47
edits
Changes
Jump to navigation
Jump to search
Line 1:
Line 1: − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Line 54:
Line 219: − + + + + Line 133:
Line 301: − +
Ubuntu 12.04 LTS added
{{Warning box| This is based upon limited testing and a small number of users via a VirtualBox virtual machine installation of Ubuntu 9.10, and subsequently a VMWare virtual machine installation with Ubuntu 10.04 LTS. YMMV}}
==Authors==
Original howto by [http://www.tmnash.co.uk/ Nash Consultancy]
Revised by [http://www.david-harper.com/ David Harper]
Latest revision by the Wiki amd Docs Team
==Ubuntu 12.04 LTS Authentication==
===Introduction===
The following details the setup of Ubuntu 12.04 LTS (Precise Pangolin) as a desktop to authenticate users against SME Server 8.0 using Samba and Winbind. It assumes login is via Ubuntu's standard GDM login screen.
Ubuntu 12.04 is a long term service release, and will be supported on the desktop until April 2017.
===Install Ubuntu===
*Download the Ubuntu .iso and install.
{{Tip box| When prompted for a user name to log in with, give a non-SME Server user such as 'localuser', as this first user effectively becomes a local user with sudo root access.
Make sure you set the 'Name of this Computer' to something less than 15 characters.}}
*Complete install, login and apply all updates.
===Additional Packages===
Use the 'Software Manager' to install additional packages
auth-client-config
winbind
libpam-mount
cifs-utils
Optionally, you can use the command line:
sudo apt-get install auth-client-config winbind libpam-mount cifs-utils
===Samba Modifications===
*Open an 'Applications - Accessories - Terminal' cli and change to root privileges
sudo su
*Open and edit /etc/samba/smb.conf. Find the relevant lines and alter them or uncomment them as below. Some lines may not exist and may need to be added.
:Replace <WORKGROUP> below with the 'Windows workgroup' name of your SME Server. Replace <ip of sme server> below with the internal network ip address of your SME Server.
workgroup = <WORKGROUP>
wins server = <ip of sme server>
name resolve order = wins host lmhosts bcast
security = domain
socket options = TCP_NODELAY
idmap config * : backend = tdb
idmap config * : range = 10001-20000
idmap config DOMAIN : backend = rid
idmap config DOMAIN : range = 10000-20000
idmap config DOMAIN : base_rid = 0
template shell = /bin/bash
template homedir = /home/%D/%U
winbind enum users = yes
winbind enum groups = yes
winbind cache time = 10
winbind use default domain = yes
*To check validation of smb.conf, run
testparm
*If all OK, then run
net rpc join -D <WORKGROUP> -U admin
:Enter the admin password for the SME Server when prompted and you should get a message,
Joined domain <WORKGROUP>
*Restart the machine to apply the changes.
* Login as the local user, open a Terminal cli and 'sudo su' again
*The following commands should now list users, groups and available shares respectively from the SME Server
wbinfo -u
wbinfo -g
smbtree
===Authentication Modifications===
{{Warning box| Altering the pam system authentication files can seriously effect your ability to login in to the system. Take a backup of the /etc/pam.d directory and /etc/nsswitch.conf. Have a live CD available to give access and re-apply the backup files if you make a mistake and/or get locked out}}
*Open and edit /etc/nsswitch.conf and find the hosts: line. Change it to
hosts: files dns wins
*Change to the auth-client-config tool profile directory
cd /etc/auth-client-config/profile.d
*Create a new file called acc-sme, and enter
[sme]
nss_group=group: compat winbind
nss_netgroup=netgroup: nis
nss_passwd=passwd: compat winbind
nss_shadow=shadow: compat
pam_account=account [success=2 new_authtok_reqd=done default=ignore] pam_winbind.so
account [success=1 default=ignore] pam_unix.so use_first_pass use_authtok
account requisite pam_deny.so
account required pam_permit.so
pam_auth=auth [success=2 default=ignore] pam_winbind.so
auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass use_authtok
auth requisite pam_deny.so
auth required pam_permit.so
auth required pam_securetty.so
auth optional pam_mount.so enable_pam_password
pam_password=password [success=2 default=ignore] pam_unix.so obscure sha512
password [success=1 default=ignore] pam_winbind.so use_first_pass md5 use_authtok
password requisite pam_deny.so
password required pam_permit.so
password optional pam_gnome_keyring.so
pam_session=session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session optional pam_winbind.so
session required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel umask=0022
session optional pam_mount.so enable_pam_password
session optional pam_ck_connector.so nox11
*Save the file. Apply the pam authorisation changes
auth-client-config -a -p sme
===Modify Login Screen===
The default login screen for Ubuntu 12.04 LTS does not give the option to select “Other” users. This is required if we are to authenticate against SME Server users. To enable this option edit /etc/lightdm/lightdm.conf and add the following line
greeter-show-manual-login = true
===Automount User Home Directories at Login===
*Create a new group in SME Server with a Group Name of “nethome” and a Description of “nethome-group”. Add all SME Server users to this group, or at least all SME Server users who will be using the SME Server to authenticate an Ubuntu client workstation.
{{Note box| The names “nethome” and “nethome-group” can, of course be anything you like, these are just my example for the purpose of this HowTo. They are, however, a sensible choice as we are going to use a mount point called “nethome” but again this mount point name can be anything you want.}}
*Open and edit /etc/security/pam_mount.conf.xml file. Find the 'Volume Definitions' section. Add a volume line below the header
<nowiki><!-- Volume Definitions --> </nowiki>
<volume sgrp="nethome-group" fstype="cifs" server="<SMESERVER>" path="homes" mountpoint="~/nethome" options="nosuid,nodev" />
*Replace <SMESERVER> above with the samba name of your SME Server. This will mount the users 'home' directory from SME Server into a directory called 'nethome' in their local home directory.
=== Automount Ibays at Login===
*Edit /etc/security/pam_mount.conf.xml and add a line below the header
<nowiki><!-- Volume Definitions --> </nowiki>
<volume sgrp="<GROUPNAME>" fstype="cifs" server="<SMESERVER>" path="<IBAYNAME>" mountpoint="~/<IBAYNAME>" options="user=%(DOMAIN_USER),setuids,acl" />
*Replace <SMESERVER> with the samba name of your SME server, <IBAYNAME> with the ibay name, <GROUPNAME> with the '''[[description]]''' of the ibay owner group. The description can be recovered with
wbinfo -g
{{Note box| The sgrp param is optional. If used, ibay will be mounted only if %(DOMAIN_USER) is a member of ibay's owner group}}
===Login and Test===
*Exit the Terminal cli
*Reboot the machine.
*Login as a valid SME Server user on your system, just giving username and password. No need for DOMAIN\user as samba configured above to use the default Windows Workgroup
*Authentication against SME Server should proceed and the user log in. A home directory on the local machine should be created as /home/DOMAIN/user, and a sub directory to that called 'nethome' mounted to the users home directory on the SME Server.
==Options==
===Give SME Server Users Local Admin Rights===
{{Note box| Always use visudo to edit the sudoers file}}
su visudo
*Edit the sudoers file and add the following line immediately below "root ALL=(ALL:ALL) ALL"
user ALL=(ALL) ALL
Where "user" is a username from SME Server
===Login screen security===
The list of available users shown at the login screen is cleared after each reboot. Once you have confirmed that everything is working you can, however, optionally configure the graphical login screen to hide the names of both local users and SME Server users who have recently logged in. This won't stop any serious attempt to break into a machine but is roughly equivalent to similar options available with the Windows XP login screen. Edit /etc/lightdm/lightdm.conf and add the following line
greeter-hide-users=true
===Synaptic===
*If Synaptic is installed and does not load from the menu try the following workaround.
*Edit /usr/share/applications/synaptic.desktop. Change the line Exec=synaptic-pkexec to the following:
Exec=gksudo synaptic
{{Note box| This is NOT caused by this HowTo but is a bug in Synaptic. I have included this workaround to help those users who still like to use Synaptic.}}
==Ubuntu 10.04 Authentication==
==Ubuntu 10.04 Authentication==
{{Warning box| This is based upon limited testing and a small number of users via a VirtualBox virtual machine installation of Ubuntu 9.10, and subsequently a VMWare virtual machine installation with Ubuntu 10.04 LTS. YMMV}}
===Introduction===
===Introduction===
Joined domain <WORKGROUP>
Joined domain <WORKGROUP>
{{Note box| Now restart the machine, login, open a Terminal cli and 'sudo su' again. You could miss out this restart step and carry on with the modifications below, but the following commands and the full join to SME didn't seem to work until the machine had been restarted and reconnected to the server.
*Restart the machine to apply the changes.
{{Note box| You could miss out this restart step and carry on with the modifications below, but the following commands and the full join to SME didn't seem to work until the machine had been restarted and reconnected to the server.
This may be a timing/delay issue similar to the volume mount (see below) due to NAT traversal. The restart may be unnecessary - can anyone confirm??}}
This may be a timing/delay issue similar to the volume mount (see below) due to NAT traversal. The restart may be unnecessary - can anyone confirm??}}
* Login as the local user, open a Terminal cli and 'sudo su' again
*The following commands should now list users, groups and available shares respectively from the SME server
*The following commands should now list users, groups and available shares respectively from the SME server
wbinfo -u
wbinfo -u
*Reboot the machine.
*Reboot the machine.
*Login as a valid SME server user on your system, just giving username and password. No need for DOMAIN\user as samba configured above to use the default Windows Workgroup
*Login as a valid SME server user on your system, just giving username and password. No need for DOMAIN\user as samba configured above to use the default Windows Workgroup
*Authentication against SME should proceed and the user log in. A home directory on the local machine should be created as /home/DOMAIN/user, and a sub directory to that called 'nethome' mounted to the users home directory on the SME server. The mount point should also appear on the users gui desktop.
*Authentication against SME should proceed and the user log in. A home directory on the local machine should be created as /home/DOMAIN/user, and a sub directory to that called 'nethome' mounted to the users home directory on the SME server. The mount point should also appear on the desktop.
===Login screen security===
===Login screen security===