rize a écrit 2 commentaires

vi /etc/krb5.conf
admin_server = mondomaine
}
ça viens de la /etc/krb5.conf c'est un exemple en commentaire c'est pas important
EXAMPLE.COM = {
kdc = kerberos.example.com
admin_server = kerberos.example.com
}

[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMON
[domain_realm]
.mondomaine = mondomaine
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
minimum_uid = 1
external = sshd
use_shmem = sshd
}

je veux que m'es utilisateurs s'authentifies auprès d'un AD si tu fais la remarque c'est que je n'ai pas besoins de samba.

oui en effet vsftpd doit être configuré mais je le ferai en dernier une fois que tout communique ça deviendra plus simple

Actuellement le FTP est pas important sinon j'ai utilisé vsftpd

j'utilise Winbind

Justement j'ai pas trop modifier de fichier de conf car avec suse tu utilises Yast en interface graphique

j'ai activé samba mais j'ai un message d'erreur quand j'essaye de me connecter avec le compte admin du domaine.
"unable to find a suitable server for domain XXXX"

le client kerberos je l'ai activé mais j'ai mis ne pas utiliser

driftfile /var/lib/ntp/drift/ntp.drift

path for drift file

logfile /var/log/ntp

alternate log file

logconfig =syncstatus + sysevents

logconfig =all

statsdir /tmp/ # directory for statistics files

filegen peerstats file peerstats type day enable

filegen loopstats file loopstats type day enable

filegen clockstats file clockstats type day enable

Authentication stuff

keys /etc/ntp.keys

path for keys file

trustedkey 1

define trusted keys

requestkey 1

key (7) for accessing server variables

kerberos
admin_server = mondomaine (j'ai enlevé pour l'exemple)
}

EXAMPLE.COM = {

kdc = kerberos.example.com

admin_server = kerberos.example.com

}

[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMON
[domain_realm]
.domaine = domaine
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
minimum_uid = 1
external = sshd
use_shmem = sshd
}

SAMBA
vi /etc/samba/smb.conf
wins support = No
kerberos method = secrets and keytab
realm = mondomaine
template homedir = /home/%D/%U
winbind refresh tickets = yes
template shell = /bin/bash
allow trusted domains = yes
winbind offline logon = yes
winbind use default domain = no
winbind separator = +
[homes]
comment = Home Directories
valid users = %S, %D%w%S
browseable = No
read only = No
inherit acls = Yes
[profiles]
comment = Network Profiles Service
path = %H
read only = No
store dos attributes = Yes
create mask = 0600
directory mask = 0700

[groups]
comment = All groups
path = /home/groups
read only = No
inherit acls = Yes
[printers]
comment = All Printers
path = /var/tmp
printable = Yes
create mask = 0600
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/drivers
write list = @ntadmin root
force group = ntadmin
create mask = 0664
directory mask = 0775

NSS

passwd: compat winbind
group: files ldap winbind

hosts: files mdns_minimal [NOTFOUND=return] dns
networks: files dns

services: files ldap
protocols: files
rpc: files
ethers: files
netmasks: files
netgroup: files ldap
publickey: files

bootparams: files
automount: files nis
aliases: files ldap
passwd_compat: ldap
~

/etc/pam.d/cat common-account

account requisite pam_unix.so try_first_pass
account required pam_krb5.so use_first_pass ignore_unknown_principals
account sufficient pam_localuser.so
account required pam_winbind.so use_first_pass

/etc/pam.d/cat common-auth
auth required pam_env.so
auth optional pam_gnome_keyring.so
auth sufficient pam_unix.so try_first_pass
auth sufficient pam_krb5.so use_first_pass
auth required pam_winbind.so use_first_pass

/etc/pam.d/cat common-password
password sufficient pam_winbind.so
password requisite pam_cracklib.so
password optional pam_gnome_keyring.so use_authtok
password [default=ignore success=1] pam_succeed_if.so uid > 999 quiet
password sufficient pam_unix.so use_authtok nullok shadow try_first_pass
password sufficient pam_krb5.so
password required pam_deny.so

/etc/pam.d/cat common-session

session optional pam_mkhomedir.so
session required pam_limits.so
session required pam_unix.so try_first_pass
session optional pam_krb5.so
session required pam_winbind.so
session optional pam_umask.so
session optional pam_systemd.so
session optional pam_gnome_keyring.so auto_start only_if=gdm,gdm-password,lxdm,lightdm
session optional pam_env.so

je pense avoir tout mis