O le iloaina o aʻu sa ou i ai i se faʻafefiloi faʻaulufale mai e leʻi vave oʻo mai. Na o le taimi lava na amata ai ona taunuu mai uta fou o PC mai se faʻalapotopotoga maualuga ma le Alt Linux tufatufaga i luga o le vaʻa na ou masalomia ai se mea e sese.
Ae ui i lea, i le faagasologa o le ui atu i tulaga o le taliaina o le mea e le maalofia, na ou aafia ai ma na amata ona ou fiafia i le faagasologa. Ma i se taimi na ou manatu ai i se saoasaoa faapena, e le o toe mamao pe mulimuli ane e tatau ona ou vavae ese ma fofo mo le faʻatulagaina o se faʻatonuga auaunaga mai Microsoft ma agai atu i se mea e sili atu. O le mea lea, ina ia saunia muamua mo le le maalofia, ma, pe a mafai, ia maua le tele o mailei e mafai ai, na filifili ai e faʻapipiʻi se nofoa suʻega, lea e aofia ai:
- DC1 — Windows Server 2012R2
- DC2 - Alt Server 8.2
- 'Au'aunaga Faila — Windows Server 2012R2
- PC1 — Windows 7
- PC2 - Alt Workstation 8.2
Tutu galuega:
- Fa'atulaga se 'domain' e fa'avae i luga o le w2k12r2. Fausia se seti la'ititi o faiga fa'avae a vaega (e tutusa ma mea e fa'aaogaina i le atina'e gaosiga), e aofia ai se faiga fa'avae mo le fesiita'iina o faila galuega a tagata fa'aoga (La'uina Mai/Pepa/Laupapa). I le iuga, ou te mana'o e fa'amautinoa pe a suia e se tagata fa'aoga lana masini faigaluega, Windows i Linux ma toe foʻi mai sa faigofie ona ia maua ana pepa faigaluega.
- Ulufale atu i Samba DC e le pule lona lua. Fa'amaonia Au'aunaga Fa'atonu ma le Fa'aliliuga DNS
- Fa'atulaga tagata fa'atau Linux e galue ai ma faila fe'avea'i
Faatinoga:
- Fa'apipi'i ma fa'aofiina se pule fouFa'atasi ai ma le fa'apipi'iina o le MS Windows E faigofie ma manino lelei le 2012R2. E 1001 tusi lesona i luga o le initaneti mo le faʻapipiʻiina o se 'upega tafaʻilagi' i luga o le Windows o loʻo faʻaaogaina uma le GUI ma le Powershell, o lea ou te le toe faia, o le a ou alu ese i luga. faʻamaumauga, mo le fia iloa ma i latou e fia faʻafouina o latou mafaufau.
Ae ui i lea, e tasi le itu taua i lenei tulaga. Samba i le taimi nei e le o galue i le lisi o polokalame e sili atu nai lo le 2008R2.
spoiler igoa I se tulaga sa'o, na ta'ua e le au atia'e lenei lagolago o se mea fa'ata'ita'i. Ae i le fa'atinoina, o se taumafaiga e fa'alauiloa Samba o se DC lona lua i totonu o se vaega ua iai. Windows faatasi ai ma le fuafuaga 69 - o le a faafeiloaia oe i le mea sese lea
Ua le manuia le DsAddEntry i le tulaga WERR_ACCESS_DENIED fa'amatalaga (8567, 'WERR_DS_INCOMPATIBLE_VERSION')
O le faʻafitauli o le Windows O le 2012 ma le 2012R2 e faʻaogaina meafaigaluega a le WMI e galulue ai ma domains ma vaomatua, o le lagolago mautu lea ua faʻalauiloaina mo naʻo le lomiga Samba 4.11, lea ua faʻamoemoe e oʻo mai aʻo leʻi oʻo i le faaiuga o lenei tausaga.
E mulimuli mai i lenei mea e na o le pau lava le filifiliga mo le faʻaofiina o samba i totonu o se AD domain o loʻo faʻapipiʻiina i luga o le 2012R2 server o le faʻaititia o le polokalame mai le 69 i le 47. Ioe, e le manaʻomia lenei mea i luga o se gaosiga gaosiga e aunoa ma ni mafuaaga lelei, ae o loʻo i ai se matou suʻega. nofoa iinei, aisea la e le moni ai.Fa'apipi'i le Alt Server 8.2. I le taimi o le faʻapipiʻiina, filifili le "Samba-DC Server (AD Controller)" faʻamatalaga. I luga o le 'auʻaunaga faʻapipiʻi, matou te faia se faʻafouga atoatoa o le polokalama, ma faʻapipiʻi le task-samba-dc package, lea o le a tosoina ai mea uma e te manaʻomia.
# apt-get install task-samba-dcAfai faʻafuaseʻi galuega-samba-dc, e le tusa ai ma faʻamautinoaga o faʻamaumauga, e musu Alta e faʻapipiʻi mea uma e manaʻomia e ia lava.
# apt-get install python-module-samba-DC samba-DC-common samba-DC-winbind-clients samba-DC-winbind samba-DC-common-libs libpytalloc-develO le isi, matou te agai i luma i le faʻatulagaina o Kerberos ma maua se tiketi. Tatala le faila krb5.conf, alu i le [libdefaults] vaega, ma aumai i le fomu nei:
# vim /etc/krb5.confdns_lookup_kdc = true dns_lookup_realm = true default_realm = TEST.LOCALTalosaga mo se tiketi
# kinit administrator Password for administrator@TEST.LOCAL:Siaki le lisi o tiketi Kerberos maua
# klist Ticket cache: KEYRING:persistent:0:0 Default principal: administrator@TEST.LOCAL Valid starting Expires Service principal 16.05.2019 11:51:38 16.05.2019 21:51:38 krbtgt/TEST.LOCAL@TEST.LOCAL renew until 23.05.2019 11:51:35Aveese nei pe toe faaigoa le samba config.
# mv smb.conf smb.conf.bak1Ma mulimuli ane matou ulufale atu i le pule lona lua i le AD domain:
# samba-tool domain join test.local DC -U"TESTadministrator"O le ulufale fa'amanuiaina o le a fa'atasi ma le fa'amaumauga lea
Finding a writeable DC for domain 'test.local' Found DC DC1.TEST.LOCAL Password for [TESTadministrator]: Reconnecting to naming master e31d7da6-8f56-4420-8473-80f2b3a31338._msdcs.TEST. LOCAL DNS name of new naming master is DC1.TEST.LOCAL workgroup is TEST realm is TEST.LOCAL Adding CN=DC2,OU=Domain Controllers,DC=TEST,DC=LOCAL Adding CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC =TEST,DC=LOCAL Adding CN=NTDS Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN =Configuration,DC=TEST,DC=LOCAL Adding SPNs to CN=DC2,OU=Domain Controllers,DC=TEST,DC=LOCAL Setting account password for DC2$ Enabling account Calling bare provision Looking up IPv4 addresses Looking up IPv6 addresses No IPv6 address will be assigned Setting up share.ldb Setting up secrets.ldb Setting up the registry Setting up the privileges database Setting up idmap db Setting up SAM db Setting up sam.ldb partitions and settings Setting up sam.ldb rootDSE Pre-loading the Samba 4 and AD schema A Kerberos configuration suitable for Samba AD has been generated at /var/lib/sa mba/private/krb5.conf Provision OK for domain DN DC=TEST,DC=LOCAL Starting replication Schema-DN[CN=Schema,CN=Configuration,DC=TEST,DC=LOCAL] objects[402/1426] linked _values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=TEST,DC=LOCAL] objects[804/1426] linked _values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=TEST,DC=LOCAL] objects[1206/1426] linke d_values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=TEST,DC=LOCAL] objects[1608/1426] linke d_values[0/0] Schema-DN[CN=Schema,CN=Configuration,DC=TEST,DC=LOCAL] objects[1743/1426] linke d_values[0/0] Analyze and apply schema objects Partition[CN=Configuration,DC=TEST,DC=LOCAL] objects[402/2240] linked_values[0/ 24] Partition[CN=Configuration,DC=TEST,DC=LOCAL] objects[804/2240] linked_values[0/ 24] Partition[CN=Configuration,DC=TEST,DC=LOCAL] objects[1206/2240] linked_values[0 /24] Partition[CN=Configuration,DC=TEST,DC=LOCAL] objects[1608/2240] linked_values[0 /24] Partition[CN=Configuration,DC=TEST,DC=LOCAL] objects[1772/2240] linked_values[2 4/24] Replicating critical objects from the base DN of the domain Partition[DC=TEST,DC=LOCAL] objects[109/110] linked_values[26/29] Partition[DC=TEST,DC=LOCAL] objects[394/5008] linked_values[29/29] Done with always replicated NC (base, config, schema) Replicating DC=DomainDnsZones,DC=TEST,DC=LOCAL Partition[DC=DomainDnsZones,DC=TEST,DC=LOCAL] objects[42/42] linked_values[0/0] Replicating DC=ForestDnsZones,DC=TEST,DC=LOCAL Partition[DC=ForestDnsZones,DC=TEST,DC=LOCAL] objects[20/20] linked_values[0/0] Exop on[CN=RID Manager$,CN=System,DC=TEST,DC=LOCAL] objects[3] linked_values[0] Committing SAM database Adding 1 remote DNS records for DC2.TEST.LOCAL Adding DNS A record DC2.TEST.LOCAL for IPv4 IP: 192.168.90.201 Adding DNS CNAME record 6ff1df40-cbb5-41f0-b7b3-53a27dde8edf._msdcs.TEST.LOCAL for DC2.TEST.LOCAL All other DNS records (like _ldap SRV records) will be created samba_dnsupdate o n first startup Replicating new DNS records in DC=DomainDnsZones,DC=TEST,DC=LOCAL Partition[DC=DomainDnsZones,DC=TEST,DC=LOCAL] objects[1/42] linked_values[0/0] Replicating new DNS records in DC=ForestDnsZones,DC=TEST,DC=LOCAL Partition[DC=ForestDnsZones,DC=TEST,DC=LOCAL] objects[1/20] linked_values[0/0] Sending DsReplicaUpdateRefs for all the replicated partitions Setting isSynchronized and dsServiceName Setting up secrets database Joined domain TEST (SID S-1-5-21-3959064270-1572045903-2556826204) as a DCE tatau ona i ai se fa'ailoga a le ADUC mo le DC fou i le TEST.LOCAL domain, ma e tatau i le DNS Manager ona i ai se fa'amatalaga fou A e fetaui ma le DC2.
- Toe faia i le va o puleMuamua, tatou siaki le Directory Replication Service (DRS)
# samba-tool drs showreplE tatau ona manuia taumafaiga uma o le toe faia o le kopi i le output. E tatau ona aliali mai la tatou DC1 i le lisi o mea faitino a le KCC i totonu o le 15 minute talu ona fa'aofi. Windows
Default-First-Site-NameDC2 DSA Options: 0x00000001 DSA object GUID: 0e9f5bce-ff59-401e-bdbd-fc69df3fc6bf DSA invocationId: 017997b5-d718-41d7-a3f3-e57ab5151b5c ==== INBOUND NEIGHBORS ==== DC=ForestDnsZones,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:56:31 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:56:31 2019 MSK DC=DomainDnsZones,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:56:32 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:56:32 2019 MSK CN=Schema,CN=Configuration,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:56:32 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:56:32 2019 MSK DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:56:32 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:56:32 2019 MSK CN=Configuration,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:56:33 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:56:33 2019 MSK ==== OUTBOUND NEIGHBORS ==== DC=ForestDnsZones,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Thu May 23 16:40:03 2019 MSK was successful 0 consecutive failure(s). Last success @ Thu May 23 16:40:03 2019 MSK DC=DomainDnsZones,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Thu May 23 16:40:03 2019 MSK was successful 0 consecutive failure(s). Last success @ Thu May 23 16:40:03 2019 MSK CN=Schema,CN=Configuration,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Thu May 23 16:40:08 2019 MSK was successful 0 consecutive failure(s). Last success @ Thu May 23 16:40:08 2019 MSK DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Thu May 23 16:40:08 2019 MSK was successful 0 consecutive failure(s). Last success @ Thu May 23 16:40:08 2019 MSK CN=Configuration,DC=test,DC=local Default-First-Site-NameDC1 via RPC DSA object GUID: 60fb339d-efa3-4585-a42d-04974e6601b7 Last attempt @ Mon May 27 12:12:17 2019 MSK was successful 0 consecutive failure(s). Last success @ Mon May 27 12:12:17 2019 MSK ==== KCC CONNECTION OBJECTS ==== Connection -- Connection name: 6d2652b3-e723-4af7-a19f-1ee48915753c Enabled : TRUE Server DNS name : DC1.test.local Server DN name : CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=test,DC=local TransportType: RPC options: 0x00000001 Warning: No NC replicated for Connection!Le puipuiga "Leai se NC toe faia mo So'oga!" e mafai ona le amanaiaina saogalemu. E aliali mai ona o le mea moni e faapea pe a resitalaina se DC fou, samba le setiina o ni fuʻa toe faia.
Ose manatu lelei fo'i le siaki ole fa'asologa o le LDAP.
# samba-tool ldapcmp ldap://dc1.test.local ldap://dc2.test.local -UadministratorO le faʻatonuga o loʻo i luga o le a faʻatusatusa ai uiga taua o mea faʻatonu uma ile DC1 ma DC2.
Fa'ata'ita'iga o le toe faia fa'amanuiaina
* Comparing [DOMAIN] context... * Objects to be compared: 249 * Result for [DOMAIN]: SUCCESS * Comparing [CONFIGURATION] context... * Objects to be compared: 1750 * Result for [CONFIGURATION]: SUCCESS * Comparing [SCHEMA] context... * Objects to be compared: 1739 * Result for [SCHEMA]: SUCCESS * Comparing [DNSDOMAIN] context... * Objects to be compared: 42 * Result for [DNSDOMAIN]: SUCCESS * Comparing [DNSFOREST] context... * Objects to be compared: 20 * Result for [DNSFOREST]: SUCCESSI nisi tulaga, o uiga o mea i luga o pule eseese e ono eseese, ma o le gaioiga o le poloaiga o le a faʻaalia ai oe e uiga i ai. Ae le o tulaga uma, o le a avea ma se faʻailoga o se faʻafitauli i le toe faia.
O le isi laasaga o le faʻatulagaina ma le lima o le faʻasologa mautu o le SysVol directory.
O le mea moni, e leʻi lagolagoina e Samba le DFS-R, e pei lava ona leʻi lagolagoina le FRS muamua. O le mea lea, mo le toe faia i le va o DCs, o Samba ma Windows Pau lava le fofo e aoga i le taimi nei o le toe faia o le tasi itu e faʻaaoga ai le mea faigaluega robocopy mai le pusa .Ina ia 'alofia fa'afitauli o le fetaui, e fautuaina e le au atia'e Samba le fa'apipi'iina muamua o le utility suite i luga o se workstation masani, ona kopiina lea o le Robocopy i le controller i le faila "C:\Program Files (x86)"Windows Pusa PunaoaMeafaigaluega»
A maeʻa ona faʻapipiʻi, i le task scheduler i luga o le controller ma Windows Matou te faia se galuega e faʻatino ai le toe faia o le kopi ma faʻasologa nei:
- Taufetuli mo tagata faʻaoga uma
- Fa'aoso e fa'atino Aso Ta'itasi uma 5 minute i le aso
- I gaioiga, matou te tusia le ala i le robocopy aoga, faʻamaonia e fai ma finauga:DC1SYSVOLtest.local DC2SYSVOLtest.local /mir /secI se tulaga faʻapitoa, matou te kopiina mea o loʻo i totonu o le SysVol directory mai DC1 i DC2.
- Fa'apipi'i fa'aoga fa'aoga fa'aoga pam_mount configurationO le mea moni, na ou mauaina ni filifiliga talafeagai se lua mo le foia o lenei faafitauli.
- Fa'apipi'i atoa se faila fa'amatalaga mai le network i le /home partition. O se filifiliga faigofie. E aoga lelei pe afai e tutusa igoa o My Documents, Downloads, ma Desktop folders i operating systems uma e lua. O lenei mea e fa'apea o le PC i luga Linux ua uma ona ulufale i totonu o le domain ma e ulufale tagata faʻaoga i lalo o a latou tala o le domain e faʻaaoga ai le sssd o se auala faʻamaonia ma faʻatagaina.
# vim /etc/security/pam_mount.conf.xml<volume uid="100000000-2000000000" fstype="cifs" server="dfs" path="Profile_Users/%(USER)" mountpoint="~" options="sec=krb5,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775"/>pe afai:
- uid="100000000-2000000000" - UID va'aiga ua tu'uina atu i tagata fa'aoga vaega mai le SSSD
- server="dfs" - igoa faila faila
- ala = "Profile_Users/%(USER)" - o se punaoa i luga o se faila faila, faʻatasi ai ma se faʻamatalaga tagata faʻaoga talimalo
- mountpoint="~" - fa'apipi'i le ala ile fa'ailoga fale ole tagata fa'aoga
O le saini a le tagata e fa'aoga e pasi atu i le "%(USER)" macro variable fa'aaogaina e pam_mount e fa'apipi'i ai a tatou punaoa feso'ota'iga, e pei ona tusia i le fa'aaliga pule. O le mea lea, e taua tele le ulufale i totonu o le DM e aunoa ma se faʻamatalaga manino o le igoa ole igoa.
I le sssd.conf, e foia lenei mea e ala i le faʻaalia, poʻo le setiina o le False value i le filifiliga fa'aoga_igoa_uma_agava'a, lea e mafai ai le igoa atoa (e aofia ai le vaega) mo tagata fa'aoga ma vaega.
- O le auala lona lua e le faigofie ma faʻafefe, ma i loʻu manatu e sili atu ona faigofie ma sili atu. O le ese'esega mai le muamua e na'o le pam_mount configuration
# vim /etc/security/pam_mount.conf.xml<volume uid="100000000-2000200000" fstype="cifs" server="dfs" path="Profile_Users/%(USER)/Рабочий стол" mountpoint="~/Рабочий стол" options="sec=krb5,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775"/> <volume uid="100000000-2000200000" fstype="cifs" server="dfs" path="Profile_Users/%(USER)/Downloads" mountpoint="~/Загрузки" options="sec=krb5,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775"/> <volume uid="100000000-2000200000" fstype="cifs" server="dfs" path="Profile_Users/%(USER)/Мои документы" mountpoint="~/Документы" options="sec=krb5,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775"/>O lona uiga, matou te fa'apipi'i eseese a matou faila ta'itasi i le lisi e fetaui ma ia
- Fa'apipi'i atoa se faila fa'amatalaga mai le network i le /home partition. O se filifiliga faigofie. E aoga lelei pe afai e tutusa igoa o My Documents, Downloads, ma Desktop folders i operating systems uma e lua. O lenei mea e fa'apea o le PC i luga Linux ua uma ona ulufale i totonu o le domain ma e ulufale tagata faʻaoga i lalo o a latou tala o le domain e faʻaaoga ai le sssd o se auala faʻamaonia ma faʻatagaina.
sailiiliga
I le afa masina o le galuega i luga o le laulau fa'ata'ita'i, na manuia ai lenei afifi i le tele o taimi e tapunia ai masini e lua mo se taimi umi ma se taimi pu'upu'u, e aunoa ma ni a'afiaga mo tagata fa'atau (pe a avea ma tagata fa'atau i luga). Windows7 mafutaga faatuatuaina ua leiloa).
I se tulaga lautele, sa ou maua se lagona manaia o le galue ma lenei oloa, e ui lava i mea uma na ou feagai ma le tusiga ma tua atu o vaaiga.
E tele lava ni fa'aletonu, ma a'o e galue i le Samba, e tatau ona e iloa le tele o na fa'aletonu. Peita'i, e leai ni isi fofo i le taimi nei e mafai ai ona e fa'atulaga se siosiomaga fa'afefiloi, e iai ma e leai fo'i se tautua fa'asino. Windows.
puna: www.habr.com
