| 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. Domain Control</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="The Official Samba 3.5.x HOWTO and Reference Guide"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="prev" href="ServerType.html" title="Chapter 3. Server Types and Security Modes"><link rel="next" href="samba-bdc.html" title="Chapter 5. Backup Domain Control"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. Domain Control</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ServerType.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="samba-bdc.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 4. Domain Control"><div class="titlepage"><div><div><h2 class="title"><a name="samba-pdc"></a>Chapter 4. Domain Control</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jerry@samba.org">jerry@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">David</span> <span class="surname">Bannon</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:dbannon@samba.org">dbannon@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="surname">Deschner</span></h3><span class="contrib">LDAP updates</span> <div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:gd@samba.org">gd@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="samba-pdc.html#id332816">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="samba-pdc.html#id333361">Single Sign-On and Domain Security</a></span></dt><dt><span class="sect1"><a href="samba-pdc.html#id333870">Basics of Domain Control</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-pdc.html#id333888">Domain Controller Types</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id334343">Preparing for Domain Control</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-pdc.html#id334811">Domain Control: Example Configuration</a></span></dt><dt><span class="sect1"><a href="samba-pdc.html#id335523">Samba ADS Domain Control</a></span></dt><dt><span class="sect1"><a href="samba-pdc.html#id335566">Domain and Network Logon Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-pdc.html#id335583">Domain Network Logon Service</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id336119">Security Mode and Master Browsers</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-pdc.html#id336354">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-pdc.html#id336359"><span class="quote">“<span class="quote">$</span>”</span> Cannot Be Included in Machine Name</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id336454">Joining Domain Fails Because of Existing Machine Account</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id336513">The System Cannot Log You On (C000019B)</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id336578">The Machine Trust Account Is Not Accessible</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id336685">Account Disabled</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id336710">Domain Controller Unavailable</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id336727">Cannot Log onto Domain Member Workstation After Joining Domain</a></span></dt></dl></dd></dl></div><p>
|
|---|
| 2 | There are many who approach MS Windows networking with incredible misconceptions.
|
|---|
| 3 | That's okay, because it gives the rest of us plenty of opportunity to be of assistance.
|
|---|
| 4 | Those who really want help are well advised to become familiar with information
|
|---|
| 5 | that is already available.
|
|---|
| 6 | </p><p>
|
|---|
| 7 | <a class="indexterm" name="id332704"></a>
|
|---|
| 8 | You are advised not to tackle this section without having first understood
|
|---|
| 9 | and mastered some basics. MS Windows networking is not particularly forgiving of
|
|---|
| 10 | misconfiguration. Users of MS Windows networking are likely to complain
|
|---|
| 11 | of persistent niggles that may be caused by a broken network configuration.
|
|---|
| 12 | To a great many people, however, MS Windows networking starts with a domain controller
|
|---|
| 13 | that in some magical way is expected to solve all network operational ills.
|
|---|
| 14 | </p><p>
|
|---|
| 15 | <a class="link" href="samba-pdc.html#domain-example" title="Figure 4.1. An Example Domain.">The Example Domain Illustration</a> shows a typical MS Windows domain security
|
|---|
| 16 | network environment. Workstations A, B, and C are representative of many physical MS Windows
|
|---|
| 17 | network clients.
|
|---|
| 18 | </p><div class="figure"><a name="domain-example"></a><p class="title"><b>Figure 4.1. An Example Domain.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/domain.png" width="216" alt="An Example Domain."></div></div></div><br class="figure-break"><p>
|
|---|
| 19 | From the Samba mailing list we can readily identify many common networking issues.
|
|---|
| 20 | If you are not clear on the following subjects, then it will do much good to read the
|
|---|
| 21 | sections of this HOWTO that deal with it. These are the most common causes of MS Windows
|
|---|
| 22 | networking problems:
|
|---|
| 23 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Basic TCP/IP configuration.</p></li><li class="listitem"><p>NetBIOS name resolution.</p></li><li class="listitem"><p>Authentication configuration.</p></li><li class="listitem"><p>User and group configuration.</p></li><li class="listitem"><p>Basic file and directory permission control in UNIX/Linux.</p></li><li class="listitem"><p>Understanding how MS Windows clients interoperate in a network environment.</p></li></ul></div><p>
|
|---|
| 24 | Do not be put off; on the surface of it MS Windows networking seems so simple that anyone
|
|---|
| 25 | can do it. In fact, it is not a good idea to set up an MS Windows network with
|
|---|
| 26 | inadequate training and preparation. But let's get our first indelible principle out of the
|
|---|
| 27 | way: <span class="emphasis"><em>It is perfectly okay to make mistakes!</em></span> In the right place and at
|
|---|
| 28 | the right time, mistakes are the essence of learning. It is very much not okay to make
|
|---|
| 29 | mistakes that cause loss of productivity and impose an avoidable financial burden on an
|
|---|
| 30 | organization.
|
|---|
| 31 | </p><p>
|
|---|
| 32 | Where is the right place to make mistakes? Only out of harms way. If you are going to
|
|---|
| 33 | make mistakes, then please do it on a test network, away from users, and in such a way as
|
|---|
| 34 | to not inflict pain on others. Do your learning on a test network.
|
|---|
| 35 | </p><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id332816"></a>Features and Benefits</h2></div></div></div><p>
|
|---|
| 36 | <a class="indexterm" name="id332824"></a>
|
|---|
| 37 | <span class="emphasis"><em>What is the key benefit of Microsoft Domain Security?</em></span>
|
|---|
| 38 | </p><p>
|
|---|
| 39 | <a class="indexterm" name="id332836"></a>
|
|---|
| 40 | <a class="indexterm" name="id332845"></a>
|
|---|
| 41 | <a class="indexterm" name="id332851"></a>
|
|---|
| 42 | <a class="indexterm" name="id332857"></a>
|
|---|
| 43 | In a word, <span class="emphasis"><em>single sign-on</em></span>, or SSO for short. To many, this is the Holy Grail of MS
|
|---|
| 44 | Windows NT and beyond networking. SSO allows users in a well-designed network to log onto any workstation that
|
|---|
| 45 | is a member of the domain that contains their user account (or in a domain that has an appropriate trust
|
|---|
| 46 | relationship with the domain they are visiting) and they will be able to log onto the network and access
|
|---|
| 47 | resources (shares, files, and printers) as if they are sitting at their home (personal) workstation. This is a
|
|---|
| 48 | feature of the domain security protocols.
|
|---|
| 49 | </p><p>
|
|---|
| 50 | <a class="indexterm" name="id332879"></a>
|
|---|
| 51 | <a class="indexterm" name="id332885"></a>
|
|---|
| 52 | <a class="indexterm" name="id332891"></a>
|
|---|
| 53 | <a class="indexterm" name="id332900"></a>
|
|---|
| 54 | <a class="indexterm" name="id332908"></a>
|
|---|
| 55 | The benefits of domain security are available to those sites that deploy a Samba PDC. A domain provides a
|
|---|
| 56 | unique network security identifier (SID). Domain user and group security identifiers are comprised of the
|
|---|
| 57 | network SID plus a relative identifier (RID) that is unique to the account. User and group SIDs (the network
|
|---|
| 58 | SID plus the RID) can be used to create access control lists (ACLs) attached to network resources to provide
|
|---|
| 59 | organizational access control. UNIX systems recognize only local security identifiers.
|
|---|
| 60 | </p><p>
|
|---|
| 61 | <a class="indexterm" name="id332922"></a>
|
|---|
| 62 | A SID represents a security context. For example, every Windows machine has local accounts within the security
|
|---|
| 63 | context of the local machine which has a unique SID. Every domain (NT4, ADS, Samba) contains accounts that
|
|---|
| 64 | exist within the domain security context which is defined by the domain SID.
|
|---|
| 65 | </p><p>
|
|---|
| 66 | <a class="indexterm" name="id332934"></a>
|
|---|
| 67 | <a class="indexterm" name="id332940"></a>
|
|---|
| 68 | A domain member server will have a SID that differs from the domain SID. The domain member server can be
|
|---|
| 69 | configured to regard all domain users as local users. It can also be configured to recognize domain users and
|
|---|
| 70 | groups as non-local. SIDs are persistent. A typical domain of user SID looks like this:
|
|---|
| 71 | </p><pre class="screen">
|
|---|
| 72 | S-1-5-21-726309263-4128913605-1168186429
|
|---|
| 73 | </pre><p>
|
|---|
| 74 | Every account (user, group, machine, trust, etc.) is assigned a RID. This is done automatically as an account
|
|---|
| 75 | is created. Samba produces the RID algorithmically. The UNIX operating system uses a separate name space for
|
|---|
| 76 | user and group identifiers (the UID and GID) but Windows allocates the RID from a single name space. A Windows
|
|---|
| 77 | user and a Windows group can not have the same RID. Just as the UNIX user <code class="literal">root</code> has the
|
|---|
| 78 | UID=0, the Windows Administrator has the well-known RID=500. The RID is catenated to the Windows domain SID,
|
|---|
| 79 | so Administrator account for a domain that has the above SID will have the user SID
|
|---|
| 80 | </p><pre class="screen">
|
|---|
| 81 | S-1-5-21-726309263-4128913605-1168186429-500
|
|---|
| 82 | </pre><p>
|
|---|
| 83 | The result is that every account in the Windows networking world has a globally unique security identifier.
|
|---|
| 84 | </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 85 | <a class="indexterm" name="id332976"></a>
|
|---|
| 86 | <a class="indexterm" name="id332984"></a>
|
|---|
| 87 | <a class="indexterm" name="id332990"></a>
|
|---|
| 88 | Network clients of an MS Windows domain security environment must be domain members to be able to gain access
|
|---|
| 89 | to the advanced features provided. Domain membership involves more than just setting the workgroup name to the
|
|---|
| 90 | domain name. It requires the creation of a domain trust account for the workstation (called a machine
|
|---|
| 91 | account). Refer to <a class="link" href="domain-member.html" title="Chapter 6. Domain Membership">Domain Membership</a> for more information.
|
|---|
| 92 | </p></div><p>
|
|---|
| 93 | The following functionalities are new to the Samba-3 release:
|
|---|
| 94 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
|
|---|
| 95 | <a class="indexterm" name="id333017"></a>
|
|---|
| 96 | Samba-3 supports the use of a choice of backends that may be used in which user, group and machine
|
|---|
| 97 | accounts may be stored. Multiple passwd backends can be used in combination, either as additive backend
|
|---|
| 98 | data sets, or as fail-over data sets.
|
|---|
| 99 | </p><p>
|
|---|
| 100 | <a class="indexterm" name="id333031"></a>
|
|---|
| 101 | <a class="indexterm" name="id333037"></a>
|
|---|
| 102 | <a class="indexterm" name="id333043"></a>
|
|---|
| 103 | <a class="indexterm" name="id333050"></a>
|
|---|
| 104 | <a class="indexterm" name="id333056"></a>
|
|---|
| 105 | An LDAP passdb backend confers the benefit that the account backend can be distributed and replicated,
|
|---|
| 106 | which is of great value because it confers scalability and provides a high degree of reliability.
|
|---|
| 107 | </p></li><li class="listitem"><p>
|
|---|
| 108 | <a class="indexterm" name="id333068"></a>
|
|---|
| 109 | <a class="indexterm" name="id333079"></a>
|
|---|
| 110 | <a class="indexterm" name="id333087"></a>
|
|---|
| 111 | Windows NT4 domain trusts. Samba-3 supports workstation and server (machine) trust accounts. It also
|
|---|
| 112 | supports Windows NT4 style interdomain trust accounts, which further assists in network scalability
|
|---|
| 113 | and interoperability.
|
|---|
| 114 | </p></li><li class="listitem"><p>
|
|---|
| 115 | <a class="indexterm" name="id333100"></a>
|
|---|
| 116 | <a class="indexterm" name="id333106"></a>
|
|---|
| 117 | <a class="indexterm" name="id333112"></a>
|
|---|
| 118 | <a class="indexterm" name="id333119"></a>
|
|---|
| 119 | <a class="indexterm" name="id333127"></a>
|
|---|
| 120 | <a class="indexterm" name="id333135"></a>
|
|---|
| 121 | Operation without NetBIOS over TCP/IP, rather using the raw SMB over TCP/IP. Note, this is feasible
|
|---|
| 122 | only when operating as a Microsoft active directory domain member server. When acting as a Samba domain
|
|---|
| 123 | controller the use of NetBIOS is necessary to provide network browsing support.
|
|---|
| 124 | </p></li><li class="listitem"><p>
|
|---|
| 125 | <a class="indexterm" name="id333151"></a>
|
|---|
| 126 | <a class="indexterm" name="id333157"></a>
|
|---|
| 127 | <a class="indexterm" name="id333163"></a>
|
|---|
| 128 | Samba-3 provides NetBIOS name services (WINS), NetBIOS over TCP/IP (TCP port 139) session services, SMB over
|
|---|
| 129 | TCP/IP (TCP port 445) session services, and Microsoft compatible ONC DCE RPC services (TCP port 135)
|
|---|
| 130 | services.
|
|---|
| 131 | </p></li><li class="listitem"><p>
|
|---|
| 132 | <a class="indexterm" name="id333176"></a>
|
|---|
| 133 | Management of users and groups via the User Manager for Domains. This can be done on any MS Windows client
|
|---|
| 134 | using the <code class="filename">Nexus.exe</code> toolkit for Windows 9x/Me, or using the SRVTOOLS.EXE package for MS
|
|---|
| 135 | Windows NT4/200x/XP platforms. These packages are available from Microsoft's Web site.
|
|---|
| 136 | </p></li><li class="listitem"><p>
|
|---|
| 137 | Implements full Unicode support. This simplifies cross-locale internationalization support. It also opens up
|
|---|
| 138 | the use of protocols that Samba-2.2.x had but could not use due to the need to fully support Unicode.
|
|---|
| 139 | </p></li></ul></div><p>
|
|---|
| 140 | The following functionalities are not provided by Samba-3:
|
|---|
| 141 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
|
|---|
| 142 | <a class="indexterm" name="id333207"></a>
|
|---|
| 143 | <a class="indexterm" name="id333214"></a>
|
|---|
| 144 | SAM replication with Windows NT4 domain controllers (i.e., a Samba PDC and a Windows NT BDC, or vice versa).
|
|---|
| 145 | This means Samba cannot operate as a BDC when the PDC is Microsoft-based Windows NT PDC. Samba-3 can not
|
|---|
| 146 | participate in replication of account data to Windows PDCs and BDCs.
|
|---|
| 147 | </p></li><li class="listitem"><p>
|
|---|
| 148 | <a class="indexterm" name="id333227"></a>
|
|---|
| 149 | <a class="indexterm" name="id333233"></a>
|
|---|
| 150 | Acting as a Windows 2000 active directory domain controller (i.e., Kerberos and Active Directory). In point of
|
|---|
| 151 | fact, Samba-3 does have some Active Directory domain control ability that is at this time purely experimental.
|
|---|
| 152 | Active directory domain control is one of the features that is being developed in Samba-4, the next
|
|---|
| 153 | generation Samba release. At this time there are no plans to enable active directory domain control
|
|---|
| 154 | support during the Samba-3 series life-cycle.
|
|---|
| 155 | </p></li><li class="listitem"><p>
|
|---|
| 156 | <a class="indexterm" name="id333249"></a>
|
|---|
| 157 | <a class="indexterm" name="id333255"></a>
|
|---|
| 158 | <a class="indexterm" name="id333262"></a>
|
|---|
| 159 | The Windows 200x/XP Microsoft Management Console (MMC) cannot be used to manage a Samba-3 server. For this you
|
|---|
| 160 | can use only the MS Windows NT4 Domain Server Manager and the MS Windows NT4 Domain User Manager. Both are
|
|---|
| 161 | part of the SVRTOOLS.EXE package mentioned later.
|
|---|
| 162 | </p></li></ul></div><p>
|
|---|
| 163 | <a class="indexterm" name="id333278"></a>
|
|---|
| 164 | <a class="indexterm" name="id333284"></a>
|
|---|
| 165 | Windows 9x/Me/XP Home clients are not true members of a domain for reasons outlined in this chapter. The
|
|---|
| 166 | protocol for support of Windows 9x/Me-style network (domain) logons is completely different from NT4/Windows
|
|---|
| 167 | 200x-type domain logons and has been officially supported for some time. These clients use the old LanMan
|
|---|
| 168 | network logon facilities that are supported in Samba since approximately the Samba-1.9.15 series.
|
|---|
| 169 | </p><p>
|
|---|
| 170 | <a class="indexterm" name="id333298"></a>
|
|---|
| 171 | Samba-3 implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated
|
|---|
| 172 | to explain in a short space). This is discussed more fully in <a class="link" href="groupmapping.html" title="Chapter 12. Group Mapping: MS Windows and UNIX">Group Mapping: MS
|
|---|
| 173 | Windows and UNIX</a>.
|
|---|
| 174 | </p><p>
|
|---|
| 175 | <a class="indexterm" name="id333319"></a>
|
|---|
| 176 | <a class="indexterm" name="id333326"></a>
|
|---|
| 177 | <a class="indexterm" name="id333335"></a>
|
|---|
| 178 | Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store user and Machine Trust
|
|---|
| 179 | Account information in a suitable backend data-store. Refer to <a class="link" href="domain-member.html#machine-trust-accounts" title="MS Windows Workstation/Server Machine Trust Accounts">MS
|
|---|
| 180 | Windows Workstation/Server Machine Trust Accounts</a>. With Samba-3 there can be multiple backends for
|
|---|
| 181 | this. A complete discussion of account database backends can be found in <a class="link" href="passdb.html" title="Chapter 11. Account Information Databases">Account
|
|---|
| 182 | Information Databases</a>.
|
|---|
| 183 | </p></div><div class="sect1" title="Single Sign-On and Domain Security"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id333361"></a>Single Sign-On and Domain Security</h2></div></div></div><p>
|
|---|
| 184 | <a class="indexterm" name="id333369"></a>
|
|---|
| 185 | <a class="indexterm" name="id333378"></a>
|
|---|
| 186 | <a class="indexterm" name="id333384"></a>
|
|---|
| 187 | <a class="indexterm" name="id333391"></a>
|
|---|
| 188 | <a class="indexterm" name="id333398"></a>
|
|---|
| 189 | <a class="indexterm" name="id333405"></a>
|
|---|
| 190 | <a class="indexterm" name="id333411"></a>
|
|---|
| 191 | When network administrators are asked to describe the benefits of Windows NT4 and active directory networking
|
|---|
| 192 | the most often mentioned feature is that of single sign-on (SSO). Many companies have implemented SSO
|
|---|
| 193 | solutions. The mode of implementation of a single sign-on solution is an important factor in the practice of
|
|---|
| 194 | networking in general, and is critical in respect of Windows networking. A company may have a wide variety of
|
|---|
| 195 | information systems, each of which requires a form of user authentication and validation, thus it is not
|
|---|
| 196 | uncommon that users may need to remember more than ten login IDs and passwords. This problem is compounded
|
|---|
| 197 | when the password for each system must be changed at regular intervals, and particularly so where password
|
|---|
| 198 | uniqueness and history limits are applied.
|
|---|
| 199 | </p><p>
|
|---|
| 200 | <a class="indexterm" name="id333428"></a>
|
|---|
| 201 | There is a broadly held perception that SSO is the answer to the problem of users having to deal with too many
|
|---|
| 202 | information system access credentials (username/password pairs). Many elaborate schemes have been devised to
|
|---|
| 203 | make it possible to deliver a user-friendly SSO solution. The trouble is that if this implementation is not
|
|---|
| 204 | done correctly, the site may end up paying dearly by way of complexity and management overheads. Simply put,
|
|---|
| 205 | many SSO solutions are an administrative nightmare.
|
|---|
| 206 | </p><p>
|
|---|
| 207 | <a class="indexterm" name="id333442"></a>
|
|---|
| 208 | <a class="indexterm" name="id333449"></a>
|
|---|
| 209 | <a class="indexterm" name="id333456"></a>
|
|---|
| 210 | SSO implementations utilize centralization of all user account information. Depending on environmental
|
|---|
| 211 | complexity and the age of the systems over which a SSO solution is implemented, it may not be possible to
|
|---|
| 212 | change the solution architecture so as to accommodate a new identity management and user authentication system.
|
|---|
| 213 | Many SSO solutions involving legacy systems consist of a new super-structure that handles authentication on
|
|---|
| 214 | behalf of the user. The software that gets layered over the old system may simply implement a proxy
|
|---|
| 215 | authentication system. This means that the addition of SSO increases over-all information systems complexity.
|
|---|
| 216 | Ideally, the implementation of SSO should reduce complexity and reduce administative overheads.
|
|---|
| 217 | </p><p>
|
|---|
| 218 | <a class="indexterm" name="id333472"></a>
|
|---|
| 219 | <a class="indexterm" name="id333479"></a>
|
|---|
| 220 | <a class="indexterm" name="id333488"></a>
|
|---|
| 221 | <a class="indexterm" name="id333497"></a>
|
|---|
| 222 | <a class="indexterm" name="id333504"></a>
|
|---|
| 223 | The initial goal of many network administrators is often to create and use a centralized identity management
|
|---|
| 224 | system. It is often assumed that such a centralized system will use a single authentication infrastructure
|
|---|
| 225 | that can be used by all information systems. The Microsoft Windows NT4 security domain architecture and the
|
|---|
| 226 | Micrsoft active directory service are often put forward as the ideal foundation for such a system. It is
|
|---|
| 227 | conceptually simple to install an external authentication agent on each of the disparate infromation systems
|
|---|
| 228 | that can then use the Microsoft (NT4 domain or ads service) for user authentication and access control. The
|
|---|
| 229 | wonderful dream of a single centralized authentication service is commonly broken when realities are realized.
|
|---|
| 230 | The problem with legacy systems is often the inability to externalize the authentication and access control
|
|---|
| 231 | system it uses because its implementation will be excessively invasive from a re-engineering perspective, or
|
|---|
| 232 | because application software has built-in dependencies on particular elements of the way user authentication
|
|---|
| 233 | and access control were designed and built.
|
|---|
| 234 | </p><p>
|
|---|
| 235 | <a class="indexterm" name="id333524"></a>
|
|---|
| 236 | <a class="indexterm" name="id333531"></a>
|
|---|
| 237 | <a class="indexterm" name="id333537"></a>
|
|---|
| 238 | <a class="indexterm" name="id333544"></a>
|
|---|
| 239 | <a class="indexterm" name="id333551"></a>
|
|---|
| 240 | <a class="indexterm" name="id333558"></a>
|
|---|
| 241 | <a class="indexterm" name="id333565"></a>
|
|---|
| 242 | <a class="indexterm" name="id333572"></a>
|
|---|
| 243 | Over the past decade an industry has been developed around the various methods that have been built to get
|
|---|
| 244 | around the key limitations of legacy information technology systems. One approach that is often used involves
|
|---|
| 245 | the use of a meta-directory. The meta-directory stores user credentials for all disparate information systems
|
|---|
| 246 | in the format that is particular to each system. An elaborate set of management procedures is coupled with a
|
|---|
| 247 | rigidly enforced work-flow protocol for managing user rights and privileges within the maze of systems that
|
|---|
| 248 | are provisioned by the new infrastructure makes possible user access to all systems using a single set of user
|
|---|
| 249 | credentials.
|
|---|
| 250 | </p><p>
|
|---|
| 251 | <a class="indexterm" name="id333587"></a>
|
|---|
| 252 | <a class="indexterm" name="id333597"></a>
|
|---|
| 253 | <a class="indexterm" name="id333606"></a>
|
|---|
| 254 | <a class="indexterm" name="id333615"></a>
|
|---|
| 255 | The Organization for the Advancement of Structured Information Standards (OASIS) has developed the Security
|
|---|
| 256 | Assertion Markup Language (SAML), a structured method for communication of authentication information. The
|
|---|
| 257 | over-all umbrella name for the technologies and methods that deploy SAML is called Federated Identity
|
|---|
| 258 | Management (FIM). FIM depends on each system in the complex maze of disparate information systems to
|
|---|
| 259 | authenticate their respective users and vouch for secure access to the services each provides.
|
|---|
| 260 | </p><p>
|
|---|
| 261 | <a class="indexterm" name="id333630"></a>
|
|---|
| 262 | <a class="indexterm" name="id333639"></a>
|
|---|
| 263 | <a class="indexterm" name="id333646"></a>
|
|---|
| 264 | <a class="indexterm" name="id333653"></a>
|
|---|
| 265 | <a class="indexterm" name="id333659"></a>
|
|---|
| 266 | <a class="indexterm" name="id333665"></a>
|
|---|
| 267 | SAML documents can be wrapped in a Simple Object Access Protocol (SOAP) message for the computer-to-computer
|
|---|
| 268 | communications needed for Web services. Or they may be passed between Web servers of federated organizations
|
|---|
| 269 | that share live services. The Liberty Alliance, an industry group formed to promote federated-identity
|
|---|
| 270 | standards, has adopted SAML 1.1 as part of its application framework. Microsoft and IBM have proposed an
|
|---|
| 271 | alternative specification called WS-Security. Some believe that the competing technologies and methods may
|
|---|
| 272 | converge when the SAML 2.0 standard is introduced. A few Web access-management products support SAML today,
|
|---|
| 273 | but implementation of the technology mostly requires customization to integrate applications and develop user
|
|---|
| 274 | interfaces. In a nutshell, that is why FIM is a big and growing industry.
|
|---|
| 275 | </p><p>
|
|---|
| 276 | <a class="indexterm" name="id333687"></a>
|
|---|
| 277 | <a class="indexterm" name="id333694"></a>
|
|---|
| 278 | <a class="indexterm" name="id333701"></a>
|
|---|
| 279 | <a class="indexterm" name="id333708"></a>
|
|---|
| 280 | <a class="indexterm" name="id333714"></a>
|
|---|
| 281 | Ignoring the bigger picture, which is beyond the scope of this book, the migration of all user and group
|
|---|
| 282 | management to a centralized system is a step in the right direction. It is essential for interoperability
|
|---|
| 283 | reasons to locate the identity management system data in a directory such as Microsoft Active Directory
|
|---|
| 284 | Service (ADS), or any proprietary or open source system that provides a standard protocol for information
|
|---|
| 285 | access (such as LDAP) and that can be coupled with a flexible array of authentication mechanisms (such as
|
|---|
| 286 | kerberos) that use the protocols that are defined by the various general security service application
|
|---|
| 287 | programming interface (GSSAPI) services.
|
|---|
| 288 | </p><p>
|
|---|
| 289 | <a class="indexterm" name="id333733"></a>
|
|---|
| 290 | <a class="indexterm" name="id333740"></a>
|
|---|
| 291 | <a class="indexterm" name="id333746"></a>
|
|---|
| 292 | A growing number of companies provide authentication agents for disparate legacy platforms to permit the use
|
|---|
| 293 | of LDAP systems. Thus the use of OpenLDAP, the dominant open source software implementation of the light
|
|---|
| 294 | weight directory access protocol standard. This fact, means that by providing support in Samba for the use of
|
|---|
| 295 | LDAP and Microsoft ADS make Samba a highly scalable and forward reaching organizational networking technology.
|
|---|
| 296 | </p><p>
|
|---|
| 297 | <a class="indexterm" name="id333760"></a>
|
|---|
| 298 | <a class="indexterm" name="id333766"></a>
|
|---|
| 299 | <a class="indexterm" name="id333773"></a>
|
|---|
| 300 | <a class="indexterm" name="id333780"></a>
|
|---|
| 301 | <a class="indexterm" name="id333787"></a>
|
|---|
| 302 | <a class="indexterm" name="id333794"></a>
|
|---|
| 303 | Microsoft ADS provides purely proprietary services that, with limitation, can be extended to provide a
|
|---|
| 304 | centralized authentication infrastructure. Samba plus LDAP provides a similar opportunity for extension of a
|
|---|
| 305 | centralized authentication architecture, but it is the fact that the Samba Team are pro-active in introducing
|
|---|
| 306 | the extension of authentication services, using LDAP or otherwise, to applications such as SQUID (the open
|
|---|
| 307 | source proxy server) through tools such as the <code class="literal">ntlm_auth</code> utility, that does much to create
|
|---|
| 308 | sustainable choice and competition in the FIM market place.
|
|---|
| 309 | </p><p>
|
|---|
| 310 | <a class="indexterm" name="id333814"></a>
|
|---|
| 311 | <a class="indexterm" name="id333821"></a>
|
|---|
| 312 | <a class="indexterm" name="id333828"></a>
|
|---|
| 313 | Primary domain control, if it is to be scalable to meet the needs of large sites, must therefore be capable of
|
|---|
| 314 | using LDAP. The rapid adoption of OpenLDAP, and Samba configurations that use it, is ample proof that the era
|
|---|
| 315 | of the directory has started. Samba-3 does not demand the use of LDAP, but the demand for a mechanism by which
|
|---|
| 316 | user and group identity information can be distributed makes it an an unavoidable option.
|
|---|
| 317 | </p><p>
|
|---|
| 318 | <a class="indexterm" name="id333845"></a>
|
|---|
| 319 | <a class="indexterm" name="id333852"></a>
|
|---|
| 320 | <a class="indexterm" name="id333858"></a>
|
|---|
| 321 | At this time, the use of Samba based BDCs, necessitates the use of LDAP. The most commonly used LDAP
|
|---|
| 322 | implementation used by Samba sites is OpenLDAP. It is possible to use any standards compliant LDAP server.
|
|---|
| 323 | Those known to work includes those manufactured by: IBM, CA, Novell (e-Directory), and others.
|
|---|
| 324 | </p></div><div class="sect1" title="Basics of Domain Control"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id333870"></a>Basics of Domain Control</h2></div></div></div><p>
|
|---|
| 325 | <a class="indexterm" name="id333878"></a>
|
|---|
| 326 | Over the years, public perceptions of what domain control really is has taken on an almost mystical nature.
|
|---|
| 327 | Before we branch into a brief overview of domain control, there are three basic types of domain controllers.
|
|---|
| 328 | </p><div class="sect2" title="Domain Controller Types"><div class="titlepage"><div><div><h3 class="title"><a name="id333888"></a>Domain Controller Types</h3></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>NT4 style Primary Domain Controller</p></li><li class="listitem"><p>NT4 style Backup Domain Controller</p></li><li class="listitem"><p>ADS Domain Controller</p></li></ul></div><p>
|
|---|
| 329 | <a class="indexterm" name="id333913"></a>
|
|---|
| 330 | <a class="indexterm" name="id333919"></a>
|
|---|
| 331 | <a class="indexterm" name="id333926"></a>
|
|---|
| 332 | <a class="indexterm" name="id333935"></a>
|
|---|
| 333 | The <span class="emphasis"><em>Primary Domain Controller</em></span> or PDC plays an important role in MS Windows NT4. In
|
|---|
| 334 | Windows 200x domain control architecture, this role is held by domain controllers. Folklore dictates that
|
|---|
| 335 | because of its role in the MS Windows network, the domain controller should be the most powerful and most
|
|---|
| 336 | capable machine in the network. As strange as it may seem to say this here, good overall network performance
|
|---|
| 337 | dictates that the entire infrastructure needs to be balanced. It is advisable to invest more in standalone
|
|---|
| 338 | (domain member) servers than in the domain controllers.
|
|---|
| 339 | </p><p>
|
|---|
| 340 | <a class="indexterm" name="id333958"></a>
|
|---|
| 341 | <a class="indexterm" name="id333965"></a>
|
|---|
| 342 | <a class="indexterm" name="id333972"></a>
|
|---|
| 343 | <a class="indexterm" name="id333978"></a>
|
|---|
| 344 | <a class="indexterm" name="id333985"></a>
|
|---|
| 345 | In the case of MS Windows NT4-style domains, it is the PDC that initiates a new domain control database.
|
|---|
| 346 | This forms a part of the Windows registry called the Security Account Manager (SAM). It plays a key
|
|---|
| 347 | part in NT4-type domain user authentication and in synchronization of the domain authentication
|
|---|
| 348 | database with BDCs.
|
|---|
| 349 | </p><p>
|
|---|
| 350 | <a class="indexterm" name="id334000"></a>
|
|---|
| 351 | <a class="indexterm" name="id334012"></a>
|
|---|
| 352 | <a class="indexterm" name="id334019"></a>
|
|---|
| 353 | <a class="indexterm" name="id334028"></a>
|
|---|
| 354 | With MS Windows 200x Server-based Active Directory domains, one domain controller initiates a potential
|
|---|
| 355 | hierarchy of domain controllers, each with its own area of delegated control. The master domain
|
|---|
| 356 | controller has the ability to override any downstream controller, but a downline controller has
|
|---|
| 357 | control only over its downline. With Samba-3, this functionality can be implemented using an
|
|---|
| 358 | LDAP-based user and machine account backend.
|
|---|
| 359 | </p><p>
|
|---|
| 360 | <a class="indexterm" name="id334042"></a>
|
|---|
| 361 | <a class="indexterm" name="id334048"></a>
|
|---|
| 362 | New to Samba-3 is the ability to use a backend database that holds the same type of data as the NT4-style SAM
|
|---|
| 363 | database (one of the registry files)<sup>[<a name="id334056" href="#ftn.id334056" class="footnote">1</a>]</sup>
|
|---|
| 364 | </p><p>
|
|---|
| 365 | <a class="indexterm" name="id334071"></a>
|
|---|
| 366 | <a class="indexterm" name="id334078"></a>
|
|---|
| 367 | <a class="indexterm" name="id334084"></a>
|
|---|
| 368 | <a class="indexterm" name="id334091"></a>
|
|---|
| 369 | <a class="indexterm" name="id334098"></a>
|
|---|
| 370 | <a class="indexterm" name="id334104"></a>
|
|---|
| 371 | The <span class="emphasis"><em>Backup Domain Controller</em></span> or BDC plays a key role in servicing network authentication
|
|---|
| 372 | requests. The BDC is biased to answer logon requests in preference to the PDC. On a network segment that has
|
|---|
| 373 | a BDC and a PDC, the BDC will most likely service network logon requests. The PDC will answer network logon
|
|---|
| 374 | requests when the BDC is too busy (high load). When a user logs onto a Windows domain member client the
|
|---|
| 375 | workstation will query the network to locate the nearest network logon server. Where a WINS server is used,
|
|---|
| 376 | this is done via a query to the WINS server. If a netlogon server can not be found from the WINS query, or in
|
|---|
| 377 | the absence of a WINS server, the workstation will perform a NetBIOS name lookup via a mailslot broadcast over
|
|---|
| 378 | the UDP broadcast protocol. This means that the netlogon server that the windows client will use is influenced
|
|---|
| 379 | by a number of variables, thus there is no simple determinant of whether a PDC or a BDC will serve a
|
|---|
| 380 | particular logon authentication request.
|
|---|
| 381 | </p><p>
|
|---|
| 382 | <a class="indexterm" name="id334126"></a>
|
|---|
| 383 | <a class="indexterm" name="id334133"></a>
|
|---|
| 384 | A Windows NT4 BDC can be promoted to a PDC. If the PDC is online at the time that a BDC is promoted to PDC,
|
|---|
| 385 | the previous PDC is automatically demoted to a BDC. With Samba-3, this is not an automatic operation; the PDC
|
|---|
| 386 | and BDC must be manually configured, and other appropriate changes also need to be made.
|
|---|
| 387 | </p><p>
|
|---|
| 388 | <a class="indexterm" name="id334146"></a>
|
|---|
| 389 | With MS Windows NT4, a decision is made at installation to determine what type of machine the server will be.
|
|---|
| 390 | It is possible to promote a BDC to a PDC, and vice versa. The only method Microsoft provide to convert a
|
|---|
| 391 | Windows NT4 domain controller to a domain member server or a standalone server is to reinstall it. The install
|
|---|
| 392 | time choices offered are:
|
|---|
| 393 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><span class="emphasis"><em>Primary Domain Controller</em></span> the one that seeds the domain SAM.</p></li><li class="listitem"><p><span class="emphasis"><em>Backup Domain Controller</em></span> one that obtains a copy of the domain SAM.</p></li><li class="listitem"><p><span class="emphasis"><em>Domain Member Server</em></span> one that has no copy of the domain SAM; rather
|
|---|
| 394 | it obtains authentication from a domain controller for all access controls.</p></li><li class="listitem"><p><span class="emphasis"><em>Standalone Server</em></span> one that plays no part in SAM synchronization,
|
|---|
| 395 | has its own authentication database, and plays no role in domain security.</p></li></ul></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 396 | <a class="indexterm" name="id334209"></a>
|
|---|
| 397 | Algin Technology LLC provide a commercial tool that makes it possible to promote a Windows NT4 standalone
|
|---|
| 398 | server to a PDC or a BDC, and also permits this process to be reversed. Refer to the <a class="ulink" href="http://utools.com/UPromote.asp" target="_top">Algin</a> web site for further information.
|
|---|
| 399 | </p></div><p>
|
|---|
| 400 | <a class="indexterm" name="id334226"></a>
|
|---|
| 401 | <a class="indexterm" name="id334238"></a>
|
|---|
| 402 | Samba-3 servers can readily be converted to and from domain controller roles through simple changes to the
|
|---|
| 403 | <code class="filename">smb.conf</code> file. Samba-3 is capable of acting fully as a native member of a Windows 200x server Active
|
|---|
| 404 | Directory domain.
|
|---|
| 405 | </p><p>
|
|---|
| 406 | <a class="indexterm" name="id334255"></a>
|
|---|
| 407 | For the sake of providing a complete picture, MS Windows 2000 domain control configuration is done after the server has been
|
|---|
| 408 | installed. Please refer to Microsoft documentation for the procedures that should be followed to convert a
|
|---|
| 409 | domain member server to or from a domain control, and to install or remove active directory service support.
|
|---|
| 410 | </p><p>
|
|---|
| 411 | <a class="indexterm" name="id334271"></a>
|
|---|
| 412 | <a class="indexterm" name="id334280"></a>
|
|---|
| 413 | New to Samba-3 is the ability to function fully as an MS Windows NT4-style domain controller,
|
|---|
| 414 | excluding the SAM replication components. However, please be aware that Samba-3 also supports the
|
|---|
| 415 | MS Windows 200x domain control protocols.
|
|---|
| 416 | </p><p>
|
|---|
| 417 | <a class="indexterm" name="id334294"></a>
|
|---|
| 418 | At this time any appearance that Samba-3 is capable of acting as a <span class="emphasis"><em>domain controller</em></span> in
|
|---|
| 419 | native ADS mode is limited and experimental in nature. This functionality should not be used until the Samba
|
|---|
| 420 | Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all
|
|---|
| 421 | configuration and management requirements. Samba can act as a NT4-style domain controller in a Windows 2000/XP
|
|---|
| 422 | environment. However, there are certain compromises:
|
|---|
| 423 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>No machine policy files.</p></li><li class="listitem"><p>No Group Policy Objects.</p></li><li class="listitem"><p>No synchronously executed Active Directory logon scripts.</p></li><li class="listitem"><p>Can't use Active Directory management tools to manage users and machines.</p></li><li class="listitem"><p>Registry changes tattoo the main registry, while with Active Directory they do not leave
|
|---|
| 424 | permanent changes in effect.</p></li><li class="listitem"><p>Without Active Directory you cannot perform the function of exporting specific
|
|---|
| 425 | applications to specific users or groups.</p></li></ul></div></div><div class="sect2" title="Preparing for Domain Control"><div class="titlepage"><div><div><h3 class="title"><a name="id334343"></a>Preparing for Domain Control</h3></div></div></div><p>
|
|---|
| 426 | <a class="indexterm" name="id334351"></a>
|
|---|
| 427 | <a class="indexterm" name="id334358"></a>
|
|---|
| 428 | <a class="indexterm" name="id334365"></a>
|
|---|
| 429 | <a class="indexterm" name="id334372"></a>
|
|---|
| 430 | There are two ways that MS Windows machines may interact with each other, with other servers,
|
|---|
| 431 | and with domain controllers: either as <span class="emphasis"><em>standalone</em></span> systems, more commonly
|
|---|
| 432 | called <span class="emphasis"><em>workgroup</em></span> members, or as full participants in a security system,
|
|---|
| 433 | more commonly called <span class="emphasis"><em>domain</em></span> members.
|
|---|
| 434 | </p><p>
|
|---|
| 435 | <a class="indexterm" name="id334395"></a>
|
|---|
| 436 | <a class="indexterm" name="id334402"></a>
|
|---|
| 437 | <a class="indexterm" name="id334411"></a>
|
|---|
| 438 | It should be noted that workgroup membership involves no special configuration other than the machine being
|
|---|
| 439 | configured so the network configuration has a commonly used name for its workgroup entry. It is not uncommon
|
|---|
| 440 | for the name WORKGROUP to be used for this. With this mode of configuration, there are no Machine Trust
|
|---|
| 441 | Accounts, and any concept of membership as such is limited to the fact that all machines appear in the network
|
|---|
| 442 | neighborhood to be logically grouped together. Again, just to be clear: <span class="emphasis"><em>workgroup mode does not
|
|---|
| 443 | involve security machine accounts</em></span>.
|
|---|
| 444 | </p><p>
|
|---|
| 445 | <a class="indexterm" name="id334429"></a>
|
|---|
| 446 | <a class="indexterm" name="id334436"></a>
|
|---|
| 447 | <a class="indexterm" name="id334445"></a>
|
|---|
| 448 | Domain member machines have a machine trust account in the domain accounts database. A special procedure
|
|---|
| 449 | must be followed on each machine to effect domain membership. This procedure, which can be done
|
|---|
| 450 | only by the local machine Administrator account, creates the domain machine account (if it does
|
|---|
| 451 | not exist), and then initializes that account. When the client first logs onto the
|
|---|
| 452 | domain, a machine trust account password change will be automatically triggered.
|
|---|
| 453 | </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 454 | <a class="indexterm" name="id334460"></a>
|
|---|
| 455 | When Samba is configured as a domain controller, secure network operation demands that
|
|---|
| 456 | all MS Windows NT4/200x/XP Professional clients should be configured as domain members.
|
|---|
| 457 | If a machine is not made a member of the domain, then it will operate like a workgroup
|
|---|
| 458 | (standalone) machine. Please refer to <a class="link" href="domain-member.html" title="Chapter 6. Domain Membership">Domain Membership</a>, for
|
|---|
| 459 | information regarding domain membership.
|
|---|
| 460 | </p></div><p>
|
|---|
| 461 | The following are necessary for configuring Samba-3 as an MS Windows NT4-style PDC for MS Windows
|
|---|
| 462 | NT4/200x/XP clients:
|
|---|
| 463 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Configuration of basic TCP/IP and MS Windows networking.</p></li><li class="listitem"><p>Correct designation of the server role (<a class="link" href="smb.conf.5.html#SECURITY" target="_top">security = user</a>).</p></li><li class="listitem"><p>Consistent configuration of name resolution.<sup>[<a name="id334510" href="#ftn.id334510" class="footnote">2</a>]</sup></p></li><li class="listitem"><p>Domain logons for Windows NT4/200x/XP Professional clients.</p></li><li class="listitem"><p>Configuration of roaming profiles or explicit configuration to force local profile usage.</p></li><li class="listitem"><p>Configuration of network/system policies.</p></li><li class="listitem"><p>Adding and managing domain user accounts.</p></li><li class="listitem"><p>Configuring MS Windows NT4/2000 Professional and Windows XP Professional client machines to become domain members.</p></li></ul></div><p>
|
|---|
| 464 | The following provisions are required to serve MS Windows 9x/Me clients:
|
|---|
| 465 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Configuration of basic TCP/IP and MS Windows networking.</p></li><li class="listitem"><p>Correct designation of the server role (<a class="link" href="smb.conf.5.html#SECURITY" target="_top">security = user</a>).</p></li><li class="listitem"><p>Network logon configuration (since Windows 9x/Me/XP Home are not technically domain
|
|---|
| 466 | members, they do not really participate in the security aspects of Domain logons as such).</p></li><li class="listitem"><p>Roaming profile configuration.</p></li><li class="listitem"><p>Configuration of system policy handling.</p></li><li class="listitem"><p>Installation of the network driver <span class="quote">“<span class="quote">Client for MS Windows Networks</span>”</span> and configuration
|
|---|
| 467 | to log onto the domain.</p></li><li class="listitem"><p>Placing Windows 9x/Me clients in user-level security if it is desired to allow
|
|---|
| 468 | all client-share access to be controlled according to domain user/group identities.</p></li><li class="listitem"><p>Adding and managing domain user accounts.</p></li></ul></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 469 | <a class="indexterm" name="id334622"></a>
|
|---|
| 470 | <a class="indexterm" name="id334628"></a>
|
|---|
| 471 | Roaming profiles and system/network policies are advanced network administration topics
|
|---|
| 472 | that are covered in <a class="link" href="ProfileMgmt.html" title="Chapter 27. Desktop Profile Management">Desktop Profile Management</a> and
|
|---|
| 473 | <a class="link" href="PolicyMgmt.html" title="Chapter 26. System and Account Policies">System and Account Policies</a> of this document. However, these are not
|
|---|
| 474 | necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts.
|
|---|
| 475 | </p></div><p>
|
|---|
| 476 | A domain controller is an SMB/CIFS server that:
|
|---|
| 477 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
|
|---|
| 478 | <a class="indexterm" name="id334662"></a>
|
|---|
| 479 | <a class="indexterm" name="id334671"></a>
|
|---|
| 480 | <a class="indexterm" name="id334677"></a>
|
|---|
| 481 | <a class="indexterm" name="id334684"></a>
|
|---|
| 482 | <a class="indexterm" name="id334691"></a>
|
|---|
| 483 | Registers and advertises itself as a domain controller (through NetBIOS broadcasts
|
|---|
| 484 | as well as by way of name registrations either by Mailslot Broadcasts over UDP broadcast,
|
|---|
| 485 | to a WINS server over UDP unicast, or via DNS and Active Directory).
|
|---|
| 486 | </p></li><li class="listitem"><p>
|
|---|
| 487 | <a class="indexterm" name="id334704"></a>
|
|---|
| 488 | <a class="indexterm" name="id334711"></a>
|
|---|
| 489 | Provides the NETLOGON service. (This is actually a collection of services that runs over
|
|---|
| 490 | multiple protocols. These include the LanMan logon service, the Netlogon service,
|
|---|
| 491 | the Local Security Account service, and variations of them.)
|
|---|
| 492 | </p></li><li class="listitem"><p>
|
|---|
| 493 | Provides a share called NETLOGON.
|
|---|
| 494 | </p></li></ul></div><p>
|
|---|
| 495 | <a class="indexterm" name="id334729"></a>
|
|---|
| 496 | <a class="indexterm" name="id334741"></a>
|
|---|
| 497 | <a class="indexterm" name="id334752"></a>
|
|---|
| 498 | <a class="indexterm" name="id334759"></a>
|
|---|
| 499 | <a class="indexterm" name="id334766"></a>
|
|---|
| 500 | It is rather easy to configure Samba to provide these. Each Samba domain controller must provide the NETLOGON
|
|---|
| 501 | service that Samba calls the <a class="link" href="smb.conf.5.html#DOMAINLOGONS" target="_top">domain logons</a> functionality (after the name of the
|
|---|
| 502 | parameter in the <code class="filename">smb.conf</code> file). Additionally, one server in a Samba-3 domain must advertise itself as the
|
|---|
| 503 | domain master browser.<sup>[<a name="id334793" href="#ftn.id334793" class="footnote">3</a>]</sup> This causes the PDC to claim a domain-specific NetBIOS name that identifies
|
|---|
| 504 | it as a DMB for its given domain or workgroup. Local master browsers (LMBs) in the same domain or workgroup on
|
|---|
| 505 | broadcast-isolated subnets then ask for a complete copy of the browse list for the whole wide-area network.
|
|---|
| 506 | Browser clients then contact their LMB, and will receive the domain-wide browse list instead of just the list
|
|---|
| 507 | for their broadcast-isolated subnet.
|
|---|
| 508 | </p></div></div><div class="sect1" title="Domain Control: Example Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id334811"></a>Domain Control: Example Configuration</h2></div></div></div><p>
|
|---|
| 509 | The first step in creating a working Samba PDC is to understand the parameters necessary
|
|---|
| 510 | in <code class="filename">smb.conf</code>. An example <code class="filename">smb.conf</code> for acting as a PDC can be found in <a class="link" href="samba-pdc.html#pdc-example" title="Example 4.1. smb.conf for being a PDC">the
|
|---|
| 511 | smb.conf file for an example PDC</a>.
|
|---|
| 512 | </p><div class="example"><a name="pdc-example"></a><p class="title"><b>Example 4.1. smb.conf for being a PDC</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id334864"></a></td></tr><tr><td><a class="indexterm" name="id334871"></a></td></tr><tr><td><a class="indexterm" name="id334878"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id334889"></a><em class="parameter"><code>os level = 33</code></em></td></tr><tr><td><a class="indexterm" name="id334900"></a><em class="parameter"><code>preferred master = auto</code></em></td></tr><tr><td><a class="indexterm" name="id334912"></a><em class="parameter"><code>domain master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id334923"></a><em class="parameter"><code>local master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id334935"></a><em class="parameter"><code>security = user</code></em></td></tr><tr><td><a class="indexterm" name="id334946"></a><em class="parameter"><code>domain logons = yes</code></em></td></tr><tr><td><a class="indexterm" name="id334958"></a><em class="parameter"><code>logon path = \\%N\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id334969"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id334981"></a><em class="parameter"><code>logon home = \\homeserver\%U\winprofile</code></em></td></tr><tr><td><a class="indexterm" name="id334992"></a><em class="parameter"><code>logon script = logon.cmd</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id335013"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id335025"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id335036"></a></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id335052"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id335063"></a><em class="parameter"><code>read only = no</code></em></td></tr><tr><td><a class="indexterm" name="id335075"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id335086"></a><em class="parameter"><code>directory mask = 0700</code></em></td></tr></table></div></div><br class="example-break"><p>
|
|---|
| 513 | The basic options shown in <a class="link" href="samba-pdc.html#pdc-example" title="Example 4.1. smb.conf for being a PDC">this example</a> are explained as follows:
|
|---|
| 514 | </p><div class="variablelist"><dl><dt><span class="term">passdb backend </span></dt><dd><p>
|
|---|
| 515 | <a class="indexterm" name="id335119"></a>
|
|---|
| 516 | <a class="indexterm" name="id335129"></a>
|
|---|
| 517 | <a class="indexterm" name="id335135"></a>
|
|---|
| 518 | <a class="indexterm" name="id335142"></a>
|
|---|
| 519 | <a class="indexterm" name="id335149"></a>
|
|---|
| 520 | <a class="indexterm" name="id335156"></a>
|
|---|
| 521 | This contains all the user and group account information. Acceptable values for a PDC
|
|---|
| 522 | are: <span class="emphasis"><em>smbpasswd, tdbsam, and ldapsam</em></span>. The <span class="quote">“<span class="quote">guest</span>”</span> entry provides
|
|---|
| 523 | default accounts and is included by default; there is no need to add it explicitly.
|
|---|
| 524 | </p><p>
|
|---|
| 525 | <a class="indexterm" name="id335175"></a>
|
|---|
| 526 | <a class="indexterm" name="id335182"></a>
|
|---|
| 527 | <a class="indexterm" name="id335189"></a>
|
|---|
| 528 | <a class="indexterm" name="id335196"></a>
|
|---|
| 529 | Where use of BDCs is intended, the only logical choice is
|
|---|
| 530 | to use LDAP so the passdb backend can be distributed. The tdbsam and smbpasswd files
|
|---|
| 531 | cannot effectively be distributed and therefore should not be used.
|
|---|
| 532 | </p></dd><dt><span class="term">Domain Control Parameters </span></dt><dd><p>
|
|---|
| 533 | <a class="indexterm" name="id335214"></a>
|
|---|
| 534 | <a class="indexterm" name="id335221"></a>
|
|---|
| 535 | <a class="indexterm" name="id335228"></a>
|
|---|
| 536 | <a class="indexterm" name="id335235"></a>
|
|---|
| 537 | The parameters <span class="emphasis"><em>os level, preferred master, domain master, security,
|
|---|
| 538 | encrypt passwords</em></span>, and <span class="emphasis"><em>domain logons</em></span> play a central role in assuring domain
|
|---|
| 539 | control and network logon support.
|
|---|
| 540 | </p><p>
|
|---|
| 541 | <a class="indexterm" name="id335256"></a>
|
|---|
| 542 | <a class="indexterm" name="id335262"></a>
|
|---|
| 543 | The <span class="emphasis"><em>os level</em></span> must be set at or above a value of 32. A domain controller
|
|---|
| 544 | must be the DMB, must be set in <span class="emphasis"><em>user</em></span> mode security,
|
|---|
| 545 | must support Microsoft-compatible encrypted passwords, and must provide the network logon
|
|---|
| 546 | service (domain logons). Encrypted passwords must be enabled. For more details on how
|
|---|
| 547 | to do this, refer to <a class="link" href="passdb.html" title="Chapter 11. Account Information Databases">Account Information Databases</a>.
|
|---|
| 548 | </p></dd><dt><span class="term">Environment Parameters </span></dt><dd><p>
|
|---|
| 549 | <a class="indexterm" name="id335296"></a>
|
|---|
| 550 | <a class="indexterm" name="id335303"></a>
|
|---|
| 551 | <a class="indexterm" name="id335310"></a>
|
|---|
| 552 | <a class="indexterm" name="id335317"></a>
|
|---|
| 553 | The parameters <span class="emphasis"><em>logon path, logon home, logon drive</em></span>, and <span class="emphasis"><em>logon script</em></span> are
|
|---|
| 554 | environment support settings that help to facilitate client logon operations and that help
|
|---|
| 555 | to provide automated control facilities to ease network management overheads. Please refer
|
|---|
| 556 | to the man page information for these parameters.
|
|---|
| 557 | </p></dd><dt><span class="term">NETLOGON Share </span></dt><dd><p>
|
|---|
| 558 | <a class="indexterm" name="id335343"></a>
|
|---|
| 559 | <a class="indexterm" name="id335350"></a>
|
|---|
| 560 | <a class="indexterm" name="id335357"></a>
|
|---|
| 561 | <a class="indexterm" name="id335364"></a>
|
|---|
| 562 | <a class="indexterm" name="id335370"></a>
|
|---|
| 563 | <a class="indexterm" name="id335377"></a>
|
|---|
| 564 | The NETLOGON share plays a central role in domain logon and domain membership support.
|
|---|
| 565 | This share is provided on all Microsoft domain controllers. It is used to provide logon
|
|---|
| 566 | scripts, to store group policy files (NTConfig.POL), as well as to locate other common
|
|---|
| 567 | tools that may be needed for logon processing. This is an essential share on a domain controller.
|
|---|
| 568 | </p></dd><dt><span class="term">PROFILE Share </span></dt><dd><p>
|
|---|
| 569 | <a class="indexterm" name="id335397"></a>
|
|---|
| 570 | <a class="indexterm" name="id335404"></a>
|
|---|
| 571 | <a class="indexterm" name="id335410"></a>
|
|---|
| 572 | <a class="indexterm" name="id335417"></a>
|
|---|
| 573 | <a class="indexterm" name="id335424"></a>
|
|---|
| 574 | This share is used to store user desktop profiles. Each user must have a directory at the root
|
|---|
| 575 | of this share. This directory must be write-enabled for the user and must be globally read-enabled.
|
|---|
| 576 | Samba-3 has a VFS module called <span class="quote">“<span class="quote">fake_permissions</span>”</span> that may be installed on this share. This will
|
|---|
| 577 | allow a Samba administrator to make the directory read-only to everyone. Of course this is useful
|
|---|
| 578 | only after the profile has been properly created.
|
|---|
| 579 | </p></dd></dl></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 580 | The above parameters make for a full set of functionality that may define the server's mode
|
|---|
| 581 | of operation. The following <code class="filename">smb.conf</code> parameters are the essentials alone:
|
|---|
| 582 | </p><p>
|
|---|
| 583 | </p><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id335459"></a><em class="parameter"><code>netbios name = BELERIAND</code></em></td></tr><tr><td><a class="indexterm" name="id335471"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id335482"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id335494"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id335505"></a><em class="parameter"><code>security = User</code></em></td></tr></table><p>
|
|---|
| 584 | </p><p>
|
|---|
| 585 | The additional parameters shown in the longer listing in this section just make for
|
|---|
| 586 | a more complete explanation.
|
|---|
| 587 | </p></div></div><div class="sect1" title="Samba ADS Domain Control"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id335523"></a>Samba ADS Domain Control</h2></div></div></div><p>
|
|---|
| 588 | <a class="indexterm" name="id335531"></a>
|
|---|
| 589 | Samba-3 is not, and cannot act as, an Active Directory server. It cannot truly function as an Active Directory
|
|---|
| 590 | PDC. The protocols for some of the functionality of Active Directory domain controllers has been partially
|
|---|
| 591 | implemented on an experimental only basis. Please do not expect Samba-3 to support these protocols. Do not
|
|---|
| 592 | depend on any such functionality either now or in the future. The Samba Team may remove these experimental
|
|---|
| 593 | features or may change their behavior. This is mentioned for the benefit of those who have discovered secret
|
|---|
| 594 | capabilities in Samba-3 and who have asked when this functionality will be completed. The answer is maybe
|
|---|
| 595 | someday or maybe never!
|
|---|
| 596 | </p><p>
|
|---|
| 597 | <a class="indexterm" name="id335547"></a>
|
|---|
| 598 | <a class="indexterm" name="id335554"></a>
|
|---|
| 599 | To be sure, Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4-style
|
|---|
| 600 | domain controllers have. Samba-3 does not have all the capabilities of Windows NT4, but it does have
|
|---|
| 601 | a number of features that Windows NT4 domain controllers do not have. In short, Samba-3 is not NT4 and it
|
|---|
| 602 | is not Windows Server 200x: it is not an Active Directory server. We hope this is plain and simple
|
|---|
| 603 | enough for all to understand.
|
|---|
| 604 | </p></div><div class="sect1" title="Domain and Network Logon Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id335566"></a>Domain and Network Logon Configuration</h2></div></div></div><p>
|
|---|
| 605 | <a class="indexterm" name="id335574"></a>
|
|---|
| 606 | The subject of network or domain logons is discussed here because it forms
|
|---|
| 607 | an integral part of the essential functionality that is provided by a domain controller.
|
|---|
| 608 | </p><div class="sect2" title="Domain Network Logon Service"><div class="titlepage"><div><div><h3 class="title"><a name="id335583"></a>Domain Network Logon Service</h3></div></div></div><p>
|
|---|
| 609 | <a class="indexterm" name="id335591"></a>
|
|---|
| 610 | All domain controllers must run the netlogon service (<span class="emphasis"><em>domain logons</em></span>
|
|---|
| 611 | in Samba). One domain controller must be configured with <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a>
|
|---|
| 612 | (the PDC); on all BDCs set the parameter <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = No</a>.
|
|---|
| 613 | </p><div class="sect3" title="Example Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id335627"></a>Example Configuration</h4></div></div></div><div class="example"><a name="PDC-config"></a><p class="title"><b>Example 4.2. smb.conf for being a PDC</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id335656"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id335667"></a><em class="parameter"><code>domain master = (Yes on PDC, No on BDCs)</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id335688"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id335700"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id335711"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id335723"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect3" title="The Special Case of MS Windows XP Home Edition"><div class="titlepage"><div><div><h4 class="title"><a name="id335736"></a>The Special Case of MS Windows XP Home Edition</h4></div></div></div><p>
|
|---|
| 614 | <a class="indexterm" name="id335744"></a>
|
|---|
| 615 | To be completely clear: If you want MS Windows XP Home Edition to integrate with your
|
|---|
| 616 | MS Windows NT4 or Active Directory domain security, understand it cannot be done.
|
|---|
| 617 | The only option is to purchase the upgrade from MS Windows XP Home Edition to
|
|---|
| 618 | MS Windows XP Professional.
|
|---|
| 619 | </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 620 | MS Windows XP Home Edition does not have the ability to join any type of domain
|
|---|
| 621 | security facility. Unlike MS Windows 9x/Me, MS Windows XP Home Edition also completely
|
|---|
| 622 | lacks the ability to log onto a network.
|
|---|
| 623 | </p></div><p>
|
|---|
| 624 | Now that this has been said, please do not ask the mailing list or email any of the
|
|---|
| 625 | Samba Team members with your questions asking how to make this work. It can't be done.
|
|---|
| 626 | If it can be done, then to do so would violate your software license agreement with
|
|---|
| 627 | Microsoft, and we recommend that you do not do that.
|
|---|
| 628 | </p></div><div class="sect3" title="The Special Case of Windows 9x/Me"><div class="titlepage"><div><div><h4 class="title"><a name="id335768"></a>The Special Case of Windows 9x/Me</h4></div></div></div><p>
|
|---|
| 629 | <a class="indexterm" name="id335775"></a>
|
|---|
| 630 | <a class="indexterm" name="id335782"></a>
|
|---|
| 631 | <a class="indexterm" name="id335789"></a>
|
|---|
| 632 | <a class="indexterm" name="id335796"></a>
|
|---|
| 633 | <a class="indexterm" name="id335803"></a>
|
|---|
| 634 | A domain and a workgroup are exactly the same in terms of network
|
|---|
| 635 | browsing. The difference is that a distributable authentication
|
|---|
| 636 | database is associated with a domain, for secure login access to a
|
|---|
| 637 | network. Also, different access rights can be granted to users if they
|
|---|
| 638 | successfully authenticate against a domain logon server. Samba-3 does this
|
|---|
| 639 | now in the same way as MS Windows NT/200x.
|
|---|
| 640 | </p><p>
|
|---|
| 641 | <a class="indexterm" name="id335816"></a>
|
|---|
| 642 | The SMB client logging on to a domain has an expectation that every other
|
|---|
| 643 | server in the domain should accept the same authentication information.
|
|---|
| 644 | Network browsing functionality of domains and workgroups is identical and
|
|---|
| 645 | is explained in this documentation under the browsing discussions.
|
|---|
| 646 | It should be noted that browsing is totally orthogonal to logon support.
|
|---|
| 647 | </p><p>
|
|---|
| 648 | <a class="indexterm" name="id335829"></a>
|
|---|
| 649 | <a class="indexterm" name="id335836"></a>
|
|---|
| 650 | <a class="indexterm" name="id335843"></a>
|
|---|
| 651 | Issues related to the single-logon network model are discussed in this
|
|---|
| 652 | section. Samba supports domain logons, network logon scripts, and user
|
|---|
| 653 | profiles for MS Windows for Workgroups and MS Windows 9x/Me clients,
|
|---|
| 654 | which are the focus of this section.
|
|---|
| 655 | </p><p>
|
|---|
| 656 | <a class="indexterm" name="id335855"></a>
|
|---|
| 657 | When an SMB client in a domain wishes to log on, it broadcasts requests for a logon server. The first one to
|
|---|
| 658 | reply gets the job and validates its password using whatever mechanism the Samba administrator has installed.
|
|---|
| 659 | It is possible (but ill advised) to create a domain where the user database is not shared between servers;
|
|---|
| 660 | that is, they are effectively workgroup servers advertising themselves as participating in a domain. This
|
|---|
| 661 | demonstrates how authentication is quite different from but closely involved with domains.
|
|---|
| 662 | </p><p>
|
|---|
| 663 | Using these features, you can make your clients verify their logon via
|
|---|
| 664 | the Samba server, make clients run a batch file when they log on to
|
|---|
| 665 | the network and download their preferences, desktop, and start menu.
|
|---|
| 666 | </p><p><span class="emphasis"><em>
|
|---|
| 667 | MS Windows XP Home edition is not able to join a domain and does not permit the use of domain logons.
|
|---|
| 668 | </em></span></p><p>
|
|---|
| 669 | Before launching into the configuration instructions, it is worthwhile to look at how a Windows 9x/Me client
|
|---|
| 670 | performs a logon:
|
|---|
| 671 | </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>
|
|---|
| 672 | <a class="indexterm" name="id335893"></a>
|
|---|
| 673 | <a class="indexterm" name="id335900"></a>
|
|---|
| 674 | The client broadcasts (to the IP broadcast address of the subnet it is in)
|
|---|
| 675 | a NetLogon request. This is sent to the NetBIOS name DOMAIN<1C> at the
|
|---|
| 676 | NetBIOS layer. The client chooses the first response it receives, which
|
|---|
| 677 | contains the NetBIOS name of the logon server to use in the format of
|
|---|
| 678 | <code class="filename">\\SERVER</code>. The <code class="literal">1C</code> name is the name
|
|---|
| 679 | type that is registered by domain controllers (SMB/CIFS servers that provide
|
|---|
| 680 | the netlogon service).
|
|---|
| 681 | </p></li><li class="listitem"><p>
|
|---|
| 682 | <a class="indexterm" name="id335933"></a>
|
|---|
| 683 | <a class="indexterm" name="id335940"></a>
|
|---|
| 684 | <a class="indexterm" name="id335946"></a>
|
|---|
| 685 | The client connects to that server, logs on (does an SMBsessetupX) and
|
|---|
| 686 | then connects to the IPC$ share (using an SMBtconX).
|
|---|
| 687 | </p></li><li class="listitem"><p>
|
|---|
| 688 | <a class="indexterm" name="id335961"></a>
|
|---|
| 689 | The client does a NetWkstaUserLogon request, which retrieves the name
|
|---|
| 690 | of the user's logon script.
|
|---|
| 691 | </p></li><li class="listitem"><p>
|
|---|
| 692 | The client then connects to the NetLogon share and searches for said script.
|
|---|
| 693 | If it is found and can be read, it is retrieved and executed by the client.
|
|---|
| 694 | After this, the client disconnects from the NetLogon share.
|
|---|
| 695 | </p></li><li class="listitem"><p>
|
|---|
| 696 | <a class="indexterm" name="id335983"></a>
|
|---|
| 697 | <a class="indexterm" name="id335990"></a>
|
|---|
| 698 | The client sends a NetUserGetInfo request to the server to retrieve
|
|---|
| 699 | the user's home share, which is used to search for profiles. Since the
|
|---|
| 700 | response to the NetUserGetInfo request does not contain much more than
|
|---|
| 701 | the user's home share, profiles for Windows 9x clients must reside in the user
|
|---|
| 702 | home directory.
|
|---|
| 703 | </p></li><li class="listitem"><p>
|
|---|
| 704 | <a class="indexterm" name="id336006"></a>
|
|---|
| 705 | The client connects to the user's home share and searches for the
|
|---|
| 706 | user's profile. As it turns out, you can specify the user's home share as
|
|---|
| 707 | a share name and path. For example, <code class="filename">\\server\fred\.winprofile</code>.
|
|---|
| 708 | If the profiles are found, they are implemented.
|
|---|
| 709 | </p></li><li class="listitem"><p>
|
|---|
| 710 | <a class="indexterm" name="id336027"></a>
|
|---|
| 711 | The client then disconnects from the user's home share and reconnects to
|
|---|
| 712 | the NetLogon share and looks for <code class="filename">CONFIG.POL</code>, the policies file. If this is
|
|---|
| 713 | found, it is read and implemented.
|
|---|
| 714 | </p></li></ol></div><p>
|
|---|
| 715 | The main difference between a PDC and a Windows 9x/Me logon server configuration is:
|
|---|
| 716 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
|
|---|
| 717 | <a class="indexterm" name="id336054"></a>
|
|---|
| 718 | <a class="indexterm" name="id336063"></a>
|
|---|
| 719 | Password encryption is not required for a Windows 9x/Me logon server. But note
|
|---|
| 720 | that beginning with MS Windows 98 the default setting is that plaintext
|
|---|
| 721 | password support is disabled. It can be re-enabled with the registry
|
|---|
| 722 | changes that are documented in <a class="link" href="PolicyMgmt.html" title="Chapter 26. System and Account Policies">System and Account Policies</a>.
|
|---|
| 723 | </p></li><li class="listitem"><p>
|
|---|
| 724 | <a class="indexterm" name="id336084"></a>
|
|---|
| 725 | Windows 9x/Me clients do not require and do not use Machine Trust Accounts.
|
|---|
| 726 | </p></li></ul></div><p>
|
|---|
| 727 | <a class="indexterm" name="id336095"></a>
|
|---|
| 728 | A Samba PDC will act as a Windows 9x/Me logon server; after all, it does provide the
|
|---|
| 729 | network logon services that MS Windows 9x/Me expect to find.
|
|---|
| 730 | </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 731 | <a class="indexterm" name="id336108"></a>
|
|---|
| 732 | Use of plaintext passwords is strongly discouraged. Where used they are easily detected
|
|---|
| 733 | using a sniffer tool to examine network traffic.
|
|---|
| 734 | </p></div></div></div><div class="sect2" title="Security Mode and Master Browsers"><div class="titlepage"><div><div><h3 class="title"><a name="id336119"></a>Security Mode and Master Browsers</h3></div></div></div><p>
|
|---|
| 735 | <a class="indexterm" name="id336127"></a>
|
|---|
| 736 | <a class="indexterm" name="id336134"></a>
|
|---|
| 737 | <a class="indexterm" name="id336140"></a>
|
|---|
| 738 | There are a few comments to make in order to tie up some loose ends. There has been much debate over the issue
|
|---|
| 739 | of whether it is okay to configure Samba as a domain controller that operates with security mode other than
|
|---|
| 740 | user-mode. The only security mode that will not work due to technical reasons is share-mode security. Domain
|
|---|
| 741 | and server mode security are really just a variation on SMB user-level security.
|
|---|
| 742 | </p><p>
|
|---|
| 743 | <a class="indexterm" name="id336157"></a>
|
|---|
| 744 | <a class="indexterm" name="id336164"></a>
|
|---|
| 745 | <a class="indexterm" name="id336171"></a>
|
|---|
| 746 | <a class="indexterm" name="id336177"></a>
|
|---|
| 747 | <a class="indexterm" name="id336184"></a>
|
|---|
| 748 | <a class="indexterm" name="id336191"></a>
|
|---|
| 749 | <a class="indexterm" name="id336198"></a>
|
|---|
| 750 | Actually, this issue is also closely tied to the debate on whether Samba must be the DMB for its workgroup
|
|---|
| 751 | when operating as a domain controller. In a pure Microsoft Windows NT domain, the PDC wins the election to be
|
|---|
| 752 | the DMB, and then registers the DOMAIN<1B> NetBIOS name. This is not the name used by Windows clients
|
|---|
| 753 | to locate the domain controller, all domain controllers register the DOMAIN<1C> name and Windows clients
|
|---|
| 754 | locate a network logon server by seraching for the DOMAIN<1C> name. A DMB is a Domain Master Browser
|
|---|
| 755 | see <a class="link" href="NetworkBrowsing.html" title="Chapter 10. Network Browsing">The Network Browsing Chapter</a>, <a class="link" href="NetworkBrowsing.html#DMB" title="Configuring Workgroup Browsing">Configuring WORKGROUP Browsing</a>; Microsoft PDCs expect to win the election to become the
|
|---|
| 756 | DMB, if it loses that election it will report a continuous and rapid sequence of warning messages to its
|
|---|
| 757 | Windows event logger complaining that it has lost the election to become a DMB. For this reason, in networks
|
|---|
| 758 | where a Samba server is the PDC it is wise to configure the Samba domain controller as the DMB.
|
|---|
| 759 | </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 760 | <a class="indexterm" name="id336238"></a>
|
|---|
| 761 | <a class="indexterm" name="id336245"></a>
|
|---|
| 762 | <a class="indexterm" name="id336251"></a>
|
|---|
| 763 | <a class="indexterm" name="id336258"></a>
|
|---|
| 764 | <a class="indexterm" name="id336265"></a>
|
|---|
| 765 | SMB/CIFS servers that register the DOMAIN<1C> name do so because they provide the network logon
|
|---|
| 766 | service. Server that register the DOMAIN<1B> name are DMBs meaning that they are responsible
|
|---|
| 767 | for browse list synchronization across all machines that have registered the DOMAIN<1D> name. The later
|
|---|
| 768 | are LMBs that have the responsibility to listen to all NetBIOS name registrations that occur locally to their
|
|---|
| 769 | own network segment. The network logon service (NETLOGON) is germane to domain control and has nothing to do
|
|---|
| 770 | with network browsing and browse list management. The 1C and 1B/1D name services are orthogonal to each
|
|---|
| 771 | other.
|
|---|
| 772 | </p></div><p>
|
|---|
| 773 | Now back to the issue of configuring a Samba domain controller to use a mode other than <a class="link" href="smb.conf.5.html#SECURITY" target="_top">security = user</a>. If a Samba host is configured to use another SMB server or domain
|
|---|
| 774 | controller in order to validate user connection requests, it is a fact that some other machine on the network
|
|---|
| 775 | (the <a class="link" href="smb.conf.5.html#PASSWORDSERVER" target="_top">password server</a>) knows more about the user than the Samba host. About 99 percent
|
|---|
| 776 | of the time, this other host is a domain controller. Now to operate in domain mode security, the
|
|---|
| 777 | <a class="link" href="smb.conf.5.html#WORKGROUP" target="_top">workgroup</a> parameter must be set to the name of the Windows NT domain (which already
|
|---|
| 778 | has a domain controller). If the domain does not already have a domain controller, you do not yet have a
|
|---|
| 779 | domain.
|
|---|
| 780 | </p><p>
|
|---|
| 781 | Configuring a Samba box as a domain controller for a domain that already by definition has a
|
|---|
| 782 | PDC is asking for trouble. Therefore, you should always configure the Samba domain controller
|
|---|
| 783 | to be the DMB for its domain and set <a class="link" href="smb.conf.5.html#SECURITY" target="_top">security = user</a>.
|
|---|
| 784 | This is the only officially supported mode of operation.
|
|---|
| 785 | </p></div></div><div class="sect1" title="Common Errors"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id336354"></a>Common Errors</h2></div></div></div><div class="sect2" title="“$” Cannot Be Included in Machine Name"><div class="titlepage"><div><div><h3 class="title"><a name="id336359"></a><span class="quote">“<span class="quote">$</span>”</span> Cannot Be Included in Machine Name</h3></div></div></div><p>
|
|---|
| 786 | <a class="indexterm" name="id336369"></a>
|
|---|
| 787 | <a class="indexterm" name="id336376"></a>
|
|---|
| 788 | <a class="indexterm" name="id336383"></a>
|
|---|
| 789 | A machine account, typically stored in <code class="filename">/etc/passwd</code>, takes the form of the machine
|
|---|
| 790 | name with a <span class="quote">“<span class="quote">$</span>”</span> appended. Some BSD systems will not create a user with a <span class="quote">“<span class="quote">$</span>”</span> in the name.
|
|---|
| 791 | Recent versions of FreeBSD have removed this limitation, but older releases are still in common use.
|
|---|
| 792 | </p><p>
|
|---|
| 793 | <a class="indexterm" name="id336408"></a>
|
|---|
| 794 | The problem is only in the program used to make the entry. Once made, it works perfectly. Create a user
|
|---|
| 795 | without the <span class="quote">“<span class="quote">$</span>”</span>. Then use <code class="literal">vipw</code> to edit the entry, adding the <span class="quote">“<span class="quote">$</span>”</span>.
|
|---|
| 796 | Or create the whole entry with vipw if you like; make sure you use a unique user login ID.
|
|---|
| 797 | </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>The machine account must have the exact name that the workstation has.</p></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 798 | The UNIX tool <code class="literal">vipw</code> is a common tool for directly editing the <code class="filename">/etc/passwd</code> file.
|
|---|
| 799 | The use of vipw will ensure that shadow files (where used) will remain current with the passwd file. This is
|
|---|
| 800 | important for security reasons.
|
|---|
| 801 | </p></div></div><div class="sect2" title="Joining Domain Fails Because of Existing Machine Account"><div class="titlepage"><div><div><h3 class="title"><a name="id336454"></a>Joining Domain Fails Because of Existing Machine Account</h3></div></div></div><p>
|
|---|
| 802 | <a class="indexterm" name="id336462"></a>
|
|---|
| 803 | <span class="quote">“<span class="quote">I get told, `You already have a connection to the Domain....' or `Cannot join domain, the
|
|---|
| 804 | credentials supplied conflict with an existing set...' when creating a Machine Trust Account.</span>”</span>
|
|---|
| 805 | </p><p>
|
|---|
| 806 | This happens if you try to create a Machine Trust Account from the machine itself and already have a
|
|---|
| 807 | connection (e.g., mapped drive) to a share (or IPC$) on the Samba PDC. The following command will remove all
|
|---|
| 808 | network drive connections:
|
|---|
| 809 | </p><pre class="screen">
|
|---|
| 810 | <code class="prompt">C:\> </code><strong class="userinput"><code>net use * /d</code></strong>
|
|---|
| 811 | </pre><p>
|
|---|
| 812 | This will break all network connections.
|
|---|
| 813 | </p><p>
|
|---|
| 814 | Further, if the machine is already a <span class="quote">“<span class="quote">member of a workgroup</span>”</span> that is the same name as the domain
|
|---|
| 815 | you are joining (bad idea), you will get this message. Change the workgroup name to something else
|
|---|
| 816 | it does not matter what reboot, and try again.
|
|---|
| 817 | </p></div><div class="sect2" title="The System Cannot Log You On (C000019B)"><div class="titlepage"><div><div><h3 class="title"><a name="id336513"></a>The System Cannot Log You On (C000019B)</h3></div></div></div><p><span class="quote">“<span class="quote">
|
|---|
| 818 | I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message,
|
|---|
| 819 | <span class="errorname">`The system cannot log you on (C000019B). Please try again or consult your system
|
|---|
| 820 | administrator</span> when attempting to logon.'</span>”</span>
|
|---|
| 821 | </p><p>
|
|---|
| 822 | <a class="indexterm" name="id336530"></a>
|
|---|
| 823 | This occurs when the domain SID stored in the secrets.tdb database is changed. The most common cause of a
|
|---|
| 824 | change in domain SID is when the domain name and/or the server name (NetBIOS name) is changed. The only way
|
|---|
| 825 | to correct the problem is to restore the original domain SID or remove the domain client from the domain and
|
|---|
| 826 | rejoin. The domain SID may be reset using either the net or rpcclient utilities.
|
|---|
| 827 | </p><p>
|
|---|
| 828 | To reset or change the domain SID you can use the net command as follows:
|
|---|
| 829 |
|
|---|
| 830 | </p><pre class="screen">
|
|---|
| 831 | <code class="prompt">root# </code><strong class="userinput"><code>net getlocalsid 'OLDNAME'</code></strong>
|
|---|
| 832 | <code class="prompt">root# </code><strong class="userinput"><code>net setlocalsid 'SID'</code></strong>
|
|---|
| 833 | </pre><p>
|
|---|
| 834 | </p><p>
|
|---|
| 835 | Workstation Machine Trust Accounts work only with the domain (or network) SID. If this SID changes,
|
|---|
| 836 | domain members (workstations) will not be able to log onto the domain. The original domain SID
|
|---|
| 837 | can be recovered from the secrets.tdb file. The alternative is to visit each workstation to rejoin
|
|---|
| 838 | it to the domain.
|
|---|
| 839 | </p></div><div class="sect2" title="The Machine Trust Account Is Not Accessible"><div class="titlepage"><div><div><h3 class="title"><a name="id336578"></a>The Machine Trust Account Is Not Accessible</h3></div></div></div><p>
|
|---|
| 840 | <span class="quote">“<span class="quote">When I try to join the domain I get the message, <span class="errorname">"The machine account
|
|---|
| 841 | for this computer either does not exist or is not accessible</span>." What's wrong?</span>”</span>
|
|---|
| 842 | </p><p>
|
|---|
| 843 | This problem is caused by the PDC not having a suitable Machine Trust Account. If you are using the
|
|---|
| 844 | <a class="link" href="smb.conf.5.html#ADDMACHINESCRIPT" target="_top">add machine script</a> method to create accounts, then this would indicate that it has not
|
|---|
| 845 | worked. Ensure the domain admin user system is working.
|
|---|
| 846 | </p><p>
|
|---|
| 847 | Alternately, if you are creating account entries manually, then they have not been created correctly. Make
|
|---|
| 848 | sure that you have the entry correct for the Machine Trust Account in <code class="filename">smbpasswd</code> file on
|
|---|
| 849 | the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure
|
|---|
| 850 | that the account name is the machine NetBIOS name with a <span class="quote">“<span class="quote">$</span>”</span> appended to it (i.e.,
|
|---|
| 851 | computer_name$). There must be an entry in both the POSIX UNIX system account backend as well as in the
|
|---|
| 852 | SambaSAMAccount backend. The default backend for Samba-3 (i.e., the parameter <em class="parameter"><code>passdb
|
|---|
| 853 | backend</code></em> is not specified in the <code class="filename">smb.conf</code> file, or if specified is set to
|
|---|
| 854 | <code class="literal">smbpasswd</code>, are respectively the <code class="filename">/etc/passwd</code> and
|
|---|
| 855 | <code class="filename">/etc/samba/smbpasswd</code> (or <code class="filename">/usr/local/samba/lib/private/smbpasswd</code> if
|
|---|
| 856 | compiled using Samba Team default settings). The use of the <code class="filename">/etc/passwd</code> can be overridden
|
|---|
| 857 | by alternative settings in the NSS <code class="filename">/etc/nsswitch.conf</code> file.
|
|---|
| 858 | </p><p>
|
|---|
| 859 | Some people have also reported that inconsistent subnet masks between the Samba server and the NT
|
|---|
| 860 | client can cause this problem. Make sure that these are consistent for both client and server.
|
|---|
| 861 | </p></div><div class="sect2" title="Account Disabled"><div class="titlepage"><div><div><h3 class="title"><a name="id336685"></a>Account Disabled</h3></div></div></div><p><span class="quote">“<span class="quote">When I attempt to log in to a Samba domain from a NT4/W200x workstation,
|
|---|
| 862 | I get a message about my account being disabled.</span>”</span></p><p>
|
|---|
| 863 | Enable the user accounts with <strong class="userinput"><code>smbpasswd -e <em class="replaceable"><code>username</code></em>
|
|---|
| 864 | </code></strong>. This is normally done as an account is created.
|
|---|
| 865 | </p></div><div class="sect2" title="Domain Controller Unavailable"><div class="titlepage"><div><div><h3 class="title"><a name="id336710"></a>Domain Controller Unavailable</h3></div></div></div><p><span class="quote">“<span class="quote">Until a few minutes after Samba has started, clients get the error `Domain Controller Unavailable'</span>”</span></p><p>
|
|---|
| 866 | A domain controller has to announce its role on the network. This usually takes a while. Be patient for up to 15 minutes,
|
|---|
| 867 | then try again.
|
|---|
| 868 | </p></div><div class="sect2" title="Cannot Log onto Domain Member Workstation After Joining Domain"><div class="titlepage"><div><div><h3 class="title"><a name="id336727"></a>Cannot Log onto Domain Member Workstation After Joining Domain</h3></div></div></div><p>
|
|---|
| 869 | <a class="indexterm" name="id336735"></a>
|
|---|
| 870 | <a class="indexterm" name="id336742"></a>
|
|---|
| 871 | After successfully joining the domain, user logons fail with one of two messages: one to the
|
|---|
| 872 | effect that the domain controller cannot be found; the other claims that the account does not
|
|---|
| 873 | exist in the domain or that the password is incorrect. This may be due to incompatible
|
|---|
| 874 | settings between the Windows client and the Samba-3 server for <span class="emphasis"><em>schannel</em></span>
|
|---|
| 875 | (secure channel) settings or <span class="emphasis"><em>smb signing</em></span> settings. Check your Samba
|
|---|
| 876 | settings for <span class="emphasis"><em>client schannel</em></span>, <span class="emphasis"><em>server schannel</em></span>,
|
|---|
| 877 | <span class="emphasis"><em>client signing</em></span>, <span class="emphasis"><em>server signing</em></span> by executing:
|
|---|
| 878 | </p><pre class="screen">
|
|---|
| 879 | <code class="literal">testparm -v | grep channel</code> and looking for the value of these parameters.
|
|---|
| 880 | </pre><p>
|
|---|
| 881 | </p><p>
|
|---|
| 882 | Also use the MMC Local Security Settings. This tool is available from the
|
|---|
| 883 | Control Panel. The Policy settings are found in the Local Policies/Security Options area and are prefixed by
|
|---|
| 884 | <span class="emphasis"><em>Secure Channel:..., and Digitally sign...</em></span>.
|
|---|
| 885 | </p><p>
|
|---|
| 886 | It is important that these be set consistently with the Samba-3 server settings.
|
|---|
| 887 | </p></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id334056" href="#id334056" class="para">1</a>] </sup>See also <a class="link" href="passdb.html" title="Chapter 11. Account Information Databases">Account Information
|
|---|
| 888 | Databases</a>.</p></div><div class="footnote"><p><sup>[<a name="ftn.id334510" href="#id334510" class="para">2</a>] </sup>See <a class="link" href="NetworkBrowsing.html" title="Chapter 10. Network Browsing">Network Browsing</a>, and
|
|---|
| 889 | <a class="link" href="integrate-ms-networks.html" title="Chapter 29. Integrating MS Windows Networks with Samba">Integrating MS Windows Networks with Samba</a>.</p></div><div class="footnote"><p><sup>[<a name="ftn.id334793" href="#id334793" class="para">3</a>] </sup>See <a class="link" href="NetworkBrowsing.html" title="Chapter 10. Network Browsing">Network
|
|---|
| 890 | Browsing</a>.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ServerType.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="type.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="samba-bdc.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 3. Server Types and Security Modes </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 5. Backup Domain Control</td></tr></table></div></body></html>
|
|---|
