HSBC AU アカウントアクティヴ化

Dear TOSHIKA-SAN,

I am sorry to learn that your accounts have been rendered inactive. I know that this is important to you.

I have today forwarded a reactivation request to our processing team.

Your accounts will be reactivated within 2-3 business days upon receipt of request. I regret any inconvenience that this procedure has caused you.

Please note that an account becomes 'dormant' if no withdrawals are made over a period of 12 months or more and becomes “unclaimed” after 24 months or more. Please ensure that you make a withdrawal within the timeframe indicated to avoid any account deactivation in the future.

HSBC is also in the process of updating our customer details on file. We may need you to supply us with the following information below so this can be updated on your account.

- Permanent Residence and Postal Address
- Time At Address (Address Since)
- Mobile, Home, Business Phone Numbers
- Occupation, Job Title and Employer’s name
Please feel free to send us a secure email using your device logon confirming the above information.

We thank you for using HSBC Personal Internet Banking to access your account online.

Read More

Raspberry Piで統合認証環境を作ってみる pt.6 samba パスワードポリシー設定

 passwordの複雑性や有効期限の変更を行う。Windowsの管理ツールでは対応していない。

root@raspberry1:/home/pi# /opt/samba/bin/samba-tool domain passwordsettings show

Password informations for domain 'DC=yamatomura,DC=local'

Password complexity: on

Store plaintext passwords: off

Password history length: 24

Minimum password length: 7

Minimum password age (days): 1

Maximum password age (days): 42

Account lockout duration (mins): 30

Account lockout threshold (attempts): 0

Reset account lockout after (mins): 30

root@raspberry1:/home/pi# /opt/samba/bin/samba-tool domain passwordsettings set --complexity=off

Password complexity deactivated!

All changes applied successfully!

root@raspberry1:/home/pi# /opt/samba/bin/samba-tool domain passwordsettings set --min-pwd-age=0

Minimum password age changed!

All changes applied successfully!

root@raspberry1:/home/pi# /opt/samba/bin/samba-tool domain passwordsettings set --max-pwd-age=0

Maximum password age changed!

All changes applied successfully!

root@raspberry1:/home/pi# /opt/samba/bin/samba-tool domain passwordsettings show

Password informations for domain 'DC=yamatomura,DC=local'

Password complexity: off

Store plaintext passwords: off

Password history length: 24

Minimum password length: 7

Minimum password age (days): 0

Maximum password age (days): 0

Account lockout duration (mins): 30

Account lockout threshold (attempts): 0

Reset account lockout after (mins): 30

Read More

samba 4.2.1 設定（AD 1台のみ版）

  GNU nano 2.2.6             File: /etc/modules                                 

# /etc/modules: kernel modules to load at boot time.

#

# This file contains the names of kernel modules that should be loaded

# at boot time, one per line. Lines beginning with "#" are ignored.

# Parameters can be specified after the module name.

snd-bcm2835

ipv6

  GNU nano 2.2.6                         File: /etc/network/interfaces                                                         

auto lo

iface lo inet loopback

auto eth0

allow-hotplug eth0

#iface eth0 inet manual

iface eth0 inet static

address 192.168.0.20

gateway 192.168.0.1

netmask 255.255.255.0

network 192.168.0.0

broadcast 192.168.0.255

dns-nameservers 192.168.0.20 192.168.0.1

dns-search yamatomura.local

auto wlan0

allow-hotplug wlan0

iface wlan0 inet manual

wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

auto wlan1

allow-hotplug wlan1

iface wlan1 inet manual

wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

  GNU nano 2.2.6                         File: /opt/samba/etc/smb.conf                                                         

# Global parameters

[global]

        workgroup = YAMATOMURA

        realm = YAMATOMURA.LOCAL

        netbios name = RASPBERRY1

        server role = active directory domain controller

        dns forwarder = 192.168.0.1

        server services = rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate, dns, smb

        dcerpc endpoint servers = epmapper, wkssvc, rpcecho, samr, netlogon, lsarpc, spoolss, drsuapi, dssetup, unixinfo, brow$

        idmap_ldb:use rfc2307 = yes

[netlogon]

        path = /opt/samba/var/locks/sysvol/yamatomura.local/scripts

        read only = No

[sysvol]

        path = /opt/samba/var/locks/sysvol

        read only = No

  GNU nano 2.2.6                             File: /etc/hosts                                                                  

127.0.0.1       localhost.yamatomura.local localhost

::1             localhost ip6-localhost ip6-loopback

fe00::0         ip6-localnet

ff00::0         ip6-mcastprefix

ff02::1         ip6-allnodes

ff02::2         ip6-allrouters

192.168.0.20    raspberry1.yamatomura.local raspberry1 

less /etc/init.d/samba-ad-dc

#! /bin/sh

### BEGIN INIT INFO
# Provides:          samba-ad-dc
# Required-Start:    $network $local_fs $remote_fs
# Required-Stop:     $network $local_fs $remote_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: start Samba daemons for the AD DC
### END INIT INFO

#
# Start/stops the Samba daemon (samba).
# Adapted from the Samba 3 packages.
#

PIDDIR=/opt/samba/var/run
SAMBAPID=$PIDDIR/samba.pid

# clear conflicting settings from the environment
unset TMPDIR

# See if the daemon and the config file are there
test -x /opt/samba/sbin/samba -a -r /opt/samba/etc/smb.conf || exit 0

. /lib/lsb/init-functions

case "$1" in
        start)
                SERVER_ROLE=`/opt/samba/bin//opt/samba/bin/samba-tool testparm --parameter-name="server role"  2>/dev/null | tail -1`
                if [ "$SERVER_ROLE" != "active directory domain controller" ]; then
                    exit 0
                fi

                if init_is_upstart; then
                        exit 1
                fi

                # CVE-2013-4475
                KEYFILE=/var/lib/samba/private/tls/key.pem
                if [ -e $KEYFILE ]
                then
                                KEYPERMS=`stat -c %a $KEYFILE`
                                if [ "$KEYPERMS" != "600" ]
                                then
                                                echo "wrong permission on $KEYFILE, must be 600"
                                                echo "samba will not start (CVE-2013-4475)"
                                                echo "Removing all tls .pem files will cause an auto-regeneration with the correct permissions."
                                                exit 1
                                fi
                fi

                log_daemon_msg "Starting Samba AD DC daemon" "samba"
                # Make sure we have our PIDDIR, even if it's on a tmpfs
                install -o root -g root -m 755 -d $PIDDIR

                if ! start-stop-daemon --start --quiet --oknodo --exec /opt/samba/sbin/samba -- -D; then
                        log_end_msg 1
                        exit 1
                fi

                log_end_msg 0
                ;;
        stop)
                if init_is_upstart; then
                        exit 0
                fi
                log_daemon_msg "Stopping Samba AD DC daemon" "samba"

                start-stop-daemon --stop --quiet --pidfile $SAMBAPID
                # Wait a little and remove stale PID file
                sleep 1
                if [ -f $SAMBAPID ] && ! ps h `cat $SAMBAPID` > /dev/null
                then
                        # Stale PID file (samba was succesfully stopped),
                        # remove it (should be removed by samba itself IMHO.)
                        rm -f $SAMBAPID
                fi

                log_end_msg 0

                ;;
        restart|force-reload)
                if init_is_upstart; then
                        exit 1
                fi
                $0 stop
                sleep 1
                $0 start
                ;;
        status)
                status_of_proc -p $SAMBAPID /opt/samba/sbin/samba samba
                exit $?
                ;;
        *)
                echo "Usage: /etc/init.d/samba-ad-dc {start|stop|restart|force-reload|status}"
                exit 1
                ;;
esac

exit 0

  GNU nano 2.2.6                                 File: /etc/krb5.conf                                                                         

[logging]
        default = FILE:/var/log/krb5libs.log
        kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmind.log

[libdefaults]
        default_realm = YAMATOMURA.LOCAL
        dns_lookup_realm = true
        dns_lookup_kdc = true

[realms]
        YAMATOMURA.LOCAL = {
        kdc = raspberry1.yamatomura.local
        admin_server = raspberry1.yamatomura.local
        }

[domain_realm]
        .yamatomura.local = YAMATOMURA.LOCAL
        yamatomura.local = YAMATOMURA.LOCAL

Read More

Raspberry Piで統合認証環境を作ってみる pt.5 samba設定

前提
ad1号機 raspberry1.yamatomura.local 192.168.0.20
samba導入先 /opt/samba
gateway 192.168.0.1

基本的にsheepdogさんのweb siteをそのまま。

1.samba設定

root@raspberry1:/# /opt/samba/bin/samba-tool domain provision --use-rfc2307 --interactive --use-ntvfs

Realm: yamatomura.local

 Domain [Yamatomura]:  yamatomura

 Server Role (dc, member, standalone) [dc]: dc

 DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: SAMBA_INTERNAL

 DNS forwarder IP address (write 'none' to disable forwarding) [192.168.1.20]: 192.168.0.1

2.resolv.conf設定の代わりにinterface設定

　以前の投稿の様に、resolv.confを設定しても再起動すると上書きされるので、interfaceを設定する。DNSを自分自身とgatewayにする。以下の通り、dns-namservers , dns-searchを記述する。

iface eth0 inet static

address 192.168.0.20

gateway 192.168.0.1

netmask 255.255.255.0

network 192.168.0.0

broadcast 192.168.0.255

dns-nameservers 192.168.0.20 192.168.0.1

dns-search yamatomura.local

3.samba起動とテスト

root@raspberry1:/# /opt/samba/sbin/samba

root@raspberry1:/# /opt/samba/sbin/samba -V

Version 4.2.1

root@raspberry1:/# /opt/samba/bin/smbclient --version

Version 4.2.1

root@raspberry1:/# /opt/samba/bin/smbclient -L localhost -U%

Domain=[YAMATOMURA] OS=[Unix] Server=[Samba 4.2.1]

Sharename       Type      Comment

---------       ----      -------

netlogon        Disk      

sysvol          Disk      

IPC$            IPC       IPC Service

Domain=[YAMATOMURA] OS=[Unix] Server=[Samba 4.2.1]

Server               Comment

---------            -------

Workgroup            Master

---------            -------

4.samba認証の確認

root@raspberry1:/# /opt/samba/bin/smbclient //localhost/netlogon -UAdministrator -c 'ls'

Enter Administrator's password: 

Domain=[YAMATOMURA] OS=[Unix] Server=[Samba 4.2.1]

  .                                   D        0  Wed May 20 23:41:54 2015

  ..                                  D        0  Wed May 20 23:43:42 2015

30501800 blocks of size 512. 22098024 blocks available

5.samba4 ad用の起動スクリプト
　sheepdogさんのweb siteをそのままだが、環境変更しているので、それを反映。

wget "http://anonscm.debian.org/gitweb/?p=pkg-samba/samba.git;a=blob_plain;f=debian/samba.samba-ad-dc.init;h=3132d2e367675f822342a5b7bc2e50c046aa3b8f;hb=HEAD" -O /etc/init.d/samba-ad-dc

/opt/sambaにsambaを導入しているので、install pathに合わせてsedでパスを変更する。samba wikiをそのまま。

root@raspberry1:/# sed -i 's|/usr/sbin|/opt/samba/sbin|g' /etc/init.d/samba-ad-dc

root@raspberry1:/# sed -i 's|/etc/samba|/opt/samba/etc|g' /etc/init.d/samba-ad-dc

root@raspberry1:/# sed -i 's|/var/run/samba|/opt/samba/var/run|g' /etc/init.d/samba-ad-dc

root@raspberry1:/# sed -i 's|samba-tool|/opt/samba/bin/samba-tool|g' /etc/init.d/samba-ad-dc

起動スクリプトの権限付与等。samba wikiだとスクリプト名がsamba4になっているので、samba-ad-dcに修正。

root@raspberry1:/# chmod 755 /etc/init.d/samba-ad-dc 

root@raspberry1:/# update-rc.d samba-ad-dc defaults

update-rc.d: using dependency based boot sequencing

6.kerberos認証の設定

/opt/samba/private/krb5.confが作られ、これを複製すれば最低限動作する設定となるが、いろいろあるみたいで、調査したものへ差し替えとした。

root@raspberry1:/# cp /opt/samba/private/krb5.conf /etc

7.各種サービスの名前解決の確認
　ldapとkerberosのサービスの名前解決が出来るか。
　自身の名前解決が出来るか。

root@raspberry1:/# host -t SRV _ldap._tcp.yamatomura.local.

_ldap._tcp.yamatomura.local has SRV record 0 100 389 raspberry1.yamatomura.local.

root@raspberry1:/# host -t SRV _kerberos._udp.yamatomura.local.

_kerberos._udp.yamatomura.local has SRV record 0 100 88 raspberry1.yamatomura.local.

root@raspberry1:/# host -t A raspberry1.yamatomura.local.

raspberry1.yamatomura.local has address 192.168.0.20

8.kdc周りの確認

　この時にはドメイン名の最後にドットを付けてはいけない。

root@raspberry1:/# kinit administrator@YAMATOMURA.LOCAL

Password for administrator@YAMATOMURA.LOCAL: 

Warning: Your password will expire in 41 days on Sun Jul  5 22:16:47 2015

root@raspberry1:/# klist

Ticket cache: FILE:/tmp/krb5cc_0

Default principal: administrator@YAMATOMURA.LOCAL

Valid starting    Expires           Service principal

24/05/2015 23:24  25/05/2015 09:24  krbtgt/YAMATOMURA.LOCAL@YAMATOMURA.LOCAL

renew until 31/05/2015 23:24

Read More

raspberry pi (raspbian 2015-5-5)でsamba 4.2.1構築中にkinit周りが動作しない対応

　sheepdogさんのweb siteを参考にsamba 4.2.1を構築しているのだが、最後のkerberos設定が上手く行かない。

　krb5.confを弄り回しても

kinit: Cannot contact any KDC for realm 'YAMATOMURA.LOCAL' while getting initial credentials

　となり、接続で失敗してしまう。

　結論から言えばhostsの修正が必要であった。

127.0.0.1       localhost

::1             localhost ip6-localhost ip6-loopback

fe00::0         ip6-localnet

ff00::0         ip6-mcastprefix

ff02::1         ip6-allnodes

ff02::2         ip6-allrouters

127.0.1.1    raspberry1

　となっていたものを、以下に修正。

127.0.0.1       localhost.yamatomura.local localhost       

::1             localhost ip6-localhost ip6-loopback

fe00::0         ip6-localnet

ff00::0         ip6-mcastprefix

ff02::1         ip6-allnodes

ff02::2         ip6-allrouters

192.168.0.20    raspberry1.yamatomura.local raspberry1      

　元ファイル（自動生成された！？）の127.0.1.1がどの様に生成されているのかが謎だが、一旦これで試験してみる。

（追記）
　なお、FQDNを前に書く必要があるとの事。

Read More

raspberry pi (raspbian 2015-5-5)でresolv.confが毎回空白になる対応

　samba 4.2.1再構築中に再起動すると、resolv.confが毎回空白になってしまう。

　resolv.confを見ると

# Generated by resolvconf

　とあり、結論から言えばresolv.confに書いてもresolvconfによって上書きされる。

　正しくは/etc/network/interfacesにDNS周りの設定を記載すれば良い。

　筆者の環境では以下の様にしている。dns-nameservers,dns-searchnの内容が起動時にresolv.confに転記される。

iface eth0 inet static

address 192.168.0.20

gateway 192.168.0.1

netmask 255.255.255.0

network 192.168.0.0

broadcast 192.168.0.255

dns-nameservers 192.168.0.20 192.168.0.1

dns-search yamatomura.local

　他のblogを見てもresolv.confを編集して事足りている事例が多いが、debian系ではresolv.confに記載するのは誤りの様である。

Read More

raspberry pi (raspbian 2015-5-5)でDHCP clientが止まらない対応

　RaspberryPi2を設定中、/etc/network/interfacesでdhcp不使用設定としても、何故かDHCP clientが起動時にip addressを拾って来た。

　実害は殆ど無いが気持ち悪いので、dhcpcdを停止した。

　停止方法は以下を参考とした。

ls -l /etc/rc*.d/*dhcp*

lrwxrwxrwx 1 root root 16  5月 19 23:07 /etc/rc0.d/K01dhcpcd -> ../init.d/dhcpcd

lrwxrwxrwx 1 root root 16  5月 19 23:07 /etc/rc1.d/K01dhcpcd -> ../init.d/dhcpcd

lrwxrwxrwx 1 root root 16  5月 19 23:07 /etc/rc2.d/S01dhcpcd -> ../init.d/dhcpcd

lrwxrwxrwx 1 root root 16  5月 19 23:07 /etc/rc3.d/S01dhcpcd -> ../init.d/dhcpcd

lrwxrwxrwx 1 root root 16  5月 19 23:07 /etc/rc4.d/S01dhcpcd -> ../init.d/dhcpcd

lrwxrwxrwx 1 root root 16  5月 19 23:07 /etc/rc5.d/S01dhcpcd -> ../init.d/dhcpcd

lrwxrwxrwx 1 root root 16  5月 19 23:07 /etc/rc6.d/K01dhcpcd -> ../init.d/dhcpcd

sudo insserv -r dhcpcd

sudo insserv dhcpcd,stop=2,3,4,5

　として、明示的にrun level 2,3,4,5でdhcpdを停止させた。

　interfaces設定ではdhcpを使う記述は無いのだが...。謎。

（追記）
　どうも初回起動時にLAN接続しているとdhcpdが自動起動する様になると思われる。初回起動時にLAN接続せず、/etc/network/interfaceを設定するとdhcpdは動かない様子。

Read More