我正在尝试获取我在活动目录中设置的 uid 和 gid 映射,以便将其复制到我已添加到 Windows 2008 域控制器的现有 Ubuntu 框中。我们正在尝试让所有机器加入,并且由于机器已经具有来自 OpenLDAP 的这些映射,因此让它们进行复制非常重要。我正在使用 Samba4、Winbind、Ubuntu 12.04。
smb.conf:
[global]
security = ads
realm = DOMAIN.NET
password server = dc01.domain.net
workgroup = DOMAIN
#idmap uid = 1000-99999
#idmap gid = 1000-99999
idmap config *:backend = tdb
idmap config *:range = 70001-80000
idmap config DOMAIN:backend = ad
idmap config DOMAIN:range = 500-40000
winbind nss info = rfc2307
winbind separator = +
winbind enum users = no
winbind enum groups = no
winbind use default domain = yes
template homedir = /home/%U
template shell = /bin/bash
client use spnego = yes
domain master = no
krb5.conf:
[logging]
default = FILE:/var/log/krb5.log
[libdefaults]
allow_weak_crypto = true
ticket_lifetime = 24000
default_realm = DOMAIN.NET
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
[realms]
DOMAIN.NET = {
kdc = DC01.DOMAIN.NET
admin_server = DC01.DOMAIN.NET
default_domain = DOMAIN
}
[domain_realm]
.domain.net = DOMAIN.NET
domain.net = DOMAIN.NET
nsswitch.conf
# pre_auth-client-config # passwd: compat
passwd: compat winbind
# pre_auth-client-config # group: compat
group: compat winbind
# pre_auth-client-config # shadow: compat
shadow: compat winbind
hosts: files dns wins
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
# pre_auth-client-config # netgroup: nis
netgroup: nis
当我添加 idmap 配置 DOMAIN:backend = ad 行时,我无法使用域帐户 ssh 进入计算机,只能使用本地帐户。如果我注释掉这些行,我可以使用域帐户和组进行 SSH 读取。这两个配置都允许我从 wbinfo 获取返回值,在这两个 getent 中也只返回本地帐户。我被难住了。
答案1
必须在域用户组上设置 Unix 属性,以便引入 AD 用户。然后,可以查询定义了 Unix 字段的任何人。