View source for Centralized login using LDAP and Samba

To create a centralized authentication system where both Windows and Linux/Unix client can authenticate against follow this tutorial.
=Install Samba=
<pre>
apt-get install samba
</pre>
*Workgroup/Domain Name: <EXAMPLE.COM>
*Modify smb.conf to use WINS settings from DHCP? <No>

=LDAP Server=
<pre>
apt-get install slapd samba-doc
</pre>
*Administrator password: <password>
*Confirm password: <password>

=Configure LDAP Server=
Remove the database that was created during installation:
<pre>
rm -rf /var/lib/ldap/*
</pre>
Run
<pre>
dpkg-reconfigure slapd
</pre>
*Omit OpenLDAP server configuration? <No>
*DNS domain name: <example.com>
*Organization name: <Example Organization>
*Administrator password: <password>
*Confirm password: <password>
*Database backend to use: <HDB>
*Do you want the database to be removed when slapd is purged? <No>
*Move old database? <Yes>
*Allow LDAPv2 protocol? <No>
Copy the example samba.schema file
<pre>
zcat /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz > /etc/ldap/schema/samba.schema
</pre>
Edit /etc/ldap/slapd.conf to add the samba schema
<pre>
include         /etc/ldap/schema/samba.schema
</pre>
Add the indexing options to /etc/ldap/slapd.conf
<pre>
index         uid,uidNumber,gidNumber,memberUid       eq
index         cn,mail,surname,givenname               eq,subinitial
index         sambaSID                                eq
index         sambaPrimaryGroupSID                    eq
index         sambaDomainName                         eq
</pre>
Change access rules in /etc/ldap/slapd.conf
<pre>
access to attrs=userPassword,shadowLastChange,sambaNTPassword,sambaLMPassword
        by dn="cn=admin,dc=example,dc=com"  write
        by anonymous auth
        by self write
        by * none
</pre>
Restart de OpenLDAP server
<pre>
/etc/init.d/slapd restart
</pre>

=Configure Samba=
Create the profile and netlogon directories for domain purpose:
<pre>
mkdir /var/lib/samba/profiles
chmod 777 /var/lib/samba/profiles
mkdir /var/lib/samba/netlogon
</pre>

Store LDAP password for Samba use (Make sure the password you enter is the same as the one you entered during LDAP setup):
<pre>
smbpasswd -W
</pre>
*New SMB password: <password>
*Retype new SMB password: <password>

Restart Samba:
<pre>
/etc/init.d/samba restart
</pre>

=smbldap-tools=
Install smbldap-tools
<pre>
apt-get install smbldap-tools
</pre>
Copy the example configfiles
<pre>
cat /usr/share/doc/smbldap-tools/examples/smbldap_bind.conf > /etc/smbldap-tools/smbldap_bind.conf
zcat /usr/share/doc/smbldap-tools/examples/smbldap.conf.gz > /etc/smbldap-tools/smbldap.conf
</pre>
Change these lines in /etc/smbldap-tools/smbldap.conf to match your configuration:
*sambaDomain
*suffix
*userSmbHome
*userProfile
*mailDomain
Change the following in /etc/smbldap-tools/smbldap.conf:
* #SID=
*defaultUserGid="5000"
*defaultComputerGid="2000"
Change the lines in /etc/smbldap-tools/smbldap_bind.conf to match you configuration:
<pre>
slaveDN="cn=admin,dc=example,dc=com"
slavePw="the password you entered during ldap configuration"
masterDN="cn=admin,dc=example,dc=com"
masterPw="the password you entered during ldap configuration"
</pre>
Set the correct permissions:
<pre>
chmod 0644 /etc/smbldap-tools/smbldap.conf
chmod 0600 /etc/smbldap-tools/smbldap_bind.conf 
</pre>
Now it's time to populate the directory with default samba information
<pre>
smbldap-populate
</pre>
*Enter the password for the domain root user (yes also on Windows it's called root now)
=Start the engine=
Index the OpenLDAP server
<pre>
/etc/init.d/slapd stop
slapindex
chown -R openldap:openldap /var/lib/ldap
/etc/init.d/slapd start
</pre>
Add a user
<pre>
smbldap-useradd -a -m -M martijn.zeedijk martijn.zeedijk
smbldap-passwd martijn.zeedijk
</pre>
*New password: <password>
*Retype new password: <password>
=LDAP client=
<pre>
apt-get install libnss-ldap
</pre>
*LDAP server Uniform Resource Identifier: <ldap://ipaddress>
*Distinguished name of the search base: <dc=example,dc=com>
*LDAP version to use: <3>
*LDAP account for root: <cn=admin,dc=example,dc=com>
*Make local root Database admin. <Yes>
*Does the LDAP database require login? <No>
*LDAP account for root: <cn=admin,dc=example,dc=com>
Change these lines in /etc/nsswitch.conf
<pre>
passwd:         compat ldap
group:          compat ldap
shadow:         compat ldap
</pre>
Replace /etc/pam.d/common-account with:
<pre>
account         sufficient      pam_unix.so 
account         sufficient      pam_ldap.so 
account         required        pam_deny.so
</pre>
Replace /etc/pam.d/common-auth with:
<pre>
auth    required        pam_env.so 
auth    sufficient      pam_unix.so likeauth nullok 
auth    sufficient      pam_ldap.so use_first_pass 
auth    required        pam_deny.so
</pre>
Replace /etc/pam.d/common-password with:
<pre>
password        sufficient      pam_unix.so nullok md5 shadow use_authtok 
password        sufficient      pam_ldap.so use_first_pass 
password        required        pam_deny.so
</pre>
Replace /etc/pam.d/common-session with:
<pre>
session         required        pam_limits.so
session         required        pam_mkhomedir.so skel=/etc/skel/ umask=0077
session         required        pam_unix.so
session         optional        pam_ldap.so
</pre>

[[Category: Debian]]
[[Category: LDAP]]
[[Category: Samba]]