<div><br></div><div>In addition to that good advise I would recommend a couple of things:</div><div><br></div><div><br></div><div>1) Disable nscd. It doesn't work well with AD and this is recommended either in the Samba docs or on their web site (I forget which).</div>
<div><br></div><div># service nscd stop</div><div># chkconfig nscd off</div><div><br></div><div><br></div><div>2) If you want Red Hat to create new home directories the first time an AD user logs in then you can enable that from the "Options" tab in the system-config-authentication GUI. Enable “Create home directories on the first login”. Alternatively, edit /etc/pam.d/system-auth-ac and add a line below pam_limits.so that reads:</div>
<div><br></div><div>session optional pam_mkhomedir.so</div><div><br></div><div><br></div><div>3) Consider using the user RID part of the SID for generating UIDs. e.g. <span class="Apple-style-span" style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 16px; ">S-1-111-222-333-XXX where XXX is the RID.</span></div>
<meta http-equiv="content-type" content="text/html; charset=utf-8"><div><br></div><div>The advantage is that for a given user you guarantee the same UID on every system. This is especially important in a cluster where you have a shared cluster filesystem :) </div>
<div><br></div><div>To configure this edit /etc/samba/smb.conf and in the [global] section replace the tdbsam backend stuff with this:</div><div><br></div><div><div>idmap domains = EXAMPLE</div><div>idmap config EXAMPLE:backend = rid</div>
<div>idmap config EXAMPLE:base_rid = 0</div><div>idmap config EXAMPLE:range = 1000 - 33554431</div></div><div><br></div><div>Tweak the range to your own needs, then restart winbind.</div><div><br></div><div><br></div><div>
John</div><div><br></div><br><br><div class="gmail_quote">On 21 June 2010 23:03, Colin Coe <span dir="ltr"><<a href="mailto:colin.coe@gmail.com">colin.coe@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
I use:<br>
<br>
authconfig --enableshadow \<br>
--enablemd5 \<br>
--enablekrb5 \<br>
--krb5kdc=<a href="http://server.example.com" target="_blank">server.example.com</a> \<br>
--krb5adminserver=<a href="http://server.example.com" target="_blank">server.example.com</a> \<br>
--krb5realm=<a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> \<br>
--enablekrb5kdcdns \<br>
--enablekrb5realmdns \<br>
--enablesmbauth \<br>
--smbservers=<a href="http://server.example.com" target="_blank">server.example.com</a> \<br>
--smbworkgroup=EXAMPLE \<br>
--enablewinbind \<br>
--enablewinbindauth \<br>
--smbsecurity=ads \<br>
--smbrealm=<a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> \<br>
--winbindtemplateshell=/bin/bash \<br>
--enablewinbindusedefaultdomain \<br>
--enablewinbindoffline \<br>
--winbindjoin=administrator \<br>
--enablecache \<br>
--enablelocauthorize \<br>
--enablepamaccess \<br>
--disablesysnetauth \<br>
--kickstart<br>
<br>
Works for me on RHEL4u8+ and RHEL5.4.+. Haven't actually tried on RHEL6 yet.<br>
<br>
YMMV<br>
<div><div></div><div class="h5"><br>
On Mon, Jun 21, 2010 at 7:24 PM, Kirby Zhou <<a href="mailto:kirbyzhou@sohu-rd.com">kirbyzhou@sohu-rd.com</a>> wrote:<br>
> I can do smbclient with the DC, but ads join failed.<br>
><br>
> ]# smbclient //<a href="http://10.10.96.207/sysvol" target="_blank">10.10.96.207/sysvol</a> -U Administrator<br>
> Enter Administrator's password:<br>
> Domain=[SOHU-TEST] OS=[Windows Server 2008 R2 Enterprise 7600]<br>
> Server=[Windows Server 2008 R2 Enterprise 6.1]<br>
> smb: \> ls<br>
> . D 0 Mon Jun 21 18:44:29 2010<br>
> .. D 0 Mon Jun 21 18:44:29 2010<br>
> <a href="http://SOHU-TEST.COM" target="_blank">SOHU-TEST.COM</a> D 0 Mon Jun 21 18:44:29 2010<br>
><br>
> 65433 blocks of size 1048576. 52832 blocks available<br>
> smb: \><br>
><br>
> /usr/bin/net join -w SOHU-TEST -S 10.10.96.207 -U Administrator<br>
> Enter Administrator's password:<br>
> Failed to join domain: failed to connect to AD: Operations error<br>
> ADS join did not work, falling back to RPC...<br>
> Enter Administrator's password:<br>
> [2010/06/21 19:21:47, 0] utils/net_rpc_join.c:398(net_rpc_join_newstyle)<br>
> Error in domain join verification (credential setup failed):<br>
> NT_STATUS_INVALID_COMPUTER_NAME<br>
><br>
> Unable to join domain SOHU-TEST.<br>
><br>
><br>
><br>
> Regards,<br>
> Kirby Zhou<br>
> from SOHU-RD +86-10-6272-8261<br>
><br>
><br>
><br>
> _______________________________________________<br>
> rhelv6-beta-list mailing list<br>
> <a href="mailto:rhelv6-beta-list@redhat.com">rhelv6-beta-list@redhat.com</a><br>
> <a href="https://www.redhat.com/mailman/listinfo/rhelv6-beta-list" target="_blank">https://www.redhat.com/mailman/listinfo/rhelv6-beta-list</a><br>
><br>
<br>
<br>
<br>
</div></div><font color="#888888">--<br>
RHCE#805007969328369<br>
</font><div><div></div><div class="h5"><br>
_______________________________________________<br>
rhelv6-beta-list mailing list<br>
<a href="mailto:rhelv6-beta-list@redhat.com">rhelv6-beta-list@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/rhelv6-beta-list" target="_blank">https://www.redhat.com/mailman/listinfo/rhelv6-beta-list</a><br>
</div></div></blockquote></div><br>