AD統合を備えたLinuxプリントサーバー

 [libdefaults] ticket_lifetime = 24000 default_realm = INITIAL.LOCAL dns_lookup_realm = false dns_lookup_kds = false clockskew = 300 # ------------------------------------- kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true [realms] INITIAL.LOCAL = { kdc = dc-01.initial.local default_domain = initial.local # admin_server = kerberos.initial.local:749 admin_server = dc-01.initial.local } # EXAMPLE.COM = { # kdc = kerberos.example.com # admin_server = kerberos.example.com # } [logging] kdc = FILE:/var/log/krb5/krb5kdc.log admin_server = FILE:/var/log/krb5/kadmind.log default = SYSLOG:NOTICE:DAEMON [domain_realm] .initial.local = INITIAL.LOCAL .INITIAL.local = INITIAL.LOCAL .INITIAL = INITIAL.LOCAL initial.local = INITIAL.LOCAL [appdefaults] pam = { debug = false ticket_lifetime = 1d renew_lifetime = 1d forwardable = true proxiable = false retain_after_close = false minimum_uid = 1 use_shmem = sshd clockskew = 300 } 

 # /etc/nsswitch.conf # # An example Name Service Switch config file. This file should be # sorted with the most-used services at the beginning. # # The entry '[NOTFOUND=return]' means that the search for an # entry should stop if the search in the previous entry turned # up nothing. Note that if the search failed due to some other reason # (like no NIS server responding) then the search continues with the # next entry. # # Legal entries are: # # compat Use compatibility setup # nisplus Use NIS+ (NIS version 3) # nis Use NIS (NIS version 2), also called YP # dns Use DNS (Domain Name Service) # files Use the local files # [NOTFOUND=return] Stop searching if not found so far # # For more information, please read the nsswitch.conf.5 manual page. # # passwd: files nis # shadow: files nis # group: files nis # passwd: compat winbind # group: compat winbind # shadow: compat winbind passwd: files winbind group: files winbind shadow: files winbind # hosts: files mdns4_minimal [NOTFOUND=return] dns wins hosts: files [dns] wins networks: files dns services: files protocols: files rpc: files ethers: files netmasks: files netgroup: files nis publickey: files bootparams: files automount: files nis aliases: files 

 # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example,dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never URI ldap://10.10.15.31 BASE DC=initial,DC=local 

 # smb.conf is the main Samba configuration file. You find a full commented # version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE if the # samba-doc package is installed. [global] workgroup = INITIAL # passdb backend = smbpasswd printing = cups printcap name = cups printcap cache time = 750 cups options = raw map to guest = Bad User logon path = \\%L\profiles\.msprofile logon home = \\%L\%U\.9xprofile logon drive = P: usershare allow guests = Yes add machine script = /usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %m$ domain logons = No domain master = No security = ADS encrypt passwords = yes # idmap backend = ldap:ldap://10.10.15.31 ldap admin dn = admin@initial.local ldap group suffix = ou=Groups ldap idmap suffix = ou=Idmap ldap machine suffix = ou=Computers ldap passwd sync = Yes ldap suffix = DC=initial,DC=local ldap user suffix = ou=Users ldap ssl = Off ldapsam:trusted = yes ldapsam:editposix = yes # idmap gid = 500-10000000 # idmap uid = 500-10000000 netbios name = print-01 name resolve order = lmhost wins host bcast wins server = 10.10.15.31 wins support = No usershare max shares = 100 kerberos method = system keytab ## -------------------------------------- winbind separator = / winbind enum users = yes winbind enum groups = yes winbind nested groups = yes winbind use default domain = yes winbind nss info = rfc2307 winbind uid = 10000-20000 winbind gid = 10000-20000 realm = INITIAL.LOCAL template homedir = /home/%D/%U winbind refresh tickets = yes template shell = /bin/bash # [homes] # comment = Home Directories # valid users = %S, %D%w%S # browseable = No # read only = No # inherit acls = Yes # [profiles] # comment = Network Profiles Service # path = %H # read only = No # store dos attributes = Yes # create mask = 0600 # directory mask = 0700 # [users] # comment = All users # path = /home # read only = No # inherit acls = Yes # veto files = /aquota.user/groups/shares/ # guest ok = No # [groups] # comment = All groups # path = /home/groups # read only = No # inherit acls = Yes [printers] comment = All Printers path = /var/spool/samba printable = Yes create mask = 0664 browseable = Yes read only = No guest ok = Yes [print$] comment = Printer Drivers path = /var/lib/samba/drivers write list = @ntadmin root force group = ntadmin create mask = 0664 directory mask = 0700 read only = No guest ok = Yes writable = yes # inherit permissions = yes # -------------------------------- use client driver = yes # [netlogon] 

 LogLevel debug SystemGroup root # Allow remote access Port 631 Listen /run/cups/cups.sock Browsing On BrowseLocalProtocols CUPS BrowseRemoteProtocols CUPS BrowseOrder allow,deny BrowseAllow all BrowseAddress 10.10.15.0/24 BrowseAddress 172.19.2.0/24 BrowseAddress 172.19.3.0/24 BrowseAddress 172.19.4.0/24 DefaultAuthType Basic WebInterface Yes <Location /> # Allow remote access... Order allow,deny Allow all </Location> <Location /admin> Order deny,allow </Location> <Location /admin/conf> AuthType Default Require user @SYSTEM </Location> <Policy default> JobPrivateAccess default JobPrivateValues default SubscriptionPrivateAccess default SubscriptionPrivateValues default <Limit Create-Job Print-Job Print-URI Validate-Job> Order deny,allow </Limit> <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document> Require user @OWNER @SYSTEM Order deny,allow </Limit> <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices> AuthType Default Require user @SYSTEM Order deny,allow </Limit> <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs> AuthType Default Require user @SYSTEM Order deny,allow </Limit> <Limit Cancel-Job CUPS-Authenticate-Job> Require user @OWNER @SYSTEM Order deny,allow </Limit> <Limit All> Order deny,allow </Limit> </Policy> <Policy authenticated> JobPrivateAccess default JobPrivateValues default SubscriptionPrivateAccess default SubscriptionPrivateValues default <Limit Create-Job Print-Job Print-URI Validate-Job> AuthType Default Order deny,allow </Limit> <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document> AuthType Default Require user @OWNER @SYSTEM Order deny,allow </Limit> <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default> AuthType Default Require user @SYSTEM Order deny,allow </Limit> <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs> AuthType Default Require user @SYSTEM Order deny,allow </Limit> <Limit Cancel-Job CUPS-Authenticate-Job> AuthType Default Require user @OWNER @SYSTEM Order deny,allow </Limit> <Limit All> Order deny,allow </Limit> </Policy> <Policy allowallforanybody> JobPrivateAccess all JobPrivateValues none SubscriptionPrivateAccess all SubscriptionPrivateValues none <Limit All Validate-Job Cancel-Jobs Cancel-My-Jobs Close-Job CUPS-Get-Document> Order deny,allow Allow from all </Limit> </Policy> DefaultPolicy default