Solaris

Hi all. A while back i began looking a using Sun One JDS for our S10 environment which subsequently fell by the wayside as other more pressing things cropped up :-)

Now its ugly head has popped up again but with the prerequisite that we authenticate against AD.

So, i have a few questions.

1) I have no experience with LDAP but that seems to be the logical way forward as far as the transport side of things goes. Do anyone have any 'easy guide' to installing/running LDAP on S10?

2) Integrating with AD. I guess the obvious question is how??????

3) can i choose to only authenticate certain user's ie just some staff users rather than the root/admin users?

Any help would be much appreciated, especially as i have no experience with LDAP/AD (although someone else will be dealing with the actually AD configuration side.

Thanks

pete

Hi Boneyard,

This blog is an encyclopedia in itself : Refined Solaris 10-AD Integration Instructions - blog.scottlowe.org - The weblog of an IT pro specializing in virtualization, storage, and servers.

I too am working on same. Currently held up at LDAP client config part.
Good luck.

HG

Thanks for the reply Renjesh. I've had quick look through that and still have a few questions though :-)

My main concern is that i dont want to authenticate all users, any ideas how this would be accomplished ie i only want staff users to authenticate against AD but root/admin locally

Cheers

Do not install an account called root in AD.
Ensure that if you use SSH that the sshd_config file has "PermitRootLogin no".
Ensure the the CONSOLE= line in the /etc/default/login file is set to /dev/console.
/etc/nsswitch.conf and /etc/pam.conf will be configured to allow local as well as LDAP authentication.

Thanks for the reply tony.

So when u say "configured to allow local as well as ldap", does that mean that it will look to AD first and then local if a user if not in existance on AD?

You may have guessed I'm wingng it a little here ;-)

Cheers

Yes,Boney.

An entry in /etc/nsswitch.conf for passwd service will decide where to look and where not to!

HG

Excellent stuff. Thanks for that guys.

Cheers