Précédent Remonter Suivant

4  Using the scripts

4.1  Initial directory's population

You can initialize the LDAP directory using the smbldap-populate script. To do that, the account defined in the /etc/smbldap-tools/smbldap_bind.conf to access the master directory must must be the manager account defined in the directory configuration. On RedHat system, this file is /etc/openldap/slapd.conf and the account is defined with

  rootdn          "cn=Manager,dc=idealx,dc=com"
  rootpw          secret
The smbldap_bind.conf file must then be configured so that the parameters to connect to the master LDAP server match the previous ones:

  masterDN="cn=Manager,dc=idealx,dc=com"
  masterPw="secret"
Available options for this script are summarized in the table 1:

option definition default value
-a user administrator login name Administrator
-b user guest login name nobody
-e file export a init file  
-i file import a init file  

Table 1: Options available for the smbldap-populate script


In the more general case, to set up your directory, simply use the following command:
[root@etoile root]# smbldap-populate 
Using builtin directory structure
adding new entry: dc=idealx,dc=com
adding new entry: ou=Users,dc=idealx,dc=com
adding new entry: ou=Groups,dc=idealx,dc=com
adding new entry: ou=Computers,dc=idealx,dc=com
adding new entry: uid=Administrator,ou=Users,dc=idealx,dc=com
adding new entry: uid=nobody,ou=Users,dc=idealx,dc=com
adding new entry: cn=Domain Admins,ou=Groups,dc=idealx,dc=com
adding new entry: cn=Domain Users,ou=Groups,dc=idealx,dc=com
adding new entry: cn=Domain Guests,ou=Groups,dc=idealx,dc=com
adding new entry: cn=Print Operators,ou=Groups,dc=idealx,dc=com
adding new entry: cn=Backup Operators,ou=Groups,dc=idealx,dc=com
adding new entry: cn=Replicator,ou=Groups,dc=idealx,dc=com
adding new entry: cn=Domain Computers,ou=Groups,dc=idealx,dc=com
After this step, if you don't want to use the cn=Manager,dc=idealx,dc=com account anymore, you can create a dedicated account for Samba and the smbldap-tools. See section 9.2 for more details.

4.2  User management

4.2.1  Adding a user

To add a user, use the smbldap-useradd script. Available options are summarized in the table 2. If applicable, default values are mentionned in the third column. Any string beginning with a $ symbol refers to a parameter defined in the /etc/smbldap-tools/smbldap.conf configuration file.

option definition example default value
-a create a Windows account. Otherwise, only a Posix account is created    
-w create a Windows Workstation account    
-i create an interdomain trust account. See section 4.4 for more details    
-u set a uid value -u 1003 first uid available
-g set a gid value -g 1003 first gid available
-G add the new account to one or several supplementary groups (comma-separated) -G 512,550  
-d set the home directory -d /var/user $userHomePrefix/user
-s set the login shell -s /bin/ksh $userLoginShell
-c set the user gecos -c "admin user" $userGecos
-m creates user's home directory and copies /etc/skel into it    
-k set the skeleton dir (with -m) -k /etc/skel2 $skeletonDir
-P ends by invoking smbldap-passwd to set the user's password    
-A user can change password ? 0 if no, 1 if yes -A 1  
-B user must change password at first session ? 0 if no, 1 if yes -B 1  
-C set the samba home share \\PDC\homes $userSmbHome
-D set a letter associated with the home share H: $userHomeDrive
-E set DOS script to execute on login common.bat $userScript
-F set the profile directory \\PDC\profiles\user) $userProfile
-H set the samba account control bits like'[NDHTUMWSLKI]') [X]  
-N set the canonical name of the user    
-S set the surname of the user    

Table 2: Options available to the smbldap-useradd script


For example, if you want to add a user named user_admin and who : you must invoke:
smbldap-useradd -a -G 512 -m -s /bin/false -d /dev/null -P user_admin

4.2.2  Removing a user

To remove a user account, use the smbldap-userdel script. One available option is

option definition
-r remove home directory

Table 3: Option available to the smbldap-userdel script


For example, if you want to remove the user1 account from the LDAP directory, and if you also want to delete his home directory, use the following command :
smbldap-userdel -r user1
Note: '-r' is dangerous as it may delete precious and unbackuped data, please be careful.

4.3  Group management

4.3.1  Adding a group

To add a new group in the LDAP directory, use the smbldap-groupadd script. Available options are listed in the table 4.

option definition example
-a add automatic group mapping entry  
-g gid set the gidNumer for this group to gid -g 1002
-o gidNumber is not unique  
-r group-rid set the rid of the group to group-rid -r 1002
-s group-sid set the sid of the group to group-sid -s S-1-5-21-3703471949-3718591838-2324585696-1002
-t group-type set the sambaGroupType to group-type -t 2
-p print the gidNumber to stdout  

Table 4: Options available for the smbldap-groupadd script


4.3.2  Removing a group

To remove the group named group1, just use the following command :
smbldap-userdel group1

4.4  Adding a interdomain trust account

To add an interdomain trust account to the primary controller trust-pdc, use the -i option of smbldap-useradd as follows :
[root@etoile root]# smbldap-useradd -i trust-pdc
New password : *******
Retype new password : *******
The script will terminate asking for a password for this trust account. The account will be created in the directory branch where all computer accounts are stored (ou=Computers by default). The only two particularities of this account are that you are setting a password for this account, and the flags of this account are [I ].
Précédent Remonter Suivant