編輯 /etc/polkit-1/localauthority/50-local.d/wifi.scan.pkla
[Allow Wifi Scan]
Identity=unix-user:*
Action=org.freedesktop.NetworkManager.wifi.scan;org.freedesktop.NetworkManager.enable-disable-wifi;org.freedesktop.NetworkManager.settings.modify.own;org.freedesktop.NetworkManager.settings.modify.system;org.freedesktop.NetworkManager.network-control
ResultAny=yes
ResultInactive=yes
ResultActive=yes
編輯 /etc/polkit-1/localauthority/50-local.d/46-allow-update-repo.pkla
[Allow Package Management all Users]
Identity=unix-user:*
Action=org.freedesktop.packagekit.system-sources-refresh
ResultAny=yes
ResultInactive=yes
ResultActive=yes
/etc/security/pwquality.conf
/etc/pam.d/common-password
/etc/login.defs
相關指令及檔案
/etc/pam.d/password
/etc/pam.d/common-password
passwd --expire [[$USER]
chage -d 0 [$USER]
編輯 /etc/apt/sources.list
deb http://deb.debian.org/debian bookworm main contrib non-free
deb http://deb.debian.org/debian bookworm-updates main contrib non-free
deb http://security.debian.org/debian-security bookworm-security main
deb http://ftp.debian.org/debian bookworm-backports main contrib non-free
apt update -y
apt upgrade --without-new-pkgs -y
apt full-upgrade -y
編輯 /etc/apt/sources.list
deb http://deb.debian.org/debian bullseye main contrib non-free
deb http://deb.debian.org/debian bullseye-updates main contrib non-free
deb http://security.debian.org/debian-security bullseye-security main
deb http://ftp.debian.org/debian bullseye-backports main contrib non-free
apt update -y
apt upgrade --without-new-pkgs -y
apt full-upgrade -y
安裝軟體
apt install -y sudo screen
apt install -y acl attr samba samba-dsdb-modules samba-vfs-modules winbind libpam-winbind libnss-winbind libpam-krb5 krb5-config krb5-user dnsutils net-tools
apt install samba krb5-config winbind smbclient -y
apt install ldb-tools -y
systemctl stop smbd nmbd winbind
systemctl disable smbd nmbd winbind
systemctl mask smbd nmbd winbind
升級 Domain Controller
mv /etc/samba/smb.conf /etc/samba/smb.conf.ori
samba-tool domain provision
#samba-tool domain provision --use-rfc2307 --interactive
#samba-tool domain provision --use-rfc2307 --use-xattrs=yes --function-level=2008_R2 --interactive
mv /etc/krb5.conf /etc/krb5.conf.ori
ln -s /var/lib/samba/private/krb5.conf /etc/krb5.conf
systemctl start samba-ad-dc
測試
smbclient -L localhost -U%
samba-tool domain level show
建立帳號
samba-tool user create user
samba-tool user list
pdbedit -L -v
RFC 2307屬性
驗證 NIS 擴充功能是否已安裝在 Active Directory 中
ldbsearch -H /var/lib/samba/private/sam.ldb -s base -b \
CN=ypservers,CN=ypServ30,CN=RpcServices,CN=System,DC=tdap,DC=test cn
RFC 2307屬性允許在 LDAP 目錄中儲存 Unix 使用者和群組資訊
不建議在 Samba AD DC 上使用 RFC2307 對應。預設的 idmap.ldb 機制適用於網域控制站且不易出錯。
