Bienvenido(a) a Alcance Libre 11/09/2025, 01:45
|
![]() |
Índice del foro > Todo acerca de Linux > Redes y Servidores |
![]() ![]() |
![]() |
romanrsr |
|
|||||||
![]() ![]() ![]() ![]() ![]() Nuevo Estado: desconectado ![]() Identificado: 10/05/13 Mensajes: 7 |
Hola amigos, como están? Les comento.. Tengo un Centos 6 configurado para que Samba Autetique con LDAP. La configuración de LDAP esta bien, ya que al hacer getent me trae los grupos y usuarios ldap. El inconveniente que estoy teniendo, es que Samba no me autentica los usuarios LDAP, solo los locales por lo cual no puedo acceder a las carpetas en la Red. Alguien me puede ayudar? Les dejo el smb.conf:
PHP Formatted Code #======================= Global Settings =====================================[global] security = domain log file = /var/log/samba/%m.log load printers = yes read raw = no name resolve order = wins bcast hosts write raw = no socket options = TCP_NODELAY store dos attributes = yes wins server = 192.168.0.11 winbind trusted domains only = yes encrypt passwords = yes winbind use default domain = yes map read only = yes netbios name = srv-kve map archive = yes server string = Servidor de Archivos password server = 192.168.0.11 ldap suffix = solo lo saque por seguridad dos charset = ISO8859-1 workgroup = LEMPERT os level = 33 unix charset = UTF8 max log size = 50 # username map = /etc/samba/smbusers ; ldap admin dn = ; idmap backend = ; ldap user suffix = ou=People ; ldap group suffix = ou=Groups ; ldap machine suffix = ou=Computers ; ldap idmap suffix = ou=idmap ; idmap gid = 10000-20000 ; idmap uid = 10000-20000 # load printers = yes # cups options = raw # smb ports = 139 # unix password sync = yes # encrypt passwords = yes # passdb backend = tdbsam # passdb backend = # ldap ssl = off # ldap delete dn = no # Specify the base DN to use when searching the - directory # ----------------------- Network Related Options ------------------------- # # workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH # # server string is the equivalent of the NT Description field # # netbios name can be used to specify a server name not tied to the hostname # # Interfaces lets you configure Samba to use multiple interfaces # If you have multiple network interfaces then you can list the ones # you want to listen on (never omit localhost) # # Hosts Allow/Hosts Deny lets you restrict who can connect, and you can # specifiy it as a per share option as well # ; netbios name = MYSERVER ; interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24 ; hosts allow = 127. 192.168.12. 192.168.13. # --------------------------- Logging Options ----------------------------- # # Log File let you specify where to put logs and how to split them up. # # Max Log Size let you specify the max size log files should reach # logs split per machine ; log file = /var/log/samba/%m.log # max 50KB per log file, then rotate ; max log size = 50 # ----------------------- Standalone Server Options ------------------------ # # Security can be set to user, share(deprecated) or server(deprecated) # # Backend to store user information in. New installations should # use either tdbsam or ldapsam. smbpasswd is available for backwards # compatibility. tdbsam requires no further configuration. # ----------------------- Domain Members Options ------------------------ # # Security must be set to domain or ads # # Use the realm option only with security = ads # Specifies the Active Directory realm the host is part of # # Backend to store user information in. New installations should # use either tdbsam or ldapsam. smbpasswd is available for backwards # compatibility. tdbsam requires no further configuration. # # Use password server option only with security = server or if you can't # use the DNS to locate Domain Controllers # The argument list may include: # password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name] # or to auto-locate the domain controller/s # password server = * ; security = domain ; passdb backend = tdbsam ; realm = MY_REALM ; password server = <NT-Server-Name> # ----------------------- Domain Controller Options ------------------------ # # Security must be set to user for domain controllers # # Backend to store user information in. New installations should # use either tdbsam or ldapsam. smbpasswd is available for backwards # compatibility. tdbsam requires no further configuration. # # Domain Master specifies Samba to be the Domain Master Browser. This # allows Samba to collate browse lists between subnets. Don't use this # if you already have a Windows NT domain controller doing this job # # Domain Logons let Samba be a domain logon server for Windows workstations. # # Logon Scrpit let yuou specify a script to be run at login time on the client # You need to provide it in a share called NETLOGON # # Logon Path let you specify where user profiles are stored (UNC path) # # Various scripts can be used on a domain controller or stand-alone # machine to add or delete corresponding unix accounts # ; security = user ; passdb backend = tdbsam ; domain master = yes ; domain logons = yes # the login script name depends on the machine name ; logon script = %m.bat # the login script name depends on the unix user used ; logon script = %u.bat ; logon path = \\%L\Profiles\%u # disables profiles support by specifing an empty path ; logon path = ; add user script = /usr/sbin/useradd "%u" -n -g users ; add group script = /usr/sbin/groupadd "%g" ; add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /bin/false "%u" ; delete user script = /usr/sbin/userdel "%u" ; delete user from group script = /usr/sbin/userdel "%u" "%g" ; delete group script = /usr/sbin/groupdel "%g" # ----------------------- Browser Control Options ---------------------------- # # set local master to no if you don't want Samba to become a master # browser on your network. Otherwise the normal election rules apply # # OS Level determines the precedence of this server in master browser # elections. The default value should be reasonable # # Preferred Master causes Samba to force a local browser election on startup # and gives it a slightly higher chance of winning the election ; local master = no ; os level = 33 ; preferred master = yes #----------------------------- Name Resolution ------------------------------- # Windows Internet Name Serving Support Section: # Note: Samba can be either a WINS Server, or a WINS Client, but NOT both # # - WINS Support: Tells the NMBD component of Samba to enable it's WINS Server # # - WINS Server: Tells the NMBD components of Samba to be a WINS Client # # - WINS Proxy: Tells Samba to answer name resolution queries on # behalf of a non WINS capable client, for this to work there must be # at least one WINS Server on the network. The default is NO. # # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names # via DNS nslookups. ; wins support = yes ; wins server = w.x.y.z ; wins proxy = yes ; dns proxy = yes # --------------------------- Printing Options ----------------------------- # # Load Printers let you load automatically the list of printers rather # than setting them up individually # # Cups Options let you pass the cups libs custom options, setting it to raw # for example will let you use drivers on your Windows clients # # Printcap Name let you specify an alternative printcap file # # You can choose a non default printing system using the Printing option ; printcap name = /etc/printcap #obtain list of printers automatically on SystemV ; printcap name = lpstat ; printing = cups # --------------------------- Filesystem Options --------------------------- # # The following options can be uncommented if the filesystem supports # Extended Attributes and they are enabled (usually by the mount option # user_xattr). Thess options will let the admin store the DOS attributes # in an EA and make samba not mess with the permission bits. # # Note: these options can also be set just per share, setting them in global # makes them the default for all shares ; map hidden = no ; map system = no #============================ Share Definitions ============================== [homes] recycle:excludedir = /tmp|/temp|/cache recycle:keeptree = Yes recycle:maxsize = 3120000 recycle:versions = Yes recycle:repository = Recycle Bin recycle:minsize = 10 vfs objects = recycle browseable = no writable = yes path = /u02/r2d2/%S locking = no force group = Administrators comment = Home Directory valid users = LEMPERT\%S force create mode = 0770 force directory mode = 0770 create mode = 0770 directory mode = 0770 map archive = yes map read only = yes store dos attributes = yes ; valid users = %D+%S,%S,@TODOS #[printers] # browseable = no # printable = yes # writable = no # path = /var/spool/samba # guest ok = no # comment = All Printers # available = no # Un-comment the following and create the netlogon directory for Domain Logons ; [netlogon] ; comment = Network Logon Service ; path = /var/lib/samba/netlogon ; guest ok = yes ; writable = no ; share modes = no # Un-comment the following to provide a specific roving profile share # the default is to use the user's home directory ; [Profiles] ; path = /var/lib/samba/profiles ; browseable = no ; guest ok = yes # A publicly accessible directory, but read only, except for people in # the "staff" group [public] recycle:excludedir = /tmp|/temp|/cache force directory mode = 0777 force group = TODOS recycle:keeptree = Yes public = yes recycle:maxsize = 3120000 writeable = yes recycle:minsize = 10 path = /u03 force create mode = 0777 comment = Public Stuff valid users = @TODOS create mode = 0777 recycle:repository = Recycle Bin recycle:versions = Yes directory mode = 0777 ; printable = no ; write list = +staff |
|||||||
|
||||||||
John J. Toro A. |
|
|||||||
![]() ![]() ![]() ![]() ![]() Moderador ![]() Estado: desconectado ![]() Identificado: 19/02/07 Mensajes: 119 Localización:Medellín - Colombia |
Saludos.
Veo como comentarios las opciones de LDAP (; al inicio). Mirate (en la sección de manuales): Dominio Samba con OpenLDAP [CentOS 5] (Parte 1: Configuracion General). JohnToro |
|||||||
|
||||||||
romanrsr |
|
|||||||
![]() ![]() ![]() ![]() ![]() Nuevo Estado: desconectado ![]() Identificado: 10/05/13 Mensajes: 7 |
Quote by: John J. Toro A. Saludos. Acabo de revisar el manual, pero no doy con la solución.. Tengo la sospecha que es la actualización del paquete Samba, ya que tengo servidores con Centos 5 usando el mismo smb.conf y funcionan a la perfección! Existe algun manual para configurar versiones nuevas de Samba? Muchas Gracias! Saludos! |
|||||||
|
||||||||
Joel Barrios Dueñas |
|
|||||||
![]() ![]() ![]() ![]() ![]() Admin ![]() Estado: desconectado ![]() Identificado: 17/02/07 Mensajes: 1761 Localización:Mexico |
¿Tienes activo SELInux?
¿Configuraste todas las políticas que se ocupan para Samba com PDC?? getsebool -a |grep samba |
|||||||
|
||||||||
romanrsr |
|
|||||||
![]() ![]() ![]() ![]() ![]() Nuevo Estado: desconectado ![]() Identificado: 10/05/13 Mensajes: 7 |
Quote by: Joel Barrios Dueñas ¿Tienes activo SELInux? Si, lo tengo activo al SELinux, el comando getsebol no me funciona en Centos, esta bien escrito? Mucchas gracias por la ayuda! Saludos! |
|||||||
|
||||||||
Tox |
|
|||||||
![]() ![]() ![]() ![]() ![]() Miembro regular Estado: desconectado ![]() Identificado: 21/03/10 Mensajes: 85 |
getsebool -a | grep samba
|
|||||||
|
||||||||
romanrsr |
|
|||||||
![]() ![]() ![]() ![]() ![]() Nuevo Estado: desconectado ![]() Identificado: 10/05/13 Mensajes: 7 |
Quote by: Tox getsebool -a | grep samba Acabo de ejecutar el programa, y me aparece lo siguiente: samba_create_home_dirs --> off samba_domain_controller --> off samba_enable_home_dirs --> off samba_export_all_ro --> off samba_export_all_rw --> off samba_run_unconfined --> off samba_share_fusefs --> off samba_share_nfs --> off use_samba_home_dirs --> off virt_use_samba --> off Alguna idea? Muchas Gracias! Saludos! |
|||||||
|
||||||||
Joel Barrios Dueñas |
|
|||||||
![]() ![]() ![]() ![]() ![]() Admin ![]() Estado: desconectado ![]() Identificado: 17/02/07 Mensajes: 1761 Localización:Mexico |
Necesitas activar todas las políticas para PDC.
setsebool -P samba_create_home_dirs 1 setsebool -P samba_domain_controller 1n setsebool -P samba_enable_home_dirs 1 setsebool -P samba_export_all_ro off setsebool -P samba_export_all_rw 1 setsebool -P samba_run_unconfined 1 setsebool -P use_samba_home_dirs 1 Cada uno de los mandatos anteriores demora de 3 a 5 minutos en completarse. Por favor lee el manual de Samba Básico de este sitio para dudas posteriores. http://www.alcancelibre.org/staticpages/index.php/como-samba-basico Básicamente tu problema fue que configuraste Samba y LDAP pero pasaste pro alto SELinux. |
|||||||
|
||||||||
romanrsr |
|
|||||||
![]() ![]() ![]() ![]() ![]() Nuevo Estado: desconectado ![]() Identificado: 10/05/13 Mensajes: 7 |
Quote by: Joel Barrios Dueñas Necesitas activar todas las políticas para PDC. Al final opte por desactivar el selinux, y solucione el problema. Como hago para dar por solucionado el tema? Muchas gracias a todos por la ayuda! Me sirvió muchísimo! Saludos! |
|||||||
|
||||||||
Joel Barrios Dueñas |
|
|||||||
![]() ![]() ![]() ![]() ![]() Admin ![]() Estado: desconectado ![]() Identificado: 17/02/07 Mensajes: 1761 Localización:Mexico |
Desactivar SELinux no es una forma de solucionar los problemas. Acabas de hacer algo que es equivalente a desactivar todas las funciones de seguridad de Windows. Si luego tienes un problema de seguridad en el PDC, donde vas a colocar información muy delicada de la empresa (usuarios y contraseñas), no preguntes luego por qué ocurrió. Si deses marcar el tema como solucionado, sólo edita el título del tema y añade [SOLUCIONADO].
|
|||||||
|
||||||||
Contenido generado en: 0.31 segundos |
![]() ![]() |
Todas las horas son CST. Hora actual 01:45 . |
|
|