うみゅ

で、DebianLinuxの設定メモ。
これでとりあえずSambaとSshはAD側の認証で使えるようになった。
次の目標はセキュリティ系かな？

jkon導入

	apt-get install kon2

/etc/hosts.allow 編集

	追加：	ssh   : 192.168.*.0/255.255.255.0

/etc/ssh/sshd_config 編集

	変更：	PasswordAuthentication no → yes
	追加：	AllowUser [sshを利用するユーザー名]

Samba導入

	apt-get install samba
	ドメイン：	[DOMAINNAME].LOCAL
	その他	：	デフォルト

Winbind導入

	apt-get install winbind

Kerberos5導入

	apt-get install krb5-config krb5-user

pam-Kerberos5導入

	apt-get install libpam-krb5

ntp-simple導入

	apt-get install ntp-simple

/etc/nsswitch.confの設定

	passwd:		files winbind
	group:		files winbind
	shadow:		files winbind

/etc/samba/smb.confの設定

[global]

	dos charset = CP932
	workgroup = [DOMAINNAME]
	realm = [DOMAINNAME].LOCAL
	server string = %h server (Samba %v)
	security = ADS
	password server = [dc].[domainname].local

	dns proxy = No

	log file = /var/log/samba/log.%m
	max log size = 1000
	syslog = 0
	panic action = /usr/share/samba/panic-action %d

	obey pam restrictions = Yes
	invalid users = root
	passwd program = /usr/bin/passwd %u
	passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n .

	passdb backend = tdbsam, guest
	ldap ssl = no
	idmap uid = 10000-20000
	idmap gid = 10000-20000
	template homedir = /home/%U
	template shell = /bin/bash
	winbind use default domain = Yes

[homes]
	comment = Home Directories
	read only = No
	create mask = 0700
	directory mask = 0700
	browseable = No

[Share]
	comment = default share
	path = /home/share
	read only = No

/etc/krb5.confの設定

[realms]
	[DOMAINNAME].LOCAL = {
		kdc = [dc].[domainname].local:88
		admin_server = [dc].[domainname].local
		default_domain = [domainname].local
	}
[domain_realm]
	.[domainname].local = [DOMAINNAME].LOCAL
	[domainname].local = [DOMAINNAME].LOCAL

/etc/ntp.confの設定

	server [dc].[domainname].local
	server 192.168.*.1

/etc/hostsの設定

	127.0.0.1	kara.[domainname].local	kara localhost localhost.localdomain
	192.168.*.5	[dc].[domainname].local	[dc]

/home/share　フォルダ作成

	mkdir share
	chmod 777 share

/etc/pam.d/samba　の変更

全ての行をコメントアウト後追加
	auth	sufficient	/lib/security/pam_krb5.so
	account	sufficient	/lib/security/pam_unix.so
	session	required	/lib/security/pam_mkhomedir.so	skel=/etc/skel	umask=0077

/etc/pam.d/ssh　の変更

全ての行をコメントアウト後追加
	auth	sufficient	/lib/security/pam_krb5.so
	auth	sufficient	/lib/security/pam_unix.so
	account	sufficient	/lib/security/pam_krb5.so
	account	sufficient	/lib/security/pam_unix.so
	session	required	/lib/security/pam_mkhomedir.so	skel=/etc/skel	umask=0077