source: vendor/3.6.23/docs/htmldocs/Samba3-ByExample/net2000users.html

Last change on this file was 597, checked in by Herwig Bauernfeind, 14 years ago

Samba 3.5: Update vendor to version 3.5.9
File size: 86.2 KB
Line 
1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. A Distributed 2000-User Network</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="happy.html" title="Chapter 5. Making Happy Users"><link rel="next" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. A Distributed 2000-User Network</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="happy.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="DMSMig.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 6. A Distributed 2000-User Network"><div class="titlepage"><div><div><h2 class="title"><a name="net2000users"></a>Chapter 6. A Distributed 2000-User Network</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="net2000users.html#id352846">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id352871">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id352928">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id353175">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id353997">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id354011">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id357027">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id357166">Questions and Answers</a></span></dt></dl></div><p>
2There is something indeed mystical about things that are
3big. Large networks exhibit a certain magnetism and exude a sense of
4importance that obscures reality. You and I know that it is no more
5difficult to secure a large network than it is a small one. We all
6know that over and above a particular number of network clients, the
7rules no longer change; the only real dynamic is the size of the domain
8(much like a kingdom) over which the network ruler (oops, administrator)
9has control. The real dynamic then transforms from the technical to the
10political. Then again, that point is often reached well before the
11kingdom (or queendom) grows large.
12</p><p>
13If you have systematically worked your way to this chapter, hopefully you
14have found some gems and techniques that are applicable in your
15world. The network designs you have worked with in this book have their
16strong points as well as weak ones. That is to be expected given that
17they are based on real business environments, the specifics of which are
18molded to serve the purposes of this book.
19</p><p>
20This chapter is intent on wrapping up issues that are central to
21implementation and design of progressively larger networks. Are you ready
22for this chapter? Good, it is time to move on.
23</p><p>
24In previous chapters, you made the assumption that your network
25administration staff need detailed instruction right down to the
26nuts and bolts of implementing the solution. That is still the case,
27but they have graduated now. You decide to document only those issues,
28methods, and techniques that are new or complex. Routine tasks such as
29implementing a DNS or a DHCP server are under control. Even the basics of
30Samba are largely under control. So in this section you focus on the
31specifics of implementing LDAP changes, Samba changes, and approach and
32design of the solution and its deployment.
33</p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id352846"></a>Introduction</h2></div></div></div><p>
34Abmas is a miracle company. Most businesses would have collapsed under
35the weight of rapid expansion that this company has experienced. Samba
36is flexible, so there is no need to reinstall the whole operating
37system just because you need to implement a new network design. In fact,
38you can keep an old server running right up to the moment of cutover
39and then do a near-live conversion. There is no need to reinstall a
40Samba server just to change the way your network should function.
41</p><p>
42<a class="indexterm" name="id352861"></a>
43Network growth is common to all organizations. In this exercise,
44your preoccupation is with the mechanics of implementing Samba and
45LDAP so that network users on each network segment can work
46without impediment.
47</p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id352871"></a>Assignment Tasks</h3></div></div></div><p>
48 Starting with the configuration files for the server called
49 <code class="constant">MASSIVE</code> in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>, you now deal with the
50 issues that are particular to large distributed networks. Your task
51 is simple identify the challenges, consider the
52 alternatives, and then design and implement a solution.
53 </p><p>
54 <a class="indexterm" name="id352896"></a>
55 Remember, you have users based in London (UK), Los Angeles,
56 Washington. DC, and, three buildings in New York. A significant portion
57 of your workforce have notebook computers and roam all over the
58 world. Some dial into the office, others use VPN connections over the
59 Internet, and others just move between buildings.i
60 </p><p>
61 What do you say to an employee who normally uses a desktop
62 system but must spend six weeks on the road with a notebook computer?
63 She is concerned about email access and how to keep coworkers current
64 with changing documents.
65 </p><p>
66 To top it all off, you have one network support person and one
67 help desk person based in London, a single person dedicated to all
68 network operations in Los Angeles, five staff for user administration
69 and help desk in New York, plus one <span class="emphasis"><em>floater</em></span> for
70 Washington.
71 </p><p>
72 You have outsourced all desktop deployment and management to
73 DirectPointe. Your concern is server maintenance and third-level
74 support. Build a plan and show what must be done.
75 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id352928"></a>Dissection and Discussion</h2></div></div></div><p>
76<a class="indexterm" name="id352936"></a>
77<a class="indexterm" name="id352942"></a>
78In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>, you implemented an LDAP server that provided the
79<em class="parameter"><code>passdb backend</code></em> for the Samba servers. You
80explored ways to accelerate Windows desktop profile handling and you
81took control of network performance.
82</p><p>
83<a class="indexterm" name="id352966"></a>
84<a class="indexterm" name="id352972"></a>
85<a class="indexterm" name="id352979"></a>
86<a class="indexterm" name="id352986"></a>
87The implementation of an LDAP-based passdb backend (known as
88<span class="emphasis"><em>ldapsam</em></span> in Samba parlance), or some form of database
89that can be distributed, is essential to permit the deployment of Samba
90Primary and Backup Domain Controllers (PDC/BDCs). You see, the problem
91is that the <span class="emphasis"><em>tdbsam</em></span>-style passdb backend does not
92lend itself to being replicated. The older plain-text-based
93<span class="emphasis"><em>smbpasswd</em></span>-style passdb backend can be replicated
94using a tool such as <code class="literal">rsync</code>, but
95<span class="emphasis"><em>smbpasswd</em></span> suffers the drawback that it does not
96support the range of account facilities demanded by modern network
97managers.
98</p><p>
99<a class="indexterm" name="id353021"></a>
100<a class="indexterm" name="id353028"></a>
101The new <span class="emphasis"><em>tdbsam</em></span> facility supports functionality
102that is similar to an <span class="emphasis"><em>ldapsam</em></span>, but the lack of
103distributed infrastructure sorely limits the scope for its
104deployment. This raises the following questions: Why can't I just use
105an XML-based backend, or for that matter, why not use an SQL-based
106backend? Is support for these tools broken? Answers to these
107questions require a bit of background.</p><p>
108<a class="indexterm" name="id353049"></a>
109<a class="indexterm" name="id353055"></a>
110<a class="indexterm" name="id353062"></a>
111<a class="indexterm" name="id353069"></a>
112<span class="emphasis"><em>What is a directory?</em></span> A directory is a
113collection of information regarding objects that can be accessed to
114rapidly find information that is relevant in a particular and
115consistent manner. A directory differs from a database in that it is
116generally more often searched (read) than updated. As a consequence, the
117information is organized to facilitate read access rather than to
118support transaction processing.</p><p>
119<a class="indexterm" name="id353086"></a>
120<a class="indexterm" name="id353095"></a>
121<a class="indexterm" name="id353102"></a>
122<a class="indexterm" name="id353109"></a>
123The Lightweight Directory Access Protocol (LDAP) differs
124considerably from a traditional database. It has a simple search
125facility that uniquely makes a highly preferred mechanism for managing
126user identities. LDAP provides a scalable mechanism for distributing
127the data repository and for keeping all copies (slaves) in sync with
128the master repository.</p><p>
129<a class="indexterm" name="id353122"></a>
130<a class="indexterm" name="id353129"></a>
131<a class="indexterm" name="id353135"></a>
132Samba is a flexible and powerful file and print sharing
133technology. It can use many external authentication sources and can be
134part of a total authentication and identity management
135infrastructure. The two most important external sources for large sites
136are Microsoft Active Directory and LDAP. Sites that specifically wish to
137avoid the proprietary implications of Microsoft Active Directory
138naturally gravitate toward OpenLDAP.</p><p>
139<a class="indexterm" name="id353149"></a>
140In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>, you had to deal with a locally routed
141network. All deployment concerns focused around making users happy,
142and that simply means taking control over all network practices and
143usage so that no one user is disadvantaged by any other. The real
144lesson is one of understanding that no matter how much network
145bandwidth you provide, bandwidth remains a precious resource.</p><p>In this chapter, you must now consider how the overall network must
146function. In particular, you must be concerned with users who move
147between offices. You must take into account the way users need to
148access information globally. And you must make the network robust
149enough so that it can sustain partial breakdown without causing loss of
150productivity.</p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id353175"></a>Technical Issues</h3></div></div></div><p>
151 There are at least three areas that need to be addressed as you
152 approach the challenge of designing a network solution for the newly
153 expanded business:
154 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><a class="indexterm" name="id353189"></a>
155 User needs such as mobility and data access</p></li><li class="listitem"><p>The nature of Windows networking protocols</p></li><li class="listitem"><p>Identity management infrastructure needs</p></li></ul></div><p>Let's look at each in turn.</p><div class="sect3" title="User Needs"><div class="titlepage"><div><div><h4 class="title"><a name="id353212"></a>User Needs</h4></div></div></div><p>
156 The new company has three divisions. Staff for each division are spread across
157 the company. Some staff are office-bound and some are mobile users. Mobile
158 users travel globally. Some spend considerable periods working in other offices.
159 Everyone wants to be able to work without constraint of productivity.
160 </p><p>
161 The challenge is not insignificant. In some parts of the world, even dial-up
162 connectivity is poor, while in other regions political encumbrances severely
163 curtail user needs. Parts of the global Internet infrastructure remain shielded
164 off for reasons outside the scope of this discussion.
165 </p><p>
166 <a class="indexterm" name="id353231"></a>
167 Decisions must be made regarding where data is to be stored, how it will be
168 replicated (if at all), and what the network bandwidth implications are. For
169 example, one decision that can be made is to give each office its own master
170 file storage area that can be synchronized to a central repository in New
171 York. This would permit global data to be backed up from a single location.
172 The synchronization tool could be <code class="literal">rsync,</code> run via a cron
173 job. Mobile users may use off-line file storage under Windows XP Professional.
174 This way, they can synchronize all files that have changed since each logon
175 to the network.
176 </p><p>
177 <a class="indexterm" name="id353252"></a>
178 <a class="indexterm" name="id353262"></a>
179 No matter which way you look at this, the bandwidth requirements
180 for acceptable performance are substantial even if only 10 percent of
181 staff are global data users. A company with 3,500 employees,
182 280 of whom are mobile users who use a similarly distributed
183 network, found they needed at least 2 Mb/sec connectivity
184 between the UK and US offices. Even over 2 Mb/sec bandwidth, this
185 company abandoned any attempt to run roaming profile usage for
186 mobile users. At that time, the average roaming profile took 480
187 KB, while today the minimum Windows XP Professional roaming
188 profile involves a transfer of over 750 KB from the profile
189 server to and from the client.
190 </p><p>
191 <a class="indexterm" name="id353277"></a>
192 Obviously then, user needs and wide-area practicalities dictate the economic and
193 technical aspects of your network design as well as for standard operating procedures.
194 </p></div><div class="sect3" title="The Nature of Windows Networking Protocols"><div class="titlepage"><div><div><h4 class="title"><a name="id353288"></a>The Nature of Windows Networking Protocols</h4></div></div></div><p>
195 <a class="indexterm" name="id353296"></a>
196 Network logons that include roaming profile handling requires from 140 KB to 2 MB.
197 The inclusion of support for a minimal set of common desktop applications can push
198 the size of a complete profile to over 15 MB. This has substantial implications
199 for location of user profiles. Additionally, it is a significant factor in
200 determining the nature and style of mandatory profiles that may be enforced as
201 part of a total service-level assurance program that might be implemented.
202 </p><p>
203 <a class="indexterm" name="id353312"></a>
204 <a class="indexterm" name="id353319"></a>
205 One way to reduce the network bandwidth impact of user logon
206 traffic is through folder redirection. In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>, you
207 implemented this in the new Windows XP Professional standard
208 desktop configuration. When desktop folders such as <span class="guimenu">My
209 Documents</span> are redirected to a network drive, they should
210 also be excluded from synchronization to and from the server on
211 logon or logout. Redirected folders are analogous to network drive
212 connections.
213 </p><p><a class="indexterm" name="id353343"></a>
214 Of course, network applications should only be run off
215 local application servers. As a general rule, even with 2 Mb/sec
216 network bandwidth, it would not make sense at all for someone who
217 is working out of the London office to run applications off a
218 server that is located in New York.
219 </p><p>
220 <a class="indexterm" name="id353356"></a>
221 When network bandwidth becomes a precious commodity (that is most
222 of the time), there is a significant demand to understand network
223 processes and to mold the limits of acceptability around the
224 constraints of affordability.
225 </p><p>
226 When a Windows NT4/200x/XP Professional client user logs onto
227 the network, several important things must happen.
228 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
229 <a class="indexterm" name="id353375"></a>
230 The client obtains an IP address via DHCP. (DHCP is
231 necessary so that users can roam between offices.)
232 </p></li><li class="listitem"><p>
233 <a class="indexterm" name="id353387"></a>
234 <a class="indexterm" name="id353394"></a>
235 The client must register itself with the WINS and/or DNS server.
236 </p></li><li class="listitem"><p>
237 <a class="indexterm" name="id353406"></a>
238 The client must locate the closest domain controller.
239 </p></li><li class="listitem"><p>
240 The client must log onto a domain controller and obtain as part of
241 that process the location of the user's profile, load it, connect to
242 redirected folders, and establish all network drive and printer connections.
243 </p></li><li class="listitem"><p>
244 The domain controller must be able to resolve the user's
245 credentials before the logon process is fully implemented.
246 </p></li></ul></div><p>
247 Given that this book is about Samba and that it implements the Windows
248 NT4-style domain semantics, it makes little sense to compare Samba with
249 Microsoft Active Directory insofar as the logon protocols and principles
250 of operation are concerned. The following information pertains exclusively
251 to the interaction between a Windows XP Professional workstation and a
252 Samba-3.0.20 server. In the discussion that follows, use is made of DHCP and WINS.
253 </p><p>
254 As soon as the Windows workstation starts up, it obtains an
255 IP address. This is immediately followed by registration of its
256 name both by broadcast and Unicast registration that is directed
257 at the WINS server.
258 </p><p>
259 <a class="indexterm" name="id353444"></a>
260 <a class="indexterm" name="id353450"></a><a class="indexterm" name="id353460"></a>
261 Given that the client is already a domain member, it then sends
262 a directed (Unicast) request to the WINS server seeking the list of
263 IP addresses for domain controllers (NetBIOS name type 0x1C). The
264 WINS server replies with the information requested.</p><p>
265 <a class="indexterm" name="id353472"></a>
266 <a class="indexterm" name="id353481"></a>
267 <a class="indexterm" name="id353488"></a>
268 The client sends two netlogon mailslot broadcast requests
269 to the local network and to each of the IP addresses returned by
270 the WINS server. Whichever answers this request first appears to
271 be the machine that the Windows XP client attempts to use to
272 process the network logon. The mailslot messages use UDP broadcast
273 to the local network and UDP Unicast directed at each machine that
274 was listed in the WINS server response to a request for the list of
275 domain controllers.
276 </p><p>
277 <a class="indexterm" name="id353502"></a>
278 <a class="indexterm" name="id353511"></a>
279 <a class="indexterm" name="id353518"></a>
280 The logon process begins with negotiation of the SMB/CIFS
281 protocols that are to be used; this is followed by an exchange of
282 information that ultimately includes the client sending the
283 credentials with which the user is attempting to logon. The logon
284 server must now approve the further establishment of the
285 connection, but that is a good point to halt for now. The priority
286 here must center around identification of network infrastructure
287 needs. A secondary fact we need to know is, what happens when
288 local domain controllers fail or break?
289 </p><p>
290 <a class="indexterm" name="id353533"></a>
291 <a class="indexterm" name="id353540"></a>
292 <a class="indexterm" name="id353546"></a>
293 <a class="indexterm" name="id353553"></a>
294 Under most circumstances, the nearest domain controller
295 responds to the netlogon mailslot broadcast. The exception to this
296 norm occurs when the nearest domain controller is too busy or is out
297 of service. Herein lies an important fact. This means it is
298 important that every network segment should have at least two
299 domain controllers. Since there can be only one PDC, all additional
300 domain controllers are by definition BDCs.
301 </p><p>
302 <a class="indexterm" name="id353566"></a>
303 <a class="indexterm" name="id353573"></a>
304 The provision of sufficient servers that are BDCs is an
305 important design factor. The second important design factor
306 involves how each of the BDCs obtains user authentication
307 data. That is the subject of the next section, which involves key
308 decisions regarding Identity Management facilities.
309 </p></div><div class="sect3" title="Identity Management Needs"><div class="titlepage"><div><div><h4 class="title"><a name="id353585"></a>Identity Management Needs</h4></div></div></div><p>
310 <a class="indexterm" name="id353593"></a>
311 <a class="indexterm" name="id353600"></a>
312 <a class="indexterm" name="id353606"></a>
313 <a class="indexterm" name="id353613"></a>
314 Network managers recognize that in large organizations users
315 generally need to be given resource access based on needs, while
316 being excluded from other resources for reasons of privacy. It is
317 therefore essential that all users identify themselves at the
318 point of network access. The network logon is the principal means
319 by which user credentials are validated and filtered and appropriate
320 rights and privileges are allocated.
321 </p><p>
322 <a class="indexterm" name="id353627"></a>
323 <a class="indexterm" name="id353634"></a>
324 <a class="indexterm" name="id353640"></a>
325 Unfortunately, network resources tend to have their own Identity
326 Management facilities, the quality and manageability of which varies
327 from quite poor to exceptionally good. Corporations that use a mixture
328 of systems soon discover that until recently, few systems were
329 designed to interoperate. For example, UNIX systems each have an
330 independent user database. Sun Microsystems developed a facility that
331 was originally called <code class="constant">Yellow Pages</code>, and was renamed
332 when a telephone company objected to the use of its trademark.
333 What was once called <code class="constant">Yellow Pages</code> is today known
334 as <code class="constant">Network Information System</code> (NIS).
335 </p><p>
336 <a class="indexterm" name="id353666"></a>
337 NIS gained a strong following throughout the UNIX/VMS space in a short
338 period of time and retained that appeal and use for over a decade.
339 Security concerns and inherent limitations have caused it to enter its
340 twilight. NIS did not gain widespread appeal outside of the UNIX world
341 and was not universally adopted. Sun updated this to a more secure
342 implementation called NIS+, but even it has fallen victim to changing
343 demands as the demand for directory services that can be coupled with
344 other information systems is catching on.
345 </p><p>
346 <a class="indexterm" name="id353681"></a>
347 <a class="indexterm" name="id353687"></a>
348 <a class="indexterm" name="id353694"></a>
349 Nevertheless, both NIS and NIS+ continue to hold ground in
350 business areas where UNIX still has major sway. Examples of
351 organizations that remain firmly attached to the use of NIS and
352 NIS+ include large government departments, education institutions,
353 and large corporations that have a scientific or engineering
354 focus.
355 </p><p>
356 <a class="indexterm" name="id353707"></a>
357 <a class="indexterm" name="id353714"></a>
358 Today's networking world needs a scalable, distributed Identity
359 Management infrastructure, commonly called a directory. The most
360 popular technologies today are Microsoft Active Directory service
361 and a number of LDAP implementations.
362 </p><p>
363 <a class="indexterm" name="id353726"></a>
364 The problem of managing multiple directories has become a focal
365 point over the past decade, creating a large market for
366 metadirectory products and services that allow organizations that
367 have multiple directories and multiple management and control
368 centers to provision information from one directory into
369 another. The attendant benefit to end users is the promise of
370 having to remember and deal with fewer login identities and
371 passwords.</p><p>
372 <a class="indexterm" name="id353740"></a>
373 The challenge of every large network is to find the optimum
374 balance of internal systems and facilities for Identity
375 Management resources. How well the solution is chosen and
376 implemented has potentially significant impact on network bandwidth
377 and systems response needs.</p><p>
378 <a class="indexterm" name="id353754"></a>
379 <a class="indexterm" name="id353761"></a>
380 <a class="indexterm" name="id353770"></a>
381 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>, you implemented a single LDAP server for the
382 entire network. This may work for smaller networks, but almost
383 certainly fails to meet the needs of large and complex networks. The
384 following section documents how you may implement a single
385 master LDAP server with multiple slave servers.</p><p>
386 What is the best method for implementing master/slave LDAP
387 servers within the context of a distributed 2,000-user network is a
388 question that remains to be answered.</p><p>
389 <a class="indexterm" name="id353796"></a>
390 <a class="indexterm" name="id353803"></a>
391 One possibility that has great appeal is to create a single,
392 large distributed domain. The practical implications of this
393 design (see <a class="link" href="net2000users.html#chap7net" title="Figure 6.6. Network Topology 2000 User Complex Design A">&#8220;Network Topology 2000 User Complex Design A&#8221;</a>) demands the placement of
394 sufficient BDCs in each location. Additionally, network
395 administrators must make sure that profiles are not transferred
396 over the wide-area links, except as a totally unavoidable
397 measure. Network design must balance the risk of loss of user
398 productivity against the cost of network management and
399 maintenance.
400 </p><p>
401 <a class="indexterm" name="id353826"></a>
402 The network design in <a class="link" href="net2000users.html#chap7net2" title="Figure 6.7. Network Topology 2000 User Complex Design B">&#8220;Network Topology 2000 User Complex Design B&#8221;</a> takes the approach
403 that management of networks that are too remote to be managed
404 effectively from New York ought to be given a certain degree of
405 autonomy. With this rationale, the Los Angeles and London networks,
406 though fully integrated with those on the East Coast, each have their
407 own domain name space and can be independently managed and controlled.
408 One of the key drawbacks of this design is that it flies in the face of
409 the ability for network users to roam globally without some compromise
410 in how they may access global resources.
411 </p><p>
412 <a class="indexterm" name="id353848"></a>
413 Desk-bound users need not be negatively affected by this design, since
414 the use of interdomain trusts can be used to satisfy the need for global
415 data sharing.
416 </p><p>
417 <a class="indexterm" name="id353859"></a>
418 <a class="indexterm" name="id353866"></a>
419 <a class="indexterm" name="id353875"></a>
420 When Samba-3 is configured to use an LDAP backend, it stores the domain
421 account information in a directory entry. This account entry contains the
422 domain SID. An unintended but exploitable side effect is that this makes it
423 possible to operate with more than one PDC on a distributed network.
424 </p><p>
425 <a class="indexterm" name="id353887"></a>
426 <a class="indexterm" name="id353894"></a>
427 <a class="indexterm" name="id353901"></a>
428 How might this peculiar feature be exploited? The answer is simple. It is
429 imperative that each network segment have its own WINS server. Major
430 servers on remote network segments can be given a static WINS entry in
431 the <code class="filename">wins.dat</code> file on each WINS server. This allows
432 all essential data to be visible from all locations. Each location would,
433 however, function as if it is an independent domain, while all sharing the
434 same domain SID. Since all domain account information can be stored in a
435 single LDAP backend, users have unfettered ability to roam.
436 </p><p>
437 <a class="indexterm" name="id353921"></a>
438 <a class="indexterm" name="id353930"></a>
439 This concept has not been exhaustively validated, though we can see no reason
440 why this should not work. The important facets are the following: The name of
441 the domain must be identical in all locations. Each network segment must have
442 its own WINS server. The name of the PDC must be the same in all locations; this
443 necessitates the use of NetBIOS name aliases for each PDC so that they can be
444 accessed globally using the alias and not the PDC's primary name. A single master
445 LDAP server can be based in New York, with multiple LDAP slave servers located
446 on every network segment. Finally, the BDCs should each use failover LDAP servers
447 that are in fact slave LDAP servers on the local segments.
448 </p><p>
449 <a class="indexterm" name="id353946"></a>
450 <a class="indexterm" name="id353956"></a>
451 <a class="indexterm" name="id353962"></a>
452 <a class="indexterm" name="id353972"></a>
453 With a single master LDAP server, all network updates are effected on a single
454 server. In the event that this should become excessively fragile or network
455 bandwidth limiting, one could implement a delegated LDAP domain. This is also
456 known as a partitioned (or multiple partition) LDAP database and as a distributed
457 LDAP directory.
458 </p><p>
459 As the LDAP directory grows, it becomes increasingly important
460 that its structure is implemented in a manner that mirrors
461 organizational needs, so as to limit network update and
462 referential traffic. It should be noted that all directory
463 administrators must of necessity follow the same standard
464 procedures for managing the directory, because retroactive correction of
465 inconsistent directory information can be exceedingly difficult.
466 </p></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id353997"></a>Political Issues</h3></div></div></div><p>
467 As organizations grow, the number of points of control increases
468 also. In a large distributed organization, it is important that the
469 Identity Management system be capable of being updated from
470 many locations, and it is equally important that changes made should
471 become usable in a reasonable period, typically
472 minutes rather than days (the old limitation of highly manual
473 systems).
474 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id354011"></a>Implementation</h2></div></div></div><p>
475 <a class="indexterm" name="id354019"></a>
476 <a class="indexterm" name="id354026"></a>
477 <a class="indexterm" name="id354032"></a>
478 <a class="indexterm" name="id354039"></a>
479 Samba-3 has the ability to use multiple password (authentication and
480 identity resolution) backends. The diagram in <a class="link" href="net2000users.html#chap7idres" title="Figure 6.1. Samba and Authentication Backend Search Pathways">&#8220;Samba and Authentication Backend Search Pathways&#8221;</a>
481 demonstrates how Samba uses winbind, LDAP, and NIS, the traditional system
482 password database. The diagram only documents the mechanisms for
483 authentication and identity resolution (obtaining a UNIX UID/GID)
484 using the specific systems shown.
485 </p><div class="figure"><a name="chap7idres"></a><p class="title"><b>Figure 6.1. Samba and Authentication Backend Search Pathways</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-idresol.png" width="297" alt="Samba and Authentication Backend Search Pathways"></div></div></div><br class="figure-break"><p>
486 <a class="indexterm" name="id354099"></a>
487 <a class="indexterm" name="id354106"></a>
488 <a class="indexterm" name="id354113"></a>
489 <a class="indexterm" name="id354120"></a>
490 <a class="indexterm" name="id354126"></a>
491 <a class="indexterm" name="id354133"></a>
492 <a class="indexterm" name="id354140"></a>
493 Samba is capable of using the <code class="constant">smbpasswd</code>,
494 <code class="constant">tdbsam</code>, <code class="constant">xmlsam</code>,
495 and <code class="constant">mysqlsam</code> authentication databases. The SMB
496 passwords can, of course, also be stored in an LDAP ldapsam
497 backend. LDAP is the preferred passdb backend for distributed network
498 operations.
499 </p><p>
500 <a class="indexterm" name="id354166"></a>
501 Additionally, it is possible to use multiple passdb backends
502 concurrently as well as have multiple LDAP backends. As a result, you
503 can specify a failover LDAP backend. The syntax for specifying a
504 single LDAP backend in <code class="filename">smb.conf</code> is:
505</p><pre class="screen">
506...
507passdb backend = ldapsam:ldap://master.abmas.biz
508...
509</pre><p>
510 This configuration tells Samba to use a single LDAP server, as shown in <a class="link" href="net2000users.html#ch7singleLDAP" title="Figure 6.2. Samba Configuration to Use a Single LDAP Server">&#8220;Samba Configuration to Use a Single LDAP Server&#8221;</a>.
511 </p><div class="figure"><a name="ch7singleLDAP"></a><p class="title"><b>Figure 6.2. Samba Configuration to Use a Single LDAP Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-singleLDAP.png" width="351" alt="Samba Configuration to Use a Single LDAP Server"></div></div></div><p><br class="figure-break">
512 <a class="indexterm" name="id354234"></a>
513 <a class="indexterm" name="id354244"></a>
514 The addition of a failover LDAP server can simply be done by adding a
515 second entry for the failover server to the single <em class="parameter"><code>ldapsam</code></em>
516 entry, as shown here (note the particular use of the double quotes):
517</p><pre class="screen">
518...
519passdb backend = ldapsam:"ldap://master.abmas.biz \
520 ldap://slave.abmas.biz"
521...
522</pre><p>
523 This configuration tells Samba to use a master LDAP server, with failover to a slave server if necessary,
524 as shown in <a class="link" href="net2000users.html#ch7dualLDAP" title="Figure 6.3. Samba Configuration to Use a Dual (Fail-over) LDAP Server">&#8220;Samba Configuration to Use a Dual (Fail-over) LDAP Server&#8221;</a>.
525 </p><div class="figure"><a name="ch7dualLDAP"></a><p class="title"><b>Figure 6.3. Samba Configuration to Use a Dual (Fail-over) LDAP Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-fail-overLDAP.png" width="351" alt="Samba Configuration to Use a Dual (Fail-over) LDAP Server"></div></div></div><p><br class="figure-break">
526 </p><p>
527 Some folks have tried to implement this without the use of double quotes. This is the type of entry they
528 created:
529</p><pre class="screen">
530...
531passdb backend = ldapsam:ldap://master.abmas.biz \
532 ldapsam:ldap://slave.abmas.biz
533...
534</pre><p>
535 <a class="indexterm" name="id354323"></a>
536 The effect of this style of entry is that Samba lists the users
537 that are in both LDAP databases. If both contain the same information,
538 it results in each record being shown twice. This is, of course, not the
539 solution desired for a failover implementation. The net effect of this
540 configuration is shown in <a class="link" href="net2000users.html#ch7dualadd" title="Figure 6.4. Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!">&#8220;Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!&#8221;</a>
541 </p><div class="figure"><a name="ch7dualadd"></a><p class="title"><b>Figure 6.4. Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-dual-additive-LDAP.png" width="297" alt="Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!"></div></div></div><br class="figure-break"><p>
542 If, however, each LDAP database contains unique information, this may
543 well be an advantageous way to effectively integrate multiple LDAP databases
544 into one seemingly contiguous directory. Only the first database will be updated.
545 An example of this configuration is shown in <a class="link" href="net2000users.html#ch7dualok" title="Figure 6.5. Samba Configuration to Use Two LDAP Databases - The result is additive.">&#8220;Samba Configuration to Use Two LDAP Databases - The result is additive.&#8221;</a>.
546 </p><div class="figure"><a name="ch7dualok"></a><p class="title"><b>Figure 6.5. Samba Configuration to Use Two LDAP Databases - The result is additive.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-dual-additive-LDAP-Ok.png" width="297" alt="Samba Configuration to Use Two LDAP Databases - The result is additive."></div></div></div><br class="figure-break"><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
547 When the use of ldapsam is specified twice, as shown here, it is imperative
548 that the two LDAP directories must be disjoint. If the entries are for a
549 master LDAP server as well as its own slave server, updates to the LDAP
550 database may end up being lost or corrupted. You may safely use multiple
551 LDAP backends only if both are entirely separate from each other.
552 </p></div><p>
553 It is assumed that the network you are working with follows in a
554 pattern similar to what was covered in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>. The following steps
555 permit the operation of a master/slave OpenLDAP arrangement.
556 </p><div class="procedure" title="Procedure 6.1. Implementation Steps for an LDAP Slave Server"><a name="id354454"></a><p class="title"><b>Procedure 6.1. Implementation Steps for an LDAP Slave Server</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
557 <a class="indexterm" name="id354465"></a>
558 <a class="indexterm" name="id354472"></a>
559 Log onto the master LDAP server as <code class="constant">root</code>.
560 You are about to change the configuration of the LDAP server, so it
561 makes sense to temporarily halt it. Stop OpenLDAP from running on
562 SUSE Linux by executing:
563</p><pre class="screen">
564<code class="prompt">root# </code> rcldap stop
565</pre><p>
566 On Red Hat Linux, you can do this by executing:
567</p><pre class="screen">
568<code class="prompt">root# </code> service ldap stop
569</pre><p>
570 </p></li><li class="step" title="Step 2"><p>
571 <a class="indexterm" name="id354514"></a>
572 Edit the <code class="filename">/etc/openldap/slapd.conf</code> file so it
573 matches the content of <a class="link" href="net2000users.html#ch7-LDAP-master" title="Example 6.1. LDAP Master Server Configuration File /etc/openldap/slapd.conf">&#8220;LDAP Master Server Configuration File /etc/openldap/slapd.conf&#8221;</a>.
574 </p></li><li class="step" title="Step 3"><p>
575 Create a file called <code class="filename">admin-accts.ldif</code> with the following contents:
576</p><pre class="screen">
577dn: cn=updateuser,dc=abmas,dc=biz
578objectClass: person
579cn: updateuser
580sn: updateuser
581userPassword: not24get
582
583dn: cn=sambaadmin,dc=abmas,dc=biz
584objectClass: person
585cn: sambaadmin
586sn: sambaadmin
587userPassword: buttercup
588</pre><p>
589 </p></li><li class="step" title="Step 4"><p>
590 Add an account called <span class="quote">&#8220;<span class="quote">updateuser</span>&#8221;</span> to the master LDAP server as shown here:
591</p><pre class="screen">
592<code class="prompt">root# </code> slapadd -v -l admin-accts.ldif
593</pre><p>
594 </p></li><li class="step" title="Step 5"><p>
595 <a class="indexterm" name="id354583"></a>
596 <a class="indexterm" name="id354590"></a>
597 Change directory to a suitable place to dump the contents of the
598 LDAP server. The dump file (and LDIF file) is used to preload
599 the slave LDAP server database. You can dump the database by executing:
600</p><pre class="screen">
601<code class="prompt">root# </code> slapcat -v -l LDAP-transfer-LDIF.txt
602</pre><p>
603 Each record is written to the file.
604 </p></li><li class="step" title="Step 6"><p>
605 <a class="indexterm" name="id354620"></a>
606 Copy the file <code class="filename">LDAP-transfer-LDIF.txt</code> to the intended
607 slave LDAP server. A good location could be in the directory
608 <code class="filename">/etc/openldap/preload</code>.
609 </p></li><li class="step" title="Step 7"><p>
610 Log onto the slave LDAP server as <code class="constant">root</code>. You can
611 now configure this server so the <code class="filename">/etc/openldap/slapd.conf</code>
612 file matches the content of <a class="link" href="net2000users.html#ch7-LDAP-slave" title="Example 6.2. LDAP Slave Configuration File /etc/openldap/slapd.conf">&#8220;LDAP Slave Configuration File /etc/openldap/slapd.conf&#8221;</a>.
613 </p></li><li class="step" title="Step 8"><p>
614 Change directory to the location in which you stored the
615 <code class="filename">LDAP-transfer-LDIF.txt</code> file (<code class="filename">/etc/openldap/preload</code>).
616 While in this directory, execute:
617</p><pre class="screen">
618<code class="prompt">root# </code> slapadd -v -l LDAP-transfer-LDIF.txt
619</pre><p>
620 If all goes well, the following output confirms that the data is being loaded
621 as intended:
622</p><pre class="screen">
623added: "dc=abmas,dc=biz" (00000001)
624added: "cn=sambaadmin,dc=abmas,dc=biz" (00000002)
625added: "cn=updateuser,dc=abmas,dc=biz" (00000003)
626added: "ou=People,dc=abmas,dc=biz" (00000004)
627added: "ou=Groups,dc=abmas,dc=biz" (00000005)
628added: "ou=Computers,dc=abmas,dc=biz" (00000006)
629added: "uid=Administrator,ou=People,dc=abmas,dc=biz" (00000007)
630added: "uid=nobody,ou=People,dc=abmas,dc=biz" (00000008)
631added: "cn=Domain Admins,ou=Groups,dc=abmas,dc=biz" (00000009)
632added: "cn=Domain Users,ou=Groups,dc=abmas,dc=biz" (0000000a)
633added: "cn=Domain Guests,ou=Groups,dc=abmas,dc=biz" (0000000b)
634added: "uid=bobj,ou=People,dc=abmas,dc=biz" (0000000c)
635added: "sambaDomainName=MEGANET2,dc=abmas,dc=biz" (0000000d)
636added: "uid=stans,ou=People,dc=abmas,dc=biz" (0000000e)
637added: "uid=chrisr,ou=People,dc=abmas,dc=biz" (0000000f)
638added: "uid=maryv,ou=People,dc=abmas,dc=biz" (00000010)
639added: "cn=Accounts,ou=Groups,dc=abmas,dc=biz" (00000011)
640added: "cn=Finances,ou=Groups,dc=abmas,dc=biz" (00000012)
641added: "cn=PIOps,ou=Groups,dc=abmas,dc=biz" (00000013)
642</pre><p>
643 </p></li><li class="step" title="Step 9"><p>
644 Now start the LDAP server and set it to run automatically on system reboot by executing:
645</p><pre class="screen">
646<code class="prompt">root# </code> rcldap start
647<code class="prompt">root# </code> chkconfig ldap on
648</pre><p>
649 On Red Hat Linux, execute the following:
650</p><pre class="screen">
651<code class="prompt">root# </code> service ldap start
652<code class="prompt">root# </code> chkconfig ldap on
653</pre><p>
654 </p></li><li class="step" title="Step 10"><p>
655 <a class="indexterm" name="id354767"></a>
656 <a class="indexterm" name="id354774"></a>
657 <a class="indexterm" name="id354781"></a>
658 Go back to the master LDAP server. Execute the following to start LDAP as well
659 as <code class="literal">slurpd</code>, the synchronization daemon, as shown here:
660</p><pre class="screen">
661<code class="prompt">root# </code> rcldap start
662<code class="prompt">root# </code> chkconfig ldap on
663<code class="prompt">root# </code> rcslurpd start
664<code class="prompt">root# </code> chkconfig slurpd on
665</pre><p>
666 <a class="indexterm" name="id354824"></a>
667 On Red Hat Linux, check the equivalent command to start <code class="literal">slurpd</code>.
668 </p></li><li class="step" title="Step 11"><p>
669 <a class="indexterm" name="id354844"></a>
670 On the master LDAP server you may now add an account to validate that replication
671 is working. Assuming the configuration shown in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>, execute:
672</p><pre class="screen">
673<code class="prompt">root# </code> /var/lib/samba/sbin/smbldap-useradd -a fruitloop
674</pre><p>
675 </p></li><li class="step" title="Step 12"><p>
676 On the slave LDAP server, change to the directory <code class="filename">/var/lib/ldap</code>.
677 There should now be a file called <code class="filename">replogfile</code>. If replication worked
678 as expected, the content of this file should be:
679</p><pre class="screen">
680time: 1072486403
681dn: uid=fruitloop,ou=People,dc=abmas,dc=biz
682changetype: modify
683replace: sambaProfilePath
684sambaProfilePath: \\MASSIVE\profiles\fruitloop
685-
686replace: sambaHomePath
687sambaHomePath: \\MASSIVE\homes
688-
689replace: entryCSN
690entryCSN: 2003122700:43:38Z#0x0005#0#0000
691-
692replace: modifiersName
693modifiersName: cn=Manager,dc=abmas,dc=biz
694-
695replace: modifyTimestamp
696modifyTimestamp: 20031227004338Z
697-
698</pre><p>
699 </p></li><li class="step" title="Step 13"><p>
700 Given that this first slave LDAP server is now working correctly, you may now
701 implement additional slave LDAP servers as required.
702 </p></li><li class="step" title="Step 14"><p>
703 On each machine (PDC and BDCs) after the respective <code class="filename">smb.conf</code> files have been created as shown in
704 <a class="link" href="net2000users.html#ch7-massmbconfA" title="Example 6.3. Primary Domain Controller smb.conf File Part A">Primary Domain Controller <code class="filename">smb.conf</code> File Part A + B + C</a> and
705 on BDCs the <a class="link" href="net2000users.html#ch7-slvsmbocnfA" title="Example 6.6. Backup Domain Controller smb.conf File Part A">Backup Domain Controller <code class="filename">smb.conf</code> File Part A
706 + B + C</a> execute the following:
707</p><pre class="screen">
708<code class="prompt">root# </code> smbpasswd -w buttercup
709</pre><p>
710 This will install in the <code class="filename">secrets.tdb</code> file the password that Samba will need to
711 manage (write to) the LDAP Master server to perform account updates.
712 </p></li></ol></div><div class="example"><a name="ch7-LDAP-master"></a><p class="title"><b>Example 6.1. LDAP Master Server Configuration File <code class="filename">/etc/openldap/slapd.conf</code></b></p><div class="example-contents"><pre class="screen">
713include /etc/openldap/schema/core.schema
714include /etc/openldap/schema/cosine.schema
715include /etc/openldap/schema/inetorgperson.schema
716include /etc/openldap/schema/nis.schema
717include /etc/openldap/schema/samba.schema
718
719pidfile /var/run/slapd/slapd.pid
720argsfile /var/run/slapd/slapd.args
721
722database bdb
723suffix "dc=abmas,dc=biz"
724rootdn "cn=Manager,dc=abmas,dc=biz"
725
726# rootpw = not24get
727rootpw {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
728
729replica host=lapdc.abmas.biz:389
730 suffix="dc=abmas,dc=biz"
731 binddn="cn=updateuser,dc=abmas,dc=biz"
732 bindmethod=simple credentials=not24get
733
734access to attrs=sambaLMPassword,sambaNTPassword
735 by dn="cn=sambaadmin,dc=abmas,dc=biz" write
736 by * none
737
738replogfile /var/lib/ldap/replogfile
739
740directory /var/lib/ldap
741
742# Indices to maintain
743index objectClass eq
744index cn pres,sub,eq
745index sn pres,sub,eq
746index uid pres,sub,eq
747index displayName pres,sub,eq
748index uidNumber eq
749index gidNumber eq
750index memberUID eq
751index sambaSID eq
752index sambaPrimaryGroupSID eq
753index sambaDomainName eq
754index default sub
755</pre></div></div><br class="example-break"><div class="example"><a name="ch7-LDAP-slave"></a><p class="title"><b>Example 6.2. LDAP Slave Configuration File <code class="filename">/etc/openldap/slapd.conf</code></b></p><div class="example-contents"><pre class="screen">
756include /etc/openldap/schema/core.schema
757include /etc/openldap/schema/cosine.schema
758include /etc/openldap/schema/inetorgperson.schema
759include /etc/openldap/schema/nis.schema
760include /etc/openldap/schema/samba.schema
761
762pidfile /var/run/slapd/slapd.pid
763argsfile /var/run/slapd/slapd.args
764
765database bdb
766suffix "dc=abmas,dc=biz"
767rootdn "cn=Manager,dc=abmas,dc=biz"
768
769# rootpw = not24get
770rootpw {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
771
772access to *
773 by dn=cn=updateuser,dc=abmas,dc=biz write
774 by * read
775
776updatedn cn=updateuser,dc=abmas,dc=biz
777updateref ldap://massive.abmas.biz
778
779directory /var/lib/ldap
780
781# Indices to maintain
782index objectClass eq
783index cn pres,sub,eq
784index sn pres,sub,eq
785index uid pres,sub,eq
786index displayName pres,sub,eq
787index uidNumber eq
788index gidNumber eq
789index memberUID eq
790index sambaSID eq
791index sambaPrimaryGroupSID eq
792index sambaDomainName eq
793index default sub
794</pre></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfA"></a><p class="title"><b>Example 6.3. Primary Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id355074"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id355085"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id355097"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id355108"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id355120"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id355131"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id355143"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id355154"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id355166"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id355177"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id355189"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355200"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id355212"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355224"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355236"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id355248"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id355259"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355272"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355284"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355296"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355308"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id355319"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id355331"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id355343"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id355354"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id355366"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355377"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355389"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355400"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id355412"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id355423"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id355435"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id355447"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id355458"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id355470"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id355482"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355493"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355505"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id355516"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfB"></a><p class="title"><b>Example 6.4. Primary Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[IPC$]</code></em></td></tr><tr><td><a class="indexterm" name="id355561"></a><em class="parameter"><code>path = /tmp</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id355581"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id355593"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id355604"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id355625"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id355636"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id355648"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id355668"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id355680"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id355691"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id355712"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id355723"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id355735"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id355746"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id355767"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id355778"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id355790"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355801"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355813"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfC"></a><p class="title"><b>Example 6.5. Primary Domain Controller <code class="filename">smb.conf</code> File Part C</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id355857"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id355869"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id355880"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id355892"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id355912"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id355924"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id355936"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id355947"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355959"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id355979"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id355990"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id356002"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356014"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id356034"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id356046"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id356057"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356069"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id356089"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id356101"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id356112"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id356124"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfA"></a><p class="title"><b>Example 6.6. Backup Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># # Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id356172"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id356183"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id356195"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id356206"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id356218"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id356229"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id356241"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id356252"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id356264"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id356275"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id356287"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id356298"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id356310"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id356322"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id356333"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id356345"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id356356"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356368"></a><em class="parameter"><code>os level = 63</code></em></td></tr><tr><td><a class="indexterm" name="id356379"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id356391"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id356402"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id356414"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id356425"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id356437"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id356449"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id356460"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id356472"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356483"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id356495"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id356507"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id356518"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id356538"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id356550"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id356562"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id356582"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id356594"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id356605"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfB"></a><p class="title"><b>Example 6.7. Backup Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id356650"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id356661"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id356673"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id356693"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id356705"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id356716"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356728"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id356748"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id356760"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id356771"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356783"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356794"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id356815"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id356826"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id356838"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id356849"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id356870"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id356881"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id356893"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356904"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id356925"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id356936"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id356948"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356959"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id356980"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id356991"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id357003"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id357014"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id357027"></a>Key Points Learned</h3></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
795 <a class="indexterm" name="id357038"></a><a class="indexterm" name="id357043"></a>
796 Where Samba-3 is used as a domain controller, the use of LDAP is an
797 essential component to permit the use of BDCs.
798 </p></li><li class="listitem"><p>
799 <a class="indexterm" name="id357055"></a>
800 Replication of the LDAP master server to create a network of BDCs
801 is an important mechanism for limiting WAN traffic.
802 </p></li><li class="listitem"><p>
803 Network administration presents many complex challenges, most of which
804 can be satisfied by good design but that also require sound communication
805 and unification of management practices. This can be highly challenging in
806 a large, globally distributed network.
807 </p></li><li class="listitem"><p>
808 Roaming profiles must be contained to the local network segment. Any
809 departure from this may clog wide-area arteries and slow legitimate network
810 traffic to a crawl.
811 </p></li></ul></div></div><div class="figure"><a name="chap7net"></a><p class="title"><b>Figure 6.6. Network Topology 2000 User Complex Design A</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net-Ar.png" width="432" alt="Network Topology 2000 User Complex Design A"></div></div></div><br class="figure-break"><div class="figure"><a name="chap7net2"></a><p class="title"><b>Figure 6.7. Network Topology 2000 User Complex Design B</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net2-Br.png" width="432" alt="Network Topology 2000 User Complex Design B"></div></div></div><br class="figure-break"></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id357166"></a>Questions and Answers</h2></div></div></div><p>
812 There is much rumor and misinformation regarding the use of MS Windows networking protocols.
813 These questions are just a few of those frequently asked.
814 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id357176"></a><dl><dt> <a href="net2000users.html#id357182">
815
816
817 Is it true that DHCP uses lots of WAN bandwidth?
818 </a></dt><dt> <a href="net2000users.html#id357303">
819
820
821 How much background communication takes place between a master LDAP server and its slave LDAP servers?
822 </a></dt><dt> <a href="net2000users.html#id357360">
823 LDAP has a database. Is LDAP not just a fancy database front end?
824 </a></dt><dt> <a href="net2000users.html#id357417">
825
826 Can Active Directory obtain account information from an OpenLDAP server?
827 </a></dt><dt> <a href="net2000users.html#id357449">
828 What are the parts of a roaming profile? How large is each part?
829 </a></dt><dt> <a href="net2000users.html#id357590">
830 Can the My Documents folder be stored on a network drive?
831 </a></dt><dt> <a href="net2000users.html#id357635">
832
833
834
835 How much WAN bandwidth does WINS consume?
836 </a></dt><dt> <a href="net2000users.html#id357712">
837 How many BDCs should I have? What is the right number of Windows clients per server?
838 </a></dt><dt> <a href="net2000users.html#id357739">
839
840 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to
841 run an NIS server?
842 </a></dt><dt> <a href="net2000users.html#id357770">
843 Can I use NIS in place of LDAP?
844 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id357182"></a><a name="id357185"></a></td><td align="left" valign="top"><p>
845 <a class="indexterm" name="id357189"></a>
846 <a class="indexterm" name="id357196"></a>
847 Is it true that DHCP uses lots of WAN bandwidth?
848 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
849 <a class="indexterm" name="id357212"></a>
850 <a class="indexterm" name="id357221"></a>
851 <a class="indexterm" name="id357228"></a>
852 It is a smart practice to localize DHCP servers on each network segment. As a
853 rule, there should be two DHCP servers per network segment. This means that if
854 one server fails, there is always another to service user needs. DHCP requests use
855 only UDP broadcast protocols. It is possible to run a DHCP Relay Agent on network
856 routers. This makes it possible to run fewer DHCP servers.
857 </p><p>
858 <a class="indexterm" name="id357244"></a>
859 <a class="indexterm" name="id357253"></a>
860 A DHCP network address request and confirmation usually results in about six UDP packets.
861 The packets are from 60 to 568 bytes in length. Let us consider a site that has 300 DHCP
862 clients and that uses a 24-hour IP address lease. This means that all clients renew
863 their IP address lease every 24 hours. If we assume an average packet length equal to the
864 maximum (just to be on the safe side), and we have a 128 Kb/sec wide-area connection,
865 how significant would the DHCP traffic be if all of it were to use DHCP Relay?
866 </p><p>
867 I must stress that this is a bad design, but here is the calculation:
868</p><pre class="screen">
869Daily Network Capacity: 128,000 (Kbits/s) / 8 (bits/byte)
870 x 3600 (sec/hr) x 24 (hrs/day)= 2288 Mbytes/day.
871
872DHCP traffic: 300 (clients) x 6 (packets)
873 x 512 (bytes/packet) = 0.9 Mbytes/day.
874</pre><p>
875 From this can be seen that the traffic impact would be minimal.
876 </p><p>
877 <a class="indexterm" name="id357282"></a>
878 <a class="indexterm" name="id357291"></a>
879 Even when DHCP is configured to do DNS update (dynamic DNS) over a wide-area link,
880 the impact of the update is no more than the DHCP IP address renewal traffic and thus
881 still insignificant for most practical purposes.
882 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357303"></a><a name="id357305"></a></td><td align="left" valign="top"><p>
883 <a class="indexterm" name="id357310"></a>
884 <a class="indexterm" name="id357317"></a>
885 How much background communication takes place between a master LDAP server and its slave LDAP servers?
886 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
887 <a class="indexterm" name="id357336"></a>
888 The process that controls the replication of data from the master LDAP server to the slave LDAP
889 servers is called <code class="literal">slurpd</code>. The <code class="literal">slurpd</code> remains nascent (quiet)
890 until an update must be propagated. The propagation traffic per LDAP slave to update (add/modify/delete)
891 two user accounts requires less than 10KB traffic.
892 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357360"></a><a name="id357362"></a></td><td align="left" valign="top"><p>
893 LDAP has a database. Is LDAP not just a fancy database front end?
894 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
895 <a class="indexterm" name="id357374"></a>
896 <a class="indexterm" name="id357381"></a>
897 <a class="indexterm" name="id357390"></a>
898 <a class="indexterm" name="id357396"></a>
899 LDAP does store its data in a database of sorts. In fact, the LDAP backend is an application-specific
900 data storage system. This type of database is indexed so that records can be rapidly located, but the
901 database is not generic and can be used only in particular pre-programmed ways. General external
902 applications do not gain access to the data. This type of database is used also by SQL servers. Both
903 an SQL server and an LDAP server provide ways to access the data. An SQL server has a transactional
904 orientation and typically allows external programs to perform ad hoc queries, even across data tables.
905 An LDAP front end is a purpose-built tool that has a search orientation that is designed around specific
906 simple queries. The term <code class="constant">database</code> is heavily overloaded and thus much misunderstood.
907 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357417"></a><a name="id357419"></a></td><td align="left" valign="top"><p>
908 <a class="indexterm" name="id357423"></a>
909 Can Active Directory obtain account information from an OpenLDAP server?
910 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
911 <a class="indexterm" name="id357437"></a>
912 No, at least not directly. It is possible to provision Active Directory from and/or to an OpenLDAP
913 database through use of a metadirectory server. Microsoft MMS (now called MIIS) can interface
914 to OpenLDAP using standard LDAP queries and updates.
915 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357449"></a><a name="id357452"></a></td><td align="left" valign="top"><p>
916 What are the parts of a roaming profile? How large is each part?
917 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id357462"></a>
918 A roaming profile consists of
919 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
920 Desktop folders such as <code class="constant">Desktop</code>, <code class="constant">My Documents</code>,
921 <code class="constant">My Pictures</code>, <code class="constant">My Music</code>, <code class="constant">Internet Files</code>,
922 <code class="constant">Cookies</code>, <code class="constant">Application Data</code>,
923 <code class="constant">Local Settings,</code> and more. See <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>, <a class="link" href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">&#8220;Windows XP Professional User Shared Folders&#8221;</a>.
924 </p><p>
925 <a class="indexterm" name="id357521"></a>
926 Each of these can be anywhere from a few bytes to gigabytes in capacity. Fortunately, all
927 such folders can be redirected to network drive resources. See <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">&#8220;Configuration of Default Profile with Folder Redirection&#8221;</a>
928 for more information regarding folder redirection.
929 </p></li><li class="listitem"><p>
930 A static or rewritable portion that is typically only a few files (2-5 KB of information).
931 </p></li><li class="listitem"><p>
932 <a class="indexterm" name="id357545"></a>
933 <a class="indexterm" name="id357551"></a>
934 The registry load file that modifies the <code class="constant">HKEY_LOCAL_USER</code> hive. This is
935 the <code class="filename">NTUSER.DAT</code> file. It can be from 0.4 to 1.5 MB.
936 </p></li></ul></div><p>
937 <a class="indexterm" name="id357573"></a>
938 Microsoft Outlook PST files may be stored in the <code class="constant">Local Settings\Application Data</code>
939 folder. It can be up to 2 GB in size per PST file.
940 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357590"></a><a name="id357592"></a></td><td align="left" valign="top"><p>
941 Can the <code class="constant">My Documents</code> folder be stored on a network drive?
942 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
943 <a class="indexterm" name="id357607"></a>
944 <a class="indexterm" name="id357614"></a>
945 Yes. More correctly, such folders can be redirected to network shares. No specific network drive
946 connection is required. Registry settings permit this to be redirected directly to a UNC (Universal
947 Naming Convention) resource, though it is possible to specify a network drive letter instead of a
948 UNC name. See <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">&#8220;Configuration of Default Profile with Folder Redirection&#8221;</a>.
949 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357635"></a><a name="id357637"></a></td><td align="left" valign="top"><p>
950 <a class="indexterm" name="id357641"></a>
951 <a class="indexterm" name="id357648"></a>
952 <a class="indexterm" name="id357657"></a>
953 How much WAN bandwidth does WINS consume?
954 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
955 <a class="indexterm" name="id357671"></a>
956 <a class="indexterm" name="id357680"></a>
957 <a class="indexterm" name="id357687"></a>
958 MS Windows clients cache information obtained from WINS lookups in a local NetBIOS name cache.
959 This keeps WINS lookups to a minimum. On a network with 3500 MS Windows clients and a central WINS
960 server, the total bandwidth demand measured at the WINS server, averaged over an 8-hour working day,
961 was less than 30 KB/sec. Analysis of network traffic over a 6-week period showed that the total
962 of all background traffic consumed about 11 percent of available bandwidth over 64 Kb/sec links.
963 Background traffic consisted of domain replication, WINS queries, DNS lookups, and authentication
964 traffic. Each of 11 branch offices had a 64 Kb/sec wide-area link, with a 1.5 Mb/sec main connection
965 that aggregated the branch office connections plus an Internet connection.
966 </p><p>
967 In conclusion, the total load afforded through WINS traffic is again marginal to total operational
968 usage as it should be.
969 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357712"></a><a name="id357714"></a></td><td align="left" valign="top"><p>
970 How many BDCs should I have? What is the right number of Windows clients per server?
971 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
972 It is recommended to have at least one BDC per network segment, including the segment served
973 by the PDC. Actual requirements vary depending on the working load on each of the BDCs and the
974 load demand pattern of client usage. I have seen sites that function without problem with 200
975 clients served by one BDC, and yet other sites that had one BDC per 20 clients. In one particular
976 company, there was a drafting office that had 30 CAD/CAM operators served by one server, a print
977 server; and an application server. While all three were BDCs, typically only the print server would
978 service network logon requests after the first 10 users had started to use the network. This was
979 a reflection of the service load placed on both the application server and the data server.
980 </p><p>
981 As unsatisfactory as the answer might sound, it all depends on network and server load
982 characteristics.
983 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357739"></a><a name="id357741"></a></td><td align="left" valign="top"><p>
984 <a class="indexterm" name="id357745"></a><a class="indexterm" name="id357751"></a>
985 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to
986 run an NIS server?
987 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
988 The correct answer to both questions is yes. But do understand that an LDAP server has
989 a configurable schema that can store far more information for many more purposes than
990 just NIS.
991 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357770"></a><a name="id357772"></a></td><td align="left" valign="top"><p>
992 Can I use NIS in place of LDAP?
993 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
994 <a class="indexterm" name="id357783"></a>
995 <a class="indexterm" name="id357790"></a>
996 No. The NIS database does not have provision to store Microsoft encrypted passwords and does not deal
997 with the types of data necessary for interoperability with Microsoft Windows networking. The use
998 of LDAP with Samba requires the use of a number of schemas, one of which is the NIS schema, but also
999 a Samba-specific schema extension.
1000 </p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="happy.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="DMSMig.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 5. Making Happy Users </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Part II. Domain Members, Updating Samba and Migration</td></tr></table></div></body></html>
Note: See TracBrowser for help on using the repository browser.