![非标准目录中的 Solaris 11 和 samba4,除 Finger 外均适用](https://linux22.com/image/186888/%E9%9D%9E%E6%A0%87%E5%87%86%E7%9B%AE%E5%BD%95%E4%B8%AD%E7%9A%84%20Solaris%2011%20%E5%92%8C%20samba4%EF%BC%8C%E9%99%A4%20Finger%20%E5%A4%96%E5%9D%87%E9%80%82%E7%94%A8.png)
Oracle 打包版本的 samba 给了我一些问题(krb5 错误并且无法加入 AD samba4 服务器)。于是我自己用IPS重新编译了最新版本的samba(4.3.13)。经过30分钟的编译,我的samba4就安装好了。一切正常:net ads join OK, wbinfo OK, wbinfo -i user OK
,除了两件事:id winbinduser
和finger winbinduser
。我已经用这个肮脏但有效的解决方案解决了 id(最好将这些文件放在清单和标准位置,但我想避免与 Oracle samba 标准包发生冲突)。
ln -sf /opt/gm/lib/nss_winbind.so.1 /usr/lib/amd64/nss_winbind.so.1
ln -sf /opt/gm/lib/nss_winbind.so.1 /usr/lib/nss_winbind.so.1
ln -sf /opt/gm/lib/security/pam_winbind.so /usr/lib/security/amd64/pam_winbind.so
ln -sf /opt/gm/lib/security/pam_winbind.so /usr/lib/security/amd64/pam_winbind.so.1
ln -sf /opt/gm/lib/security/pam_winbind.so /usr/lib/security/pam_winbind.so
ln -sf /opt/gm/lib/security/pam_winbind.so /usr/lib/security/pam_winbind.so.1
ID 正在工作,但手指保持静音。我想念什么?
id pino
uid=10005(pino) gid=10016(domain users)
root@solaris11:~# finger !$
finger pino
Login name: pino In real life: ???
这是 nsswitch.conf
passwd: files winbind
group: files winbind
hosts: files dns wins
ipnodes: files dns wins
networks: files
protocols: files
rpc: files
ethers: files
netmasks: files
bootparams: files
publickey: files
netgroup: ldap
automount: files
aliases: files
services: files
project: files
auth_attr: files
prof_attr: files
tnrhtp: files
tnrhdb: files
sudoers: files
这是桁架的输出。
答案1
如果您正确设置了 smb.conf,并且不将 winbind ldap 后端与 Samba AD 一起使用,那么它可能会有所帮助,并且您应该只使用“winbind enum”行进行测试。试试这个 smb.conf:
[global]
workgroup = MYDOM
server string = solaris11
realm = MYDOM.PRIV
security = ads
hosts allow = 10.3.0.
log file = /var/opt/gm/log/samba/samba.%m
max log size = 50
dns proxy = no
kerberos method = secrets and keytab
server signing = mandatory
client signing = mandatory
smb encrypt = mandatory
restrict anonymous = 2
log level = 1
server min protocol = SMB3
client max protocol = SMB3
local master = No
preferred master = No
bind interfaces only = Yes
local master = No
preferred master = No
winbind use default domain = Yes
template homedir = /export/home/%U
template shell = /usr/bin/bash
idmap config * : backend = tdb
idmap config * : range = 3000-7999
idmap config MYDOM : backend = rid
idmap config MYDOM : range = 10000-20000
最后,从 /etc/nsswitch.conf 中删除“wins”
答案2
找到解决方案。是 winbind 缓存文件的问题,而不是库的问题。在 smb.conf 上添加这些行后
# Winbind
winbind enum groups = yes
winbind enum users = yes
重新启动 winbind inger 可以正常工作,getent passwd 和 getent group 也可以正常工作。
finger pino
Login name: pino
Directory: /export/home/pino Shell: /usr/bin/bash
Never logged in.
No unread mail
No Plan.
如果有兴趣,这是我的 Solaris 11 客户端的 smb.conf
[global]
workgroup = MYDOM
server string = solaris11
netbios name = SOLARIS11
server role = standalone server
hosts allow = 10.3.0.
log file = /var/opt/gm/log/samba/samba.%m
max log size = 50
realm = mydom.priv
dns proxy = no
kerberos method = secrets and keytab
server signing = mandatory
client signing = mandatory
smb encrypt = mandatory
restrict anonymous = 2
log level = 1
server min protocol = SMB3
client max protocol = SMB3
name resolve order = bcast lmhosts host wins
local master = No
preferred master = No
bind interfaces only = Yes
local master = No
preferred master = No
winbind use default domain = Yes
ldap admin dn = cn=ldapadm,dc=ldap2,dc=mydom,dc=priv
security = ads
ldap ssl = start tls
tls verify peer = no_check
template homedir = /export/home/%U
template shell = /usr/bin/bash
password hash userPassword schemes = CryptSHA512:rounds=7000
# Winbind
winbind enum groups = yes
winbind enum users = yes
idmap config * : backend = ldap
idmap config * : range = 10000-20000
idmap config * : ldap_url = ldap://ldap2.mydom.priv
idmap config * : ldap_base_dn = ou=idmap,dc=ldap2,dc=mydom,dc=priv
idmap config * : ldap_user_dn = cn=ldapadm,dc=ldap2,dc=mydom,dc=priv