域主機搭建，windows，linux的加域

1、搭建域主機的好處：
1，簡化管理工做。
2，單個賬戶登錄後，能夠訪問域中全部有權訪問的資源。
3，具備強大的查詢功能。
2、域主機的構建：（windows2012 r2）
https://jingyan.baidu.com/article/acf728fd4a7f80f8e410a353.html
這裏有詳細的配製方法。
3、服務器加域。（咱們的dns：10.0.0.8 域ip：test.com）

1. windows服務器加域的方法：
   a:在IPV4屬性那裏，選Advance->DNS，
   b：DNS Server添加10.0.0.8
   c:Append these DNS suffixes那裏添加tcminplay.local
   
   d： System->Advanced system settings->Computere Name
   
   e:點change。修更名字和輸入域ip（接下來須要輸入域主機的管理員賬號和密碼）
   
   f：添加遠程登陸域帳戶：System->Advanced system settings->Remote->Select Users ->Add ->Advanced...->輸入域管理員用戶名和密碼 -->Find Now -> 找到 管理員用戶 添加
   

2. linux服務器加域的方法：
   a：安裝必須的軟件包
   yum install krb5-libs krb5-devel pam_krb5 krb5-workstation krb5-auth-dialog
   yum install samba-winbind samba samba-common samba-client samba-winbind-clients
   b：修改三個配置文件
   cat /etc/samba/smb.conf
   [global]
   workgroup = TEST 必須大寫
   security = ADS
   idmap uid = 16777216-33554431
   idmap gid = 16777216-33554431
   password server = 10.0.0.8
   map to guest = bad user
   encrypt passwords =yes
   realm = TEST.COM 必須大寫
   winbind use default domain = yes
   template homedir = /home/%D/%U
   template shell = /bin/bash
   [homes]
   comment = %S
   path =/home/%D/%S
   writeable = yes
   browsable = yes
   ; valid users = %S
   valid users = CAMPUS\%S

cat /etc/krb5.conf
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = TEST.COM 必須大寫
dns_lookup_kdc = true
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = yes
rdns = false
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
TEST.COM = {
kdc = 10.0.0.81:88
admin_server = 10.0.0.8:749
default_domain = TEST.COM 必須大寫
}
[domain_realm]
.test.com = TEST.COM 必須大寫
test.com = TEST.COM 必須大寫

cat /etc/nsswitch.conf
...
passwd: files winbind
shadow: files winbind
group: files winbind 只須要修改這裏
...

c:重啓samba服務，重啓winbind服務。
/bin/systemctl restart samba.service
/bin/systemctl start winbind.service
d：驗證 ：
kinit administrator@TEST.COM 成功會提示輸入密碼（域主機的管理員密碼）
e：加域
net ads join -S 10.0.0.8 -U Administrator
輸入密碼 無報錯則加域成功