Rootop 服务器运维与web架构

开始之前我先声明：此过程也是我照着网上做法做出来的，其中文字加以修改补充。支持原创。其次解释一下所谓的加入域：

1: 访问linux服务时，通过域控进行身份验证

2：linux系统登录时，通过“域”进行身份验证，这里的域就不是win下的，而是NIS。

这篇文章是属于第一种。

一、实验环境：
AD server：windows server 2003
client：redhat5.4

AD server的hostname和IP地址：
srv03               172.16.10.2
samba的hostname和IP地址：
redhat       172.16.10.3

Domain name：srv03.venus.com
DNS：172.16.10.2

安装NTP时间验证套件：
#yum -y install ntp

再来与AD server校准时间
# ntpdate 172.16.10.2

# hwclock –w  #写入硬件

补充说明：在Linux中有硬件时钟与系统时钟等两种时钟。硬件时钟是指主机板上的时钟设备，也就是通常可在BIOS画面设定的时钟。系统时钟则是指kernel中的时钟。当Linux启动时，系统时钟会去读取硬件时钟的设定，之后系统时钟即独立运作。所有Linux相关指令与函数都是读取系统时钟的设定。具体的可以man hwclock

安装Samba服务器软件需求：
krb5-workstation-1.2.7-19
pam_krb5-1.70-1
krb5-devel-1.2.7-19
krb5-libs-1.2.7-19
samba-3.0.5-2

用yum进行的安装
#yum -y install samba
安装完后，如果你要确认samba安装成功没有可以用下述命令来检查samba包的基础库支持，一般用yum安装或RPM安装是不会有问题的。
# smbd -b | grep LDAP
HAVE_LDAP_H
HAVE_LDAP
HAVE_LDAP_DOMAIN2HOSTLIST
…
# smbd -b | grep KRB
HAVE_KRB5_H
HAVE_ADDRTYPE_IN_KRB5_ADDRESS
HAVE_KRB5
…
# smbd -b | grep ADS
WITH_ADS
WITH_ADS
# smbd -b | grep WINBIND
WITH_WINBIND
WITH_WINBIND

二、编辑设定档
1、krb5配置
#vi /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = VENUS.COM  # 大写域名
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes

[realms]
VENSU.COM = {  # 大写域名
kdc = 172.16.10.2:88  # 域伺服器IP
admin_server = 172.16.10.2:749  # 域伺服器IP
default_domain = venus.com   # 这里就不用大写了
}

[domain_realm]
.venus.com = VENUS.COM  # 域验证范围
venus.com = VENUS.COM

[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

连接AD server
kinit administrator@VENUS.COM
Kerberos 的 kinit 命令将测试服务器间的通信，后面的域名VENUS.COM 是你的活动目录的域名，必须大写，否则会收到错误信息：
kinit(v5): Cannot find KDC for requested realm while getting initial credentials.

如果通信正常，你会提示输入口令，口令正确的话，就返回 bash 提示符，如果错误则报告：
kinit(v5): Preauthentication failed while getting initial credentials.
这一步代表了已经可以和AD server做沟通了，但并不代表Samba Server已经加入域了。
2、smb.conf配置
#vi /etc/samba/smb.conf
#===================== Global Settings =========================
[global]
workgroup = VENUS   # 一定要填自己的domain名称(大写)

netbios name = redhat  #你的linux主机名

# 一下必须添加，否则身份认证失败！
idmap uid    = 15000-20000
idmap gid    = 15000-20000
winbind enum groups = yes
winbind enum users  = yes
winbind separator   = /
;       winbind use default domain = yes
template homedir = /home/%D/%U
template shell   = /bin/bash
;       interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24
hosts allow = 172.16.10.

# ———————– Domain Members Options ————————
security = domain
;       passdb backend = tdbsam
；      realm = VENUS.COM    #这里我觉得还是注释起好点
encrypt passwords = yes     #这句是必须添加的，不然后面验证会提示不成功
password server = 172.16.10.2
[homes]
path = /home/%D/%U
browseable = no
writable = yes
valid users = venus.com/%U     #这里记得把域名带上，否则你用ad帐号访问samba服务器时输入正确的ad帐号和密码仍然不能访问共享目录
create mode = 0777
directory mode = 0777
3、配置nsswitch.conf
#vi /etc/nsswitch.conf
修改以下位置
passwd:     files winbind
shadow:     files
group:      files winbind
4、启用samba和winbind服务
service smb reload   #加这一句是用来解决有时候samba启动不了的问题
service smb start
service winbind start
5、加入AD域
[root@lamp ~]# net rpc join -S srv03.venus.com -U administrator
Password:
Joined domain VENUS.

如果不设置DNS的话，会提示：

另外请注意计算机的名字长度及NetBIOS名字长度

6、验证加入是否成功
[root@lamp ~]# net rpc testjoin
Join to ‘TT’ is OK
[root@lamp ~]# wbinfo -t
checking the trust secret via RPC calls succeeded
[root@lamp ~]# wbinfo -u
TT/administrator
TT/guest
TT/support_388945a0
TT/krbtgt
[root@lamp ~]# wbinfo -g
TT/domain computers
TT/domain controllers
TT/schema admins
TT/enterprise admins
VENUS/domain admins
VENUS/domain users
VENUS/domain guests
VENUS/group policy creator owners
VENUS/dnsupdateproxy
[root@lamp ~]# getent passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
VENUS/administrator:*:15000:15000:Administrator:/home/VENUS/administrator:/bin/bash
VENUS/guest:*:15001:15001:Guest:/home/VENUS/guest:/bin/bash
VENUS/support_388945a0:*:15002:15000:SUPPORT_388945a0:/home/VENUS/support_388945a0:/bin/bash
VENUS/krbtgt:*:15003:15000:krbtgt:/home/VENUS/krbtgt:/bin/bash
[root@lamp ~]# getent group
root:x:0:root
bin:x:1:root,bin,daemon
daemon:x:2:root,bin,daemon
sys:x:3:root,bin,adm
adm:x:4:root,adm,daemon
tty:x:5:
disk:x:6:root
lp:x:7:daemon,lp
mem:x:8:
kmem:x:9:
wheel:x:10:root
mail:x:12:mail
news:x:13:news
uucp:x:14:uucp
man:x:15:
games:x:20:
gopher:x:30:
dip:x:40:
ftp:x:50:
lock:x:54:
nobody:x:99:
users:x:100:
rpm:x:37:
dbus:x:81:
utmp:x:22:
mailnull:x:47:
smmsp:x:51:
nscd:x:28:
floppy:x:19:
vcsa:x:69:
rpc:x:32:
rpcuser:x:29:
nfsnobody:x:65534:
sshd:x:74:
pcap:x:77:
utempter:x:35:
slocate:x:21:
haldaemon:x:68:
ntp:x:38:
VENUS/domain computers:*:15002:
VENUS/domain controllers:*:15003:
VENUS/schema admins:*:15004:VENUS/administrator
VENUS/enterprise admins:*:15005:VENUS/administrator
VENUS/domain admins:*:15006:VENUS/administrator
VENUS/domain users:*:15000:
VENUS/domain guests:*:15001:
VENUS/group policy creator owners:*:15007:VENUS/administrator
VENUS/dnsupdateproxy:*:15008:
完成

用加入域的客户端访问samba时，不再需要用户名及密码。

同时，AD中也可以看到redhat的信息了。

[root@localhost linux-2.6.35.7]# make menuconfig
 *** Unable to find the ncurses libraries or the
 *** required header files.
 *** ‘make menuconfig’ requires the ncurses libraries.
 ***
 *** Install ncurses (ncurses-devel) and try again.
 ***
make[1]: *** [scripts/kconfig/dochecklxdialog] 错误 1
make: *** [menuconfig] 错误 2
[root@localhost linux-2.6.35.7]#
[root@localhost linux-2.6.35.7]# yum install -y make
Loaded plugins: rhnplugin, security
This system is not registered with RHN.
RHN support will be disabled.
xxx                                                      | 1.3 kB     00:00
Setting up Install Process
Package 1:make-3.81-3.el5.i386 already installed and latest version
Nothing to do
[root@localhost linux-2.6.35.7]#
[root@localhost linux-2.6.35.7]# yum install -y ncurses-devel
Loaded plugins: rhnplugin, security
This system is not registered with RHN.
RHN support will be disabled.
Setting up Install Process
Resolving Dependencies
–> Running transaction check
—> Package ncurses-devel.i386 0:5.5-24.20060715 set to be updated
–> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package               Arch         Version                   Repository   Size
================================================================================
Installing:
 ncurses-devel         i386         5.5-24.20060715           xxx         1.6 M

Transaction Summary
================================================================================
Install      1 Package(s)
Update       0 Package(s)
Remove       0 Package(s)

Total download size: 1.6 M
Downloading Packages:
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing     : ncurses-devel                                            1/1

Installed:
  ncurses-devel.i386 0:5.5-24.20060715

Complete!
[root@localhost linux-2.6.35.7]#

ncurses-devel 用于显示编译内核时显示字符界面。

今天再次编译的时候提示错误：

[root@fedora /usr/src/kernels/2.6.21-1.3194.fc7-i686]#make menuconfig
  HOSTCC  scripts/kconfig/lxdialog/checklist.o
在包含自 scripts/kconfig/lxdialog/checklist.c：24 的文件中:
scripts/kconfig/lxdialog/dialog.h:32:20: 错误：curses.h：没有那个文件或目录
In file included from scripts/kconfig/lxdialog/checklist.c:24:
scripts/kconfig/lxdialog/dialog.h:97: 错误：expected specifier-qualifier-list before ‘chtype’
scripts/kconfig/lxdialog/dialog.h:187: 错误：expected ‘)’ before ‘*’ token
scripts/kconfig/lxdialog/dialog.h:193: 错误：expected ‘)’ before ‘*’ token
scripts/kconfig/lxdialog/dialog.h:195: 错误：expected ‘)’ before ‘*’ token
scripts/kconfig/lxdialog/dialog.h:196: 错误：expected ‘)’ before ‘*’ token
scripts/kconfig/lxdialog/dialog.h:197: 错误：expected ‘)’ before ‘*’ token
scripts/kconfig/lxdialog/dialog.h:198: 错误：expected ‘)’ before ‘*’ token
scripts/kconfig/lxdialog/dialog.h:200: 错误：expected ‘)’ before ‘*’ token
scripts/kconfig/lxdialog/checklist.c:31: 错误：expected ‘)’ before ‘*’ token
scripts/kconfig/lxdialog/checklist.c:59: 错误：expected ‘)’ before ‘*’ token
scripts/kconfig/lxdialog/checklist.c:95: 错误：expected ‘)’ before ‘*’ token
scripts/kconfig/lxdialog/checklist.c: 在函数 ‘dialog_checklist’ 中：
scripts/kconfig/lxdialog/checklist.c:116: 错误：‘WINDOW’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:116: 错误：(即使在一个函数内多次出现，每个未声明的标识符在其
scripts/kconfig/lxdialog/checklist.c:116: 错误：所在的函数内只报告一次。)
scripts/kconfig/lxdialog/checklist.c:116: 错误：‘dialog’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:116: 错误：‘list’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:116: 警告：逗号表达式的左操作数不起作用
scripts/kconfig/lxdialog/checklist.c:129: 警告：隐式声明函数 ‘getmaxy’
scripts/kconfig/lxdialog/checklist.c:129: 错误：‘stdscr’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:130: 错误：‘KEY_MAX’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:131: 警告：隐式声明函数 ‘getmaxx’
scripts/kconfig/lxdialog/checklist.c:137: 错误：‘COLS’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:138: 错误：‘LINES’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:140: 警告：隐式声明函数 ‘draw_shadow’
scripts/kconfig/lxdialog/checklist.c:142: 警告：隐式声明函数 ‘newwin’
scripts/kconfig/lxdialog/checklist.c:143: 警告：隐式声明函数 ‘keypad’
scripts/kconfig/lxdialog/checklist.c:143: 错误：‘TRUE’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:145: 警告：隐式声明函数 ‘draw_box’
scripts/kconfig/lxdialog/checklist.c:146: 错误：‘struct dialog_color’ 没有名为 ‘atr’ 的成员
scripts/kconfig/lxdialog/checklist.c:146: 错误：‘struct dialog_color’ 没有名为 ‘atr’ 的成员
scripts/kconfig/lxdialog/checklist.c:147: 警告：隐式声明函数 ‘wattrset’
scripts/kconfig/lxdialog/checklist.c:147: 错误：‘struct dialog_color’ 没有名为 ‘atr’ 的成员
scripts/kconfig/lxdialog/checklist.c:148: 警告：隐式声明函数 ‘mvwaddch’
scripts/kconfig/lxdialog/checklist.c:150: 警告：隐式声明函数 ‘waddch’
scripts/kconfig/lxdialog/checklist.c:151: 错误：‘struct dialog_color’ 没有名为 ‘atr’ 的成员
scripts/kconfig/lxdialog/checklist.c:154: 警告：隐式声明函数 ‘print_title’
scripts/kconfig/lxdialog/checklist.c:156: 错误：‘struct dialog_color’ 没有名为 ‘atr’ 的成员
scripts/kconfig/lxdialog/checklist.c:157: 警告：隐式声明函数 ‘print_autowrap’
scripts/kconfig/lxdialog/checklist.c:164: 警告：隐式声明函数 ‘subwin’
scripts/kconfig/lxdialog/checklist.c:171: 错误：‘struct dialog_color’ 没有名为 ‘atr’ 的成员
scripts/kconfig/lxdialog/checklist.c:171: 错误：‘struct dialog_color’ 没有名为 ‘atr’ 的成员
scripts/kconfig/lxdialog/checklist.c:189: 警告：隐式声明函数 ‘print_item’
scripts/kconfig/lxdialog/checklist.c:192: 警告：隐式声明函数 ‘print_arrows’
scripts/kconfig/lxdialog/checklist.c:195: 警告：隐式声明函数 ‘print_buttons’
scripts/kconfig/lxdialog/checklist.c:197: 警告：隐式声明函数 ‘wnoutrefresh’
scripts/kconfig/lxdialog/checklist.c:199: 警告：隐式声明函数 ‘doupdate’
scripts/kconfig/lxdialog/checklist.c:202: 警告：隐式声明函数 ‘wgetch’
scripts/kconfig/lxdialog/checklist.c:210: 错误：‘KEY_UP’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:210: 错误：‘KEY_DOWN’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:220: 错误：‘FALSE’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:221: 警告：隐式声明函数 ‘scrollok’
scripts/kconfig/lxdialog/checklist.c:222: 警告：隐式声明函数 ‘wscrl’
scripts/kconfig/lxdialog/checklist.c:232: 警告：隐式声明函数 ‘wrefresh’
scripts/kconfig/lxdialog/checklist.c:293: 警告：隐式声明函数 ‘delwin’
scripts/kconfig/lxdialog/checklist.c:297: 错误：‘KEY_LEFT’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:298: 错误：‘KEY_RIGHT’ 未声明 (在此函数内第一次使用)
scripts/kconfig/lxdialog/checklist.c:310: 警告：隐式声明函数 ‘on_key_esc’
scripts/kconfig/lxdialog/checklist.c:312: 错误：‘KEY_RESIZE’ 未声明 (在此函数内第一次使用)
make[1]: *** [scripts/kconfig/lxdialog/checklist.o] 错误 1
make: *** [menuconfig] 错误 2

附件情况:2：scripts/kconfig/lxdialog/dialog.h:31:20: error: curses.h: 没有那个文件或目录