• - Tutorial para Ubuntu e/ou Debian 4.0 - http://wiki.sintectus.com/bin/view/GrupoLinux/InstalacaoLdapSamba

## Modificação: Jarbas - 18-07-2005
## Baseado na documentação do IDEALX.ORG

# ===== Bibliotecas SCHEMA que o LDAP irá utilizar =====
include /usr/share/openldap/schema/core.schema
include /usr/share/openldap/schema/cosine.schema
include /usr/share/openldap/schema/inetorgperson.schema
include /usr/share/openldap/schema/nis.schema
include /usr/share/openldap/schema/samba.schema

schemacheck on

# ===== Habilita a versão 2 do protocolo LDAP =====
# É necessário para algumas versões antigas do mozilla poderem acessar o catálogo de endereços ldap
allow bind_v2

# Para permitir conexões criptografadas, criar /etc/ssl/openldap/ldap.pem
# através do /usr/share/openldap/gencert.sh
TLSRandFile            /dev/random
TLSCipherSuite         HIGH:MEDIUM:+SSLv2
TLSCertificateFile      /etc/ssl/openldap/ldap.pem
TLSCertificateKeyFile   /etc/ssl/openldap/ldap.pem
#TLSCACertificatePath   /etc/ssl/openldap/
#TLSCACertificateFile    /etc/ssl/cacert.pem
TLSCACertificateFile    /etc/ssl/openldap/ldap.pem
#TLSVerifyClient never # ([never]|allow|try|demand)

# ===== ACLs - Lista de Controle de Acesso =====
# Usuários autenticados podem trocar suas senhas
access to attrs=sambaLMPassword,sambaNTPassword,userPassword,sambaPasswordHistory,sambaPwdLastSet
        by self write
        by anonymous auth
        by * none
# Todos outros atributos são lidos por todos
access to *
        by * read

# ===== Estrutura da Base =====

database        ldbm
suffix          ""
rootdn          "cn=,"
# Senha criptografada. Deve ser gerada através do comando abaixo:
#
#      [root@jarbelix ~]# slappasswd -h {SSHA} -s 
#      {SSHA}7eLKstWsAMLJ9D03vHS9NOtVzjyiCv4+
#
# A geração automática dessa senha não foi possível de ser preparada automaticamente
# Substitua os XXXXXXXXXX pelo resultado do comando acima
rootpw          {SSHA}XXXXXXXXXX

# O diretório da base de dados que DEVE existir antes de rodar o slapd e DEVE
# somente ser acessível às ferramentas slapd. Modo 700 é recomendado.
directory       /var/lib/ldap

# ===== Ajustes para melhorar performance =====
# Lastmod off
lastmod off

# ===== Habilita a geracao de log's =====
# Quando em producao colocar 0 se nao precisar de log
loglevel 256

# ===== Estruturas de Índices =====
index   objectClass,uidNumber,gidNumber                 eq
index   cn,sn,uid,displayName                           pres,sub,eq
index   memberUID,mail,givenname                        eq,subinitial
index   sambaSID,sambaPrimaryGroupSID,sambaDomainName   eq

#===================================
# Implementar o "BDC" do LDAP
#
# No ldap: PDC=MASTER e BDC=SLAVEs
#===================================

# Configuração para Replicar Ldap
# Se este servidor é um Slave descomente as linhas abaixo
#========================================================
#updatedn        "cn=,"
#updateref       "ldaps://"

# Se este servidor é um Master desomente as linhas abaixo
# e coloque os IP corretos dos slaves
#========================================================
# Diretório onde estão os LOGs das replicas
#replogfile /var/log/ldap/replog

#replica uri=ldaps://ip-do-ldap-slave-1:636
#        binddn="cn=,"
#        bindmethod=simple
#        credentials=""
#
#replica uri=ldaps://ip-do-ldap-slave-2:636
#        binddn="cn=,"
#        bindmethod=simple
#        credentials=""
#
# ...
#
#replica uri=ldaps://ip-do-ldap-slave-n:636
#        binddn="cn=,"
#        bindmethod=simple
#        credentials=""

[root@jarbelix ~]# /usr/share/openldap/gencert.sh
----------------------------------------------------------------------
Create self-signed test certificate

Christian Zoffoli 
Version 0.2 - 20010501
______________________________________________________________________

Will create ldap.pem in /root

Generating Certificate
______________________________________________________________________

Generating a 1024 bit RSA private key
..........++++++
.++++++
writing new private key to 'ldap.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
1. Country Name             (2 letter code) [US]:BR
2. State or Province Name   (full name)     []:Autoridade Certificadora Regional Goias
3. Locality Name            (eg, city)      []:Goiania
4. Organization Name        (eg, company)   [LDAP Server]:Dataprev Regional Goias
5. Organizational Unit Name (eg, section)   [For testing purposes only]:Regional Goias
6. Common Name              (eg, CA name)   [jarbelix.prevnet]:  <=== DEVE ser o nome do HOST (# uname -n)
7. Email Address            (eg, name@FQDN) []:jarbas.junior@gmail.com
Certificate creation done!

[root@jarbelix ~]# mv ldap.pem /etc/ssl/openldap/ldap.pem

[root@jarbelix ~]# service ldap start
Iniciando slapd (ldap + ldaps):                                 [  OK  ]

[root@jarbelix ldap]# ldapsearch -x -b '' -s base "(ObjectClass=*)"
# extended LDIF
#
# LDAPv3
# base <> with scope base
# filter: (ObjectClass=*)
# requesting: ALL
#

#
dn:
objectClass: top
objectClass: OpenLDAProotDSE

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

[root@jarbelix ~]# chkconfig ldap on

Porém no Mandriva existe um utilitário drakauth de linha de comando que facilita (e muito) a configuração das estações Linux que irão se autenticar no servidor LDAP, pois apenas é necessário informar que se deseja autenticar via LDAP, o IP do servidor LDAP e o Sufixo Ldap.

As configurações abaixo dizem respeito aos clientes que irão utilizar o servidor ldap para se autenticarem.

Isso facilitará o administrador do LDAP via linha de comando, pois não será necessário informar a senha toda vez que se fizer alguma alteração na base LDAP. Mas tome cuidado com esse arquivo, pois ninguém que estiver logado no servidor poderá lê-lo. Por isso faça um

# chmod 600 /etc/ldap.secret.

# O acesso ao seu servidor LDAP tem que ser resolvido sem usar LDAP.
# De preferência coloque o IP ou tenha certeza que o DNS resolve o nome.
host 127.0.0.1

# O nome distinto da base de procura.
base 

# A identificacao do root do Ldap, ou seja o "Root Password DN"
# A senha deve ser armazenada no arquivo /etc/ldap.secret (mode 600)
rootbinddn cn=,

# Contexto para pesquisa no LDAP (RFC2307bis)
# Nos usaremos ?sub (e nao o default ?one) porque separamos
# sambaAccounts no ou=Computer,
# e usuarios em ou=Usuarios,
nss_base_passwd         ?sub
nss_base_shadow         ?sub
nss_base_group          ou=Grupos,?one

# Opcoes de seguranca
ssl no
pam_password crypt

passwd:     files ldap
shadow:     files ldap
group:      files ldap

hosts:      files nisplus nis dns

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files

netgroup:   nisplus

publickey:  nisplus

automount:  files nisplus
aliases:    files nisplus

# Módulo "pam_ldap.so" para conecções pelo ldap
# Isso não afeta se os usuários existem localmente em /etc/passwd
#%PAM-1.0

auth        required      pam_env.so
auth        sufficient    pam_succeed_if.so use_uid user ingroup wheel
auth        sufficient    pam_unix.so likeauth nullok
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     sufficient    pam_unix.so
# Usar o ldap antes de arquivos locais
account     sufficient    pam_ldap.so use_first_pass
account     required      pam_deny.so

password    required      pam_cracklib.so retry=3 minlen=2  dcredit=0  ucredit=0
password    sufficient    pam_unix.so nullok use_authtok md5 shadow
# Aceitar o ldap para checar usuário/senha
password    sufficient    pam_ldap.so
password    required      pam_deny.so

# Criar diretório local no momento em que o usuário se loga no Desktop
session     optional      pam_mkhomedir.so skel=/etc/skel/ umask=0077
session     required      pam_limits.so
session     required      pam_unix.so

[root@jarbelix ~]# getent passwd

[root@jarbelix ~]# getent shadow

[root@jarbelix ~]# getent group

# Parâmetros Globais
[global]

   # Dominio, Nome e Descricao
        workgroup = 
        netbios name = 
        server string = 

   # Disponibilizar impressora no Linux para Windows
        printcap name = cups
        load printers = yes
        printing = cups
        # printcap cache time, so samba will automatically load new cups printers
        printcap cache time = 60

   # Nao mostrar no servidor o Wizard "Adicionar Impressora"
        show add printer wizard = No

   # Quais interfaces de rede utilizar
        interfaces = lo, eth0
        bind interfaces only = Yes

   # Nivel de Mensagens
        log level = 1
        log file = /var/log/samba/%m.log
        max log size = 0
        debug level = 1
        syslog = 0

   # Atuar como um PDC
        security = user
        domain logons = yes
        preferred master = yes
        domain master = yes
        os level = 65

   # Tratamento das senhas
        encrypt passwords = yes

   # Equivalencia de usuarios Windows X Linux
        username map = /etc/samba/smbusers

   # Evitar o perfil ambulante do Windows NT/XP
        logon path =
        logon drive =
        logon home =

   # Script de logon em rede (deve ficar no compartilhamento netlogon - em formato DOS)
        logon script = .BAT

   # Configuracoes para o LDAP
        passdb backend = ldapsam:ldaps://127.0.0.1
        ldap passwd sync = yes
        ldap delete dn = Yes
        ldap admin dn = cn=,
        ldap suffix = 
        ldap machine suffix = ou=Computadores
        ldap user suffix = ou=Usuarios
        ldap group suffix = ou=Grupos
        ldap idmap suffix = sambaDomainName=
        idmap backend = ldap:ldaps://127.0.0.1
        idmap uid = 10000-20000
        idmap gid = 10000-20000
   # Permitir que usuarios do grupo "Administradores do Dominio" possam ingressar maquinas
   # WinXP/Win2000 ao dominio samba
   # to the domain
        enable privileges = yes

   # Scrips utilizados para Gerenciar Usuários da M$
   # adiconar/remover Usuarios
        add user script = /usr/sbin/smbldap-useradd -m "%u"
        delete user script = /usr/sbin/smbldap-userdel "%u"
   # adiconar/remover Grupos
        add group script = /usr/sbin/smbldap-groupadd -p "%g"
        delete group script = /usr/sbin/smbldap-groupdel "%g"
   # Scripts para adiconar/remover Usuarios nos Grupos
        add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
        delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
   # Script para definir o grupo primario do usuario
        set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
   # Script par adicionar maquina Win NT/XP ingressar no Dominio
        add machine script = /usr/sbin/smbldap-useradd -w "%u"

   # Otimizacoes recomendadas em
        smb ports = 445 139
        name resolve order = wins bcast hosts
        utmp = Yes
        time server = Yes
        template shell = /bin/false
        winbind use default domain = no
        map acl inherit = Yes
        strict locking = Yes

   # Como o cliente ira' se comunicar com o servidor
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

   # Servidor Wins da Rede
   # Quando já tiver um servidor Wins na rede
   # descomente a linha abaixo e acerte o IP do Wins
#      wins server = 10.0.134.223
   # Quando ainda não tiver um servidor Wins na rede
   # descomente a linha abaixo
       wins support = Yes
   

   # Ativar a internacionalizacao: permitir caracteres acentuados pelo Windows
        dos charset = CP850
        unix charset = ISO8859-1

   # Nao tentar fazer um lock nestes arquivos
        veto files = /*.eml/*.nws/*.{*}/
        veto oplock files = /*.doc/*.xls/*.mdb/

   # Tratar os arquivos que comecam com "." como ocultos para maquinas Windows
        hidedotfiles = yes

   # Simular a Lixeira do Windows
        recycle:repository = .lixeira
        recycle:keeptree = True
        recycle:touch = True
        recycle:versions = True
        recycle:exclude = *.tmp|*.temp|*.o|*.obj|~$*|*.$$$
        recycle:excludedir = /tmp|/temp|/trash
        recycle:noversions = .doc|.xls|.ppt|.dbf|.nsx|.idx|.dbt
        recycle:maxsize = 0

#=============================
#===== Compartilhamentos =====
#=============================

[netlogon]
        comment = Servico de Logon em Rede [ .BAT ]
        path = /home/samba/netlogon
        browseable = Yes
        read only = Yes

[home]
        comment = Diretorio Pessoal de Cada Usuario [ U:\ ]
        path = /home/usr/%u
        browseable = no
        writeable = Yes
        create mask = 0600
        directory mask = 0700
#        vfs objects = recycle

[dados]
        comment = Sistemas e Dados de Usuarios [ F:\ ]
        path = /home/samba/dados
        writeable = Yes
        force create mode = 0660
        force directory mode = 02770
        vfs objects = recycle

[temp]
        comment = Dados Temporarios [ T:\ ]
        path = /home/samba/temp
        writeable = Yes
        force create mode = 0666
        force directory mode = 02777

[printers]
   comment = Spool de Impressao SMB
   path = /var/spool/samba
   browseable = No
   guest ok = Yes
   writeable = No
   printable = Yes
   create mode = 0700
   use client driver = yes

# This share is used for Windows NT-style point-and-print support.
# To be able to install drivers, you need to be either root, or listed
# in the printer admin parameter above. Note that you also need write access
# to the directory and share definition to be able to upload the drivers.
# For more information on this, please see the Printing Support Section of
# /usr/share/doc/samba-/docs/Samba-HOWTO-Collection.pdf
#
# A special case is using the CUPS Windows Postscript driver, which allows
# all features available via CUPS on the client, by publishing the ppd file
# and the cups driver by using the 'cupsaddsmb' tool. This requires the
# installation of the CUPS driver (http://www.cups.org/windows.php)
# on the server, but doesn't require you to use Windows at all :-).
[print$]
   path = /var/lib/samba/printers
   browseable = yes
   write list = @"Operadores de Impressao" root
   guest ok = yes
   inherit permissions = yes

[root@jarbelix ~]# rm -rf /etc/samba/secrets.tdb /var/log/samba/*

[root@jarbelix ~]# smbpasswd -w 
Setting stored password for "cn=," in secrets.tdb

root@jarbelix ~]# service smb start
Iniciando os serviços SMB:                                      [  OK  ]
Iniciando os serviços NMB:                                      [  OK  ]

[root@jarbelix ~]# smbclient -L 127.0.0.1 -U%
Domain=[] OS=[Unix] Server=[Samba 3.0.13]

        Sharename       Type      Comment
        ---------       ----      -------
        netlogon        Disk      Servico de Logon em Rede [ .BAT ]
        dados           Disk      Sistemas e Dados de Usuarios [ F:\ ]
        temp            Disk      Dados Temporarios [ T:\ ]
        print$          Disk
        IPC$            IPC       IPC Service ()
        ADMIN$          IPC       IPC Service ()
        HP-LaserJet     Printer   HP LaserJet 4P
        HP-GALENO       Printer   HP DeskJet 680C

Domain=[] OS=[Unix] Server=[Samba 3.0.13]
        Server               Comment
        ---------            -------
                  

        Workgroup            Master
        ---------            -------
                  

[root@jarbelix ~]# mkdir -p /home/samba/dados /home/samba/netlogon /home/samba/temp
[root@jarbelix ~]# chmod 2770 /home/samba/dados/ /home/samba/temp/
[root@jarbelix ~]# chmod 750 /home/samba/netlogon/
[root@jarbelix ~]# chgrp 513 /home/samba/*

[root@jarbelix ~]# ll /home/samba/
total 12
drwxrws---  20 root Usuarios do Dominio 4096 Set  2 21:36 dados/
drwxr-x---   2 root Usuarios do Dominio 4096 Set  2 23:28 netlogon/
drwxrws---   2 root Usuarios do Dominio 4096 Set  2 23:51 temp/
[root@ServerLinux ~]#

[root@jarbelix ~]# net getlocalsid
[2005/07/19 16:03:14, 0] lib/smbldap.c:smbldap_search_suffix(1176)
  smbldap_search_suffix: Problem during the LDAP search:  (No such object)
SID for domain  is: S-1-5-21-2942727800-3465096550-1454047873

[root@jarbelix ~]# /usr/share/doc/smbldap-tools-0.9.1/configure.pl

# Coloque aqui seu próprio SID
# para obter este número faça: net getlocalsid
SID="S-1-5-21-3605816189-1598215328-2250501690"

##############################################################################
#
# LDAP Configuration
#
##############################################################################

# Slave LDAP : para melhorar a performance
slaveLDAP="127.0.0.1"
slavePort="389"

# Master LDAP : necessario para operacoes de escrita
masterLDAP=""
masterPort="389"

# Usar TLS para LDAP
# Se "setado" para 1, esta opção irá usar start_tls para conecções
ldapTLS="0"

# How to verify the server's certificate (none, optional or require)
# see "man Net::LDAP" in start_tls section for more details
verify="require"

# CA certificate
# see "man Net::LDAP" in start_tls section for more details
cafile="/etc/smbldap-tools/ca.pem"

# certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientcert="/etc/smbldap-tools/smbldap-tools.pem"

# key certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientkey="/etc/smbldap-tools/smbldap-tools.key"

# Sufixo LDAP
suffix=""

# Onde são armazenados os Usuarios
usersdn="ou=Usuarios,${suffix}"

# Onde estão armazenados os Computadores
computersdn="ou=Computadores,${suffix}"

# Onde estão armazenados os Grupos
groupsdn="ou=Grupos,${suffix}"

# Onde estão armazenados as entradas Idmap (usadas se o samba é um servidor membro do domínio)
idmapdn="ou=Idmap,${suffix}"

# Onde são armazenadas os próximos uidNumber e gidNumber disponíveis
sambaUnixIdPooldn="sambaDomainName=,${suffix}"

# Escopo default utilizado
scope="sub"

# Método de criptografação utilizado pelo Unix (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT)
hash_encrypt="SSHA"

# if hash_encrypt is set to CRYPT, you may set a salt format.
# default is "%s", but many systems will generate MD5 hashed
# passwords if you use "$1$%.8s". This parameter is optional!
crypt_salt_format="%s"

##############################################################################
#
# Unix Accounts Configuration
#
##############################################################################

# Login defs
# Default Login Shell
userLoginShell="/bin/bash"

# Home directory
userHome="/home/usr/%U"

# Gecos
userGecos="System User"

# Default User (POSIX and Samba) GID
defaultUserGid="513"

# Default Computer (Samba) GID
defaultComputerGid="515"

# Skel dir
skeletonDir="/etc/skel"

# Tempo de vida, em dias, das senhas dos usuários Windows.
# Comente a linha abaixo se não desejar expirar esta senha
# Cuidado com o valor do atributo sambaPwdMustChange
defaultMaxPasswordAge="99"

##############################################################################
#
# SAMBA Configuration
#
##############################################################################

# The UNC path to home drives location (%U username substitution)
# Ex: \\My-PDC-netbios-name\homes\%U
# Just set it to a null string if you want to use the smb.conf 'logon home'
# directive and/or disable roaming profiles
#userSmbHome="\\PDC-SRV\homes\%U"
userSmbHome=""

# The UNC path to profiles locations (%U username substitution)
# Ex: \\My-PDC-netbios-name\profiles\%U
# Just set it to a null string if you want to use the smb.conf 'logon path'
# directive and/or disable roaming profiles
#userProfile="\\PDC-SRV\profiles\%U"
userProfile=""

# The default Home Drive Letter mapping
# (will be automatically mapped at logon time if home directory exist)
# Ex: H: for H:
userHomeDrive=""

# The default user netlogon script name (%U username substitution)
# if not used, will be automatically username.cmd
# Ex: %U.cmd
# userScript="startup.cmd" # make sure script file is edited under dos
# deixe comentado para utilizar o script de logon do /etc/samba/smb.conf
#userScript=".BAT"


# Domain appended to the users "mail"-attribute
# when smbldap-useradd -M is used
mailDomain=""

##############################################################################
#
# SMBLDAP-TOOLS Configuration (default are ok for a RedHat)
#
##############################################################################

# Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but
# prefer Crypt::SmbHash library
with_smbpasswd="0"
smbpasswd="/usr/bin/smbpasswd"

# Allows not to use slappasswd (if with_slappasswd == 0 in smbldap_conf.pm)
# but prefer Crypt:: libraries
with_slappasswd="0"
slappasswd="/usr/sbin/slappasswd"

############################
# Credential Configuration #
############################
# Nota: você pode especificar duas configuracoes diferentes se voce
# utiliza um ldap MASTER para escrita e outro ldap SLAVE para leitura
# Por default, iremos utilizar o mesmo DN
slaveDN="cn=,"
slavePw=""
masterDN="cn=,"
masterPw=""

#!/bin/bash
#
# Objetivo: trocar as informações do smbldap-populate do ingles para o portugues brasileiro
#
# Autor: Jarbas, 14-04-2005
# Licença: GPL :)

if [ $# -ne 1 ]; then
        echo "Sintaxe errada"
        echo "O correto eh $0 CAMINHO-COMPLETO-DO-smbldap-populate a ser traduzido"
        exit 1
fi

sed -e "s/Administrators/Administradores/g" \
     -e "s/Domain Guest/Convidados do Dominio/g" \
     -e "s/Domain Admins/Administradores do Dominio/g" \
     -e "s/Domain Users/Usuarios do Dominio/g" \
     -e "s/Domain Computers/Computadores do Dominio/g" \
     -e "s/Print Operators/Operadores de Impressao/g" \
     -e "s/Backup Operators/Operadores de Backup/g" \
     -e "s/Account Operators/Operadores de Contas/g" \
     -e "s/Replicators/Duplicadores/g" $1  > $1.pt_BR

chmod +x $1.pt_BR

echo "Arquivo $1 traduzido em $1.pt_BR"

[root@jarbelix ~]# type smbldap-populate
smbldap-populate is /usr/sbin/smbldap-populate

[root@jarbelix ~]# ./smbldap-populate-pt_BR.sh /usr/sbin/smbldap-populate
Arquivo /usr/sbin/smbldap-populate traduzido em /usr/sbin/smbldap-populate.pt_BR

1. O parâmetro abaixo informado após o -a permitirá que você utilize outro usuário ao invés do root para ser o administrador do ldap.
2. Algumas pessoas me relataram que não conseguiam concluir a instalação utilizando o Manager ou Admin como administrador.
3. Creio que esse parâmetro irá resolver o problema.

[root@jarbelix ~]# /usr/sbin/smbldap-populate.pt_BR -a 
Populating LDAP directory for domain  (S-1-5-21-2942727800-3465096550-1454047873)
(using builtin directory structure)

adding new entry: 
adding new entry: ou=Usuarios,
adding new entry: ou=Grupos,
adding new entry: ou=Computadores,
adding new entry: ou=Idmap,
adding new entry: uid=,ou=Usuarios,
adding new entry: uid=nobody,ou=Usuarios,
adding new entry: cn=Administradores do Dominio,ou=Grupos,
adding new entry: cn=Usuarios do Dominio,ou=Grupos,
adding new entry: cn=Convidados do Dominios,ou=Grupos,
adding new entry: cn=Computadores do Dominio,ou=Grupos,
adding new entry: cn=Administradores,ou=Grupos,dc=go,
adding new entry: cn=Operadores de Contas,ou=Grupos,
adding new entry: cn=Operadores de Impressao,ou=Grupos,
adding new entry: cn=Operadores de Backup,ou=Grupos,
adding new entry: cn=Duplicadores,ou=Grupos,
adding new entry: sambaDomainName=,

Please provide a password for the domain :
Changing password for 
New password :
Retype new password :

Portanto NAO é a mesma senha do Password Root Ldap ().

Coloque uma outra para que o usuário possa ingressar máquinas no Domínio, quando o Windows XP/2k/2k3 solicitar o usuário/senha.

[root@jarbelix ~]# ldapsearch -x -b "" "(ObjectClass=*)"
# extended LDIF
#
# LDAPv3
# base  with scope sub
# filter: (ObjectClass=*)
# requesting: ALL
#

dn: 
objectClass: dcObject
objectClass: organization

...
... (outras entrada foram omitidas)
...

# search result
search: 2
result: 0 Success

# numResponses: 18
# numEntries: 17

[root@lxgod001 ~]# slapcat > slapcat.ldbm.ldif
[root@lxgod001 ~]# ll slapcat.ldbm.ldif
-rw-r--r--  1 root root 1570213 Ago 15 10:42 slapcat.ldbm.ldif

[root@lxgod001 ~]# pdbedit -v -u d323209
Unix username:        d323209
NT username:          d323209
Account Flags:        [U          ]
User SID:             S-1-5-21-4134352437-1265944048-1494428847-4020
Primary Group SID:    S-1-5-21-4134352437-1265944048-1494428847-513
Full Name:            Jarbas Peixoto Júnior
Home Directory:
HomeDir Drive:
Logon Script:         PSGOD001.BAT
Profile Path:
Domain:               PREV-GO
Account desc:         JARBAO
Workstations:
Munged dial:
Logon time:           0
Logoff time:          Tue, 19 Jan 2038 01:14:07 GMT
Kickoff time:         Tue, 19 Jan 2038 01:14:07 GMT
Password last set:    Thu, 11 Aug 2005 16:12:38 GMT
Password can change:  Tue, 09 Aug 2005 13:59:40 GMT
Password must change: Fri, 18 Nov 2005 17:12:38 GMT
Last bad password   : 0
Bad password count  : 0
Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

[root@jarbelix ~]# getent passwd
root:x:0:0:root:/root:/bin/bash
...
... (outros usuários foram omitidos)
...
:x:0:0:Netbios Domain Administrator:/home/usr/root:/bin/false
nobody:x:999:514:nobody:/dev/null:/bin/false

[root@jarbelix ~]# ls /usr/sbin/smbldap*
/usr/sbin/smbldap-groupadd*  /usr/sbin/smbldap-groupshow*  /usr/sbin/smbldap-populate.pt_BR*  /usr/sbin/smbldap-userinfo*
/usr/sbin/smbldap-groupdel*  /usr/sbin/smbldap-passwd*     /usr/sbin/smbldap-useradd*         /usr/sbin/smbldap-usermod*
/usr/sbin/smbldap-groupmod*  /usr/sbin/smbldap-populate*   /usr/sbin/smbldap-userdel*         /usr/sbin/smbldap-usershow*

[root@jarbelix ~]# smbldap-passwd --help
(c) Jerome Tournier - IDEALX 2004 (http://www.idealx.com)- Licensed under the GPL
Usage: /usr/sbin/smbldap-passwd [username]
  -u             update only unix password (userPasswd)
  -?, --help     show this help message

[root@jarbelix ~]# smbldap-groupadd -a DATAPREV
[root@jarbelix ~]# smbldap-groupadd -a INSS

[root@jarbelix ~]# getent group
root:x:0:
...
... (outros grupos foram omitidos)
...
Administradores do Dominio:x:512:
Usuarios do Dominio:x:513:linux,sambix
Convidados do Dominios:x:514:
Computadores do Dominio:x:515:
Administradores:x:544:
Operadores de Contas:x:548:
Operadores de Impressao:x:550:
Operadores de Backup:x:551:
Duplicadores:x:552:
DATAPREV:x:1000:
INSS:x:1001:

[root@jarbelix ~]# mkdir -p /home/usr

[root@jarbelix ~]# smbldap-useradd -m -c "Teste Linux" linux
[root@jarbelix ~]# smbldap-passwd linux
Changing password for linux
New password :
Retype new password :

[root@jarbelix ~]# smbldap-useradd -a -m -c "Teste Samba" sambix
[root@jarbelix ~]# smbldap-passwd sambix
Changing password for sambix
New password :
Retype new password :

[root@jarbelix ~]# smbldap-useradd -w winlinux

[root@jarbelix ~]# getent passwd
root:x:0:0:root:/root:/bin/bash
...
... (outros usuários foram omitidos)
...
:x:0:0:Netbios Domain Administrator:/home/usr/root:/bin/false
nobody:x:999:514:nobody:/dev/null:/bin/false
linux:x:1000:513:Teste Linux:/home/usr/linux:/bin/bash
sambix:x:1001:513:Teste Samba:/home/usr/sambix:/bin/bash
winlinux$:x:1002:515:Computer:/dev/null:/bin/false

@echo off
rem Logon script Default - by Jarbas, 3501-2248 - Dataprev-GO

REM Coloque na linha abaixo o nome dado ao servidor
REM definido no smb.conf pelo parametro "netbios name"

set LOGONSERVER=\
echo ========================================================
echo Executando o script de login do Servidor %LOGONSERVER%
echo Por favor, aguarde...
echo =============================
echo ...

echo Efetuando os Mapeamentos F: U: e T:

if %OS%.==Windows_NT. goto WinNT

:Win95
:Win98
NET USE F: %LOGONSERVER%\DADOS
NET USE U: %LOGONSERVER%\HOME
NET USE T: %LOGONSERVER%\TEMP
goto Fim_Mapeamento

:WinNT
REM Se for um Windows_NT fazendo login devo desmapear o drive mapeado ao fazer logoff
NET USE F: %LOGONSERVER%\DADOS  /PERSISTENT:NO
NET USE U: %LOGONSERVER%\HOME   /PERSISTENT:NO
NET USE T: %LOGONSERVER%\TEMP   /PERSISTENT:NO

:Fim_Mapeamento
echo Atualizando a hora local com o Relogio do Servidor
NET TIME %LOGONSERVER% /SET /YES

:Fim_Geral
REM == FIM DO CODIGO ==

[root@jarbelix ~]# urpmi unix2dos

    ftp://mirror/pub/linux/Mandrakelinux/devel/cooker/i586/media/contrib/unix2dos-2.2-5mdk.i586.rpm
instalando unix2dos-2.2-5mdk.i586.rpm a partir de /var/cache/urpmi/rpms
Preparando...                    #############################################
      1/1: unix2dos              #############################################

[root@jarbelix ~]# unix2dos /home/samba/netlogon/.BAT
unix2dos: converting file .BAT to DOS format ...

Em caso de algum erro neste tutorial sinta-se à vontade para me mandar as correções, ou mesmo fazê-las on-line, neste TWiki Site (http://psl-go.softwarelivre.org).

Quem sou eu? Clique em JarbasJunior!