Ubuntu Winbind integrated AD account with Samba

Ubuntu Winbind integrated AD account with Samba:

Install the Software:

Apt-get Install samba krb5-config krb5-user winbind libpam-winbind libnss-winbind

Input ming.com

Vi/etc/nsswitch.conf

Passwd:compat Winbind
Group:compat Winbind
Shadow:compat Winbind

: Wq

Vi/etc/krb5.conf ([Realms] the others below can be deleted)

[Libdefaults]
Default_realm = ming.com (must be uppercase here)

[Realms]
spreadtrum.com = {
KDC = 10.0.0.2:88
KDC = 10.0.0.3:88
Default_domain = ming.com
}

: Wq

Kinit zhi.ming (can add domain of ordinary ad account can)

Enter your account password

Klistvi/etc/samba/smb.conf

[Global]

  workgroup = ming  realm = ming.com  netbios name = aa  security = ADS  dns forwarder = 10.0.0.1  idmap config *:backend = tdb  idmap config *:range = 50000-1000000  template homedir = /home/%D/%U  template shell = /bin/bash  winbind use default domain = true  winbind offline  logon = true  winbind nss info  = rfc2307  winbind enum users = yes  winbind enum groups = yes  vfs objects = acl_xattr  map acl inherit = Yes  store dos attributes = Yes

: Wq

Vi/etc/pam.d/common-account (Automatically create home directory)

Session Required Pam_mkhomedir.so skel=/etc/skel/umask=0022
: Wq

Vi/etc/pam.d/common-password

Password [Success=1 Default=ignore] pam_winbind.so try_first_pass (remove the default Use_authtok)

: Wq

Service SMBD restartservice nmbd restartnet ads join-u zhi.ming (can be added to the normal ad account of the domain)

Enter the AD account password

Note:
The host name and domain name in the/etc/hosts are consistent with the AD domain (inconsistencies will not be added)

Service Winbind restartwbinfo-u (view account information in AD) Wbinfo-g (view group information in AD) Getent passwd | grep Zhi.mingid zhi.mingsu-zhi.ming

Remote SSH:

SSH [email protected]

Give sudo permission:

to individuals:

Vi/etc/sudoers

Zhi.ming all= (All:all) Nopasswd:all

: Wq

To group (non-formed):

%ming\domain\ users all= (all:all) Nopasswd:all

Support Graphical Login:

Vi/usr/share/lightdm/lightdm.conf/50-ubuntu.conf

Greeter-show-manual-login=true
Greeter-hide-users=true

: Wq

Log in as ming\zhi.ming (i.e., before adding a domain name)

Note:

1. The UID and GID of the account are sorted according to the access order (/etc/samba/smb.conf defined) and cannot be customized in AD.
2. All accounts can be logged in and cannot be restricted by/etc/passwd

Access Samba sharing via AD domain account:

Share homes:

Vi/etc/samba/smb.conf

[Homes]
Comment = Home directories
browseable = No
writable = yes
Valid users =%s

 :wq # service smbd restart 访问：\\ip\zhi.ming    （此时不需要输用户名密码直接就可以访问自己家目录，访问不了别人的） 共享特定目录： # vi /etc/samba/smb.conf [share]comment = sharepath = /space/sharebrowseable = yeswritable = yesvalid users = MING\zhi.ming    :wq    访问：\\ip\share     （此时不需要输用户名密码直接就可以访问)

Ubuntu Winbind integrated AD account with Samba