PDC
\nTo add to the previous post, we’ll show now a way to ssh to your Solaris 10 SPARC server using an ActiveDirectory
\nuser+pass, additional to use samba shares anywhere, with your AD credentials.
\nBUILDING
\nSamba from blastwave does not include pam_winbind.so, to plug it to PAM, and use our AD user+pass to
\nlogin to solaris, so we ned to build our own samba. The release i got is samba 3.0.28, from
\nhttp:\/\/us4.samba.org\/samba\/ftp\/stable\/samba-3.0.28.tar.gz
\nWe need to make sure all required packages to build and use SAMBA are in the system, so please obtain
\nthis list
\nusing pkg-get from blastwave.
\nOur SAMBA sources like GNU ld, so we are not going to use solaris native ld to build it, we do so by doing:
\n# mv \/usr\/ccs\/bin\/ld \/usr\/ccs\/bin\/ld. old
\n# ln -s \/opt\/csw\/bin\/gld \/opt\/csw\/bin\/ld
\n# export PATH=$PATH:\/opt\/csw\/bin
\nWe uncompress SAMBA in a directory called “\/builds” and then:
\n# cd \/builds\/samba-3.0.28\/source
\n# .\/configure –with-ldap –with-ads –with-krb5=\/opt\/csw –with-winbind –with-pam –prefix=\/usr\/samba_ad
\nThis will use the openldap client libs in \/opt\/csw, same as the krb5 in \/opt\/csw. If all reqs are passed do a
\n# make && make install
\nThen, it will all end at \/usr\/samba_ad
\nAfter building these you can always remove the gcc suite, automake, autoconf, flex and bison.
\nWe now need to copy the nsswitch and pam extensions to their locations:
\n# cp \/builds\/samba-3.0.28\/source\/nsswitch\/libnss_win* \/usr\/lib
\n# ln -s \/usr\/lib\/libnss_winbind.so \/usr\/lib\/libnss_winbind.so.1
\n# ln -s \/usr\/lib\/libnss_wins.so \/usr\/lib\/libnss_wins.so.1
\nNow we copy the pam extension:
\n# cp \/builds\/samba-3.0.28\/source\/bin\/pam_winbind.so \/usr\/lib\/security
\n# cp \/builds\/samba-3.0.28\/source\/bin\/pam_winbind.so \/lib\/security
\n# ln -s \/usr\/lib\/security\/pam_winbind.so \/usr\/lib\/security\/pam_winbind.so.1
\n# ln -s \/lib\/security\/pam_winbind.so \/lib\/security\/pam_winbind.so.1
\nCONFIGURING
\n134\/433
\n\/opt\/csw\/etc\/krb5.conf
\n:
\n\/usr\/samba_ad\/lib\/smb.conf
\n:
\n\/etc\/nsswitch.conf
\n, to add winbind to users and groups:
\npasswd: files winbind
\ngroup: files winbind
\nOur Windows 2003 ActiveDirectory Primary Domain controller is “fwa-dc01.aww.com”, our AD domain is
\n“AWW.COM”, and our solaris 10 sparc server is “netra.aww.com”, so we add these entries to \/etc\/hosts,
\ntaking care the FQDN appears first.
\n172.16.1.38 netra.aww.com netra loghost
\n172.16.1.55 fwa-dc01.aww.com fwa-dc01
\nNow we configure pam.conf, we need to make sure home directories are created whenever a user from the
\nwindows world logs in, so we get pam_mkhomedir from http:\/\/mega.ist. utl.pt\/~filipe\/pam_mkhomedir-sol\/, at
\nhttp:\/\/mega.ist. utl.pt\/~filipe\/pam_mkhomedir-sol\/pam_mkhomedir-sol-0.0.1.tgz
\nWe build pam_mkhomedir by uncompressing it at \/builds\/pam_mkhomedir and editing its Makefile to use the
\nsolaris native ld:
\nLD=\/usr\/ccs\/bin\/ld.old
\nnow we just build it
\n# cd \/builds\/pam_mkhomedir
\n# make
\nAnd then we copy it to the system default for PAM modules:
\n# cp \/builds\/pam_mkhomedir\/pam_mkhomedir.so \/usr\/lib\/security
\n# ln -s \/usr\/lib\/security\/pam_mkhomedir.so \/usr\/lib\/security\/pam_mkhomedir. so.1
\n\/etc\/pam.conf
\n, to use both pam_winbind and pam_mkhomedir, adding 4 lines:
\nlogin auth sufficient pam_winbind.so.1
\nother auth sufficient pam_winbind.so.1
\nother account sufficient pam_winbind.so.1
\nother session optional pam_mkhomedir.so.1 skel=\/etc\/skel umask=0022
\nSTARTING DAEMONS
\nAfter this, we can start samba, and see the effects:
\n# export PATH=\/usr\/samba_ad\/sbin:\/usr\/samba_ad\/bin:\/opt\/csw\/bin:\/opt\/csw\/sbin:$PATH
\n# pkill winbindd; pkill smbd;pkill nmbd, \/etc\/init.d\/cswsamba stop
\n# \/opt\/csw\/bin\/kdestroy
\n# net ads leave -U “Administrator%M1cr050ft123”
\n# \/opt\/csw\/bin\/kinit Administrator@AWW.COM
\n# net ads join -U “Administrator%M1cr050ft123”
\n135\/433
\n# winbindd -B
\n# smbd -D
\n# nmbd -D
\nTESTING
\nI wrote an easy test script called sambatest.ksh:
\n#!\/bin\/bash
\nexport
\n136\/433
\nPATH=\/usr\/samba_ad\/sbin:\/usr\/samba_ad\/bin:\/opt\/csw\/bin:\/opt\/csw\/sbin:\/usr\/sbin:\/usr\/bin:\/usr\/openwin\/bin:\/opt\/csw\/gcc3\/bin:\/usr\/sfw\/bin:\/usr\/ccs\/bin:\/usr\/local\/bin:\/usr\/local\/bin:\/usr\/local\/sbin
\nexport LD_LIBRARY_PATH=\/usr\/samba_ad\/lib
\nset -x
\nwhich net
\nwhich smbd
\nwhich nmbd
\nwhich winbindd
\nwhich klist
\nwhich kinit
\n137\/433
\nsleep 5
\nsmbclient -L netra -U%
\nwbinfo -m
\nwbinfo -g
\nwbinfo -u
\ngetent passwd
\ngetent group
\nnet ads status
\nnet ads info
\nthis
\n. Please note that wbinfo -m shows your AD domain, wbinfo -g and wbinfo
\n-u show users and groups, getent passwd should show both your local and AD users.
\nNow we use ssh with an ActiveDirectory user+pass, it should look like this:
\nroot@kraftek:~# ssh bmahock@netra
\nPassword:
\nCreating directory ‘\/export\/home\/AWW.bmahock’.
\nLast login: Sat Feb 2 19:53:08 2008 from localhost
\n\/usr\/openwin\/bin\/xauth: creating new authority file \/export\/home\/AWW.bmahock\/.Xauthority
\nSun Microsystems Inc. SunOS 5.10 Generic January 2005
\n-bash-3.00$ id
\nuid=10004(bmahock) gid=10008(domain users)
\n-bash-3.00$ pwd
\n\/export\/home\/AWW.bmahock
\nThen it’s just a question of enjoying. \ud83d\ude42
\nBINARIES
\nIf you don’t want to compile much, just install the CSW packages mentioned above, get these binaries:
\nsamba_ad_solaris_10_sparc.tar.gz
\n, put them at \/ and untar them, be careful, these contain the libraries
\nneeded at \/usr\/lib\/security and \/usr\/lib, then just configure \/etc\/nsswitch.conf, \/etc\/pam.conf,
\n\/usr\/samba_ad\/lib\/smb.conf, \/etc\/krb5.conf and \/opt\/csw\/etc\/krb5.conf, verify for each program and library that
\nno symbol is missing using ldd, and start your engines!.
\nSCREENSHOTS
\nComputers
\nUsers
\nfreenx solaris gnome session
\nfor an ActiveDirectory user, yes he can also use sudo!
\nwindows xp
\nusing his AD user+pass, and paswordless-ly view and
\nsmb.conf
\n.
\n138\/433<\/p>\n","protected":false},"excerpt":{"rendered":"
PDC To add to the previous post, we’ll show now a way to ssh to your Solaris 10 SPARC server using an ActiveDirectory user+pass, additional to use samba shares anywhere, with your AD credentials. BUILDING Samba from blastwave does not include pam_winbind.so, to plug it to PAM, and use our AD user+pass to login to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-550","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/posts\/550","targetHints":{"allow":["GET"]}}],"collection":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=550"}],"version-history":[{"count":0,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/posts\/550\/revisions"}],"wp:attachment":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=550"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=550"},{"taxonomy":"post_tag","embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=550"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}