Windows Server 2008 AD 帳密整合Linux VSFTP 異質平台服務測試 By Keynes－NEIL`s_IT技術學習分享發表Blog

實驗環境

Windows Server 2008 AD : mike.lohas.com , IP: 192.168.0.199

CentOS 5.5(winbind) : 利用samba,winbind向Windows Server 2008 AD 帳號驗證Kerbros

實驗目標

將 CentOS 5.5(主機名稱:winbind) 加入AD網域,並安裝VSFTP套件,我們將利用網域帳號

測試登入與存取VSFTPD是否可能(若OK,日後僅需在AD上建立統一帳號管理異質平台服務)

益處: 減少網路架構中分散帳號管理不易,統一集中由AD管理Server服務帳號即可

1.) vi /etc/hosts

寫入 winbind 對應IP & mike.lohas.com 對應IP #AD Domain & IP

vi /etc/samba/smb.conf

       workgroup = lohas         # lohas.com 最左邊"lohas"
      server string = Samba Server Version %v
      netbios name = winbind    #填入centos 5.5 這台 netbios
      security = ads                     #填入ads 網域驗證
      password server = mike.lohas.com  #填入AD Server FQDN
      winbind separator = +
      idmap uid = 10000-20000         #填入網域帳戶uid & gid 起與終範圍
      idmap gid = 10000-20000
      winbind enum users = yes
      winbind enum groups = yes
      nt acl support = yes                   #nt acl support
      winbind cache time = 0
      template shell = /bin/bash
      template homedir = /home/%U   #網域的home目錄路徑
      winbind use default domain = yes

(2.) vi /etc/krb5.conf #修改的部分,請參照反綠字體,注意大小寫

[logging]

default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

   [libdefaults]
    default_realm = LOHAS.COM       #修改為LOHAS.COM
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 24h
    forwardable = yes

    [realms]                                          #修改為LOHAS.COM
    LOHAS.COM = {
    kdc = mike.lohas.com:88                       #kdc=mike.lohas.com:88
    admin_server = mike.lohas.com:749     #admin_server=mike.lohas.com:88
    default_domain = lohas.com                  #default_domain = lohas.com
   }

   [domain_realm]
   .example.com = EXAMPLE.COM
   example.com = LOHAS.COM

........