8119l1.txt0100664000175300003300000000243410244653174011455 0ustar jillljeditListing 1. The slapd.conf file includes important settings for running LDAP securely. # slapd.conf # schemas to use include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/redhat/autofs.schema # database definition database ldbm suffix "dc=foo,dc=com" rootdn "cn=Manager,dc=foo,dc=com" # Cleartext passwords, especially for the rootdn, # should be avoided. Use strong authentication. #rootpw secret rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxx directory /var/lib/ldap # Indices to maintain for this database index objectClass,uid,uidNumber,gidNumber, memberUid eq index cn,mail,surname,givenname eq,subinitial index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq # Users can authenticate and change their password access to attrs=userPassword,sambaNTPassword, sambaLMPassword by dn="cn=Manager,dc=foo,dc=com" write by self write by anonymous auth by * none # All other attributes are readable to everybody access to * by self write by dn="cn=Manager,dc=foo,dc=com" write by * read 8119l2.txt0100664000175300003300000000102410244653225011445 0ustar jillljeditListing 2. LDAP distinguished names are organized into a tree of organizational units. + dc=foo,dc=com |- ou=People Persons | |- ou=contacts,ou=people Email contacts |- ou=Groups System groups |- ou=auto.master Automount master map |- ou=auto.home Automount map |- ou=auto.misc Automount map |- ou=Computers Samba domain members |- cn=NextFreeUnixId Samba Next Free ID |- SambaDomainName Samba domain info object class 8119l3.txt0100664000175300003300000000075110244653271011455 0ustar jillljeditListing 3. Create the top of the LDAP tree, top.ldif, manually in the simple key: value LDIF format. dn: dc=foo,dc=com objectClass: dcObject objectClass: organization o: Foo Company dc: foo dn:ou=People,dc=foo,dc=com objectClass: organizationalUnit ou: People dn:ou=Groups,dc=foo,dc=com objectClass: organizationalUnit ou: Groups dn:ou=contacts,ou=people,dc=foo,dc=com associatedDomain: foo.com ou: contacts ou: people objectClass: organizationalUnit objectClass: domainRelatedObject 8119l4.txt0100664000175300003300000000173310244653335011460 0ustar jillljeditListing 4. A user login entry contains the password information needed to log in, along with Samba configuration. dn:uid=gomerp,ou=People,dc=foo,dc=com uid: gomerp cn: Gomer Pyle sn: Pyle givenname: Gomer mail: gomer.pyle@foo.com objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSAMAccount uidNumber: 5000 homeDirectory: /h/gomerp loginShell: /bin/bash description: Gomer Pyle displayName: Gomer Pyle gecos: Gomer Pyle gidNumber: 513 userPassword: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaSID: S-1-5-21-1400792368-3813960858-1703501993-11000 sambaPrimaryGroupSID: S-1-5-21-1400792368-3813960858-1703501993-513 sambaLogonScript: gomerp.cmd sambaHomeDrive: H: sambaHomePath: \\LDAPSERVER\gomerp sambaLMPassword: XXXXXXXXXX sambaAcctFlags: [U] sambaNTPassword: XXXXXXXXXX sambaPwdLastSet: 1097240543 sambaPwdMustChange: 1105016543 8119l5.txt0100664000175300003300000000206710244653413011457 0ustar jillljeditListing 5. Excerpts from a Samba smb.conf file configured to work with the OpenLDAP directory. [global] ... obey pam restrictions = No ldap passwd sync = Yes ldap passwd sync = Yes ... passdb backend = ldapsam:ldap://ldapserver.foo.com/ ldap admin dn = cn=Manager,dc=foo,dc=com ldap suffix = dc=foo,dc=com ldap group suffix = ou=Groups ldap user suffix = ou=People ldap machine suffix = ou=Computers ldap idmap suffix = ou=People ldap ssl = no add user script = \ /usr/local/sbin/smbldap-useradd -m "%u" ldap delete dn = Yes delete user script = \ /usr/local/sbin/smbldap-userdel "%u" add machine script = \ /usr/local/sbin/smbldap-useradd -w "%u" add group script = \ /usr/local/sbin/smbldap-groupadd -p "%g" delete group script = \ /usr/local/sbin/smbldap-groupdel "%g" add user to group script = \ /usr/local/sbin/smbldap-groupmod -m "%u" "% g" delete user from group script = \ /usr/local/sbin/smbldap-groupmod -x "% u" "%g" set primary group script = \ /usr/local/sbin/smbldap-usermod -g "%g" "%u " 8119l6.txt0100664000175300003300000000170410244653462011461 0ustar jillljeditListing 6. The smbldap-populate tool automatically adds the accounts required to make your OpenLDAP server work with Samba. [root]# smbldap-populate Using builtin directory structure adding new entry: dc=foo,dc=com adding new entry: ou=Users,dc=foo,dc=com adding new entry: ou=Groups,dc=foo,dc=com adding new entry: ou=Computers,dc=foo,dc=com adding new entry: ou=Idmap,dc=foo,dc=org adding new entry: cn=NextFreeUnixId,dc=foo,dc=org adding new entry: uid=Administrator,ou=Users,dc=foo,dc=com adding new entry: uid=nobody,ou=Users,dc=foo,dc=com adding new entry: cn=Domain Admins,ou=Groups,dc=foo,dc=com adding new entry: cn=Domain Users,ou=Groups,dc=foo,dc=com adding new entry: cn=Domain Guests,ou=Groups,dc=foo,dc=com adding new entry: cn=Print Operators,ou=Groups,dc=foo,dc=com adding new entry: cn=Backup Operators,ou=Groups,dc=foo,dc=com adding new entry: cn=Replicator,ou=Groups,dc=foo,dc=com adding new entry: cn=Domain Computers,ou=Groups,dc=foo,dc=com