Difference between revisions of "Talk:Client Authentication:Ubuntu"

auth-client-config
winbind
libpam-mount
cifs-utils

sudo apt-get install auth-client-config winbind libpam-mount cifs-utils

sudo su

workgroup = <WORKGROUP>
wins server = <ip of sme server>
name resolve order = wins host lmhosts bcast
security = domain
socket options = TCP_NODELAY
idmap config * : backend = tdb
idmap config * : range = 10001-20000
idmap config DOMAIN : backend = rid
idmap config DOMAIN : range = 10000-20000
idmap config DOMAIN : base_rid = 0
template shell = /bin/bash
template homedir = /home/%D/%U
winbind enum users = yes
winbind enum groups = yes
winbind cache time = 10
winbind use default domain = yes

testparm

net rpc join -D <WORKGROUP> -U admin

Joined domain <WORKGROUP>

wbinfo -u
wbinfo -g
smbtree

hosts: files dns wins

cd /etc/auth-client-config/profile.d

[sme]
nss_group=group:        compat winbind
nss_netgroup=netgroup:  nis
nss_passwd=passwd:      compat winbind
nss_shadow=shadow:      compat
pam_account=account  [success=2 new_authtok_reqd=done default=ignore]  pam_winbind.so
            account  [success=1 default=ignore]                        pam_unix.so	use_first_pass	use_authtok
            account  requisite                                         pam_deny.so
            account  required                                          pam_permit.so
pam_auth=auth	[success=2 default=ignore]  pam_winbind.so	
         auth	[success=1 default=ignore]  pam_unix.so       nullok_secure  use_first_pass  use_authtok
         auth	requisite	            pam_deny.so
         auth	required		    pam_permit.so
         auth	required		    pam_securetty.so
         auth	optional		    pam_mount.so      enable_pam_password
pam_password=password	[success=2 default=ignore]  pam_unix.so     obscure sha512
             password	[success=1 default=ignore]  pam_winbind.so  use_first_pass  md5  use_authtok
             password	requisite		    pam_deny.so
             password	required		    pam_permit.so
             password	optional	            pam_gnome_keyring.so
pam_session=session  [default=1]  pam_permit.so
            session  requisite    pam_deny.so
            session  required     pam_permit.so
            session  optional     pam_winbind.so
            session  required     pam_unix.so 
            session  required     pam_mkhomedir.so	skel=/etc/skel	umask=0022
            session  optional     pam_mount.so	        enable_pam_password
            session  optional     pam_ck_connector.so  nox11

auth-client-config -a -p sme

greeter-show-manual-login = true

<!-- Volume Definitions --> 
<volume sgrp="nethome-group" fstype="cifs" server="<SMESERVER>" path="homes" mountpoint="~/nethome" options="nosuid,nodev" />

<!-- Volume Definitions --> 
<volume sgrp="<GROUPNAME>" fstype="cifs" server="<SMESERVER>" path="<IBAYNAME>" mountpoint="~/<IBAYNAME>" options="user=%(DOMAIN_USER),setuids,acl" />

wbinfo -g

su visudo

user ALL=(ALL) ALL

greeter-hide-users=true

Exec=gksudo synaptic

@@ Line 227: / Line 227: @@
   greeter-show-manual-login = true
 ===Automount User Home Directories at Login===
-  cd /etc/security
+*Create a new group in SME Server with a Group Name of  “nethome” and a Description of “nethome-group”. Add all SME Server users to this group, or at least all SME Server users who will be using the SME Server to authenticate an Ubuntu client workstation.
+{{Note box| The names “nethome” and “nethome-group” can, of course be anything you like, these are just my example for the purpose of this HowTo. They are, however, a sensible choice as we are going to use a mount point called “nethome” but again this mount point name can be anything you want.}}
-*Open and edit pam_mount.conf.xml file. Find the 'Volume Definitions' section. Add a volume line below the header
+*Open and edit /etc/security/pam_mount.conf.xml file. Find the 'Volume Definitions' section. Add a volume line below the header
   <nowiki><!-- Volume Definitions --> </nowiki>
-  <volume fstype="cifs" server="<SMESERVER>" path="homes" mountpoint="~/nethome" options="nosuid,nodev" />
+  <volume sgrp="nethome-group" fstype="cifs" server="<SMESERVER>" path="homes" mountpoint="~/nethome" options="nosuid,nodev" />
 *Replace <SMESERVER> above with the samba name of your SME Server. This will mount the users 'home' directory from SME Server into a directory called 'nethome' in their local home directory.

Difference between revisions of "Talk:Client Authentication:Ubuntu"

Revision as of 10:42, 1 April 2013

Contents

Authors

Ubuntu 12.04 LTS Authentication

Introduction

Install Ubuntu

Additional Packages

Samba Modifications

Authentication Modifications

Modify Login Screen

Automount User Home Directories at Login

Automount Ibays at Login

Login and Test

Options

Give SME Server Users Local Admin Rights

Login screen security

Synaptic

Issues / ToDo

Error Messages

Navigation menu

Page actions

Page actions

Personal tools

Koozali SME Server

Recent activities

Koozali resources

Koozali SME Server wiki

Tools

Search

	Work in Progress:
	relayer has marked this page as a Work in Progress. The contents off this page may be in flux, please have a look at this page history the to see list of changes.

	Tip:
	When prompted for a user name to log in with, give a non-SME Server user such as 'localuser', as this first user effectively becomes a local user with sudo root access. Make sure you set the 'Name of this Computer' to something less than 15 characters.

	Warning:
	Altering the pam system authentication files can seriously effect your ability to login in to the system. Take a backup of the /etc/pam.d directory and /etc/nsswitch.conf. Have a live CD available to give access and re-apply the backup files if you make a mistake and/or get locked out

	Note:
	The names “nethome” and “nethome-group” can, of course be anything you like, these are just my example for the purpose of this HowTo. They are, however, a sensible choice as we are going to use a mount point called “nethome” but again this mount point name can be anything you want.

	Note:
	The sgrp param is optional. If used, ibay will be mounted only if %(DOMAIN_USER) is a member of ibay's owner group

	Note:
	When using sudo su from the terminal you will be asked to “reenter password for pam_mount." Just hit return, no password is required.