1 |
On 6 Jan 2006, at 12:32, brunogola wrote: |
2 |
> |
3 |
> I have a machine running linux, and i'm authenticating in a |
4 |
> windows 2000 domain (Active directory) using |
5 |
> samba, winbind and kerberos. |
6 |
|
7 |
Hi there, |
8 |
|
9 |
I've done some of this recently, and I don't think you need active |
10 |
directory, winbind AND kerberos. My understanding is that all three |
11 |
are separate mechanisms for authenticating *nix users against a |
12 |
Windows domain. |
13 |
|
14 |
Active directory is MS's name for LDAP, so if you use that then your |
15 |
applications would be compiled using the LDAP USE flag & would treat |
16 |
the MS server as an LDAP server. I don't believe its schema's are |
17 |
terribly good for *nix users - I use Winbind, which uses PAM to |
18 |
appear part of the local authentication process and pass these on to |
19 |
the Windows DC. |
20 |
|
21 |
> What i need to know is if there is a way of making some other machines |
22 |
> authenticate in this machine, and this machine will ask the |
23 |
> password for the windows 2000 domain (only for some |
24 |
> users, and the user need to be in the /etc/passwd). |
25 |
|
26 |
It would be helpful if you gave an example of which programs / |
27 |
services on which machines (A, B and C??) you need to be able |
28 |
authenticate in this way. |
29 |
|
30 |
> Let me explain: i have a user 'bob' that is not a user in |
31 |
> the domain, but it has your username and password on my linux |
32 |
> machine, so he can authenticate. I have a user |
33 |
> bgola who has the username on the AD and on the linux machine, but |
34 |
> the password isnt on the linux machine, only |
35 |
> on the AD. He can authenticate too. |
36 |
> Resuming: my linux machine will use the username database from its |
37 |
> own but the password database from its own |
38 |
> AND from the AD. |
39 |
|
40 |
I believe that in this situation it would be unusual to give the |
41 |
bgola a username on the Linux machine - he has one on the AD, so if |
42 |
you use Winbind then he doesn't need one on the Linux box. He can |
43 |
have a homedir, since he may need to store files on the Linux box, |
44 |
but that's not the same, I think, as having an account. |
45 |
|
46 |
For instance on my Linux/Winbind machine on an AD: |
47 |
|
48 |
$ getent passwd | grep -e stroller -e ned |
49 |
stroller:x:1000:100::/home/stroller:/bin/bash |
50 |
ned:x:10012:10000:Some Geezer:/home/DOMAIN/ned:/bin/false |
51 |
$ grep -e stroller -e ned /etc/passwd |
52 |
stroller:x:1000:100::/home/stroller:/bin/bash |
53 |
$ ls -ld ~stroller ~ned |
54 |
drwxr-xr-x 3 ned domain users 160 Jan 6 06:32 /home/DOMAIN/ned |
55 |
drwxr-xr-x 5 stroller users 272 Jan 6 03:58 /home/stroller |
56 |
|
57 |
Both users can authenticate, depending on how the /etc/pam.d/ |
58 |
the_authenticating_service is set up. I use pam_mkhomedir.so to |
59 |
create a home directory for any users authenticating via Winbind, but |
60 |
beware this only works for services which call PAM "session" directives. |
61 |
|
62 |
I used this guide to set it all up: http://www.samba.org/samba/docs/ |
63 |
man/Samba-HOWTO-Collection/winbind.html#id2621482 |
64 |
|
65 |
Please CC me should you reply to the list with further questions, |
66 |
|
67 |
Stroller. |
68 |
|
69 |
|
70 |
-- |
71 |
gentoo-user@g.o mailing list |