|
|
32.
|
|
|
The Kerberos authentication security system is a standardized service for providing authentication to computers and users by means of a centralized server which grants encrypted authorization tickets accepted for authorization by any other computer using Kerberos. Benefits of Kerberos authentication include mutual authentication, delegated authentication, interoperability, and simplified trust management. The primary server daemons for handling the Kerberos authentication and Kerberos database administration on Ubuntu are <application>krb5kdc</application> and <application>kadmin</application>. SAMBA may use Kerberos as a mechanism for authenticating computers and users against a Windows Domain Controller. To do so, the Ubuntu system must have Kerberos installed, and the <filename>/etc/samba/smb.conf</filename> must be modified to select the the proper <emphasis role="italic">realm</emphasis> and <emphasis role="italic">security</emphasis> mode. For example, edit the <filename>/etc/samba/smb.conf</filename> file and add the values:
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
../generic/serverguide/C/windows-networking.xml:150(para)
|
|
|
33.
|
|
|
realm = DOMAIN_NAME
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
../generic/serverguide/C/windows-networking.xml:164(emphasis)
|
|
|
34.
|
|
|
security = ADS
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
../generic/serverguide/C/windows-networking.xml:167(emphasis)
|
|
|
35.
|
|
|
to the file, and save the file.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
../generic/serverguide/C/windows-networking.xml:169(para)
|
|
|
36.
|
|
|
Be sure to replace the token DOMAIN_NAME in the example above with the actual name of your specific Windows Domain.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
../generic/serverguide/C/windows-networking.xml:173(para)
|
|
|
37.
|
|
|
You will need to restart the SAMBA daemons to effect these changes. Restart the SAMBA daemons with the following command entered at a terminal prompt:
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
../generic/serverguide/C/windows-networking.xml:177(para)
|
|
|
38.
|
|
|
sudo /etc/init.d/samba restart
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/windows-networking.xml:218(command) serverguide/C/windows-networking.xml:331(command) serverguide/C/windows-networking.xml:468(command) serverguide/C/windows-networking.xml:567(command) serverguide/C/windows-networking.xml:937(command) serverguide/C/windows-networking.xml:1047(command) serverguide/C/windows-networking.xml:1162(command) serverguide/C/network-auth.xml:1860(command)
|
|
|
39.
|
|
|
Computer Accounts
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
../generic/serverguide/C/windows-networking.xml:189(title)
|
|
|
40.
|
|
|
Computer Accounts are used in Directory Services to uniquely identify computer systems participating in a network, and are even treated in the same manner as users in terms of security. Computer accounts may have passwords just as user accounts do, and are subject to authorization to network resources in the same manner as user accounts. For example, if a network user, with a valid account for a particular network attempts to authenticate with a network resource from a computer which does not have a valid computer account, depending upon policies enforced on the network, the user may be denied access to the resource if the computer the user is attempting authentication from is considered to be an unauthorized computer.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
../generic/serverguide/C/windows-networking.xml:190(para)
|
|
|
41.
|
|
|
A computer account may be added to the SAMBA password file, provided the name of the computer being added exists as a valid user account in the local password database first. The syntax for adding a computer or machine account to the SAMBA password file is to use the <application>smbpasswd</application> command from a terminal prompt as follows:
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
../generic/serverguide/C/windows-networking.xml:199(para)
|
