Re: [gentoo-server] Complete migration from Scientific Linux with new features (Samba+AD/Winbind)

[Vinícius Ferrão]

Thanks for your tips.
I'm having problems now to authenticate without winbind. Using only LDAP and Kerberos.

Kerberos appears to be working, but I cannot "ssh" to machine for example.

auth ~ # kinit viniciusferrao
Password for viniciusferrao@×××××××.BR: 
auth ~ # klist 
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: viniciusferrao@×××××××.BR

Valid starting     Expires            Service principal
11/01/11 17:00:53  11/02/11 03:01:05  krbtgt/IF.UFRJ.BR@×××××××.BR
	renew until 11/02/11 17:00:53

Any insights?

On Oct 31, 2011, at 1:01 PM, Brian Kroth wrote:

> Vinícius Ferrão <viniciusferrao@××××××××××.br> 2011-10-30 18:48:
>> Hello Brian,
>>
>> Can you give-me some advices on how to implement this? I haven't installed UNIX Services for Windows. UID and GID is mapped through SAMBA at this moment.
>
> I don't even think that that's necessary anymore (though I haven't dealt with it personally in a while).  My understanding was that the R2 version of Windows Server's AD schema just included the uidNumber, gidNumber, homeDirectory, loginShell, etc. attributes in AD's ldap.  You could manage them through another tab on the user/group object properties in mmc.
>
> Past that it wasn't any more difficult than pointing your Linux hosts at any other ldap.  I think the only catch was that that AD wants a proxy user to bind as in order to do the searches.
>
> Brian
>
>> On 30/10/2011, at 17:55, Brian Kroth <bpkroth@×××××.com> wrote:
>>
>>> gregorcy <gregorcy@××××××××.edu> 2011-10-29 10:52:
>>>>   What's missing: OpenLDAP replication from AD? Is this possible? Is this
>>>>   needed? Since I want another machines (running Linux) to authenticate it
>>>>   will be a good idea only ONE machine get information from AD and
>>>>   everyone else authenticate natively on this Gentoo Machine.
>>>>
>>>> No this is not needed.  If you are in a mixed environment (I think) it
>>>> is much easier to just use AD as the one directory service and join all
>>>> your linux boxes to it.  As long as your idmap ranges match your users
>>>> will have the same uid on all boxes.
>>>
>>> I agree with this except for the need to "join all your linux boxes".  AD is really just ldap+kerberos.  Most of the time you don't need the headache of kerberos and can just use the ldap component.  Modern AD schemas include all the of necessary attributes support for having Linux clients talk to it directly for uid/gid mapping, which is much nicer since it avoids the complexity of any samba requirements when you don't need them (eg: mail, web, etc.).
>>>
>>> </cent></cent>
>>>
>>> Brian
>
>