Public feed
#726848
cat /etc/samba/smb.conf
[global]
workgroup = UOFA
server string = Samba Server
netbios name = MUDMAN
printcap name = /etc/printcap
log file = /var/log/samba/%m.log
max log size = 2500
security = ADS
socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192
local master = no
dns proxy = no
# I believe the BUILTINS in fact does nothing.
# but am too much of a scaredy cat to remove it and risk breaking things
# If it said BUILTIN (no 'S') then it probably would do something
idmap backend = idmap_rid:UOFA=16777216-33554431
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
allow trusted domains = no
template shell = /bin/bash
winbind use default domain = yes
password server = nsx.ad.adelaide.edu.au
realm = AD.ADELAIDE.EDU.AU
restrict anonymous = yes
domain master = no
preferred master = no
ldap ssl = No
acl compatibility = win2k
nt acl support = true
inherit acls = yes
map acl inherit = yes
winbind enum users = No
winbind enum groups = No
winbind nested groups = Yes
ea support = yes
[USERS]
path = /shares
public = no
browseable = yes
guest ok = no
writeable = yes
case sensitive = auto
msdfs proxy = no
force create mode = 0600
force group = Domain Admins
create mask = 0700 # with 0600 and map archive user can't set o+x
directory mask = 0700
directory security mask = 770
security mask = 0770
admin users = bsella_admin mboots_admin bfoggo_admin kaz_admin gings_admin
[COMMON]
path = /projects
public = no
browseable = yes
guest ok = no
writeable = yes
case sensitive = auto
msdfs proxy = no
force create mode = 0600
force group = Domain Admins
create mask = 0700 # with 0600 and map archive user can't set o+x
directory mask = 0700
directory security mask = 0770
security mask = 0770
admin users = bsella_admin mboots_admin bfoggo_admin kaz_admin gings_admin
[a1155344@mudman ~]$ cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required /lib/security/$ISA/pam_env.so
auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
# Only need winbind for samba users - apparently this does nto require the auth service
#auth sufficient /lib/security/$ISA/pam_winbind.so use_first_pass
auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass
auth required /lib/security/$ISA/pam_deny.so
account required /lib/security/$ISA/pam_unix.so broken_shadow
account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
# Only need winbind for samba users apparently smaba does not require the accoutn service
#account [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_winbind.so
account [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_ldap.so
account required /lib/security/$ISA/pam_permit.so
password requisite /lib/security/$ISA/pam_cracklib.so retry=3
password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow
password sufficient /lib/security/$ISA/pam_winbind.so use_authtok
password sufficient /lib/security/$ISA/pam_ldap.so use_authtok
password required /lib/security/$ISA/pam_deny.so
session required /lib/security/$ISA/pam_limits.so
session required /lib/security/$ISA/pam_unix.so
session optional /lib/security/$ISA/pam_ldap.so
cat /etc/sysconfig/authconfig
USECRACKLIB=yes
USEDB=no
USEHESIOD=no
USELDAP=yes
USENIS=no
USEPASSWDQC=no
USEWINBIND=yes
USEKERBEROS=no
USELDAPAUTH=yes
USEMD5=yes
USESHADOW=yes
USESMBAUTH=no
USEWINBINDAUTH=yes
USELOCAUTHORIZE=no
[a1155344@mudman ~]$ cat /etc/nsswitch.conf
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
# nis or yp Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# db Use the local database (.db) files
# compat Use NIS on compat mode
# hesiod Use Hesiod for user lookups
# ldap Use LDAP (only if nss_ldap is installed)
# nisplus or nis+ Use NIS+ (NIS version 3), unsupported
# [NOTFOUND=return] Stop searching if not found so far
#
# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd: db files ldap nis
#shadow: db files ldap nis
#group: db files ldap nis
passwd: files winbind ldap
shadow: files winbind ldap
group: files winbind ldap
#hosts: db files ldap nis dns
hosts: files dns
# Example - obey only what ldap tells us...
#services: ldap [NOTFOUND=return] files
#networks: ldap [NOTFOUND=return] files
#protocols: ldap [NOTFOUND=return] files
#rpc: ldap [NOTFOUND=return] files
#ethers: ldap [NOTFOUND=return] files
bootparams: files
ethers: files
netmasks: files
networks: files
protocols: files winbind
[a1155344@mudman ~]$ cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = AD.ADELAIDE.EDU.AU
dns_lookup_realm = false
dns_lookup_kdc = false
[realms]
AD.ADELAIDE.EDU.AU = {
kdc = nsx.ad.adelaide.edu.au
}
[domain_realm]
.adelaide.edu.au = AD.ADELAIDE.EDU.AU
# adelaide.edu.au = AD.ADELAIDE.EDU.AU
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
[a1155344@mudman ~]$
cat /etc/sysconfig/samba
# Options to smbd
SMBDOPTIONS="-D -d1 "
# Options to nmbd
NMBDOPTIONS="-D"
# Options for winbindd
WINBINDOPTIONS=" -d1 "
[a1155344@mudman ~]$