Инструменты пользователя
squid_w2008_ad
Различия
Показаны различия между двумя версиями страницы.
| Следующая версия | Предыдущая версия | ||
| squid_w2008_ad [2012/07/11 02:24] – создано pinkbyte | squid_w2008_ad [2021/08/04 17:06] (текущий) – удалено pinkbyte | ||
|---|---|---|---|
| Строка 1: | Строка 1: | ||
| - | 0. Valid package.use for this installation: | ||
| - | <code bash> | ||
| - | net-fs/ | ||
| - | net-proxy/ | ||
| - | net-nds/ | ||
| - | dev-libs/ | ||
| - | </ | ||
| - | |||
| - | 1. Change / | ||
| - | |||
| - | < | ||
| - | [libdefaults] | ||
| - | default_realm = TEST.LOCAL | ||
| - | ticket_lifetime = 24h | ||
| - | default_keytab_name = / | ||
| - | |||
| - | # for Windows 2008 with AES | ||
| - | default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 | ||
| - | default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 | ||
| - | permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 | ||
| - | |||
| - | [realms] | ||
| - | TEST.LOCAL = { | ||
| - | # | ||
| - | default_domain = test.local | ||
| - | # kdc = ad.test.local | ||
| - | } | ||
| - | |||
| - | [domain_realm] | ||
| - | .test.local = TEST.LOCAL | ||
| - | test.local = TEST.LOCAL | ||
| - | </ | ||
| - | |||
| - | here: TEST.LOCAL - realm(case sensitive). test.local - DNS name of domain, | ||
| - | ad.test.local - DNS name of Domain Controller | ||
| - | |||
| - | 2. <code bash> | ||
| - | |||
| - | 3. Check with klist for valid krb5 credentials cache | ||
| - | |||
| - | 4. On Windows-side: | ||
| - | |||
| - | 5. Back on Linux-side :-). Install msktutil(TODO: | ||
| - | |||
| - | 6. Try: | ||
| - | <code bash> | ||
| - | --computer-name ZFSTEST-K --upn HTTP/ | ||
| - | --verbose --user-creds-only</ | ||
| - | |||
| - | 7. On Windows-side: | ||
| - | |||
| - | 8. On Linux-side: <code bash> | ||
| - | |||
| - | 9. Check for auto-update keytab works properly: | ||
| - | <code bash> | ||
| - | |||
| - | 10. If all goes OK: write auto-updating keytab to crontab | ||
| - | < | ||
| - | |||
| - | 11. <code bash> | ||
| - | |||
| - | 12. < | ||
| - | and WAIT!!!!! | ||
| - | |||
| - | 13. Edit daemon_list in / | ||
| - | < | ||
| - | #add " | ||
| - | daemon_list=" | ||
| - | </ | ||
| - | |||
| - | 14. <code bash>/ | ||
| - | |||
| - | 15. Check Winbind | ||
| - | <code bash> | ||
| - | wbinfo -p | ||
| - | wbinfo -t | ||
| - | wbinfo -u | ||
| - | wbinfo -g | ||
| - | </ | ||
| - | |||
| - | 16. <code bash> | ||
| - | |||
| - | 17. Install negotiate wrapper(TODO: | ||
| - | |||
| - | 18. On DC: create user Squid, assing him a password. | ||
| - | Write password for this user to / | ||
| - | Check permissions on this file!!!! | ||
| - | |||
| - | 19. Paste follow config for authorization: | ||
| - | |||
| - | < | ||
| - | ### negotiate kerberos and ntlm authentication | ||
| - | auth_param negotiate program / | ||
| - | auth_param negotiate children 10 | ||
| - | auth_param basic realm Negotiate Auth | ||
| - | auth_param negotiate keep_alive off | ||
| - | |||
| - | ### pure ntlm authentication | ||
| - | auth_param ntlm program / | ||
| - | auth_param ntlm children 10 | ||
| - | auth_param basic realm NTLM Auth | ||
| - | auth_param ntlm keep_alive off | ||
| - | |||
| - | ### provide basic authentication via ldap for clients not authenticated via kerberos/ | ||
| - | auth_param basic program / | ||
| - | auth_param basic children 10 | ||
| - | auth_param basic realm Basic Auth | ||
| - | auth_param basic credentialsttl 1 minute | ||
| - | </ | ||
| - | |||
| - | 20. Configuration finished. Check results :-) | ||
squid_w2008_ad.1341959050.txt.gz · Последнее изменение: (внешнее изменение)
Инструменты страницы
Если не указано иное, содержимое этой вики предоставляется на условиях следующей лицензии: Public Domain
