Active directory, Samba, Acls

Mise en place NTP:
apt-get install ntpdate
Puis ajout controleur de domaine à /etc/default/ntpdate

Mise en pace kerberos:
apt-get install libpam-krb5 krb5-user

#################################################
#/etc/krb5.conf
#################################################
[logging]
 default = FILE:/var/log/krb5.log
[libdefaults]
 ticket_lifetime = 1d
 kdc_timesync = 1
 ccache_type = 4
 forwardable = true
 proxiable = true
 default_realm = AD.CHEZTOI.FR
 clockskew = 300
[realms]
 AD.CHEZTOI.FR = {
 kdc = @ ip controleur 1
 kdc = @ ip controleur 2, etc...
 admin_server = @ ip d'un des controleur
 default_domain = AD.CHEZTOI.FR
 }
[domain_realm]
 .ad.cheztoi.fr = AD.CHEZTOI.FR
 ad.cheztoi.fr = AD.CHEZTOI.FR
 ad = AD.CHEZTOI.FR

Test de kerberos: kinit ADMIN-??@AD.CHEZTOI.FR => N'affiche rien si conf ok

Mise en place de samba
apt-get install samba winbind

#/etc/samba/smb.conf
[global]
########### 
# DOMAINE #
###########
 workgroup = AD
 realm = AD.CHEZTOI.FR
 netbios name = linux-ad
 security = ads
 client use spnego = yes
 domain master = no
 local master = no
 preferred master = no
 os level = 0
 wins support = no
 wins server = ip controlleur si wins
###########
# WINBIND #
###########
 idmap backend = idmap_rid:AD=1010-100000000
 idmap uid = 1010-100000000
 idmap gid = 1010-100000000
 template shell = /bin/bash
# winbind separator = +
 winbind use default domain = yes
 winbind enum users = no
 winbind enum groups = no
 winbind nested groups = yes
 map untrusted to domain = no
 winbind refresh tickets = yes
 template homedir = /home/user
###########
# OPTIONS #
###########
 socket options = TCP_NODELAY SO_KEEPALIVE SO_SNDBUF=8192 SO_RCVBUF=8192
 inherit acls = Yes
 dns proxy = no
 wide links = yes
 unix extensions = no
 create mask = 0700
 directory mask = 0700
 inherit acls = yes
 hide unreadable = yes
 hide files = /desktop.ini/
 hide dot files = yes
 dos charset = 850
 unix charset = UTF-8
 bind interfaces only = yes

Intégration:
net ads join -U admin-cb -S controleurdedomaine

Mise en place resolution users/groups:
#################################################
# /etc/nsswitch.conf
#################################################

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd: compat winbind
group: compat winbind
shadow: compat winbind
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis

Voilà ou j'en suis sur mon wiki :) Bien sur il te faut activer les acls sur ton fs...

La partie importante niveau smb.conf est:

 idmap backend = idmap_rid:AD=1010-100000000
 idmap uid = 1010-100000000
 idmap gid = 1010-100000000

qui te permet d'etre sur d'avoir une association SID <-> UID valide dans le temps meme si tu crashes son serveur.