192.168.32.2 RA-Proxy.RA.local
192.168.32.1 RA-DC.RA.LOCAL

[libdefaults]
default_realm = RA.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h

# The following krb5.conf variables are only for MIT Kerberos.
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true

# The following encryption type specification will be used by MIT Kerberos
# if uncommented. In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
#
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn’t know about (such as
# old versions of Sun Java).

# default_tgs_enctypes = des3-hmac-sha1
# default_tkt_enctypes = des3-hmac-sha1
# permitted_enctypes = des3-hmac-sha1

# The following libdefaults parameters are only for Heimdal Kerberos.
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
fcc-mit-ticketflags = true

[realms]
RA.LOCAL = {
kdc = RA-DC.RA.LOCAL
admin_server = RA-DC.RA.LOCAL
default_domain = RA.LOCAL
}
[domain_realm]
.RA.LOCAL = RA.LOCAL
RA.LOCAL = RA.LOCAL

[login]
krb4_convert = true
krb4_get_tickets = false

# netbios имя домена
workgroup = RA
netbios name = ra-proxy

# Строка комментария сервера
server string = Squid with LDAP auth

# Режим безопасности, в нашем случае ads
security = ads

# расположение лог файла и его размер
log file = /var/log/samba/samba.log
max log size = 500

# Здесь необходимо указать dns имя или ip контроллера домена,
# если указываете dns имя необходимо убедиться, что разрешение
# имен работает правильно
password server = 192.168.32.1

# dns имя Active Directory
realm = RA.LOCAL

# Тип хранилища.
passdb backend = tdbsam

# Сетевые настройки.
socket options = TCP_NODELAY

# Указываем, что самба не является PDC
local master = no
domain master = no
preferred master = no
domain logons = no
os level = 0

# Настройка кириллицы
display charset = UTF-8
unix charset = UTF-8
dos charset = cp866

# Использовать шифрованные пароли
encrypt passwords = yes

# Настройки winbind
winbind use default domain = no
winbind uid = 10000-20000
winbind gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes

acl users proxy_auth REQUIRED
http_access allow users

group: files winbind
passwd: files winbind
shadow: files winbind

chgrp proxy $PIDDIR/winbindd_privileged/ || return 1

/etc/init.d/samba restart
/etc/init.d/winbind restart
exit 0

/etc/init.d/samba restart

/etc/init.d/winbind restart

Using short domain name — RA
Joined ‘GentooRouter’ to realm ‘RA.LOCAL’

Ping to winbindd succeeded on fd 4

wbinfo -t

checking the trust secret via RPC calls succeeded

wbinfo -u

YOURDOMAIN\DomainAdminAccount
YOURDOMAIN\администратор
YOURDOMAIN\гость
YOURDOMAIN\tsinternetuser
YOURDOMAIN\krbtgt
YOURDOMAIN\freebsd$
YOURDOMAIN\server$

wbinfo -g

YOURDOMAIN\компьютеры домена
YOURDOMAIN\контроллеры домена
YOURDOMAIN\администраторы схемы
YOURDOMAIN\администраторы предприятия
YOURDOMAIN\издатели сертификатов
YOURDOMAIN\администраторы домена
YOURDOMAIN\пользователи домена
YOURDOMAIN\гости домена
YOURDOMAIN\владельцы-создатели групповой политики
YOURDOMAIN\серверы ras и ias
YOURDOMAIN\dnsadmins
YOURDOMAIN\dnsupdateproxy

Name : RA
Alt_Name : RA.LOCAL
SID : S-1-5-21-220523388-842925246-839522115
Active Directory : Yes
Native : Yes
Primary : Yes
Sequence : 3143

net ads info

LDAP server: 192.168.32.1
LDAP server name: RA-DC.RA.local
Realm: RA.LOCAL
Bind Path: dc=RA,dc=LOCAL
LDAP port: 389
Server time: Сбт, 30 Апр 2011 02:45:47 MSD
KDC server: 192.168.32.1
Server time offset: -1

plaintext password authentication succeeded
challenge/response password authentication succeeded

RA\RA\ADMIN[%PASS]

** server can't find 1cserver.pharmlider.local: NXDOMAIN

** server can't find 1cserver.pharmlider.local: NXDOMAIN