redhat as 3.0 and windows 2003 ldap

xn85turbo · 12-04-2004, 07:31 PM

I want to login to linux using windows 2003 ads ldap accounts.

I do not want to use samba and winbind because I do not want to have to login as domain_user@ip.

Can someone show me a how-to that works because I have palyed with openldap and sfu 3.5 without success.

hob · 12-05-2004, 04:46 AM

You don't have to use the format username@domain to login to Active Directory.

Windows also accepts the format DOMAIN\username, and you can set Winbind to automatically add the "DOMAIN\" part so that users don't have to know about it. This just requires you to add this line to smb.conf:

winbind use default domain = yes

Winbind works very, very well in practice (we have 4,000 accounts, which isn't a large deployment for this kind of technology). Any other method is likely to be a lot more work for little gain, as I guess you've found...

xn85turbo · 12-05-2004, 07:48 AM

I have done the winbind thing before, actually wrote a how-to aboput it for www.linux-noob.com
Ithink whta worried me was the fact that I was worried about Password sync from Windows ADS to Linux with winbind. As if I remember correctly winbind goes out and pulls the info when you configure it and stores it all in passwd, etc... Bascially I just need to use ads accounts for login so my sftp users can be managed from Windows 2003 ADS. Also I will be converting ADS to native mode (non pre-windows 2000 computers) will this have an effect too correct?

hob · 12-05-2004, 03:17 PM

Winbind doesn't store the passwords locally, maybe you are thinking of SFU or something else ? It does have database to map AD usernames to local UIDs for file permissions, but it doesn't store anything else. The actual authentication process with Winbind uses the Kerberos protocol to check username/password combinations against the AD server, which responds with a yes or no.

There isn't much difference between mixed and native mode. With mixed mode certain options like nested groups aren't allowed because NT 4.0 and below can't cope with them. We run Samba 3 on a native mode domain.

I used SSH to test my Winbind set up, and it was just a case of following the instructions in the Samba docs.