====== Instalación LDAP+SMB 3.4 en Debian Lenny ====== ===== Descripción ===== Instalación LDAP+SMB 3.4 en Debian Lenny ===== Prerequistos ===== Un servidor debian Lenny ===== Procedimiento ===== Using LDAP is one of a good solution for single user database within networking hybrid system, e.g. integrate both user login for Windows and Linux, for email services, for web logon, and so on. This HOWTO will guide you though a basic system setup, including Samba PDC and PAM/NSS with LDAP on Debian Lenny. You can further more extend the use of LDAP to other system/platform with this setup.**** ==== Prepare Debian Lenny ==== **** Before start I will assume you have a functional Debian Lenny setup. If you have any question please refer to my  [[http://edin.no-ip.com/content/fast-and-safe-upgrade-debian-lenny|mini-HOWTO for upgrade Debian as Lenny]]. It is also recommended to install your system with a function xorg. This can be complete with  ''%%tasksel --new-install%%''  where choose both  **Desktop environment**  and **Standard system**. You should also click  **manual package selection**  in order to verify your installation before start. Next, install all required package. You can skip all configuration during installation, soon we will come back for it: Se agrega repositorio de Squeeze\\ deb http:%%//%%ftp.de.debian.org/debian squeeze main\\ apt-get update   ''%%apt-get updateapt-get install apache2-suexec libapache2-mod-php5 php5 php5-cli php5-curl php5-gd php5-imap php5-ldap php5-mcrypt php5-mhash php5-sqlite php5-tidy php5-xmlrpc php-pear slapd mcrypt ldap-utils libgd-tools apache2-doc libpam-ldap libnss-ldap resolvconf samba swat smbclient smbfs smbldap-tools%%'' Moreover, if you hope to use Samba as file server, your  ''%%/etc/fstab%%''  may also need update with  ''%%user_xattr%%''  and  ''%%acl%%''  support. It is also a good idea to replace  ''%%defaults%%'' with  ''%%relatime%%''  (clone from Ubuntu 9.04). For example: ''%%/dev/sda3       /               ext3    relatime,user_xattr,acl,errors=remount-ro 0       1/dev/sda1       /boot           ext3    relatime,user_xattr,acl 0       2/dev/sda2       none            swap    sw              0       0%%'' **** ==== Configure slapd ==== **** Run  ''%%dpkg-reconfigure slapd%%''  and initialize slapd with following parameters: * Omit OpenLDAP[[http://localhost/cgi-bin/twiki/edit/Main/OpenLDAP?topicparent=Main.ControladorDeDominioLDAPEnDebian|?]] server configuration? No * DNS domain name: example.com * Organization name: example.com * Administrator password: CHANGE * Database backend to use: HDB * Do you want the database to be removed when slapd is purged? No * Allow LDAPv2 protocol? No Backup you initialize LDAP database with following command: ''%%slapcat > ~/slapd.ldif%%'' Now, prepare the LDAP schema for Samba: ''%%cp /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz /etc/ldap/schema/samba.schema.gzgunzip%%'' ''%%-d /etc/ldap/schema/samba.schema.gzrm -rf /etc/ldap/schema/samba.schema.gz%%'' Generate your rootdn password with MD5: ''%%slappasswd -h {MD5}%%'' Now copy and replace your /etc/ldap/slapd.conf with my version, and further more customize it according to your setup: ''%%# This is the main slapd configuration file. See slapd.conf(5) for more# info on the configuration options.######################################################################## Global Directives:# Features to permit#allow bind_v2# Schema and objectClass definitionsinclude         /etc/ldap/schema/core.schemainclude         /etc/ldap/schema/cosine.schemainclude         /etc/ldap/schema/nis.schemainclude         /etc/ldap/schema/inetorgperson.schemainclude         /etc/ldap/schema/samba.schema# Where the pid file is put. The init.d script# will not stop the server if you change this.pidfile         /var/run/slapd/slapd.pid# List of arguments that were passed to the serverargsfile        /var/run/slapd/slapd.args# Read slapd.conf(5) for possible valuesloglevel        none# Where the dynamically loaded modules are storedmodulepath /usr/lib/ldapmoduleload back_hdb# The maximum number of entries that is returned for a search operationsizelimit 500# The tool-threads parameter sets the actual amount of cpu's that is used# for indexing.tool-threads 1######################################################################## Specific Backend Directives for hdb:# Backend specific directives apply to this backend until another# 'backend' directive occursbackend hdb######################################################################## Specific Backend Directives for 'other':# Backend specific directives apply to this backend until another# 'backend' directive occurs#backend ######################################################################## Specific Directives for database #1, of type hdb:# Database specific directives apply to this databasse until another# 'database' directive occursdatabase        hdb# The base of your directory in database #1suffix          "dc=example,dc=com" [Cambiar]CN del dominio[/Cambiar]# rootdn directive for specifying a superuser on the database. This is needed# for syncrepl.rootdn          "cn=admin,dc=example,dc=com" [Cambiar]CN del root del dominio%%'' ''%%rootpw          {MD5} [CAMBIAR] Código MD5 de la contraseña [/CAMBIAR]# Where the database file are physically stored for database #1directory       "/var/lib/ldap"# The dbconfig settings are used to generate a DB_CONFIG file the first# time slapd starts.  They do NOT override existing an existing DB_CONFIG# file.  You should therefore change these settings in DB_CONFIG directly# or remove DB_CONFIG and restart slapd for changes to take effect.# For the Debian package we use 2MB as default but be sure to update this# value if you have plenty of RAMdbconfig set_cachesize 0 2097152 0# Sven Hartge reported that he had to set this value incredibly high# to get slapd running at all. See  http://bugs.debian.org/303057  for more# information.# Number of objects that can be locked at the same time.dbconfig set_lk_max_objects 1500# Number of locks (both requested and granted)dbconfig set_lk_max_locks 1500# Number of lockersdbconfig set_lk_max_lockers 1500# Indices to maintain for this databaseindex objectClass                       eq,presindex ou,cn,sn,mail,givenname           eq,pres,subindex uidNumber,gidNumber,memberUid     eq,presindex loginShell                        eq,pres## required to support pdb_getsampwnamindex uid                               pres,sub,eq## required to support pdb_getsambapwrid()index displayName                       pres,sub,eqindex nisMapName,nisMapEntry            eq,pres,subindex sambaSID                          eqindex sambaPrimaryGroupSID              eqindex sambaDomainName                   eqindex default                           subindex uniqueMember                      eqindex sambaGroupType                    eqindex sambaSIDList                      eq# Save the time that the entry gets modified, for database #1lastmod         on# Checkpoint the BerkeleyDB? database periodically in case of system# failure and to speed slapd shutdown.checkpoint      512 30# Where to store the replica logs for database #1# replogfile /var/lib/ldap/replog# users can authenticate and change their passwordaccess to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdMustChange,sambaPwdLastSet        by self write        by anonymous auth        by 10_consejos_para_la_resolucion_de_problemas.html acta_de_constitucion_interna_del_proyecto.html active_directory.html administrar_servidores_con_ipmi.html admin_rpms_con_yum.html albasoftware_libre_de_gestion_educativa.html alta_disponibilidad_de_conexion_a_internet.html ansible_administracion_centralizada_de_servidores.html anti_virusanti_spam_y_hardening_de_correo2024.html anti_virusanti_spam_y_hardening_de_correo.html apache2_mod_security.html apacheservidor_de_www.html aplicativos_usando_ldap.html autoconf.html aws_amazon_ec2.html aws_amazon_lambda.html bacula_backup2024.html bacula_backup.html bandwidthd.html bind_dns.html bonding.html cacti.html cambio_contrasena_ldap_ad_por_web.html cambios_recientes.html caracteres_octal_hexa_unicode_html.html centos_sobre_hyperv.html cfengine.html chumne_administrador_de_licencias.html ciclo_de_pruebas_orfeo.html cluster_con_haproxy.html cluster_ldap.html colaborador_del_mes.html comision_de_proyectos_obsoleto.html como_desplegar_remoto_con_un_tunel_ssh.html como_hacer_manual_de_funciones.html como_instalar_spoon.html como_limpiar_cache_dns.html como_publicar_docs.html como_reportar_spam.html como_se_implementa_orfeo_sgd.html compensatorios_obsoleto.html condiciones_generales_de_contrato_de_soporte_v14.html configuracion_de_tomcat_como_modulo_de_apache.html configuracion_de_x_lite_cliente_sip.html configuracion_pidgin.html configuracion_planta_telefonica_voip.html configurar_redes.html consola_serial.html consul_open_participation_ruby.html controlador_de_dominio_secundario_samba4.html convertir_pdf_a_a_pdf_plano.html copiar_disco_por_la_red.html cpanel.html crack_de_wep_con_aircrack_ng.html creacion_servidor_codema.html creacion_usuario_postgres_solo_para_consultas.html crear_instalador_de_windows_facil_con_nsis.html crear_instancias_de_orfeong.html crear_paquetes_deb_y_rpm.html crear_repositorios_de_paquetes_deb_y_rpm.html cuestionario_de_severidad.html cups.html cygwn.html dd_wrt.html declaracion_de_trabajo_sow.html deploy_instancia_de_orfeo_express_5x_en_amazon.html deploy_instancia_de_orfeo_express_6x_en_amazon.html descargar_pagina_web_recursivo.html deshabilite_ipv6.html dhcp_multiples_vlans.html dhcp_server.html dhcp_y_dns_dinamico.html directrices_de_manejo_de_tiquetes_en_mesa_de_ayuda_glpi.html docker.html documentacion_de_codigo.html documentos_de_implementacion_de_orfeo_5x.html documentos_estandar_control_proyectos_desarrollo.html dotproject.html drbd.html drp_plan_de_recuperacion_de_desastres.html dsl_personalizacion.html egroupware_ex_phpgw.html ejabberd.html elastix.html enigmail.html enlightenment.html entidad_de_certificacion_a_mano.html entidad_de_certificacion.html entidad_de_certificacion_openca.html envio_y_recepcion_de_fax_en_asterisk.html errores_modelos.html esquema_backup_ikatta.html estandar_bitacora.html estandar_comunicaciones_por_correo_electronico.html estandar_de_archivos_y_directorios.html estandar_de_interfaz_para_proyectos_de_desarrollo.html estandar_de_manejo_de_cronograma.html estandar_de_revision_de_documentos.html estandar_de_soporte_y_mantenimiento_de_skinatech.html estandares_de_comunicacion_de_soporte.html estandar_estacion_de_trabajo_gnu_linux.html estandar_estacion_de_trabajo_ms_windows.html estandar_firma_skina.html estandar_para_interfaz_de_proyectos_de_desarrollo.html estandar_para_la_creacion_de_bases_de_dato.html example_howto.html exim_mta.html extraccion_de_texto_de_documentos.html fail2ban.html falla_laboral.html fax_server.html fink.html firewalld.html firewall_skina_howto.html flujo_de_trabajo_de_proyecto.html flujo_de_trabajo_de_proyecto_trello.html formatos_de_documentos_estandares_de_skinatech.html freenas.html freenx.html freetds.html ftpproxy.html generar_diccionarios_de_datos_en_workbench.html getfacl_y_setfacl.html getmenu2.html gforge.html git_flow.html git.html gitlab.html glassfish.html glpi10.html glpi95.html gnokii.html gnupg_gpg.html google_cloud_platform.html graylog_consolidador_de_bitacoras.html grub.html hacer_modelo_y_o_backup.html hardening_de_linux.html hearbeat_cluster.html hipergate.html hispaniola_firewall_ikatta.html horario_de_trabajo.html how_to_enviar_html_imagenes_con_php5.html howto.html howto_mon.html howto_php_nuke.html huawei_e220.html ibm_aix_snmp_setup_for_nagios.html ibm_db2.html ids_logchecklogwatchtripwireaideetc.html ilo2_e_ilo3.html implementacion_de_oauth2_google_en_orfeo_ng.html implementacion_de_oauth2_microsoft_en_orfeo_ng.html implementacion_glpi.html indicadores_de_gestion.html informes_semanales.html informix_apache_php.html infraestructura_de_operacion.html instalacion_asterisk_en_.html instalacion_de_modelo_de_servidor.html instalacion_ldap_smb_34_en_debian_lenny.html none# those 2 parameters must be world readable for password aging to work correctly# (or use a priviledge account in /etc/ldap.conf to bind to the directory)access to attrs=shadowLastChange,shadowMax        by self write        by 10_consejos_para_la_resolucion_de_problemas.html acta_de_constitucion_interna_del_proyecto.html active_directory.html administrar_servidores_con_ipmi.html admin_rpms_con_yum.html albasoftware_libre_de_gestion_educativa.html alta_disponibilidad_de_conexion_a_internet.html ansible_administracion_centralizada_de_servidores.html anti_virusanti_spam_y_hardening_de_correo2024.html anti_virusanti_spam_y_hardening_de_correo.html apache2_mod_security.html apacheservidor_de_www.html aplicativos_usando_ldap.html autoconf.html aws_amazon_ec2.html aws_amazon_lambda.html bacula_backup2024.html bacula_backup.html bandwidthd.html bind_dns.html bonding.html cacti.html cambio_contrasena_ldap_ad_por_web.html cambios_recientes.html caracteres_octal_hexa_unicode_html.html centos_sobre_hyperv.html cfengine.html chumne_administrador_de_licencias.html ciclo_de_pruebas_orfeo.html cluster_con_haproxy.html cluster_ldap.html colaborador_del_mes.html comision_de_proyectos_obsoleto.html como_desplegar_remoto_con_un_tunel_ssh.html como_hacer_manual_de_funciones.html como_instalar_spoon.html como_limpiar_cache_dns.html como_publicar_docs.html como_reportar_spam.html como_se_implementa_orfeo_sgd.html compensatorios_obsoleto.html condiciones_generales_de_contrato_de_soporte_v14.html configuracion_de_tomcat_como_modulo_de_apache.html configuracion_de_x_lite_cliente_sip.html configuracion_pidgin.html configuracion_planta_telefonica_voip.html configurar_redes.html consola_serial.html consul_open_participation_ruby.html controlador_de_dominio_secundario_samba4.html convertir_pdf_a_a_pdf_plano.html copiar_disco_por_la_red.html cpanel.html crack_de_wep_con_aircrack_ng.html creacion_servidor_codema.html creacion_usuario_postgres_solo_para_consultas.html crear_instalador_de_windows_facil_con_nsis.html crear_instancias_de_orfeong.html crear_paquetes_deb_y_rpm.html crear_repositorios_de_paquetes_deb_y_rpm.html cuestionario_de_severidad.html cups.html cygwn.html dd_wrt.html declaracion_de_trabajo_sow.html deploy_instancia_de_orfeo_express_5x_en_amazon.html deploy_instancia_de_orfeo_express_6x_en_amazon.html descargar_pagina_web_recursivo.html deshabilite_ipv6.html dhcp_multiples_vlans.html dhcp_server.html dhcp_y_dns_dinamico.html directrices_de_manejo_de_tiquetes_en_mesa_de_ayuda_glpi.html docker.html documentacion_de_codigo.html documentos_de_implementacion_de_orfeo_5x.html documentos_estandar_control_proyectos_desarrollo.html dotproject.html drbd.html drp_plan_de_recuperacion_de_desastres.html dsl_personalizacion.html egroupware_ex_phpgw.html ejabberd.html elastix.html enigmail.html enlightenment.html entidad_de_certificacion_a_mano.html entidad_de_certificacion.html entidad_de_certificacion_openca.html envio_y_recepcion_de_fax_en_asterisk.html errores_modelos.html esquema_backup_ikatta.html estandar_bitacora.html estandar_comunicaciones_por_correo_electronico.html estandar_de_archivos_y_directorios.html estandar_de_interfaz_para_proyectos_de_desarrollo.html estandar_de_manejo_de_cronograma.html estandar_de_revision_de_documentos.html estandar_de_soporte_y_mantenimiento_de_skinatech.html estandares_de_comunicacion_de_soporte.html estandar_estacion_de_trabajo_gnu_linux.html estandar_estacion_de_trabajo_ms_windows.html estandar_firma_skina.html estandar_para_interfaz_de_proyectos_de_desarrollo.html estandar_para_la_creacion_de_bases_de_dato.html example_howto.html exim_mta.html extraccion_de_texto_de_documentos.html fail2ban.html falla_laboral.html fax_server.html fink.html firewalld.html firewall_skina_howto.html flujo_de_trabajo_de_proyecto.html flujo_de_trabajo_de_proyecto_trello.html formatos_de_documentos_estandares_de_skinatech.html freenas.html freenx.html freetds.html ftpproxy.html generar_diccionarios_de_datos_en_workbench.html getfacl_y_setfacl.html getmenu2.html gforge.html git_flow.html git.html gitlab.html glassfish.html glpi10.html glpi95.html gnokii.html gnupg_gpg.html google_cloud_platform.html graylog_consolidador_de_bitacoras.html grub.html hacer_modelo_y_o_backup.html hardening_de_linux.html hearbeat_cluster.html hipergate.html hispaniola_firewall_ikatta.html horario_de_trabajo.html how_to_enviar_html_imagenes_con_php5.html howto.html howto_mon.html howto_php_nuke.html huawei_e220.html ibm_aix_snmp_setup_for_nagios.html ibm_db2.html ids_logchecklogwatchtripwireaideetc.html ilo2_e_ilo3.html implementacion_de_oauth2_google_en_orfeo_ng.html implementacion_de_oauth2_microsoft_en_orfeo_ng.html implementacion_glpi.html indicadores_de_gestion.html informes_semanales.html informix_apache_php.html infraestructura_de_operacion.html instalacion_asterisk_en_.html instalacion_de_modelo_de_servidor.html instalacion_ldap_smb_34_en_debian_lenny.html read# all others attributes are readable to everybodyaccess to         by 10_consejos_para_la_resolucion_de_problemas.html acta_de_constitucion_interna_del_proyecto.html active_directory.html administrar_servidores_con_ipmi.html admin_rpms_con_yum.html albasoftware_libre_de_gestion_educativa.html alta_disponibilidad_de_conexion_a_internet.html ansible_administracion_centralizada_de_servidores.html anti_virusanti_spam_y_hardening_de_correo2024.html anti_virusanti_spam_y_hardening_de_correo.html apache2_mod_security.html apacheservidor_de_www.html aplicativos_usando_ldap.html autoconf.html aws_amazon_ec2.html aws_amazon_lambda.html bacula_backup2024.html bacula_backup.html bandwidthd.html bind_dns.html bonding.html cacti.html cambio_contrasena_ldap_ad_por_web.html cambios_recientes.html caracteres_octal_hexa_unicode_html.html centos_sobre_hyperv.html cfengine.html chumne_administrador_de_licencias.html ciclo_de_pruebas_orfeo.html cluster_con_haproxy.html cluster_ldap.html colaborador_del_mes.html comision_de_proyectos_obsoleto.html como_desplegar_remoto_con_un_tunel_ssh.html como_hacer_manual_de_funciones.html como_instalar_spoon.html como_limpiar_cache_dns.html como_publicar_docs.html como_reportar_spam.html como_se_implementa_orfeo_sgd.html compensatorios_obsoleto.html condiciones_generales_de_contrato_de_soporte_v14.html configuracion_de_tomcat_como_modulo_de_apache.html configuracion_de_x_lite_cliente_sip.html configuracion_pidgin.html configuracion_planta_telefonica_voip.html configurar_redes.html consola_serial.html consul_open_participation_ruby.html controlador_de_dominio_secundario_samba4.html convertir_pdf_a_a_pdf_plano.html copiar_disco_por_la_red.html cpanel.html crack_de_wep_con_aircrack_ng.html creacion_servidor_codema.html creacion_usuario_postgres_solo_para_consultas.html crear_instalador_de_windows_facil_con_nsis.html crear_instancias_de_orfeong.html crear_paquetes_deb_y_rpm.html crear_repositorios_de_paquetes_deb_y_rpm.html cuestionario_de_severidad.html cups.html cygwn.html dd_wrt.html declaracion_de_trabajo_sow.html deploy_instancia_de_orfeo_express_5x_en_amazon.html deploy_instancia_de_orfeo_express_6x_en_amazon.html descargar_pagina_web_recursivo.html deshabilite_ipv6.html dhcp_multiples_vlans.html dhcp_server.html dhcp_y_dns_dinamico.html directrices_de_manejo_de_tiquetes_en_mesa_de_ayuda_glpi.html docker.html documentacion_de_codigo.html documentos_de_implementacion_de_orfeo_5x.html documentos_estandar_control_proyectos_desarrollo.html dotproject.html drbd.html drp_plan_de_recuperacion_de_desastres.html dsl_personalizacion.html egroupware_ex_phpgw.html ejabberd.html elastix.html enigmail.html enlightenment.html entidad_de_certificacion_a_mano.html entidad_de_certificacion.html entidad_de_certificacion_openca.html envio_y_recepcion_de_fax_en_asterisk.html errores_modelos.html esquema_backup_ikatta.html estandar_bitacora.html estandar_comunicaciones_por_correo_electronico.html estandar_de_archivos_y_directorios.html estandar_de_interfaz_para_proyectos_de_desarrollo.html estandar_de_manejo_de_cronograma.html estandar_de_revision_de_documentos.html estandar_de_soporte_y_mantenimiento_de_skinatech.html estandares_de_comunicacion_de_soporte.html estandar_estacion_de_trabajo_gnu_linux.html estandar_estacion_de_trabajo_ms_windows.html estandar_firma_skina.html estandar_para_interfaz_de_proyectos_de_desarrollo.html estandar_para_la_creacion_de_bases_de_dato.html example_howto.html exim_mta.html extraccion_de_texto_de_documentos.html fail2ban.html falla_laboral.html fax_server.html fink.html firewalld.html firewall_skina_howto.html flujo_de_trabajo_de_proyecto.html flujo_de_trabajo_de_proyecto_trello.html formatos_de_documentos_estandares_de_skinatech.html freenas.html freenx.html freetds.html ftpproxy.html generar_diccionarios_de_datos_en_workbench.html getfacl_y_setfacl.html getmenu2.html gforge.html git_flow.html git.html gitlab.html glassfish.html glpi10.html glpi95.html gnokii.html gnupg_gpg.html google_cloud_platform.html graylog_consolidador_de_bitacoras.html grub.html hacer_modelo_y_o_backup.html hardening_de_linux.html hearbeat_cluster.html hipergate.html hispaniola_firewall_ikatta.html horario_de_trabajo.html how_to_enviar_html_imagenes_con_php5.html howto.html howto_mon.html howto_php_nuke.html huawei_e220.html ibm_aix_snmp_setup_for_nagios.html ibm_db2.html ids_logchecklogwatchtripwireaideetc.html ilo2_e_ilo3.html implementacion_de_oauth2_google_en_orfeo_ng.html implementacion_de_oauth2_microsoft_en_orfeo_ng.html implementacion_glpi.html indicadores_de_gestion.html informes_semanales.html informix_apache_php.html infraestructura_de_operacion.html instalacion_asterisk_en_.html instalacion_de_modelo_de_servidor.html instalacion_ldap_smb_34_en_debian_lenny.html read# For Netscape Roaming support, each user gets a roaming# profile for which they have write access to#access to dn=".,ou=Roaming,o=morsnet"#        by dn="cn=admin,dc=example,dc=com" write#        by dnattr=owner write######################################################################## Specific Directives for database #2, of type 'other' (can be hdb too):# Database specific directives apply to this databasse until another# 'database' directive occurs#database        # The base of your directory for database #2#suffix "dc=debian,dc=org"%%'' Always switch off nscd for LDAP debug: ''%%/etc/init.d/nscd stop%%'' Renew your LDAP database with following command: ''%%/etc/init.d/slapd stoprm -rf /var/lib/ldap/*slapadd -l ~/slapd.ldifslapindexchown -Rf openldap:openldap /var/lib/ldap/etc/init.d/slapd start%%'' Now verify your setup with  ''%%slapcat%%'' **** ==== Prepare Apache and PHP for phpLDAPadmin ==== **** Before install phpLDAPadmin we should give some basic configuration for Apache and PHP. Edit  ''%%/etc/php5/apache2/php.ini%%''  and change the following lines accordingly: ''%%memory_limit = 128M;post_max_size = 32Mupload_max_filesize = 32Mdate.timezone = "Asia/Hong_Kong"display_errors = Off%%'' Edit Apache default site setup with  ''%%/etc/apache2/sites-enabled/000-default%%'', and change the  ''%%AllowOverride none%%''  with  ''%%AllowOverride all%%''  as follow (note: this setup is just for non-production site): ''%%                        Options Indexes FollowSymLinks? MultiViews?                 AllowOverride? all                Order allow,deny                allow from all        %%'' Now you can restart your Apache: ''%%/etc/init.d/apache2 restart%%'' **** ==== Install phpLDAPadmin ==== **** I would like to assist my LDAP setup with phpLDAPadmin. First of all, download the package from sourceforge.net: http://phpldapadmin.sourceforge.net/wiki/index.php/Download Prepare your phpLDAPadmin: ''%%mv zxvf phpldapadmin-1.1.0.6.tar.gz /var/www/cd /var/wwwtar zxvf phpldapadmin-1.1.0.6.tar.gzln -s phpldapadmin-1.1.0.6 phpldapadmincd /var/www/phpldapadmin/config/cp config.php.example config.php%%'' Edit  ''%%/var/www/phpldapadmin/config/config.php%%''  and uncomment the following line: ''%%$ldapservers->SetValue($i,'server','host','127.0.0.1');%%'' Now access your phpLDAPadmin from  http:%%//%%localhost/phpldapadmin[[http://localhost/cgi-bin/twiki/edit////////////Phpldapadmin?topicparent=Main.ControladorDeDominioLDAPEnDebian|?]] , and login with your rootdn. Verify all setup. Si al entrar a phpldapadmin, obtiene un error de falta del Base DN, se debe intentar esto: Crear un archivo mybase.ldif   dn: dc=mydomain,dc=com [Cambiar]CN del dominio[Cambiar] objectclass: dcObject  objectclass: organization  dc: mydomain  o: mydomain  and then add the base entry with ldapadd:    ldapadd -x -f mybase.ldif -D cn=manager,dc=mydomain,dc=com -W **** ==== Prepare Samba ====   **Copy and replace your /etc/samba/smb.conf with my version:** **''%%# Samba config file created using SWAT# from UNKNOWN ()# Date: 2009/06/22 21:47:29[global]dos charset = UTF-8display charset = UTF-8workgroup = EXAMPLErealm = EXAMPLE.COMserver string = %h servermap to guest = Bad Userpassdb backend = ldapsam:ldap://127.0.0.1/pam password change = Yespasswd program = /usr/sbin/smbldap-passwd -u %upasswd chat = New*password %n\ Retype*new*password %n\ *all*authentication*tokens*updated*unix password sync = Yessyslog = 0log file = /var/log/samba/log.%mmax log size = 1000time server = Yessocket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192add user script = /usr/sbin/smbldap-useradd -m %udelete user script = /usr/sbin/smbldap-userdel %uadd group script = /usr/sbin/smbldap-groupadd -p %gdelete group script = /usr/sbin/smbldap-groupdel %gadd user to group script = /usr/sbin/smbldap-groupmod -m %u %gdelete user from group script = /usr/sbin/smbldap-groupmod -x %u %gset primary group script = /usr/sbin/smbldap-usermod -g %g %uadd machine script = /usr/sbin/smbldap-useradd -w %ulogon script = logon.batlogon path = \\\\%N\\profiles\\%Ulogon drive = U:domain logons = Yesos level = 65preferred master = Yesdomain master = Yesdns proxy = Nowins support = Yesldap admin dn = cn=admin,dc=example,dc=comldap delete dn = Yesldap group suffix = ou=groupldap idmap suffix = ou=idmapldap machine suffix = ou=computerldap suffix = dc=example,dc=comldap ssl = noldap user suffix = ou=peoplepanic action = /usr/share/samba/panic-action %dmap acl inherit = Yescase sensitive = Nohide unreadable = Yesmap hidden = Yesmap system = Yes[homes]comment = Home Directoriesvalid users = %Sread only = Nocreate mask = 0600directory mask = 0700browseable = No[printers]comment = All Printerspath = /var/spool/sambacreate mask = 0700printable = Yesbrowseable = No[print$]comment = Printer Driverspath = /var/lib/samba/printers[netlogon]path = /var/lib/samba/netlogonbrowseable = No[profiles]path = /var/lib/samba/profilesforce user = %Uread only = Nocreate mask = 0600directory mask = 0700guest ok = Yesprofile acls = Yesbrowseable = Nocsc policy = disable[public]path = /tmpread only = Noguest ok = Yes%%''** **Activación de SWAT en inetd:** **# /usr/sbin/update-inetd --verbose --enable swat\\ Processing /etc/inetd.conf\\ Processing service `swat' ... enabled** **En realidad, lo que hace es descomentar la lí­nea que corresponde en /etc/inetd.conf** ---- **Ahora se hace que el superservidor inetd relea su configuración, quedando el servicio SWAT disponible en el sistema:** ---- **Hacemos que el superservidor inetd relea su configuración** ---- **# /usr/bin/killall --verbose -HUP inetd\\ Killed inetd(3005) with signal 1 \\/etc/smbldap-tools/smbldap.confcp /usr/share/doc/smbldap-tools/examples/smbldap_bind.conf \\/etc/smbldap-tools/smbldap_bind.conf%%''** **Get your Samba SID for  ''%%/etc/smbldap-tools/smbldap.conf%%'':** **''%%net getlocalsid%%''** **Replace your  ''%%/etc/smbldap-tools/smbldap.conf%%''  with my version, and further more update according to your requirement (remember to replace the  ''%%SID%%''):** **''%%# $Source: /var/lib/twiki/data/Main/ControladorDeDominioLDAPEnDebian.txt,v $# $Id: ControladorDeDominioLDAPEnDebian.txt,v 1.1 2010/01/29 22:04:38 admin Exp $## smbldap-tools.conf : Q & D configuration file for smbldap-tools#  This code was developped by IDEALX ( http://IDEALX.org/) and#  contributors (their names can be found in the CONTRIBUTORS file).##                 Copyright (C) 2001-2002 IDEALX##  This program is free software; you can redistribute it and/or#  modify it under the terms of the GNU General Public License#  as published by the Free Software Foundation; either version 2#  of the License, or (at your option) any later version.##  This program is distributed in the hope that it will be useful,#  but WITHOUT ANY WARRANTY; without even the implied warranty of#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the#  GNU General Public License for more details.##  You should have received a copy of the GNU General Public License#  along with this program; if not, write to the Free Software#  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,#  USA.#  Purpose :#       . be the configuration file for all smbldap-tools scripts################################################################################ General Configuration################################################################################ Put your own SID. To obtain this number do: "net getlocalsid".# If not defined, parameter is taking from "net getlocalsid" returnSID="S-1-5-21-1169193956-4199179787-2206793627"# Domain name the Samba server is in charged.# If not defined, parameter is taking from smb.conf configuration file# Ex: sambaDomain="IDEALX-NT"sambaDomain="EXAMPLE"################################################################################ LDAP Configuration################################################################################ Notes: to use to dual ldap servers backend for Samba, you must patch# Samba with the dual-head patch from IDEALX. If not using this patch# just use the same server for slaveLDAP and masterLDAP.# Those two servers declarations can also be used when you have# . one master LDAP server where all writing operations must be done# . one slave LDAP server where all reading operations must be done#   (typically a replication directory)# Slave LDAP server# Ex: slaveLDAP=127.0.0.1# If not defined, parameter is set to "127.0.0.1"slaveLDAP="127.0.0.1"# Slave LDAP port# If not defined, parameter is set to "389"slavePort="389"# Master LDAP server: needed for write operations# Ex: masterLDAP=127.0.0.1# If not defined, parameter is set to "127.0.0.1"masterLDAP="127.0.0.1"# Master LDAP port# If not defined, parameter is set to "389"masterPort="389"# Use TLS for LDAP# If set to 1, this option will use start_tls for connection# (you should also used the port 389)# If not defined, parameter is set to "1"ldapTLS="0"# How to verify the server's certificate (none, optional or require)# see "man Net::LDAP" in start_tls section for more detailsverify="require"# CA certificate# see "man Net::LDAP" in start_tls section for more detailscafile="/etc/smbldap-tools/ca.pem"# certificate to use to connect to the ldap server# see "man Net::LDAP" in start_tls section for more detailsclientcert="/etc/smbldap-tools/smbldap-tools.pem"# key certificate to use to connect to the ldap server# see "man Net::LDAP" in start_tls section for more detailsclientkey="/etc/smbldap-tools/smbldap-tools.key"# LDAP Suffix# Ex: suffix=dc=IDEALX,dc=ORGsuffix="dc=example,dc=com"# Where are stored Users# Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG"# Warning: if 'suffix' is not set here, you must set the full dn for usersdnusersdn="ou=people,${suffix}"# Where are stored Computers# Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG"# Warning: if 'suffix' is not set here, you must set the full dn for computersdncomputersdn="ou=computer,${suffix}"# Where are stored Groups# Ex: groupsdn="ou=Groups,dc=IDEALX,dc=ORG"# Warning: if 'suffix' is not set here, you must set the full dn for groupsdngroupsdn="ou=group,${suffix}"# Where are stored Idmap entries (used if samba is a domain member server)# Ex: groupsdn="ou=Idmap,dc=IDEALX,dc=ORG"# Warning: if 'suffix' is not set here, you must set the full dn for idmapdnidmapdn="ou=idmap,${suffix}"# Where to store next uidNumber and gidNumber available for new users and groups# If not defined, entries are stored in sambaDomainName object.# Ex: sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"# Ex: sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"# Default scope Usedscope="sub"# Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT)hash_encrypt="MD5"# if hash_encrypt is set to CRYPT, you may set a salt format.# default is "%s", but many systems will generate MD5 hashed# passwords if you use "$1$%.8s". This parameter is optional!crypt_salt_format="%s"################################################################################ Unix Accounts Configuration################################################################################ Login defs# Default Login Shell# Ex: userLoginShell="/bin/bash"userLoginShell="/bin/bash"# Home directory# Ex: userHome="/home/%U"userHome="/home/%U"# Default mode used for user homeDirectoryuserHomeDirectoryMode="700"# GecosuserGecos="System User"# Default User (POSIX and Samba) GIDdefaultUserGid="513"# Default Computer (Samba) GIDdefaultComputerGid="515"# Skel dirskeletonDir="/etc/skel"# Default password validation time (time in days) Comment the next line if# you don't want password to be enable for defaultMaxPasswordAge days (be# careful to the sambaPwdMustChange attribute's value)defaultMaxPasswordAge="365"################################################################################ SAMBA Configuration################################################################################ The UNC path to home drives location (%U username substitution)# Just set it to a null string if you want to use the smb.conf 'logon home'# directive and/or disable roaming profiles# Ex: userSmbHome="\\\\PDC-SMB3\\%U"userSmbHome=""# The UNC path to profiles locations (%U username substitution)# Just set it to a null string if you want to use the smb.conf 'logon path'# directive and/or disable roaming profiles# Ex: userProfile="\\\\PDC-SMB3\\profiles\\%U"userProfile=""# The default Home Drive Letter mapping# (will be automatically mapped at logon time if home directory exist)# Ex: userHomeDrive="H:"userHomeDrive="U:"# The default user netlogon script name (%U username substitution)# if not used, will be automatically username.cmd# make sure script file is edited under dos# Ex: userScript="startup.cmd" # make sure script file is edited under dosuserScript="logon.bat"# Domain appended to the users "mail"-attribute# when smbldap-useradd -M is used# Ex: mailDomain="idealx.com"mailDomain="example.com"################################################################################ SMBLDAP-TOOLS Configuration (default are ok for a RedHat? )################################################################################ Allows not to use smbpasswd (if with_smbpasswd =%%'' 0 in smbldap_conf.pm) but\\ # prefer Crypt::SmbHash library\\ with_smbpasswd="0"\\ smbpasswd="/usr/bin/smbpasswd"** **# Allows not to use slappasswd (if with_slappasswd ''%%= 0 in smbldap_conf.pm)# but prefer Crypt:: librarieswith_slappasswd="0"slappasswd="/usr/sbin/slappasswd"# comment out the following line to get rid of the default banner# no_banner="1"%%''** **Update  ''%%/etc/smbldap-tools/smbldap_bind.conf%%''  as below:** **''%%############################# Credential Configuration ############################## Notes: you can specify two differents configuration if you use a# master ldap for writing access and a slave ldap server for reading access# By default, we will use the same DN (so it will work for standard Samba# release)slaveDN="cn=admin,dc=example,dc=com"slavePw="CHANGE"masterDN="cn=admin,dc=example,dc=com"masterPw="CHANGE"%%''** **Change configuration with correct permisison:** **''%%chmod 0644 /etc/smbldap-tools/smbldap.confchmod 0600 /etc/smbldap-tools/smbldap_bind.conf%%''** **Now you can populate your Samba LDAP schema:** **''%%smbldap-populate%%''** **Don't forget to backup your latest LDAP database:** **''%%slapcat > ~/smbldap.ldif%%''** ******** ==== Configure PAM/NSS with LDAP ==== ******** **Reconfigure libnss-ldap with following  ''%%dpkg-reconfigure libnss-ldap%%'':** * **LDAP server Uniform Resource Identifier: ldap:%%//%%127.0.0.1** **** Distinguished name of the search base: dc=example,dc=com **** LDAP version to use: 3 **** Does the LDAP database require login? No **** Special LDAP privileges for root? Yes **** Make the configuration file readable/writeable by its owner only? Yes **** LDAP account for root: cn=admin,dc=example,dc=com **** LDAP root account password: CHANGE **** **Update  ''%%/etc/nsswitch.conf%%''  as below:** **''%%passwd: files ldapgroup: files ldapshadow: files ldaphosts: files mdns4_minimal [NOTFOUND=return] dns mdns4 ldap%%''** **Add the following lines to  ''%%/etc/ldap/ldap.conf%%''  for LDAP clients:** **''%%host localhostbase dc=example,dc=combinddn cn=admin,dc=example,dc=combindpw CHANGEbind_policy softpam_password exoptimelimit 15nss_base_passwd dc=example,dc=com?subnss_base_shadow dc=example,dc=com?subnss_base_group ou=group,dc=example,dc=com?one%%''** **Modify the following lines to  ''%%/etc/libnss-ldap.conf%%'':** **''%%bind_policy softpam_password md5nss_base_passwd  dc=example,dc=com?subnss_base_shadow  dc=example,dc=com?subnss_base_group  ou=group,dc=example,dc=com?one%%''** **Check your  ''%%/etc/libnss-ldap.secret%%'':** **''%%cat /etc/libnss-ldap.secret%%''** **Reconfigure libpam-ldap with following  ''%%dpkg-reconfigure libpam-ldap%%'':** * **LDAP server Uniform Resource Identifier: ldap:%%//%%127.0.0.1** **** Distinguished name of the search base: dc=hkmadavidli,dc=edu,dc=hk **** LDAP version to use: 3 **** Make local root Database admin. Yes **** Does the LDAP database require login? No **** LDAP account for root: cn=admin,dc=example,dc=com **** LDAP root account password: CHANGE **** Local crypt to use when changing passwords. MD5 **** (UPDATE 2009-05-09, only available after pam 1.0.1-6)  PAM profiles to enable: Unix authentication, LDAP Authentication **** **Modify the following lines to  ''%%/etc/pam_ldap.conf%%'':** **''%%bind_policy softpam_password md5nss_base_passwd  dc=example,dc=com?subnss_base_shadow  dc=example,dc=com?subnss_base_group  ou=group,dc=example,dc=com?one%%''** **Check your  ''%%/etc/pam_ldap.secret%%'':** **''%%cat /etc/pam_ldap.secret%%''** ****(UPDATE 2009-05-09, only available after pam 1.0.1-6)**  Refer to  ''%%/etc/pam.d/common-account%%''  comment:** **''%%# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.# To take advantage of this, it is recommended that you configure any# local modules either before or after the default block, and use# pam-auth-update to manage selection of other modules.  See# pam-auth-update(8) for details.%%''** **By default, Debian already coming with correct LDAP auth setup under  ''%%/usr/share/pam-configs/ldap%%'':** **''%%Name: LDAP AuthenticationDefault: yesPriority: 128Auth-Type: PrimaryAuth-Initial:        [success=end default=ignore]    pam_ldap.soAuth:        [success=end default=ignore]    pam_ldap.so use_first_passAccount-Type: PrimaryAccount:        [success=end default=ignore]    pam_ldap.soPassword-Type: PrimaryPassword-Initial:        [success=end user_unknown=ignore default=die]   pam_ldap.soPassword:        [success=end user_unknown=ignore default=die]   pam_ldap.so use_authtok try_first_passSession-Type: AdditionalSession:        optional                        pam_ldap.so%%''** **If you follow above guideline, your libpam-ldap should already setup correctly; otherwise, run  ''%%pam-auth-update%%''  manually.**
**); background-position: 0% 0%;">** **Here are legacy reference setup before pam 1.0.1-6.** **Update your  ''%%/etc/pam.d/common-account%%''  as below:** **''%%# here are the per-package modules (the "Primary" block)account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.soaccount [success=1 default=ignore]      pam_ldap.so# here's the fallback if no module succeedsaccount requisite                       pam_deny.so# prime the stack with a positive return value if there isn't one already;# this avoids us returning an error just because nothing sets a success code# since the modules above will each just jump aroundaccount required                        pam_permit.so# and here are more per-package modules (the "Additional" block)%%''** **Update your  ''%%/etc/pam.d/common-auth%%''  as below:** **''%%# here are the per-package modules (the "Primary" block)auth    [success=2 default=ignore]      pam_unix.so nullok_secureauth    [success=1 default=ignore]      pam_ldap.so use_first_pass# here's the fallback if no module succeedsauth    requisite                       pam_deny.so# prime the stack with a positive return value if there isn't one already;# this avoids us returning an error just because nothing sets a success code# since the modules above will each just jump aroundauth    required                        pam_permit.so%%''** **Update your  ''%%/etc/pam.d/common-password%%''  as below (don't use  ''%%use_authtok%%''  for pam_ldap.so, see  http://ubuntuforums.org/archive/index.php/t-156071.html):** **''%%# here are the per-package modules (the "Primary" block)password        [success=2 default=ignore]      pam_unix.so obscure md5password        [success=1 user_unknown=ignore default=die]     pam_ldap.so use_authtok try_first_pass# here's the fallback if no module succeedspassword        requisite                       pam_deny.so# prime the stack with a positive return value if there isn't one already;# this avoids us returning an error just because nothing sets a success code# since the modules above will each just jump aroundpassword        required                        pam_permit.so# and here are more per-package modules (the "Additional" block)%%''** **Update your  ''%%/etc/pam.d/common-session%%''  as below:** **''%%# here are the per-package modules (the "Primary" block)session [default=1]                     pam_permit.so# here's the fallback if no module succeedssession requisite                       pam_deny.so# prime the stack with a positive return value if there isn't one already;# this avoids us returning an error just because nothing sets a success code# since the modules above will each just jump aroundsession required                        pam_permit.so# and here are more per-package modules (the "Additional" block)session required                        pam_unix.sosession optional                        pam_ldap.so%%''**  
**During system bootup udevd will search for some non-exists users/groups from NSS and so prompt for error message ( http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412989). Quick fix it with create according users/groups in  ''%%/etc/passwd%%''  and  ''%%/etc/groups%%''  so will not check from LDAP before slapd start:** **''%%addgroup --system nvramaddgroup --system rdmaaddgroup --system fuseaddgroup --system kvmadduser --system --group --shell /usr/sbin/nologin --home /var/lib/tpm tss%%''**   > **); background-position: 0% 0%;">** > > ''%%bind_policy soft%%'' ** can speed up the pass-though of these error message, but doesn't get the above problem fixed.** **Reboot your Debian and debug for any error message :D****** ==== Test your setup ==== ******** **Create demo user accout with smbldap-tools:** **''%%smbldap-useradd -a -m postmastersmbldap-passwd postmaster%%''** **Check your user and group lookup. You should find the record from LDAP accordingly:** **''%%getent passwdgetent group%%''** **Now logout and log into your Debian with the LDAP new user account. After successful login check your home directory with  ''%%pwd%%''. It should be all fine.** **It is time for you to test the join domain from Windows. BTW, this is not the key point for the HOWTO so I will skip in here.** **After join your Windows into this Samba domain, login with your LDAP user account. Again it should be all fine :D****** ==== Extra tips ==== ********

  1. ****Can't join Windows XP into domain**\\ Check if  ''%%nss_base_passwd ou=computer,dc=example,dc=com?one%%''  exists in your PAM/NSS setup (or using  ''%%nss_base_passwd dc=example,dc=com?sub%%''  as above, but may come with some performance degrade).**

    **Also, someone report that  ''%%/var/lib/samba/secrets.tdb%%''  may corrupted and so can't join domain correctly. Remove it and redo  ''%%smbpasswd -w CHANGE%%'', e.g.:\\ **

    **''%%/etc/init.d/samba stop rm -rf /var/lib/samba/secrets.tdb /var/lib/samba/schannel_store.tdb /var/cache/samba/* smbpasswd -w CHANGE /etc/init.d/samba start%%''**
**** SID must setup correctly Don't forget the  net getlocalsid  and replace that within  /etc/smbldap-tools/smbldap.conf **** root must be uidnumber = 0 This is documented in smbldap-tools HOWTO. If you change this during  smbldap-populate  your Windows XP will not able to join domain. **** Can't use  net getlocalsid  after  =passdb backend = ldapsam== Can use  =net rpc info  instead. ******** ==== Other references ==== ******** **As your Linux is now LDAP PAM/NSS enabled, you may also embed most Linux services, e.g. email and webmail:** * **[[http://edin.no-ip.com/content/exim4-courier-ssl-debian-etch-mini-howto|Exim4 + Courier + SSL on Debian etch mini-HOWTO]]** **** Exim4 + ClamAV + SpamAssassin + Greylistd on Debian etch mini-HOWTO **** Exim4 + Mailman + Apache2 on Debian etch mini-HOWTO ===== A. Instalación básica ===== ===== B. Configuración ===== === 1. Una accion === === 2. Segunda accion === ===== Problemas ===== ==== 1. Si el instale_mrtg.sh no le funciona ==== - ===== Referencias ===== - FIN ============================================================== 15-Marzo-2006 J.E.Gomez v1.0 Primera version ---- __**Advertencia**__ Este documento es privado y es de u so exclusivo de sus autores y de SKINA TECH. Cualquier uso sin una autorización escrita es contra la ley de derechos de autor y de propiedad intelectual, y será motivo de una acción legal. ----