[BraLUG] Debian 8 (stable) in MS AD 2003

[Angelika Schulz]

Tach,

also ... ich habe im Moment ein Debian Testing am Laufen, aber das 
spricht zumindest im Moment mit nem 2008 AD - der glaube ich noch im 
Kompatibilitaetsmodus laeuft.

meine krb5.conf (leicht abgefaelscht):

==========================================
[libdefaults]
	default_realm = COOL.DOMAIN
	clockskew = 300

[realms]
COOL.DOMAIN = {
	kdc = ad.cool.domain
	default_domain = cool.domain
	admin_server = ad.cool.domain
}

[logging]
	kdc = FILE:/var/log/krb5/krb5kdc.log
	admin_server = FILE:/var/log/krb5/kadmind.log
	default = SYSLOG:NOTICE:DAEMON

[domain_realm]
	.cool.domain = COOL.DOMAIN

[appdefaults]
pam = {
	ticket_lifetime = 1d
	renew_lifetime = 1d
	forwardable = true
	proxiable = false
	minimum_uid = 1
}

==========================================

Und der einzige geaenderte Part in meiner smb.conf:

===========================================
[global]
	workgroup = COOL
	passdb backend = tdbsam
	printing = cups
	printcap name = cups
	printcap cache time = 750
	cups options = raw
	map to guest = Bad User
	include = /etc/samba/dhcp.conf
	logon path = \\%L\profiles\.msprofile
	logon home = \\%L\%U\.9xprofile
	logon drive = P:
	usershare allow guests = No
	security = ADS
	idmap backend = tdb
	idmap uid = 100000-199999
	idmap gid = 100000-199999
	idmap config COOL : backend = ad
	idmap config COOL : range = 1000-19999
	idmap config COOL : schema_mode = rfc2307
	kerberos method = secrets and keytab
	realm = COOL.DOMAIN
	template shell = /bin/bash
	winbind refresh tickets = yes
	winbind enum users = yes
	winbind enum groups = yes
	winbind use default domain = yes
	winbind offline logon = yes
	template homedir = /home/%D/%U
	encrypt passwords = yes
	password server = ad.cool.domain
===========================================

Alle 1 bis 2 Wochen "vergisst" das System die ID mappings vollstaendig, 
aber immerhin ist nach nem rejoin wieder alles schick ...  kannst ja mal 
probieren ob das bei dir klappt.

Die meisten Settings habe ich so auch unter OpenSUSE 11.2, OpenSUSE 12.X 
und OpenSUSE 13.1 benutzt, sollten also beinahe global benutzbar sein ...

Gruesse,
Angie
-- 
I know it all.  I just can't remember it all at once.