“UbuntuHelp:ActiveDirectoryHowto”的版本间的差异

2007年12月3日 (一) 15:47的版本

文章出处:

https://help.ubuntu.com/community/ActiveDirectoryHowto

点击翻译:

English  • 中文

请不要直接编辑翻译本页，本页将定期与来源同步。

== 活动目录 == 微软的活动目录作为一种服务也支持很多开放的协议,如 Kerberos, ldap和SSL. 这里有很多种方法来使用活动目录的认证, 你可以使用 pam_krb5, LDAP 或者 winbind. 使用winbind请查看 [ActiveDirectoryWinbindHowto]. === === === Kerberos: pam_krb5 === ==== 配置和安装
==== 安装pam_krb5之前你需要从Universe Repository安装krb5-user 和 libpam-krb5 .'你不需要更改活动目录的任何配置 安装krb5 $ sudo apt-get install krb5-user libpam-krb5 安装完成后 使用文本编辑器编辑/etc/krb5.conf文件,添加或修改以下的内容. '

[logging]
default = FILE:/var/log/krb5lib.log
[libdefaults]
ticket_lifetime = 24000
default_realm = EXAMPLE.COM
default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc
default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc
[realms]
EXAMPLE.COM = {
kdc = windc.example.com
admin_server = windc.example.com
default_domain = example.com
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM

你需要使用你windows的FQDN域名或者IP替换其中的 windc.example.com,用你的kerberos realm替换和 EXAMPLE.COM, 域名需要大写.保存并关闭文本编辑器. 使用kinit命令来测试你是否能收到kerberos的票据 注意:域名要大写

# kinit user
Password for [email protected]: ...
# klist
Ticket cache: FILE:/tmp/krb5cc_1003
Default principal: [email protected]
Valid starting Expires Service principal
11/26/04 11:23:53 11/26/04 21:23:53 krbtgt/[email protected]
Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

下面进行认证的配置 编辑 /etc/pam.d/common-auth

auth sufficient pam_krb5.so ccache=/tmp/krb5cc_%u
auth sufficient pam_unix.so likeauth nullok use_first_pass
auth required pam_deny.so

编辑 /etc/pam.d/common-session.

session required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0077

kpasswd for password changing does not work. The user from AD have to exist in /etc/passwd on the ubuntu workstation, you can also use libnss-ldap to get the account info also from AD. === LDAP === ==== TestQuery: Windows ==== Assuming you do not maintain the Active Directory, You will want to determine the structure of AD before trying to connect to it from Linux. From a windows PC connected to AD you should perform a query using Microsoft's Active Directory Application Mode (ADAM). ADAM is a package of tools that includes CSVDE, which we will be using to perform our queries. Type this into google, the download page should be the second hit.

adam microsoft

Install. Open the command prompt. Start>RUN and type 'cmd' Navigate to the installation directory, default is c:\windows\ADAM Example Queries: Query a user entry

CSVDE -f export.csv -r "(&(objectClass=user)(sn=lastname))"

wildcards work as well

CSVDE -f export.csv -r "(&(objectClass=user)(sn=last*))"

Query a computer entry

CSVDE -f export.csv -r "(&(objectClass=computer)(cn=computername))"

Return everything in the following AD folder

CSVDE -d "OU=Pathology,OU=Departmental OUs,OU=Medcenter,DC=Med,DC=University,DC=edu" -f export.csv

The output of these queries would be placed within export.csv inside c:\windows\ADAM. Which can then be viewed as a spreadsheet editor. For more on querying with ADAM's CSVDE [www.computerperformance.co.uk/Logon/Logon_CSVDE.htm] ==== Configure AD ==== In Windows Server versions prior to WS03 R2, it is necessary to extend the LDAP schema from AD with the UNIX attributes. Install "Windows Services for UNIX" from Microsoft (I used version 3.5). SFU: http://www.microsoft.com/windows/sfu/ Installing SFU 3.5 on Windows Server 2003 (non R2) does not appear to add the necessary LDAP schema extensions. In order to extend the LDAP schema, it is necessary to install the "Server for NIS" component. The installation needs to be performed using an account that has Enterprise Admin privileges in order for the schema to be extended successfully (indeed, Enterprise Admin privileges are required even if the schema has already been extended). In Active Directory, schema extensions are non-reversible, so if the NIS Server is not required, it can be removed once the schema extension is complete. If the SFU Server for NIS is installed however, it will extend the Active Directory Users and Computers tool with a UNIX Attributes tab which allows GUI editing of the UNIX attributes for users, groups and computers. In Windows Server 2003 R2, the Active Directory schema is already extended with an RFC2307-compliant schema. This differs from the schema extensions used in SFU3.5, requiring a different libnss-ldap configuration. It is still necessary to install Server for NIS to extend the Active Directory Users and Computers tool with the UNIX Attributes tab to allow GUI editing of UNIX attributes for users, groups and computers. ==== TestQuery: Linux ==== We will want to perform a testquery in linux before we attempt to configure AD. Its much simpler to determine how to connect on the commandline, and then configure, rather than reconfigure a file repeatedly. We will need at least these two packages to perform test queries on Active Directory.

sudo apt-get install libnss-ldap ldap-utils

We perform queries with 'ldapsearch' We must specify these minimum parameters: We need to specify the LDAP Server (Domain Controller)

ldapsearch -h medcenterdc01

and the authentication type: simple or SASL SASL authentication off, simple on

ldapsearch -h medcenterdc01 -x

and the folder we want to search in

ldapsearch -h medcenterdc01 -x -b "OU=Pathology,OU=Departmental OUs,OU=medcenter,DC=mc,DC=university,DC=edu" 

and who to authenticate as

ldapsearch -h medcenterdc01 -x -b "OU=Pathology,OU=Departmental OUs,OU=medcenter,DC=mc,DC=university,DC=edu" -D "CN=last name\\, firstname,OU=Users,OU=Pathology,OU=Departmental OUs,OU=medcenter,DC=mc,DC=university,DC=edu" 

we'll have it prompt for the password, instead of specifying it in the command

ldapsearch -h medcenterdc01 -x -b "OU=Pathology,OU=Departmental OUs,OU=medcenter,DC=mc,DC=university,DC=edu" -D "CN=last name\\, firstname,OU=Users,OU=Pathology,OU=Departmental OUs,OU=medcenter,DC=mc,DC=university,DC=edu" -W 

and lets search for sammy's account

ldapsearch -h medcenterdc01 -x -b "OU=Pathology,OU=Departmental OUs,OU=medcenter,DC=mc,DC=university,DC=edu" -D "CN=last name\\, firstname,OU=Users,OU=Pathology,OU=Departmental OUs,OU=medcenter,DC=mc,DC=university,DC=edu" -W "sAMAccountName=sammy" 

One doesn't need to worry about spaces, but to specify a comma as part of the path we need to prefix the comma with '\\'

CN=last name\\, firstname

==== libnss-ldap ==== You can install libnss-ldap and nscd from the Universe Repository. Now you need to set up /etc/nsswitch.conf for ldap.

passwd: compat
group: compat
shadow: compat
passwd_compat: ldap
group_compat: ldap
shadow_compat: ldap
hosts: files dns
networks: files dns
services: db files
protocols: db files
rpc: db files
ethers: db files
netmasks: files
netgroup: files
bootparams: files
automount: files
aliases: files

If you have trouble when you attempt to ping and your network has a wins server you will want to append 'wins' to the hosts line of nsswitch.conf - you may only notice this only when you try to ping a static ip linux pc from another linux pc - I believe wins is a part of the samba package and the IP addresses for wins servers are stored in /etc/samba/dhcp.conf, the static ip machine also needs to specify its netbios name within /etc/samba/smb.conf When fiddling with /etc/nsswitch.conf, it is best to turn the Name Services Caching Daemon off - /etc/init.d/nscd stop or you will be confused by cached results. Turn it on afterwards. Then you need to set up /etc/libnss-ldap.conf. AKA: /etc/ldap.conf

# Replace windc.example.com with your Windows DC
uri ldap://windc.example.com/
base dc=example,dc=com
ldap_version 3
# Add a user to AD, that can read the container
# with the users, that you want use.
binddn cn=ldapreader,cn=Users,dc=example,dc=com
bindpw cvfd123
scope sub
timelimit 30
pam_filter objectclass=User
pam_login_attribute sAMAccountName
pam_lookup_policy yes
# Modify cn=User,dc=e... to your container with your users.
nss_base_passwd cn=User,dc=example,dc=com?sub
nss_base_shadow cn=User,dc=example,dc=com?sub
nss_base_group cn=User,dc=example,dc=com?sub
# For MSSFU:
nss_map_objectclass posixAccount User
nss_map_objectclass shadowAccount User
nss_map_attribute uid sAMAccountName
nss_map_attribute uniqueMember member
nss_map_attribute uidNumber msSFU30UidNumber
nss_map_attribute gidNumber msSFU30GidNumber
nss_map_attribute userPassword msSFU30Password
nss_map_attribute homeDirectory msSFU30HomeDirectory
nss_map_attribute loginShell msSFU30LoginShell
nss_map_attribute gecos name
nss_map_attribute cn sAMAccountName

I think it only needs rootbinddn, no binddn, with the bindpw in /etc/libnss-ldap.secret, not here. I have also successfully combined /etc/ldap/ldap.conf, /etc/libnss-ldap.conf, and /etc/pam_ldap.conf, symlinking them all to /etc/ldap/ldap.conf - AndyRabagliati Incorrect nss_map settings will prevent one from authenticating, and reading AD in general. These settings are dependent on the column names within your AD database. In older systems the database (schema) needs to be extended as described in the 'Configure AD' section. Once these *NIX attributes are part of the schema they can be modified with the MMC snap-in Active directory Users and Groups, as long as idmu.exe has been installed from the Windows Server 2003 R2 Administration Tools Pack. If *NIX group membership has been administered by modifying the list in the UNIX attributes tab of AD Users and Computers (which is REQUIRED in a NIS environment), then 'uniqueMember' should be mapped to 'msSFU30PosixMember' (or 'posixMember' for WS03R2) as 'member' only includes the membership listed in the Windows group. For Windows Server 2003 R2, the schema extensions are RFC2307 compliant - no longer prefixed 'msSFU30' and with the next letter in lower case (e.g. msSFU30UidNumber is now uidNumber). Further optimizations of the queries can be made for the nss_base properties:

nss_base_passwd dc=mydomain,dc=com?sub?(&(objectClass=user)(uidnumber=*))
nss_base_shadow dc=mydomain,dc=com?sub?(&(objectClass=user)(uidnumber=*))
nss_base_group dc=mydomain,dc=com?sub?(&(objectClass=group)(gidnumber=*))
The ampersand in the queries above merely specifies AND logic
AND (&(filter)(filter))
OR (|(filter)(filter))
NOT (!(filter)(filter))

===== Debugging ===== To debug LDAP queries one should make sure nscd is off and use the getent command

sudo /etc/init.d/nscd stop
getent passwd
getent shadow
getent group

To follow the actions of the command use strace

strace getent passwd

If thats not enough you can place a line in the configuration file for output:

debug 10

This can be a value anywhere from 1 to 10, 10 being the most verbose. With this config is the LDAP Traffic unencrypted and someone can sniff it. To make it secure use SSL Now you need to set up /etc/pam.d/common-auth and

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_ldap.so
auth required pam_unix.so nullok_secure use_first_pass

set up /etc/pam.d/common-account.

#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system. The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
account sufficient pam_ldap.so
account required pam_unix.so

We are still using Kerberos for authentication, but now we are storing the information that would normally be stored in /etc/passwd using Active Directory. Here are some other useful config files: * login.defs * nscd.conf ----