1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
|
!==
!== Solaris-Winbind-HOWTO.txt
!==
Contributors: Naag Mummaneni <getnag@rediffmail.com>
Updated: May 2, 2002
Status: Current
Subject: Installing and Configuring Winbind on Solaris
=============================================================================
Installation and Configuration of Winbind on Solaris.
-----------------------------------------------------
This HOWTO describes how to get winbind services up and running to control
access and authenticate users on your Solaris box using the winbind services
which come with SAMBA 2.2.x latest CVS Checkout.Make sure you are using the
latest Samba 2.2.x cvs checkout as other versions come with a lots of bugs
regarding winbind .And even the Latest Samba Stable Release is also not an
exception to this.
Introduction
------------
This HOWTO describes the procedures used to get winbind up and running on a
Solaris system. Winbind is capable of providing access and authentication
control for Windows Domain users through an NT or Win2K PDC for 'regular'
services, such as telnet and ftp, as well for SAMBA services.
Why should I to this?
This allows the SAMBA administrator to rely on the authentication mechanisms
on the NT/Win2K PDC for the authentication of domain members. NT/Win2K users
no longer need to have separate accounts on the SAMBA server.
Who should be reading this document?
This HOWTO is designed for system administrators. If you are implementing
SAMBA on a file server and wish to (fairly easily) integrate existing
NT/Win2K users from your PDC onto the SAMBA server, this HOWTO is for you.
Requirements
------------
If you have a samba configuration file that you are currently using... BACK
IT UP! If your system already uses PAM, back up the /etc/pam.conf file ! If
you haven't already made a boot disk, MAKEONE NOW! Messing with the pam
configuration file can make it nearly impossible to log in to yourmachine.
That's why you want to be able to boot back into your machine in single user
mode and restore your /etc/pam.conf back to the original state they were in
if you get frustrated with the way things are going. ;-) Please refer to the
main SAMBA web page or, better yet, your closest SAMBA mirror site for
instructions on downloading the source code of Samba 2.2.x from the SAMBA
CVS repository. To allow Domain users the ability to access SAMBA shares and
files, as well as potentially other services provided by your SAMBA machine,
PAM (pluggable authentication modules) must be setup properly on your
machine. In order to compile the winbind modules, you should have at least
the pam libraries resident on your system. Solaris 7/8 has its pam modules
coming with the distribution itself.
Testing Things Out
------------------
Before starting, it is probably best to kill off all the SAMBA related
daemons running on your server. Kill off all smbd, nmbd, and winbindd
processes that may be running.
Configure and compile SAMBA
---------------------------
The configuration and compilation of SAMBA is pretty straightforward. The
first three steps may not be necessary depending upon whether or not you
have previously built the Samba binaries.
root# autoconf
root# make clean
root# rm config.cache
root# ./configure --with-winbind --with-pam
root# make
root# make install
This will, by default, install SAMBA in /usr/local/samba. See the main SAMBA
documentation if you want to install SAMBA somewhere else. It will also
build the winbindd executable and libraries.
Configure nsswitch.conf and the winbind libraries
-------------------------------------------------
The libraries needed to run the winbindd daemon through nsswitch need to be
copied to their proper locations, so
root# cp ../samba/source/nsswitch/libnss_winbind.so /usr/lib
I also found it necessary to make the following symbolic links:
root# ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1
root# ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.2
root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1
root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2
Now, as root you need to edit /etc/nsswitch.conf to allow user and group
entries to be visible from the winbindd daemon. My /etc/nsswitch.conf file
look like this after editing:
passwd: files winbind
group: files winbind
Configure smb.conf
------------------
Several parameters are needed in the smb.conf file to control the behavior
of winbindd. Configure smb.conf These are described in more detail in the
winbindd(8) man page. My smb.conf file was modified to include the following
entries in the [global] section:
[global]
<...>
# The previous documentation says to
# as the "winbind seperator " directive also but
# it is no longer supported.
# use uids from 10000 to 20000 for domain users
winbind uid = 10000-20000
# use gids from 10000 to 20000 for domain groups
winbind gid = 10000-20000
# allow enumeration of winbind users and groups
winbind enum users = yes
winbind enum groups = yes
# give winbind users a real shell (only needed if
# they have telnet access)
template homedir = /home/winnt/%D/%U
template shell = /bin/bash
Join the SAMBA server to the PDC domain
---------------------------------------
Enter the following command to make the SAMBA server join the PDC domain,
where DOMAIN is the name of your Windows domain and Administrator is a
domain user who has administrative privileges in the domain.
root# /usr/local/samba/bin/smbpasswd -j DOMAIN -r PDC -U Administrator
The proper response to the command should be: "Joined the domain DOMAIN"
where DOMAIN is your DOMAIN name.
Start up the winbindd daemon and test it!
Eventually, you will want to modify your smb startup script to automatically
invoke the winbindd daemon when the other parts of SAMBA start, but it is
possible to test out just the winbind portion first. To start up winbind
services, enter the following command as root:
root# /usr/local/samba/bin/winbindd
I'm always paranoid and like to make sure the daemon is really running...
root# ps -ae | grep winbindd
This command should produce output like this, if the daemon is running
3025 ? 00:00:00 winbindd
Now... for the real test, try to get some information about the users on
your PDC
root# /usr/local/samba/bin/wbinfo -u
This should echo back a list of users on your Windows users on your PDC. For
example, I get the following response:
CEO\Administrator
CEO\burdell
CEO\Guest
CEO\jt-ad
CEO\krbtgt
CEO\TsInternetUser
root# /usr/local/samba/bin/wbinfo -g
CEO\Domain Admins
CEO\Domain Users
CEO\Domain Guests
CEO\Domain Computers
CEO\Domain Controllers
CEO\Cert Publishers
CEO\Schema Admins
CEO\Enterprise Admins
CEO\Group Policy Creator Owners
The function 'getent' can now be used to get unified lists of both local and
PDC users and groups. Try the following command:
root# getent passwd
You should get a list that looks like your /etc/passwd list followed by the domain users with their new
uids, gids, home directories and default shells.
The same thing can be done for groups with the command
root# getent group
Fix the /etc/rc.d/init.d/samba.server startup files The winbindd daemon
needs to start up after the smbd and nmbd daemons are running. To accomplish
this task, you need to modify the /etc/init.d/samba.server script to add
commands to invoke this daemon in the proper sequence. My
/etc/init.d/samba.server file starts up smbd, nmbd, and winbindd from the
/usr/local/samba/bin directory directly.
##
## samba.server
##
if [ ! -d /usr/bin ]
then # /usr not mounted
exit
fi
killproc() { # kill the named process(es)
pid=`/usr/bin/ps -e |
/usr/bin/grep -w $1 |
/usr/bin/sed -e 's/^ *//' -e 's/ .*//'`
[ "$pid" != "" ] && kill $pid
}
# Start/stop processes required for samba server
case "$1" in
'start')
#
# Edit these lines to suit your installation (paths, workgroup, host)
#
echo Starting SMBD
/usr/local/samba/bin/smbd -D -s \
/usr/local/samba/smb.conf
echo Starting NMBD
/usr/local/samba/bin/nmbd -D -l \
/usr/local/samba/var/log -s /usr/local/samba/smb.conf
echo Starting Winbind Daemon
/usr/local/samba/bin/winbindd
;;
'stop')
killproc nmbd
killproc smbd
killproc winbindd
;;
*)
echo "Usage: /etc/init.d/samba.server { start | stop }"
;;
esac
If you restart the smbd, nmbd, and winbindd daemons at this point, you
should be able to connect to the samba server as a domain member just as if
you were a local user.
Configure Winbind and PAM
-------------------------
If you have made it this far, you know that winbindd and samba are working
together. If you want to use winbind to provide authentication for other
services, keep reading. The pam configuration file need to be altered in
this step. (Did you remember to make backups of your original /etc/pam.conf
file? If not, do it now.) You will need a pam module to use winbindd with
these other services. This module will be compiled in the ../source/nsswitch
directory by default when we used ./configure --with-pam option.
root# make nsswitch/pam_winbind.so
from the ../source directory. The pam_winbind.so file should be copied to
the location of your other pam security modules. On my Solaris 8, this was
the /usr/lib/security directory.
root# cp ../samba/source/nsswitch/pam_winbind.so /usr/lib/security
The /etc/pam.conf need to be changed. I changed this file so that my Domain
users can logon both locally as well as telnet.The following are the changes
that I made.You can customize the pam.conf file as per your requirements,but
be sure of those changes because in the worst case it will leave your system
nearly impossible to boot.
#
#ident "@(#)pam.conf 1.14 99/09/16 SMI"
#
# Copyright (c) 1996-1999, Sun Microsystems, Inc.
# All Rights Reserved.
#
# PAM configuration
#
# Authentication management
#
login auth required /usr/lib/security/pam_winbind.so
login auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
login auth required /usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass
#
rlogin auth sufficient /usr/lib/security/pam_winbind.so
rlogin auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
rlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
#
dtlogin auth sufficient /usr/lib/security/pam_winbind.so
dtlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
#
rsh auth required /usr/lib/security/$ISA/pam_rhosts_auth.so.1
other auth sufficient /usr/lib/security/pam_winbind.so
other auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
#
# Account management
#
login account sufficient /usr/lib/security/pam_winbind.so
login account requisite /usr/lib/security/$ISA/pam_roles.so.1
login account required /usr/lib/security/$ISA/pam_unix.so.1
#
dtlogin account sufficient /usr/lib/security/pam_winbind.so
dtlogin account requisite /usr/lib/security/$ISA/pam_roles.so.1
dtlogin account required /usr/lib/security/$ISA/pam_unix.so.1
#
other account sufficient /usr/lib/security/pam_winbind.so
other account requisite /usr/lib/security/$ISA/pam_roles.so.1
other account required /usr/lib/security/$ISA/pam_unix.so.1
#
# Session management
#
other session required /usr/lib/security/$ISA/pam_unix.so.1
#
# Password management
#
#other password sufficient /usr/lib/security/pam_winbind.so
other password required /usr/lib/security/$ISA/pam_unix.so.1
dtsession auth required /usr/lib/security/$ISA/pam_unix.so.1
#
# Support for Kerberos V5 authentication (uncomment to use Kerberos)
#
#rlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#login auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#dtlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#other auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#dtlogin account optional /usr/lib/security/$ISA/pam_krb5.so.1
#other account optional /usr/lib/security/$ISA/pam_krb5.so.1
#other session optional /usr/lib/security/$ISA/pam_krb5.so.1
#other password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
I also added a try_first_pass line after the winbind.so line to get rid of
annoying double prompts for passwords.
Now restart your Samba & try connecting through your application that you
configured in the pam.conf.
!==
!== end of Solaris-Winbind-HOWTO.txt
!==
|