- Timestamp:
- Nov 24, 2016, 1:14:11 PM (9 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-DomainMember.xml
r414 r988 56 56 <indexterm><primary>domain control</primary></indexterm> 57 57 <indexterm><primary>Server Type</primary><secondary>Domain Member</secondary></indexterm> 58 Samba -3 can join an MS Windows NT4-style domain as a native member server, an58 Samba can join an MS Windows NT4-style domain as a native member server, an 59 59 MS Windows Active Directory domain as a native member server, or a Samba domain 60 60 control network. Domain membership has many advantages: … … 194 194 A corresponding UNIX account, typically stored in <filename>/etc/passwd</filename>. Work is in progress to 195 195 allow a simplified mode of operation that does not require UNIX user accounts, but this has not been a feature 196 of the early releases of Samba -3, and is not currently planned for release either.196 of the early releases of Samba, and is not currently planned for release either. 197 197 </para></listitem> 198 198 </itemizedlist> … … 607 607 608 608 <sect2> 609 <title>Joining an NT4-type Domain with Samba -3</title>609 <title>Joining an NT4-type Domain with Samba</title> 610 610 611 611 <para><link linkend="assumptions">Assumptions</link> lists names that are used in the remainder of this chapter.</para> … … 798 798 </sect2> 799 799 800 <sect2>801 <title>Why Is This Better Than <parameter>security = server</parameter>?</title>802 803 <para>804 <indexterm><primary>domain security</primary></indexterm>805 <indexterm><primary>UNIX users</primary></indexterm>806 <indexterm><primary>authentication</primary></indexterm>807 Currently, domain security in Samba does not free you from having to create local UNIX users to represent the808 users attaching to your server. This means that if domain user <constant>DOM\fred</constant> attaches to your809 domain security Samba server, there needs to be a local UNIX user fred to represent that user in the UNIX file810 system. This is similar to the older Samba security mode <smbconfoption811 name="security">server</smbconfoption>, where Samba would pass through the authentication request to a Windows812 NT server in the same way as a Windows 95 or Windows 98 server would.813 </para>814 815 <para>816 <indexterm><primary>winbind</primary></indexterm>817 <indexterm><primary>UID</primary></indexterm>818 <indexterm><primary>GID</primary></indexterm>819 Please refer to <link linkend="winbind">Winbind: Use of Domain Accounts</link>, for information on a system820 to automatically assign UNIX UIDs and GIDs to Windows NT domain users and groups.821 </para>822 823 <para>824 <indexterm><primary>domain-level</primary></indexterm>825 <indexterm><primary>authentication</primary></indexterm>826 <indexterm><primary>RPC</primary></indexterm>827 The advantage of domain-level security is that the authentication in domain-level security is passed down the828 authenticated RPC channel in exactly the same way that an NT server would do it. This means Samba servers now829 participate in domain trust relationships in exactly the same way NT servers do (i.e., you can add Samba830 servers into a resource domain and have the authentication passed on from a resource domain PDC to an account831 domain PDC).832 </para>833 834 <para>835 <indexterm><primary>PDC</primary></indexterm>836 <indexterm><primary>BDC</primary></indexterm>837 <indexterm><primary>connection resources</primary></indexterm>838 In addition, with <smbconfoption name="security">server</smbconfoption>, every Samba daemon on a server has to839 keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the840 connection resources on a Microsoft NT server and cause it to run out of available connections. With841 <smbconfoption name="security">domain</smbconfoption>, however, the Samba daemons connect to the PDC or BDC842 only for as long as is necessary to authenticate the user and then drop the connection, thus conserving PDC843 connection resources.844 </para>845 846 <para>847 <indexterm><primary>PDC</primary></indexterm>848 <indexterm><primary>authentication reply</primary></indexterm>849 <indexterm><primary>SID</primary></indexterm>850 <indexterm><primary>NT groups</primary></indexterm>851 Finally, acting in the same manner as an NT server authenticating to a PDC means that as part of the852 authentication reply, the Samba server gets the user identification information such as the user SID, the list853 of NT groups the user belongs to, and so on.854 </para>855 856 <note>857 <para>858 Much of the text of this document was first published in the Web magazine859 <ulink url="http://www.linuxworld.com"><emphasis>LinuxWorld</emphasis></ulink> as the article <ulink860 url="http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html"/>861 <emphasis>Doing the NIS/NT Samba</emphasis>.862 </para>863 </note>864 865 </sect2>866 800 </sect1> 867 801 … … 874 808 <indexterm><primary>KDC</primary></indexterm> 875 809 <indexterm><primary>Kerberos</primary></indexterm> 876 This is a rough guide to setting up Samba -3with Kerberos authentication against a810 This is a rough guide to setting up Samba with Kerberos authentication against a 877 811 Windows 200x KDC. A familiarity with Kerberos is assumed. 878 812 </para> … … 980 914 [libdefaults] 981 915 default_realm = YOUR.KERBEROS.REALM 982 983 [realms] 984 YOUR.KERBEROS.REALM = { 985 kdc = your.kerberos.server 986 } 916 dns_lookup_kdc = true 987 917 988 918 [domain_realms] … … 992 922 993 923 <para> 994 <indexterm><primary>Heimdal</primary></indexterm> 995 When using Heimdal versions before 0.6, use the following configuration settings: 924 If you must specify the KDC directly, the minimal configuration is: 996 925 <screen> 997 926 [libdefaults] 998 927 default_realm = YOUR.KERBEROS.REALM 999 default_etypes = des-cbc-crc des-cbc-md51000 default_etypes_des = des-cbc-crc des-cbc-md51001 928 1002 929 [realms] … … 1016 943 <replaceable>USERNAME</replaceable>@<replaceable>REALM</replaceable></userinput> and 1017 944 making sure that your password is accepted by the Win2000 KDC. 1018 </para>1019 1020 <para>1021 <indexterm><primary>Heimdal</primary></indexterm>1022 <indexterm><primary>ADS</primary></indexterm>1023 <indexterm><primary>KDC</primary></indexterm>1024 <indexterm><primary>Windows 2003</primary></indexterm>1025 With Heimdal versions earlier than 0.6.x you can use only newly created accounts1026 in ADS or accounts that have had the password changed once after migration, or1027 in case of <constant>Administrator</constant> after installation. At the1028 moment, a Windows 2003 KDC can only be used with Heimdal releases later than 0.61029 (and no default etypes in krb5.conf). Unfortunately, this whole area is still1030 in a state of flux.1031 945 </para> 1032 946 … … 1053 967 <indexterm><primary>Kerberos</primary></indexterm> 1054 968 Clock skew limits are configurable in the Kerberos protocols. The default setting is five minutes. 1055 </para>1056 1057 <para>1058 <indexterm><primary>DNS</primary></indexterm>1059 <indexterm><primary>KDC</primary></indexterm>1060 <indexterm><primary>hostname</primary></indexterm>1061 <indexterm><primary>realm</primary></indexterm>1062 You also must ensure that you can do a reverse DNS lookup on the IP address of your KDC. Also, the name that1063 this reverse lookup maps to must either be the NetBIOS name of the KDC (i.e., the hostname with no domain1064 attached) or it can be the NetBIOS name followed by the realm.1065 </para>1066 1067 <para>1068 <indexterm><primary>/etc/hosts</primary></indexterm>1069 <indexterm><primary>KDC</primary></indexterm>1070 <indexterm><primary>realm</primary></indexterm>1071 The easiest way to ensure you get this right is to add a <filename>/etc/hosts</filename> entry mapping the IP1072 address of your KDC to its NetBIOS name. If you do not get this correct, then you will get a <errorname>local1073 error</errorname> when you try to join the realm.1074 969 </para> 1075 970 … … 1113 1008 <indexterm><primary>net</primary><secondary>ads</secondary><tertiary>join</tertiary></indexterm> 1114 1009 When making a Windows client a member of an ADS domain within a complex organization, you 1115 may want to create the machine trust account within a particular organizational unit. Samba -3permits1010 may want to create the machine trust account within a particular organizational unit. Samba permits 1116 1011 this to be done using the following syntax: 1117 1012 <screen> … … 1160 1055 <replaceable>USERNAME</replaceable>@<replaceable>REALM</replaceable></userinput>. 1161 1056 <replaceable>USERNAME</replaceable> must be a user who has rights to add a machine to the domain. 1162 </para></listitem></varlistentry>1163 1164 <varlistentry><term>Unsupported encryption/or checksum types</term>1165 <listitem><para>1166 <indexterm><primary>/etc/krb5.conf</primary></indexterm>1167 <indexterm><primary>unsupported encryption</primary></indexterm>1168 <indexterm><primary>Kerberos</primary></indexterm>1169 Make sure that the <filename>/etc/krb5.conf</filename> is correctly configured1170 for the type and version of Kerberos installed on the system.1171 1057 </para></listitem></varlistentry> 1172 1058 </variablelist> … … 1218 1104 server using &smbclient; and Kerberos. Use &smbclient; as usual, but 1219 1105 specify the <option>-k</option> option to choose Kerberos authentication. 1220 </para>1221 1222 </sect2>1223 1224 <sect2>1225 <title>Notes</title>1226 1227 <para>1228 <indexterm><primary>administrator password</primary></indexterm>1229 <indexterm><primary>change password</primary></indexterm>1230 <indexterm><primary>encryption types</primary></indexterm>1231 You must change the administrator password at least once after installing a domain controller,1232 to create the right encryption types.1233 </para>1234 1235 <para>1236 <indexterm><primary>_kerberos._udp</primary></indexterm>1237 <indexterm><primary>_ldap._tcp</primary></indexterm>1238 <indexterm><primary>default DNS setup</primary></indexterm>1239 Windows 200x does not seem to create the <parameter>_kerberos._udp</parameter> and1240 <parameter>_ldap._tcp</parameter> in the default DNS setup. Perhaps this will be fixed later in service packs.1241 1106 </para> 1242 1107 … … 1401 1266 1402 1267 </sect2> 1403 1404 <sect2>1405 <title>I Can't Join a Windows 2003 PDC</title>1406 1407 <para>1408 <indexterm><primary>SMB signing</primary></indexterm>1409 <indexterm><primary>SMB</primary></indexterm>1410 <indexterm><primary>Windows 2003</primary></indexterm>1411 <indexterm><primary>SMB/CIFS</primary></indexterm>1412 Windows 2003 requires SMB signing. Client-side SMB signing has been implemented in Samba-3.0.1413 Set <smbconfoption name="client use spnego">yes</smbconfoption> when communicating1414 with a Windows 2003 server. This will not interfere with other Windows clients that do not1415 support the more advanced security features of Windows 2003 because the client will simply1416 negotiate a protocol that both it and the server suppport. This is a well-known fall-back facility1417 that is built into the SMB/CIFS protocols.1418 </para>1419 1420 </sect2>1421 1422 1268 </sect1> 1423 1269 </chapter>
Note:
See TracChangeset
for help on using the changeset viewer.
