Пример

Статья

###################################################################
# Ввод в домен с помощью winbind, выше был sssd вроде ? непонятно
###################################################################
# yum install samba-winbind samba-winbind-clients samba pam_krb5 krb5-workstation chrony
 
 
##########################
# Генерация конфига kerberos
##########################
authconfig --enablekrb5 --krb5kdc=netsrv.pw --krb5adminserver=netsrv.pw --krb5realm=NETSRV.PW --enablewinbind --enablewinbindauth --smbsecurity=ads --smbrealm=NETSRV.PW --smbservers=netsrv.pw --smbworkgroup=NETSRV --winbindtemplatehomedir=/home/%U --winbindtemplateshell=/bin/bash --enablemkhomedir --enablewinbindusedefaultdomain --update
 
###########################
	# Заводим самбу в домен
net ads join -U <username>
net ads testjoin
 
 
##########################
# конфиг smb.conf
##########################
[global]
   workgroup = NETSRV
   password server = NETSRV.PW
   realm = NETSRV.PW
   security = ads
   idmap config * : range = 16777216-33554431
   template homedir = /home/%U
   template shell = /bin/bash
   kerberos method = secrets only
   winbind use default domain = true
   winbind offline logon = false
 
   passdb backend = tdbsam
 
   load printers = no
   show add printer wizard = no
   printcap name = /dev/null
   disable spoolss = yes
 
   domain master = no
   local master = no
   preferred master = no
   os level = 1
 
   log level = 3
   log file = /var/log/samba/log.%m
 
 
#####################################
	# Далее
systemctl start winbind
systemctl start smb.service
 
	# Делаем проверки
wbinfo -t
	перечень пользователей/групп
wbinfo -u
wbingo -g
wbinfo -i <username>
 
	# Проверка авторизации в домене
wbinfo -a <domain-name>\\<username>
 
	# Должна подгрузится инфа по пользователю
id <username(доменный)>

Это под вопросом

#####################################
# Ввод сервера в домен (sssd вроде)
#####################################
yum -y install krb5-user samba winbind ntp samba-winbind samba-winbind-clients pam_krb5
"127.0.0.1   localhost localhost.localdomain serviceApps serviceApps.netsrv.pw" > /etc/hosts
 
<=правки в /etc/krb5.conf=>
	# авторизация хоста в домене
kinit <username>
	# проверка
klist
 
	# здесь еще вроде как ввод в домен 
realm discover <name-domain>
realm join -U <username> <domain-name>
 
	# Информация о домене
realm list
adcli info netsrv.pw
 
############################################
	# параметры авторизации в /etc/krb5.conf
############################################
[libdefaults]
	default_realm = <имя-домена>
        ticket_lifetime = 24h
        forwardable = true
[realms]
        NETSRV.PW = {
                kdc = <ip-контроллера>
                default_domain = <имя-домена>
        }
[domain_realm]
	.netsrv.pw = NETSRV.PW
    netsrv.pw = NETSRV.PW
 
 
[appdefaults]
	pam = {
               	debug = false
                ticket_lifetime = 36000
                renew_lifetime = 36000
                forwardable = true
                krb4_convert = false
        }
[logging]
	kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmin.log
        default = FILE:/var/log/krb5lib.log
 
 
##########################
	# параметры в smb.conf
##########################
[global]
	unix extensions = no
	workgroup = NETSRV
	realm = NETSRV.PW
	security = ads
	domain master = no
	local master = no
	preferred master = no
	load printers = no
	printcap name = /etc/printcap
 
	idmap config NETSRV : backend = rid
	idmap config NETSRV : range = 5000-10000000
	idmap config NETSRV : base_rid = 0
 
	winbind enum users = yes
	winbind enum groups = yes
	winbind use default domain = yes
	winbind nested groups = yes
	winbind refresh tickets = yes
	winbind offline logon = true
 
	template homedir = /home/%D/%U
	template shell = /bin/false
	client use spnego = yes
	client ntlmv2 auth = yes
	encrypt passwords = yes
	restrict anonymous = 2
	log file = /var/log/samba/samba.log
	log level = 1
	map to guest = Bad User
	socket options = TCP_NODELAY
	aio read size = 1
	aio write size = 1
 
 
[mySuperShare]
path = /path/path/logs
guest ok = no
browsable = no
writeable = no
follow symlinks = yes
wide links = yes
create mask = 0444
directory mask = 0444
valid users = @NETSRV\ACL_FProfilesAutoAcceleration_R