source: branches/samba-3.0/docs/htmldocs/Samba3-HOWTO/samba-bdc.html

Last change on this file was 311, checked in by Herwig Bauernfeind, 16 years ago

Update 3.0 to final 3.0.36 (docs)
File size: 48.2 KB
Line 
1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Backup Domain Control</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.0.x HOWTO and Reference Guide"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="prev" href="samba-pdc.html" title="Chapter 4. Domain Control"><link rel="next" href="domain-member.html" title="Chapter 6. Domain Membership"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Backup Domain Control</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="samba-pdc.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="domain-member.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="samba-bdc"></a>Chapter 5. Backup Domain Control</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="orgname">Samba Team</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="orgname">SuSE</span> <span class="surname">Deschner</span></h3><span class="contrib">LDAP updates</span> <div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:gd@suse.de">gd@suse.de</a>&gt;</code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="samba-bdc.html#id2565806">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="samba-bdc.html#id2566212">Essential Background Information</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2566282">MS Windows NT4-style Domain Control</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2566969">LDAP Configuration Notes</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2567334">Active Directory Domain Control</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2567393">What Qualifies a Domain Controller on the Network?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2567484">How Does a Workstation find its Domain Controller?</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-bdc.html#id2567665">Backup Domain Controller Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2568166">Example Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-bdc.html#id2568623">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2568667">Machine Accounts Keep Expiring</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2568722">Can Samba Be a Backup Domain Controller to an NT4 PDC?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2568777">How Do I Replicate the smbpasswd File?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2568882">Can I Do This All with LDAP?</a></span></dt></dl></dd></dl></div><p>
2Before you continue reading this section, please make sure that you are comfortable
3with configuring a Samba domain controller as described in <a class="link" href="samba-pdc.html" title="Chapter 4. Domain Control">Domain Control</a>.
4</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2565806"></a>Features and Benefits</h2></div></div></div><p>
5This is one of the most difficult chapters to summarize. It does not matter what we say here, for someone will
6still draw conclusions and/or approach the Samba Team with expectations that are either not yet capable of
7being delivered or that can be achieved far more effectively using a totally different approach. In the event
8that you should have a persistent concern that is not addressed in this book, please email <a class="ulink" href="mailto:jht@samba.org" target="_top">John H. Terpstra</a> clearly setting out your requirements and/or question, and
9we will do our best to provide a solution.
10</p><p>
11<a class="indexterm" name="id2565832"></a>
12<a class="indexterm" name="id2565841"></a>
13<a class="indexterm" name="id2565848"></a>
14<a class="indexterm" name="id2565854"></a>
15<a class="indexterm" name="id2565864"></a>
16Samba-3 can act as a Backup Domain Controller (BDC) to another Samba Primary Domain Controller (PDC). A
17Samba-3 PDC can operate with an LDAP account backend. The LDAP backend can be either a common master LDAP
18server or a slave server. The use of a slave LDAP server has the benefit that when the master is down, clients
19may still be able to log onto the network. This effectively gives Samba a high degree of scalability and is
20an effective solution for large organizations. If you use an LDAP slave server for a PDC, you will need to
21ensure the master's continued availability if the slave finds its master down at the wrong time,
22you will have stability and operational problems.
23</p><p>
24<a class="indexterm" name="id2565888"></a>
25<a class="indexterm" name="id2565897"></a>
26<a class="indexterm" name="id2565906"></a>
27<a class="indexterm" name="id2565915"></a>
28While it is possible to run a Samba-3 BDC with a non-LDAP backend, that backend must allow some form of
29"two-way" propagation of changes from the BDC to the master. At this time only LDAP delivers the capability
30to propagate identity database changes from the BDC to the PDC. The BDC can use a slave LDAP server, while it
31is preferable for the PDC to use as its primary an LDAP master server.
32</p><p>
33<a class="indexterm" name="id2565932"></a>
34<a class="indexterm" name="id2565941"></a>
35<a class="indexterm" name="id2565950"></a>
36<a class="indexterm" name="id2565962"></a>
37<a class="indexterm" name="id2565968"></a>
38<a class="indexterm" name="id2565975"></a>
39<a class="indexterm" name="id2565982"></a>
40The use of a non-LDAP backend SAM database is particularly problematic because domain member
41servers and workstations periodically change the Machine Trust Account password. The new
42password is then stored only locally. This means that in the absence of a centrally stored
43accounts database (such as that provided with an LDAP-based solution) if Samba-3 is running
44as a BDC, the BDC instance of the domain member trust account password will not reach the
45PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs, this results in
46overwriting the SAM that contains the updated (changed) trust account password with resulting
47breakage of the domain trust.
48</p><p>
49<a class="indexterm" name="id2566003"></a>
50<a class="indexterm" name="id2566012"></a>
51<a class="indexterm" name="id2566021"></a>
52<a class="indexterm" name="id2566030"></a>
53Considering the number of comments and questions raised concerning how to configure a BDC,
54let's consider each possible option and look at the pros and cons for each possible solution.
55<a class="link" href="samba-bdc.html#pdc-bdc-table" title="Table 5.1. Domain Backend Account Distribution Options">The Domain Backend Account Distribution Options table below</a> lists
56possible design configurations for a PDC/BDC infrastructure.
57</p><div class="table"><a name="pdc-bdc-table"></a><p class="title"><b>Table 5.1. Domain Backend Account Distribution Options</b></p><div class="table-contents"><table summary="Domain Backend Account Distribution Options" border="1"><colgroup><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="center">PDC Backend</th><th align="center">BDC Backend</th><th align="left">Notes/Discussion</th></tr></thead><tbody><tr><td align="center"><p>Master LDAP Server</p></td><td align="center"><p>Slave LDAP Server</p></td><td align="left"><p>The optimal solution that provides high integrity. The SAM will be
58 replicated to a common master LDAP server.</p></td></tr><tr><td align="center"><p>Single Central LDAP Server</p></td><td align="center"><p>Single Central LDAP Server</p></td><td align="left"><p>
59 A workable solution without failover ability. This is a usable solution, but not optimal.
60 </p></td></tr><tr><td align="center"><p>tdbsam</p></td><td align="center"><p>tdbsam + <code class="literal">net rpc vampire</code></p></td><td align="left"><p>
61 Does not work with Samba-3.0; Samba does not implement the
62 server-side protocols required.
63 </p></td></tr><tr><td align="center"><p>tdbsam</p></td><td align="center"><p>tdbsam + <code class="literal">rsync</code></p></td><td align="left"><p>
64 Do not use this configuration.
65 Does not work because the TDB files are live and data may not
66 have been flushed to disk. Furthermore, this will cause
67 domain trust breakdown.
68 </p></td></tr><tr><td align="center"><p>smbpasswd file</p></td><td align="center"><p>smbpasswd file</p></td><td align="left"><p>
69 Do not use this configuration.
70 Not an elegant solution due to the delays in synchronization
71 and also suffers
72 from the issue of domain trust breakdown.
73 </p></td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2566212"></a>Essential Background Information</h2></div></div></div><p>
74<a class="indexterm" name="id2566220"></a>
75<a class="indexterm" name="id2566227"></a>
76<a class="indexterm" name="id2566234"></a>
77<a class="indexterm" name="id2566240"></a>
78A domain controller is a machine that is able to answer logon requests from network
79workstations. Microsoft LanManager and IBM LanServer were two early products that
80provided this capability. The technology has become known as the LanMan Netlogon service.
81</p><p>
82<a class="indexterm" name="id2566255"></a>
83<a class="indexterm" name="id2566266"></a>
84When MS Windows NT3.10 was first released, it supported a new style of Domain Control
85and with it a new form of the network logon service that has extended functionality.
86This service became known as the NT NetLogon Service. The nature of this service has
87changed with the evolution of MS Windows NT and today provides a complex array of
88services that are implemented over an intricate spectrum of technologies.
89</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2566282"></a>MS Windows NT4-style Domain Control</h3></div></div></div><p>
90<a class="indexterm" name="id2566290"></a>
91<a class="indexterm" name="id2566297"></a>
92<a class="indexterm" name="id2566304"></a>
93<a class="indexterm" name="id2566310"></a>
94<a class="indexterm" name="id2566317"></a>
95<a class="indexterm" name="id2566324"></a>
96<a class="indexterm" name="id2566333"></a>
97Whenever a user logs into a Windows NT4/200x/XP Professional workstation,
98the workstation connects to a domain controller (authentication server) to validate that
99the username and password the user entered are valid. If the information entered
100does not match account information that has been stored in the domain
101control database (the SAM, or Security Account Manager database), a set of error
102codes is returned to the workstation that has made the authentication request.
103</p><p>
104<a class="indexterm" name="id2566353"></a>
105<a class="indexterm" name="id2566360"></a>
106<a class="indexterm" name="id2566367"></a>
107<a class="indexterm" name="id2566374"></a>
108<a class="indexterm" name="id2566381"></a>
109When the username/password pair has been validated, the domain controller
110(authentication server) will respond with full enumeration of the account information
111that has been stored regarding that user in the user and machine accounts database
112for that domain. This information contains a complete network access profile for
113the user but excludes any information that is particular to the user's desktop profile,
114or for that matter it excludes all desktop profiles for groups that the user may
115belong to. It does include password time limits, password uniqueness controls,
116network access time limits, account validity information, machine names from which the
117user may access the network, and much more. All this information was stored in the SAM
118in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0).
119</p><p>
120<a class="indexterm" name="id2566418"></a>
121<a class="indexterm" name="id2566427"></a>
122<a class="indexterm" name="id2566434"></a>
123<a class="indexterm" name="id2566442"></a>
124<a class="indexterm" name="id2566448"></a>
125The account information (user and machine) on domain controllers is stored in two files,
126one containing the security information and the other the SAM. These are stored in files
127by the same name in the <code class="filename">%SystemRoot%\System32\config</code> directory.
128This normally translates to the path <code class="filename">C:\WinNT\System32\config</code>. These
129are the files that are involved in replication of the SAM database where BDCs are present
130on the network.
131</p><p>
132There are two situations in which it is desirable to install BDCs:
133</p><div class="itemizedlist"><ul type="disc"><li><p>
134 <a class="indexterm" name="id2566484"></a>
135 <a class="indexterm" name="id2566491"></a>
136 On the local network that the PDC is on, if there are many
137 workstations and/or where the PDC is generally very busy. In this case the BDCs
138 will pick up network logon requests and help to add robustness to network services.
139 </p></li><li><p>
140 <a class="indexterm" name="id2566505"></a>
141 At each remote site, to reduce wide-area network traffic and to add stability to
142 remote network operations. The design of the network, and the strategic placement of
143 BDCs, together with an implementation that localizes as much of network to client
144 interchange as possible, will help to minimize wide-area network bandwidth needs
145 (and thus costs).
146 </p></li></ul></div><p>
147<a class="indexterm" name="id2566525"></a>
148<a class="indexterm" name="id2566531"></a>
149<a class="indexterm" name="id2566538"></a>
150<a class="indexterm" name="id2566545"></a>
151<a class="indexterm" name="id2566552"></a>
152The interoperation of a PDC and its BDCs in a true Windows NT4 environment is worth
153mentioning here. The PDC contains the master copy of the SAM. In the event that an
154administrator makes a change to the user account database while physically present
155on the local network that has the PDC, the change will likely be made directly to
156the PDC instance of the master copy of the SAM. In the event that this update may
157be performed in a branch office, the change will likely be stored in a delta file
158on the local BDC. The BDC will then send a trigger to the PDC to commence the process
159of SAM synchronization. The PDC will then request the delta from the BDC and apply
160it to the master SAM. The PDC will then contact all the BDCs in the domain and
161trigger them to obtain the update and then apply that to their own copy of the SAM.
162</p><p>
163<a class="indexterm" name="id2566576"></a>
164<a class="indexterm" name="id2566584"></a>
165<a class="indexterm" name="id2566593"></a>
166<a class="indexterm" name="id2566600"></a>
167Samba-3 cannot participate in true SAM replication and is therefore not able to
168employ precisely the same protocols used by MS Windows NT4. A Samba-3 BDC will
169not create SAM update delta files. It will not interoperate with a PDC (NT4 or Samba)
170to synchronize the SAM from delta files that are held by BDCs.
171</p><p>
172<a class="indexterm" name="id2566615"></a>
173<a class="indexterm" name="id2566622"></a>
174Samba-3 cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 cannot
175function correctly as a PDC to an MS Windows NT4 BDC. Both Samba-3 and MS Windows
176NT4 can function as a BDC to its own type of PDC.
177</p><p>
178<a class="indexterm" name="id2566635"></a>
179<a class="indexterm" name="id2566641"></a>
180<a class="indexterm" name="id2566648"></a>
181The BDC is said to hold a <span class="emphasis"><em>read-only</em></span> of the SAM from which
182it is able to process network logon requests and authenticate users. The BDC can
183continue to provide this service, particularly while, for example, the wide-area
184network link to the PDC is down. A BDC plays a very important role in both the
185maintenance of domain security as well as in network integrity.
186</p><p>
187<a class="indexterm" name="id2566668"></a>
188<a class="indexterm" name="id2566674"></a>
189<a class="indexterm" name="id2566681"></a>
190<a class="indexterm" name="id2566688"></a>
191In the event that the NT4 PDC should need to be taken out of service, or if it dies, one of the NT4 BDCs can
192be promoted to a PDC. If this happens while the original NT4 PDC is online, it is automatically demoted to an
193NT4 BDC. This is an important aspect of domain controller management. The tool that is used to effect a
194promotion or a demotion is the Server Manager for Domains. It should be noted that Samba-3 BDCs cannot be
195promoted in this manner because reconfiguration of Samba requires changes to the <code class="filename">smb.conf</code> file. It is easy
196enough to manuall change the <code class="filename">smb.conf</code> file and then restart relevant Samba network services.
197</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2566718"></a>Example PDC Configuration</h4></div></div></div><p>
198<a class="indexterm" name="id2566726"></a>
199<a class="indexterm" name="id2566733"></a>
200Beginning with Version 2.2, Samba officially supports domain logons for all current Windows clients, including
201Windows NT4, 2003, and XP Professional. For Samba to be enabled as a PDC, some parameters in the
202<em class="parameter"><code>[global]</code></em> section of the <code class="filename">smb.conf</code> have to be set. Refer to <a class="link" href="samba-bdc.html#minimalPDC" title="Example 5.1. Minimal smb.conf for a PDC in Use with a BDC LDAP Server on PDC">the Minimal smb.conf for a PDC in Use with a BDC LDAP Server on PDC
203section</a> for an example of the minimum required settings.
204</p><div class="example"><a name="minimalPDC"></a><p class="title"><b>Example 5.1. Minimal smb.conf for a PDC in Use with a BDC LDAP Server on PDC</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2566786"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2566798"></a><em class="parameter"><code>passdb backend = ldapsam://localhost:389</code></em></td></tr><tr><td><a class="indexterm" name="id2566810"></a><em class="parameter"><code>domain master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566822"></a><em class="parameter"><code>domain logons = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566834"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2566846"></a><em class="parameter"><code>ldap user suffix = ou=Users</code></em></td></tr><tr><td><a class="indexterm" name="id2566857"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2566869"></a><em class="parameter"><code>ldap machine suffix = ou=Computers</code></em></td></tr><tr><td><a class="indexterm" name="id2566881"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2566893"></a><em class="parameter"><code>ldap admin dn = cn=sambadmin,dc=quenya,dc=org</code></em></td></tr></table></div></div><br class="example-break"><p>
205<a class="indexterm" name="id2566909"></a>
206<a class="indexterm" name="id2566916"></a>
207Several other things like a <em class="parameter"><code>[homes]</code></em> and a <em class="parameter"><code>[netlogon]</code></em> share
208also need to be set along with settings for the profile path, the user's home drive, and so on. This is not
209covered in this chapter; for more information please refer to <a class="link" href="samba-pdc.html" title="Chapter 4. Domain Control">Domain Control</a>.
210Refer to <a class="link" href="samba-pdc.html" title="Chapter 4. Domain Control">the Domain Control chapter</a> for specific recommendations for PDC
211configuration. Alternately, fully documented working example network configurations using OpenLDAP and Samba
212as available in the <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample" target="_top">book</a> &#8220;<span class="quote">Samba-3
213by Example</span>&#8221; that may be obtained from local and on-line book stores.
214</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2566969"></a>LDAP Configuration Notes</h3></div></div></div><p>
215<a class="indexterm" name="id2566977"></a>
216<a class="indexterm" name="id2566986"></a>
217<a class="indexterm" name="id2566996"></a>
218When configuring a master and a slave LDAP server, it is advisable to use the master LDAP server
219for the PDC and slave LDAP servers for the BDCs. It is not essential to use slave LDAP servers; however,
220many administrators will want to do so in order to provide redundant services. Of course, one or more BDCs
221may use any slave LDAP server. Then again, it is entirely possible to use a single LDAP server for the
222entire network.
223</p><p>
224<a class="indexterm" name="id2567013"></a>
225<a class="indexterm" name="id2567022"></a>
226<a class="indexterm" name="id2567031"></a>
227<a class="indexterm" name="id2567038"></a>
228<a class="indexterm" name="id2567045"></a>
229When configuring a master LDAP server that will have slave LDAP servers, do not forget to configure this in
230the <code class="filename">/etc/openldap/slapd.conf</code> file. It must be noted that the DN of a server certificate
231must use the CN attribute to name the server, and the CN must carry the servers' fully qualified domain name.
232Additional alias names and wildcards may be present in the subjectAltName certificate extension. More details
233on server certificate names are in RFC2830.
234</p><p>
235<a class="indexterm" name="id2567068"></a>
236<a class="indexterm" name="id2567075"></a>
237<a class="indexterm" name="id2567082"></a>
238<a class="indexterm" name="id2567088"></a>
239<a class="indexterm" name="id2567098"></a>
240<a class="indexterm" name="id2567105"></a>
241<a class="indexterm" name="id2567112"></a>
242It does not really fit within the scope of this document, but a working LDAP installation is basic to
243LDAP-enabled Samba operation. When using an OpenLDAP server with Transport Layer Security (TLS), the machine
244name in <code class="filename">/etc/ssl/certs/slapd.pem</code> must be the same as in
245<code class="filename">/etc/openldap/sldap.conf</code>. The Red Hat Linux startup script creates the
246<code class="filename">slapd.pem</code> file with hostname &#8220;<span class="quote">localhost.localdomain.</span>&#8221; It is impossible to
247access this LDAP server from a slave LDAP server (i.e., a Samba BDC) unless the certificate is re-created with
248a correct hostname.
249</p><p>
250<a class="indexterm" name="id2567152"></a>
251<a class="indexterm" name="id2567158"></a>
252<a class="indexterm" name="id2567165"></a>
253<a class="indexterm" name="id2567172"></a>
254<a class="indexterm" name="id2567179"></a>
255<a class="indexterm" name="id2567186"></a>
256Do not install a Samba PDC so that is uses an LDAP slave server. Joining client machines to the domain
257will fail in this configuration because the change to the machine account in the LDAP tree must take place on
258the master LDAP server. This is not replicated rapidly enough to the slave server that the PDC queries. It
259therefore gives an error message on the client machine about not being able to set up account credentials. The
260machine account is created on the LDAP server, but the password fields will be empty. Unfortunately, some
261sites are unable to avoid such configurations, and these sites should review the <a class="link" href="smb.conf.5.html#LDAPREPLICATIONSLEEP" target="_top">ldap replication sleep</a> parameter, intended to slow down Samba sufficiently for the replication to catch up.
262This is a kludge, and one that the administrator must manually duplicate in any scripts (such as the
263<a class="link" href="smb.conf.5.html#ADDMACHINESCRIPT" target="_top">add machine script</a>) that they use.
264</p><p>
265Possible PDC/BDC plus LDAP configurations include:
266</p><div class="itemizedlist"><ul type="disc"><li><p>
267 PDC+BDC -&gt; One Central LDAP Server.
268 </p></li><li><p>
269 PDC -&gt; LDAP master server, BDC -&gt; LDAP slave server.
270 </p></li><li><p>
271 PDC -&gt; LDAP master, with secondary slave LDAP server.
272 </p><p>
273 BDC -&gt; LDAP master, with secondary slave LDAP server.
274 </p></li><li><p>
275 PDC -&gt; LDAP master, with secondary slave LDAP server.
276 </p><p>
277 BDC -&gt; LDAP slave server, with secondary master LDAP server.
278 </p></li></ul></div><p>
279In order to have a fallback configuration (secondary) LDAP server, you would specify
280the secondary LDAP server in the <code class="filename">smb.conf</code> file as shown in <a class="link" href="samba-bdc.html#mulitldapcfg" title="Example 5.2. Multiple LDAP Servers in smb.conf">the Multiple LDAP
281Servers in <code class="filename">smb.conf</code> example</a>.
282</p><div class="example"><a name="mulitldapcfg"></a><p class="title"><b>Example 5.2. Multiple LDAP Servers in <code class="filename">smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2567320"></a><em class="parameter"><code>passdb backend = ldapsam:"ldap://master.quenya.org ldap://slave.quenya.org"</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2567334"></a>Active Directory Domain Control</h3></div></div></div><p>
283<a class="indexterm" name="id2567342"></a>
284<a class="indexterm" name="id2567349"></a>
285<a class="indexterm" name="id2567356"></a>
286<a class="indexterm" name="id2567363"></a>
287<a class="indexterm" name="id2567370"></a>
288<a class="indexterm" name="id2567376"></a>
289As of the release of MS Windows 2000 and Active Directory, this information is now stored
290in a directory that can be replicated and for which partial or full administrative control
291can be delegated. Samba-3 is not able to be a domain controller within an Active Directory
292tree, and it cannot be an Active Directory server. This means that Samba-3 also cannot
293act as a BDC to an Active Directory domain controller.
294</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2567393"></a>What Qualifies a Domain Controller on the Network?</h3></div></div></div><p>
295<a class="indexterm" name="id2567401"></a>
296<a class="indexterm" name="id2567408"></a>
297<a class="indexterm" name="id2567414"></a>
298<a class="indexterm" name="id2567421"></a>
299Every machine that is a domain controller for the domain MIDEARTH has to register the NetBIOS
300group name MIDEARTH&lt;1C&gt; with the WINS server and/or by broadcast on the local network.
301The PDC also registers the unique NetBIOS name MIDEARTH&lt;1B&gt; with the WINS server.
302The name type &lt;1B&gt; name is normally reserved for the Domain Master Browser (DMB), a role
303that has nothing to do with anything related to authentication, but the Microsoft domain
304implementation requires the DMB to be on the same machine as the PDC.
305</p><p>
306<a class="indexterm" name="id2567443"></a>
307<a class="indexterm" name="id2567450"></a>
308<a class="indexterm" name="id2567456"></a>
309Where a WINS server is not used, broadcast name registrations alone must suffice. Refer to
310<a class="link" href="NetworkBrowsing.html" title="Chapter 10. Network Browsing">Network Browsing</a>,<a class="link" href="NetworkBrowsing.html#netdiscuss" title="Discussion">Discussion</a>
311for more information regarding TCP/IP network protocols and how SMB/CIFS names are handled.
312</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2567484"></a>How Does a Workstation find its Domain Controller?</h3></div></div></div><p>
313<a class="indexterm" name="id2567492"></a>
314<a class="indexterm" name="id2567499"></a>
315There are two different mechanisms to locate a domain controller: one method is used when
316NetBIOS over TCP/IP is enabled and the other when it has been disabled in the TCP/IP
317network configuration.
318</p><p>
319<a class="indexterm" name="id2567512"></a>
320<a class="indexterm" name="id2567519"></a>
321Where NetBIOS over TCP/IP is disabled, all name resolution involves the use of DNS, broadcast
322messaging over UDP, as well as Active Directory communication technologies. In this type of
323environment all machines require appropriate DNS entries. More information may be found in
324<a class="link" href="NetworkBrowsing.html#adsdnstech" title="DNS and Active Directory">DNS and Active Directory</a>.
325</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2567540"></a>NetBIOS Over TCP/IP Enabled</h4></div></div></div><p>
326<a class="indexterm" name="id2567548"></a>
327<a class="indexterm" name="id2567555"></a>
328<a class="indexterm" name="id2567562"></a>
329<a class="indexterm" name="id2567569"></a>
330An MS Windows NT4/200x/XP Professional workstation in the domain MIDEARTH that wants a
331local user to be authenticated has to find the domain controller for MIDEARTH. It does this
332by doing a NetBIOS name query for the group name MIDEARTH&lt;1C&gt;. It assumes that each
333of the machines it gets back from the queries is a domain controller and can answer logon
334requests. To not open security holes, both the workstation and the selected domain controller
335authenticate each other. After that the workstation sends the user's credentials (name and
336password) to the local domain controller for validation.
337</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2567606"></a>NetBIOS Over TCP/IP Disabled</h4></div></div></div><p>
338<a class="indexterm" name="id2567614"></a>
339<a class="indexterm" name="id2567621"></a>
340<a class="indexterm" name="id2567628"></a>
341<a class="indexterm" name="id2567634"></a>
342An MS Windows NT4/200x/XP Professional workstation in the realm <code class="constant">quenya.org</code>
343that has a need to affect user logon authentication will locate the domain controller by
344re-querying DNS servers for the <code class="constant">_ldap._tcp.pdc._msdcs.quenya.org</code> record.
345More information regarding this subject may be found in <a class="link" href="NetworkBrowsing.html#adsdnstech" title="DNS and Active Directory">DNS and Active Directory</a>.
346</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2567665"></a>Backup Domain Controller Configuration</h2></div></div></div><p>
347<a class="indexterm" name="id2567672"></a>
348The creation of a BDC requires some steps to prepare the Samba server before
349<span class="application">smbd</span> is executed for the first time. These steps are as follows:
350</p><div class="itemizedlist"><ul type="disc"><li><p>
351 <a class="indexterm" name="id2567693"></a>
352 <a class="indexterm" name="id2567700"></a>
353 <a class="indexterm" name="id2567706"></a>
354 <a class="indexterm" name="id2567713"></a>
355 <a class="indexterm" name="id2567720"></a>
356 <a class="indexterm" name="id2567727"></a>
357 The domain SID has to be the same on the PDC and the BDC. In Samba versions pre-2.2.5, the domain SID was
358 stored in the file <code class="filename">private/MACHINE.SID</code>. For all versions of Samba released since 2.2.5
359 the domain SID is stored in the file <code class="filename">private/secrets.tdb</code>. This file is unique to each
360 server and cannot be copied from a PDC to a BDC; the BDC will generate a new SID at startup. It will overwrite
361 the PDC domain SID with the newly created BDC SID. There is a procedure that will allow the BDC to aquire the
362 domain SID. This is described here.
363 </p><p>
364 <a class="indexterm" name="id2567757"></a>
365 <a class="indexterm" name="id2567764"></a>
366 <a class="indexterm" name="id2567771"></a>
367 <a class="indexterm" name="id2567777"></a>
368 <a class="indexterm" name="id2567784"></a>
369 To retrieve the domain SID from the PDC or an existing BDC and store it in the
370 <code class="filename">secrets.tdb</code>, execute:
371 </p><pre class="screen">
372<code class="prompt">root# </code><strong class="userinput"><code>net rpc getsid</code></strong>
373</pre></li><li><p>
374 <a class="indexterm" name="id2567824"></a>
375 <a class="indexterm" name="id2567831"></a>
376 <a class="indexterm" name="id2567838"></a>
377 Specification of the <a class="link" href="smb.conf.5.html#LDAPADMINDN" target="_top">ldap admin dn</a> is obligatory.
378 This also requires the LDAP administration password to be set in the <code class="filename">secrets.tdb</code>
379 using the <code class="literal">smbpasswd -w <em class="replaceable"><code>mysecret</code></em></code>.
380 </p></li><li><p>
381 The <a class="link" href="smb.conf.5.html#LDAPSUFFIX" target="_top">ldap suffix</a> parameter and the <a class="link" href="smb.conf.5.html#LDAPIDMAPSUFFIX" target="_top">ldap idmap suffix</a>
382 parameter must be specified in the <code class="filename">smb.conf</code> file.
383 </p></li><li><p>
384 <a class="indexterm" name="id2567913"></a>
385 <a class="indexterm" name="id2567922"></a>
386 <a class="indexterm" name="id2567928"></a>
387 <a class="indexterm" name="id2567935"></a>
388 The UNIX user database has to be synchronized from the PDC to the
389 BDC. This means that both the <code class="filename">/etc/passwd</code> and
390 <code class="filename">/etc/group</code> have to be replicated from the PDC
391 to the BDC. This can be done manually whenever changes are made.
392 Alternately, the PDC is set up as an NIS master server and the BDC as an NIS slave
393 server. To set up the BDC as a mere NIS client would not be enough,
394 as the BDC would not be able to access its user database in case of
395 a PDC failure. NIS is by no means the only method to synchronize
396 passwords. An LDAP solution would also work.
397 </p></li><li><p>
398 <a class="indexterm" name="id2567968"></a>
399 <a class="indexterm" name="id2567975"></a>
400 <a class="indexterm" name="id2567982"></a>
401 <a class="indexterm" name="id2567988"></a>
402 <a class="indexterm" name="id2567995"></a>
403 <a class="indexterm" name="id2568002"></a>
404 <a class="indexterm" name="id2568009"></a>
405 <a class="indexterm" name="id2568015"></a>
406 The Samba password database must be replicated from the PDC to the BDC.
407 Although it is possible to synchronize the <code class="filename">smbpasswd</code>
408 file with <code class="literal">rsync</code> and <code class="literal">ssh</code>, this method
409 is broken and flawed, and is therefore not recommended. A better solution
410 is to set up slave LDAP servers for each BDC and a master LDAP server for the PDC.
411 The use of rsync is inherently flawed by the fact that the data will be replicated
412 at timed intervals. There is no guarantee that the BDC will be operating at all
413 times with correct and current machine and user account information. This means that
414 this method runs the risk of users being inconvenienced by discontinuity of access
415 to network services due to inconsistent security data. It must be born in mind that
416 Windows workstations update (change) the machine trust account password at regular
417 intervals administrators are not normally aware that this is happening
418 or when it takes place.
419 </p><p>
420 <a class="indexterm" name="id2568061"></a>
421 <a class="indexterm" name="id2568067"></a>
422 <a class="indexterm" name="id2568074"></a>
423 <a class="indexterm" name="id2568081"></a>
424 The use of LDAP for both the POSIX (UNIX user and group) accounts and for the
425 SambaSAMAccount data automatically ensures that all account change information
426 will be written to the shared directory. This eliminates the need for any special
427 action to synchronize account information because LDAP will meet that requirement.
428 </p></li><li><p>
429 <a class="indexterm" name="id2568098"></a>
430 <a class="indexterm" name="id2568105"></a>
431 <a class="indexterm" name="id2568112"></a>
432 <a class="indexterm" name="id2568118"></a>
433 <a class="indexterm" name="id2568125"></a>
434 <a class="indexterm" name="id2568131"></a>
435 The netlogon share has to be replicated from the PDC to the BDC. This can be done manually whenever login
436 scripts are changed, or it can be done automatically using a <code class="literal">cron</code> job that will replicate
437 the directory structure in this share using a tool like <code class="literal">rsync</code>. The use of
438 <code class="literal">rsync</code> for replication of the netlogon data is not critical to network security and is one
439 that can be manually managed given that the administrator will make all changes to the netlogon share as part
440 of a conscious move.
441 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568166"></a>Example Configuration</h3></div></div></div><p>
442Finally, the BDC has to be capable of being found by the workstations. This can be done by configuring the
443Samba <code class="filename">smb.conf</code> file <em class="parameter"><code>[global]</code></em> section as shown in <a class="link" href="samba-bdc.html#minim-bdc" title="Example 5.3. Minimal Setup for Being a BDC">Minimal
444Setup for Being a BDC</a>.
445</p><div class="example"><a name="minim-bdc"></a><p class="title"><b>Example 5.3. Minimal Setup for Being a BDC</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2568212"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2568223"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://slave-ldap.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2568236"></a><em class="parameter"><code>domain master = no</code></em></td></tr><tr><td><a class="indexterm" name="id2568247"></a><em class="parameter"><code>domain logons = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568259"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2568271"></a><em class="parameter"><code>ldap user suffix = ou=Users</code></em></td></tr><tr><td><a class="indexterm" name="id2568283"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2568295"></a><em class="parameter"><code>ldap machine suffix = ou=Computers</code></em></td></tr><tr><td><a class="indexterm" name="id2568307"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2568319"></a><em class="parameter"><code>ldap admin dn = cn=sambadmin,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2568331"></a><em class="parameter"><code>idmap backend = ldap:ldap://master-ldap.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2568343"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2568355"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr></table></div></div><br class="example-break"><p>
446Fully documented working example network configurations using OpenLDAP and Samba
447as available in the <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample" target="_top">book</a> &#8220;<span class="quote">Samba-3
448by Example</span>&#8221; that may be obtained from local and on-line book stores.
449</p><p>
450<a class="indexterm" name="id2568386"></a>
451<a class="indexterm" name="id2568393"></a>
452<a class="indexterm" name="id2568400"></a>
453<a class="indexterm" name="id2568406"></a>
454This configuration causes the BDC to register only the name MIDEARTH&lt;1C&gt; with the WINS server. This is
455not a problem, as the name MIDEARTH&lt;1C&gt; is a NetBIOS group name that is meant to be registered by more
456than one machine. The parameter <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = no</a> forces the BDC not to
457register MIDEARTH&lt;1B&gt;, which is a unique NetBIOS name that is reserved for the PDC.
458</p><p>
459<a class="indexterm" name="id2568439"></a>
460<a class="indexterm" name="id2568445"></a>
461<a class="indexterm" name="id2568452"></a>
462<a class="indexterm" name="id2568459"></a>
463<a class="indexterm" name="id2568465"></a>
464<a class="indexterm" name="id2568472"></a>
465<a class="indexterm" name="id2568479"></a>
466<a class="indexterm" name="id2568486"></a>
467<a class="indexterm" name="id2568493"></a>
468The <em class="parameter"><code>idmap backend</code></em> will redirect the <code class="literal">winbindd</code> utility to use the LDAP
469database to store all mappings for Windows SIDs to UIDs and GIDs for UNIX accounts in a repository that is
470shared. The BDC will however depend on local resolution of UIDs and GIDs via NSS and the
471<code class="literal">nss_ldap</code> utility.
472</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
473<a class="indexterm" name="id2568526"></a>
474<a class="indexterm" name="id2568535"></a>
475<a class="indexterm" name="id2568541"></a>
476<a class="indexterm" name="id2568548"></a>
477Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it
478allows greater flexibility in how user and group IDs are handled in respect to NT domain user and group
479SIDs. One of the new facilities provides for explicitly ensuring that UNIX/Linux UID and GID values
480will be consistent on the PDC, all BDCs, and all domain member servers. The parameter that controls this
481is called <em class="parameter"><code>idmap backend</code></em>. Please refer to the man page for <code class="filename">smb.conf</code> for more information
482regarding its behavior.
483</p></div><p>
484<a class="indexterm" name="id2568579"></a>
485<a class="indexterm" name="id2568585"></a>
486<a class="indexterm" name="id2568592"></a>
487The use of the <a class="link" href="smb.conf.5.html#IDMAPBACKEND" target="_top">idmap backend = ldap:ldap://master.quenya.org</a>
488option on a BDC only makes sense where ldapsam is used on a PDC. The purpose of an LDAP-based idmap backend is
489also to allow a domain member (without its own passdb backend) to use winbindd to resolve Windows network users
490and groups to common UID/GIDs. In other words, this option is generally intended for use on BDCs and on domain
491member servers.
492</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2568623"></a>Common Errors</h2></div></div></div><p>
493<a class="indexterm" name="id2568631"></a>
494Domain control was a new area for Samba, but there are now many examples that we may refer to.
495Updated information will be published as they become available and may be found in later Samba releases or
496from the Samba Web <a class="ulink" href="http://samba.org" target="_top">site</a>; refer in particular to the
497<code class="filename">WHATSNEW.txt</code> in the Samba release tarball. The book, &#8220;<span class="quote">Samba-3 by Example</span>&#8221;
498documents well tested and proven configuration examples. You can obtain a copy of this
499<a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample.pdf" target="_top">book</a> for the Samba web site.
500</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568667"></a>Machine Accounts Keep Expiring</h3></div></div></div><p>
501<a class="indexterm" name="id2568675"></a>
502<a class="indexterm" name="id2568682"></a>
503<a class="indexterm" name="id2568689"></a>
504<a class="indexterm" name="id2568695"></a>
505This problem will occur when the passdb (SAM) files are copied from a central
506server but the local BDC is acting as a PDC. This results in the application of
507Local Machine Trust Account password updates to the local SAM. Such updates
508are not copied back to the central server. The newer machine account password is then
509overwritten when the SAM is recopied from the PDC. The result is that the domain member machine
510on startup will find that its passwords do not match the one now in the database, and
511since the startup security check will now fail, this machine will not allow logon attempts
512to proceed and the account expiry error will be reported.
513</p><p>
514The solution is to use a more robust passdb backend, such as the ldapsam backend, setting up
515a slave LDAP server for each BDC and a master LDAP server for the PDC.
516</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568722"></a>Can Samba Be a Backup Domain Controller to an NT4 PDC?</h3></div></div></div><p>
517<a class="indexterm" name="id2568730"></a>
518<a class="indexterm" name="id2568739"></a>
519No. The native NT4 SAM replication protocols have not yet been fully implemented.
520</p><p>
521<a class="indexterm" name="id2568750"></a>
522<a class="indexterm" name="id2568757"></a>
523<a class="indexterm" name="id2568763"></a>
524Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC.The
525main reason for implementing a BDC is availability. If the PDC is a Samba
526machine, a second Samba machine can be set up to service logon requests whenever
527the PDC is down.
528</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568777"></a>How Do I Replicate the smbpasswd File?</h3></div></div></div><p>
529<a class="indexterm" name="id2568785"></a>
530<a class="indexterm" name="id2568794"></a>
531<a class="indexterm" name="id2568801"></a>
532Replication of the smbpasswd file is sensitive. It has to be done whenever changes
533to the SAM are made. Every user's password change is done in the smbpasswd file and
534has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary.
535</p><p>
536<a class="indexterm" name="id2568815"></a>
537<a class="indexterm" name="id2568822"></a>
538<a class="indexterm" name="id2568828"></a>
539As the smbpasswd file contains plaintext password equivalents, it must not be
540sent unencrypted over the wire. The best way to set up smbpasswd replication from
541the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport.
542<code class="literal">ssh</code> itself can be set up to accept <span class="emphasis"><em>only</em></span>
543<code class="literal">rsync</code> transfer without requiring the user to type a password.
544</p><p>
545<a class="indexterm" name="id2568859"></a>
546<a class="indexterm" name="id2568866"></a>
547As said a few times before, use of this method is broken and flawed. Machine trust
548accounts will go out of sync, resulting in a broken domain. This method is
549<span class="emphasis"><em>not</em></span> recommended. Try using LDAP instead.
550</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568882"></a>Can I Do This All with LDAP?</h3></div></div></div><p>
551<a class="indexterm" name="id2568890"></a>
552<a class="indexterm" name="id2568897"></a>
553The simple answer is yes. Samba's pdb_ldap code supports binding to a replica
554LDAP server and will also follow referrals and rebind to the master if it ever
555needs to make a modification to the database. (Normally BDCs are read-only, so
556this will not occur often).
557</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="samba-pdc.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="type.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="domain-member.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 4. Domain Control </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 6. Domain Membership</td></tr></table></div></body></html>
Note: See TracBrowser for help on using the repository browser.