Client Authentication:Debian

# apt-get install winbind cifs-utils libpam-mount

[global]
workgroup = WORKGROUP		
wins support = no							
wins server = <ip of sme server>

[Debugging/Accounting]
log level = 1
syslog = 0

[Authentication]
security = domain
invalid users = root
unix password sync = no

[Printing]
disable spoolss = yes

[Misc]
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 
winbind use default domain = yes
idmap config * : backend = tdb
idmap config * : range = 10001-20000
idmap config DOMAIN : backend = rid
idmap config DOMAIN : range = 10000-20000
idmap config DOMAIN : base_rid = 0
template shell = /bin/bash
template homedir = /home/%D/%U
winbind enum groups = yes
winbind enum users = yes

testparm

passwd:         files winbind
group:          files winbind
shadow:         compat
hosts:          files dns wins
networks:       files

# 
# This file MUST be edited with the 'visudo' command as root. 
# 
# Please consider adding local content in /etc/sudoers.d/ instead of 
# directly modifying this file. 
# 
# See the man page for details on how to write a sudoers file. 
# 
Defaults        env_reset 
Defaults        mail_badpass 
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin" 

# Host alias specification 

# User alias specification 

# Cmnd alias specification 
Cmnd_Alias UMOUNT=/bin/umount 

# User privilege specification 
root    ALL=(ALL:ALL) ALL 
ALL             ALL=NOPASSWD: UMOUNT 

# Allow members of group sudo to execute any command 
%sudo   ALL=(ALL:ALL) ALL 

# See sudoers(5) for more information on "#include" directives: 

#includedir /etc/sudoers.d 

## allow users with valid unix account or valid winbind account
# success=3 jumps over the next 3 commands
auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_winbind.so  use_first_pass
auth    requisite       pam_deny.so
auth    optional        pam_mount.so    use_first_pass
auth	required		pam_group.so

#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).  The default is pam_unix.
#

session  required     pam_unix.so 
session  optional     pam_mkhomedir.so	silent skel=/etc/skel	umask=0022
session  optional     pam_mount.so

#%PAM-1.0
auth    requisite       pam_nologin.so
auth    required        pam_env.so readenv=1
auth    required        pam_env.so readenv=1 envfile=/etc/default/locale
@include common-auth

@include common-account
session required        pam_limits.so
@include common-session

@include common-password
auth    optional        pam_gnome_keyring.so
session optional        pam_gnome_keyring.so auto_start

<volume sgrp=”nethome-group” fstype="cifs" server="SMESERVER" path="homes" mountpoint="~" options="nosuid,nodev,nounix,file_mode=0640,dir_mode=0700" />

<!-- Volume Definitions --> 
<volume sgrp="<GROUPNAME>" fstype="cifs" server="<SMESERVER>" path="<IBAYNAME>" mountpoint="~/<IBAYNAME>" options="user=%(DOMAIN_USER),setuids,acl" />

wbinfo -g

* ; * ; * ; Al0000-2400 ; floppy, video, audio, cdrom, dip, plugdev, users, scanner

# net rpc join -D WORKGROUP -U admin

Joined domain <WORKGROUP>

# /etc/init.d/winbind restart

Client Authentication:Debian

Contents

Client Configuration

Introduction

Install Debian

Additional Packages

Authentication Modifications

Automount User Home Directories at Login

Automount Ibays at Login

References

Navigation menu

Search

	Warning:
	This is based upon limited testing and a small number of users. YMMV

	Tip:
	When prompted for a user name to log in with, give a non-SME user such as 'localuser', as this first user effectively becomes a local user with root access. Make sure you set the 'Name of this Computer' to something less than 15 characters.

	Note:
	You need root privileges to make the changes – use the root terminal.

	Warning:
	Altering the pam system authentication files can seriously effect your ability to login in to the system. Take a backup of the /etc/pam.d directory and /etc/nsswitch.conf. Have a live CD available to give access and re-apply the backup files if you make a mistake and/or get locked out

	Note:
	The names “nethome” and “nethome-group” can, of course be anything you like, these are just my example for the purpose of this HowTo. They are, however, a sensible choice as we are going to use a mount point called “nethome” but again this mount point name can be anything you want.

	Note:
	The sgrp param is optional. If used, ibay will be mounted only if %(DOMAIN_USER) is a member of ibay's owner group