linux в домене win

Керберос настроен? И конфиги в студию.

+1 smb.conf и krb5.conf в студию

В Вашем применении ldap.conf сбоку припёку. Покажите smb.conf krb5.conf или смотрите логи при старте samba. Что-то не так. wbinfo -u /-g должно работать.

Насчёт остального, я правлю /etc/nsswitch и использую pam_winbind.

smb.conf [global] workgroup = DATA server string = linux local master = no log file = /var/log/samba/log.%m max log size = 50 realm = DATA.RAZIONAL.RU security = ads password server = 192.168.254.50 encrypt passwords = yes winbind separator = + winbind use default domain = true winbind uid = 10000-20000 winbind gid = 10000-20000

socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 dns proxy = no use sendfile = yes

idmap uid = 500-33554431 idmap gid = 500-33554431 template shell = /bin/false ------------

[global] workgroup = DATA server string = linux

local master = no

log file = /var/log/samba/log.%m

max log size = 50

realm = DATA.RAZIONAL.RU

security = ads

password server = 192.168.254.50

encrypt passwords = yes

winbind separator = +

winbind use default domain = true

winbind uid = 10000-20000

winbind gid = 10000-20000

socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

dns proxy = no

use sendfile = yes

idmap uid = 500-33554431

idmap gid = 500-33554431

template shell = /bin/false

[root@client ~]# cat /etc/krb5.conf

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

default_realm = DATA.RAZIONAL.RU

dns_lookup_realm = false

dns_lookup_kdc = false

ticket_lifetime = 24h

forwardable = yes

[realms]

DATA.RAZIONAL.RU = {

kdc = kerberos.example.com:88

admin_server = 192.168.254.50:749

default_domain = data.razional.ru

}

DATA = {

kdc = 192.168.254.50

}

DATA.RAZIONAL.RU = {

kdc = 192.168.254.50

}

[domain_realm]

.data.razional.ru = DATA.RAZIONAL.RU

data.razional.ru = DATA.RAZIONAL.RU

#[kdc]
# profile = /usr/kerberos/share/examples/krb5/kdc.conf


[appdefaults]

pam = {

debug = false

ticket_lifetime = 36000

renew_lifetime = 36000

forwardable = true

krb4_convert = false

==============

насчет [kdc] кстати мне непонятно - и вообще krb как демон работает или как либа ??

nsswitch.conf правил?

ldap.conf тут не при делах вообще.

id <ad login> работает?

net ads join делал?

[root@client ~]# net ads join -S 192.168.254.50 -U admin

admin's password:

winscard_clnt.c:320:SCardEstablishContextTH() Cannot open public shared file: /var/run/pcscd.pub

winscard_clnt.c:320:SCardEstablishContextTH() Cannot open public shared file: /var/run/pcscd.pub

Using short domain name -- DATA

Failed to set servicePrincipalNames. Please ensure that the DNS domain of this server matches the AD domain, Or rejoin with using Domain Admin credentials.

winscard_clnt.c:320:SCardEstablishContextTH() Cannot open public shared file: /var/run/pcscd.pub

Deleted account for 'CLIENT' in realm 'DATA.RAZIONAL.RU'

Failed to join domain: Type or value exists

------------

но из Гнома комп в АД заводится "-Система--Аутентификация --Winbind --Войти в домен "

-----nsswitch.conf

passwd: files ldap winbind

shadow: files ldap winbind

group: files ldap winbind

hosts: files dns

bootparams: nisplus [NOTFOUND=return] files

ethers: files

netmasks: files

networks: files

protocols: files ldap

rpc: files

services: files ldap

netgroup: files ldap

publickey: nisplus

automount: files ldap

aliases: files ldap nisplus