#create a compile user
        mkdir -p /usr/download;
        groupadd -g 252 compile
        useradd -c 'compile user' compile -d /usr/download -g compile -s /bin/bash -u 252
   #assign some directory rights to user compile
        chown -R compile:compile /usr/src
        chown compile:compile /usr/download

 
   if [ -f /tmp/workingdir ] ; then rm /tmp/workingdir ; fi 
   su compile
   cd
   wget http://www.padl.com/download/pam_ldap.tgz
   cd /usr/src
   tar -zxvf ~/pam_ldap.tgz
   cd pam_*
   ./configure --prefix=/usr/ \
   --sysconfdir=/etc \
   --localstatedir=/var \
   --with-ldap-lib=openldap 
   make && `pwd > /tmp/workingdir` #Dump current path to a file
   exit
   if [ -f /tmp/workingdir ] ; then
     cd `cat /tmp/workingdir`
     checkinstall --install=yes
   else
     echo Check for errors
   fi

 if [ -f /tmp/workingdir ] ; then rm /tmp/workingdir ; fi 
   su compile
   cd
   wget http://www.padl.com/download/nss_ldap.tgz
   cd /usr/src
   tar -zxvf ~/nss_ldap.tgz
   cd nss_*
   ./configure --prefix=/usr \
   --sysconfdir=/etc \
   --localstatedir=/var \
   --enable-rfc2307bis \
   --with-ldap-lib=openldap
   make && `pwd > /tmp/workingdir` #Dump current path to a file
   exit
   if [ -f /tmp/workingdir ] ; then
     cd `cat /tmp/workingdir`
     checkinstall
   else
     echo Check for errors
   fi

###############################################
#               slapd.conf                    #
###############################################

##### Begin adding in the schema files... #####
### required for openldap (the basic schema)
include  /etc/openldap/schema/core.schema

### Support for X.500 directory pilots.  RFC 1274
include  /etc/openldap/schema/cosine.schema

### inetorgperson stores contact information ###
include  /etc/openldap/schema/inetorgperson.schema

#NIS is required by the samba.schema
include  /etc/openldap/schema/nis.schema

#Samba schema is required to manage samba accounts
include  /etc/openldap/schema/samba.schema

# Logging (1,2,4,8,16,32,64,128 - bits to make up the value)
# 1 (0x1 trace) trace function calls
# 2 (0x2 packet) debug packet handling
# 4 (0x4 args) heavy trace debugging (function args)
# 8 (0x8 conns) connection management
# 16 (0x10 BER) print out packets sent and received
# 32 (0x20 filter) search filter processing
# 64 (0x40 config) configuration file processing
# 128 (0x80 ACL) access control list processing
# 256 (0x100 stats) stats log connections/operations/results
# 512 (0x200 stats2) stats log entries sent
# 1024 (0x400 shell) print communication with shell backends
# 2048 (0x800 parse) entry parsing
# 4096 (0x1000 cache) caching (unused)
# 8192 (0x2000 index) data indexing (unused)
# 16384 (0x4000 sync) LDAPSync replication
# 32768 (0x8000 none) only messages that get logged whatever log level is set
loglevel 264

#Choose the database type to use.
# Note to netatalk users:  Netatalk can use a DBD backend to store its CNID database. Please be
#                          aware of this when upgrading your DBD version 
database bdb


#Enter the topmost suffix of your LDAP tree
suffix "dc=example,dc=lan"

#Set the distinquished name for the LDAP administrator user which is not subject to access 
# control or administrative restrictions for operations on this database.  An empty root
# DN (the default) specifies no root access is to be granted. It is recommended that the
# root dn only be specified  when needed (such as when initially populating a database).  
#  Note: the rootdn is always needed when using syncrepl.
rootdn "cn=admin,dc=example,dc=lan"

#Set the rootpw for the rootdn admin
# Note:  run 'slappasswd' from the command line to generate a password hash to use here.
#  (The password used in this example was:   secretpw
rootpw {SSHA}lkFH5nh2tq+iaCHaTi4gh2M62PaMOnjD

#Set the directory where the ldap database will be stored.
directory /etc/openldap/data/example.lan

#Set the absolute path and pidfile name
pidfile /var/run/slapd.pid

#`man slapd-bdb` to learn about this option
#cachesize 2000

## indexes to maintain

#Additional indices to maintain. (from the Official Samba 3 Howto Guide. p.163)
# NOTE:  An error such as "bdb_equality_candidates: (sambaGroupType) index_param failed"
# may be encountered when an attribute does not have an index but when something is doing a 
# on that attribute.  This is not generally a problem for the occasional error but if the error
# is constant you can add in the appropriate index, stop slapd, and rebuild the index files with
# the slapindex utility.  There are performance tradeoffs between maintaining additional indices
# VS allowing unindexed filter searches.  See: http://www.openldap.org/faq/data/cache/42.html

#################################################################################################
# Indices to maintain  [See the OPENLDAP section of the Official Samba3 HOWTO reference guide : #
# ( http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html#id327194 )           #
#################################################################################################
## required by OpenLDAP
index objectclass eq
index cn pres,sub,eq
index sn pres,sub,eq

## required to support pdb_getsampwnam
index uid pres,sub,eq

## required to support pdb_getsambapwrid()
index displayName pres,sub,eq

## uncomment these if you are storing posixAccount and
## posixGroup entries in the directory as well
index uidNumber eq
index gidNumber eq
index memberUid eq


index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq
index default sub

## Additional Indices (possibly used by ldapsam:editposix)
#index   sambaSIDList            eq
#index   sambaGroupType          eq
#index   uniqueMember            eq

################ END OF INDEX MAINTENANCE LIST  #######################

#Grant rights to the LDAP directory. 
#TODO: come back and FIX this with the PROPER rights!!!!!
#Reference: http://www.stanford.edu/services/directory/openldap/configuration/slapd-acl.html
access to *
  by * read
access to *
  by * write

#copy the samba.schema file from the doc directory to the /etc/openldap/schema directory
cp /usr/doc/samba-3.0.24/examples/LDAP/samba.schema /etc/openldap/schema/

#Create a file to hold the initial LDAP entries
cat > /tmp/initialtree.ldif << EOF
# Building the root node organization 
dn: dc=example,dc=lan
objectClass: top
objectclass: dcObject
objectclass: organization
dc: example
o: example LAN
description: example.LAN home network

# Organizational Role for Directory Management
dn: cn=Admin,dc=example,dc=lan
objectclass: organizationalRole
cn: admin
description: Directory Manager
objectclass: simpleSecurityObject
userPassword: {SSHA}lkFH5nh2tq+iaCHaTi4gh2M62PaMOnjD

# Setting up the home Organizational Unit
dn: ou=home,dc=example,dc=lan
objectclass: top
objectclass: organizationalUnit
ou: home

# Setting up the Users OU inside of the home OU
dn: ou=people,ou=home,dc=example,dc=lan
objectclass: top
objectclass: organizationalUnit
ou: people

# Setting up container for groups
dn: ou=groups,ou=home,dc=example,dc=lan
objectclass: top
objectclass: organizationalUnit
ou: groups

# Setting up container for computers
dn: ou=computers,ou=home,dc=example,dc=lan
objectclass: top
objectclass: organizationalUnit
ou: computers

# Setting up container for IDMAP
dn: ou=idmap,ou=home,dc=example,dc=lan
objectclass: top
objectclass: organizationalUnit
ou: idmap
EOF

#ensure that the LDAP data directory exists
mkdir -p /etc/openldap/data/example.lan

#Copy in a DB_CONFIG file to prevent annoying error messages
cp /etc/openldap/DB_CONFIG.example /etc/openldap/data/example.lan/DB_CONFIG

#Use 'slapadd' to populate the LDAP tree using the file containing the initial LDAP records.
slapadd -vl /tmp/initialtree.ldif

#create or overwrite( > ) an rc.slap file
cat > /etc/rc.d/rc.slapd << EOF
#!/bin/bash
# -x
#
# /etc/rc.d/rc.slapd
#
# Start/stop/restart the slapd daemon
#
# To make SLAP start automatically at boot, make this
# file executable:  chmod 755 /etc/rc.d/rc.slapd
#
#
# IMPORTANT NOTE: To kill off slapd safely, you should give 
#  a command like this:
#
#       kill -INT `cat /var/run/slapd.pid`
#
#  where /var/run is determined by configure.
#
#Killing slapd by a more drastic method may cause information loss or database corruption.

slap_start() {
  if [ -x /usr/bin/slapd -a -f /etc/openldap/slapd.conf ]; then
       echo "Starting Slap  /usr/bin/slapd"
       /usr/bin/slapd
  fi
}

slap_stop() {
  if [ -f /var/run/slapd.pid ] ; then
       kill -INT \`cat /var/run/slapd.pid\`
  else
       echo "I can't find /var/run/slapd.pid.  Will try to nuke any running slapd processes"
           killall -INT slapd
  fi
}

slap_restart() {
  slap_stop
  sleep 2
  slap_start
}

case "\$1" in
'start')
  slap_start
  ;;
'stop')
  slap_stop
  ;;
'restart')
  slap_restart
  ;;
*)
  # Default is "start", for backwards compatibility with previous
  # Slackware versions.  This may change to a 'usage' error someday.
  slap_start
esac

EOF

#Change the permissions on the rc.slap file so that it is executable
chmod 700 /etc/rc.d/rc.slapd

#Add (append >> ) the rc.slap command to the rc.local startup file
cat >> /etc/rc.d/rc.local << EOF

if [ -x /etc/rc.d/rc.slapd ] ; then
  echo "Starting the slapd daemon...."
  /etc/rc.d/rc.slapd start
fi
EOF


#Start the slap server 
/etc/rc.d/rc.slapd start

#look for slapd entries in the last 300 entries of /var/log/debug
tail -n 300 /var/log/debug | grep -i slapd

#wait for 4 seconds to allow for a good look at the logs
sleep 4

#use ldapsearch to list out the contents of the ldap database thus far
# using dc=example,dc=lan as a base
ldapsearch -x -b dc=example,dc=lan -LLL

cat > /tmp/testuser.ldif << EOF
dn: cn=testuser,ou=Groups,ou=home,dc=example,dc=lan
gidNumber: 2000
cn: testuser
userPassword:
objectClass: posixGroup
memberUid: testuser

dn: uid=testuser,ou=People,ou=home,dc=example,dc=lan
cn: Test User
uid: testuser
uidNumber: 2000
loginShell: /bin/bash
homeDirectory: /home/testuser
#The following userPassword is set to:   letmein
userPassword:: e2NyeXB0fU1EQ2NjZFZVQ0FMZFE=
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
shadowLastChange: 13606
givenName: Test
sn: User
gecos: Test User
gidNumber: 2000
EOF

#add user using (-x simple authentication) (-f get data from file) 
#   -D "login as the following administrator user"  ( -w with_password)
ldapadd -x -f /tmp/testuser.ldif -D "cn=admin,dc=example,dc=lan" -w secretpw

#sample commands to run to verify that your LDAP server is running correctly.
#list all the POSIX users
getent passwd

#list all the POSIX groups
getent group

#get the listing for our testuser user
id testuser

ldapdelete -x -h localhost -D "cn=admin,dc=example,dc=lan" -w secretpw \
 "uid=testuser,ou=People,ou=home,dc=example,dc=lan"
ldapdelete -x -h localhost -D "cn=admin,dc=example,dc=lan" -w secretpw \
  "cn=testuser,ou=Groups,ou=home,dc=example,dc=lan"

[global]
#Microsoft enjoys using the DCs for the name of the domain.  The domain name can , in fact, be anything.
# In the case used here, rather than using "example.lan" for the name of the domain or workgroup, the TLD 
# component ".lan" will be dropped and replaced with the suffix "_DOM" to signify that it is a DOMain.
        workgroup = example_dom

        #The description of the server as it will appear when browsed.
        server string = Main File and Print server

        #Setting the security mode for this samba installation.
        security = user

        #Setting the location, size and level of the log files. 
        #   **Be sure the /var/log/samba path exists!!**
        log file = /var/log/samba/log.%m
        max log size = 50
        log level = 3


        dns proxy = no

        #Provide WINS support (Be a WINS server) on the network
        wins support = yes

        #Tell the Samba server to act as a domain controller for NT4 style domain services
        domain logons = yes

        #Performance tuning options
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

        #specify the local path to which the home directory will be connected
        logon drive = P:

        #Negotiate encrypted passwords with the client
        encrypt passwords = true

        #Unix users can map to different SMB User names
        username map = /etc/samba/smbusers


#Setting LDAP parameters
#TODO:  Document these better when 3.0.25 comes out with the updated man pages for smb.conf
#Set Samba to use the an LDAP database for storing user and group information 
        passdb backend = ldapsam

#inform Samba that the complete user and group database that is relevant to Samba is
#   stored in LDAP with the standard posixAccount/posixGroup attributes and that the  Samba  
#   auxiliary object classes are stored together with the POSIX data in the same LDAP object.  
#   This allows Samba to completely bypass the NSS system to query user information. 
        ldapsam:trusted=yes

#Activate the editposix extention so that the posix user management can be maintained by samba.
        ldapsam:editposix=yes

#Define whether or not Samba should sync the LDAP password with the NT and LM hashes for normal 
#   accounts (NOT for  workstation,  server  or domain trusts) on a password change via SAMBA. 
#
#       Default = no ( only update NT and LM passwords and update the pwdLastSet time.)
#       ldap password sync = no


#specify where idmap is go to use LDAP to obtain SID to UID / GID mappings for unmapped SIDs instead of having
# to use a local idmap tdb file.
        idmap backend = ldap:ldap://127.0.0.1

#Set the UID and GID range that idmap can use
        idmap uid = 1000-60000
        idmap gid = 1000-60000

#Set the ldap administrator information as well as the base suffix 
#    and the Users, Groups, and Computer suffixes
        ldap admin dn = cn=admin,dc=example,dc=lan
        ldap suffix = ou=home,dc=example,dc=lan
        ldap user suffix = ou=Groups
        ldap group suffix = ou=People
        ldap machine suffix = ou=Computers
        ldap idmap suffix = ou=idmap

# *WARNING* - pay attention to the following parameter!!!
# setting the following parameter to yes will cause a delete operation in ldapsam to delete
# the COMPLETE ldap entry and not just the SAMBA attributes. 
        ldap delete dn = yes




[homes]
   comment = Home Directories
   browseable = no
   writable = yes

[netlogon]
  comment = Network Logon Service
# **BE SURE THE FOLLOWING PATH EXISTS**
  path = /home/sambadata/netlogon
  guest ok = yes
   writable = no
   share modes = no
[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
   guest ok = no
   writable = no
   printable = yes

[sys]
   comment = Network Share
   path = /home/sys
   writable = yes
   printable = no
#NOTE: The name of the group @domusers, is the name of the unix group that the 'net sam provision'
#      script will create.  TODO: Document this behavior on the wiki.samba.org/ldapsam_editposix page.
   write list = @domusers

#optional step to set the local and domain SIDs
net setlocalsid S-1-5-21-4001470350-4061692207-2918579299
net setdomainsid S-1-5-21-4001470350-4061692207-2918579299

#Store the LDAP admin password in samba
smbpasswd -w secretpw

#Launch the first samba daemon that will be required by 'net sam provision'
winbindd

#Run the command to provision the database
net sam provision

#Now let's start samba (slackware style)
/etc/rc.d/rc.samba start

#Now we must set samba account rights to the Administrator user
net rpc rights grant Administrator SeAddUsersPrivilege -U Administrator
net rpc rights grant Administrator SeMachineAccountPrivilege -U Administrator