# Mac OS X: 實用腳本程序(bash scripts)系列-8 # AD Binding的一個腳本實例 Active Directory在現實企業管理中已經成為了現實的標準，Open Directory, Active Directory,或者eDirectory等都是基于Directory原理實現的，都有各自的實現和擴展，各有優勢。基于現實中PC機和AD服務在企業中應用的普及性，在企業中把Mac或者其它系統納入AD管理，也就是AD集成可以說在企業中的應用很普遍。實際中要考慮系統版本號的兼容，自己企業AD的配置情況，管理特點，當然別忘了把客戶計算機先加入到AD中，設置相應的GPO和管理環境所需的管理組等。 ? 下面的腳本就是一個實際企業環境中把Mac系統納入到AD管理環境的實際例子. 謹和大家分享: <table id="x_6f" border="1" cellspacing="0" cellpadding="3" width="100%" bordercolor="#000000"><tbody><tr><td width="100%"><p> #--------------------------------------------------------------------------------------<br/> # Check for Valid Corp Network IP Address<br/> CorpIP=""<br/> check=20<br/>Limit=check<br/> X=0<br/> while [ "$CorpIP" = "" ]<br/> do<br/> ??? echo "Checking valid IP detected...$check times."<br/> ??? CorpIP=$(ifconfig| grep "inet 10.")<br/> ??? X=$((X+1))<br/> ??? if [ $X -ge $limit ]; then<br/> ?????? CorpIP="NO_ValidIP"<br/> ?????? break<br/> ??? fi<br/> ??? check=$((check-1))<br/> ??? sleep 2<br/> done<br/><br/> echo "Detected IP: $CorpIP"<br/><br/> if [ "$CorpIP" = "NO_ValidIP" ]; then<br/> ??? echo "Binding failed! Valid Corp Network not detected!"<br/> ??? osascript -e 'set volume 4'<br/> ??? say "Binding failed! Valid Corp IP Address not detected!"<br/> ??? exit 1<br/> fi<br/><br/>#--------------------------------------------------------------------------------------<br/> # Host-specific parameters<br/> #--------------------------------------------------------------------------------------<br/> computerid=`/usr/sbin/scutil --get LocalHostName`<br/><br/> #--------------------------------------------------------------------------------------<br/> # Standard Parameters used to Bind Workstation to AD<br/> #--------------------------------------------------------------------------------------<br/> domain="Corp.com"<br/> udn="MacADIAdmin"<br/> password="Mac1nt0SH"<br/> ou="CN=Computers,DC=Corp,DC=com"<br/><br/> #--------------------------------------------------------------------------------------<br/> # Advanced Options for AD Plugin<br/> #--------------------------------------------------------------------------------------<br/> alldomains="enable" <br/> localhome="disable"<br/> protocol="afp" <br/> mobile="disable" <br/>mobileconfirm="disable" <br/>useuncpath="enable"<br/> user_shell="/bin/bash"<br/>preferred="-nopreferred"<br/>admingroups="Corp/WSAdmins"<br/> searchPathLDAP=`cat/Library/Preferences/DirectoryService/SearchNodeConfig.plist | grepLDAPv3 | sed -e 's!string&gt;!!g' -e 's!&lt;//!!g' | tr -d '/t'`<br/><br/> #--------------------------------------------------------------------------------------<br/> # Synchronize Time with Corp Network Time Server<br/> #--------------------------------------------------------------------------------------<br/> echo "Setting the Network Time Server to 10.0.1.1 ... Please Wait"<br/> "$1/Contents/Resources/systemsetup-tiger" -setusingnetworktime off &gt;&amp; /dev/null<br/> "$1/Contents/Resources/systemsetup-tiger" -setnetworktimeserver 10.0.1.1 &gt;&amp; /dev/null<br/> "$1/Contents/Resources/systemsetup-tiger" -setusingnetworktime on &gt;&amp; /dev/null<br/><br/> echo "Restarting Network Time Service... Please Wait"<br/> SystemStarter -d restart "Network Time" &gt;&amp; /dev/null<br/><br/> #--------------------------------------------------------------------------------------<br/> # Attempt to force unbind the workstation<br/> #--------------------------------------------------------------------------------------<br/> echo "Attempting a force unbind in case system is already bound to AD... Please Wait."<br/> dsconfigad -r -f -u baduser -p badpass &gt;&amp; /dev/null<br/><br/> #--------------------------------------------------------------------------------------<br/> # Disable Unused Protocols<br/> #--------------------------------------------------------------------------------------<br/> echo "Disable all unused protocols (AppleTalk, BSD, SMB, SLP)... Please Wait."<br/> defaults write /Library/Preferences/DirectoryService/DirectoryService AppleTalk -string Inactive<br/> defaults write /Library/Preferences/DirectoryService/DirectoryService BSD -string Inactive<br/> defaults write /Library/Preferences/DirectoryService/DirectoryService SMB -string Inactive<br/> defaults write /Library/Preferences/DirectoryService/DirectoryService SLP -string Inactive<br/> plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist<br/><br/> #--------------------------------------------------------------------------------------<br/> # Activate the AD plugin<br/> #--------------------------------------------------------------------------------------<br/> echo "Activating AD Plugin... Please Wait."<br/> defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active"<br/> plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist<br/><br/> #--------------------------------------------------------------------------------------<br/> # Bind to AD<br/> #--------------------------------------------------------------------------------------<br/> echo "Binding system to AD as '$computerid'... Please Wait."<br/> bind_result=`dsconfigad -f -a $computerid -domain $domain -u $udn -p "$password" -ou "$ou"`<br/><br/> if [ "$bind_result" != "Computer was successfully Added to Active Directory." ]; then<br/> ??? echo "Binding failed! Check the Computer Name and ensure it has an account in Active Directory"<br/> ??? osascript -e 'set volume 4'<br/>?? ?osascript -e 'say "I am sorry but Active Directory binding failed!Please check the computer name and ensure this system has an account inActive Directory." using "Vicki"'<br/> ??? exit 1<br/> else<br/> ??? echo "$bind_result"<br/> fi</p><p>?</p><p># Write value so workstation can be easily identified being bound to AD<br/> defaults write /Library/Preferences/com.apple.RemoteDesktop "Text4" 'Bound to AD - OSXServer - v2.0'<br/><br/> #--------------------------------------------------------------------------------------<br/> # Configure advanced AD plugin options<br/> #--------------------------------------------------------------------------------------<br/> echo "Configuring Advanced AD Plugins... Please Wait."<br/> if [ "$admingroups" = "" ]; then<br/> ??? dsconfigad -nogroups<br/> else<br/> ??? dsconfigad -groups "$admingroups"<br/> fi<br/><br/> dsconfigad -alldomains $alldomains -localhome $localhome -protocol $protocol /<br/> ??? -mobile $mobile -mobileconfirm $mobileconfirm -useuncpath $useuncpath /<br/> ??? -shell $user_shell $preferred<br/><br/> #--------------------------------------------------------------------------------------<br/> # Add the AD node to the search path<br/> # Delay a bit to give the Directory Service a chance to catch its breath<br/> #--------------------------------------------------------------------------------------<br/> echo "Adding AD to Search Path... Please Wait."<br/><br/>if [ "$searchPathLDAP" = "" ] || [ `echo $searchPathLDAP| grep127.0.0.1` ] || [ `echo $searchPathLDAP| grep localhost` ]; then<br/> ??? echo "No existing LDAP path... Only writing AD. Please Wait."<br/> ??? defaults write/Library/Preferences/DirectoryService/SearchNodeConfig "Search NodeCustom Path Array" -array "/Active Directory/All Domains"<br/> ??? defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3<br/> ??? plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist<br/><br/>else<br/> ??? echo "LDAP path is /$searchPathLDAP... Writing AD as first search and LDAP second. Please Wait."<br/> ??? defaults write/Library/Preferences/DirectoryService/SearchNodeConfig "Search NodeCustom Path Array" -array "/Active Directory/All Domains""/$searchPathLDAP"<br/> ??? defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3<br/> ??? plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist<br/> fi<br/><br/> #--------------------------------------------------------------------------------------<br/> # Restart DirectoryService (necessary to reload AD plugin activation settings)<br/> #--------------------------------------------------------------------------------------<br/> echo "Restarting DirectoryService... Please Wait."<br/> sleep 2<br/> killall DirectoryService &gt;&amp; /dev/null<br/> sleep 8<br/><br/> #--------------------------------------------------------------------------------------<br/> # Disable autologin - If it's enabled<br/> #--------------------------------------------------------------------------------------<br/> echo "Disabling autologin if enabled... Please Wait."<br/> defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser &gt;&amp; /dev/null<br/> srm /etc/kcpassword &gt;&amp; /dev/null<br/><br/> #--------------------------------------------------------------------------------------<br/> # Complete<br/> #--------------------------------------------------------------------------------------<br/> echo "Done. AD Bind Successful."<br/> exit 0 </p></td>?? ? </tr></tbody></table>