Scribd
Upload
9 views5 pages

comandos parte2

The document provides a detailed guide for adding a machine to a domain using Samba and configuring various services including Squid, Apache, Postfix, and Dovecot. It includes specific configuration settings for Samba, user and group management, and authentication methods. Additionally, it outlines the installation and setup of necessary packages and services to ensure proper functionality within the domain environment.

Uploaded by

said
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
9 views5 pages

comandos parte2

The document provides a detailed guide for adding a machine to a domain using Samba and configuring various services including Squid, Apache, Postfix, and Dovecot. It includes specific configuration settings for Samba, user and group management, and authentication methods. Additionally, it outlines the installation and setup of necessary packages and services to ensure proper functionality within the domain environment.

Uploaded by

said
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 5

adicionar a maquina no dominio

vi /etc/samba/smb.conf
[global]
workgroup = CERTIFICACAO
map to guest = Bad User
include = /etc/samba/dhcp.conf
logon path = \\%L\profiles\.msprofile
logon home = \\%L\%U\.9xprofile
logon drive = P:
usershare allow guests = No
idmap gid = 10000-20000
idmap uid = 10000-20000
realm = CERTIFICACAO.COM
security = ADS
template homedir = /home/%D/%U
template shell = /bin/bash
winbind offline logon = yes
winbind refresh tickets = yes
password server = 10.211.55.13
winbind separator = + # some applications get confused with \
winbind enum users = yes
winbind enum groups = yes
winbind nested groups = Yes
winbind use default domain = yes
encrypt passwords = yes
socket options = TCP_NODELAY SO_RCVBUF=16384 SO_SNDBUF=16384
log level = 3 passdb:5 auth:3 winbind:3
[homes]
comment = Home Directories
valid users = %S, %D%w%S
browseable = No
read only = No
inherit acls = Yes

klist
net ads join -Uadministrator
net rpc join -Uadministrator
net ads testjoin -Uadministrator
net ads keytab list -Uadministrator
net rpc trustdom list -Uadministrator
net ads user -U administrator
net ads group -U administrator
wbinfo -a administrator%1eimg2eimm!
wbinfo -D certificacao
wbinfo -t
wbinfo -i administrator
wbinfo -u
wbinfo -g

groupadd squid
useradd -g squid -d /var/cache/squid -s /bin/false squid
chown root:squid /var/lib/samba/winbindd_privileged
chmod 750 /var/lib/samba/winbindd_privileged

yast2 -i findutils readline glibc-devel findutils-locate gcc flex lynx compat-


readline4 db-devel wget gcc-c++ subversion make
wget http://www.squid-cache.org/Versions/v3/3.3/squid-3.3.3-20130314-r12516.tar.gz
tar xvzf squid-3.3.3-20130314-r12516.tar.gz
./configure --prefix=/usr/local/squid
make
make install

chown -R squid:squid /usr/local/squid


chmod 770 /usr/local/squid
cd /usr/local/squid
chown -R squid:squid *

vi /usr/local/squid/etc/squid.conf

cache_effective_user squid
cache_effective_group squid

visible_hostname linux-jw8v.certificacao.com

# para autenticacao basica


auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 5
auth_param ntlm max_challenge_reuses 0
auth_param ntlm max_challenge_lifetime 2 minutes

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic


auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 5 hours

acl NTLMUsers proxy_auth REQUIRED


http_access allow all NTLMUsers

#para autenticacao por grupo


auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 5

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic


auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 5 hours

external_acl_type wbinfo_check %LOGIN /usr/local/squid/lib/ext_wbinfo_group_acl


acl allowed_group external wbinfo_check AcessoTotal

http_access allow allowed_group

acl sites_liberados url_regex -i "/usr/local/squid/etc/sites_liberados"

http_access allow sites_liberados

#
# apache
#

a2enmod authnz_ldap
a2enmod ldap

mkdir /srv/www/htdocs/secreto

rcapache restart

vi /etc/apache2/httpd.conf

Options Indexes FollowSymLinks MultiViews


AllowOverride None
Order allow,deny
allow from all
AuthType Basic
AuthName "Acesso Restrito"
AuthBasicProvider ldap
AuthzLDAPAuthoritative off
AuthLDAPURL "ldap://10.211.55.13:389/ou=rede,dc=certificacao,dc=com?
sAMAccountName?sub?(objectClass=*)" NONE
AuthLDAPBindDN "cn=Administrator,cn=Users,dc=certificacao,dc=com"
AuthLDAPBindPassword "1eimg2eimm!"
Require valid-user # Use essa diretiva para habilitar todos os
usu�rios da "OU" ou do "DC"

#
# postfix
#

sudo apt-get install postfix postfix-ldap dovecot-common dovecot-imapd dovecot-


pop3d dovecot-ldap

sudo useradd vmail -s /bin/false -d /home/vmail

sudo chown -R vmail:vmail /home/vmail


sudo chmod -R 700 /home/vmail

vi ldap-users.cf
server_host = 10.211.55.13
search_base = dc=certificacao,dc=com
version = 3
query_filter = (&(objectclass=person)(samaccountname=%s))
result_attribute = samaccountname
result_format = %u/Maildir/
bind = yes
bind_dn = [email protected]
bind_pw = 1eimg2eimm!

vi /etc/postfix/main.cf
smtpd_banner = $myhostname ESMTP $mail_name (GNU)
biff = no

# appending .domain is the MUA's job.


append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for


# information on enabling SSL in the smtp client.

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = certificacao.com, localhost.localdomain, localhost
home_mailbox = Maildir/
relayhost =
mynetworks = 127.0.0.0/8 ,10.0.0.0/16
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

virtual_mailbox_domains = ubuntu.certificacao.com
virtual_mailbox_base = /home/vmail/
virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf
virtual_uid_maps = static:1001 # Aqui coloca-se o valor do uid do usuario vmail
virtual_gid_maps = static:1001 # Aqui coloca-se o valor do gid do usuario vmail

smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_mynetworks,
permit_sasl_authenticated, reject_unauth_destination
broken_sasl_auth_clients = yes

vi /etc/dovecot/dovecot.conf
mail_location = maildir:/home/vmail/%u/Maildir/
mail_privileged_group = mail
mail_debug = no
valid_chroot_dirs = /home/vmail
maildir_copy_with_hardlinks = yes
protocol imap {
mail_plugin_dir = /usr/lib/dovecot/modules/imap
imap_client_workarounds = delay-newmail outlook-idle netscape-eoh
}
protocol pop3 {
pop3_uidl_format = %08Xu%08Xv
mail_plugin_dir = /usr/lib/dovecot/modules/pop3
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}
protocol managesieve {
sieve=~/.dovecot.sieve
sieve_storage=~/sieve
}

auth_username_format = %Lu
auth_debug = no
auth default {
mechanisms = plain login
socket listen {
client {
path = /var/spool/postfix/private/auth
mode = 0660
user = postfix
group = postfix
}
}
passdb ldap {
args = /etc/dovecot/dovecot-ldap.conf
}
userdb static {
args = uid=1001 gid=1001 home=/home/vmail/%u
}

socket listen {
master {
path = /var/run/dovecot/auth-master
mode = 0600
user = vmail
group = vmail
}
client {
path = /var/run/dovecot/auth-client
mode = 0660
}
}

vi dovecot-ldap.conf
hosts = 10.211.55.13
base = dc=certificacao,dc=com
ldap_version = 3
auth_bind = yes
auth_bind_userdn = certificacao\%u

sudo service postfix restart


sudo service dovecot restart

You might also like