Bonjour,

J'ai mis en place un serveur Samba 3 et Openldap afin de faire un PDC avec prise en compte du couple identifiant via la base de données d'openldap.

Mon problème est le suivant : Si j'active le firewall, le nom d'utilisateur est inconnu (message ethereal : SAM unknown user ) et si je desactive le firewall le nom de domaine specifié n'est pas trouvé.

Pour le pare feu j'ai authorisé samba,ldap,ldaps (interieur et exterieur).

A présent passons au fichier de configuration:

########### slapd.conf #######################
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
#include /etc/openldap/schema/rfc2307bis.schema
include /etc/openldap/schema/yast.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/samba3.schema
# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org

pidfile /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args

# Load dynamic backend modules:
modulepath /usr/lib/openldap/modules
# moduleload back_ldap.la
# moduleload back_meta.la
# moduleload back_monitor.la
# moduleload back_perl.la

# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access to user password
# Allow anonymous users to authenticate
# Allow read access to everything else
# Directives needed to implement policy:
## Yast2 samba hack ACL
## allow the "ldap admin dn" access, but deny everyone else
access to attrs=SambaLMPassword,SambaNTPassword
by dn="cn=Admin,dc=mondomaine,dc=fr" write
by * none
## Yast2 samba hack ACL done
access to dn.base=""
by * read

access to dn.base="cn=Subschema"
by * read

access to attrs=userPassword,userPKCS12
by self write
by * auth

access to attrs=shadowLastChange
by self write
by * read

access to *
by * read

# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# BDB database definitions
#######################################################################

loglevel 4095
TLSCertificateFile /etc/ssl/servercerts/servercert.pem
TLSCACertificatePath /etc/ssl/certs/
TLSCertificateKeyFile /etc/ssl/servercerts/serverkey.pem
database bdb
suffix "dc=mondomaine,dc=fr"
rootdn "cn=Admin,dc=mondomaine,dc=fr"
rootpw "secret"
directory /var/lib/ldap
checkpoint 1024 5
cachesize 10000
index objectClass,uidNumber,gidNumber eq
index member,mail eq,pres
index cn,displayname,uid,sn,givenname sub,eq,pres
index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq

#################################################################

A présent voici le fichier de configuratin de samba

################### smb.conf ###################################
# smb.conf is the main Samba configuration file. You find a full commented
# version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE if the
# samba-doc package is installed.
# Date: 2006-06-16
[global]
# le nom du domaine
workgroup =mondomaine.fr
# le nom netbios
netbios name = mondmaine
printing = cups
printcap name = cups
printcap cache time = 750
cups options = raw
map to guest = Bad User
include = /etc/samba/dhcp.conf
# savoir ou sont les logs
log file = /var/log/samba/log.%m
max log size = 50
#Répertoire utilisé par win9x pour stocker les profils
logon path = \\%L\profiles\
logon drive = P:
# Répertoire utilisé par winNT,XP pour stocker les profils
logon home = \\%L\profiles\%U
username map = /etc/samba/smbusers
# add machine script = /sbin/yast /usr/share/YaST2/data/add_machine.ycp %m$
set primary group script = /usr/local/bin/ldapsetprimarygroup '%u' '%g'
rename user script = /usr/local/bin/ldaprenameuser '%uold' '%unew'
# permettre d'utiliser les profils errants sur le serveur samba
domain logons = Yes
domain master = Yes
local master = Yes
preferred master = Yes
idmap backend = ldap:ldap://127.0.0.1
ldap admin dn = cn=Admin,dc=mondomaine,dc=fr
ldap delete dn = No
ldap user suffix = ou=people
ldap group suffix = ou=group
ldap idmap suffix = ou=Idmap
ldap machine suffix = ou=Machines
ldap passwd sync = Yes
ldap replication sleep = 1000
ldap ssl = Start_tls
ldap suffix = dc=mondomaine,dc=fr
ldap timeout = 5
smb passwd file = /etc/samba/smbpasswd
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *New* %n\n *Re* %n\n *pa*
passwd chat debug = Yes
set primary group script = /usr/local/bin/ldapsetprimarygroup '%u' '%g'
rename user script = /usr/local/bin/ldaprenameuser '%uold' '%unew'
# nombre pour battre les autres serveurs Windows
os level = 255
share modes = No
admin users = @root
passdb backend = ldapsam:ldap://127.0.0.1
security = user
# samba supporte serveur wins
wins support = Yes
winbind use default domain = Yes
dns proxy = No
nt acl support = No
msdfs root = Yes
#Synchroniser l'horloge du client avec celle du serveur
time server = Yes
[homes]
comment = Home Directories
valid users = %S, %D%w%S
browseable = No
read only = No
inherit acls = Yes
[profiles]
comment = Network Profiles Service
path = %H
read only = No
store dos attributes = Yes
create mask = 0600
directory mask = 0700
[users]
comment = All users
path = /home/users
read only = No
inherit acls = Yes
veto files = /aquota.user/groups/shares/
[prof]
path = /home/prof
browseable = No
read only = No
inherit acls = Yes
veto files = /aquota.ser/groups/shares/
[groups]
comment = All groups
path = /home/groups
read only = No
inherit acls = Yes
[printers]
comment = All Printers
path = /var/tmp
printable = Yes
create mask = 0600
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/drivers
write list = @ntadmin root
force group = ntadmin
create mask = 0664
directory mask = 0775
[netlogon]
comment = Network Logon Service
path = /home/netlogon
write list = root
read only = Yes
browseable = No

###############################################################

Voici nsswitch.conf

########################## nsswitch.conf ######################
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
# compat Use compatibility setup
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# [NOTFOUND=return] Stop searching if not found so far
#
# For more information, please read the nsswitch.conf.5 manual page.
#

# passwd: files nis
# shadow: files nis
# group: files nis

passwd: compat ldap
group: compat ldap
shadow: compat ldap
hosts: files dns
networks: files dns

services: db files ldap
protocols: db files
rpc: db files
ethers: db files
netmasks: files
netgroup: files ldap
publickey: files

bootparams: files
automount: files nis ldap
aliases: files ldap
passwd_compat: ldap
group_compat: ldap

#################################################################

A présent, quelque détaille supplémentaire :
Sur mon client 2000 pro, j'arrive a me connecté avec le compte root de samba.

J'utilise ldapscript 1,6 pour crée mes groupes ainsi qu'utilisateurs ( equivalent de smb tool sauf qu'au lieu d'être écrit en perl, c'est du shell). A ce niveau aucun soucis une fois les scripts lancés, j'ai lancer jexplorer, les comptes sont bien présent dans l'arbre.

Les logs de openldap m'indique l'erreur suivante lorsque je redémarre le service :
nscd: nss_ldap: could not search LDAP server - Server is unavailable

La commande ldapsearch fonctionne parfaitement.

Enfin les repertoires ont tous comme droits 777. Pour éviter pour le moment tout soucis.

J'espère vous avoir exposé mon problème avec le plus de précision et de clarté possible.

Merci d'avance pour votre aide.

Configuration: Linux Suse
Firefox 1.5.0.4