opsi-server_authentication_over_windows_ad_based_on_ldap
Differences
This shows you the differences between two versions of the page.
|
opsi-server_authentication_over_windows_ad_based_on_ldap [2015/05/22 10:42] koepkek created |
opsi-server_authentication_over_windows_ad_based_on_ldap [2021/08/23 08:37] |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | 1 ==== OPSI Server authentication over Windows AD based on LDAP ==== | ||
| - | |||
| - | === Purpose: === | ||
| - | |||
| - | You can use your Windows user and password to authenticate against the following services: | ||
| - | |||
| - | * SSH | ||
| - | * SAMBA | ||
| - | * OPSI ConfigEditor | ||
| - | |||
| - | |||
| - | === Configuration steps: === | ||
| - | |||
| - | This procedure is tested with Debian 6.0.10 and OPSI 4.0.5 | ||
| - | |||
| - | |||
| - | * Before you can use the login to the OPSI host with your Windows user and password, you have to create a local *NIX user account (no password necessary). Use as *NIX username the Windows sAMAccountName. | ||
| - | | ||
| - | |||
| - | * Install additional package: | ||
| - | * '' | ||
| - | |||
| - | * Here is the relevant configuration part for pam_ldap.conf: | ||
| - | * Windows AD Domain Controller: dc1.mywin.domain | ||
| - | * AD user account: OpsiAdRead | ||
| - | * AD user pass: secretpw | ||
| - | |||
| - | |||
| - | / | ||
| - | < | ||
| - | # | ||
| - | |||
| - | # The distinguished name of the search base. | ||
| - | base dc=mywin, | ||
| - | |||
| - | # Another way to specify your LDAP server is to provide an | ||
| - | uri ldap:// | ||
| - | |||
| - | # The LDAP version to use (defaults to 3 | ||
| - | # if supported by client library) | ||
| - | ldap_version 3 | ||
| - | |||
| - | # The distinguished name to bind to the server with. | ||
| - | # Optional: default is to bind anonymously. | ||
| - | binddn cn=OpsiAdRead, | ||
| - | |||
| - | # The credentials to bind with. | ||
| - | # Optional: default is no credential. | ||
| - | bindpw secretpw | ||
| - | |||
| - | # The search scope. | ||
| - | scope sub | ||
| - | |||
| - | # Search timelimit | ||
| - | timelimit 5 | ||
| - | |||
| - | # Bind/ | ||
| - | bind_timelimit 5 | ||
| - | |||
| - | # Reconnect policy: hard (default) will retry connecting to | ||
| - | # the software with exponential backoff, soft will fail | ||
| - | # immediately. | ||
| - | bind_policy soft | ||
| - | |||
| - | # The user ID attribute (defaults to uid) | ||
| - | pam_login_attribute sAMAccountName | ||
| - | |||
| - | # Hash password locally; required for University of | ||
| - | # Michigan LDAP server, and works with Netscape | ||
| - | # Directory Server if you're using the UNIX-Crypt | ||
| - | # hash mechanism and not using the NT Synchronization | ||
| - | # service. | ||
| - | pam_password crypt | ||
| - | |||
| - | # Update Active Directory password, by | ||
| - | # creating Unicode password and updating | ||
| - | # unicodePwd attribute. | ||
| - | pam_password ad | ||
| - | |||
| - | # RFC 2307 (AD) mappings | ||
| - | nss_map_objectclass posixAccount user | ||
| - | nss_map_objectclass shadowAccount user | ||
| - | nss_map_attribute uid sAMAccountName | ||
| - | nss_map_attribute homeDirectory unixHomeDirectory | ||
| - | nss_map_attribute shadowLastChange pwdLastSet | ||
| - | nss_map_objectclass posixGroup group | ||
| - | nss_map_attribute uniqueMember member | ||
| - | pam_login_attribute sAMAccountName | ||
| - | pam_filter objectclass=User | ||
| - | pam_password ad | ||
| - | </ | ||
| - | |||
| - | * Here is the relevant configuration changes for the smb.conf: | ||
| - | * For the “password server” option you can use more as one server, if one server not reachable the next one is used. Use as server name the Netbios name and not the FQDN or the IP address. If one of the servers rejects the password the connection failed, Samba does not ask the next server. | ||
| - | |||
| - | / | ||
| - | < | ||
| - | [global] | ||
| - | |||
| - | ## Browsing/ | ||
| - | |||
| - | # Change this to the workgroup/ | ||
| - | workgroup = MYWIN | ||
| - | |||
| - | ####### Authentication ####### | ||
| - | |||
| - | # " | ||
| - | # in this server for every user accessing the server. See | ||
| - | # / | ||
| - | # in the samba-doc package for details. | ||
| - | | ||
| - | |||
| - | # You may wish to use password encryption. | ||
| - | # ' | ||
| - | | ||
| - | |||
| - | # If you are using encrypted passwords, Samba will need to know what | ||
| - | # password database type you are using. | ||
| - | # | ||
| - | | ||
| - | |||
| - | obey pam restrictions = yes | ||
| - | # | ||
| - | </ | ||
| - | |||
| - | Join the OPSI host to the Windows AD domain | ||
| - | |||
| - | DC1 = Netbios name of the windows domain controller dc1.mywin.domain | ||
| - | Administrator = Domain admin account | ||
| - | |||
| - | net rpc join -S DC1 -U Administrator | ||
| - | |||
| - | Create a domain user account < | ||
| - | |||
| - | Use for the domain user < | ||
| - | |||
| - | passwd pcpatch | ||
| - | smbpasswd –U pcpatch | ||
| - | |||
| - | opsi-admin -d task setPcpatchPassword < | ||
| - | |||
| - | Create a global host parameter with the ConfigEd. | ||
| - | |||
| - | clientconfig.depot.user : MYWIN\pcpatch | ||
| - | |||
| - | * | ||
| - | http:// | ||
opsi-server_authentication_over_windows_ad_based_on_ldap.txt · Last modified: 2021/08/23 08:37 (external edit)
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
