☰

getent 组未返回域组

tag-icon • tag-icon permissions samba active-directory groups
getent 组未返回域组

我想允许 Windows AD 用户访问我的 Ubuntu Server (16.04.1) 上的文件共享。
我遵循了本教程： Samba 在 Ubuntu 12.04 上与 Active Directory 登录共享
我按照每个步骤操作。经过一番故障排除后，我发现我需要安装libnss-winbind。安装完最后的几个软件包后，libpam-winbind我重新做了一遍。pam-auth-update

kinit当我作为用户
wbinfo -u工作时，我会获得有效的 itcket ，
wbinfo -g作品，
getent passwd返回本地和AD 用户，

但getent group仅返回本地群组。

当我想这样做时chgrp -R 'Domain Users' /sharing/，我得到：chgrp: invalid group: ‘Domain Users’

krb5.conf =

[libdefaults]
  ticket_lifetime = 24h
  default_realm = EXAMPLE.LOCAL
  forwardable = true

[realms]
  EXAMPLE.LOCAL = {
    kdc = 192.168.254.3
    default_domain = EXAMPLE.LOCAL
  }

[domain_realm]
  .example.local = EXAMPLE.LOCAL
  example.local = EXAMPLE.LOCAL

[kdc]
  profile = /etc/krb5kdc/kdc.conf

[appdefaults]
  pam = {
    debug = false
    ticket_lifetime = 36000
    renew_lifetime = 36000
    forwardable = true
    krb4_convert = false
  }

[logging]
  kdc = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmin.log
  default = FILE:/var/log/krb5lib.log

smb.conf =

[global]
    # No .tld
    workgroup = EXAMPLE
    # Active Directory System
    security = ads
    # With .tld
    realm = EXAMPLE.LOCAL
    # Just a member server
    domain master = no
    local master = no
    preferred master = no
    # Disable printing error log messages when CUPS is not installed.
    printcap name = /etc/printcap
    load printers = no
    # Works both in samba 3.2 and 3.6.
    idmap backend = tdb
    idmap uid = 10000-99999
    idmap gid = 10000-99999
    # no .tld
    idmap config EXAMPLE:backend = rid
    idmap config EXAMPLE:range = 10000-99999
    winbind enum users = yes
    winbind enum groups = yes
    # This way users log in with username instead of [email protected]
    winbind use default domain = yes
    # Inherit groups in groups
    winbind nested groups = yes
    winbind refresh tickets = yes
    winbind offline logon = true
    # Becomes /home/example/username
    template homedir = /home/%D/%U
    # No shell access
    template shell = /bin/false
    client use spnego = yes
    client ntlmv2 auth = yes
    encrypt passwords = yes
    restrict anonymous = 2
    log file = /var/log/samba/samba.log
    log level = 2

[Dropbox]
    comment = Daily Emptied Dropbox
    path = /sharing/test
    valid users = "@EXAMPLE\Domain Users"
    force group = "domain users"
    writable = yes
    read only = no
    force create mode = 0660
    create mask = 0777
    directory mask = 0777
    force directory mode = 0770
    access based share enum = yes
    hide unreadable = yes

nsswitch.conf=

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         files winbind
group:          files windind
shadow:         files windind
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

（用compat代替进行测试files，结果相同）

我怎样才能使 AD 组发挥作用？

答案1

您需要 apt-get install libnss-winbind libpam-winbind。它会在您的系统中建立一些链接，以强制 getent 通过 winbind。对我来说，ubuntu 16 samba 4.3.11 有效

答案2

我发布此信息是为了帮助可能遇到与我相同问题的人：

  • getent group @<domain.name> 不返回任何内容
  • 基于 AD 组的登录不起作用
  • 基于 AD 个人用户的登录功能正在运行

经过多次故障排除，我发现 systemd-resolved 提供的 /etc/resolv.conf 与 sssd 和 AD 组登录不兼容。使用 sudo realm permit @<domain.name> 单独添加用户时，Sssd 会允许用户登录，但使用 sudo realm permit -g @<domain.name> 则不行。

在 /etcv/resolv.conf 中，将 120.0.0.53 替换为您网络中的域控制器 IP。您可能需要 netplan apply，并且可以重新启动 sssd 以获得良好的效果。此后，基于组的 AD 登录开始工作，我已经测试了几次，修复是一致的。

本

相关内容