Domain Controller con LDAP+Samba PDC+PAM/NSS en Debian Lenny

Nota importante: este es un HOWTO, funcional 100%, muy bueno, cuando se trata de migrar una plataforma de Window$ 2003 Server a Linux Debian Lenny, con esto no tendremos que pagar mas las famosas CAL de Microsft por usuario, ni tampoco tener el dolor de cabeza de que cuando la empresa crece hay que comprar mas CAL debido a que si ya esta saturado el servidor de windwos no aceptara mas conexiones al dominio, Ya esta bueno de esto, con esta implementación no tendrá limite, su limite será su espacio en disco o que tan potente sea su servidor que va a soporta este controlador de dominio o PDC, con la cual usted podrá migrar Windows 2003 server a linux sin problemas.

Tabla de contenidos


1. Preparar Debian Lenny
2. Configurar slapd
3. Preparar Apache y PHP para phpLDAPadmin
4. PhpLDAPadmin Instalar
5. Preparar Samba
6. Smbldap Configurar herramientas
7. Configurar PAM / NSS con LDAP
8. Pruebe la configuración
9. Consejos extra
10. Otras referencias
Uso de LDAP es una de una buena solución para la base de datos de usuario único en la creación de redes del sistema híbrido, por ejemplo, integrar ambos login de usuarios para Windows y Linux, para los servicios de correo electrónico, para inicio de sesión web, y así sucesivamente. Esta guía le guiará a través de una configuración básica del sistema, incluyendo Samba PDC y PAM / NSS con LDAP en Debian Lenny. Además, puede ampliar más el uso de LDAP a otro sistema o plataforma, con esta configuración.
Preparando Debian Lenny
Antes de empezar voy a suponer que usted tiene una configuración funcional de Debian Lenny.  Instalado con los paquetes básicos y actualizado a la fecha o al máximo.
Actualizar a Debian Lenny
apt-get update
apt-get install dpkg aptitude apt
aptitude update
aptitude full-upgrade
También se recomienda la instalación de su sistema con una función de Xorg. Esto se puede completar con tasksel --new-install donde elegir, tanto entorno de escritorio y el sistema estándar. Usted también debe manual de selección, haga clic en el paquete con el fin de verificar la instalación antes de comenzar.
A continuación, instalar todos los paquetes necesarios. Usted puede saltar toda la configuración durante la instalación, pronto vamos a volver por ella:
apt-get update
apt-get install apache2-suexec libapache2-mod-php5 php5 php5-cli php5-curl php5-gd php5-imap php5-ldap php5-mcrypt php5-mhash php5-sqlite php5-tidy php5-xmlrpc php-pear slapd mcrypt ldap-utils libgd-tools apache2-doc libpam-ldap libnss-ldap resolvconf samba swat smbclient smbfs smbldap-tools
Por otra parte, si esperamos usar Samba como servidor de archivos, el archivo /etc/fstab también puede ser necesario actualizar con user_xattr y soporte ACL.
/dev/sda3       /               ext3    relatime,user_xattr,acl,errors=remount-ro 0       1
/dev/sda1       /boot           ext3    relatime,user_xattr,acl 0       2
/dev/sda2       none            swap    sw              0       0
Configurando slapd
Ejecutar dpkg-reconfigure slapd e inicializar slapd con los siguientes parámetros:

• Omit OpenLDAP server configuration? No
• DNS domain name: example.com
• Organization name: example.com
• Administrator password: CHANGE
• Database backend to use: HDB
• Do you want the database to be removed when slapd is purged? No
• Allow LDAPv2 protocol? No

Copia de seguridad de inicializar la base de datos LDAP con el siguiente comando:
slapcat > ~/slapd.ldif
Ahora, preparar el esquema LDAP de Samba:
zcat /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz > \
/etc/ldap/schema/samba.schema
Generar tu contraseña rootdn con MD5:
slappasswd -h {MD5}
Ahora copia y reemplazar sus /etc/ldap/slapd.conf con mi versión, y más aún personalizarlo de acuerdo a su configuración:
vim /etc/ldap/slapd.conf
# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.
#######################################################################
# Global Directives:
# Features to permit
#allow bind_v2
# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/samba.schema
# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile         /var/run/slapd/slapd.pid
# List of arguments that were passed to the server
argsfile        /var/run/slapd/slapd.args
# Read slapd.conf(5) for possible values
loglevel        none
# Where the dynamically loaded modules are stored
modulepath /usr/lib/ldap
moduleload back_hdb
# The maximum number of entries that is returned for a search operation
sizelimit 500
# The tool-threads parameter sets the actual amount of cpu’s that is used
# for indexing.
tool-threads 1
#######################################################################
# Specific Backend Directives for hdb:
# Backend specific directives apply to this backend until another
# ‘backend’ directive occurs
backend hdb
#######################################################################
# Specific Backend Directives for ‘other’:
# Backend specific directives apply to this backend until another
# ‘backend’ directive occurs
#backend
#######################################################################
# Specific Directives for database #1, of type hdb:
# Database specific directives apply to this databasse until another
# ‘database’ directive occurs
database        hdb
# The base of your directory in database #1
suffix          “dc=example,dc=com”
# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn          “cn=admin,dc=example,dc=com”
rootpw          {MD5}Qhz9FD5FDD9YFKBJVAngcw==
# Where the database file are physically stored for database #1
directory       “/var/lib/ldap”
# The dbconfig settings are used to generate a DB_CONFIG file the first
# time slapd starts.  They do NOT override existing an existing DB_CONFIG
# file.  You should therefore change these settings in DB_CONFIG directly
# or remove DB_CONFIG and restart slapd for changes to take effect.
# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0
# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057 for more
# information.
# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500
# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,sn,mail,givenname           eq,pres,sub
index uidNumber,gidNumber,memberUid     eq,pres
index loginShell                        eq,pres
## required to support pdb_getsampwnam
index uid                               pres,sub,eq
## required to support pdb_getsambapwrid()
index displayName                       pres,sub,eq
index nisMapName,nisMapEntry            eq,pres,sub
index sambaSID                          eq
index sambaPrimaryGroupSID              eq
index sambaDomainName                   eq
index default                           sub
index uniqueMember                      eq
index sambaGroupType                    eq
index sambaSIDList                      eq
# Save the time that the entry gets modified, for database #1
lastmod         on
# Checkpoint the BerkeleyDB database periodically in case of system
# failure and to speed slapd shutdown.
checkpoint      512 30
# Where to store the replica logs for database #1
# replogfile /var/lib/ldap/replog
# users can authenticate and change their password
access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdMustChange,sambaPwdLastSet
by self write
by anonymous auth
by * none
# those 2 parameters must be world readable for password aging to work correctly
# (or use a priviledge account in /etc/ldap.conf to bind to the directory)
access to attrs=shadowLastChange,shadowMax
by self write
by * read
# all others attributes are readable to everybody
access to *
by * read
# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=”.*,ou=Roaming,o=morsnet”
#        by dn=”cn=admin,dc=example,dc=com” write
#        by dnattr=owner write
#######################################################################
# Specific Directives for database #2, of type ‘other’ (can be hdb too):
# Database specific directives apply to this databasse until another
# ‘database’ directive occurs
#database       
# The base of your directory for database #2
#suffix “dc=debian,dc=org”
Nota importante siempre apague nscd para depurar LDAP:
/etc/init.d/nscd stop
Renueva su base de datos LDAP con el siguiente comando:
/etc/init.d/slapd stop
rm -rf /var/lib/ldap/*
slapadd -l ~/slapd.ldif
slapindex
chown -Rf openldap:openldap /var/lib/ldap
/etc/init.d/slapd start
Ahora compruebe su configuración con los slapcat
Preparando Apache y PHP para phpLDAPadmin
Antes de instalar phpLDAPadmin debemos dar una configuración básica para Apache y PHP.
Editar /etc/php5/apache2/php.ini y cambie las líneas siguientes en consecuencia:
vim /etc/php5/apache2/php.ini
memory_limit = 128M;
post_max_size = 32M
upload_max_filesize = 32M
date.timezone = “Asia/Hong_Kong”
display_errors = Off
Editar el sitio de instalación por defecto con Apache /etc/apache2/sites-enabled/000-default, y cambiar el AllowOverride none por AllowOverride all de la siguiente manera (Nota: esta configuración no es sólo para el sitio de producción):

Options Indexes FollowSymLinks MultiViews
AllowOverride all
Order allow,deny
allow from all

Ahora puedes reiniciar el Apache:
/etc/init.d/apache2 restart
Instalando phpLDAPadmin
Me gustaría ayudar a mi LDAP setup con phpLDAPadmin. En primer lugar, descargar el paquete de sourceforge.net:
http://phpldapadmin.sourceforge.net/wiki/index.php/Download
Preparando su phpLDAPadmin:
mv zxvf phpldapadmin-1.1.0.6.tar.gz /var/www/
cd /var/www
tar zxvf phpldapadmin-1.1.0.6.tar.gz
ln -s phpldapadmin-1.1.0.6 phpldapadmin
cd /var/www/phpldapadmin/config/
cp config.php.example config.php
Editar /var/www/phpldapadmin/config/config.php y descomentar las siguientes lineas:
$ldapservers->SetValue($i,’server’,'host’,'127.0.0.1′);
Ahora accesoe su phpLDAPadmin en http://localhost/phpldapadmin, y hacer login con su  rootdn. Compruebe toda la configuración.
Preparando Samba
Copiar y reemplazar sus /etc/samba/smb.conf con mi versión:
cp /etc/samba/smb.conf /etc/samba/smb.conf.original
vim /etc/samba/smb.conf
# Samba config file created using SWAT
# from ()
# Creado por Nelson Castillo J, njcastillo@gmail.com
[global]
dos charset = UTF-8
display charset = UTF-8
workgroup = EXAMPLE
realm = EXAMPLE.COM
server string = %h server
map to guest = Bad User
passdb backend = ldapsam:ldap://127.0.0.1/
pam password change = Yes
passwd program = /usr/sbin/smbldap-passwd -u %u
passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updated*
unix password sync = Yes
syslog = 0
log file = /var/log/samba/log.%m
max log size = 1000
time server = Yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
add user script = /usr/sbin/smbldap-useradd -m %u
delete user script = /usr/sbin/smbldap-userdel %u
add group script = /usr/sbin/smbldap-groupadd -p %g
delete group script = /usr/sbin/smbldap-groupdel %g
add user to group script = /usr/sbin/smbldap-groupmod -m %u %g
delete user from group script = /usr/sbin/smbldap-groupmod -x %u %g
set primary group script = /usr/sbin/smbldap-usermod -g %g %u
add machine script = /usr/sbin/smbldap-useradd -w %u
logon script = logon.bat
logon path = \\%N\profiles\%U
logon drive = U:
domain logons = Yes
os level = 65
preferred master = Yes
domain master = Yes
dns proxy = No
wins support = Yes
ldap admin dn = cn=admin,dc=example,dc=com
ldap delete dn = Yes
ldap group suffix = ou=group
ldap idmap suffix = ou=idmap
ldap machine suffix = ou=computer
ldap suffix = dc=example,dc=com
ldap ssl = no
ldap user suffix = ou=people
panic action = /usr/share/samba/panic-action %d
map acl inherit = Yes
case sensitive = No
hide unreadable = Yes
map hidden = Yes
map system = Yes
[homes]
comment = Home Directories
valid users = %S
read only = No
create mask = 0600
directory mask = 0700
browseable = No
[printers]
comment = All Printers
path = /var/spool/samba
create mask = 0700
printable = Yes
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
[netlogon]
path = /var/lib/samba/netlogon
browseable = No
[profiles]
path = /var/lib/samba/profiles
force user = %U
read only = No
create mask = 0600
directory mask = 0700
guest ok = Yes
profile acls = Yes
browseable = No
csc policy = disable
[public]
path = /tmp
read only = No
guest ok = Yes
Ahora, abra Samba SWAT desde un web browser a la dirección http://localhost:901, y cambie todos los parámetros requeridos para su configuración y adaptarlo a su necesidades, como  workgroup, nombre del dominio y realm, etc.
Configurar su contraseña de LDAP para Samba:
Nota: CHANGE será su password
smbpasswd -w CHANGE
Crear directorios para Netlogon y perfiles:
mkdir -p /var/lib/samba/netlogon /var/lib/samba/profiles
chown -Rf root:root /var/lib/samba/netlogon /var/lib/samba/profiles
chmod 1777 /var/lib/samba/profiles
Reiniciar Samba con el siguiente comando:
/etc/init.d/samba restart
Pon a prueba tu archivo de configuración de Samba con el comando testparm, y comprobar si hay algún mensaje de error.
Configurando smbldap-tools
Preparando smbldap-tools archivos de configuración:
zcat /usr/share/doc/smbldap-tools/examples/smbldap.conf.gz > \
/etc/smbldap-tools/smbldap.conf
cp /usr/share/doc/smbldap-tools/examples/smbldap_bind.conf \
/etc/smbldap-tools/smbldap_bind.conf
Consigue tu Samba SID para /etc/smbldap-tools/smbldap.conf:
net getlocalsid
Reemplace su /etc/smbldap-tools/smbldap.conf con mi versión, y más aún actualización de acuerdo a sus necesidades (Nota: recuerde sustituir el SID con su SID obtendo con net getlocalsid):
vim /etc/smbldap-tools/smbldap.conf
# $Source: $
# $Id: smbldap.conf,v 1.18 2005/05/27 14:28:47 jtournier Exp $
#
# smbldap-tools.conf : Q & D configuration file for smbldap-tools
#  This code was developped by IDEALX (http://IDEALX.org/) and
#  contributors (their names can be found in the CONTRIBUTORS file).
#
#                 Copyright (C) 2001-2002 IDEALX
#
#  This program is free software; you can redistribute it and/or
#  modify it under the terms of the GNU General Public License
#  as published by the Free Software Foundation; either version 2
#  of the License, or (at your option) any later version.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to the Free Software
#  Foundation, Inc., 59 Temple Place – Suite 330, Boston, MA 02111-1307,
#  USA.
#  Purpose :
#       . be the configuration file for all smbldap-tools scripts
##############################################################################
#
# General Configuration
#
##############################################################################
# Put your own SID. To obtain this number do: “net getlocalsid”.
# If not defined, parameter is taking from “net getlocalsid” return
SID=”S-1-5-21-1169193956-4199179787-2206793627″
# Domain name the Samba server is in charged.
# If not defined, parameter is taking from smb.conf configuration file
# Ex: sambaDomain=”IDEALX-NT”
sambaDomain=”EXAMPLE”
##############################################################################
#
# LDAP Configuration
#
##############################################################################
# Notes: to use to dual ldap servers backend for Samba, you must patch
# Samba with the dual-head patch from IDEALX. If not using this patch
# just use the same server for slaveLDAP and masterLDAP.
# Those two servers declarations can also be used when you have
# . one master LDAP server where all writing operations must be done
# . one slave LDAP server where all reading operations must be done
#   (typically a replication directory)
# Slave LDAP server
# Ex: slaveLDAP=127.0.0.1
# If not defined, parameter is set to “127.0.0.1″
slaveLDAP=”127.0.0.1″
# Slave LDAP port
# If not defined, parameter is set to “389″
slavePort=”389″
# Master LDAP server: needed for write operations
# Ex: masterLDAP=127.0.0.1
# If not defined, parameter is set to “127.0.0.1″
masterLDAP=”127.0.0.1″
# Master LDAP port
# If not defined, parameter is set to “389″
masterPort=”389″
# Use TLS for LDAP
# If set to 1, this option will use start_tls for connection
# (you should also used the port 389)
# If not defined, parameter is set to “1″
ldapTLS=”0″
# How to verify the server’s certificate (none, optional or require)
# see “man Net::LDAP” in start_tls section for more details
verify=”require”
# CA certificate
# see “man Net::LDAP” in start_tls section for more details
cafile=”/etc/smbldap-tools/ca.pem”
# certificate to use to connect to the ldap server
# see “man Net::LDAP” in start_tls section for more details
clientcert=”/etc/smbldap-tools/smbldap-tools.pem”
# key certificate to use to connect to the ldap server
# see “man Net::LDAP” in start_tls section for more details
clientkey=”/etc/smbldap-tools/smbldap-tools.key”
# LDAP Suffix
# Ex: suffix=dc=IDEALX,dc=ORG
suffix=”dc=example,dc=com”
# Where are stored Users
# Ex: usersdn=”ou=Users,dc=IDEALX,dc=ORG”
# Warning: if ’suffix’ is not set here, you must set the full dn for usersdn
usersdn=”ou=people,${suffix}”
# Where are stored Computers
# Ex: computersdn=”ou=Computers,dc=IDEALX,dc=ORG”
# Warning: if ’suffix’ is not set here, you must set the full dn for computersdn
computersdn=”ou=computer,${suffix}”
# Where are stored Groups
# Ex: groupsdn=”ou=Groups,dc=IDEALX,dc=ORG”
# Warning: if ’suffix’ is not set here, you must set the full dn for groupsdn
groupsdn=”ou=group,${suffix}”
# Where are stored Idmap entries (used if samba is a domain member server)
# Ex: groupsdn=”ou=Idmap,dc=IDEALX,dc=ORG”
# Warning: if ’suffix’ is not set here, you must set the full dn for idmapdn
idmapdn=”ou=idmap,${suffix}”
# Where to store next uidNumber and gidNumber available for new users and groups
# If not defined, entries are stored in sambaDomainName object.
# Ex: sambaUnixIdPooldn=”sambaDomainName=${sambaDomain},${suffix}”
# Ex: sambaUnixIdPooldn=”cn=NextFreeUnixId,${suffix}”
sambaUnixIdPooldn=”sambaDomainName=${sambaDomain},${suffix}”
# Default scope Used
scope=”sub”
# Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT)
hash_encrypt=”MD5″
# if hash_encrypt is set to CRYPT, you may set a salt format.
# default is “%s”, but many systems will generate MD5 hashed
# passwords if you use “$1$%.8s”. This parameter is optional!
crypt_salt_format=”%s”
##############################################################################
#
# Unix Accounts Configuration
#
##############################################################################
# Login defs
# Default Login Shell
# Ex: userLoginShell=”/bin/bash”
userLoginShell=”/bin/bash”
# Home directory
# Ex: userHome=”/home/%U”
userHome=”/home/%U”
# Default mode used for user homeDirectory
userHomeDirectoryMode=”700″
# Gecos
userGecos=”System User”
# Default User (POSIX and Samba) GID
defaultUserGid=”513″
# Default Computer (Samba) GID
defaultComputerGid=”515″
# Skel dir
skeletonDir=”/etc/skel”
# Default password validation time (time in days) Comment the next line if
# you don’t want password to be enable for defaultMaxPasswordAge days (be
# careful to the sambaPwdMustChange attribute’s value)
defaultMaxPasswordAge=”365″
##############################################################################
#
# SAMBA Configuration
#
##############################################################################
# The UNC path to home drives location (%U username substitution)
# Just set it to a null string if you want to use the smb.conf ‘logon home’
# directive and/or disable roaming profiles
# Ex: userSmbHome=”\\PDC-SMB3\%U”
userSmbHome=”"
# The UNC path to profiles locations (%U username substitution)
# Just set it to a null string if you want to use the smb.conf ‘logon path’
# directive and/or disable roaming profiles
# Ex: userProfile=”\\PDC-SMB3\profiles\%U”
userProfile=”"
# The default Home Drive Letter mapping
# (will be automatically mapped at logon time if home directory exist)
# Ex: userHomeDrive=”H:”
userHomeDrive=”U:”
# The default user netlogon script name (%U username substitution)
# if not used, will be automatically username.cmd
# make sure script file is edited under dos
# Ex: userScript=”startup.cmd” # make sure script file is edited under dos
userScript=”logon.bat”
# Domain appended to the users “mail”-attribute
# when smbldap-useradd -M is used
# Ex: mailDomain=”idealx.com”
mailDomain=”example.com”
##############################################################################
#
# SMBLDAP-TOOLS Configuration (default are ok for a RedHat)
#
##############################################################################
# Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but
# prefer Crypt::SmbHash library
with_smbpasswd=”0″
smbpasswd=”/usr/bin/smbpasswd”
# Allows not to use slappasswd (if with_slappasswd == 0 in smbldap_conf.pm)
# but prefer Crypt:: libraries
with_slappasswd=”0″
slappasswd=”/usr/sbin/slappasswd”
# comment out the following line to get rid of the default banner
# no_banner=”1″
Update /etc/smbldap-tools/smbldap_bind.conf as below:
############################
# Credential Configuration #
############################
# Notes: you can specify two differents configuration if you use a
# master ldap for writing access and a slave ldap server for reading access
# By default, we will use the same DN (so it will work for standard Samba
# release)
slaveDN=”cn=admin,dc=example,dc=com”
slavePw=”CHANGE”
masterDN=”cn=admin,dc=example,dc=com”
masterPw=”CHANGE”
Cambiar la configuración con permisos correctos:
chmod 0644 /etc/smbldap-tools/smbldap.conf
chmod 0600 /etc/smbldap-tools/smbldap_bind.conf
Ahora puedes llenar tu Samba esquema LDAP:
smbldap-populate
No se olvide de hacer copia de seguridad de su base de datos más recientes de LDAP:
slapcat > ~/smbldap.ldif
Configurando PAM/NSS con LDAP
Reconfigurar  libnss-ldap con el siguiente comando dpkg-reconfigure libnss-ldap:

• LDAP server Uniform Resource Identifier: ldap://127.0.0.1
• Distinguished name of the search base: dc=example,dc=com
• LDAP version to use: 3
• Does the LDAP database require login? No
• Special LDAP privileges for root? Yes
• Make the configuration file readable/writeable by its owner only? Yes
• LDAP account for root: cn=admin,dc=example,dc=com
• LDAP root account password: CHANGE

Actualizar /etc/nsswitch.conf como ve a continuación:
vim /etc/nsswitch.conf
passwd: files ldap
group: files ldap
shadow: files ldap
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4 ldap
Añada las siguientes líneas a /etc/ldap/ldap.conf para los clientes LDAP:
vim /etc/ldap/ldap.conf
host localhost
base dc=example,dc=com
binddn cn=admin,dc=example,dc=com
bindpw CHANGE
bind_policy soft
pam_password exop
timelimit 15
nss_base_passwd dc=example,dc=com?sub
nss_base_shadow dc=example,dc=com?sub
nss_base_group ou=group,dc=example,dc=com?one
Modificar las siguientes líneas a /etc/libnss-ldap.conf:
bind_policy soft
pam_password md5
nss_base_passwd dc=example,dc=com?sub
nss_base_shadow dc=example,dc=com?sub
nss_base_group ou=group,dc=example,dc=com?one
Revise su /etc/libnss-ldap.secret:
cat /etc/libnss-ldap.secret
Reconfigurar libpam-ldap con las siguientes dpkg-reconfigure libpam-ldap:

• LDAP server Uniform Resource Identifier: ldap://127.0.0.1
• Distinguished name of the search base: dc=hkmadavidli,dc=edu,dc=hk
• LDAP version to use: 3
• Make local root Database admin. Yes
• Does the LDAP database require login? No
• LDAP account for root: cn=admin,dc=example,dc=com
• LDAP root account password: CHANGE
• Local crypt to use when changing passwords. MD5
• (UPDATE 2009-05-09, only available after pam 1.0.1-6) PAM profiles to enable: Unix authentication, LDAP Authentication

Modificar las siguientes líneas a /etc/pam_ldap.conf:
vim /etc/pam_ldap.conf:
bind_policy soft
pam_password md5
nss_base_passwd dc=example,dc=com?sub
nss_base_shadow dc=example,dc=com?sub
nss_base_group ou=group,dc=example,dc=com?one
Revise su /etc/pam_ldap.secret:
cat /etc/pam_ldap.secret
(UPDATE 2009-05-09, only available after pam 1.0.1-6) Refer to /etc/pam.d/common-account comment:
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
Por defecto, Debian Lenny ya viene con la configuración de LDAP correcta con respecto de /usr/share/pam-configs/ldap:
vim /usr/share/pam-configs/ldap
Name: LDAP Authentication
Default: yes
Priority: 128
Auth-Type: Primary
Auth-Initial:
[success=end default=ignore]    pam_ldap.so
Auth:
[success=end default=ignore]    pam_ldap.so use_first_pass
Account-Type: Primary
Account:
[success=end default=ignore]    pam_ldap.so
Password-Type: Primary
Password-Initial:
[success=end user_unknown=ignore default=die]   pam_ldap.so
Password:
[success=end user_unknown=ignore default=die]   pam_ldap.so use_authtok try_first_pass
Session-Type: Additional
Session:
optional                        pam_ldap.so
Si seguido este manual hasta aquí, su libpam-LDAP debería ya configurado correctamente, de lo contrario, ejec utar la actualización manualmente pam-auth.
Actualice su /etc/pam.d/common-account como ve a continuación:
# here are the per-package modules (the “Primary” block)
account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.so
account [success=1 default=ignore]      pam_ldap.so
# here’s the fallback if no module succeeds
account requisite                       pam_deny.so
# prime the stack with a positive return value if there isn’t one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required                        pam_permit.so
# and here are more per-package modules (the “Additional” block)
Update your /etc/pam.d/common-auth as below:
# here are the per-package modules (the “Primary” block)
auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass
# here’s the fallback if no module succeeds
auth    requisite                       pam_deny.so
# prime the stack with a positive return value if there isn’t one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
Actualiza tu /etc/pam.d/common-password como abajo (no utilizar use_authtok para pam_ldap.so, véase http://ubuntuforums.org/archive/index.php/t-156071.html):
# here are the per-package modules (the “Primary” block)
password        [success=2 default=ignore]      pam_unix.so obscure md5
password        [success=1 user_unknown=ignore default=die]     pam_ldap.so use_authtok try_first_pass
# here’s the fallback if no module succeeds
password        requisite                       pam_deny.so
# prime the stack with a positive return value if there isn’t one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password        required                        pam_permit.so
# and here are more per-package modules (the “Additional” block)
Actualiza tu /etc/pam.d/common-session como se ve a continuacion:
# here are the per-package modules (the “Primary” block)
session [default=1]                     pam_permit.so
# here’s the fallback if no module succeeds
session requisite                       pam_deny.so
# prime the stack with a positive return value if there isn’t one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required                        pam_permit.so
# and here are more per-package modules (the “Additional” block)
session required                        pam_unix.so
session optional                        pam_ldap.so
Durante el arranque del sistema puede surgir algún error de non-exists users/groups de NSS , por favor ver solución aquí (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412989). Quick fix it with create according users/groups in /etc/passwd and /etc/groups so will not check from LDAP before slapd start:
addgroup –system nvram
addgroup –system rdma
addgroup –system fuse
addgroup –system kvm
adduser –system –group –shell /usr/sbin/nologin –home /var/lib/tpm tss
bind_policy suave puede acelerar el paso, aunque de estos mensaje de error
Reinicie su sistema Debian y depuración para cualquier mensaje de error: D
Pruebe la configuración
Crear un usuario demo con smbldap-tools:
smbldap-useradd -a -m postmaster
smbldap-passwd postmaster
Revisa tu usuario y la búsqueda de grupo. Usted debe encontrar el registro de LDAP en consecuencia:
getent passwd
getent group
Ahora cerrar la sesión y acceder a su sistema Debian con la cuenta de nuevo usuario LDAP. Tras haberse identificado correctamente, consulte su directorio personal con discapacidad. Debe esta ahora  todo bien.
Es hora de probar la combinación de dominio de Windows. BTW, este no es el punto clave para el Linux, así que se saltará aquí.
Después de unirse a tu Windows a este dominio de Samba, la conexión con su cuenta de usuario LDAP. Una vez más, debería estar todo bien: D
Consejos extra

1. Can’t join Windows XP into domain (No se puede unir al dominio de Windows XP)
   Check if nss_base_passwd ou=computer,dc=example,dc=com?one exists in your PAM/NSS setup (or using nss_base_passwd dc=example,dc=com?sub as above, but may come with some performance degrade).

Also, someone report that /var/lib/samba/secrets.tdb may corrupted and so can’t join domain correctly. Remove it and redo smbpasswd -w CHANGE, e.g.:
/etc/init.d/samba stop
rm -rf /var/lib/samba/secrets.tdb /var/lib/samba/schannel_store.tdb /var/cache/samba/*
smbpasswd -w CHANGE
/etc/init.d/samba start

1. SID must setup correctly (SID debe configurar correctamente)
   No se olvide de la red de getlocalsid y sustituya el plazo de /etc/smbldap-tools/smbldap.conf
2. root must be uidnumber = 0
   Esto está documentado en smbldap-tools HOWTO. Si se cambia esta en smbldap-populate Windows XP no pueda reunirse de dominio.
3. Can’t use net getlocalsid after passdb backend = ldapsam
   Can use net rpc info instead.

Enlaces de ayuda adiccional:
version original en ingles:
http://edin.no-ip.com/content/ldap-samba-pdc-pamnss-debian-lenny-howto
Otros enlaces
http://www.esdebian.org/wiki/controlador-primario-dominio-pdc-debian-lenny-50-mediante-samba-pamnss-openldap
http://jroliva.wordpress.com/samba-ldap-debian-40-etch/