Using my method you get pam to point to AD and let it manage everything for you. This results in the box acting like any other client machine on an AD network but still providing all the functionality (services and applications) of a Linux box.<div>
<br></div><div>Unless you need more domain servers to handle authentication requests then I wouldn't worry to implement that part of Samba. </div><div><br></div><div>Some interesting reading for heterogeneous networking is this book (published bu Oreilly) <a href="http://commons.oreilly.com/wiki/index.php/Linux_in_a_Windows_World">Linux in a Windows World</a>:</div>
<meta http-equiv="content-type" content="text/html; charset=utf-8"><div>Book page: <a href="http://oreilly.com/catalog/9780596007584">http://oreilly.com/catalog/9780596007584</a></div><div><a href="http://oreilly.com/catalog/9780596007584"></a>Commons (Free Online Reading): <a href="http://commons.oreilly.com/wiki/index.php/Linux_in_a_Windows_World">http://commons.oreilly.com/wiki/index.php/Linux_in_a_Windows_World</a></div>
<div><br></div><div><a href="http://commons.oreilly.com/wiki/index.php/Linux_in_a_Windows_World"></a>This book was a big launchpad for me in the Linux/MS world. Some of it is out of date (but some reading of documentation can bring you back up to speed) but it gives a good overview of things. I do have a print copy somewhere but I can't seem to find it in my shelf at this moment in time. If you or anyone else is interested in (and will use) this book then I can have a hunt for it. Since it is only gathering dust I'm happy to give it to a good home.<br>
<br><div class="gmail_quote">On 29 April 2011 19:42, Peter Childs <span dir="ltr"><<a href="mailto:PChilds@bcs.org.uk">PChilds@bcs.org.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><div></div><div class="h5">On 29 April 2011 18:52, David Halliday <<a href="mailto:david.halliday@gmail.com">david.halliday@gmail.com</a>> wrote:<br>
> I did (a few years ago when still in Rochester) spend quite some time<br>
> working with samba and authentication.<br>
> I wanted to achieve a number of goals:<br>
><br>
> Users access a FTP, SSH and other services on a Linux server using AD<br>
> usernames/passwords.<br>
> Users authenticate to Linux workstations using their AD credentials.<br>
><br>
> Since I wanted to provide a number (and provide many more) services to users<br>
> I found that the solution was to configure pam (which is one of the main<br>
> central authentication engines) to allow authentication against the AD<br>
> server. This might be overkill or it might prove to be the simple solution<br>
> to all your problems, but once you get one service working through pam, you<br>
> can have any other authenticating against the same method.<br>
> My notes are here: <a href="http://david-halliday.co.uk/?Linux:AD_Authentication" target="_blank">http://david-halliday.co.uk/?Linux:AD_Authentication</a><br>
> They are a little old but reference a more in depth guide. I recently helped<br>
> implement a similar configuration (with in the past 6 months on a<br>
> centos installation) at work and little had changed.<br>
> The most important thing to check (and maintain) is that the Linux box and<br>
> the Microsoft server that it is authenticating against have the same time.<br>
> Where possible make them sync against the same server regularly (or<br>
> one against the other) as the time being out (and it doesn't have to be<br>
> much) can be a confusing hurdle.<br>
><br>
> For anyone who is interested in playing with authentication pam is<br>
> interesting as it is modular and you can fairly quickly build and implement<br>
> your own methods including authentication against something like a MySQL<br>
> server database if you particularly wanted.<br>
><br>
> I have not used any of the purpose built NAS on a CD distros (but many look<br>
> good).<br>
> We use CentOS at work and they seem good, I have used Cent OS in other<br>
> places too. CentOS looked good a few years ago as Red Hat (from which its<br>
> derived) was the "solid business choice" and many proprietary applications<br>
> that were targeted at businesses were predominantly tested (and supported)<br>
> on Red Hat, so having a Red Hat based distribution makes life easier there.<br>
> I have wanted to use Debian in production servers but have always been out<br>
> voted by people who have a red hat background.<br>
> With the rise of Ubuntu and now Ubuntu Server... Things could shift in<br>
> support/consensus.<br>
><br>
><br>
> On 28 April 2011 12:38, Peter Childs <<a href="mailto:pchilds@bcs.org">pchilds@bcs.org</a>> wrote:<br>
>><br>
>> Samba need good book, any ideas.....<br>
>><br>
>> Peter.<br>
>><br>
>> On 26 April 2011 20:07, Laurence Southon <<a href="mailto:laurence@southon.uk.net">laurence@southon.uk.net</a>> wrote:<br>
>> > On 26/04/11 18:27, Peter Childs wrote:<br>
>> >> I've been asked to set up a File Server for a network of windows based<br>
>> >> machines, So I'm guessing Samba here..... I guess I need to set up<br>
>> >> Samba to run as a Windows PDC to sort out security and get all the<br>
>> >> Windows XP Pro (I think thats what they have) to join the "Network"<br>
>> >> Unless I can get the Samba server look like AD, but I'm not sure how<br>
>> >> to go about this... They want passwords and some "Security" over the<br>
>> >> files on the file server.....<br>
>> >><br>
>> > You can have username:passwd security without a PDC, and unless the<br>
>> > workstations definitely are XP Pro they won't be able to join a domain.<br>
>> ><br>
>> > It's a lot of work to set up the domain and then join each machine to<br>
>> > it. Personally I would avoid it, and another downside is that by default<br>
>> > Samba will use roaming profiles which will likely lead to trouble in the<br>
>> > long run. You can disable that but it's yet another setting to get dead<br>
>> > right.<br>
>> ><br>
>> >> While doing a bit of reading up on doing this I worked out it should<br>
>> >> be possible to use Samba to do shared home directories on Linux and it<br>
>> >> should work *better* than NFS.<br>
>> ><br>
>> > Yes, homes are easy to set up in Samba. Be careful where you place them,<br>
>> > and consider user quotas to stop disc usage getting out of control.<br>
>> >><br>
>> >> Also can I join the Wins bit of the SMB to my DNS and not have so much<br>
>> >> duplication of service.<br>
>> > Samba will become a WINS server, just put 'wins support = yes' in the<br>
>> > [global] part of smb.conf. Job done.<br>
>> ><br>
>> > Samba is a leviathan, there are literally hundreds of possible settings,<br>
>> > any of which can trip you up. Good place to start is the official<br>
>> > documentation:<br>
>> ><br>
>> > <a href="http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/" target="_blank">http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/</a><br>
>> ><br>
>> > Feel free to fire questions, but a couple of tips on things that are<br>
>> > guaranteed to drive you up the wall at some point:<br>
>> ><br>
>> > You can grant whatever permissions you like in Samba, but if the<br>
>> > appropriate Unix permissions are not in place, then they won't work, and<br>
>> > you won't know why.<br>
>> ><br>
>> > Some config changes in Samba take effect straightaway, others require a<br>
>> > Windows logon/logoff or even reboot to take effect, so always worth<br>
>> > trying that before giving up.<br>
>> ><br>
<br>
<br>
</div></div>Interesting. I'll have to do some playing, and see what I can get working.<br>
<br>
I've used most of the building blocks before but not together....<br>
<br>