mkdir -p CA/certs CA/crl CA/newcerts  CA/private

chmod 700 CA/private

touch CA/index.txt

echo 01 > CA/serial

# The dir parameter is important because it tells

# openssl where to find all necessary files used to

# generate keys.

dir                             = ./

# default_days defines the length of time your key is valid for.

default_days                    = 3650

# default_bits is an indicator of the strength of your key.  I elected

# 1024 but you can choose more or less.

default_bits                    = 1024

# The following parameters should be modified to fit your

# organization.

countryName_default             = US

stateOrProvinceName_default     = North Carolina

localityName_default            = Raleigh

0.organizationName_default      = somedomain.com

# See slapd.conf(5) for details on configuration options.

# This file should NOT be world readable.

#

include     /etc/openldap/schema/core.schema

include     /etc/openldap/schema/cosine.schema

include     /etc/openldap/schema/inetorgperson.schema

include     /etc/openldap/schema/nis.schema

include     /etc/openldap/schema/samba.schema

# -1 is all messages 296 is a good compromise for most debugging

#loglevel    -1

pidfile     /var/run/slapd.pid

argsfile    /var/run/slapd.args

# The following three lines are related to security.  Leave them commented out now.

# We uncomment them and enable security *after* we have successfully tested Samba with

# LDAP in an unsecured configuration.  Debugging is infinitely easier without encryption

# enabled.

#TLSCipherSuite          HIGH

#TLSCertificateFile      /etc/openldap/slapd-cert.pem

#TLSCertificateKeyFile   /etc/openldap/slapd-key.pem

database    bdb

# MODIFY

# Modify suffix and rootdn to match your domain name.

suffix      "dc=somedomain,dc=com"

rootdn      "cn=Manager,dc=somedomain,dc=com"

# MODIFY

# Use the following to generate:

#  slappasswd -h {SSHA} -s <your password here>

rootpw      {SSHA}kCuJt72QLJ2O06nFUvdre97sHT0AxlH/

# MODIFY

# The database directory MUST exist prior to running slapd AND

# should only be accessible by the slapd and slap tools.

# Mode 700 recommended with an owner of ldap and a group of ldap

directory   /var/lib/ldap/somedomain.com

# Indices to maintain for this database

index objectClass           eq

index cn                    pres,sub,eq

index sn                    pres,sub,eq

index uid                   pres,sub,eq

index displayName           pres,sub,eq

index uidNumber             eq

index gidNumber             eq

index memberUID             eq

index sambaSID              eq

index sambaPrimaryGroupSID  eq

index sambaDomainName       eq

index default               sub

# Access Control Entries

# Note these ACEs are duplicated from the IDEALX smbldap usermanual with one exception

# users can authenticate and change their password access to attrs=userPassword,

sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdMustChange

      by dn="uid=samba,ou=Users,dc=somedomain,dc=com" write

      by self write

      by anonymous auth

      by * none

# some attributes need to be readable anonymously so that 'id user' can answer correctly

access to attrs=objectClass,entry,gecos,homeDirectory,uid,uidNumber,gidNumber,cn,

memberUid

      by dn="uid=samba,ou=Users,dc=somedomain,dc=com" write

      by * read

# somme attributes can be writable by users themselves

access to attrs=description,telephoneNumber

      by dn="uid=samba,ou=Users,dc=somedomain,dc=com" write

      by self write

      by * read

# some attributes need to be writable for samba (this ACE modified from original to allow

some unix commands to work) access to attrs=cn,sambaLMPassword,sambaNTPassword,

sambaPwdLastSet,sambaLogonTime,sambaLogoffTime,sambaKickoffTime,sambaPwdCanChange,

sambaPwdMustChange,sambaAcctFlags,displayName,sambaHomePath,sambaHomeDrive,

sambaLogonScript,sambaProfilePath,description,sambaUserWorkstations,sambaPrimaryGroupSID,

sambaDomainName,sambaSID,sambaGroupType,sambaNextRid,sambaNextGroupRid,sambaNextUserRid,

sambaAlgorithmicRidBase,sambaLogonScript,loginShell

      by dn="uid=samba,ou=Users,dc=somedomain,dc=com" write

      by self read

      by * none

# samba need to be able to create the samba domain account

access to dn.base="dc=somedomain,dc=com"

      by dn="uid=samba,ou=Users,dc=somedomain,dc=com" write

      by * none

# samba need to be able to create new users account

access to dn="ou=Users,dc=somedomain,dc=com"

      by dn="uid=samba,ou=Users,dc=somedomain,dc=com" write

      by * none

# samba need to be able to create new groups account

access to dn="ou=Groups,dc=somedomain,dc=com"

      by dn="uid=samba,ou=Users,dc=somedomain,dc=com" write

      by * none

# samba need to be able to create new computers account

access to dn="ou=Computers,dc=somedomain,dc=com"

      by dn="uid=samba,ou=Users,dc=somedomain,dc=com" write

      by * none

# this can be omitted but we leave it: there could be other branch

# in the directory

access to *

      by self read

      by * none

## IMPORTANT

## The /etc/ldap.conf file is used by PAM.   There is another ldap.conf file in

## /etc/openldap.

## The file, /etc/openldap/ldap.conf, is used by ldap tools, such as ldapsearch.

## If you intend to use those tools you will need to add a TLS_CACERT directive to that

## file also.

# Your LDAP server. Must be resolvable without using LDAP.

# Multiple hosts may be specified, each separated by a

# space.

host 127.0.0.1

# MODIFY

# The distinguished name of the search base.

base dc=somedomain,dc=com

# MODIFY

# The distinguished name to bind to the server with.

# We will use the root dn until we can create a lesser privileged user.

binddn cn=Manager,dc=somedomain,dc=com

bindpw < use the password you created for Manager in "Step 4: Configure slapd.conf">

# MODIFY

# Note: "ou=Users" and "ou=Groups" should match what

# you entered in smb.conf for "ldap group suffix"

# and "ldap user suffix"

nss_base_passwd        ou=Users,dc=somedomain,dc=com?one

nss_base_passwd        ou=Computers,dc=somedomain,dc=com?one

nss_base_shadow        ou=Users,dc=somedomain,dc=com?one

nss_base_group         ou=Groups,dc=somedomain,dc=com?one

ssl no

pam_password md5

# We need to tell PAM where the certificate used to authenticate the LDAP

# server (i.e. is the LDAP server the one we think it is).

tls_cacertfile /etc/openldap/cacert.pem

# If you experience difficulty authenticating after enabling TLS, try uncommenting

# the next line.  You will know that you are having problems if you

# issue "getent group" and do not see any of the MS Windows groups

# that have been created in your LDAP database.

# tls_checkpeer no

# Global parameters

[# Global parameters

[global]

        # MODIFY

        workgroup = BIGTIME

        # MODIFY

        netbios name =  linus

        # MODIFY

        server string = Linus Samba Server

        passdb backend = ldapsam:ldap://127.0.0.1/

        # By default run with minimal logging.  However, if you need to debug

        # 5 is a fairly verbose logging level.

        #log level = 5

        log file = /var/log/samba/log.%m

        max log size = 50

        time server = Yes

        add user script = /var/lib/samba/sbin/smbldap-useradd -a '%u'

        delete user script = /var/lib/samba/sbin/smbldap-userdel '%u'

        add group script = /var/lib/samba/sbin/smbldap-groupadd -p '%g'

        delete group script = /var/lib/samba/sbin/smbldap-groupdel '%g'

        add user to group script = /var/lib/samba/sbin/smbldap-groupmod -m '%u''%g'

        delete user from group script = /var/lib/samba/sbin/smbldap-groupmod -x '%u' '%g'

        set primary group script = /var/lib/samba/sbin/smbldap-usermod -g '%g' '%u'

        add machine script = /var/lib/samba/sbin/smbldap-useradd -w '%u'

        # Personally, I do not like roaming profiles because they take up too

        # much space on my server.  As such, I disable roaming profiles by

        # setting the following two variables to null

        logon path =

        logon home =

        logon drive = H:

        domain logons = Yes

        preferred master = Yes

        domain master = Yes

        wins support = Yes

        # MODIFY

        ldap admin dn = cn=Manager,dc=somedomain,dc=com

        ldap group suffix = ou=Groups

        ldap idmap suffix = ou=Idmap

        ldap machine suffix = ou=Computers

        ldap passwd sync = Yes

        # MODIFY

        ldap suffix = dc=somedomain,dc=com

        ldap user suffix = ou=Users

        idmap backend = ldap:ldap://127.0.0.1

        idmap uid = 10000-20000

        idmap gid = 10000-20000

# The next three blocks define the shared drives that we will be exposing.  They are all

# nearly identical.  The important thing to note is that all files on these drives are

# readable and writeable by any user in that group.

[netlogon]

        path = /var/lib/samba/netlogon/scripts

        browseable = No

        root preexec = /var/lib/samba/netlogon/scripts/logon.pl %U %I

# MODIFY

[marketing]

        comment = Marketing material

        path = /home/marketing

        # Any files written to this drive will have this user group. Since this is a

        # *shared* drive all users should have permission to read/write/remove any file.

        # If you do not agree you will probably want to remove the "force group" line

        force group = marketing

        read only = No

        create mask = 0770

        directory mask = 0770

        browseable = No

# MODIFY

[engineering]

        comment = Common material

        path = /home/engineering

        path = /home/marketing

        # Any files written to this drive will have this user group. Since this is a

        # *shared* drive all users should have permission to read/write/remove any file.

        # If you do not agree you will probably want to remove the "force group" line

        force group = engineering

        read only = No

        create mask = 0770

        directory mask = 0770

        browseable = No

# MODIFY

[management]

        comment = Management Data

        path = /home/management

        path = /home/marketing

        # Any files written to this drive will have this user group. Since this is a

        # *shared* drive all users should have permission to read/write/remove any file.

        # If you do not agree you will probably want to remove the "force group" line

        force group = management

        read only = No

        create mask = 0770

        directory mask = 0770

#!/usr/bin/perl

use strict;

# Set the permissions on any file we create to 640 (i.e. -rw-r--r--)

umask(022);

my $NETLOGON_DIR = "/var/lib/samba/netlogon/scripts";

my $LOG_DIR = "/var/log/samba";

my $SERVERNAME = "linus";

## You will need to modify this hash to match your mountpoints.

my %MOUNTPOINTS = (

                "engineering" => "NET USE W: \\$SERVERNAME\engineering /YESrn",

                "marketing" => "NET USE W: \\$SERVERNAME\marketing /YESrn",

                "management" => "NET USE W: \\$SERVERNAME\management /YESrn"

                );

## Make sure that there is a user name and that it contains a valid

## user name string (i.e. no invalid chars).

if ($#ARGV != 1 ||

    $ARGV[0] =~ /[^a-zA-Z0-9-_]/) {

    exit(1);

}

# Make sure that the user exists and log attempts with invalid IDs

my $uid = getpwnam($ARGV[0]);

if ($uid == /[^0-9]/){

    my $now = localtime;

    open LOG, ">>$LOG_DIR/log.netlogon";

    print LOG "$now";

    print LOG " - Error: Unknown user $ARGV[0] logged into $SERVERNAME from $ARGV[1]n";

    close LOG;

    exit(1);

}

# Log the logon attempt

my $now = localtime;

open LOG, ">>$LOG_DIR/log.netlogon";

print LOG "$now";

print LOG " - User $ARGV[0] logged into $SERVERNAME from $ARGV[1]n";

close LOG;

## Create a custom logon batch file.

open FH, ">$NETLOGON_DIR/$ARGV[0].cmd";

# Turn echo off

print FH "@ECHO OFFrn";

# Synchronize time between Windows client and Linux server.

print FH "NET TIME \\$SERVERNAME /SET /YESrn";

foreach my $key (keys(%MOUNTPOINTS)) {

    if (isMember($ARGV[0], $key)) {

       # Put mount points in file

       print FH "$MOUNTPOINTS{$key}";

    }

}

close FH;

# Checks to see if the given user is a member of

# the given group.

# Returns 1 if true and 0 otherwise.

sub isMember{

    my ($user, $group) = @_;

    my ($name, $passwd, $gid, $members) = getgrnam($group);

    my @members = split /s+/, $members;

    for(@members){

       if ($user eq $_) {

          return 1;

       }

    }

    return 0;

}

[root@linus sbin]# ./configure.pl

If you need to change this, enter the full directory path, then press enter to continue.

Smbldap-tools Configuration Directory Path [/etc/opt/IDEALX/smbldap-tools/] >

 /var/lib/samba/sbin

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Let's start configuring the smbldap-tools scripts ...

. workgroup name: name of the domain Samba act as a PDC

  workgroup name [BIGTIME] >

. netbios name: netbios name of the samba controler

  netbios name [linus] >

. logon drive: local path to which the home directory will be connected (for NT

  Workstations). Ex: 'H:'

  logon drive [H:] >

. logon home: home directory location (for Win95/98 or NT Workstation).

  (use %U as username) Ex:'\linus%U'

  logon home (press the "." character if you don't want homeDirectory) [\linus%U]

  > .

. logon path: directory where roaming profiles are stored. Ex:'\linusprofiles%U'

  logon path (press the "." character if you don't want roaming profile)

  [\linusprofiles%U] > .

. home directory prefix (use %U as username) [/home/%U] >

. default users' homeDirectory mode [700] >

. default user netlogon script (use %U as username) [%U.cmd] > ""

  default password validation time (time in days) [45] >

. ldap suffix [dc=somedomain,dc=com] >

. ldap group suffix [ou=Groups] >

. ldap user suffix [ou=Users] >

. ldap machine suffix [ou=Computers] >

. Idmap suffix [ou=Idmap] >

. sambaUnixIdPooldn: object where you want to store the next uidNumber

  and gidNumber available for new users and groups

  sambaUnixIdPooldn object (relative to ${suffix}) [sambaDomainName=BIGTIME] >

. ldap master server: IP adress or DNS name of the master (writable) ldap server

  ldap master server [127.0.0.1] >

. ldap master port [389] >

. ldap master bind dn [cn=Manager,dc=somedomain,dc=com] >

. ldap master bind password [] >

. ldap slave server: IP adress or DNS name of the slave ldap server: can also be the

  master one

  ldap slave server [127.0.0.1] >

. ldap slave port [389] >

. ldap slave bind dn [cn=Manager,dc=somedomain,dc=com] >

. ldap slave bind password [] >

. ldap tls support (1/0) [0] > 1

. How to verify the server's certificate (none, optional or require) [require] >

. CA certificate file [/var/lib/samba/sbin//ca.pem] > /etc/openldap/cacerts/cacert.pem

. certificate to use to connect to the ldap server

  [/var/lib/samba/sbin//smbldap-tools.pem] >

. key certificate to use to connect to the ldap server

  [/var/lib/samba/sbin//smbldap-tools.key] >

. SID for domain BIGTIME: SID of the domain (can be obtained with

  'net getlocalsid linus')

  SID for domain BIGTIME [S-1-5-21-1030832020-2822878261-2997333186] >

. unix password encryption: encryption used for unix passwords

  unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > MD5

. default user gidNumber [513] >

. default computer gidNumber [515] >

. default login shell [/bin/bash] >

. default skeleton directory [/etc/skel] >

. default domain name to append to mail adress [] > somedomain.com

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

backup old configuration files:

  /var/lib/samba/sbin/smbldap.conf->/var/lib/samba/sbin/smbldap.conf.old

  /var/lib/samba/sbin/smbldap_bind.conf->/var/lib/samba/sbin/smbldap_bind.conf.old

writing new configuration file:

  /var/lib/samba/sbin/smbldap.conf done.

  /var/lib/samba/sbin/smbldap_bind.conf done.

[root@linus sbin]# ./smbldap-populate

Populating LDAP directory for domain BIGTIME (S-1-5-21-1030832020-2822878261-2997333186)

(using builtin directory structure)

LDAP config host: 127.0.0.1

port: 389

version: 3

timeout: 60

adding new entry: dc=somedomain,dc=com

adding new entry: ou=Users,dc=somedomain,dc=com

adding new entry: ou=Groups,dc=somedomain,dc=com

adding new entry: ou=Computers,dc=somedomain,dc=com

adding new entry: uid=root,ou=Users,dc=somedomain,dc=com

adding new entry: uid=nobody,ou=Users,dc=somedomain,dc=com

adding new entry: cn=Domain Admins,ou=Groups,dc=somedomain,dc=com

adding new entry: cn=Domain Users,ou=Groups,dc=somedomain,dc=com

adding new entry: cn=Domain Guests,ou=Groups,dc=somedomain,dc=com

adding new entry: cn=Domain Computers,ou=Groups,dc=somedomain,dc=com

adding new entry: cn=Administrators,ou=Groups,dc=somedomain,dc=com

adding new entry: cn=Account Operators,ou=Groups,dc=somedomain,dc=com

adding new entry: cn=Print Operators,ou=Groups,dc=somedomain,dc=com

adding new entry: cn=Backup Operators,ou=Groups,dc=somedomain,dc=com

adding new entry: cn=Replicators,ou=Groups,dc=somedomain,dc=com

adding new entry: cn=NextFreeUnixId,dc=somedomain,dc=com

Please provide a password for the domain root:

LDAP config host: 127.0.0.1

port: 389

version: 3

timeout: 60

Changing password for root

New password :

Retype new password :

cd /var/lib/samba/sbin

./smbldap-groupadd engineering

./smbldap-groupadd marketing

./smbldap-groupadd management

./smbldap-useradd -s /sbin/nologin -m -g engineering engineering

./smbldap-useradd -s /sbin/nologin -m -g marketing marketing

./smbldap-useradd -s /sbin/nologin -m -g management management

cd /var/lib/samba/sbin

./smbldap-useradd -a -G "Domain Users",engineering dilbert

./smbldap-passwd dilbert

./smbldap-useradd -a -G "Domain Users",engineering wally

./smbldap-passwd wally

./smbldap-useradd -a -G "Domain Users",marketing catbert

./smbldap-passwd catbert

./smbldap-useradd -a -G "Domain Users",marketing,management,engineering boss

./smbldap-passwd boss