Effectio quam eram in magna pulmentum non statim venit. Solum cum recentes traditiones PCs constanter venire coeperunt ex altiori ordinatione cum distributione Alt Linux in tabula aliquid erravisse suspicatus sum.
Sed, dum per gradus accipiendi inevitabiles ivi, incidi et etiam in processu paulo frui coepi. Et aliquando putabam me hac in re, citius aut serius, solutiones ad officia Microsoft organizandas dividendas et ad aliquid exoticis magis promovendum putarem. Itaque ad inevitabilem praeparationem et, si fieri potest, ut quam plurimas ruinas capere posset, placuit tribunali, quod comprehendit, explicari placuit;
- DC1 — Windows Server 2012R2
- DC2 - Viola Server 8.2
- Servus Archivorum — Windows Server 2012R2
- PC1 — Windows 7
- PC2 - Viola Workstation 8.2
Proposita sta:
- Dominium secundum w2k12r2 institue. Minimam seriem regularum gregis (similem illis quae in infrastructura productionis adhibentur) crea, incluso regula ad fasciculos laboris usorum migrandos (Deductiones/Documenta/Scrinium). Denique, volo efficere ut cum usor stationem laboris mutat, Windows on Linux et retro commodum ad documenta laboris sui accessum habuit.
- Samba DC input by the second controller. Reprehendo Directory et DNS replicationis
- Profecta clients Linux ad operandum cum fasciculis mobilibus
implementation:
- Institutionem et commissionem novi moderatorisCum institutione MS Windows Regula 2012R2 simplex est et plus minusve clara. Mille et unum manuales in interreti ad dominium (vel "dominium") disponendum inveniuntur. Windows et GUI et Powershell utens, ergo non iterum repetam, relinquam modo in off. documenta illis curiosis et illis qui memoriam renovare cupiunt.
Sed adhuc unum momentum in hac parte est. In statu, Samba non potest operibus directoriis machinis altiores quam 2008R2.
Praedo titulum Accuratius, artifices hoc auxilium ut experimentale declaraverunt. Sed in praxi, conatus Samba ut secundum DC in dominium iam existentem introducendi... Windows cum schemate 69 - errore sequenti occurres
DsAddEntry defecit status WERR_ACCESS_DENIED info (8567, 'WERR_DS_INCOMPATIBLE_VERSION')
Quod est quaestio Windows Programmata 2012 et 2012R2 instrumentis WMI utuntur ad operandum cum dominiis et silvis, quorum stabile subsidium tantum pro versione Samba 4.11, quae ante finem huius anni exitura est, nuntiatum est.
Ex quo sequitur, optionem unicam samba introducendi in an AD dominium in anno 2012R2 disponendam esse, schema ab 69 ad 47. Declinare, hoc sane sine causa in productione infrastructura fieri non debet, sed habemus. scamnum hic test, cur non actu.Install Alt Servo 8.2. Per institutionem, profile "Samba-DC Servo (AD Controller) elige. In instruente servo, integram rationem renovationis exhibemus ac sarcinam samba-dc inauguratam, quae omnia quae indigetis evellemus.
# apt-get install task-samba-dcSi subito negotium-samba-dc, contra cautiones documentorum, Alta recusat omnia ipsa necessaria instituere.
# apt-get install python-module-samba-DC samba-DC-common samba-DC-winbind-clients samba-DC-winbind samba-DC-common-libs libpytalloc-develDeinde progredimur ad Kerberos erigendum et tesseram accipiendam. Aperi fasciculum krb5.conf, vade ad sectionem et affer ad hanc formam:
# vim /etc/krb5.confdns_lookup_kdc = true dns_lookup_realm = true default_realm = TEST.LOCALPetens tesseram
# kinit administrator Password for administrator@TEST.LOCAL:Reprehendo accepi album Kerberos tesseras
# klist Ticket cache: KEYRING:persistent:0:0 Default principal: administrator@TEST.LOCAL Valid starting Expires Service principal 16.05.2019 11:51:38 16.05.2019 21:51:38 krbtgt/TEST.LOCAL@TEST.LOCAL renew until 23.05.2019 11:51:35Nunc delemus vel renominamus existentium samba config.
# mv smb.conf smb.conf.bak1Et tandem ad dominium cum secundo moderatore intramus:
# samba-tool domain join test.local DC -U"TESTadministrator"Prosperum initus erit cum sequenti log
Finding a writeable DC for domain 'test.local' Found DC DC1.TEST.LOCAL Password for [TESTadministrator]: Reconnecting to naming master e31d7da6-8f56-4420-8473-80f2b3a31338._msdcs.TEST. LOCAL DNS name of new naming master is DC1.TEST.LOCAL workgroup is TEST realm is TEST.LOCAL Adding CN=DC2,OU=Domain Controllers,DC=TEST,DC=LOCAL Adding CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC =TEST,DC=LOCAL Adding CN=NTDS Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN =Configuration,DC=TEST,DC=LOCAL Adding SPNs to CN=DC2,OU=Domain Controllers,DC=TEST,DC=LOCAL Setting account password for DC2$ Enabling account Calling bare provision Looking up IPv4 addresses Looking up IPv6 addresses No IPv6 address will be assigned Setting up share.ldb Setting up secrets.ldb Setting up the registry Setting up the privileges database Setting up idmap db Setting up SAM db Setting up sam.ldb partitions and settings Setting up sam.ldb rootDSE Pre-loading the Samba 4 and AD schema A Kerberos configuration suitable for Samba AD has been generated at /var/lib/sa mba/private/krb5.conf Provision OK for domain DN DC=TEST,DC=LOCAL Starting replication Schema-DN[CN=Schema,CN=Configuration,DC=TEST,DC=LOCAL] objects[402/1426] linked _values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=TEST,DC=LOCAL] objects[804/1426] linked _values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=TEST,DC=LOCAL] objects[1206/1426] linke d_values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=TEST,DC=LOCAL] objects[1608/1426] linke d_values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=TEST,DC=LOCAL] objects[1743/1426] linke d_values[0/0] Analyze and apply schema objects Partition[CN=Configuration,DC=TEST,DC=LOCAL] objects[402/2240] linked_values[0/ 24] Partition[CN=Configuration,DC=TEST,DC=LOCAL] objects[804/2240] linked_values[0/ 24] Partition[CN=Configuration,DC=TEST,DC=LOCAL] objects[1206/2240] linked_values[0 /24] Partition[CN=Configuration,DC=TEST,DC=LOCAL] objects[1608/2240] linked_values[0 /24] Partition[CN=Configuration,DC=TEST,DC=LOCAL] objects[1772/2240] linked_values[2 4/24] Replicating critical objects from the base DN of the domain Partition[DC=TEST,DC=LOCAL] objects[109/110] linked_values[26/29] Partition[DC=TEST,DC=LOCAL] objects[394/5008] linked_values[29/29] Done with always replicated NC (base, config, schema) Replicating DC=DomainDnsZones,DC=TEST,DC=LOCAL Partition[DC=DomainDnsZones,DC=TEST,DC=LOCAL] objects[42/42] linked_values[0/0] Replicating DC=ForestDnsZones,DC=TEST,DC=LOCAL Partition[DC=ForestDnsZones,DC=TEST,DC=LOCAL] objects[20/20] linked_values[0/0] Exop on[CN=RID Manager$,CN=System,DC=TEST,DC=LOCAL] objects[3] linked_values[0] Committing SAM database Adding 1 remote DNS records for DC2.TEST.LOCAL Adding DNS A record DC2.TEST.LOCAL for IPv4 IP: 192.168.90.201 Adding DNS CNAME record 6ff1df40-cbb5-41f0-b7b3-53a27dde8edf._msdcs.TEST.LOCAL for DC2.TEST.LOCAL All other DNS records (like _ldap SRV records) will be created samba_dnsupdate o n first startup Replicating new DNS records in DC=DomainDnsZones,DC=TEST,DC=LOCAL Partition[DC=DomainDnsZones,DC=TEST,DC=LOCAL] objects[1/42] linked_values[0/0] Replicating new DNS records in DC=ForestDnsZones,DC=TEST,DC=LOCAL Partition[DC=ForestDnsZones,DC=TEST,DC=LOCAL] objects[1/20] linked_values[0/0] Sending DsReplicaUpdateRefs for all the replicated partitions Setting isSynchronized and dsServiceName Setting up secrets database Joined domain TEST (SID S-1-5-21-3959064270-1572045903-2556826204) as a DCIn ADUC snap-in in TEST.LOCAL ditione novi DC recordari debet, et in DNS procuratori novum censum DC2 respondens esse debet.
- Replicatio inter moderatorisPrimum inhibeamus operationem Replicationis servitii Indicis (DRS)
# samba-tool drs showreplOmnes conatus replicationis in exitu prosperi esse debent. DC1 nostrum in indice rerum KCC intra XV minuta ab input apparere debet. Windows
Default-First-Site-NameDC2 DSA Options: 0x00000001 DSA object GUID: 0e9f5bce-ff59-401e-bdbd-fc69df3fc6bf DSA invocationId: 017997b5-d718-41d7-a3f3-e57ab5151b5c ==== INBOUND NEIGHBORS ==== DC=ForestDnsZones,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:56:31 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:56:31 2019 MSK DC=DomainDnsZones,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:56:32 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:56:32 2019 MSK CN=Schema,CN=Configuration,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:56:32 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:56:32 2019 MSK DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:56:32 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:56:32 2019 MSK CN=Configuration,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:56:33 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:56:33 2019 MSK ==== OUTBOUND NEIGHBORS ==== DC=ForestDnsZones,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Thu May 23 16:40:03 2019 MSK was successful 0 consecutive failure(s). Last success @ Thu May 23 16:40:03 2019 MSK DC=DomainDnsZones,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Thu May 23 16:40:03 2019 MSK was successful 0 consecutive failure(s). Last success @ Thu May 23 16:40:03 2019 MSK CN=Schema,CN=Configuration,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Thu May 23 16:40:08 2019 MSK was successful 0 consecutive failure(s). Last success @ Thu May 23 16:40:08 2019 MSK DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Thu May 23 16:40:08 2019 MSK was successful 0 consecutive failure(s). Last success @ Thu May 23 16:40:08 2019 MSK CN=Configuration,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:12:17 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:12:17 2019 MSK ==== KCC CONNECTION OBJECTS ==== Connection -- Connection name: 6d2652b3-e723-4af7-a19f-1ee48915753c Enabled : TRUE Server DNS name : DC1.test.local Server DN name : CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=test,DC=local TransportType: RPC options: 0x00000001 Warning: No NC replicated for Connection!monitum "Nemo NC replicatur pro Connection!" tuto neglecta esse potest. Apparet quia cum perscriptum DC novum, Samba nonnihil replicatio vexilla perperam ponit.
Esset etiam utilem replicationem LDAP sisto.
# samba-tool ldapcmp ldap://dc1.test.local ldap://dc2.test.local -UadministratorPraeceptum praeceptum comparabit valores attributorum totius directorii DC1 et DC2.
Exemplum felicis replicationis
* Comparing [DOMAIN] context... * Objects to be compared: 249 * Result for [DOMAIN]: SUCCESS * Comparing [CONFIGURATION] context... * Objects to be compared: 1750 * Result for [CONFIGURATION]: SUCCESS * Comparing [SCHEMA] context... * Objects to be compared: 1739 * Result for [SCHEMA]: SUCCESS * Comparing [DNSDOMAIN] context... * Objects to be compared: 42 * Result for [DNSDOMAIN]: SUCCESS * Comparing [DNSFOREST] context... * Objects to be compared: 20 * Result for [DNSFOREST]: SUCCESSIn quibusdam rebus diversae moderatoris attributa differunt, et mandatum output de hoc scies. Sed non in omnibus hoc signum erit quaestionis replicationis.
Proximum est manually replicationem stabilis directorii SysVol configurare.
Res ita se habet: Samba nondum DFS-R sustinet, sicut priorem FRS non sustinebat. Ergo, ad replicationem inter DCs, Samba et... Windows Sola solutio adhuc efficacis est replicatio unidirectionalis utens utilitate. robocopy ex ornamentum .Ad vitanda problemata compatibilitatis, artifices Sambae suadent ut primum fasciculum utilitatum in statione laboris communi instituant, deinde Robocopy ad moderatorem in fasciculo "C:\Program Files (x86)" transcribant.Windows Instrumenta Instrumentorum »
Post institutionem, in ordinatore operum in moderatore cum Windows Munus ad replicationem perficiendam cum his parametris creamus:
- Facite pro omnibus users
- Trigger exequi Cotidie omnis V minuta interdiu
— In actionibus viam ad robocopy utilitatem designamus, argumenta denotantes:DC1SYSVOLtest.local DC2SYSVOLtest.local /mir /secIn casu particulari, contenta directorii SysVol ab DC1 ad DC2 imitamur.
- Portable user folders per pam_mount configurationePer experientiam inveni duas optiones viabiles ad solvendum hoc problema cum suo auxilio.
- Plena insertio fasciculi profili e rete ad partitionem /home. Optio simplex. Optime operatur si nomina fasciculorum "My Documents", "Downloads", et "Scrinium" eadem sunt in utroque systemate operativo. Hoc assumit computatrum in... Linux iam in dominium inscriptum est et usores sub rationibus dominii sui initium sessionis faciunt, sssd ut mechanismum authenticationis et auctorisationis utentes.
# vim /etc/security/pam_mount.conf.xml<volume uid="100000000-2000000000" fstype="cifs" server="dfs" path="Profile_Users/%(USER)" mountpoint="~" options="sec=krb5,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775"/>ubi:
- uid="100000000-2000000000" - UID range assignata domain users ex SSSD
- server="dfs" - file server nomen eius
- iter="Profile_Users/%(USER)" - a resource in file server cum hosted user profile "
- mons "~" - montem iter ad user scriptor domum folder
Usoris login transitur ad tortor variabilis "%(USER)" usus ab pam_mount ad retiaculum retis coniungendum prout in propono procurator intravit. Propterea interest ut login in DM intratur sine nomine dominii expresse.
In sssd.conf hoc solvitur explicando vel constituendo optionem falsi use_fully_qualified_names, quae dat nomen modus plene idoneis pro usoribus et coetibus.
- Alter modus est minus simplex et inconditus, et mea quidem sententia commodior et potior. Differentia a primo tantum est in configuratione pam_mount
# vim /etc/security/pam_mount.conf.xml<volume uid="100000000-2000200000" fstype="cifs" server="dfs" path="Profile_Users/%(USER)/Рабочий стол" mountpoint="~/Рабочий стол" options="sec=krb5,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775"/> <volume uid="100000000-2000200000" fstype="cifs" server="dfs" path="Profile_Users/%(USER)/Downloads" mountpoint="~/Загрузки" options="sec=krb5,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775"/> <volume uid="100000000-2000200000" fstype="cifs" server="dfs" path="Profile_Users/%(USER)/Мои документы" mountpoint="~/Документы" options="sec=krb5,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775"/>Hoc est, solum unumquemque nostrum folder seorsim in directorio respondente conscendimus
- Plena insertio fasciculi profili e rete ad partitionem /home. Optio simplex. Optime operatur si nomina fasciculorum "My Documents", "Downloads", et "Scrinium" eadem sunt in utroque systemate operativo. Hoc assumit computatrum in... Linux iam in dominium inscriptum est et usores sub rationibus dominii sui initium sessionis faciunt, sssd ut mechanismum authenticationis et auctorisationis utentes.
Inventiones
Per dimidium mensem laboris in mensa probationum, hoc fasciculum feliciter plures alternatim diuturnas et breves interclusiones utriusque moderatoris superavit, nullis fere consequentiis pro clientibus (postquam cliens in... Windows7 relationes fiduciae amissae).
Super, satis iucundam experientiam habui cum hoc productum operando, etiam omnibus nuances quas agere habui cum in articulo et "post scenas."
Sunt insidiae, multae earum, et dum Samba uteris, earum numerum magnum detegere debebis. Nihilominus, nullae aliae solutiones in praesenti sunt quae te sinunt ambitum hybridum ordinare, cum et sine servitio directorii. Windows.
Source: www.habr.com
