syntaxerrormmm
/
ld10-samba
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Bettering the presentation. Added cons slide. Updated .info file needed.

This commit is contained in:
Emiliano Vavassori 2010-09-13 23:55:14 +02:00
parent a86513b1d8
commit a8db25c94e
2 changed files with 153 additions and 119 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
ld10-samba.pdf
View File

Binary file not shown.

272
ld10-samba.tex
View File

@ -11,24 +11,18 @@
\setmonofont[Mapping=tex-text,Scale=.9]{Consolas} \setmonofont[Mapping=tex-text,Scale=.9]{Consolas}
%\setmonofont[Mapping=tex-text,Scale=.9]{Prestige Elite Std} %\setmonofont[Mapping=tex-text,Scale=.9]{Prestige Elite Std}
% Definisco box per ``?''
\newsavebox{\qbox}
\savebox{\qbox}{{\fontspec{Hillock (BRK)}\fontsize{24}{24}\selectfont ?}}
\newlength{\myqboxlen}
\settowidth{\myqboxlen}{\usebox{\qbox}}
\newenvironment{question}[1]{\parbox{\myqboxlen}{\color{red!75!black}\usebox{\qbox}}\hfill\begin{minipage}{.92\textwidth}\alert{\bfseries #1}\\}{\end{minipage}}
% Definisco shell % Definisco shell
\setbeamercolor{shell snippet}{fg=lightgray,bg=black} \setbeamercolor{shell snippet}{fg=lightgray,bg=black}
\newenvironment{shell}{\begin{beamercolorbox}[sep=.5em]{shell snippet}\ttfamily {\color{blue}\$}}{\end{beamercolorbox}} \newenvironment{shell}{\par\vspace*{.7em}\begin{beamercolorbox}[sep=.5em]{shell snippet}\ttfamily {\color{blue}\$}}{\end{beamercolorbox}}
\newenvironment{rootshell}{\begin{beamercolorbox}[sep=.5em]{shell snippet}\ttfamily {\color{red}\#}}{\end{beamercolorbox}} \newenvironment{shell*}{\par\vspace*{.7em}\begin{beamercolorbox}[sep=.5em]{shell snippet}\ttfamily {\color{red}\#}}{\end{beamercolorbox}}
\newcommand{\urlify}[1]{{\color{blue}\url{#1}}}
% Definisco filesnippet % Definisco snippet
\newenvironment{filesnippet}[1]{\begin{block}{Snippet: \texttt{#1}}\ttfamily}{\end{block}} \newenvironment{snippet}[1]{\begin{block}{Estratto: \texttt{#1}}\ttfamily}{\end{block}}
% Definisco un po' di modifiche sulla bibliografia % Definisco un po' di modifiche sulla bibliografia
\setbeamertemplate{bibliography item}[triangle] \setbeamertemplate{bibliography item}[triangle]
\setbeamercolor*{bibliography entry author}{fg=black} %\setbeamercolor*{bibliography entry author}{fg=black}
% Un po' di altri settaggi % Un po' di altri settaggi
\beamerdefaultoverlayspecification{<+->} \beamerdefaultoverlayspecification{<+->}
@ -88,9 +82,9 @@
\end{itemize} \end{itemize}
\bigskip \bigskip
\begin{block}{Un piccolo dubbio mi assale\ldots \textbf{Esaustivo}?} \begin{block}{Un piccolo dubbio mi assale\ldots\ \textbf{Esaustivo}?}
Con \textit{Active Directory} è impossibile pensare di essere esaustivi. Non si può fare un \textit{lightning talk} su \textit{Active Directory} in
Ci vorrebbe una giornata intera. senso stretto. Ci vorrebbe una giornata intera.
\end{block} \end{block}
\end{frame} \end{frame}
@ -103,59 +97,58 @@
\end{block} \end{block}
\bigskip \bigskip
\onslide+<2-> \visible<2>{%
\begin{question}{Integrato con \emph{Active Directory}:} \begin{block}{Integrato con \emph{Active Directory}}
Gli utenti saranno in grado di accedere ai documenti condivisi senza Gli utenti saranno in grado di accedere ai documenti condivisi senza
ulteriori autenticazioni da macchine di dominio con utenze di dominio. ulteriori autenticazioni da macchine di dominio con utenze di dominio.
\end{question} \end{block}}
\end{frame} \end{frame}
\begin{frame} \begin{frame}
\frametitle{Requisiti} \frametitle{0.0 --- Struttura della rete}
\begin{block}{}
\begin{itemize}[<+->]
\item Un \emph{domain controller} Microsoft Windows
\item Un fileserver GNU/Linux (Debian 5.0 «Lenny»)
\item Avere sufficienti conoscenze di \textit{Active Directory}
\item Non avere paura di «sporcarsi le mani»
\end{itemize}
\end{block}
\end{frame}
\begin{frame}
\frametitle{0.0 --- Verifica parametri di rete}
\begin{block}{Parametri di rete} \begin{block}{Domain Controller --- \itshape Windows 2003 Server}\ttfamily
\begin{itemize}[<1>] 10.0.0.1\hspace*{4ex}testdc.domain.local
\item Domain Controller: testdc.domain.local, 10.0.0.1 \end{block}
\item File Server: linuxfs.domain.local, 10.0.0.100
\end{itemize} \bigskip
\begin{block}<1->{File Server --- \itshape Debian 5.0 «Lenny»}\ttfamily
10.0.0.100\hspace*{2ex}linuxfs.domain.local
\end{block} \end{block}
\end{frame} \end{frame}
\begin{frame} \begin{frame}
\frametitle{0.1 --- Verifica parametri di rete} \frametitle{0.1 --- Indirizzi del fileserver}
\onslide<1->% Prima di partire, conviene verificare l'indirizzo di rete:
Verificare il FQDN:\\[-.5em] \begin{shell*}
\begin{filesnippet}{/etc/hosts} ip address show eth0
10.0.0.100 linuxfs.domain.local linuxfs \textbackslash\\ \end{shell*}
\hspace*{2ex}localhost.localdomain localhost
\end{filesnippet}
\onslide<2->% \bigskip
Verificare DNS primario e dominio:\\[-.5em] \onslide<2->%
\begin{filesnippet}{/etc/resolv.conf} Verificare il \textit{Fully Qualified Domain Name} (FQDN):\\
\begin{snippet}{/etc/hosts}
10.0.0.100 linuxfs.domain.local linuxfs \textbackslash\\
\hspace*{2ex}localhost.localdomain localhost
\end{snippet}
\end{frame}
\begin{frame}
\frametitle{0.2 --- Indirizzi del domain controller}
Verificare DNS primario e dominio:
\begin{snippet}{/etc/resolv.conf}
nameserver 10.0.0.1\\ nameserver 10.0.0.1\\
search domain.local\\ search domain.local\\
domain domain.local domain domain.local
\end{filesnippet} \end{snippet}
\onslide<3->% \bigskip
Verificare comunicazione e risoluzione nomi:\\[.3em] \onslide<2->%
Verificare comunicazione e risoluzione nomi:
\begin{shell} \begin{shell}
ping 10.0.0.1 ping 10.0.0.1
\end{shell} \end{shell}
@ -169,43 +162,52 @@
\end{frame} \end{frame}
\begin{frame} \begin{frame}
\frametitle{1 --- Installazione} \frametitle{1 --- Installazione pacchetti necessari}
\begin{rootshell} \begin{shell*}
aptitude install openntpd ntpdate krb5-user samba winbind smbclient aptitude install openntpd ntpdate krb5-user samba winbind smbclient
\end{rootshell} \end{shell*}
\bigskip\onslide<2-> \bigskip
\onslide<2->%
Opzionalmente: Opzionalmente:
\begin{rootshell} \begin{shell*}
aptitude install smbfs aptitude install smbfs
\end{rootshell} \end{shell*}
\end{frame} \end{frame}
\begin{frame} \begin{frame}
\frametitle{2 --- Configurazione NTP} \frametitle{2 --- Configurazione NTP}
\begin{rootshell} Fermiamo il servizio:
\begin{shell*}
/etc/init.d/openntpd stop /etc/init.d/openntpd stop
\end{rootshell} \end{shell*}
\onslide<2->
\smallskip \bigskip
\begin{filesnippet}{/etc/openntpd/ntpd.conf} \onslide<2->%
\begin{snippet}{/etc/openntpd/ntpd.conf}
server testdc.domain.local server testdc.domain.local
\end{filesnippet} \end{snippet}
\onslide<3->
\medskip \bigskip
\begin{rootshell} \onslide<3->%
Impostiamo l'ora\ldots
\begin{shell*}
ntpdate testdc.domain.local ntpdate testdc.domain.local
\end{rootshell} \end{shell*}
\begin{rootshell}
\bigskip
\onslide<4>%
\ldots e riavviamo il servizio:
\begin{shell*}
/etc/init.d/openntpd start /etc/init.d/openntpd start
\end{rootshell} \end{shell*}
\end{frame} \end{frame}
\begin{frame} \begin{frame}
\frametitle{3 --- Configurazione Kerberos} \frametitle{3 --- Configurazione Kerberos}
\begin{filesnippet}{/etc/krb5.conf} \begin{snippet}{/etc/krb5.conf}
[libdefaults]\\ [libdefaults]\\
default\_realm = DOMAIN.LOCAL\\ default\_realm = DOMAIN.LOCAL\\
\ldots\newline \ldots\newline
@ -218,90 +220,112 @@
[domain\_realm]\\ [domain\_realm]\\
.domain.local = DOMAIN.LOCAL\\ .domain.local = DOMAIN.LOCAL\\
domain.local = DOMAIN.LOCAL domain.local = DOMAIN.LOCAL
\end{filesnippet} \end{snippet}
\end{frame} \end{frame}
\begin{frame} \begin{frame}
\frametitle{4.0 --- SAMBA} \frametitle{4.0 --- Configurazione SAMBA: generale}
\begin{filesnippet}{/etc/samba/smb.conf} \begin{snippet}{/etc/samba/smb.conf}
[global]\\ [global]\\
workgroup = DOMAIN\\ workgroup = DOMAIN\\
realm = DOMAIN.LOCAL\\ \alert<2>{\textbf<2>{realm = DOMAIN.LOCAL}}\\
wins server = 10.0.0.1\\ wins server = 10.0.0.1\\
security = ads\\ \alert<2>{\textbf<2>{security = ads}}\\
password server = testdc.domain.local\\ \alert<2>{\textbf<2>{password server = testdc.domain.local}}\\
obey pam restrictions = yes\\ obey pam restrictions = yes\\
unix password sync = yes\\ unix password sync = yes\\
winbind separator = +\\ \alert<2>{\textbf<2>{winbind separator = +}}\\
winbind use default domain = yes \alert<2>{\textbf<2>{winbind use default domain = yes}}
\end{filesnippet} \end{snippet}
\end{frame} \end{frame}
\begin{frame} \begin{frame}
\frametitle{4.1 --- SAMBA (condivisioni)} \frametitle{4.1 --- Configurazione SAMBA: condivisioni}
\begin{filesnippet}{/etc/samba/smb.conf} \begin{snippet}{/etc/samba/smb.conf}
[shared]\\ [shared]\\
comment = \ldots\\ comment = \ldots\\
path = /var/local/shared\\ path = /var/local/shared\\
valid users = \%U\\ \alert<2>{\textbf<2>{valid users = \%U}}\\
browseable = yes\\ browseable = yes\\
writable = yes\\ writable = yes\\
guest ok = no\\ guest ok = no\\
read only = no\\ read only = no\\
create mask = 0664\\ \alert<3>{\textbf<3>{create mask = 0664}}\\
directory mask = 0775 \alert<3>{\textbf<3>{directory mask = 0775}}
\end{filesnippet} \end{snippet}
\onslide<2-> \bigskip
Infine testiamo il file:\\[.5em] \onslide<4->
\begin{rootshell} Infine testiamo il file:
\begin{shell*}
testparm testparm
\end{rootshell} \end{shell*}
\end{frame} \end{frame}
\begin{frame} \begin{frame}
\frametitle{5 --- Messa in dominio} \frametitle{5 --- Messa in dominio}
Riavviamo i servizi:\\[.5em] Riavviamo i servizi:
\begin{rootshell} \begin{shell*}
/etc/init.d/samba restart /etc/init.d/samba restart
\end{rootshell} \end{shell*}
\begin{rootshell} \begin{shell*}
/etc/init.d/winbind restart /etc/init.d/winbind restart
\end{rootshell} \end{shell*}
\smallskip \medskip
\onslide<2-> \onslide<2->
Verifichiamo che Kerberos funzioni:\\[.5em] Verifichiamo che Kerberos funzioni:
\begin{rootshell} \begin{shell*}
kinit -a administrator kinit -a administrator
\end{rootshell} \end{shell*}
\smallskip \medskip
\onslide<3-> \onslide<3->
Messa in dominio:\\[.5em] Messa in dominio:
\begin{rootshell} \begin{shell*}
net ads join -U Administrator net ads join -U Administrator
\end{rootshell} \end{shell*}
\smallskip \medskip
\onslide<4-> \onslide<4->
Verifichiamo che si riesca ad accedere alle informazioni di dominio:\\[.5em] Verifichiamo che si riesca ad accedere alle informazioni di dominio:
\begin{rootshell} \begin{shell*}
wbinfo -u wbinfo -u
\end{rootshell} \end{shell*}
\end{frame} \end{frame}
\begin{frame}
\frametitle{Difetti d'implementazione}
\begin{itemize}
\item Non utilizza Heimdal Kerberos (se necessario LDAP, da preferire)
\item Incompatibilità con sistemi \textit{Microsoft} più moderni: Windows
7, Windows 2008 Server.\\
\visible<3->{\alert{Soluzione} --- Samba 3.4 da \textit{Lenny Backports}}
\item<4-> L'implementazione attuale non permette il login sul file server di
utenze di dominio (necessario configurare PAM)
\end{itemize}
\end{frame}
\begin{frame} \begin{frame}
\frametitle{Un \textit{cadeau}} \frametitle{Un \textit{cadeau}}
Possiamo «importare» magicamente gruppi e utenze all'interno della macchina Possiamo «importare» magicamente gruppi e utenze all'interno della macchina
Linux aggiungendo un paio di righe:\newline Linux aggiungendo:
\begin{filesnippet}{/etc/nsswitch.conf} \begin{snippet}{/etc/nsswitch.conf}
passwd: compat \alert{winbind}\\ passwd: compat \alert{\bfseries winbind}\\
group: compat \alert{winbind}\\ \alert{\bfseries passwd\_compat: winbind}\\
shadow: compat \alert{winbind} group: compat \alert{\bfseries winbind}\\
\end{filesnippet} \alert{\bfseries group\_compat: winbind}\\
shadow: compat \alert{\bfseries winbind}
\end{snippet}
\bigskip
\visible<2->{%
Sarà ora possibile attribuire i permessi a intere cartelle come:
\begin{shell*}
chown -R root:'domain users' /var/local/shared
\end{shell*}}
\end{frame} \end{frame}
\begin{frame} \begin{frame}
@ -320,17 +344,27 @@
\begin{thebibliography}{The Samba HOWTO and Reference Guide} \begin{thebibliography}{The Samba HOWTO and Reference Guide}
\bibitem<1>[SAMBA]{SAMBA} \bibitem<1>[SAMBA]{SAMBA}
The Official Samba 3.5.x HOWTO and Reference Guide The SAMBA Team
\newblock\alert{\url{http://tinyurl.com/samba-howto}} \newblock\textit{The Official Samba 3.5.x HOWTO and Reference Guide}
\newblock\urlify{http://tinyurl.com/samba-howto}
\bibitem<1>[SurlyJake]{Surlyjake}
Blog di Jake Surly
\newblock Post: \textit{Join Debian Lenny to Active Directory using
Samba}
\newblock\urlify{http://tinyurl.com/samba-adjoin}
\bibitem<1>[Deb-DC]{Deb-DC} \bibitem<1>[Deb-DC]{Deb-DC}
Samba e OpenLDAP: creare un controller di dominio con Debian Lenny Guide Debianizzati
\newblock\alert{\url{http://tinyurl.com/deb-dc}} \newblock\textit{Samba e OpenLDAP: creare un controller di dominio con
Debian Lenny}
\newblock\urlify{http://tinyurl.com/deb-dc}
\bibitem<1>[Deb-SDC]{Deb-SDC} \bibitem<1>[Deb-SDC]{Deb-SDC}
Samba, OpenLDAP, Kerberos: creare un controller di dominio sicuro con Guide Debianizzati
Debian Lenny \newblock\textit{Samba, OpenLDAP, Kerberos: creare un controller di
\newblock\alert{\url{http://tinyurl.com/deb-secure-dc}} dominio sicuro con Debian Lenny}
\newblock\urlify{http://tinyurl.com/deb-secure-dc}
\end{thebibliography} \end{thebibliography}
\end{frame} \end{frame}