Install LDAP + SAMBA on linux

First Install Samba

# apt-get install samba samba-doc smbclient

vim smb.conf

[global]
# Domain name ..
workgroup = TECH.COM
# Server name – as seen by Windows PCs ..
netbios name = TECH.COM
# Be a PDC ..
domain logons = Yes
domain master = Yes
# Be a WINS server ..
wins support = true

obey pam restrictions = Yes
dns proxy = No
os level = 35
log file = /var/log/samba/log.%m
max log size = 1000
syslog = 0
panic action = /usr/share/samba/panic-action %d
pam password change = Yes

# Allows users on WinXP PCs to change their password when they press Ctrl-Alt-Del
unix password sync = no
ldap passwd sync = yes

# Printing from PCs will go via CUPS ..
load printers = yes
printing = cups
printcap name = cups

# Use LDAP for Samba user accounts and groups ..
passdb backend = ldapsam:ldap://192.168.26.53

# This must match init.ldif ..
ldap suffix = dc=tech,dc=com
# The password for cn=admin MUST be stored in /etc/samba/secrets.tdb
# This is done by running ‘sudo smbpasswd -w’.
ldap admin dn = cn=admin,dc=tech,dc=com

# 4 OUs that Samba uses when creating user accounts, computer accounts, etc.
# (Because we are using smbldap-tools, call them ‘Users’, ‘Computers’, etc.)
ldap machine suffix = ou=Computers
ldap user suffix = ou=Users
ldap group suffix = ou=Groups
ldap idmap suffix = ou=Idmap
# Samba and LDAP server are on the same server in this example.
ldap ssl = no

# Scripts for Samba to use if it creates users, groups, etc.
add user script = /usr/sbin/smbldap-useradd -m ‘%u’
delete user script = /usr/sbin/smbldap-userdel %u
add group script = /usr/sbin/smbldap-groupadd -p ‘%g’
delete group script = /usr/sbin/smbldap-groupdel ‘%g’
add user to group script = /usr/sbin/smbldap-groupmod -m ‘%u’ ‘%g’
delete user from group script = /usr/sbin/smbldap-groupmod -x ‘%u’ ‘%g’
set primary group script = /usr/sbin/smbldap-usermod -g ‘%g’ ‘%u’

# Script that Samba users when a PC joins the domain ..
# (when changing ‘Computer Properties’ on the PC)
add machine script = /usr/sbin/smbldap-useradd -w ‘%u’

# Values used when a new user is created ..
# (Note: ‘%L’ does not work properly with smbldap-tools 0.9.4-1)
logon drive =
logon home =
logon path =
logon script =

# This is required for Windows XP client ..
server signing = auto
server schannel = Auto

[homes]
path = /home/%u
valid users = %S
comment = Home Directories
read only = No
browseable = Yes

[netlogon]
comment = Network Logon Service
path = /var/lib/samba/netlogon
admin users = root
guest ok = Yes
browseable = No
logon script = allusers.bat

[Profiles]
comment = Roaming Profile Share
# would probably change this to elsewhere in a production system ..
path = /var/lib/samba/profiles
read only = No
profile acls = Yes
browsable = No

[printers]
comment = All Printers
path = /var/spool/samba
use client driver = Yes
create mask = 0600
guest ok = Yes
printable = Yes
browseable = No
public = yes
writable = yes
admin users = root
write list = root

[print$]
comment = Printer Drivers Share
path = /var/lib/samba/printers
write list = root
create mask = 0664
directory mask = 0775
admin users = root

[shared]
writeable = yes
path = /var/lib/samba/shared
public = yes
browseable = yes

[archive]
path = /exports/archive
browseable = yes
create mask = 755
directory mask = 755
read only = no

# cp smb.conf /etc/samba/

Install the LDAP server

# apt-get install slapd ldap-utils libpam-smbpass smbldap-tools

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif

vim ~/backend.ldif ( my domain is tech.com)

# Load dynamic backend modules
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib/ldap
olcModuleload: back_hdb

# Database settings
dn: olcDatabase=hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcSuffix: dc=tech,dc=com
olcDbDirectory: /var/lib/ldap
olcRootDN: cn=admin,dc=tech,dc=com
olcRootPW: admin.pass
olcDbConfig: set_cachesize 0 2097152 0
olcDbConfig: set_lk_max_objects 1500
olcDbConfig: set_lk_max_locks 1500
olcDbConfig: set_lk_max_lockers 1500
olcDbIndex: objectClass eq
olcLastMod: TRUE
olcDbCheckpoint: 512 30
olcAccess: to attrs=userPassword by dn=”cn=admin,dc=tech,dc=com” write by anonymous auth by self write by * none
olcAccess: to attrs=shadowLastChange by self write by * read
olcAccess: to dn.base=”" by * read
olcAccess: to * by dn=”cn=admin,dc=tech,dc=com” write by * read

———-
Now add the LDIF to the LDAP directory:

ldapadd -Y EXTERNAL -H ldapi:/// -f ~/backend.ldif

vim ~/frontend.ldif

# Create top-level object in domain
dn: dc=tech,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: Tech
dc: Tech
description: LDAP Server

# Admin user.
dn: cn=admin,dc=tech,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword: admin.pass

dn: ou=people,dc=tech,dc=com
objectClass: organizationalUnit
ou: people

dn: ou=groups,dc=tech,dc=com
objectClass: organizationalUnit
ou: groups

dn: uid=brettg,ou=people,dc=tech,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: brettg
sn: Glasson
givenName: Brett
cn: Brett Glasson
displayName: Brett Glasson
uidNumber: 1000
gidNumber: 10000
userPassword: mypassword
gecos: Brett Glasson
loginShell: /bin/bash
homeDirectory: /home/brettg
shadowExpire: -1
shadowFlag: 0
shadowWarning: 7
shadowMin: 8
shadowMax: 999999
shadowLastChange: 10877
mail: brett.glasson@tech.com
postalCode: 31000
l: Melbourne
o: tech
mobile: +33 (0)6 xx xx xx xx
homePhone: +33 (0)5 xx xx xx xx
title: System Administrator
postalAddress:
initials: BG

dn: cn=users,ou=groups,dc=tech,dc=com
objectClass: posixGroup
cn: users
gidNumber: 10000
———————–
ldapadd -x -D cn=admin,dc=tech,dc=com -W -f frontend.ldif

smbpasswd -W
service smbd restart
smbclient -L localhost

mkdir -v -m 777 /var/lib/samba/profiles
mkdir -v -p -m 777 /var/lib/samba/netlogon

cp /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz /etc/ldap/schema/
gzip -d /etc/ldap/schema/samba.schema.gz

vim ~/schema_convert.conf
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/collective.schema
include /etc/ldap/schema/corba.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/duaconf.schema
include /etc/ldap/schema/dyngroup.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/java.schema
include /etc/ldap/schema/misc.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/openldap.schema
include /etc/ldap/schema/ppolicy.schema
include /etc/ldap/schema/samba.schema

–

slapcat -f ~/schema_convert.conf -F ~ -n0 -s “cn={12}samba,cn=schema,cn=config” > ~/cn=samba.ldif

vim ~/cn\=samba.ldif

and change the following attributes:

dn: cn={12}samba,cn=schema,cn=config
…
cn: {12}samba

to

dn: cn=samba,cn=schema,cn=config
…
cn: samba

Also, remove all these lines from the bottom of the file.

structuralObjectClass: olcSchemaConfig
entryUUID: 99e797a8-07cb-102f-8c5c-739a8467e607
creatorsName: cn=config
createTimestamp: 20100609043122Z
entryCSN: 20100609043122.188753Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20100609043122Z

Add the schema to the server;

ldapadd -Y EXTERNAL -H ldapi:/// -f ~/cn\=samba.ldif

ldapsearch -Y EXTERNAL -H ldapi:/// -D cn=admin,cn=config -b cn=config -W olcDatabase={1}hdb

You should see a metric shedload of output with this at the end;

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

If you see output like above then your LDAP server is working, but we still need to finish configuring samba.

Unpack the samba-ldap-tools (we downloaded this earlier)

gzip -d /usr/share/doc/smbldap-tools/configure.pl.gz

perl /usr/share/doc/smbldap-tools/configure.pl

smbldap-populate

/etc/init.d/slapd stop
slapindex

chown openldap:openldap /var/lib/ldap/*
/etc/init.d/slapd start

Make “root” the domain adminstrator;

sudo smbldap-groupmod -m ‘root’ ‘Administrators’

adding user root to group Administrators

If this returns;

adding user root to group Administrators

with no errors then you are looking good!

vim /etc/smbldap-tools/smbldap.conf

# Home directory
# Ex: userHome=”/home/%U”
userHome=”/home/%U”

Now install the Client

apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nscd ldap-utils libpam-mount smbclient smbfs ldap-auth-client

ldapi:///server-ip

dc=tech,dc=com

3

Yes

No

cn=admin,dc=tech,dc=com

mypassword

vim /etc/ldap.conf
bind_policy soft

pam_password crypt

Find the line that begins with uri ldapi:// . . .

Comment the line out and replace it with a line like so;

uri ldap://server-ip

vim /etc/ldap/ldap.conf
BASE    dc=tech,dc=com
URI     ldap://server-ip

SIZELIMIT       0
TIMELIMIT       0
DEREF           never

vim /etc/nsswitch.conf
passwd:         files ldap
group:          files ldap
shadow:         files ldap

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
—-

nss_updatedb ldap
auth-client-config -t nss -p lac_ldap
pam-auth-update ldap

ldapsearch -x  (show all )

getent passwd

Automount using pam_mount

vim /etc/security/pam_mount.conf.xml

<?xml version=”1.0″ encoding=”utf-8″ ?>
<!DOCTYPE pam_mount SYSTEM “pam_mount.conf.xml.dtd”>
<!–
See pam_mount.conf(5) for a description.
–>

<pam_mount>

<!– debug should come before everything else,
since this file is still processed in a single pass
from top-to-bottom –>

<debug enable=”0″ />
<mkmountpoint enable=”1″ remove=”true” />

<!– Volume definitions –>
<volume fstype=”cifs” server=”server-ip” path=”%(USER)” mountpoint=”~” />
<!– pam_mount parameters: General tunables –>

<!–
<luserconf name=”.pam_mount.conf.xml” />
–>

<!– Note that commenting out mntoptions will give you the defaults.
You will need to explicitly initialize it with the empty string
to reset the defaults to nothing. –>
<mntoptions allow=”nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other” />
<!–
<mntoptions deny=”suid,dev” />
<mntoptions allow=”*” />
<mntoptions deny=”*” />
–>
<mntoptions require=”nosuid,nodev” />
<path>/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin</path>
<logout wait=”0″ hup=”0″ term=”0″ kill=”0″ />
<!– pam_mount parameters: Volume-related –>
</pam_mount>
——————————

For Gnome Desktop users.
vim /etc/security/group.conf
gdm;*;*;Al0000-9000;floppy,audio,cdrom,video,plugdev,scanner

We also need to tell pam to use the group.conf settings;

vim /etc/pam.d/gdm

Add this line;
auth optional pam_group.so

All done ,

reboot and login as network user .. your home directory will be mounted.