Changeset 988 for vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml
- Timestamp:
- Nov 24, 2016, 1:14:11 PM (9 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml
r414 r988 145 145 146 146 <para> 147 The following functionalities are new to the Samba-3 release: 147 The following functionalities are an overview of some of the features 148 in the Samba-4 release: 148 149 </para> 149 150 … … 151 152 <listitem><para> 152 153 <indexterm><primary>account</primary><secondary>backend</secondary></indexterm> 153 Samba-3 supports the use of a choice of backends that may be used in which user, group and machine 154 accounts may be stored. Multiple passwd backends can be used in combination, either as additive backend 155 data sets, or as fail-over data sets. 154 Samba-4 supports the use of a choice of backends that may be used in which user, group and machine 155 accounts may be stored, but only when acting as a classic 156 (NT4) domain controller, 157 but not when it is acting as an Active Directory Domain Controller. 156 158 </para> 157 159 … … 163 165 <indexterm><primary>reliability</primary></indexterm> 164 166 An LDAP passdb backend confers the benefit that the account backend can be distributed and replicated, 165 which is of great value because it confers scalability and provides a high degree of reliability. 167 which is of great value because it confers scalability and 168 provides a high degree of reliability. This may be used when 169 Samba-4 is acting as an classic (NT4-like) domain controller, 170 but not when it is acting as an Active Directory Domain Controller. 166 171 </para></listitem> 167 172 … … 170 175 <indexterm><primary>trust account</primary><secondary>interdomain</secondary></indexterm> 171 176 <indexterm><primary>interoperability</primary></indexterm> 172 Windows NT4 domain trusts. Samba- 3supports workstation and server (machine) trust accounts. It also177 Windows NT4 domain trusts. Samba-4 supports workstation and server (machine) trust accounts. It also 173 178 supports Windows NT4 style interdomain trust accounts, which further assists in network scalability 174 and interoperability. 179 and interoperability, but only when itself is an classic 180 (NT4-like) domain controller. 175 181 </para></listitem> 176 182 … … 183 189 <indexterm><primary>network</primary><secondary>browsing</secondary></indexterm> 184 190 Operation without NetBIOS over TCP/IP, rather using the raw SMB over TCP/IP. Note, this is feasible 185 only when operating as a Microsoft active directory domain member server. When acting as a Samba domain 191 only when operating as a Microsoft active directory domain 192 member server. When acting as a Samba classic (NT4-like) domain 186 193 controller the use of NetBIOS is necessary to provide network browsing support. 187 194 </para></listitem> … … 191 198 <indexterm><primary>TCP port</primary></indexterm> 192 199 <indexterm><primary>session services</primary></indexterm> 193 Samba- 3provides NetBIOS name services (WINS), NetBIOS over TCP/IP (TCP port 139) session services, SMB over200 Samba-4 provides NetBIOS name services (WINS), NetBIOS over TCP/IP (TCP port 139) session services, SMB over 194 201 TCP/IP (TCP port 445) session services, and Microsoft compatible ONC DCE RPC services (TCP port 135) 195 202 services. 196 203 </para></listitem> 197 204 205 198 206 <listitem><para> 199 <indexterm><primary> Nexus.exe</primary></indexterm>200 Management of users and groups via the User Manager for Domains. This can be done on any MS Windows client201 using the <filename>Nexus.exe</filename> toolkit for Windows 9x/Me, or using the SRVTOOLS.EXE package for MS202 Windows NT4/200x/XP platforms. These packages are available from Microsoft's Web site.207 <indexterm><primary>kerberos</primary></indexterm> 208 <indexterm><primary>active directory</primary></indexterm> 209 Acting as a Windows 2000 active directory domain controller 210 (i.e., Kerberos and Active Directory). 203 211 </para></listitem> 204 212 205 213 <listitem><para> 206 Implements full Unicode support. This simplifies cross-locale internationalization support. It also opens up 207 the use of protocols that Samba-2.2.x had but could not use due to the need to fully support Unicode. 214 <indexterm><primary>MMC</primary></indexterm> 215 <indexterm><primary>SVRTOOLS.EXE</primary></indexterm> 216 <indexterm><primary>Microsoft management console</primary><see>MMC</see></indexterm> 217 The Windows 200x/XP Microsoft Management Console (MMC) can be 218 used to manage a Samba-4 server, when it is an Active 219 Directory Domain Controller. When acting as a classic (NT4) 220 domain controller, you 221 can use only the MS Windows NT4 Domain Server Manager and the MS Windows NT4 Domain User Manager. Both are 222 part of the SVRTOOLS.EXE package mentioned later. 208 223 </para></listitem> 209 224 </itemizedlist> 210 225 211 226 <para> 212 The following functionalities are not provided by Samba- 3:227 The following functionalities are not provided by Samba-4: 213 228 </para> 214 229 … … 218 233 <indexterm><primary>replication</primary></indexterm> 219 234 SAM replication with Windows NT4 domain controllers (i.e., a Samba PDC and a Windows NT BDC, or vice versa). 220 This means Samba cannot operate as a BDC when the PDC is Microsoft-based Windows NT PDC. Samba- 3can not235 This means Samba cannot operate as a BDC when the PDC is Microsoft-based Windows NT PDC. Samba-4 can not 221 236 participate in replication of account data to Windows PDCs and BDCs. 222 237 </para></listitem> 223 238 224 <listitem><para>225 <indexterm><primary>kerberos</primary></indexterm>226 <indexterm><primary>active directory</primary></indexterm>227 Acting as a Windows 2000 active directory domain controller (i.e., Kerberos and Active Directory). In point of228 fact, Samba-3 does have some Active Directory domain control ability that is at this time purely experimental.229 Active directory domain control is one of the features that is being developed in Samba-4, the next230 generation Samba release. At this time there are no plans to enable active directory domain control231 support during the Samba-3 series life-cycle.232 </para></listitem>233 234 <listitem><para>235 <indexterm><primary>MMC</primary></indexterm>236 <indexterm><primary>SVRTOOLS.EXE</primary></indexterm>237 <indexterm><primary>Microsoft management console</primary><see>MMC</see></indexterm>238 The Windows 200x/XP Microsoft Management Console (MMC) cannot be used to manage a Samba-3 server. For this you239 can use only the MS Windows NT4 Domain Server Manager and the MS Windows NT4 Domain User Manager. Both are240 part of the SVRTOOLS.EXE package mentioned later.241 </para></listitem>242 239 </itemizedlist> 243 240 244 241 <para> 245 <indexterm><primary>Windows XP Home edition</primary></indexterm>246 <indexterm><primary>LanMan</primary></indexterm>247 Windows 9x/Me/XP Home clients are not true members of a domain for reasons outlined in this chapter. The248 protocol for support of Windows 9x/Me-style network (domain) logons is completely different from NT4/Windows249 200x-type domain logons and has been officially supported for some time. These clients use the old LanMan250 network logon facilities that are supported in Samba since approximately the Samba-1.9.15 series.251 </para>252 253 <para>254 242 <indexterm><primary>group</primary><secondary>mapping</secondary></indexterm> 255 Samba -3implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated243 Samba implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated 256 244 to explain in a short space). This is discussed more fully in <link linkend="groupmapping">Group Mapping: MS 257 245 Windows and UNIX</link>. … … 262 250 <indexterm><primary>trust account</primary><secondary>machine</secondary></indexterm> 263 251 <indexterm><primary>machine account</primary></indexterm> 264 Samba- 3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store user and Machine Trust252 Samba-4, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store user and Machine Trust 265 253 Account information in a suitable backend data-store. Refer to <link linkend="machine-trust-accounts">MS 266 Windows Workstation/Server Machine Trust Accounts</link>. With Samba-3 there can be multiple backends for 267 this. A complete discussion of account database backends can be found in <link linkend="passdb">Account 254 Windows Workstation/Server Machine Trust Accounts</link>. A complete discussion of account database backends can be found in <link linkend="passdb">Account 268 255 Information Databases</link>. 269 256 </para> … … 323 310 system. It is often assumed that such a centralized system will use a single authentication infrastructure 324 311 that can be used by all information systems. The Microsoft Windows NT4 security domain architecture and the 325 Micr soft active directory service are often put forward as the ideal foundation for such a system. It is312 Microsoft active directory service are often put forward as the ideal foundation for such a system. It is 326 313 conceptually simple to install an external authentication agent on each of the disparate infromation systems 327 314 that can then use the Microsoft (NT4 domain or ads service) for user authentication and access control. The … … 426 413 Primary domain control, if it is to be scalable to meet the needs of large sites, must therefore be capable of 427 414 using LDAP. The rapid adoption of OpenLDAP, and Samba configurations that use it, is ample proof that the era 428 of the directory has started. Samba -3does not demand the use of LDAP, but the demand for a mechanism by which415 of the directory has started. Samba does not demand the use of LDAP, but the demand for a mechanism by which 429 416 user and group identity information can be distributed makes it an an unavoidable option. 430 417 </para> … … 434 421 <indexterm><primary>LDAP</primary></indexterm> 435 422 <indexterm><primary>e-Directory</primary></indexterm> 436 At this time, the use of Samba based BDCs, necessitates the use of LDAP. The most commonly used LDAP 423 At this time, the use of Samba based BDCs, necessitates the use of 424 either the Samba-4 Active Directory Domain controller or, for classic 425 (NT4-like)domains an LDAP backend. The most commonly used LDAP 437 426 implementation used by Samba sites is OpenLDAP. It is possible to use any standards compliant LDAP server. 438 427 Those known to work includes those manufactured by: IBM, CA, Novell (e-Directory), and others. … … 477 466 <indexterm><primary>authenticatior</primary></indexterm> 478 467 <indexterm><primary>synchronization</primary></indexterm> 468 <indexterm><primary>FSMO</primary></indexterm> 469 <indexterm><primary>Flexible Single Master Operator</primary><see>FSMO</see></indexterm> 479 470 <indexterm><primary>Security Account Manager</primary><see>SAM</see></indexterm> 480 471 In the case of MS Windows NT4-style domains, it is the PDC that initiates a new domain control database. 481 472 This forms a part of the Windows registry called the Security Account Manager (SAM). It plays a key 482 473 part in NT4-type domain user authentication and in synchronization of the domain authentication 483 database with BDCs. 484 </para> 485 486 <para> 487 <indexterm><primary>domain</primary><secondary>controller</secondary><tertiary>hierarchy</tertiary></indexterm> 488 <indexterm><primary>LDAP</primary></indexterm> 489 <indexterm><primary>account</primary><secondary>backend</secondary></indexterm> 490 <indexterm><primary>machine account</primary></indexterm> 491 With MS Windows 200x Server-based Active Directory domains, one domain controller initiates a potential 492 hierarchy of domain controllers, each with its own area of delegated control. The master domain 493 controller has the ability to override any downstream controller, but a downline controller has 494 control only over its downline. With Samba-3, this functionality can be implemented using an 495 LDAP-based user and machine account backend. 474 database with BDCs. With Active Directory domains, while some servers 475 may be a Flexible Single Master Operator (FSMO) role owner (and 476 therefore hold the monopoly for certain operations), it is in general 477 a distributed, multi-master replicated directory. 496 478 </para> 497 479 … … 499 481 <indexterm><primary>backend database</primary></indexterm> 500 482 <indexterm><primary>registry</primary></indexterm> 501 New to Samba-3 is the ability to use a backend database that holds the same type of data as the NT4-style SAM 502 database (one of the registry files)<footnote><para>See also <link linkend="passdb">Account Information 483 Samba-4 can use a backend database that holds the same type of data as the NT4-style SAM 484 database (one of the registry files). For BDC/BDC operations in a 485 classic domain, this functionality can be implemented using an 486 LDAP-based user and machine account backend. The Samba-4 Active 487 Directory Domain controller implements the required storage internally.<footnote><para>See also <link linkend="passdb">Account Information 503 488 Databases</link>.</para></footnote> 504 489 </para> … … 527 512 <indexterm><primary>demote</primary></indexterm> 528 513 A Windows NT4 BDC can be promoted to a PDC. If the PDC is online at the time that a BDC is promoted to PDC, 529 the previous PDC is automatically demoted to a BDC. With Samba -3, this is not an automatic operation; the PDC514 the previous PDC is automatically demoted to a BDC. With Samba, this is not an automatic operation; the PDC 530 515 and BDC must be manually configured, and other appropriate changes also need to be made. 531 516 </para> … … 548 533 </itemizedlist> 549 534 550 <note><para>551 <indexterm><primary>promote</primary></indexterm>552 Algin Technology LLC provide a commercial tool that makes it possible to promote a Windows NT4 standalone553 server to a PDC or a BDC, and also permits this process to be reversed. Refer to the <ulink554 url="http://utools.com/UPromote.asp">Algin</ulink> web site for further information.555 </para></note>556 557 535 <para> 558 536 <indexterm><primary>domain</primary><secondary>control</secondary><tertiary>role</tertiary></indexterm> 559 537 <indexterm><primary>native member</primary></indexterm> 560 Samba -3servers can readily be converted to and from domain controller roles through simple changes to the561 &smb.conf; file. Samba -3is capable of acting fully as a native member of a Windows 200x server Active538 Samba servers can readily be converted to and from domain controller roles through simple changes to the 539 &smb.conf; file. Samba is capable of acting fully as a native member of a Windows 200x server Active 562 540 Directory domain. 563 541 </para> … … 573 551 <indexterm><primary>replication</primary><secondary>SAM</secondary></indexterm> 574 552 <indexterm><primary>SAM</primary><secondary>replication</secondary></indexterm> 575 New to Samba -3is the ability to function fully as an MS Windows NT4-style domain controller,576 excluding the SAM replication components. However, please be aware that Samba -3also supports the553 New to Samba is the ability to function fully as an MS Windows NT4-style domain controller, 554 excluding the SAM replication components. However, please be aware that Samba also supports the 577 555 MS Windows 200x domain control protocols. 578 556 </para> 579 580 <para>581 <indexterm><primary>ADS</primary></indexterm>582 At this time any appearance that Samba-3 is capable of acting as a <emphasis>domain controller</emphasis> in583 native ADS mode is limited and experimental in nature. This functionality should not be used until the Samba584 Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all585 configuration and management requirements. Samba can act as a NT4-style domain controller in a Windows 2000/XP586 environment. However, there are certain compromises:587 </para>588 589 <itemizedlist>590 <listitem><para>No machine policy files.</para></listitem>591 <listitem><para>No Group Policy Objects.</para></listitem>592 <listitem><para>No synchronously executed Active Directory logon scripts.</para></listitem>593 <listitem><para>Can't use Active Directory management tools to manage users and machines.</para></listitem>594 <listitem><para>Registry changes tattoo the main registry, while with Active Directory they do not leave595 permanent changes in effect.</para></listitem>596 <listitem><para>Without Active Directory you cannot perform the function of exporting specific597 applications to specific users or groups.</para></listitem>598 </itemizedlist>599 557 600 558 </sect2> … … 647 605 648 606 <para> 649 The following are necessary for configuring Samba -3as an MS Windows NT4-style PDC for MS Windows607 The following are necessary for configuring Samba as an MS Windows NT4-style PDC for MS Windows 650 608 NT4/200x/XP clients: 651 609 </para> … … 663 621 </itemizedlist> 664 622 665 <para>666 The following provisions are required to serve MS Windows 9x/Me clients:667 </para>668 669 <itemizedlist>670 <listitem><para>Configuration of basic TCP/IP and MS Windows networking.</para></listitem>671 <listitem><para>Correct designation of the server role (<smbconfoption name="security">user</smbconfoption>).</para></listitem>672 <listitem><para>Network logon configuration (since Windows 9x/Me/XP Home are not technically domain673 members, they do not really participate in the security aspects of Domain logons as such).</para></listitem>674 <listitem><para>Roaming profile configuration.</para></listitem>675 <listitem><para>Configuration of system policy handling.</para></listitem>676 <listitem><para>Installation of the network driver <quote>Client for MS Windows Networks</quote> and configuration677 to log onto the domain.</para></listitem>678 <listitem><para>Placing Windows 9x/Me clients in user-level security &smbmdash; if it is desired to allow679 all client-share access to be controlled according to domain user/group identities.</para></listitem>680 <listitem><para>Adding and managing domain user accounts.</para></listitem>681 </itemizedlist>682 683 623 <note><para> 684 624 <indexterm><primary>roaming profiles</primary></indexterm> … … 727 667 It is rather easy to configure Samba to provide these. Each Samba domain controller must provide the NETLOGON 728 668 service that Samba calls the <smbconfoption name="domain logons"/> functionality (after the name of the 729 parameter in the &smb.conf; file). Additionally, one server in a Samba -3domain must advertise itself as the669 parameter in the &smb.conf; file). Additionally, one server in a Samba domain must advertise itself as the 730 670 domain master browser.<footnote><para>See <link linkend="NetworkBrowsing">Network 731 671 Browsing</link>.</para></footnote> This causes the PDC to claim a domain-specific NetBIOS name that identifies … … 755 695 <smbconfoption name="workgroup"><replaceable>&example.workgroup;</replaceable></smbconfoption> 756 696 <smbconfoption name="passdb backend">tdbsam</smbconfoption> 757 <smbconfoption name="os level">33</smbconfoption>758 <smbconfoption name="preferred master">auto</smbconfoption>759 <smbconfoption name="domain master">yes</smbconfoption>760 <smbconfoption name="local master">yes</smbconfoption>761 697 <smbconfoption name="security">user</smbconfoption> 762 698 <smbconfoption name="domain logons">yes</smbconfoption> … … 810 746 <varlistentry><term>Domain Control Parameters </term> 811 747 <listitem><para> 812 <indexterm><primary>os level</primary></indexterm>813 <indexterm><primary>preferred master</primary></indexterm>814 <indexterm><primary>domain master</primary></indexterm>815 748 <indexterm><primary>network</primary><secondary>logon</secondary></indexterm> 816 The parameters <emphasis> os level, preferred master, domain master, security,817 encrypt passwords</emphasis>, and <emphasis>domain logons</emphasis> play a central role in assuring domain749 The parameters <emphasis>domain logons</emphasis> 750 parameter is the key parameter indicating domain 818 751 control and network logon support. 819 </para>820 821 <para>822 <indexterm><primary>DMB</primary></indexterm>823 <indexterm><primary>encryped password</primary></indexterm>824 The <emphasis>os level</emphasis> must be set at or above a value of 32. A domain controller825 must be the DMB, must be set in <emphasis>user</emphasis> mode security,826 must support Microsoft-compatible encrypted passwords, and must provide the network logon827 service (domain logons). Encrypted passwords must be enabled. For more details on how828 to do this, refer to <link linkend="passdb">Account Information Databases</link>.829 752 </para></listitem> 830 753 </varlistentry> … … 867 790 This share is used to store user desktop profiles. Each user must have a directory at the root 868 791 of this share. This directory must be write-enabled for the user and must be globally read-enabled. 869 Samba -3has a VFS module called <quote>fake_permissions</quote> that may be installed on this share. This will792 Samba has a VFS module called <quote>fake_permissions</quote> that may be installed on this share. This will 870 793 allow a Samba administrator to make the directory read-only to everyone. Of course this is useful 871 794 only after the profile has been properly created. … … 884 807 <smbconfoption name="workgroup">&example.workgroup;</smbconfoption> 885 808 <smbconfoption name="domain logons">Yes</smbconfoption> 886 <smbconfoption name="domain master">Yes</smbconfoption>887 809 <smbconfoption name="security">User</smbconfoption> 888 810 </smbconfblock> … … 901 823 <para> 902 824 <indexterm><primary>active directory</primary></indexterm> 903 Samba-3 is not, and cannot act as, an Active Directory server. It cannot truly function as an Active Directory 904 PDC. The protocols for some of the functionality of Active Directory domain controllers has been partially 905 implemented on an experimental only basis. Please do not expect Samba-3 to support these protocols. Do not 906 depend on any such functionality either now or in the future. The Samba Team may remove these experimental 907 features or may change their behavior. This is mentioned for the benefit of those who have discovered secret 908 capabilities in Samba-3 and who have asked when this functionality will be completed. The answer is maybe 909 someday or maybe never! 825 Samba-4 is also available as an Active Directory server. It can truly function as an Active Directory 826 PDC. The protocols for some of the functionality of Active Directory 827 domain controllers has been implemented. 910 828 </para> 911 829 … … 913 831 <indexterm><primary>domain controllers</primary></indexterm> 914 832 <indexterm><primary>active directory</primary></indexterm> 915 To be sure, Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4-style 916 domain controllers have. Samba-3 does not have all the capabilities of Windows NT4, but it does have 917 a number of features that Windows NT4 domain controllers do not have. In short, Samba-3 is not NT4 and it 918 is not Windows Server 200x: it is not an Active Directory server. We hope this is plain and simple 919 enough for all to understand. 833 <indexterm><primary>classic domain support</primary></indexterm> 834 To be sure, Samba-4 is also designed to provide most of the functionality that Microsoft Windows NT4-style 835 domain controllers have. Samba-4 does not have all the capabilities of Windows NT4, but it does have 836 a number of features that Windows NT4 domain controllers do not 837 have. We call it a <emphasis>classic domain</emphasis> controller for 838 this reason, as in short, Samba-4 when acting in this mode is not NT4, 839 and the Active Directory Domain Control aspect is a distinct capability. 920 840 </para> 921 841 … … 937 857 <indexterm><primary>domain logon</primary></indexterm> 938 858 All domain controllers must run the netlogon service (<emphasis>domain logons</emphasis> 939 in Samba). One domain controller must be configured with <smbconfoption name="domain master">Yes</smbconfoption> 859 in Samba). One domain controller must be configured without the 860 <smbconfoption name="domain master"></smbconfoption> parameter 940 861 (the PDC); on all BDCs set the parameter <smbconfoption name="domain master">No</smbconfoption>. 941 862 </para> … … 949 870 <smbconfsection name="[global]"/> 950 871 <smbconfoption name="domain logons">Yes</smbconfoption> 951 <smbconfoption name="domain master">( Yeson PDC, No on BDCs)</smbconfoption>872 <smbconfoption name="domain master">(omit on PDC, No on BDCs)</smbconfoption> 952 873 953 874 <smbconfsection name="[netlogon]"/> … … 961 882 </sect3> 962 883 <sect3> 963 <title>The Special Case of MS Windows XP Home Edition</title>964 965 <para> 966 <indexterm><primary>Windows XP Home edition</primary></indexterm>967 To be completely clear: If you want MS Windows XP Home Editionto integrate with your884 <title>The Special Case of MS Windows Home Editions</title> 885 886 <para> 887 <indexterm><primary>Windows Home editions</primary></indexterm> 888 To be completely clear: If you want MS Windows Home Editions to integrate with your 968 889 MS Windows NT4 or Active Directory domain security, understand it cannot be done. 969 The only option is to purchase the upgrade from MS Windows XPHome Edition to970 MS Windows XP Professional.890 The only option is to purchase the upgrade from MS Windows Home Edition to 891 a MS Windows Professional edition. 971 892 </para> 972 893 973 894 <note><para> 974 MS Windows XP Home Edition doesnot have the ability to join any type of domain975 security facility. Unlike MS Windows 9x/Me, MS Windows XP Home Edition also completely976 lacks the ability to log onto a network.895 MS Windows Home Editions do not have the ability to join any type of domain 896 security facility. Unlike MS Windows 9x/Me, MS Windows Home Edition 897 deliberatly lacks the ability to log onto a network. 977 898 </para></note> 978 899 … … 986 907 </sect3> 987 908 988 <sect3>989 <title>The Special Case of Windows 9x/Me</title>990 991 <para>992 <indexterm><primary>domain</primary></indexterm>993 <indexterm><primary>workgroup</primary></indexterm>994 <indexterm><primary>authentication</primary></indexterm>995 <indexterm><primary>browsing</primary></indexterm>996 <indexterm><primary>rights</primary></indexterm>997 A domain and a workgroup are exactly the same in terms of network998 browsing. The difference is that a distributable authentication999 database is associated with a domain, for secure login access to a1000 network. Also, different access rights can be granted to users if they1001 successfully authenticate against a domain logon server. Samba-3 does this1002 now in the same way as MS Windows NT/200x.1003 </para>1004 1005 <para>1006 <indexterm><primary>browsing</primary></indexterm>1007 The SMB client logging on to a domain has an expectation that every other1008 server in the domain should accept the same authentication information.1009 Network browsing functionality of domains and workgroups is identical and1010 is explained in this documentation under the browsing discussions.1011 It should be noted that browsing is totally orthogonal to logon support.1012 </para>1013 1014 <para>1015 <indexterm><primary>single-logon</primary></indexterm>1016 <indexterm><primary>domain logons</primary></indexterm>1017 <indexterm><primary>network logon</primary></indexterm>1018 Issues related to the single-logon network model are discussed in this1019 section. Samba supports domain logons, network logon scripts, and user1020 profiles for MS Windows for Workgroups and MS Windows 9x/Me clients,1021 which are the focus of this section.1022 </para>1023 1024 <para>1025 <indexterm><primary>broadcast request</primary></indexterm>1026 When an SMB client in a domain wishes to log on, it broadcasts requests for a logon server. The first one to1027 reply gets the job and validates its password using whatever mechanism the Samba administrator has installed.1028 It is possible (but ill advised) to create a domain where the user database is not shared between servers;1029 that is, they are effectively workgroup servers advertising themselves as participating in a domain. This1030 demonstrates how authentication is quite different from but closely involved with domains.1031 </para>1032 1033 <para>1034 Using these features, you can make your clients verify their logon via1035 the Samba server, make clients run a batch file when they log on to1036 the network and download their preferences, desktop, and start menu.1037 </para>1038 1039 <para><emphasis>1040 MS Windows XP Home edition is not able to join a domain and does not permit the use of domain logons.1041 </emphasis></para>1042 1043 <para>1044 Before launching into the configuration instructions, it is worthwhile to look at how a Windows 9x/Me client1045 performs a logon:1046 </para>1047 1048 <orderedlist>1049 <listitem>1050 <para>1051 <indexterm><primary>DOMAIN<1C></primary></indexterm>1052 <indexterm><primary>logon server</primary></indexterm>1053 The client broadcasts (to the IP broadcast address of the subnet it is in)1054 a NetLogon request. This is sent to the NetBIOS name DOMAIN<1C> at the1055 NetBIOS layer. The client chooses the first response it receives, which1056 contains the NetBIOS name of the logon server to use in the format of1057 <filename>\\SERVER</filename>. The <literal>1C</literal> name is the name1058 type that is registered by domain controllers (SMB/CIFS servers that provide1059 the netlogon service).1060 </para>1061 </listitem>1062 1063 <listitem>1064 <para>1065 <indexterm><primary>IPC$</primary></indexterm>1066 <indexterm><primary>SMBsessetupX</primary></indexterm>1067 <indexterm><primary>SMBtconX</primary></indexterm>1068 The client connects to that server, logs on (does an SMBsessetupX) and1069 then connects to the IPC$ share (using an SMBtconX).1070 </para>1071 </listitem>1072 1073 <listitem>1074 <para>1075 <indexterm><primary>NetWkstaUserLogon</primary></indexterm>1076 The client does a NetWkstaUserLogon request, which retrieves the name1077 of the user's logon script.1078 </para>1079 </listitem>1080 1081 <listitem>1082 <para>1083 The client then connects to the NetLogon share and searches for said script.1084 If it is found and can be read, it is retrieved and executed by the client.1085 After this, the client disconnects from the NetLogon share.1086 </para>1087 </listitem>1088 1089 <listitem>1090 <para>1091 <indexterm><primary>NetUserGetInfo</primary></indexterm>1092 <indexterm><primary>profile</primary></indexterm>1093 The client sends a NetUserGetInfo request to the server to retrieve1094 the user's home share, which is used to search for profiles. Since the1095 response to the NetUserGetInfo request does not contain much more than1096 the user's home share, profiles for Windows 9x clients must reside in the user1097 home directory.1098 </para>1099 </listitem>1100 1101 <listitem>1102 <para>1103 <indexterm><primary>profiles</primary></indexterm>1104 The client connects to the user's home share and searches for the1105 user's profile. As it turns out, you can specify the user's home share as1106 a share name and path. For example, <filename>\\server\fred\.winprofile</filename>.1107 If the profiles are found, they are implemented.1108 </para>1109 </listitem>1110 1111 <listitem>1112 <para>1113 <indexterm><primary>CONFIG.POL</primary></indexterm>1114 The client then disconnects from the user's home share and reconnects to1115 the NetLogon share and looks for <filename>CONFIG.POL</filename>, the policies file. If this is1116 found, it is read and implemented.1117 </para>1118 </listitem>1119 </orderedlist>1120 1121 <para>1122 The main difference between a PDC and a Windows 9x/Me logon server configuration is:1123 </para>1124 1125 <itemizedlist>1126 <listitem><para>1127 <indexterm><primary>password</primary><secondary>plaintext</secondary></indexterm>1128 <indexterm><primary>plaintext password</primary></indexterm>1129 Password encryption is not required for a Windows 9x/Me logon server. But note1130 that beginning with MS Windows 98 the default setting is that plaintext1131 password support is disabled. It can be re-enabled with the registry1132 changes that are documented in <link linkend="PolicyMgmt">System and Account Policies</link>.1133 </para></listitem>1134 1135 <listitem><para>1136 <indexterm><primary>machine trust account</primary></indexterm>1137 Windows 9x/Me clients do not require and do not use Machine Trust Accounts.1138 </para></listitem>1139 </itemizedlist>1140 1141 <para>1142 <indexterm><primary>network logon services</primary></indexterm>1143 A Samba PDC will act as a Windows 9x/Me logon server; after all, it does provide the1144 network logon services that MS Windows 9x/Me expect to find.1145 </para>1146 1147 <note><para>1148 <indexterm><primary>sniffer</primary></indexterm>1149 Use of plaintext passwords is strongly discouraged. Where used they are easily detected1150 using a sniffer tool to examine network traffic.1151 </para></note>1152 1153 </sect3>1154 909 </sect2> 1155 910 … … 1338 1093 that the account name is the machine NetBIOS name with a <quote>$</quote> appended to it (i.e., 1339 1094 computer_name$). There must be an entry in both the POSIX UNIX system account backend as well as in the 1340 SambaSAMAccount backend. The default backend for Samba -3(i.e., the parameter <parameter>passdb1095 SambaSAMAccount backend. The default backend for Samba (i.e., the parameter <parameter>passdb 1341 1096 backend</parameter> is not specified in the &smb.conf; file, or if specified is set to 1342 1097 <literal>smbpasswd</literal>, are respectively the <filename>/etc/passwd</filename> and … … 1385 1140 effect that the domain controller cannot be found; the other claims that the account does not 1386 1141 exist in the domain or that the password is incorrect. This may be due to incompatible 1387 settings between the Windows client and the Samba -3server for <emphasis>schannel</emphasis>1142 settings between the Windows client and the Samba server for <emphasis>schannel</emphasis> 1388 1143 (secure channel) settings or <emphasis>smb signing</emphasis> settings. Check your Samba 1389 1144 settings for <emphasis>client schannel</emphasis>, <emphasis>server schannel</emphasis>, … … 1401 1156 1402 1157 <para> 1403 It is important that these be set consistently with the Samba -3server settings.1158 It is important that these be set consistently with the Samba server settings. 1404 1159 </para> 1405 1160
Note:
See TracChangeset
for help on using the changeset viewer.
