# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include		/etc/openldap/schema/core.schema
include		/etc/openldap/schema/cosine.schema
include		/etc/openldap/schema/inetorgperson.schema
include		/etc/openldap/schema/nis.schema
include 		/etc/openldap/schema/samba.schema

allow bind_v2

pidfile		/var/run/openldap/slapd.pid
argsfile	/var/run/openldap/slapd.args

database	bdb
suffix		"dc=centos,dc=ltd"
rootdn   	"cn=Manager,dc=centos,dc=ltd"

rootpw			{MD5}8lhjnSYQMbzskQ9NOwujPQ==

directory	/var/lib/ldap

# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub

access to attrs=userPassword,sambaLMPassword,sambaNTPassword
    by self write
    by dn="cn=Manager,dc=centos,dc=ltd" write
    by anonymous auth
    by * none

access to *
    by dn="cn=Manager,dc=centos,dc=ltd" write
    by self write
    by * read

[global]
	workgroup = CENTOS
	netbios name = PDC-SRV
	security = user
	enable privileges = yes
	#interfaces = 192.168.5.11
	#username map = /etc/samba/smbusers
	server string = Samba Server %v
	#security = ads
	encrypt passwords = Yes
	#min passwd length = 3
	#pam password change = no
	#obey pam restrictions = No

	unix password sync = yes
	ldap passwd sync = yes
	passwd program = /usr/sbin/smbldap-passwd -u "%u"
	passwd chat = "Changing *\nNew password*" %n\n "*Retype new password*" %n\n"

	log level = 0
	syslog = 0
	log file = /var/log/samba/log.%U
	max log size = 100000
	time server = Yes
	socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
	mangling method = hash2
	Dos charset = CP932
	Unix charset = UTF-8

	logon script = logon.bat
	logon drive = H:
        logon home = 
        logon path = 

	domain logons = Yes
	domain master = Yes
	os level = 65
	preferred master = Yes
	wins support = yes
	# passdb backend = ldapsam:"ldap://ldap1.company.com ldap://ldap2.company.com"
	passdb backend = ldapsam:ldap://127.0.0.1/
	ldap admin dn = cn=Manager,dc=centos,dc=ltd
	#ldap admin dn = cn=samba,ou=DSA,dc=company,dc=com
	ldap suffix = dc=centos,dc=ltd
        ldap group suffix = ou=Groups
        ldap user suffix = ou=Users
        ldap machine suffix = ou=Computers
	#ldap idmap suffix = ou=Idmap
        add user script = /usr/sbin/smbldap-useradd -m "%u"
        #ldap delete dn = Yes
        delete user script = /usr/sbin/smbldap-userdel "%u"
        add machine script = /usr/sbin/smbldap-useradd -t 0 -w "%u"
        add group script = /usr/sbin/smbldap-groupadd -p "%g" 
        delete group script = /usr/sbin/smbldap-groupdel "%g"
        add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
        delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
	set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
	admin users = admin

	# printers configuration
	#printer admin = @"Print Operators"
	load printers = Yes
	create mask = 0640
	directory mask = 0750
	#force create mode = 0640
	#force directory mode = 0750
	nt acl support = No
	printing = cups
	printcap name = cups
	deadtime = 10
	guest account = nobody
	map to guest = Bad User
	dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
	show add printer wizard = yes
	; to maintain capital letters in shortcuts in any of the profile folders:
	preserve case = yes
	short preserve case = yes
	case sensitive = no

[netlogon]
	path = /home/netlogon/
	browseable = No
	read only = yes

[profiles]
	path = /home/profiles
	read only = no
	create mask = 0600
	directory mask = 0700
	browseable = No
	guest ok = Yes
	profile acls = yes
	csc policy = disable
	# next line is a great way to secure the profiles 
	#force user = %U 
	# next line allows administrator to access all profiles 
	#valid users = %U "Domain Admins"

[printers]
        comment = Network Printers
        #printer admin = @"Print Operators"
        guest ok = yes 
        printable = yes
        path = /home/spool/
        browseable = No
        read only  = Yes
        printable = Yes
        print command = /usr/bin/lpr -P%p -r %s
        lpq command = /usr/bin/lpq -P%p
        lprm command = /usr/bin/lprm -P%p %j
        # print command = /usr/bin/lpr -U%U@%M -P%p -r %s
        # lpq command = /usr/bin/lpq -U%U@%M -P%p
        # lprm command = /usr/bin/lprm -U%U@%M -P%p %j
        # lppause command = /usr/sbin/lpc -U%U@%M hold %p %j
        # lpresume command = /usr/sbin/lpc -U%U@%M release %p %j
        # queuepause command = /usr/sbin/lpc -U%U@%M stop %p
        # queueresume command = /usr/sbin/lpc -U%U@%M start %p

[print$]
        path = /home/printers
        guest ok = No
        browseable = Yes
        read only = Yes
        valid users = @"Print Operators"
        write list = @"Print Operators"
        create mask = 0664
        directory mask = 0775

[public]
	path = /tmp
	guest ok = yes
	browseable = Yes
	writable = yes

Populating LDAP directory for domain CENTOS (S-1-5-21-4237105843-2919073881-1525329575)
(using builtin directory structure)

entry dc=centos,dc=ltd already exist. 
adding new entry: ou=Users,dc=centos,dc=ltd
adding new entry: ou=Groups,dc=centos,dc=ltd
adding new entry: ou=Computers,dc=centos,dc=ltd
adding new entry: ou=Idmap,dc=centos,dc=ltd
adding new entry: uid=root,ou=Users,dc=centos,dc=ltd
adding new entry: uid=nobody,ou=Users,dc=centos,dc=ltd
adding new entry: cn=Domain Admins,ou=Groups,dc=centos,dc=ltd
adding new entry: cn=Domain Users,ou=Groups,dc=centos,dc=ltd
adding new entry: cn=Domain Guests,ou=Groups,dc=centos,dc=ltd
adding new entry: cn=Domain Computers,ou=Groups,dc=centos,dc=ltd
adding new entry: cn=Administrators,ou=Groups,dc=centos,dc=ltd
adding new entry: cn=Account Operators,ou=Groups,dc=centos,dc=ltd
adding new entry: cn=Print Operators,ou=Groups,dc=centos,dc=ltd
adding new entry: cn=Backup Operators,ou=Groups,dc=centos,dc=ltd
adding new entry: cn=Replicators,ou=Groups,dc=centos,dc=ltd
entry sambaDomainName=CENTOS,dc=centos,dc=ltd already exist. Updating it...

Please provide a password for the domain root: 
Changing UNIX and samba passwords for root

# smbldap-groupadd -a admin 
# smbldap-useradd -am -g admin admin 
# smbldap-passwd admin 
Changing UNIX and samba passwords for admin

dn: cn=Domain Users,ou=Groups,dc=centos,dc=ltd
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
gidNumber: 513
cn: Domain Users
description: Netbios Domain Users
sambaSID: S-1-5-21-2252255531-4061614174-2474224977-513
sambaGroupType: 2
displayName: Domain Users
structuralObjectClass: posixGroup
entryUUID: 7f7cf07e-4fa2-102f-848e-9170128ed88d
creatorsName: cn=Manager,dc=centos,dc=ltd
createTimestamp: 20100908143832Z
entryCSN: 20100908143832Z#000008#00#000000
modifiersName: cn=Manager,dc=centos,dc=ltd
modifyTimestamp: 20100908143832Z