March 2007

###############
# /etc/hosts
###############
# This file describes a number of hostname-to-address
# mappings for the TCP/IP subsystem. It is mostly
# used at boot time, when no name servers are running.
# On small systems, this file can be used instead of a
# “named” name server.
# Syntax:
#
# IP-Address Full-Qualified-Hostname Short-Hostname
#
127.0.0.1 localhost
10.10.10.1 WINDOWS-DC-HOSTNAME.DOMAIN.COM WINDOWS-DC-HOSTNAME
# special IPv6 addresses
::1 localhost ipv6-localhost ipv6-loopback

fe00::0 ipv6-localnet

ff00::0 ipv6-mcastprefix
ff02::1 ipv6-allnodes
ff02::2 ipv6-allrouters
ff02::3 ipv6-allhosts
127.0.0.2 client-hostname.DOMAIN.COM client-hostname

###############
# krb5.conf for connecting with Windows Server 2003#
###############
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMON

[libdefaults]
ticket_lifetime = 24000
default_realm = DOMAIN.COM
default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5 aes256-cts arcfour-hmac-md5
default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5 aes256-cts arcfour-hmac-md5
[realms]
DOMAIN.COM = {
kdc = windows-dc-hostname.domain.com
admin_server = windows-dc-hostname.domain.com
default_domain = DOMAIN.COM
}

[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM

###############
# custom ldap.conf for connecting with Server 2003 R2
###############
host 10.10.10.1
base dc=domain,dc=com
uri ldap://windows-dc-hostname.domain.com/
binddn cn=linux-ldap-user,cn=Users,dc=domain,dc=com
bindpw ldap-user-passwd
scope sub
bind_timelimit 15
timelimit 15
ssl no
referrals no
nss_base_passwd dc=domain,dc=com?sub
nss_base_shadow dc=domain,dc=com?sub
nss_base_group dc=domain,dc=com?sub?&(objectCategory=group)(gidnumber=*)
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_objectclass posixGroup group
nss_map_attribute gecos cn
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute uniqueMember member
nss_initgroups_ignoreusers root,ldap

###############
# /etc/nsswitch.conf
###############
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry ‘[NOTFOUND=return]’ means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
# compat Use compatibility setup
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# [NOTFOUND=return] Stop searching if not found so far
#
# For more information, please read the nsswitch.conf.5 manual page.
#
# passwd: files nis
# shadow: files nis
# group: files nis

passwd: files ldap
shadow: files ldap
group: files ldap

hosts: files dns wins
networks: files dns

services: files
protocols: files
rpc: files
ethers: files
netmasks: files
netgroup: files nis
publickey: files

bootparams: files
automount: files nis
aliases: files

###############
# /etc/ntp.conf file
#
# Sample NTP configuration file.
# See package ‘ntp-doc’ for documentation, Mini-HOWTO and FAQ.
# Copyright © 1998 S.u.S.E. GmbH Fuerth, Germany.
#
# Author: Michael Andres,
#
###############
#
# Radio and modem clocks by convention have addresses in the
# form 127.127.t.u, where t is the clock type and u is a unit
# number in the range 0-3.
#
# Most of these clocks require support in the form of a
# serial port or special bus peripheral. The particular
# device is normally specified by adding a soft link
# /dev/device-u to the particular hardware device involved,
# where u correspond to the unit number above.
#
# Generic DCF77 clock on serial port (Conrad DCF77)
# Address: 127.127.8.u
# Serial Port: /dev/refclock-u
#
# (create soft link /dev/refclock-0 to the particular ttyS?)
#
# server 127.127.8.0 mode 5 prefer
#
# Undisciplined Local Clock. This is a fake driver intended
# for backup and when no outside source of synchronized time
# is available.
#
server 127.127.1.0 # local clock (LCL)
fudge 127.127.1.0 stratum 10 # LCL is unsynchronized

#
# Outside source of synchronized time
#
# server xx.xx.xx.xx # IP address of server
server 10.10.10.1

#
# Miscellaneous stuff
#
driftfile /var/lib/ntp/drift/ntp.drift # path for drift file

logfile /var/log/ntp # alternate log file
# logconfig =syncstatus + sysevents
# logconfig =all

# statsdir /tmp/ # directory for statistics files
# filegen peerstats file peerstats type day enable
# filegen loopstats file loopstats type day enable
# filegen clockstats file clockstats type day enable

#
# Authentication stuff
#
# keys /etc/ntp.keys # path for keys file
# trustedkey 1 2 3 4 5 6 14 15 # define trusted keys
# requestkey 15 # key (7) for accessing server variables
# controlkey 15 # key (6) for accessing server variables

###############
# /etc/pam.d/common-account - authorization settings common to all services
###############
# This file is included from other service-specific PAM config
# files, and should contain a list of the authorization modules
# that define the central access policy for use on the system.
# The default is to only deny service to users whose accounts
# are expired.
#
account sufficient pam_krb5.so
account required pam_unix2.so

###############
# /etc/pam.d/common-auth - authentication settings common to all services
###############
# This file is included from other service-specific PAM config
# files, and should contain a list of the authentication modules
# that define the central authentication scheme for use on the
# system (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default
# is to use the traditional Unix authentication mechanisms.
#
auth required pam_env.so
auth sufficient pam_krb5.so
auth required pam_unix2.so

###############
# /etc/pam.d/common-password - password-related modules common to all services
###############
# This file is included from other service-specific PAM config
# files, and should contain a list of modules that define the
# services to be used to change user passwords. The default is
# pam_unix2 in combination with pam_pwcheck.
# The “nullok” option allows users to change an empty password, else
# empty passwords are treated as locked accounts.
#
# To enable Blowfish or MD5 passwords, you should edit
# /etc/default/passwd.
#
# Alternate strength checking for passwords should be configured
# in /etc/security/pam_pwcheck.conf.
#
# pam_make can be used to rebuild NIS maps after password change.
#
password required pam_pwcheck.so nullok
password required pam_unix2.so nullok use_first_pass use_authtok
#password required pam_make.so /var/yp

###############
# /etc/pam.d/common-session - session-related modules common to all services
###############
# This file is included from other service-specific PAM config
# files, and should contain a list of modules that define tasks
# to be performed at the start and end of sessions of *any*
# kind (both interactive and non-interactive). The default is
# pam_unix2.
#
session required pam_limits.so
session required pam_unix2.so
session required pam_mkhomedir.so umask=0077 skel=/etc/skel

#%PAM-1.0
###########line above is part of this file#################
#/etc/pam.d/su config file
###########################################################
#auth sufficient pam_rootok.so
auth include common-auth
account include common-account
password include common-password
session include common-session
session optional pam_xauth.so

mount -w /dev/hda1 /mnt (where “/dev/hda1” is your system partition)
vi /mnt/etc/nsswitch.conf (remove the “ldap” from
passwd, group, and shadow - should only say “files” or “compat”)