- Timestamp:
- Jan 15, 2010, 8:21:06 AM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.3.x/docs/htmldocs/Samba3-HOWTO/samba-bdc.html
r274 r368 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Backup Domain Control</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="prev" href="samba-pdc.html" title="Chapter 4. Domain Control"><link rel="next" href="domain-member.html" title="Chapter 6. Domain Membership"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Backup Domain Control</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="samba-pdc.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="domain-member.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="samba-bdc"></a>Chapter 5. Backup Domain Control</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="orgname">Samba Team</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="orgname">SuSE</span> <span class="surname">Deschner</span></h3><span class="contrib">LDAP updates</span> <div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:gd@suse.de">gd@suse.de</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="samba-bdc.html#id2565803">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="samba-bdc.html#id2566209">Essential Background Information</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2566279">MS Windows NT4-style Domain Control</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2566966">LDAP Configuration Notes</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2567331">Active Directory Domain Control</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2567390">What Qualifies a Domain Controller on the Network?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2567481">How Does a Workstation find its Domain Controller?</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-bdc.html#id2567662">Backup Domain Controller Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2568163">Example Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-bdc.html#id2568620">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2568664">Machine Accounts Keep Expiring</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2568719">Can Samba Be a Backup Domain Controller to an NT4 PDC?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2568774">How Do I Replicate the smbpasswd File?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2568879">Can I Do This All with LDAP?</a></span></dt></dl></dd></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Backup Domain Control</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="prev" href="samba-pdc.html" title="Chapter 4. Domain Control"><link rel="next" href="domain-member.html" title="Chapter 6. Domain Membership"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Backup Domain Control</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="samba-pdc.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="domain-member.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 5. Backup Domain Control"><div class="titlepage"><div><div><h2 class="title"><a name="samba-bdc"></a>Chapter 5. Backup Domain Control</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="surname">Deschner</span></h3><span class="contrib">LDAP updates</span> <div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:gd@samba.org">gd@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="samba-bdc.html#id2571862">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="samba-bdc.html#id2572268">Essential Background Information</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2572337">MS Windows NT4-style Domain Control</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2573025">LDAP Configuration Notes</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2573390">Active Directory Domain Control</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2573448">What Qualifies a Domain Controller on the Network?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2573539">How Does a Workstation find its Domain Controller?</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-bdc.html#id2573721">Backup Domain Controller Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2574222">Example Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-bdc.html#id2574686">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2574730">Machine Accounts Keep Expiring</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2574784">Can Samba Be a Backup Domain Controller to an NT4 PDC?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2574840">How Do I Replicate the smbpasswd File?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2574945">Can I Do This All with LDAP?</a></span></dt></dl></dd></dl></div><p> 2 2 Before you continue reading this section, please make sure that you are comfortable 3 3 with configuring a Samba domain controller as described in <a class="link" href="samba-pdc.html" title="Chapter 4. Domain Control">Domain Control</a>. 4 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2565803"></a>Features and Benefits</h2></div></div></div><p>4 </p><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2571862"></a>Features and Benefits</h2></div></div></div><p> 5 5 This is one of the most difficult chapters to summarize. It does not matter what we say here, for someone will 6 6 still draw conclusions and/or approach the Samba Team with expectations that are either not yet capable of … … 9 9 we will do our best to provide a solution. 10 10 </p><p> 11 <a class="indexterm" name="id25 65829"></a>12 <a class="indexterm" name="id25 65838"></a>13 <a class="indexterm" name="id25 65845"></a>14 <a class="indexterm" name="id25 65851"></a>15 <a class="indexterm" name="id25 65861"></a>11 <a class="indexterm" name="id2571888"></a> 12 <a class="indexterm" name="id2571897"></a> 13 <a class="indexterm" name="id2571904"></a> 14 <a class="indexterm" name="id2571910"></a> 15 <a class="indexterm" name="id2571919"></a> 16 16 Samba-3 can act as a Backup Domain Controller (BDC) to another Samba Primary Domain Controller (PDC). A 17 17 Samba-3 PDC can operate with an LDAP account backend. The LDAP backend can be either a common master LDAP … … 22 22 you will have stability and operational problems. 23 23 </p><p> 24 <a class="indexterm" name="id25 65885"></a>25 <a class="indexterm" name="id25 65894"></a>26 <a class="indexterm" name="id25 65903"></a>27 <a class="indexterm" name="id25 65912"></a>24 <a class="indexterm" name="id2571944"></a> 25 <a class="indexterm" name="id2571953"></a> 26 <a class="indexterm" name="id2571962"></a> 27 <a class="indexterm" name="id2571971"></a> 28 28 While it is possible to run a Samba-3 BDC with a non-LDAP backend, that backend must allow some form of 29 29 "two-way" propagation of changes from the BDC to the master. At this time only LDAP delivers the capability … … 31 31 is preferable for the PDC to use as its primary an LDAP master server. 32 32 </p><p> 33 <a class="indexterm" name="id25 65929"></a>34 <a class="indexterm" name="id25 65938"></a>35 <a class="indexterm" name="id25 65947"></a>36 <a class="indexterm" name="id25 65959"></a>37 <a class="indexterm" name="id25 65965"></a>38 <a class="indexterm" name="id25 65972"></a>39 <a class="indexterm" name="id25 65979"></a>33 <a class="indexterm" name="id2571988"></a> 34 <a class="indexterm" name="id2571997"></a> 35 <a class="indexterm" name="id2572006"></a> 36 <a class="indexterm" name="id2572018"></a> 37 <a class="indexterm" name="id2572024"></a> 38 <a class="indexterm" name="id2572031"></a> 39 <a class="indexterm" name="id2572038"></a> 40 40 The use of a non-LDAP backend SAM database is particularly problematic because domain member 41 41 servers and workstations periodically change the Machine Trust Account password. The new … … 47 47 breakage of the domain trust. 48 48 </p><p> 49 <a class="indexterm" name="id25 66000"></a>50 <a class="indexterm" name="id25 66009"></a>51 <a class="indexterm" name="id25 66018"></a>52 <a class="indexterm" name="id25 66028"></a>49 <a class="indexterm" name="id2572059"></a> 50 <a class="indexterm" name="id2572068"></a> 51 <a class="indexterm" name="id2572077"></a> 52 <a class="indexterm" name="id2572086"></a> 53 53 Considering the number of comments and questions raised concerning how to configure a BDC, 54 54 let's consider each possible option and look at the pros and cons for each possible solution. … … 71 71 and also suffers 72 72 from the issue of domain trust breakdown. 73 </p></td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2566209"></a>Essential Background Information</h2></div></div></div><p>74 <a class="indexterm" name="id25 66217"></a>75 <a class="indexterm" name="id25 66224"></a>76 <a class="indexterm" name="id25 66231"></a>77 <a class="indexterm" name="id25 66238"></a>73 </p></td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect1" title="Essential Background Information"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2572268"></a>Essential Background Information</h2></div></div></div><p> 74 <a class="indexterm" name="id2572276"></a> 75 <a class="indexterm" name="id2572283"></a> 76 <a class="indexterm" name="id2572290"></a> 77 <a class="indexterm" name="id2572296"></a> 78 78 A domain controller is a machine that is able to answer logon requests from network 79 79 workstations. Microsoft LanManager and IBM LanServer were two early products that 80 80 provided this capability. The technology has become known as the LanMan Netlogon service. 81 81 </p><p> 82 <a class="indexterm" name="id25 66252"></a>83 <a class="indexterm" name="id25 66264"></a>82 <a class="indexterm" name="id2572311"></a> 83 <a class="indexterm" name="id2572322"></a> 84 84 When MS Windows NT3.10 was first released, it supported a new style of Domain Control 85 85 and with it a new form of the network logon service that has extended functionality. … … 87 87 changed with the evolution of MS Windows NT and today provides a complex array of 88 88 services that are implemented over an intricate spectrum of technologies. 89 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2566279"></a>MS Windows NT4-style Domain Control</h3></div></div></div><p>90 <a class="indexterm" name="id25 66287"></a>91 <a class="indexterm" name="id25 66294"></a>92 <a class="indexterm" name="id25 66301"></a>93 <a class="indexterm" name="id25 66308"></a>94 <a class="indexterm" name="id25 66314"></a>95 <a class="indexterm" name="id25 66321"></a>96 <a class="indexterm" name="id25 66330"></a>89 </p><div class="sect2" title="MS Windows NT4-style Domain Control"><div class="titlepage"><div><div><h3 class="title"><a name="id2572337"></a>MS Windows NT4-style Domain Control</h3></div></div></div><p> 90 <a class="indexterm" name="id2572346"></a> 91 <a class="indexterm" name="id2572352"></a> 92 <a class="indexterm" name="id2572360"></a> 93 <a class="indexterm" name="id2572366"></a> 94 <a class="indexterm" name="id2572373"></a> 95 <a class="indexterm" name="id2572380"></a> 96 <a class="indexterm" name="id2572389"></a> 97 97 Whenever a user logs into a Windows NT4/200x/XP Professional workstation, 98 98 the workstation connects to a domain controller (authentication server) to validate that … … 102 102 codes is returned to the workstation that has made the authentication request. 103 103 </p><p> 104 <a class="indexterm" name="id25 66350"></a>105 <a class="indexterm" name="id25 66357"></a>106 <a class="indexterm" name="id25 66364"></a>107 <a class="indexterm" name="id25 66371"></a>108 <a class="indexterm" name="id25 66378"></a>104 <a class="indexterm" name="id2572409"></a> 105 <a class="indexterm" name="id2572416"></a> 106 <a class="indexterm" name="id2572423"></a> 107 <a class="indexterm" name="id2572430"></a> 108 <a class="indexterm" name="id2572437"></a> 109 109 When the username/password pair has been validated, the domain controller 110 110 (authentication server) will respond with full enumeration of the account information … … 118 118 in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0). 119 119 </p><p> 120 <a class="indexterm" name="id25 66415"></a>121 <a class="indexterm" name="id25 66424"></a>122 <a class="indexterm" name="id25 66432"></a>123 <a class="indexterm" name="id25 66439"></a>124 <a class="indexterm" name="id25 66445"></a>120 <a class="indexterm" name="id2572474"></a> 121 <a class="indexterm" name="id2572483"></a> 122 <a class="indexterm" name="id2572490"></a> 123 <a class="indexterm" name="id2572497"></a> 124 <a class="indexterm" name="id2572504"></a> 125 125 The account information (user and machine) on domain controllers is stored in two files, 126 126 one containing the security information and the other the SAM. These are stored in files … … 131 131 </p><p> 132 132 There are two situations in which it is desirable to install BDCs: 133 </p><div class="itemizedlist"><ul type="disc"><li><p>134 <a class="indexterm" name="id25 66481"></a>135 <a class="indexterm" name="id25 66488"></a>133 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 134 <a class="indexterm" name="id2572540"></a> 135 <a class="indexterm" name="id2572546"></a> 136 136 On the local network that the PDC is on, if there are many 137 137 workstations and/or where the PDC is generally very busy. In this case the BDCs 138 138 will pick up network logon requests and help to add robustness to network services. 139 </p></li><li ><p>140 <a class="indexterm" name="id25 66502"></a>139 </p></li><li class="listitem"><p> 140 <a class="indexterm" name="id2572561"></a> 141 141 At each remote site, to reduce wide-area network traffic and to add stability to 142 142 remote network operations. The design of the network, and the strategic placement of … … 145 145 (and thus costs). 146 146 </p></li></ul></div><p> 147 <a class="indexterm" name="id25 66522"></a>148 <a class="indexterm" name="id25 66528"></a>149 <a class="indexterm" name="id25 66535"></a>150 <a class="indexterm" name="id25 66542"></a>151 <a class="indexterm" name="id25 66549"></a>147 <a class="indexterm" name="id2572581"></a> 148 <a class="indexterm" name="id2572587"></a> 149 <a class="indexterm" name="id2572594"></a> 150 <a class="indexterm" name="id2572601"></a> 151 <a class="indexterm" name="id2572607"></a> 152 152 The interoperation of a PDC and its BDCs in a true Windows NT4 environment is worth 153 153 mentioning here. The PDC contains the master copy of the SAM. In the event that an … … 161 161 trigger them to obtain the update and then apply that to their own copy of the SAM. 162 162 </p><p> 163 <a class="indexterm" name="id25 66573"></a>164 <a class="indexterm" name="id25 66582"></a>165 <a class="indexterm" name="id25 66590"></a>166 <a class="indexterm" name="id25 66597"></a>163 <a class="indexterm" name="id2572631"></a> 164 <a class="indexterm" name="id2572640"></a> 165 <a class="indexterm" name="id2572649"></a> 166 <a class="indexterm" name="id2572656"></a> 167 167 Samba-3 cannot participate in true SAM replication and is therefore not able to 168 168 employ precisely the same protocols used by MS Windows NT4. A Samba-3 BDC will … … 170 170 to synchronize the SAM from delta files that are held by BDCs. 171 171 </p><p> 172 <a class="indexterm" name="id25 66612"></a>173 <a class="indexterm" name="id25 66619"></a>172 <a class="indexterm" name="id2572671"></a> 173 <a class="indexterm" name="id2572677"></a> 174 174 Samba-3 cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 cannot 175 175 function correctly as a PDC to an MS Windows NT4 BDC. Both Samba-3 and MS Windows 176 176 NT4 can function as a BDC to its own type of PDC. 177 177 </p><p> 178 <a class="indexterm" name="id25 66632"></a>179 <a class="indexterm" name="id25 66638"></a>180 <a class="indexterm" name="id25 66645"></a>178 <a class="indexterm" name="id2572691"></a> 179 <a class="indexterm" name="id2572697"></a> 180 <a class="indexterm" name="id2572704"></a> 181 181 The BDC is said to hold a <span class="emphasis"><em>read-only</em></span> of the SAM from which 182 182 it is able to process network logon requests and authenticate users. The BDC can … … 185 185 maintenance of domain security as well as in network integrity. 186 186 </p><p> 187 <a class="indexterm" name="id25 66665"></a>188 <a class="indexterm" name="id25 66671"></a>189 <a class="indexterm" name="id25 66678"></a>190 <a class="indexterm" name="id25 66685"></a>187 <a class="indexterm" name="id2572724"></a> 188 <a class="indexterm" name="id2572730"></a> 189 <a class="indexterm" name="id2572737"></a> 190 <a class="indexterm" name="id2572744"></a> 191 191 In the event that the NT4 PDC should need to be taken out of service, or if it dies, one of the NT4 BDCs can 192 192 be promoted to a PDC. If this happens while the original NT4 PDC is online, it is automatically demoted to an … … 195 195 promoted in this manner because reconfiguration of Samba requires changes to the <code class="filename">smb.conf</code> file. It is easy 196 196 enough to manuall change the <code class="filename">smb.conf</code> file and then restart relevant Samba network services. 197 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2566715"></a>Example PDC Configuration</h4></div></div></div><p>198 <a class="indexterm" name="id25 66723"></a>199 <a class="indexterm" name="id25 66730"></a>197 </p><div class="sect3" title="Example PDC Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id2572774"></a>Example PDC Configuration</h4></div></div></div><p> 198 <a class="indexterm" name="id2572782"></a> 199 <a class="indexterm" name="id2572789"></a> 200 200 Beginning with Version 2.2, Samba officially supports domain logons for all current Windows clients, including 201 201 Windows NT4, 2003, and XP Professional. For Samba to be enabled as a PDC, some parameters in the 202 202 <em class="parameter"><code>[global]</code></em> section of the <code class="filename">smb.conf</code> have to be set. Refer to <a class="link" href="samba-bdc.html#minimalPDC" title="Example 5.1. Minimal smb.conf for a PDC in Use with a BDC LDAP Server on PDC">the Minimal smb.conf for a PDC in Use with a BDC LDAP Server on PDC 203 203 section</a> for an example of the minimum required settings. 204 </p><div class="example"><a name="minimalPDC"></a><p class="title"><b>Example 5.1. Minimal smb.conf for a PDC in Use with a BDC LDAP Server on PDC</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2566783"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2566795"></a><em class="parameter"><code>passdb backend = ldapsam://localhost:389</code></em></td></tr><tr><td><a class="indexterm" name="id2566807"></a><em class="parameter"><code>domain master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566819"></a><em class="parameter"><code>domain logons = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566831"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2566843"></a><em class="parameter"><code>ldap user suffix = ou=Users</code></em></td></tr><tr><td><a class="indexterm" name="id2566854"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2566866"></a><em class="parameter"><code>ldap machine suffix = ou=Computers</code></em></td></tr><tr><td><a class="indexterm" name="id2566878"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2566890"></a><em class="parameter"><code>ldap admin dn = cn=sambadmin,dc=quenya,dc=org</code></em></td></tr></table></div></div><br class="example-break"><p>205 <a class="indexterm" name="id25 66906"></a>206 <a class="indexterm" name="id25 66913"></a>204 </p><div class="example"><a name="minimalPDC"></a><p class="title"><b>Example 5.1. Minimal smb.conf for a PDC in Use with a BDC LDAP Server on PDC</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2572842"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2572854"></a><em class="parameter"><code>passdb backend = ldapsam://localhost:389</code></em></td></tr><tr><td><a class="indexterm" name="id2572866"></a><em class="parameter"><code>domain master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2572878"></a><em class="parameter"><code>domain logons = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2572890"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2572901"></a><em class="parameter"><code>ldap user suffix = ou=Users</code></em></td></tr><tr><td><a class="indexterm" name="id2572913"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2572925"></a><em class="parameter"><code>ldap machine suffix = ou=Computers</code></em></td></tr><tr><td><a class="indexterm" name="id2572937"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2572949"></a><em class="parameter"><code>ldap admin dn = cn=sambadmin,dc=quenya,dc=org</code></em></td></tr></table></div></div><br class="example-break"><p> 205 <a class="indexterm" name="id2572965"></a> 206 <a class="indexterm" name="id2572972"></a> 207 207 Several other things like a <em class="parameter"><code>[homes]</code></em> and a <em class="parameter"><code>[netlogon]</code></em> share 208 208 also need to be set along with settings for the profile path, the user's home drive, and so on. This is not … … 210 210 Refer to <a class="link" href="samba-pdc.html" title="Chapter 4. Domain Control">the Domain Control chapter</a> for specific recommendations for PDC 211 211 configuration. Alternately, fully documented working example network configurations using OpenLDAP and Samba 212 as available in the <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample" target="_top">book</a> “<span class="quote">Samba-3213 by Example</span>” that may be obtained from local and on-line book stores.214 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2566966"></a>LDAP Configuration Notes</h3></div></div></div><p>215 <a class="indexterm" name="id25 66974"></a>216 <a class="indexterm" name="id25 66984"></a>217 <a class="indexterm" name="id25 66993"></a>212 as available in the <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample" target="_top">book</a> <span class="quote">“<span class="quote">Samba-3 213 by Example</span>”</span> that may be obtained from local and on-line book stores. 214 </p></div></div><div class="sect2" title="LDAP Configuration Notes"><div class="titlepage"><div><div><h3 class="title"><a name="id2573025"></a>LDAP Configuration Notes</h3></div></div></div><p> 215 <a class="indexterm" name="id2573033"></a> 216 <a class="indexterm" name="id2573042"></a> 217 <a class="indexterm" name="id2573052"></a> 218 218 When configuring a master and a slave LDAP server, it is advisable to use the master LDAP server 219 219 for the PDC and slave LDAP servers for the BDCs. It is not essential to use slave LDAP servers; however, … … 222 222 entire network. 223 223 </p><p> 224 <a class="indexterm" name="id25 67010"></a>225 <a class="indexterm" name="id25 67019"></a>226 <a class="indexterm" name="id25 67028"></a>227 <a class="indexterm" name="id25 67035"></a>228 <a class="indexterm" name="id25 67042"></a>224 <a class="indexterm" name="id2573069"></a> 225 <a class="indexterm" name="id2573078"></a> 226 <a class="indexterm" name="id2573087"></a> 227 <a class="indexterm" name="id2573094"></a> 228 <a class="indexterm" name="id2573100"></a> 229 229 When configuring a master LDAP server that will have slave LDAP servers, do not forget to configure this in 230 230 the <code class="filename">/etc/openldap/slapd.conf</code> file. It must be noted that the DN of a server certificate … … 233 233 on server certificate names are in RFC2830. 234 234 </p><p> 235 <a class="indexterm" name="id25 67065"></a>236 <a class="indexterm" name="id25 67072"></a>237 <a class="indexterm" name="id25 67079"></a>238 <a class="indexterm" name="id25 67085"></a>239 <a class="indexterm" name="id25 67095"></a>240 <a class="indexterm" name="id25 67102"></a>241 <a class="indexterm" name="id25 67109"></a>235 <a class="indexterm" name="id2573124"></a> 236 <a class="indexterm" name="id2573131"></a> 237 <a class="indexterm" name="id2573137"></a> 238 <a class="indexterm" name="id2573144"></a> 239 <a class="indexterm" name="id2573154"></a> 240 <a class="indexterm" name="id2573161"></a> 241 <a class="indexterm" name="id2573168"></a> 242 242 It does not really fit within the scope of this document, but a working LDAP installation is basic to 243 243 LDAP-enabled Samba operation. When using an OpenLDAP server with Transport Layer Security (TLS), the machine 244 244 name in <code class="filename">/etc/ssl/certs/slapd.pem</code> must be the same as in 245 245 <code class="filename">/etc/openldap/sldap.conf</code>. The Red Hat Linux startup script creates the 246 <code class="filename">slapd.pem</code> file with hostname “<span class="quote">localhost.localdomain.</span>”It is impossible to246 <code class="filename">slapd.pem</code> file with hostname <span class="quote">“<span class="quote">localhost.localdomain.</span>”</span> It is impossible to 247 247 access this LDAP server from a slave LDAP server (i.e., a Samba BDC) unless the certificate is re-created with 248 248 a correct hostname. 249 249 </p><p> 250 <a class="indexterm" name="id25 67149"></a>251 <a class="indexterm" name="id25 67156"></a>252 <a class="indexterm" name="id25 67162"></a>253 <a class="indexterm" name="id25 67169"></a>254 <a class="indexterm" name="id25 67176"></a>255 <a class="indexterm" name="id25 67183"></a>250 <a class="indexterm" name="id2573208"></a> 251 <a class="indexterm" name="id2573214"></a> 252 <a class="indexterm" name="id2573221"></a> 253 <a class="indexterm" name="id2573228"></a> 254 <a class="indexterm" name="id2573235"></a> 255 <a class="indexterm" name="id2573242"></a> 256 256 Do not install a Samba PDC so that is uses an LDAP slave server. Joining client machines to the domain 257 257 will fail in this configuration because the change to the machine account in the LDAP tree must take place on … … 264 264 </p><p> 265 265 Possible PDC/BDC plus LDAP configurations include: 266 </p><div class="itemizedlist"><ul type="disc"><li><p>266 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 267 267 PDC+BDC -> One Central LDAP Server. 268 </p></li><li ><p>268 </p></li><li class="listitem"><p> 269 269 PDC -> LDAP master server, BDC -> LDAP slave server. 270 </p></li><li ><p>270 </p></li><li class="listitem"><p> 271 271 PDC -> LDAP master, with secondary slave LDAP server. 272 272 </p><p> 273 273 BDC -> LDAP master, with secondary slave LDAP server. 274 </p></li><li ><p>274 </p></li><li class="listitem"><p> 275 275 PDC -> LDAP master, with secondary slave LDAP server. 276 276 </p><p> … … 280 280 the secondary LDAP server in the <code class="filename">smb.conf</code> file as shown in <a class="link" href="samba-bdc.html#mulitldapcfg" title="Example 5.2. Multiple LDAP Servers in smb.conf">the Multiple LDAP 281 281 Servers in <code class="filename">smb.conf</code> example</a>. 282 </p><div class="example"><a name="mulitldapcfg"></a><p class="title"><b>Example 5.2. Multiple LDAP Servers in <code class="filename">smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2567317"></a><em class="parameter"><code>passdb backend = ldapsam:"ldap://master.quenya.org ldap://slave.quenya.org"</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2567331"></a>Active Directory Domain Control</h3></div></div></div><p>283 <a class="indexterm" name="id25 67340"></a>284 <a class="indexterm" name="id25 67346"></a>285 <a class="indexterm" name="id25 67353"></a>286 <a class="indexterm" name="id25 67360"></a>287 <a class="indexterm" name="id25 67367"></a>288 <a class="indexterm" name="id25 67374"></a>282 </p><div class="example"><a name="mulitldapcfg"></a><p class="title"><b>Example 5.2. Multiple LDAP Servers in <code class="filename">smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2573376"></a><em class="parameter"><code>passdb backend = ldapsam:"ldap://master.quenya.org ldap://slave.quenya.org"</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="Active Directory Domain Control"><div class="titlepage"><div><div><h3 class="title"><a name="id2573390"></a>Active Directory Domain Control</h3></div></div></div><p> 283 <a class="indexterm" name="id2573398"></a> 284 <a class="indexterm" name="id2573405"></a> 285 <a class="indexterm" name="id2573412"></a> 286 <a class="indexterm" name="id2573419"></a> 287 <a class="indexterm" name="id2573426"></a> 288 <a class="indexterm" name="id2573432"></a> 289 289 As of the release of MS Windows 2000 and Active Directory, this information is now stored 290 290 in a directory that can be replicated and for which partial or full administrative control … … 292 292 tree, and it cannot be an Active Directory server. This means that Samba-3 also cannot 293 293 act as a BDC to an Active Directory domain controller. 294 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2567390"></a>What Qualifies a Domain Controller on the Network?</h3></div></div></div><p>295 <a class="indexterm" name="id25 67398"></a>296 <a class="indexterm" name="id25 67405"></a>297 <a class="indexterm" name="id25 67411"></a>298 <a class="indexterm" name="id25 67418"></a>294 </p></div><div class="sect2" title="What Qualifies a Domain Controller on the Network?"><div class="titlepage"><div><div><h3 class="title"><a name="id2573448"></a>What Qualifies a Domain Controller on the Network?</h3></div></div></div><p> 295 <a class="indexterm" name="id2573457"></a> 296 <a class="indexterm" name="id2573463"></a> 297 <a class="indexterm" name="id2573470"></a> 298 <a class="indexterm" name="id2573477"></a> 299 299 Every machine that is a domain controller for the domain MIDEARTH has to register the NetBIOS 300 300 group name MIDEARTH<1C> with the WINS server and/or by broadcast on the local network. … … 304 304 implementation requires the DMB to be on the same machine as the PDC. 305 305 </p><p> 306 <a class="indexterm" name="id25 67440"></a>307 <a class="indexterm" name="id25 67447"></a>308 <a class="indexterm" name="id25 67454"></a>306 <a class="indexterm" name="id2573499"></a> 307 <a class="indexterm" name="id2573505"></a> 308 <a class="indexterm" name="id2573512"></a> 309 309 Where a WINS server is not used, broadcast name registrations alone must suffice. Refer to 310 310 <a class="link" href="NetworkBrowsing.html" title="Chapter 10. Network Browsing">Network Browsing</a>,<a class="link" href="NetworkBrowsing.html#netdiscuss" title="Discussion">Discussion</a> 311 311 for more information regarding TCP/IP network protocols and how SMB/CIFS names are handled. 312 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2567481"></a>How Does a Workstation find its Domain Controller?</h3></div></div></div><p>313 <a class="indexterm" name="id25 67489"></a>314 <a class="indexterm" name="id25 67496"></a>312 </p></div><div class="sect2" title="How Does a Workstation find its Domain Controller?"><div class="titlepage"><div><div><h3 class="title"><a name="id2573539"></a>How Does a Workstation find its Domain Controller?</h3></div></div></div><p> 313 <a class="indexterm" name="id2573548"></a> 314 <a class="indexterm" name="id2573555"></a> 315 315 There are two different mechanisms to locate a domain controller: one method is used when 316 316 NetBIOS over TCP/IP is enabled and the other when it has been disabled in the TCP/IP 317 317 network configuration. 318 318 </p><p> 319 <a class="indexterm" name="id25 67510"></a>320 <a class="indexterm" name="id25 67516"></a>319 <a class="indexterm" name="id2573568"></a> 320 <a class="indexterm" name="id2573575"></a> 321 321 Where NetBIOS over TCP/IP is disabled, all name resolution involves the use of DNS, broadcast 322 322 messaging over UDP, as well as Active Directory communication technologies. In this type of 323 323 environment all machines require appropriate DNS entries. More information may be found in 324 324 <a class="link" href="NetworkBrowsing.html#adsdnstech" title="DNS and Active Directory">DNS and Active Directory</a>. 325 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2567537"></a>NetBIOS Over TCP/IP Enabled</h4></div></div></div><p>326 <a class="indexterm" name="id25 67545"></a>327 <a class="indexterm" name="id25 67552"></a>328 <a class="indexterm" name="id25 67559"></a>329 <a class="indexterm" name="id25 67566"></a>325 </p><div class="sect3" title="NetBIOS Over TCP/IP Enabled"><div class="titlepage"><div><div><h4 class="title"><a name="id2573596"></a>NetBIOS Over TCP/IP Enabled</h4></div></div></div><p> 326 <a class="indexterm" name="id2573604"></a> 327 <a class="indexterm" name="id2573611"></a> 328 <a class="indexterm" name="id2573618"></a> 329 <a class="indexterm" name="id2573624"></a> 330 330 An MS Windows NT4/200x/XP Professional workstation in the domain MIDEARTH that wants a 331 331 local user to be authenticated has to find the domain controller for MIDEARTH. It does this … … 335 335 authenticate each other. After that the workstation sends the user's credentials (name and 336 336 password) to the local domain controller for validation. 337 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2567603"></a>NetBIOS Over TCP/IP Disabled</h4></div></div></div><p>338 <a class="indexterm" name="id25 67611"></a>339 <a class="indexterm" name="id25 67618"></a>340 <a class="indexterm" name="id25 67625"></a>341 <a class="indexterm" name="id25 67631"></a>337 </p></div><div class="sect3" title="NetBIOS Over TCP/IP Disabled"><div class="titlepage"><div><div><h4 class="title"><a name="id2573662"></a>NetBIOS Over TCP/IP Disabled</h4></div></div></div><p> 338 <a class="indexterm" name="id2573670"></a> 339 <a class="indexterm" name="id2573676"></a> 340 <a class="indexterm" name="id2573684"></a> 341 <a class="indexterm" name="id2573690"></a> 342 342 An MS Windows NT4/200x/XP Professional workstation in the realm <code class="constant">quenya.org</code> 343 343 that has a need to affect user logon authentication will locate the domain controller by 344 344 re-querying DNS servers for the <code class="constant">_ldap._tcp.pdc._msdcs.quenya.org</code> record. 345 345 More information regarding this subject may be found in <a class="link" href="NetworkBrowsing.html#adsdnstech" title="DNS and Active Directory">DNS and Active Directory</a>. 346 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2567662"></a>Backup Domain Controller Configuration</h2></div></div></div><p>347 <a class="indexterm" name="id25 67669"></a>346 </p></div></div></div><div class="sect1" title="Backup Domain Controller Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2573721"></a>Backup Domain Controller Configuration</h2></div></div></div><p> 347 <a class="indexterm" name="id2573728"></a> 348 348 The creation of a BDC requires some steps to prepare the Samba server before 349 349 <span class="application">smbd</span> is executed for the first time. These steps are as follows: 350 </p><div class="itemizedlist"><ul type="disc"><li><p>351 <a class="indexterm" name="id25 67690"></a>352 <a class="indexterm" name="id25 67697"></a>353 <a class="indexterm" name="id25 67703"></a>354 <a class="indexterm" name="id25 67710"></a>355 <a class="indexterm" name="id25 67717"></a>356 <a class="indexterm" name="id25 67724"></a>350 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 351 <a class="indexterm" name="id2573749"></a> 352 <a class="indexterm" name="id2573756"></a> 353 <a class="indexterm" name="id2573762"></a> 354 <a class="indexterm" name="id2573769"></a> 355 <a class="indexterm" name="id2573776"></a> 356 <a class="indexterm" name="id2573783"></a> 357 357 The domain SID has to be the same on the PDC and the BDC. In Samba versions pre-2.2.5, the domain SID was 358 358 stored in the file <code class="filename">private/MACHINE.SID</code>. For all versions of Samba released since 2.2.5 … … 362 362 domain SID. This is described here. 363 363 </p><p> 364 <a class="indexterm" name="id25 67754"></a>365 <a class="indexterm" name="id25 67761"></a>366 <a class="indexterm" name="id25 67768"></a>367 <a class="indexterm" name="id25 67774"></a>368 <a class="indexterm" name="id25 67781"></a>364 <a class="indexterm" name="id2573813"></a> 365 <a class="indexterm" name="id2573820"></a> 366 <a class="indexterm" name="id2573827"></a> 367 <a class="indexterm" name="id2573833"></a> 368 <a class="indexterm" name="id2573840"></a> 369 369 To retrieve the domain SID from the PDC or an existing BDC and store it in the 370 370 <code class="filename">secrets.tdb</code>, execute: 371 371 </p><pre class="screen"> 372 372 <code class="prompt">root# </code><strong class="userinput"><code>net rpc getsid</code></strong> 373 </pre></li><li ><p>374 <a class="indexterm" name="id25 67821"></a>375 <a class="indexterm" name="id25 67828"></a>376 <a class="indexterm" name="id25 67835"></a>373 </pre></li><li class="listitem"><p> 374 <a class="indexterm" name="id2573880"></a> 375 <a class="indexterm" name="id2573887"></a> 376 <a class="indexterm" name="id2573894"></a> 377 377 Specification of the <a class="link" href="smb.conf.5.html#LDAPADMINDN" target="_top">ldap admin dn</a> is obligatory. 378 378 This also requires the LDAP administration password to be set in the <code class="filename">secrets.tdb</code> 379 379 using the <code class="literal">smbpasswd -w <em class="replaceable"><code>mysecret</code></em></code>. 380 </p></li><li ><p>380 </p></li><li class="listitem"><p> 381 381 The <a class="link" href="smb.conf.5.html#LDAPSUFFIX" target="_top">ldap suffix</a> parameter and the <a class="link" href="smb.conf.5.html#LDAPIDMAPSUFFIX" target="_top">ldap idmap suffix</a> 382 382 parameter must be specified in the <code class="filename">smb.conf</code> file. 383 </p></li><li ><p>384 <a class="indexterm" name="id25 67910"></a>385 <a class="indexterm" name="id25 67919"></a>386 <a class="indexterm" name="id25 67926"></a>387 <a class="indexterm" name="id25 67932"></a>383 </p></li><li class="listitem"><p> 384 <a class="indexterm" name="id2573968"></a> 385 <a class="indexterm" name="id2573977"></a> 386 <a class="indexterm" name="id2573984"></a> 387 <a class="indexterm" name="id2573991"></a> 388 388 The UNIX user database has to be synchronized from the PDC to the 389 389 BDC. This means that both the <code class="filename">/etc/passwd</code> and … … 395 395 a PDC failure. NIS is by no means the only method to synchronize 396 396 passwords. An LDAP solution would also work. 397 </p></li><li ><p>398 <a class="indexterm" name="id25 67965"></a>399 <a class="indexterm" name="id25 67972"></a>400 <a class="indexterm" name="id25 67979"></a>401 <a class="indexterm" name="id25 67986"></a>402 <a class="indexterm" name="id25 67992"></a>403 <a class="indexterm" name="id25 67999"></a>404 <a class="indexterm" name="id25 68006"></a>405 <a class="indexterm" name="id25 68012"></a>397 </p></li><li class="listitem"><p> 398 <a class="indexterm" name="id2574024"></a> 399 <a class="indexterm" name="id2574031"></a> 400 <a class="indexterm" name="id2574038"></a> 401 <a class="indexterm" name="id2574044"></a> 402 <a class="indexterm" name="id2574051"></a> 403 <a class="indexterm" name="id2574058"></a> 404 <a class="indexterm" name="id2574064"></a> 405 <a class="indexterm" name="id2574071"></a> 406 406 The Samba password database must be replicated from the PDC to the BDC. 407 407 Although it is possible to synchronize the <code class="filename">smbpasswd</code> … … 418 418 or when it takes place. 419 419 </p><p> 420 <a class="indexterm" name="id25 68058"></a>421 <a class="indexterm" name="id25 68064"></a>422 <a class="indexterm" name="id25 68071"></a>423 <a class="indexterm" name="id25 68078"></a>420 <a class="indexterm" name="id2574117"></a> 421 <a class="indexterm" name="id2574123"></a> 422 <a class="indexterm" name="id2574130"></a> 423 <a class="indexterm" name="id2574137"></a> 424 424 The use of LDAP for both the POSIX (UNIX user and group) accounts and for the 425 425 SambaSAMAccount data automatically ensures that all account change information 426 426 will be written to the shared directory. This eliminates the need for any special 427 427 action to synchronize account information because LDAP will meet that requirement. 428 </p></li><li ><p>429 <a class="indexterm" name="id25 68095"></a>430 <a class="indexterm" name="id25 68102"></a>431 <a class="indexterm" name="id25 68109"></a>432 <a class="indexterm" name="id25 68115"></a>433 <a class="indexterm" name="id25 68122"></a>434 <a class="indexterm" name="id25 68128"></a>428 </p></li><li class="listitem"><p> 429 <a class="indexterm" name="id2574154"></a> 430 <a class="indexterm" name="id2574161"></a> 431 <a class="indexterm" name="id2574167"></a> 432 <a class="indexterm" name="id2574174"></a> 433 <a class="indexterm" name="id2574180"></a> 434 <a class="indexterm" name="id2574187"></a> 435 435 The netlogon share has to be replicated from the PDC to the BDC. This can be done manually whenever login 436 436 scripts are changed, or it can be done automatically using a <code class="literal">cron</code> job that will replicate … … 439 439 that can be manually managed given that the administrator will make all changes to the netlogon share as part 440 440 of a conscious move. 441 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568163"></a>Example Configuration</h3></div></div></div><p>441 </p></li></ul></div><div class="sect2" title="Example Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id2574222"></a>Example Configuration</h3></div></div></div><p> 442 442 Finally, the BDC has to be capable of being found by the workstations. This can be done by configuring the 443 443 Samba <code class="filename">smb.conf</code> file <em class="parameter"><code>[global]</code></em> section as shown in <a class="link" href="samba-bdc.html#minim-bdc" title="Example 5.3. Minimal Setup for Being a BDC">Minimal 444 444 Setup for Being a BDC</a>. 445 </p><div class="example"><a name="minim-bdc"></a><p class="title"><b>Example 5.3. Minimal Setup for Being a BDC</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2568209"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2568220"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://slave-ldap.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2568233"></a><em class="parameter"><code>domain master = no</code></em></td></tr><tr><td><a class="indexterm" name="id2568244"></a><em class="parameter"><code>domain logons = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568256"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2568268"></a><em class="parameter"><code>ldap user suffix = ou=Users</code></em></td></tr><tr><td><a class="indexterm" name="id2568280"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2568292"></a><em class="parameter"><code>ldap machine suffix = ou=Computers</code></em></td></tr><tr><td><a class="indexterm" name="id2568304"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2568316"></a><em class="parameter"><code>ldap admin dn = cn=sambadmin,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2568328"></a><em class="parameter"><code>idmap backend = ldap:ldap://master-ldap.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2568340"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2568352"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr></table></div></div><br class="example-break"><p>445 </p><div class="example"><a name="minim-bdc"></a><p class="title"><b>Example 5.3. Minimal Setup for Being a BDC</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2574267"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2574279"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://slave-ldap.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2574292"></a><em class="parameter"><code>domain master = no</code></em></td></tr><tr><td><a class="indexterm" name="id2574303"></a><em class="parameter"><code>domain logons = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2574315"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2574327"></a><em class="parameter"><code>ldap user suffix = ou=Users</code></em></td></tr><tr><td><a class="indexterm" name="id2574339"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2574351"></a><em class="parameter"><code>ldap machine suffix = ou=Computers</code></em></td></tr><tr><td><a class="indexterm" name="id2574363"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2574375"></a><em class="parameter"><code>ldap admin dn = cn=sambadmin,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2574387"></a><em class="parameter"><code>idmap backend = ldap:ldap://master-ldap.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2574399"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2574411"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr></table></div></div><br class="example-break"><p> 446 446 Fully documented working example network configurations using OpenLDAP and Samba 447 as available in the <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample" target="_top">book</a> “<span class="quote">Samba-3448 by Example</span>” that may be obtained from local and on-line book stores.449 </p><p> 450 <a class="indexterm" name="id25 68383"></a>451 <a class="indexterm" name="id25 68390"></a>452 <a class="indexterm" name="id25 68397"></a>453 <a class="indexterm" name="id25 68403"></a>447 as available in the <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample" target="_top">book</a> <span class="quote">“<span class="quote">Samba-3 448 by Example</span>”</span> that may be obtained from local and on-line book stores. 449 </p><p> 450 <a class="indexterm" name="id2574442"></a> 451 <a class="indexterm" name="id2574449"></a> 452 <a class="indexterm" name="id2574455"></a> 453 <a class="indexterm" name="id2574462"></a> 454 454 This configuration causes the BDC to register only the name MIDEARTH<1C> with the WINS server. This is 455 455 not a problem, as the name MIDEARTH<1C> is a NetBIOS group name that is meant to be registered by more … … 457 457 register MIDEARTH<1B>, which is a unique NetBIOS name that is reserved for the PDC. 458 458 </p><p> 459 <a class="indexterm" name="id25 68436"></a>460 <a class="indexterm" name="id25 68442"></a>461 <a class="indexterm" name="id25 68449"></a>462 <a class="indexterm" name="id25 68456"></a>463 <a class="indexterm" name="id25 68462"></a>464 <a class="indexterm" name="id25 68469"></a>465 <a class="indexterm" name="id25 68476"></a>466 <a class="indexterm" name="id25 68483"></a>467 <a class="indexterm" name="id25 68490"></a>459 <a class="indexterm" name="id2574494"></a> 460 <a class="indexterm" name="id2574501"></a> 461 <a class="indexterm" name="id2574508"></a> 462 <a class="indexterm" name="id2574514"></a> 463 <a class="indexterm" name="id2574521"></a> 464 <a class="indexterm" name="id2574528"></a> 465 <a class="indexterm" name="id2574535"></a> 466 <a class="indexterm" name="id2574542"></a> 467 <a class="indexterm" name="id2574549"></a> 468 468 The <em class="parameter"><code>idmap backend</code></em> will redirect the <code class="literal">winbindd</code> utility to use the LDAP 469 469 database to store all mappings for Windows SIDs to UIDs and GIDs for UNIX accounts in a repository that is 470 470 shared. The BDC will however depend on local resolution of UIDs and GIDs via NSS and the 471 471 <code class="literal">nss_ldap</code> utility. 472 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>473 <a class="indexterm" name="id25 68523"></a>474 <a class="indexterm" name="id25 68532"></a>475 <a class="indexterm" name="id25 68539"></a>476 <a class="indexterm" name="id25 68545"></a>472 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 473 <a class="indexterm" name="id2574582"></a> 474 <a class="indexterm" name="id2574591"></a> 475 <a class="indexterm" name="id2574598"></a> 476 <a class="indexterm" name="id2574605"></a> 477 477 Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it 478 478 allows greater flexibility in how user and group IDs are handled in respect to NT domain user and group … … 482 482 regarding its behavior. 483 483 </p></div><p> 484 <a class="indexterm" name="id25 68576"></a>485 <a class="indexterm" name="id25 68582"></a>486 <a class="indexterm" name="id25 68589"></a>484 <a class="indexterm" name="id2574642"></a> 485 <a class="indexterm" name="id2574649"></a> 486 <a class="indexterm" name="id2574656"></a> 487 487 The use of the <a class="link" href="smb.conf.5.html#IDMAPBACKEND" target="_top">idmap backend = ldap:ldap://master.quenya.org</a> 488 488 option on a BDC only makes sense where ldapsam is used on a PDC. The purpose of an LDAP-based idmap backend is … … 490 490 and groups to common UID/GIDs. In other words, this option is generally intended for use on BDCs and on domain 491 491 member servers. 492 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2568620"></a>Common Errors</h2></div></div></div><p>493 <a class="indexterm" name="id25 68628"></a>492 </p></div></div><div class="sect1" title="Common Errors"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2574686"></a>Common Errors</h2></div></div></div><p> 493 <a class="indexterm" name="id2574694"></a> 494 494 Domain control was a new area for Samba, but there are now many examples that we may refer to. 495 495 Updated information will be published as they become available and may be found in later Samba releases or 496 496 from the Samba Web <a class="ulink" href="http://samba.org" target="_top">site</a>; refer in particular to the 497 <code class="filename">WHATSNEW.txt</code> in the Samba release tarball. The book, “<span class="quote">Samba-3 by Example</span>”497 <code class="filename">WHATSNEW.txt</code> in the Samba release tarball. The book, <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span> 498 498 documents well tested and proven configuration examples. You can obtain a copy of this 499 499 <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample.pdf" target="_top">book</a> for the Samba web site. 500 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568664"></a>Machine Accounts Keep Expiring</h3></div></div></div><p>501 <a class="indexterm" name="id25 68672"></a>502 <a class="indexterm" name="id25 68679"></a>503 <a class="indexterm" name="id25 68686"></a>504 <a class="indexterm" name="id25 68692"></a>500 </p><div class="sect2" title="Machine Accounts Keep Expiring"><div class="titlepage"><div><div><h3 class="title"><a name="id2574730"></a>Machine Accounts Keep Expiring</h3></div></div></div><p> 501 <a class="indexterm" name="id2574738"></a> 502 <a class="indexterm" name="id2574745"></a> 503 <a class="indexterm" name="id2574752"></a> 504 <a class="indexterm" name="id2574758"></a> 505 505 This problem will occur when the passdb (SAM) files are copied from a central 506 506 server but the local BDC is acting as a PDC. This results in the application of … … 514 514 The solution is to use a more robust passdb backend, such as the ldapsam backend, setting up 515 515 a slave LDAP server for each BDC and a master LDAP server for the PDC. 516 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568719"></a>Can Samba Be a Backup Domain Controller to an NT4 PDC?</h3></div></div></div><p>517 <a class="indexterm" name="id25 68727"></a>518 <a class="indexterm" name="id25 68736"></a>516 </p></div><div class="sect2" title="Can Samba Be a Backup Domain Controller to an NT4 PDC?"><div class="titlepage"><div><div><h3 class="title"><a name="id2574784"></a>Can Samba Be a Backup Domain Controller to an NT4 PDC?</h3></div></div></div><p> 517 <a class="indexterm" name="id2574793"></a> 518 <a class="indexterm" name="id2574802"></a> 519 519 No. The native NT4 SAM replication protocols have not yet been fully implemented. 520 520 </p><p> 521 <a class="indexterm" name="id25 68747"></a>522 <a class="indexterm" name="id25 68754"></a>523 <a class="indexterm" name="id25 68760"></a>521 <a class="indexterm" name="id2574813"></a> 522 <a class="indexterm" name="id2574820"></a> 523 <a class="indexterm" name="id2574826"></a> 524 524 Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC.The 525 525 main reason for implementing a BDC is availability. If the PDC is a Samba 526 526 machine, a second Samba machine can be set up to service logon requests whenever 527 527 the PDC is down. 528 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568774"></a>How Do I Replicate the smbpasswd File?</h3></div></div></div><p>529 <a class="indexterm" name="id25 68782"></a>530 <a class="indexterm" name="id25 68791"></a>531 <a class="indexterm" name="id25 68798"></a>528 </p></div><div class="sect2" title="How Do I Replicate the smbpasswd File?"><div class="titlepage"><div><div><h3 class="title"><a name="id2574840"></a>How Do I Replicate the smbpasswd File?</h3></div></div></div><p> 529 <a class="indexterm" name="id2574848"></a> 530 <a class="indexterm" name="id2574857"></a> 531 <a class="indexterm" name="id2574864"></a> 532 532 Replication of the smbpasswd file is sensitive. It has to be done whenever changes 533 533 to the SAM are made. Every user's password change is done in the smbpasswd file and 534 534 has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. 535 535 </p><p> 536 <a class="indexterm" name="id25 68812"></a>537 <a class="indexterm" name="id25 68819"></a>538 <a class="indexterm" name="id25 68825"></a>536 <a class="indexterm" name="id2574878"></a> 537 <a class="indexterm" name="id2574885"></a> 538 <a class="indexterm" name="id2574891"></a> 539 539 As the smbpasswd file contains plaintext password equivalents, it must not be 540 540 sent unencrypted over the wire. The best way to set up smbpasswd replication from … … 543 543 <code class="literal">rsync</code> transfer without requiring the user to type a password. 544 544 </p><p> 545 <a class="indexterm" name="id25 68856"></a>546 <a class="indexterm" name="id25 68863"></a>545 <a class="indexterm" name="id2574922"></a> 546 <a class="indexterm" name="id2574929"></a> 547 547 As said a few times before, use of this method is broken and flawed. Machine trust 548 548 accounts will go out of sync, resulting in a broken domain. This method is 549 549 <span class="emphasis"><em>not</em></span> recommended. Try using LDAP instead. 550 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2568879"></a>Can I Do This All with LDAP?</h3></div></div></div><p>551 <a class="indexterm" name="id25 68887"></a>552 <a class="indexterm" name="id25 68894"></a>550 </p></div><div class="sect2" title="Can I Do This All with LDAP?"><div class="titlepage"><div><div><h3 class="title"><a name="id2574945"></a>Can I Do This All with LDAP?</h3></div></div></div><p> 551 <a class="indexterm" name="id2574953"></a> 552 <a class="indexterm" name="id2574960"></a> 553 553 The simple answer is yes. Samba's pdb_ldap code supports binding to a replica 554 554 LDAP server and will also follow referrals and rebind to the master if it ever
Note:
See TracChangeset
for help on using the changeset viewer.
