Note Technique

Date

Classement

Page

1/30

Rédacteur :

Fabrice SCEMAMA

Historique

Version

Date

Modifications

1.0

22/05/2009

Version Initiale

1.1

25/05/2009

Précisions /etc/security/user ; corrections mineures.

1.2

02/06/2009

Cache time augmenté dans /etc/smb.conf, de 10 à 300.

1.3

02/07/2009

Corrections mineures.

1.4

15/07/2009

Contournement de la limitation SSH + AD => compte « gotelnet ».

Toutes opérations en tant que root.

cd /mnt/SRC-STORE1/AIX_AD/AIX-5.3-CD4

installp -Y –aqXgd . ldap.client

Doit renvoyer ceci :

+—————————————————————————–+

Pre-installation Verification…

+—————————————————————————–+

Verifying selections…done

Verifying requisites…done

Results…

SUCCESSES

———

Filesets listed in this section passed pre-installation verification

and will be installed.

Selected Filesets

—————–

ldap.client.adt 5.2.0.0 # Directory Client SDK

ldap.client.rte 5.2.0.0 # Directory Client Runtime (No…

<< End of Success Section >>

+—————————————————————————–+

BUILDDATE Verification …

+—————————————————————————–+

Verifying build dates…done

FILESET STATISTICS

——————

2 Selected to be installed, of which:

2 Passed pre-installation verification

—-

2 Total to be installed

+—————————————————————————–+

Installing Software…

+—————————————————————————–+

installp: APPLYING software for:

ldap.client.rte 5.2.0.0

ldap.client.adt 5.2.0.0

. . . . . << Copyright notice for ldap.client >> . . . . . . .

Licensed Materials – Property of IBM

5765F2400

(C) Copyright International Business Machines Corp. 1997, 2002.

Copyright (c) 1995,1996 Regents of the University of Michigan.

All rights reserved.

Redistribution and use in source and binary forms are permitted

provided that this notice is preserved and that due credit is given

to the University of Michigan at Ann Arbor. The name of the University

may not be used to endorse or promote products derived from this

software without specific prior written permission. This software

is provided « as is'' without express or implied warranty.

All rights reserved.

US Government Users Restricted Rights – Use, duplication or disclosure

restricted by GSA ADP Schedule Contract with IBM Corp.

. . . . . << End of copyright notice for ldap.client >>. . . .

Finished processing all filesets. (Total time: 18 secs).

+—————————————————————————–+

Summaries:

+—————————————————————————–+

Installation Summary

——————–

Name Level Part Event Result

——————————————————————————-

ldap.client.rte 5.2.0.0 USR APPLY SUCCESS

ldap.client.adt 5.2.0.0 USR APPLY SUCCESS

ldap.client.rte 5.2.0.0 ROOT APPLY SUCCESS

• mkdir /apps/src
  
  • mv /usr/src/* /apps/src
    
  • rmdir /usr/src
    
  • ln –s /apps/src /usr/.

Au fil des installations et des compilations, on va stocker de gros volumes dans /usr/src. En l'espèce, et sur MYSERVER, l'espace dédié aux applications sembait être /apps ; on l'utilise donc pour nos travaux – mais sans perdre de vue que le standard est de compiler dans /usr/src.

• cd /usr/src
  
  • mkdir NAS_v1.4.0.8
    
  • cd NAS_v1.4.0.8
    
  • zcat /mnt/SRC-STORE1/AIX_AD/AIX-Extension_Pack/NAS_v1.4.0.8.tar.Z | tar xvf –
    
  • chown –R root:system *
    
  • mv images/* .
    
  • rmdir images
    
  • installp -Y -aqXgd . krb5.client

Ces commandes vont installer le client Kerberos d'IBM dans le répertoire /usr/krb5.

L'installation doit renvoyer :

+—————————————————————————–+

Pre-installation Verification…

+—————————————————————————–+

Verifying selections…done

Verifying requisites…done

Results…

SUCCESSES

———

Filesets listed in this section passed pre-installation verification

and will be installed.

Selected Filesets

—————–

krb5.client.rte 1.4.0.8 # Network Authentication Servi…

krb5.client.samples 1.4.0.8 # Network Authentication Servi…

<< End of Success Section >>

+—————————————————————————–+

BUILDDATE Verification …

+—————————————————————————–+

Verifying build dates…done

FILESET STATISTICS

——————

2 Selected to be installed, of which:

2 Passed pre-installation verification

—-

2 Total to be installed

LICENSE AGREEMENT FAILURES

——————

The software you have selected for installation contains license

agreement(s) that must be accepted before proceeding. Failure to accept

the license terms will prevent the installation of the software.

Accept the license agreement(s) by selecting "yes" in the

"Accept new license agreements" field or by specifying

the -Y option to the installp command.

Filesets Requiring Software License Acceptance

———————————————-

krb5.client.rte

/usr/src/NAS_v1.4.0.8 # installp -Y -aqXgd . krb5.client

+—————————————————————————–+

Pre-installation Verification…

+—————————————————————————–+

Verifying selections…done

Verifying requisites…done

Results…

SUCCESSES

———

Filesets listed in this section passed pre-installation verification

and will be installed.

Selected Filesets

—————–

krb5.client.rte 1.4.0.8 # Network Authentication Servi…

krb5.client.samples 1.4.0.8 # Network Authentication Servi…

<< End of Success Section >>

+—————————————————————————–+

BUILDDATE Verification …

+—————————————————————————–+

Verifying build dates…done

FILESET STATISTICS

——————

2 Selected to be installed, of which:

2 Passed pre-installation verification

—-

2 Total to be installed

+—————————————————————————–+

Installing Software…

+—————————————————————————–+

installp: APPLYING software for:

krb5.client.rte 1.4.0.8

krb5.client.samples 1.4.0.8

. . . . . << Copyright notice for krb5.client >> . . . . . . .

Licensed Materials – Property of IBM

5639N8700

(C) Copyright International Business Machines Corp. 2000, 2004.

(C) Copyright Regents of the University of California 1983, 1993.

(C) Copyright The University of Southern California 1994.

(C) Copyright Cygnus Support 1995.

(C) Copyright CyberSAFE Corporation 1994.

(C) Copyright Dennis Ferguson 1990.

(C) Copyright FundsXpress Inc. 1998.

(C) Copyright Gary S. Brown 1986.

(C) Copyright Hewlett-Packard Company 1991.

(C) Copyright Lehman Brothers, Inc. 1995.

(C) Copyright Locus Computing Corporation 1995.

(C) Copyright Massachusetts Institute of Technology 1985, 2004.

(C) Copyright 1984, 1987, 1996 Sun Microsystems, Inc.

(C) Copyright 2002 Naval Research Laboratory (NRL/CCS).

(C) Copyright 1993 Open Computing Security Group.

(C) Copyright 1997, 1998 The NetBSD Foundation, Inc.

(C) Copyright 2000 by Zero-Knowledge Systems, Inc.

(C) Copyright 2001, Dr Brian Gladman <brg@gladman.uk.net>, Worcester, UK.

(C) Copyright 2000 by Computer Science Laboratory, Rensselaer Polytechnic Ins

titute.

(C) Copyright OpenVision Technologies, Inc. 1995, 1996

(C) Copyright Richard P. Basch 1995.

(C) Copyright RSA Data Security, Inc. 1990.

(C) Copyright Student Information Processing Board of the Massachusetts Insti

tute of Technology 1987, 1989.

(C) Copyright Regents of The University of Michigan 1990.

All rights reserved.

US Government Users Restricted Rights – Use, duplication or disclosure

restricted by GSA ADP Schedule Contract with IBM Corp.

. . . . . << End of copyright notice for krb5.client >>. . . .

Finished processing all filesets. (Total time: 9 secs).

+—————————————————————————–+

Summaries:

+—————————————————————————–+

Installation Summary

——————–

Name Level Part Event Result

——————————————————————————-

krb5.client.rte 1.4.0.8 USR APPLY SUCCESS

krb5.client.samples 1.4.0.8 USR APPLY SUCCESS

krb5.client.rte 1.4.0.8 ROOT APPLY SUCCESS

installp -Y -aqXgd . krb5.toolkit

2e partie du package NAS.

L'installation doit renvoyer :

+—————————————————————————–+

Pre-installation Verification…

+—————————————————————————–+

Verifying selections…done

Verifying requisites…done

Results…

SUCCESSES

———

Filesets listed in this section passed pre-installation verification

and will be installed.

Selected Filesets

—————–

krb5.toolkit.adt 1.4.0.8 # Network Authentication Servi…

<< End of Success Section >>

+—————————————————————————–+

BUILDDATE Verification …

+—————————————————————————–+

Verifying build dates…done

FILESET STATISTICS

——————

1 Selected to be installed, of which:

1 Passed pre-installation verification

—-

1 Total to be installed

+—————————————————————————–+

Installing Software…

+—————————————————————————–+

installp: APPLYING software for:

krb5.toolkit.adt 1.4.0.8

. . . . . << Copyright notice for krb5.toolkit >> . . . . . . .

Licensed Materials – Property of IBM

5639N8700

(C) Copyright International Business Machines Corp. 2000, 2004.

(C) Copyright Regents of the University of California 1983, 1993.

(C) Copyright The University of Southern California 1994.

(C) Copyright Cygnus Support 1995.

(C) Copyright CyberSAFE Corporation 1994.

(C) Copyright Dennis Ferguson 1990.

(C) Copyright FundsXpress Inc. 1998.

(C) Copyright Gary S. Brown 1986.

(C) Copyright Hewlett-Packard Company 1991.

(C) Copyright Lehman Brothers, Inc. 1995.

(C) Copyright Locus Computing Corporation 1995.

(C) Copyright Massachusetts Institute of Technology 1985, 2004.

(C) Copyright 1984, 1987, 1996 Sun Microsystems, Inc.

(C) Copyright 2002 Naval Research Laboratory (NRL/CCS).

(C) Copyright 1993 Open Computing Security Group.

(C) Copyright 1997, 1998 The NetBSD Foundation, Inc.

(C) Copyright 2000 by Zero-Knowledge Systems, Inc.

(C) Copyright 2001, Dr Brian Gladman <brg@gladman.uk.net>, Worcester, UK.

(C) Copyright 2000 by Computer Science Laboratory, Rensselaer Polytechnic Ins

titute.

(C) Copyright OpenVision Technologies, Inc. 1995, 1996

(C) Copyright Richard P. Basch 1995.

(C) Copyright RSA Data Security, Inc. 1990.

(C) Copyright Student Information Processing Board of the Massachusetts Insti

tute of Technology 1987, 1989.

(C) Copyright Regents of The University of Michigan 1990.

All rights reserved.

US Government Users Restricted Rights – Use, duplication or disclosure

restricted by GSA ADP Schedule Contract with IBM Corp.

. . . . . << End of copyright notice for krb5.toolkit >>. . . .

Finished processing all filesets. (Total time: 2 secs).

+—————————————————————————–+

Summaries:

+—————————————————————————–+

Installation Summary

——————–

Name Level Part Event Result

——————————————————————————-

krb5.toolkit.adt 1.4.0.8 USR APPLY SUCCESS

• cd /usr
  
  • if [ -e krb5.NAS ]; then ln –s krb5.NAS krb5; fi

YMMV

Toutes opérations en tant que root.

• mkdir /apps/freeware
  
  • ln –s /apps/freeware /opt/.

Par défaut, les modules du AIX Toolbox for Linux s'installent dans /opt/freeware. Nous manquons d'espace dans ce répertoire ; là encore, le /apps semble l'endroit approprié.

• cd /mnt/SRC-STORE1/AIX_AD/AIX-Toolbox_For_Linux_Apps
  
  • installp –Y -qacXgd rpm.rte rpm.rte

Installation de RPM (RedHat Package Manager). L'installation doit renvoyer :

+—————————————————————————-

Pre-installation Verification…

+—————————————————————————-

Verifying selections…done

Verifying requisites…done

Results…

SUCCESSES

———

Filesets listed in this section passed pre-installation verification

and will be installed.

Selected Filesets

—————–

rpm.rte 3.0.5.47 # RPM Package Manager

<< End of Success Section >>

+—————————————————————————-

BUILDDATE Verification …

+—————————————————————————-

Verifying build dates…done

FILESET STATISTICS

——————

1 Selected to be installed, of which:

1 Passed pre-installation verification

—-

1 Total to be installed

LICENSE AGREEMENT FAILURES

——————

The software you have selected for installation contains license

agreement(s) that must be accepted before proceeding. Failure to accept

the license terms will prevent the installation of the software.

Accept the license agreement(s) by selecting "yes" in the

"Accept new license agreements" field or by specifying

the -Y option to the installp command.

Filesets Requiring Software License Acceptance

———————————————-

rpm.rte

• which rpm
  
  • rpm –version

Contrôle de la bonne installation. Doit renvoyer « RPM version 3.0.5 ».

• cd /mnt/SRC-STORE1/AIX_AD/AIX-Toolbox_For_Linux_Apps/000_App_Dev_Tools
  
  • rpm -i -v m4-1.4.1-1.aix5.1.ppc.rpm
    
  • rpm -i -v autoconf-2.59-1.aix5.1.noarch.rpm
    
  • rpm -i -v automake-1.8.5-1.aix5.1.noarch.rpm
    
  • rpm -i -v binutils-2.14-3.aix5.1.ppc.rpm
    
  • rpm -i -v bison-1.875-3.aix5.1.ppc.rpm
    
  • rpm -i -v coreutils-5.2.1-2.aix5.1.ppc.rpm
    
  • rpm -i -v cpio-2.5-1.aix5.1.ppc.rpm
    
  • rpm -i -v diffutils-2.8.1-1.aix4.3.ppc.rpm
    
  • rpm -i -v flex-2.5.4a-6.aix4.3.ppc.rpm
    
  • rpm -i -v gawk-3.1.3-1.aix5.1.ppc.rpm
    
  • rpm -i -v make-3.80-1.aix5.1.ppc.rpm
    
  • rpm -i -v gdb-6.0-1.aix5.1.ppc.rpm
    
  • rpm -i -v libtool-1.5.8-2.aix5.1.ppc.rpm

On n'a volontairement pas inclus le compilateur GCC 4.2.0.3 et ses librairies. On dispose en effet d'une version plus récente, obtenue par ailleurs (http://www.perzl.org/aix/index.php).

• cd /mnt/SRC-STORE1/AIX_AD/AIX-Toolbox_For_Linux_Apps/001_Base_Linux_Affinity
  
  • rpm -i -v bash-3.2-1.aix5.2.ppc.rpm
    
  • rpm -i -v rpm-3.0.5-46.aix5.2.ppc.rpm
    
  • rpm -i -v bzip2-1.0.2-4.aix5.1.ppc.rpm
    
  • rpm -i -v rpm-build-3.0.5-46.aix5.2.ppc.rpm
    
  • rpm -i -v gettext-0.10.40-8.aix5.2.ppc.rpm
    
  • rpm -i -v gzip-1.2.4a-10.aix5.2.ppc.rpm
    
  • rpm -i -v tar-1.14-2.aix5.1.ppc.rpm
    
  • rpm -i -v info-4.6-1.aix5.1.ppc.rpm
    
  • rpm -i -v unzip-5.51-1.aix5.1.ppc.rpm
    
  • rpm -i -v patch-2.5.4-4.aix4.3.ppc.rpm
    
  • rpm -i -v zip-2.3-3.aix4.3.ppc.rpm
    
  • rpm -i -v popt-1.7-2.aix5.1.ppc.rpm
    
  • rpm -i -v rpm-devel-3.0.5-46.aix5.2.ppc.rpm

• cd /mnt/SRC-STORE1/AIX_AD/AIX-Toolbox_For_Linux_Apps/003_Misc
  
  • rpm -i -v libxslt-1.1.5-2.aix5.1.ppc.rpm
    
  • rpm -i -v curl-7.9.3-2.aix4.3.ppc.rpm
    
  • rpm -i -v ncurses-5.2-3.aix4.3.ppc.rpm
    
  • rpm -i -v db-3.3.11-4.aix5.1.ppc.rpm
    
  • rpm -i -v ncurses-devel-5.2-3.aix4.3.ppc.rpm
    
  • rpm -i -v emacs-21.3-1.aix5.1.ppc.rpm
    
  • rpm -i -v pcre-3.7-3.aix5.1.ppc.rpm
    
  • rpm -i -v expat-1.95.7-4.aix5.1.ppc.rpm
    
  • rpm -i -v readline-4.3-2.aix5.1.ppc.rpm
    
  • rpm -i -v findutils-4.1-3.aix4.3.ppc.rpm
    
  • rpm -i -v readline-devel-4.3-2.aix5.1.ppc.rpm
    
  • rpm -i -v gdbm-1.8.3-2.aix5.1.ppc.rpm
    
  • rpm -i -v rxvt-2.6.3-3.aix4.3.ppc.rpm
    
  • rpm -i -v grep-2.5.1-1.aix4.3.ppc.rpm
    
  • rpm -i -v sed-4.1.1-1.aix5.1.ppc.rpm
    
  • rpm -i -v libjpeg-6b-6.aix5.1.ppc.rpm
    
  • rpm -i -v sharutils-4.2.1-1.aix4.3.ppc.rpm
    
  • rpm -i -v libpng-1.2.8-8.aix5.2.ppc.rpm
    
  • rpm -i -v wget-1.9.1-1.aix5.1.ppc.rpm
    
  • rpm -i -v libtiff-3.6.1-4.aix5.1.ppc.rpm
    
  • rpm -i -v zlib-1.2.3-4.aix5.2.ppc.rpm
    
  • rpm -i -v libungif-4.1.2-1.aix5.1.ppc.rpm
    
  • rpm -i -v zlib-devel-1.2.3-4.aix5.2.ppc.rpm
    
  • rpm -i -v libxml2-2.6.21-3.aix5.2.ppc.rpm
    
  • rpm -i -v bc-1.06-2.aix4.3.ppc.rpm
    
  • rpm -i -v tcl-8.4.7-3.aix5.1.ppc.rpm
    
  • rpm -i -v tk-8.4.7-3.aix5.1.ppc.rpm
    
  • rpm -i -v expect-5.42.1-3.aix5.1.ppc.rpm

On n'installe volontairement pas les packages OpenLDAP, dont les versions, trop obsolètes, ne permettraient pas de compiler Kerberos.

Toutes opérations en tant que root.

• vi /etc/ntp.conf
  
• La fin du fichier doit être :
  

server controleur1.ledomaine.fr

server controleur2.ledomaine.fr

broadcastclient

driftfile /etc/ntp.drift

tracefile /etc/ntp.trace

• ntpdate controleur2.ledomaine.fr

Effectue le règlage de l'horloge immédiatement.

• smitty xntpd
  
• Choisir Start, puis BOTH.

Installe le daemon approprié, y compris en démarrage automatique.

• date

Doit renvoyer la même date que sur les serveurs TAHITI et PALAOS.

Toutes opérations en tant que root.

• cd /mnt/SRC-STORE1/AIX_AD/perzl
  
• rpm -i -v libgcc-4.2.4-1.aix5.3.ppc.rpm
  
• rpm -i -v gcc-4.2.4-1.aix5.3.ppc.rpm
  
• rpm -i -v libstdc++-4.2.4-1.aix5.3.ppc.rpm
  
• rpm -i -v libstdc++-devel-4.2.4-1.aix5.3.ppc.rpm
  
• rpm -i -v gcc-c++-4.2.4-1.aix5.3.ppc.rpm
  
• rpm -i -v gcc-cpp-4.2.4-1.aix5.3.ppc.rpm

Note: sur HIPPODEV, la version d'AIX est la 5.2. On a donc téléchargé les versions pour aix5.2 de ces RPM.

• which gcc
  
• gcc -v

Simple contrôle. Doit renvoyer :

# which gcc

/usr/bin/gcc

# gcc -v

Using built-in specs.

Target: powerpc-ibm-aix5.3.0.0

Configured with: ../gcc-4.2.4/configure –with-as=/usr/bin/as –with-ld=/usr/bin/ld –enable-languages=c,c++,fortran –prefix=/opt/freeware –enable-threads –enable-version-specific-runtime-libs –disable-nls –enable-decimal-float=dpd –host=powerpc-ibm-aix5.3.0.0

Thread model: aix

gcc version 4.2.4

Toutes opérations en tant que root.

• cd /usr/src
  
• gzip –d -c /mnt/SRC-STORE1/AIX_AD/Sources/openssl-0.9.8k.tar.gz | tar xvf –
  
• chown –R root:system openssl-0.9.8k
  
• cd openssl-0.9.8k
  
• ./Configure –prefix=/opt/freeware shared aix-gcc
  
• make
  
• make install
  
• cd /opt/freeware/lib
  
• ln -sf /opt/freeware/lib/gcc/powerpc-ibm-aix5.3.0.0/4.2.4/libgcc_s.a .
  
• ln -sf /usr/lib/libcrypt.a .
  
• ln -sf /usr/lib/librtl.a .
  
• ln -sf /usr/lib/libc.a .
  
• ln -sf /usr/lib/libpthreads.a .
  
• for i in *ssl*.so *crypto*.so; do a=`echo $i|sed "s|\.so$|\.a|"`; if [ ! –e $a ]; then ar -v -q $a $i; fi; done

On va continuer, tout au long de ces installations, d'éviter de mélanger nos logiciels avec ceux natifs à AIX. C'est la raison pour laquelle, sauf exception, on gardera le préfixe /opt/freeware déjà utilisé par le IBM Toolkit for Linux.

Note : c'est volontairement qu'on compile en 32 bits (et donc pour aix-gcc plutôt que aix64-gcc), des problèmes ayant ensuite été rencontrés dans la compilation d'OpenSSH. OpenSSL fonctionne, en 32 comme en 64 bits.

• cd /usr/src
  
• gzip -d -c /mnt/SRC-STORE1/AIX_AD/Sources/openldap-stable-20090411.tgz | tar xvf -
  
• chown -R root:system openldap-2.4.16
  
• cd openldap-2.4.16
  
• ./configure –prefix=/opt/freeware –disable-slurpd –disable-bdb –disable-slapd –without-threads
  
• make depend
  
• make
  
• make install

L'option disable-bdb est rendue nécessaire par le fait qu'on ne dispose pas d'une librairie Berkeley DB suffisamment récente. Les versions 4.x se sont révélées quasiment imcompilables.

Cela n'a toutefois pas d'impact significatif sur la suite.

A noter que ce client LDAP n'est pas en concurrence avec le fileset ldap.client d'IBM. Il ne nous sert qu'à compiler un Kerberos dans /opt/freeware, lequel ne nous sert qu'à compiler Samba (puisqu'on utilisera le Kerberos inclus dans le fileset NAS d'IBM, supporté et parfaitement opérationnel, mais hélas ! livré sans headers).

• cd /usr/src
  
• tar xvf /mnt/SRC-STORE1/AIX_AD/Sources/krb5-1.5.4-signed.tar
  
• rm krb5-1.5.4.tar.gz.asc
  
• gzip -d -c krb5-1.5.4.tar.gz|tar xvf -
  
• rm krb5-1.5.4.tar.gz
  
• chown -R root:system krb5-1.5.4
  
• cd krb5-1.5.4/src
  
• ./configure –enable-dns –enable-dns-for-kdc –enable-dns-for-realm –prefix=/opt/freeware –with-ldap –without-krb4 –without-system-db –without-tcl –disable-thread-support
  
• make
  
• Va probablement générer une erreur => vi util/support/fake-addrinfo.c => commenter la ligne 1212 (sans conséquence).
  
• make
  
• En cas d'erreurs de type « ld: 0706-006 Cannot find or open library file: -l gssrpc », exécuter la commande: for i in `find .|grep \.so$`; do a=`echo $i|sed "s|\.so$|\.a|"`; rm –f $a; ar -v -q $a $i; done
  
• make (plusieurs cycles make/ar si nécessaire)
  
• make install
  
• cd /opt/freeware/lib
  
• for i in *.so; do a=`echo $i|sed "s|\.so|\.a|"`; if [ ! -e $a ]; then echo $i; ar -v -q $a $i; fi; done
  
• mkdir /var/krb5
  
• mkdir /var/krb5/log
  
• cd /usr/lib
  
• ln –s /opt/freeware/lib/libcom_err.a .

La version 1.5.4 n'est pas la plus récente stable, qui est actuellement la 1.6.3. Cette dernière présente toutefois des problèmes de compilation sous AIX, contrairement à la 1.5.4 et à la 1.7.2 (encore beta). On s'en contente donc.

La version 1.5.4 de Kerberos n'a pas été testée par le MIT sur AIX. C'est pourquoi elle génère des librairies partagées en .so et non en .a comme cela doit se faire sur AIX. On aboutit donc à des erreurs lors du make, qu'on résout en convertissant les .so en .a et en relançant la compilation.

• cd /usr/src
  
• gzip -d -c /mnt/SRC-STORE1/AIX_AD/Sources/samba-3.3.4.tar.gz | tar xvf -
  
• chown -R root:system samba-3.3.4
  
• cd samba-3.3.4/source
  
• ./configure –prefix=/usr –with-pammodulesdir=/lib/security –with-ads –with-krb5=/opt/freeware –with-automount –with-pam –with-pam_smbpass
  
• make
  
• make install
  
• cp –f ./nsswitch/WINBIND /usr/lib/security/.
  
• cp –f ./nsswitch/pam_winbind.o /usr/lib/security/.

Dans la mesure où ce composant est essentiel et absent du monde AIX, on l'installe en préfixe /usr.

A noter que le configure est extrêmement long sur AIX.

Noter également les modules dont la copie dans /usr/lib/security/ va permettre au système d'utiliser la bindery de l'AD pour authentifier les utilisateurs.

• cd /usr/src
  
• gzip -d -c /mnt/SRC-STORE1/AIX_AD/Sources/openssh-5.2p1.tar.gz |tar xvf -
  
• chown -R root:system openssh-5.2p1
  
• cd openssh-5.2p1
  
• ./configure –prefix=/usr –with-kerberos5=/opt/freeware –with-pam –sysconfdir=/etc –with-ssl-dir=/opt/freeware
  
• make
  
• make install

Noter que nous voulons les fichiers de configuration d'OpenSSH directement dans /etc.

Toutes opérations en tant que root.

• cd /usr/src
  
• gzip –d -c /mnt/SRC-STORE1/AIX_AD/Sources.Compilees/BIN.openssl-0.9.8k.tar.gz | tar xvf –
  
• chown –R root:system openssl-0.9.8k
  
• cd openssl-0.9.8k
  
• make install
  
• cd /opt/freeware/lib
  
• for i in *crypto*.so; do a=`echo $i|sed "s|\.so$|\.a|"`; rm –f $a; ar -v -q $a $i; done

• cd /usr/src
  
• gzip -d -c /mnt/SRC-STORE1/AIX_AD/Sources.Compilees/BIN.openldap-2.4.16.tar.gz | tar xvf -
  
• chown -R root:system openldap-2.4.16
  
• cd openldap-2.4.16
  
• make install

• cd /usr/src
  
• gzip –d -c /mnt/SRC-STORE1/AIX_AD/Sources.Compilees/BIN.krb5-1.5.4.tar.gz | tar xvf -
  
• chown -R root:system krb5-1.5.4
  
• cd krb5-1.5.4/src
  
• make install
  
• cd /opt/freeware/lib
  
• for i in *.so; do a=`echo $i|sed "s|\.so|\.a|"`; if [ ! -e $a ]; then echo $i; ar -v -q $a $i; fi; done
  
• mkdir /var/krb5
  
• mkdir /var/krb5/log
  
• cd /usr/lib
  
• ln –s /opt/freeware/lib/libcom_err.a .

• cd /usr/src
  
• gzip -d -c /mnt/SRC-STORE1/AIX_AD/Sources.Compilees/BIN.samba-3.3.4.tar.gz | tar xvf -
  
• chown -R root:system samba-3.3.4
  
• cd samba-3.3.4/source
  
• make install
  
• cp ./nsswitch/WINBIND /usr/lib/security
  
• cp ./nsswitch/pam_winbind.o /usr/lib/security/.

• cd /usr/src
  
• gzip -d -c /mnt/SRC-STORE1/AIX_AD/Sources.Compilees/BIN.openssh-5.2p1.tar.gz |tar xvf -
  
• chown -R root:system openssh-5.2p1
  
• cd openssh-5.2p1
  
• make install

Toutes opérations en tant que root.

• /usr/krb5/sbin/config.krb5 -C -r LEDOMAINE.FR -d LEDOMAINE.FR -c CONTROLEUR1.LEDOMAINE.FR -s CONTROLEUR2.LEDOMAINE.FR

Doit renvoyer :

Initializing configuration…

Creating /etc/krb5/krb5_cfg_type…

Creating /etc/krb5/krb5.conf…

The command completed successfully.

• cat <<eot > /etc/krb5/krb5.conf
  

  [libdefaults]
  

  default_realm = LEDOMAINE.FR
  

  default_keytab_name = FILE:/etc/krb5/krb5.keytab
  

  default_tkt_enctypes = des-cbc-md5 des-cbc-crc
  

  default_tgs_enctypes = des-cbc-md5 des-cbc-crc
  

   

  [realms]
  

  LEDOMAINE.FR = {
  

  kdc = CONTROLEUR1.LEDOMAINE.FR:88
  

  admin_server = CONTROLEUR1.LEDOMAINE.FR:749
  

  default_domain = LEDOMAINE.FR
  

  }
  

   

  [domain_realm]
  

  .LEDOMAINE.FR = LEDOMAINE.FR
  

  LEDOMAINE.FR = LEDOMAINE.FR
  

   

  [logging]
  

  kdc = FILE:/var/krb5/log/krb5kdc.log
  

  admin_server = FILE:/var/krb5/log/kadmin.log
  

  default = FILE:/var/krb5/log/krb5lib.log
  

   

  [appdefaults]
  

  pam = {
  

  debug = false
  

  ticket_lifetime = 36000
  

  renew_lifetime = 36000
  

  forwardable = true
  

  krb4_convert = false
  

  }
  

  eot
  

  • chmod 0644 /etc/krb5/krb5.conf

• /usr/krb5/bin/kinit adm-scemama

Tout administrateur de domaine. Demande le mot de passe, ne renvoie rien.

Note : implique que le DNS soit configuré, et que les hosts renseignés dans krb5.conf soient pingables.

• /usr/krb5/bin/klist

Doit renvoyer :

Ticket cache: FILE:/var/krb5/security/creds/krb5cc_0

Default principal: adm-scemama@LEDOMAINE.FR

Valid starting Expires Service principal

05/20/09 22:22:33 05/21/09 08:22:55 krbtgt/LEDOMAINE.FR@LEDOMAINE.FR

Renew until 05/21/09 22:22:33

• Appliquer la procédure indiquée dans le document « Article ID: 324144 – Last Review: November 1, 2006 – Revision: 3.1 / HOW TO: Use Ktpass.exe in Windows 2000 / Generate a UNIX Host Keytab File » (http://support.microsoft.com/?scid=kb%3Ben-us%3B324144&x=14&y=5) :
  

   

  • Dans l'OU /users de l'AD, créer un nouvel utilisateur, nommé à l'image du serveur (=> myserver en Full name et User logon name, Azerty123 comme mot de passe).
    
  • Ouvrir une fenêtre DOS sur l'un des contrôleurs de domaine, et taper la commande :
    

   

  • ktpass -princ host/myserver@LEDOMAINE.FR -mapuser myserver -pass Azerty123 -out myserver.krb5.keytab
    

   

  • Copier le fichier myserver.krb5.keytab obtenu vers /etc/krb5/krb5.keytab du serveur myserver.
    

   

  • Supprimer l'utilisateur myserver.

• ln –s -f /usr/krb5/bin/kinit /usr/bin
  
  • ln –s –f /usr/krb5/bin/klist /usr/bin
    
  • ln –s –f /usr/krb5/bin/kdestroy /usr/bin

Commodité.

Toutes opérations en tant que root.

• mkdir /var/log/samba

• mkdir /home/LEDOMAINE
  
  • chmod 0755 /home/LEDOMAINE

Répertoire devant contenir les home directories des users du domaine.

On ne le chmodde pas en 0777, Samba n'étant pas configuré ici pour créer les home directories à la volée lors du premier logon.

/!\ REMPLACER MYSERVER par le nom du serveur. Personnaliser éventuellement les partages.

• cat <<eot >/etc/smb.conf
  

#======================= Global Settings =====================================

[global]

# ———————– Network Related Options ————————-

#

# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH

#

# server string is the equivalent of the NT Description field

#

# netbios name can be used to specify a server name not tied to the hostname

#

# Interfaces lets you configure Samba to use multiple interfaces

# If you have multiple network interfaces then you can list the ones

# you want to listen on (never omit localhost)

#

# Hosts Allow/Hosts Deny lets you restrict who can connect, and you can

# specifiy it as a per share option as well

#

workgroup = LEDOMAINE

server string = Samba Server Version %v

netbios name = MYSERVER

; interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24

; hosts allow = 127. 192.168.12. 192.168.13.

# ————————— Logging Options —————————–

#

# Log File let you specify where to put logs and how to split them up.

#

# Max Log Size let you specify the max size log files should reach

# logs split per machine

log file = /var/log/samba/log.%m

# max 50KB per log file, then rotate

max log size = 50

log level = 3

# ———————– Standalone Server Options ————————

#

# Scurity can be set to user, share(deprecated) or server(deprecated)

#

# Backend to store user information in. New installations should

# use either tdbsam or ldapsam. smbpasswd is available for backwards

# compatibility. tdbsam requires no further configuration.

; security = user

; passdb backend = tdbsam

# ———————– Domain Members Options ————————

#

# Security must be set to domain or ads

#

# Use the realm option only with security = ads

# Specifies the Active Directory realm the host is part of

#

# Backend to store user information in. New installations should

# use either tdbsam or ldapsam. smbpasswd is available for backwards

# compatibility. tdbsam requires no further configuration.

#

# Use password server option only with security = server or if you can't

# use the DNS to locate Domain Controllers

# The argument list may include:

# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]

# or to auto-locate the domain controller/s

# password server = *

security = ADS

realm = LEDOMAINE.FR

workgroup = ledomaine

encrypt passwords = yes

password server = controleur1.ledomaine.fr

passdb backend = tdbsam

winbind separator = +

winbind cache time = 300

idmap uid = 10000-50000

idmap gid = 10000-50000

winbind enum users = yes

winbind enum groups = yes

template homedir = /home/%D/%U

template shell = /usr/bin/bash

client use spnego = yes

winbind use default domain = yes

domain master = no

local master = no

preferred master = no

os level = 0

# ———————– Domain Controller Options ————————

#

# Security must be set to user for domain controllers

#

# Backend to store user information in. New installations should

# use either tdbsam or ldapsam. smbpasswd is available for backwards

# compatibility. tdbsam requires no further configuration.

#

# Domain Master specifies Samba to be the Domain Master Browser. This

# allows Samba to collate browse lists between subnets. Don't use this

# if you already have a Windows NT domain controller doing this job

#

# Domain Logons let Samba be a domain logon server for Windows workstations.

#

# Logon Scrpit let yuou specify a script to be run at login time on the client

# You need to provide it in a share called NETLOGON

#

# Logon Path let you specify where user profiles are stored (UNC path)

#

# Various scripts can be used on a domain controller or stand-alone

# machine to add or delete corresponding unix accounts

#

; security = user

; passdb backend = tdbsam

; domain master = yes

; domain logons = yes

# the login script name depends on the machine name

; logon script = %m.bat

# the login script name depends on the unix user used

; logon script = %u.bat

; logon path = \\%L\Profiles\%u

# disables profiles support by specifing an empty path

; logon path =

; add user script = /usr/sbin/useradd "%u" -n -g users

; add group script = /usr/sbin/groupadd "%g"

; add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /bin/false "%u"

; delete user script = /usr/sbin/userdel "%u"

; delete user from group script = /usr/sbin/userdel "%u" "%g"

; delete group script = /usr/sbin/groupdel "%g"

# ———————– Browser Control Options —————————-

#

# set local master to no if you don't want Samba to become a master

# browser on your network. Otherwise the normal election rules apply

#

# OS Level determines the precedence of this server in master browser

# elections. The default value should be reasonable

#

# Preferred Master causes Samba to force a local browser election on startup

# and gives it a slightly higher chance of winning the election

; local master = no

; os level = 33

; preferred master = yes

#—————————– Name Resolution ——————————-

# Windows Internet Name Serving Support Section:

# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both

#

# – WINS Support: Tells the NMBD component of Samba to enable it's WINS Server

#

# – WINS Server: Tells the NMBD components of Samba to be a WINS Client

#

# – WINS Proxy: Tells Samba to answer name resolution queries on

# behalf of a non WINS capable client, for this to work there must be

# at least one WINS Server on the network. The default is NO.

#

# DNS Proxy – tells Samba whether or not to try to resolve NetBIOS names

# via DNS nslookups.

; wins support = yes

; wins server = w.x.y.z

; wins proxy = yes

; dns proxy = yes

# ————————— Printing Options —————————–

#

# Load Printers let you load automatically the list of printers rather

# than setting them up individually

#

# Cups Options let you pass the cups libs custom options, setting it to raw

# for example will let you use drivers on your Windows clients

#

# Printcap Name let you specify an alternative printcap file

#

# You can choose a non default printing system using the Printing option

load printers = yes

cups options = raw

; printcap name = /etc/printcap

#obtain list of printers automatically on SystemV

; printcap name = lpstat

; printing = cups

# ————————— Filesystem Options —————————

#

# The following options can be uncommented if the filesystem supports

# Extended Attributes and they are enabled (usually by the mount option

# user_xattr). Thess options will let the admin store the DOS attributes

# in an EA and make samba not mess with the permission bits.

#

# Note: these options can also be set just per share, setting them in global

# makes them the default for all shares

; map archive = no

; map hidden = no

; map read only = no

; map system = no

; store dos attributes = yes

#============================ Share Definitions ==============================

[homes]

comment = Home Directories

browseable = no

writable = yes

; valid users = %S

; valid users = MYDOMAIN\%S

[printers]

comment = All Printers

path = /var/spool/samba

browseable = no

guest ok = no

writable = no

printable = yes

# Un-comment the following and create the netlogon directory for Domain Logons

; [netlogon]

; comment = Network Logon Service

; path = /var/lib/samba/netlogon

; guest ok = yes

; writable = no

; share modes = no

# Un-comment the following to provide a specific roving profile share

# the default is to use the user's home directory

; [Profiles]

; path = /var/lib/samba/profiles

; browseable = no

; guest ok = yes

# A publicly accessible directory, but read only, except for people in

# the "staff" group

; [public]

; comment = Public Stuff

; path = /tmp

; public = yes

; writable = yes

; printable = no

; write list = +staff

eot

• chmod 0644 /etc/smb.conf

• ln –s –f /etc/smb.conf /usr/lib

Le chemin usuel par défaut de smb.conf est /usr/lib.

• net ads join -U adm-scemama -S controleur1.ledomaine.fr

On rejoint le domaine. Utiliser un compte admin du domaine.

En cas de conflit portant sur libgssapi_krb5.a ou libkrb5.a, utiliser la commande ldd /usr/bin/net afin d'identifier la cause. Net doit utiliser /usr/lib/libkrb5.a et /usr/lib/libgssapi_krb5.a, symlinks vers /usr/krb5/lib/libkrb5.a et libgssapi_krb5.a. Ainsi, ajouter éventuellement ces commandes :

• ln –s –f /usr/krb5/lib/libkrb5.a /opt/freeware/lib
  
• ln –s –f /usr/krb5/lib/libgssapi_krb5.a /opt/freeware/lib/. .
  

Doit renvoyer :

Enter adm-scemama's password:

Using short domain name – LEDOMAINE

Joined 'MYSERVER' to realm 'LEDOMAINE.fr'

Note: sur HIPPODEV, la commande génère un core dump, mais le serveur rejoint correctement le domaine.

• Le serveur devient visible sur l'AD : (ne pas tenir compte du commantaire « Contrôleur du domaine » : il ne l'est pas).
  

   

  

Toutes opérations en tant que root.

• vi /etc/sshd_config
  
• Doit contenir les lignes suivantes (le reste est commenté):
  

Protocol 2

PermitRootLogin yes

X11Forwarding yes

Subsystem sftp /usr/libexec/sftp-server

Toutes opérations en tant que root.

• /usr/sbin/smbd -D -s/etc/smb.conf
  
  • /usr/sbin/nmbd -D -s/etc/smb.conf
    
  • /usr/sbin/winbindd -D -s/etc/smb.conf

Voir les logs dans /var/log/samba/.

• wbinfo -g

Doit renvoyer la liste des groupes de l'AD.

• wbinfo -u

Doit renvoyer la liste des users de l'AD (mais souvent rien, pour cause de timeout).

• wbinfo –i scemama

Doit renvoyer :

scemama:*:10000:10005:SCEMAMA Fabrice:/home/LEDOMAINE/scemama:/usr/bin/bash

• id scemama

Doit renvoyer :

uid=10000(scemama) gid=10005(utilisa. du domaine) groups=10006(utilisateurs de nt businessobjects),10007(impression_photocopieur_couleur),10008(domain mqm),10009(listereclamations),10010(inf-expl),10011(gp-test-proxy),10012(utilisateurs inf stats prod),10013(testprof du domaine),10014(mqm),10015($duplicate-221a),10016(sophosuser),10017(testprof),10018(utilfax)

Toutes opérations en tant que root.

• vi /usr/lib/security/methods.cfg
  
• Ajouter les lignes:
  

WINBIND:

program = /usr/lib/security/WINBIND

options = authonly

Note: sur HIPPODEV, il a été nécessaire de commenter le paragraphe NIS. Les connexions aboutissaient en effet à un appel incorrect à yppasswd, propre à NIS (spécificité AIX 5.2 ?).

• vi /etc/security/user
  
• Paragaphe default:, modifier le paramètre SYSTEM:
  

SYSTEM = "WINBIND"

Toutes opérations en tant que root.

• mkdir /home/LEDOMAINE/scemama
  
• chown scemama /home/LEDOMAINE/scemama
  
• cat <<eot >/home/LEDOMAINE/scemama/.profile
  

export PS1='$PWD $ '

alias l="ls -l"

eot

• chown scemama /home/LEDOMAINE/scemama/.profile

Nous n'avons pas prévu de directive pour créer à la volée home directory et profil.

Cette phase est donc un préalable indispensable à un login.

Note : on peut préférer copier le /etc/profile vers /home/LEDOMAINE/ scemama/.profile

• telnet myserver

Depuis n'importe quelle station.

Doit renvoyer :

AIX Version 5

Copyright IBM Corporation, 1982, 2008.

login: scemama

scemama's Password:

*******************************************************************************

* *

* *

* Welcome to AIX Version 5.3! *

* *

* *

* Please see the README file in /usr/lpp/bos for information pertinent to *

* this release of the AIX Operating System. *

* *

* *

*******************************************************************************

/home/LEDOMAINE/scemama $

Toutes opérations en tant que root.

• vi /etc/rc.samba
  

  #!/bin/sh
  

   

  if [ ! -d /usr/bin ]
  

  then # /usr not mounted
  

  exit
  

  fi
  

   

  PS=`which ps`
  

  GREP=`which grep`
  

  SED=`which sed`
  

   

   

  killproc() { # kill the named process(es)
  

   

  pid=`$PS -e |
  

  $GREP -w $1 |
  

  $GREP –v $GREP |
  

  $SED -e 's/^ *//' -e 's/ .*//'`
  

  [ "$pid" != "" ] && kill -9 $pid
  

  }
  

   

  status () {
  

   

  nmbd=`$PS -e |
  

  $GREP -w nmbd |
  

  $GREP –v $GREP |
  

  $SED -e 's/^ *//' -e 's/ .*//'`
  

  smbd=`$PS -e |
  

  $GREP -w smbd |
  

  $GREP –v $GREP |
  

  $SED -e 's/^ *//' -e 's/ .*//'`
  

   

  if [ "$nmbd" != "" ] ; then
  

  echo nmbd is running on $nmbd
  

  else
  

  echo nbmd is not running
  

  fi
  

   

  if [ "$smbd" != "" ] ; then
  

  echo smbd is running on $smbd
  

  else
  

  echo sbmd is not running
  

  fi
  

   

  }
  

  # Start/stop processes required for samba server
  

  SAMBA_SBIN=/usr/sbin
  

  SAMBA_LIB=/usr/lib
  

   

  case "$1" in
  

   

  'stop')
  

  echo Stopping Samba
  

  killproc nmbd
  

  killproc smbd
  

  ;;
  

  'start')
  

  echo Starting Samba
  

  $SAMBA_SBIN/smbd -D -s$SAMBA_LIB/smb.conf
  

  $SAMBA_SBIN/nmbd -D -s$SAMBA_LIB/smb.conf
  

  ;;
  

  'restart')
  

  echo Stopping Samba
  

  killproc nmbd
  

  killproc smbd
  

  echo Starting Samba
  

  $SAMBA_SBIN/smbd -D -s$SAMBA_LIB/smb.conf
  

  $SAMBA_SBIN/nmbd -D -s$SAMBA_LIB/smb.conf
  

  ;;
  

  'status')
  

  status
  

  ;;
  

  *)
  

  echo "Usage: /etc/rc.samba { start | stop | restart | status }"
  

  ;;
  

  esac

• chmod 0755 /etc/rc.samba

• /etc/rc.samba status

• /etc/rc.samba restart

Test !

• vi /etc/rc.winbind
  

  #!/bin/sh
  

   

  if [ ! -d /usr/bin ]
  

  then # /usr not mounted
  

  exit
  

  fi
  

   

  PS=`which ps`
  

  GREP=`which grep`
  

  SED=`which sed`
  

   

   

  killproc() { # kill the named process(es)
  

   

  pid=`$PS -e |
  

  $GREP -w $1 |
  

  $GREP –v $GREP |
  

  $SED -e 's/^ *//' -e 's/ .*//'`
  

  [ "$pid" != "" ] && kill -9 $pid
  

  }
  

   

  status () {
  

   

  winbindd=`$PS -e |
  

  $GREP -w winbindd |
  

  $GREP –v $GREP |
  

  $SED -e 's/^ *//' -e 's/ .*//'`
  

   

  if [ "$winbindd" != "" ] ; then
  

  echo winbindd is running on $winbindd
  

  else
  

  echo winbindd is not running
  

  fi
  

   

  }
  

  # Start/stop processes required for samba server
  

  SAMBA_SBIN=/usr/sbin
  

  SAMBA_LIB=/usr/lib
  

   

  case "$1" in
  

   

  'stop')
  

  echo Stopping Winbind
  

  killproc winbindd
  

  killproc winbindd
  

  ;;
  

  'start')
  

  echo Starting Winbind
  

  $SAMBA_SBIN/winbindd -D -s$SAMBA_LIB/smb.conf
  

  ;;
  

  'restart')
  

  echo Stopping Winbind
  

  killproc winbindd
  

  echo Starting Winbind
  

  $SAMBA_SBIN/winbindd -D -s$SAMBA_LIB/smb.conf
  

  ;;
  

  'status')
  

  status
  

  ;;
  

  *)
  

  echo "Usage: /etc/rc.winbind { start | stop | restart | status }"
  

  ;;
  

  esac

• chmod 0755 /etc/rc.winbind

• /etc/rc.winbind status

• /etc/rc.winbind restart

Test !

Toutes opérations en tant que root.

• /etc/rc.samba stop
  
• /etc/rc.winbind stop

• /usr/bin/mkssys -s smbd -p /usr/sbin/smbd -u 0 -a "-D" -d -q -S -n 15 -f 9 -G tcpip
  
• /usr/sbin/mkitab "smbd:2:once:startsrc -s smbd >>/dev/console 2>&1"
  
• startsrc -s smbd
  
• lssrc -s smbd

• /usr/bin/mkssys -s nmbd -p /usr/sbin/nmbd -u 0 -a "-D" -d -q -S -n 15 -f 9 -G tcpip
  
• /usr/sbin/mkitab "nmbd:2:once:startsrc -s nmbd >>/dev/console 2>&1"
  
• startsrc -s nmbd
  
• lssrc -s nmbd

• /usr/bin/mkssys -s winbindd -p /usr/sbin/winbindd -u 0 -a "-D" -d -q -S -n 15 -f 9 -G tcpip
  
• /usr/sbin/mkitab "winbindd:2:once:startsrc -s winbindd >>/dev/console 2>&1"
  
• startsrc -s winbindd
  
• lssrc -s winbindd

Toutes opérations en tant que root.

• vi /etc/rc.sshd
  

#!/bin/sh

if [ ! -d /usr/bin ]

then # /usr not mounted

exit

fi

PS=`which ps`

GREP=`which grep`

SED=`which sed`

killproc() { # kill the named process(es)

pid=`$PS -e |

$GREP -w $1 |

$GREP –v $GREP |

$SED -e 's/^ *//' -e 's/ .*//'`

[ "$pid" != "" ] && kill -9 $pid

}

status () {

sshd=`$PS -e |

$GREP -w sshd |

$GREP –v $GREP |

$SED -e 's/^ *//' -e 's/ .*//'`

if [ "$sshd" != "" ] ; then

echo sshd is running on $sshd

else

echo sshd is not running

fi

}

# Start/stop processes required for samba server

SSHD_SBIN=/usr/sbin

case "$1" in

'stop')

echo Stopping sshd

killproc sshd

;;

'start')

echo Starting sshd

$SSHD_SBIN/sshd

;;

'restart')

echo Stopping sshd

killproc sshd

echo Starting sshd

$SSHD_SBIN/sshd

;;

'status')

status

;;

*)

echo "Usage: /etc/rc.sshd { start | stop | restart | status }"

;;

esac

• chmod 0755 /etc/rc.sshd

• /etc/rc.sshd status

• /etc/rc.sshd restart

Test !

Toutes opérations en tant que root.

• /etc/rc.sshd stop

• /usr/bin/mkssys -s sshd -p /usr/sbin/sshd -a '-D -h /etc/ssh_host_rsa_key' -u 0 -S -n 15 -f 9 -R -G local
  
• /usr/sbin/mkitab "sshd:2:once:startsrc -s sshd >>/dev/console 2>&1"
  
• startsrc -s sshd
  
• lssrc -s sshd

Toutes opérations en tant que root.

• cd /usr/src
  
• gzip –d -c /mnt/SRC-STORE1/AIX_AD/Quest/DB2_sys-auth_AIX_53.3.0.0.5.tar.gz | tar xvf -
  
• mv –f DB2_sys-auth DB2_sys-auth_AIX_53.3.0.0.5
  
• chown –R root:system DB2_sys-auth_AIX_53.3.0.0.5
  
• cd DB2_sys-auth_AIX_53.3.0.0.5

• /!\ Remplacer hinstprd par le nom de chaque instance sur laquelle le plugin doit être installé. Ici, on a travaillé sur l'instance hinstprd, qui contient notamment la DB hypopre.
  
• ./install.sh hinstprd LAM
  
• su – hinstprd
  
• db2stop
  
• db2 update dbm cfg using SRVCON_PW_PLUGIN sys-auth
  
• db2 update dbm cfg using GROUP_PLUGIN sys-auth
  
• db2 update dbm cfg using CLNT_PW_PLUGIN sys-auth
  
• db2start

Le plugin doit être installé dans chaque instance de la base. Les fichiers seront ici copiés vers le /home/hinstprd/ sqllib/security32 /plugin/.

Renvoie des messages de succès explicites.

su – hinstprd

db2

connect to HYPOPRE;

grant dbadm on database to user scemama;

connect reset;

connect to HYPOPRE user scemama using xxx;

connect reset;

connect to HYPOPRE;

revoke all on database from scemama;

connect reset;

terminate;

Test, en supposant que la base HYPOPRE ait été créée, et que scemama soit un user de l'AD, granté pour cette base de données.

(…)

debug1: monitor_child_preauth: scemama has been authenticated by privileged process

debug3: mm_get_keystate: Waiting for new keys

debug3: mm_request_receive_expect entering: type 24

debug3: mm_request_receive entering

debug3: mm_newkeys_from_blob: 20092288(118)

debug2: mac_setup: found hmac-md5

debug3: mm_get_keystate: Waiting for second key

debug3: mm_newkeys_from_blob: 20092288(118)

debug2: mac_setup: found hmac-md5

debug3: mm_get_keystate: Getting compression state

debug3: mm_get_keystate: Getting Network I/O buffers

debug3: mm_share_sync: Share sync

debug3: mm_share_sync: Share sync end

User child is on pid 1028102

debug3: mm_request_receive entering

setgroups: Operation not permitted.

initgroups: Operation not permitted.

debug1: do_cleanup

3004-679 Error getting groups for "scemama".

3004-703 Check "/etc/group" file.