在现代的企业办公环境中,一个公司如果要建立某种账号目录管理系统,毫无疑问,AD DC是完美的选择,应该来说,windows的AD域控是所有域控中最强大的。但是,如果公司不想买正版的windows授权,办公的电脑在200台以下,那么samba中自带的NT4-style PDC(Primary Domain Controller)也可以是很好的选择。
什么是NT4-style PDC呢,就是通过samba,模拟 nt4风格的主域控,我们这次实验就是给出一个教程出来。
我们的环境:
服务器是centos7,ip是192.168.1.200,hostname:share
客户端是windows7,ip是192.168.1.201,WINS地址是192.168.1.200,hostname:xxypc
建立域名称:SAMDOM
netbios名称:SHARE
yum install samba
编辑配置vim /etc/samba/smb.conf,该成如下的配置
[global] workgroup = SAMDOM server string = Samba Server Version %v netbios name = SHARE log file = /var/log/samba/log.%m max log size = 50 security = USER passdb backend = tdbsam username map = /etc/samba/username.map domain logons = yes check password script = /etc/samba/checkcomplexity.pl add user script = /usr/sbin/useradd -s /sbin/nologin %u add machine script = /usr/sbin/useradd -M -g machines -s /sbin/nologin %u wins support = yes deadtime = 15 time server = yes load printers = no printing = bsd printcap name = /dev/null disable spoolss = yes [homes] comment = Home Directories browseable = no writable = yes [netlogon] comment = Network Logon Service path = /var/lib/samba/netlogon guest ok = yes writable = no share modes = no [Profiles] path = /var/lib/samba/profiles browseable = no guest ok = yes [public] comment = Public Stuff path = /home/samba public = yes writable = yes printable = no write list = +staff
上面的配置把samba的打印机功能给禁用了,因为我发现现在的企业,打印机都是网络直接连接的,貌似要到samba打印共享的地方不多。
username map是映射用户名的,比如我们经常把root映射成域中的Administrator
vim /etc/samba/username.map
root = administrator
check password script是检查用户密码复杂性的,监督用户密码到期后,用户自己修改的密码能符合要求。
vim /etc/samba/checkcomplexity.pl
#!/usr/bin/perl -w # This Script will check password complexity $min_length=8; $min_upercase=1; $min_lowercase=1; $min_digits=1; $min_specialchar=1; $specialchars='!,@,#,$,%,^,&,*,(,),-,_,+,='; # get the password from standard input ( possible to pipe ) $str_pass=<STDIN> ; # now lets start check and update the counters is we find something # but first lets set all counters to zero $ctr_length=-1; $ctr_upercase=0; $ctr_lowercase=0; $ctr_digits=0; $ctr_specialcar=0; # conver the string to array @array_pass = split('',$str_pass); # convert specias carachter into array @arrayspecialchars = split(',',$specialchars); foreach $pass_char (@array_pass) { $ctr_length++; # check upercase if($pass_char =~ /[A-Z]/) { $ctr_upercase++; } # check lowercase elsif($pass_char =~ /[a-z]/) { $ctr_lowercase++; } # check digits elsif($pass_char =~ /[0-9]/) { $ctr_digits++; } else { # check special characters foreach $schar (@arrayspecialchars) { if($pass_char =~ /Q$schar/) { $ctr_specialcar++; } } } } # check if we reached minimal length if($ctr_length<$min_length) { print "too short , minimum $min_length and got $ctr_length n"; exit 1 ; } # check if we reached minimal UPER case if($ctr_upercase<$min_upercase) { print "not enough upercase , minimum $min_upercase and got $ctr_upercase n"; exit 2; } # check if we reached minimal lower case if($ctr_lowercase<$min_lowercase) { print "not enough lowercase , minimum $min_lowercase and got $ctr_lowercase n"; exit 3; } # check if we reached minimal digits if($ctr_digits<$min_digits) { print "not enough digits , minimum $min_digits and got $ctr_digits n"; exit 3; } # check if we reached minimal special characters if($ctr_specialcar<$min_specialchar) { print "not enough special characters , minimum $min_specialchar and got $ctr_specialcar n"; exit 4; } # if you got up to here , meaning you passed it all with success # we can now return a non error exit exit 0;
这是一个perl脚本,记得给脚本加上执行的x权限。
接下来创建上面提到的两个目录
mkdir -m 1777 /var/lib/samba/netlogon mkdir -m 1777 /var/lib/samba/profiles
创建机器组,指定gid为200(给机器用户用的)
groupadd -g 200 machines
添加用户root,alice,tom:
[root@share samba]# smbpasswd -a root New SMB password: Retype new SMB password: Added user root. [root@share samba]# smbpasswd -a alice New SMB password: Retype new SMB password: Added user alice. [root@share samba]# smbpasswd -a tom New SMB password: Retype new SMB password: Added user tom.
添加机器账号xxypc:
[root@share samba]# smbpasswd -m -a xxypc$ Added user xxypc$.
启动服务:
systemctl start smb.service nmb.service
开机自启动:
systemctl enable smb.service nmb.service
防火墙配置:
[root@share services]# firewall-cmd --permanent --add-service=samba success [root@share services]# firewall-cmd --reload success
Selinux配置
[root@share services]# setsebool -P samba_domain_controller on [root@share services]# setsebool -P samba_enable_home_dirs on [root@share services]# chcon -t samba_share_t /var/lib/samba/netlogon [root@share services]# chcon -t samba_share_t /var/lib/samba/profiles [root@share services]# chcon -t samba_share_t /home/samba
开始加域:
在电脑属性中输入域名和机器名
输入域管理员的用户名和密码
点击“确认”加入
用域用户登录,可以看到一个共享的Z盘
地址栏输入共享名\\share
可以看到所有共享。
附:各个windows版本加入pdc是需要进行的设置。来自samba官方wiki
以win7和server 2008 r2为例,需要添加注册表条目:
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters] "DomainCompatibilityMode"=dword:00000001 "DNSNameResolutionRequired"=dword:00000000