3. Установка и настройка

# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

 

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/samba.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile /var/run/slapd/slapd.args

###################################################################
# loglevel # Logging description

loglevel 256

# Where the dynamically loaded modules are stored
modulepath /usr/lib/ldap
moduleload back_bdb

# The maximum number of entries that is returned for a search operation
sizelimit 500

# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend bdb
checkpoint 512 30

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database bdb

# The base of your directory in database #1
suffix "dc=MYDOMAIN"

# Where the database file are physically stored for database #1
directory "/var/lib/ldap"

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500

# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500

# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index objectClass eq

# Save the time that the entry gets modified, for database #1
lastmod on

# users can authenticate and change their password
access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdMustChange
by dn="cn=admin,dc=MYDOMAIN" write
by self write
by anonymous auth
by * none

# The admin dn has full write access, everyone else
# can read everything.
access to *
by dn="cn=admin,dc=MYDOMAIN" write
by * read

# Global parameters
[global]
wins support = no
protocol = NT1
name resolve order = lmhosts host bcast
dns proxy = no
dos charset = CP866
unix charset = UTF-8
display charset = UTF-8
workgroup = MYDOMAIN
server string = linserver Server
netbios name = LINSERVER
netbios aliases = linserver
security = users
map acl inherit = yes
inherit acls = yes
inherit permissions = yes
encrypt passwords = yes
null passwords = yes
enable privileges = yes

 

passdb backend = ldapsam:ldap://127.0.0.1
idmap backend = ldap:ldap://127.0.0.1
ldap admin dn = cn=admin,dc=mydomain
ldap suffix = dc=mydomain
ldap machine suffix = ou=Computers
ldap user suffix = ou=Users
ldap group suffix = ou=Groups
ldap passwd sync = yes
ldap delete dn = yes
ldap passwd sync = yes
ldap ssl = no

preferred master = yes
domain master = no
domain logons = yes

logon path =
logon drive = Z:
logon home = \\%L\SYSVOL\users\%U

add machine script = /usr/sbin/smbldap-useradd -t 0 -w "%u"
add user script = /usr/sbin/smbldap-useradd -m "%u"
delete user script = /usr/sbin/smbldap-userdel "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'

interfaces = 127.0.0.0/8 eth0
hosts allow = 127.0.0.1 192.168.0.0/255.255.255.0
hosts deny = ALL
map to guest = Bad User
guest account = nobody
log file = /var/log/samba/log.%m
max log size = 500 # in Kb
log level = 5
socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192
socket address = 127.0.0.1 192.168.0.2

printing = cups
load printers = yes

####### MAIL THE ADMIN A BACKTRACE
panic action = /usr/share/samba/panic-action %d

[homes]
comment = Home Directories
guest ok = No
browseable = No
create mask = 0644
directory mask = 0775
writeable = yes
inherit permissions = Yes

[profiles]
path = /home/SYSVOL/profiles
comment = User Profiles
guest ok = Yes
browseable = No
create mask = 0600
directory mask = 0700
writeable = Yes
profile acls = Yes
csc policy = disable
force user = %U
valid users = %U @"Domain Admins"

[netlogon]
comment = User Netlogon
path = /home/SYSVOL/netlogon
browseable = No
write list = MYDOMAIN@"Domain Admins"

[IPC$]
# IPC необходимо для нормальной работы Windows-домена:
# browse network, browse folder и прочее.
path = /tmp
hosts allow = 192.168.0.0/24, 127.0.0.1
hosts deny = 0.0.0.0/0

# Закоментировать следующую строку
#account required pam_unix.so

 

# и добавить две строки
account sufficient pam_ldap.so
account required pam_unix.so try_first_pass

# Закоментировать следующую строку
#auth required pam_unix.so nullok_secure

 

# и добавить две строки
auth sufficient pam_ldap.so
auth required pam_unix.so nullok_secure use_first_pass

# Закоментировать следующую строку
#password required pam_unix.so nullok obscure min=4 max=8 md5

 

# и добавить две строки
password sufficient pam_ldap.so
password required pam_unix.so nullok obscure min=4 max=8 md5 use_first_pass