samba - May 2011 - winbind as a name service "proxy"?

Hi,

We hava a bunch of machines that needs to have the ability to look up users and
groups (like with libnss_winbind) but we need to have the Kerberos and PAM
stuff. We really don't want to join them to the AD. Are there any way to use
one server as a proxy for name and group lookups?

[dumb-node] --> [master-node-with-winbind] --> [AD]



Best regards

Emil Assarsson
Sony Ericsson Mobile Communications AB

"The information in this email, and attachment(s) thereto, is strictly
confidential and may be legally privileged. It is intended solely for the named
recipient(s), and access to this e-mail, or any attachment(s) thereto, by anyone
else is unauthorized. Violations hereof may result in legal actions. Any
attachment(s) to this e-mail has been checked for viruses, but please rely on
your own virus-checker and procedures. If you contact us by e-mail, we will
store your name and address to facilitate communications in the matter
concerned. If you do not consent to us storing your name and address for above
stated purpose, please notify the sender promptly. Also, if you are not the
intended recipient please inform the sender by replying to this transmission,
and delete the e-mail, its attachment(s), and any copies of it without,
disclosing it."

From: "Assarsson, Emil" <Emil.Assarsson at sonyericsson.com>
Date: Wed, 4 May 2011 10:37:28 +0200
> We hava a bunch of machines that needs to have the ability to look up users
and groups (like with libnss_winbind) but we need to have the Kerberos and PAM
stuff. We really don't want to join them to the AD. Are there any way to use
one server as a proxy for name and group lookups?
> 
> [dumb-node] --> [master-node-with-winbind] --> [AD]
I do not know what you exactly want.

To enable SUA on your AD and to set correctly on your every UNIX
boxes, you can look up users and groups from UNIX via LDAP or NIS (if
you enable NIS on your AD) and to set PAM and NSS craftily, you will
give auth info from Kerberos and users and groups' info from AD.

---
TAKAHASHI Motonobu <monyo at samba.gr.jp>