linux - 无法让 samba 与 AD 用户共享文件夹
问题描述
我有一个在服务器 2019 上运行的 AD 服务器。由于某种原因，我只是设置了一个 linux 机器并配置了 samba，我无法让 getent 组“域管理员”显示任何内容。如果我使用 getent passwd Administrator 它确实可以工作，并且 wbinfo -u 或 wbinfo --domain-groups 也可以正常工作。
中小企业会议
[global]
server role = MEMBER SERVER
security = ADS
realm = TESTLAB.COM
workgroup = TEST
dedicated keytab file = /etc/krb5.keytab
kerberos method = secrets and keytab
server string = Samba 4 %h
log file = /var/log/samba/%m.log
log level = 5
idmap config * : backend = tdb
idmap config * : range = 10000-20000
idmap config TESTLAB : backend = rid
idmap config TESTLAB : range = 30000-40000
idmap config TESTLAB : backend = ad
password server = adsrv1.testlab.com
encrypt passwords = yes
winbind refresh tickets = yes
winbind offline logon = yes
winbind enum users = yes
winbind enum groups = yes
winbind nested groups = yes
winbind expand groups = 4
winbind use default domain = yes
#winbind normalize name = yes
os level = 20
domain master = no
local master = yes
preferred master = no
map to guest = bad user
host msdfs = no
netbios name = smbsrv
client min protocol = SMB2
client max protocol = SMB3
client ldap sasl wrapping = plain
hosts allow = 10.0.0.0/16
unix extensions = no
reset on zero vc = yes
veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/
hide unreadable = yes
acl group control = yes
acl map full control = true
ea support = yes
vfs objects = acl_xattr
store dos attributes = yes
#dos flemode = yes
dos filetimes = yes
enable privileges = yes
restrict anonymous = 2
strict allocate = yes
guest ok = no
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
username map = /etc/samba/user.map
template shell = /bin/bash
template homedir = /home/TESTLAB/%U
[Data]
comment = "User Data"
path = /mnt/data
create mask = 0770
browseable = yes
writable = yes
valid users = @"Domain Admins" @"Domain Users"
write list = @"Domain Admins" @"Domain Users"
NSWITCH.CONF
passwd: compat files winbind sss
group: compat files windind sss
shadow: compat files sss
gshadow: files
hosts: files dns mdns4_minimal [NOTFOUND=return] mdns4
networks: files
protocols: db files
services: db files sss
ethers: db files
rpc: db files
netgroup: nis sss
sudoers: files sss
KRB5.conf
[libdefaults]
default_realm = testlab.com
dns_lookup_realm = false
dns_lookup_kdc = true
# The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
# The following libdefaults parameters are only for Heimdal Kerberos.
fcc-mit-ticketflags = true
[realms]
testlab.com = {
kdc = adsrv1.testlab.com
admin_server = adsrv1.testlab.com
}
ATHENA.MIT.EDU = {
kdc = kerberos.mit.edu
kdc = kerberos-1.mit.edu
kdc = kerberos-2.mit.edu:88
admin_server = kerberos.mit.edu
default_domain = mit.edu
}
ZONE.MIT.EDU = {
kdc = casio.mit.edu
kdc = seiko.mit.edu
admin_server = casio.mit.edu
}
CSAIL.MIT.EDU = {
admin_server = kerberos.csail.mit.edu
default_domain = csail.mit.edu
}
IHTFP.ORG = {
kdc = kerberos.ihtfp.org
admin_server = kerberos.ihtfp.org
}
1TS.ORG = {
kdc = kerberos.1ts.org
admin_server = kerberos.1ts.org
}
ANDREW.CMU.EDU = {
admin_server = kerberos.andrew.cmu.edu
default_domain = andrew.cmu.edu
}
CS.CMU.EDU = {
kdc = kerberos-1.srv.cs.cmu.edu
kdc = kerberos-2.srv.cs.cmu.edu
kdc = kerberos-3.srv.cs.cmu.edu
admin_server = kerberos.cs.cmu.edu
}
DEMENTIA.ORG = {
kdc = kerberos.dementix.org
kdc = kerberos2.dementix.org
admin_server = kerberos.dementix.org
}
stanford.edu = {
kdc = krb5auth1.stanford.edu
kdc = krb5auth2.stanford.edu
kdc = krb5auth3.stanford.edu
master_kdc = krb5auth1.stanford.edu
admin_server = krb5-admin.stanford.edu
default_domain = stanford.edu
}
UTORONTO.CA = {
kdc = kerberos1.utoronto.ca
kdc = kerberos2.utoronto.ca
kdc = kerberos3.utoronto.ca
admin_server = kerberos1.utoronto.ca
default_domain = utoronto.ca
}
[domain_realm]
.mit.edu = ATHENA.MIT.EDU
mit.edu = ATHENA.MIT.EDU
.media.mit.edu = MEDIA-LAB.MIT.EDU
media.mit.edu = MEDIA-LAB.MIT.EDU
.csail.mit.edu = CSAIL.MIT.EDU
csail.mit.edu = CSAIL.MIT.EDU
.whoi.edu = ATHENA.MIT.EDU
whoi.edu = ATHENA.MIT.EDU
.stanford.edu = stanford.edu
.slac.stanford.edu = SLAC.STANFORD.EDU
.toronto.edu = UTORONTO.CA
.utoronto.ca = UTORONTO.CA
.testlab.com = TESTLAB.COM
固态硬盘配置文件
[sssd]
config_file_version = 2
services = nss, pam
domains = TESTLAB
# SSSD will not start if you do not configure any domains.
# Add new domain configurations as [domain/<NAME>] sections, and
# then add the list of domains (in the order you want them to be
# queried) to the "domains" attribute below and uncomment it.
; domains = LDAP
[nss]
[pam]
# Example LDAP domain
[TESTLAB.COM/LDAP]
id_provider = ldap
auth_provider = ldap
# ldap_schema can be set to "rfc2307", which stores group member names in the
# "memberuid" attribute, or to "rfc2307bis", which stores group member DNs in
# the "member" attribute. If you do not know this value, ask your LDAP
# administrator.
ldap_schema = rfc2307
ldap_uri = ldap://ldap.testlab.com
ldap_search_base = dc=testlab,dc=com
# Note that enabling enumeration will have a moderate performance impact.
# Consequently, the default value for enumeration is FALSE.
# Refer to the sssd.conf man page for full details.
enumerate = true
# Allow offline logins by locally storing password hashes (default: false).
cache_credentials = true
# An example Active Directory domain. Please note that this configuration
# works for AD 2003R2 and AD 2008, because they use pretty much RFC2307bis
# compliant attribute names. To support UNIX clients with AD 2003 or older,
# you must install Microsoft Services For Unix and map LDAP attributes onto
# msSFU30* attribute names.
[domain/TESTLAB]
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_uri = ldap://ldap.testlab.com
ldap_search_base = dc=testlab,dc=com
ldap_schema = rfc2307bis
ldap_sasl_mech = GSSAPI
ldap_user_object_class = user
ldap_group_object_class = group
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
krb5_server = 10.0.0.10
krb5_realm = TESTLAB.COM
解决方案
如果您在“idmap config”行中使用了正确的域名，这可能会有所帮助。您有 'workgroup = TEST' 和 'idmap config TESTLAB : backend = rid'，它们必须匹配，将 'TESTLAB' 更改为 'TEST'
哦，如果你的 Samba 版本 >= 4.8.0，那么删除 sssd，你就不能将 Samba >= 4.8.0 与 sssd 一起使用。
好的，我会从您的 smb.conf 中删除这些行：
server role = MEMBER SERVER
password server = adsrv1.testlab.com
encrypt passwords = yes
winbind enum users = yes
winbind enum groups = yes
winbind nested groups = yes
netbios name = smbsrv
os level = 20
local master = yes
acl map full control = true
ea support = yes
dos filetimes = yes
enable privileges = yes
guest ok = no
browseable = yes
idmap config TESTLAB : backend = ad
create mask = 0770
valid users = @"Domain Admins" @"Domain Users"
write list = @"Domain Admins" @"Domain Users"
然后从 Windows（安全选项卡）设置共享权限我还将 Debian 升级到 Buster，这将为您提供更高版本的 Samba。
推荐阅读
- javascript - 如何在测验中垂直对齐分数选择？
- r - 如何从R中的strsplit制作2个单独的子字符串
- sql-server - SSIS：通过 SQL Server 代理作业访问 Sharepoint UNC
- python - python中randint和sample的区别
- python - Django 正则表达式验证器不工作 - 错误 500 部署服务器
- php - 在 Symfony 4/5 中安装 orm-fixtures 时 Composer 冲突
- dart - “？”是什么意思？在方法“字符串子字符串（int startIndex，[int？endIndex]）；” 在飞镖；
- javascript - 对受 htpasswd 保护的后端的 Ionic GET 请求
- forms - ionic 4 - 使用 segmets 进行离子选择或在选项之间引入标签
- java - 照片未上传，因为尚未在数据库中，如何覆盖？