[Samba] Samba and OpenLDAP - success?

[Joe Tseng]

All,

I've spent almost two months learning about setting up Samba and OpenLDAP for SSO.  I was finally able to get it done (at least for Win XP Pro at this point) and I've compiled some notes on how I did it.  The latest copy of my notes will be at the link below:

http://bit.ly/smbldapsetup

I've also discovered during my travels in Google-land that when you try a potentially useful URL in a page several years old, that link may end up invalid.  So to avoid that from happening with the link above I've included my notes up to this point below.  YMMV.

I'm no expert on this topic so I'll assume there are going to be mistakes in security and maintenance in my configuration.  I would warmly welcome comments and corrections.

hth,

 - Joe


If you type "Google" into Google, you can break the Internet.  -- Jen Barber


==================================================

How To Set Up Samba & LDAP with Amahi - January 2011Set up Fedora 12 with Amahi: http://www.amahi.org/support/instructionsSet up Amahi server as a PDC: http://wiki.amahi.org/index.php/PDCnote: follow instructions under header “Full Procedure for Windows XP”note: in /etc/samba/smb.conf I made changes under [global]:logon home = \\%L\%Ulogin path = \\%L\profiles\%UCreate a backup copy of /etc/samba/smb.confSet up OpenLDAP in Amahi server: http://wiki.amahi.org/index.php/LDAPI
 don’t know what the clear password was in that document for root 
(rootpw) since it was encrypted so I made my own using 
/usr/sbin/slappasswd and saved that in /etc/openldap/slapd.conf.Updated slapd.conf: include /etc/openldap/schema/samba.schemaUsed any lines I already didn’t have in /etc/samba/smb.conf and added them: http://download.gna.org/smbldap-tools/docs/samba-ldap-howto/#htoc25Changes I made to the above (to get my set up working) include:ldap ssl = offcommented out valid users under [shares] (I believe users’ filesystem permissions should protect contents.)commented out valid users and force user under [profiles]Verify directories exist for [profiles] and [netlogon]Run testparm to confirm configuration fileRestarted samba to enable updates: service smb restartInstalled and set up smbldap-tools: yum -y install smbldap-toolsUpdate /etc/smbldap-tools/smbldap.confSID - instructions on how to create one is included in fileUncomment sambaDomain and provide your domain nameset masterLDAP/slaveLDAP explicitly to 127.0.0.1ldapTLS="0"update suffixhash_encrypt="SSHA"update userSmbHome with your machine nameupdate userProfile with your machine nameI put in an updated value for mailDomain although I currently don’t own an Internet domainUpdate /etc/smbldap-tools/smbldap_bind.confInsert new entries into LDAP using smbldap-populate: http://download.gna.org/smbldap-tools/docs/samba-ldap-howto/#htoc31I used the same password as the cleartext one I used in step 3.Insert new userinto LDAP:  smbldap-useradd -a -P -A 1 usernamesmbldap-passwd usernameinto server: useradd usernamecreated new user directory in path defined in [profiles] in smb.confchown username userdirchmod 700 userdirInsert new workstationinto LDAP: smbldap-useradd -w workstationnameinto server: useradd -s /bin/false -d /home/nobody workstationname$For Windows XP Pro:Join workstation to domainWhen Windows prompts for a username and password, use “root” and password created in step 10