<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 12 (filtered medium)"> <style>  </style>  </head> <body lang=ZH-CN link=blue vlink=purple> <div class=WordSection1> <p class=MsoNormal><span lang=EN-US style='font-size:10.5pt;color:#1F497D'>Thanks, but we use the Unix extension of Windows 2008 to store uid and gid in AD itself.<o:p></o:p></span></p> <p class=MsoNormal><span lang=EN-US style='font-size:10.5pt;color:#1F497D'><o:p> </o:p></span></p> <p class=MsoNormal><span lang=EN-US style='font-size:10.5pt;color:#1F497D'><o:p> </o:p></span></p> <p class=MsoNormal style='text-align:justify;text-justify:inter-ideograph'><span lang=EN-US style='font-size:10.5pt;font-family:"Calibri","sans-serif"; color:#1F497D'>Regards,<o:p></o:p></span></p> <p class=MsoNormal style='text-align:justify;text-justify:inter-ideograph'><span lang=EN-US style='font-size:10.5pt;font-family:"Calibri","sans-serif"; color:#1F497D'> Kirby Zhou <o:p></o:p></span></p> <p class=MsoNormal style='text-align:justify;text-justify:inter-ideograph'><span lang=EN-US style='font-size:10.5pt;font-family:"Calibri","sans-serif"; color:#1F497D'> from SOHU-RD +86-10-6272-8261<o:p></o:p></span></p> <p class=MsoNormal><span lang=EN-US style='font-size:10.5pt;color:#1F497D'><o:p> </o:p></span></p> <div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'> <p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family: "Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt; font-family:"Tahoma","sans-serif"'> rhelv6-beta-list-bounces@redhat.com [mailto:rhelv6-beta-list-bounces@redhat.com] <b>On Behalf Of </b>John McNulty<br> <b>Sent:</b> Tuesday, June 22, 2010 5:00 PM<br> <b>To:</b> Red Hat Enterprise Linux 6 (Santiago) Beta releases discussion mailing-list<br> <b>Subject:</b> Re: [rhelv6-beta-list] How can I join a 2008-R2 domain?<o:p></o:p></span></p> </div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>In addition to that good advise I would recommend a couple of things:<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>1) Disable nscd. It doesn't work well with AD and this is recommended either in the Samba docs or on their web site (I forget which).<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US># service nscd stop<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US># chkconfig nscd off<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>2) If you want Red Hat to create new home directories the first time an AD user logs in then you can enable that from the "Options" tab in the system-config-authentication GUI. Enable “Create home directories on the first login”. Alternatively, edit /etc/pam.d/system-auth-ac and add a line below pam_limits.so that reads:<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>session optional pam_mkhomedir.so<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>3) Consider using the user RID part of the SID for generating UIDs. e.g. </span><span class=apple-style-span><span lang=EN-US style='font-size:8.5pt;font-family:"Verdana","sans-serif"'>S-1-111-222-333-XXX where XXX is the RID.</span></span><span lang=EN-US><o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>The advantage is that for a given user you guarantee the same UID on every system. This is especially important in a cluster where you have a shared cluster filesystem :) <o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>To configure this edit /etc/samba/smb.conf and in the [global] section replace the tdbsam backend stuff with this:<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <div> <p class=MsoNormal><span lang=EN-US>idmap domains = EXAMPLE<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>idmap config EXAMPLE:backend = rid<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>idmap config EXAMPLE:base_rid = 0<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>idmap config EXAMPLE:range = 1000 - 33554431<o:p></o:p></span></p> </div> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>Tweak the range to your own needs, then restart winbind.<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US>John<o:p></o:p></span></p> </div> <div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> <p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US><o:p> </o:p></span></p> <div> <p class=MsoNormal><span lang=EN-US>On 21 June 2010 23:03, Colin Coe <<a href="mailto:colin.coe@gmail.com">colin.coe@gmail.com</a>> wrote:<o:p></o:p></span></p> <p class=MsoNormal><span lang=EN-US> I use:<br> <br> authconfig --enableshadow \<br> --enablemd5 \<br> --enablekrb5 \<br> --krb5kdc=<a href="http://server.example.com" target="_blank">server.example.com</a> \<br> --krb5adminserver=<a href="http://server.example.com" target="_blank">server.example.com</a> \<br> --krb5realm=<a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> \<br> --enablekrb5kdcdns \<br> --enablekrb5realmdns \<br> --enablesmbauth \<br> --smbservers=<a href="http://server.example.com" target="_blank">server.example.com</a> \<br> --smbworkgroup=EXAMPLE \<br> --enablewinbind \<br> --enablewinbindauth \<br> --smbsecurity=ads \<br> --smbrealm=<a href="http://EXAMPLE.COM" target="_blank">EXAMPLE.COM</a> \<br> --winbindtemplateshell=/bin/bash \<br> --enablewinbindusedefaultdomain \<br> --enablewinbindoffline \<br> --winbindjoin=administrator \<br> --enablecache \<br> --enablelocauthorize \<br> --enablepamaccess \<br> --disablesysnetauth \<br> --kickstart<br> <br> Works for me on RHEL4u8+ and RHEL5.4.+. Haven't actually tried on RHEL6 yet.<br> <br> YMMV<o:p></o:p></span></p> <div> <div> <p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US><br> On Mon, Jun 21, 2010 at 7:24 PM, Kirby Zhou <<a href="mailto:kirbyzhou@sohu-rd.com">kirbyzhou@sohu-rd.com</a>> wrote:<br> > I can do smbclient with the DC, but ads join failed.<br> ><br> > ]# smbclient //<a href="http://10.10.96.207/sysvol" target="_blank">10.10.96.207/sysvol</a> -U Administrator<br> > Enter Administrator's password:<br> > Domain=[SOHU-TEST] OS=[Windows Server 2008 R2 Enterprise 7600]<br> > Server=[Windows Server 2008 R2 Enterprise 6.1]<br> > smb: \> ls<br> > . D 0 Mon Jun 21 18:44:29 2010<br> > .. D 0 Mon Jun 21 18:44:29 2010<br> > <a href="http://SOHU-TEST.COM" target="_blank">SOHU-TEST.COM</a> D 0 Mon Jun 21 18:44:29 2010<br> ><br> > 65433 blocks of size 1048576. 52832 blocks available<br> > smb: \><br> ><br> > /usr/bin/net join -w SOHU-TEST -S 10.10.96.207 -U Administrator<br> > Enter Administrator's password:<br> > Failed to join domain: failed to connect to AD: Operations error<br> > ADS join did not work, falling back to RPC...<br> > Enter Administrator's password:<br> > [2010/06/21 19:21:47, 0] utils/net_rpc_join.c:398(net_rpc_join_newstyle)<br> > Error in domain join verification (credential setup failed):<br> > NT_STATUS_INVALID_COMPUTER_NAME<br> ><br> > Unable to join domain SOHU-TEST.<br> ><br> ><br> ><br> > Regards,<br> > Kirby Zhou<br> > from SOHU-RD +86-10-6272-8261<br> ><br> ><br> ><br> > _______________________________________________<br> > rhelv6-beta-list mailing list<br> > <a href="mailto:rhelv6-beta-list@redhat.com">rhelv6-beta-list@redhat.com</a><br> > <a href="https://www.redhat.com/mailman/listinfo/rhelv6-beta-list" target="_blank">https://www.redhat.com/mailman/listinfo/rhelv6-beta-list</a><br> ><br> <br> <br> <o:p></o:p></span></p> </div> </div> <p class=MsoNormal><span lang=EN-US style='color:#888888'>--<br> RHCE#805007969328369</span><span lang=EN-US><o:p></o:p></span></p> <div> <div> <p class=MsoNormal><span lang=EN-US><br> _______________________________________________<br> rhelv6-beta-list mailing list<br> <a href="mailto:rhelv6-beta-list@redhat.com">rhelv6-beta-list@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/rhelv6-beta-list" target="_blank">https://www.redhat.com/mailman/listinfo/rhelv6-beta-list</a><o:p></o:p></span></p> </div> </div> </div> <p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p> </div> </body> </html>