cat /etc/samba/smb.conf [global] workgroup = UOFA server string = Samba Server netbios name = MUDMAN printcap name = /etc/printcap log file = /var/log/samba/%m.log max log size = 2500 security = ADS socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192 local master = no dns proxy = no # I believe the BUILTINS in fact does nothing. # but am too much of a scaredy cat to remove it and risk breaking things # If it said BUILTIN (no 'S') then it probably would do something idmap backend = idmap_rid:UOFA=16777216-33554431 idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 allow trusted domains = no template shell = /bin/bash winbind use default domain = yes password server = nsx.ad.adelaide.edu.au realm = AD.ADELAIDE.EDU.AU restrict anonymous = yes domain master = no preferred master = no ldap ssl = No acl compatibility = win2k nt acl support = true inherit acls = yes map acl inherit = yes winbind enum users = No winbind enum groups = No winbind nested groups = Yes ea support = yes [USERS] path = /shares public = no browseable = yes guest ok = no writeable = yes case sensitive = auto msdfs proxy = no force create mode = 0600 force group = Domain Admins create mask = 0700 # with 0600 and map archive user can't set o+x directory mask = 0700 directory security mask = 770 security mask = 0770 admin users = bsella_admin mboots_admin bfoggo_admin kaz_admin gings_admin [COMMON] path = /projects public = no browseable = yes guest ok = no writeable = yes case sensitive = auto msdfs proxy = no force create mode = 0600 force group = Domain Admins create mask = 0700 # with 0600 and map archive user can't set o+x directory mask = 0700 directory security mask = 0770 security mask = 0770 admin users = bsella_admin mboots_admin bfoggo_admin kaz_admin gings_admin [a1155344@mudman ~]$ cat /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok # Only need winbind for samba users - apparently this does nto require the auth service #auth sufficient /lib/security/$ISA/pam_winbind.so use_first_pass auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so account required /lib/security/$ISA/pam_unix.so broken_shadow account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet # Only need winbind for samba users apparently smaba does not require the accoutn service #account [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_winbind.so account [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_ldap.so account required /lib/security/$ISA/pam_permit.so password requisite /lib/security/$ISA/pam_cracklib.so retry=3 password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow password sufficient /lib/security/$ISA/pam_winbind.so use_authtok password sufficient /lib/security/$ISA/pam_ldap.so use_authtok password required /lib/security/$ISA/pam_deny.so session required /lib/security/$ISA/pam_limits.so session required /lib/security/$ISA/pam_unix.so session optional /lib/security/$ISA/pam_ldap.so cat /etc/sysconfig/authconfig USECRACKLIB=yes USEDB=no USEHESIOD=no USELDAP=yes USENIS=no USEPASSWDQC=no USEWINBIND=yes USEKERBEROS=no USELDAPAUTH=yes USEMD5=yes USESHADOW=yes USESMBAUTH=no USEWINBINDAUTH=yes USELOCAUTHORIZE=no [a1155344@mudman ~]$ cat /etc/nsswitch.conf # # /etc/nsswitch.conf # # An example Name Service Switch config file. This file should be # sorted with the most-used services at the beginning. # # The entry '[NOTFOUND=return]' means that the search for an # entry should stop if the search in the previous entry turned # up nothing. Note that if the search failed due to some other reason # (like no NIS server responding) then the search continues with the # next entry. # # Legal entries are: # # nis or yp Use NIS (NIS version 2), also called YP # dns Use DNS (Domain Name Service) # files Use the local files # db Use the local database (.db) files # compat Use NIS on compat mode # hesiod Use Hesiod for user lookups # ldap Use LDAP (only if nss_ldap is installed) # nisplus or nis+ Use NIS+ (NIS version 3), unsupported # [NOTFOUND=return] Stop searching if not found so far # # To use db, put the "db" in front of "files" for entries you want to be # looked up first in the databases # # Example: #passwd: db files ldap nis #shadow: db files ldap nis #group: db files ldap nis passwd: files winbind ldap shadow: files winbind ldap group: files winbind ldap #hosts: db files ldap nis dns hosts: files dns # Example - obey only what ldap tells us... #services: ldap [NOTFOUND=return] files #networks: ldap [NOTFOUND=return] files #protocols: ldap [NOTFOUND=return] files #rpc: ldap [NOTFOUND=return] files #ethers: ldap [NOTFOUND=return] files bootparams: files ethers: files netmasks: files networks: files protocols: files winbind [a1155344@mudman ~]$ cat /etc/krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = AD.ADELAIDE.EDU.AU dns_lookup_realm = false dns_lookup_kdc = false [realms] AD.ADELAIDE.EDU.AU = { kdc = nsx.ad.adelaide.edu.au } [domain_realm] .adelaide.edu.au = AD.ADELAIDE.EDU.AU # adelaide.edu.au = AD.ADELAIDE.EDU.AU [kdc] profile = /var/kerberos/krb5kdc/kdc.conf [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } [a1155344@mudman ~]$ cat /etc/sysconfig/samba # Options to smbd SMBDOPTIONS="-D -d1 " # Options to nmbd NMBDOPTIONS="-D" # Options for winbindd WINBINDOPTIONS=" -d1 " [a1155344@mudman ~]$