Changeset 988 for vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml
- Timestamp:
- Nov 24, 2016, 1:14:11 PM (9 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
vendor/current/docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml
r414 r988 21 21 22 22 <para> 23 <indexterm><primary>account backends</primary></indexterm>24 <indexterm><primary>password backends</primary></indexterm>25 <indexterm><primary>scalability</primary></indexterm>26 <indexterm><primary>ADS</primary></indexterm>27 Early releases of Samba-3 implemented new capability to work concurrently with multiple account backends. This28 capability was removed beginning with release of Samba 3.0.23. Commencing with Samba 3.0.23 it is possible to29 work with only one specified passwd backend.30 </para>31 32 <para>33 23 <indexterm><primary>passdb backend</primary></indexterm> 34 24 <indexterm><primary>smbpasswd</primary></indexterm> … … 68 58 <title>Features and Benefits</title> 69 59 70 <para>71 Samba-3 provides for complete backward compatibility with Samba-2.2.x functionality72 as follows:73 <indexterm><primary>SAM backend</primary><secondary>smbpasswd</secondary></indexterm>74 <indexterm><primary>SAM backend</primary><secondary>ldapsam_compat</secondary></indexterm>75 <indexterm><primary>encrypted passwords</primary></indexterm>76 </para>77 78 60 <sect2> 79 61 <title>Backward Compatibility Account Storage Systems</title> … … 121 103 </listitem> 122 104 </varlistentry> 123 124 <varlistentry><term>ldapsam_compat (Samba-2.2 LDAP Compatibility)</term>125 <listitem>126 <para>127 <indexterm><primary>ldapsam_compat</primary></indexterm>128 <indexterm><primary>Samba-2.2.x LDAP schema</primary></indexterm>129 <indexterm><primary>OpenLDAP backend</primary></indexterm>130 There is a password backend option that allows continued operation with131 an existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension.132 This option is provided primarily as a migration tool, although there is133 no reason to force migration at this time. This tool will eventually134 be deprecated.135 </para>136 </listitem>137 </varlistentry>138 105 </variablelist> 139 106 … … 144 111 145 112 <para> 146 Samba -3introduces a number of new password backend capabilities.113 Samba introduces a number of new password backend capabilities. 147 114 <indexterm><primary>SAM backend</primary><secondary>tdbsam</secondary></indexterm> 148 115 <indexterm><primary>SAM backend</primary><secondary>ldapsam</secondary></indexterm> … … 171 138 smbpasswd</emphasis> information plus the extended MS Windows NT/200x 172 139 SAM information into a binary format TDB (trivial database) file. 173 The inclusion of the extended information makes it possible for Samba -3140 The inclusion of the extended information makes it possible for Samba 174 141 to implement the same account and system access controls that are possible 175 142 with MS Windows NT4/200x-based systems. … … 203 170 <indexterm><primary>schema file</primary></indexterm> 204 171 <indexterm><primary>examples/LDAP</primary></indexterm> 205 Samba -3has a new and extended LDAP implementation that requires configuration172 Samba has a new and extended LDAP implementation that requires configuration 206 173 of OpenLDAP with a new format Samba schema. The new format schema file is 207 174 included in the <filename class="directory">examples/LDAP</filename> directory of the Samba distribution. … … 348 315 <note> 349 316 <para> 350 <indexterm><primary>Windows XP Home</primary></indexterm>317 <indexterm><primary>Windows Home edition</primary></indexterm> 351 318 <indexterm><primary>domain member</primary></indexterm> 352 319 <indexterm><primary>domain logons</primary></indexterm> 353 MS Windows XP Home does not have facilities to become a domain member, and itcannot participate in domain logons.320 MS Windows Home editions do not have facilities to become a domain member, and cannot participate in domain logons. 354 321 </para> 355 322 </note> … … 362 329 <listitem><para>Windows NT 3.5x.</para></listitem> 363 330 <listitem><para>Windows NT 4.0.</para></listitem> 364 <listitem><para>Windows 2000 Professional.</para></listitem> 365 <listitem><para>Windows 200x Server/Advanced Server.</para></listitem> 366 <listitem><para>Windows XP Professional.</para></listitem> 331 <listitem><para>Windows editions labeled Professional.</para></listitem> 332 <listitem><para>Windows editions labeled Server/Advanced Server.</para></listitem> 367 333 </itemizedlist> 368 334 … … 420 386 <indexterm><primary>SMB encryption</primary></indexterm> 421 387 Windows NT does not like talking to a server that does not support encrypted passwords. It will refuse to 422 browse the server if the server is also in user-level security mode. It will insist on prompting the user for388 browse the server. It will insist on prompting the user for 423 389 the password on each connection, which is very annoying. The only thing you can do to stop this is to use SMB 424 390 encryption. … … 515 481 <indexterm><primary>NFS</primary></indexterm> 516 482 <indexterm><primary>rsync</primary></indexterm> 517 Samba -3has a special facility that makes it possible to maintain identical UIDs and GIDs483 Samba has a special facility that makes it possible to maintain identical UIDs and GIDs 518 484 on all servers in a distributed network. A distributed network is one where there exists 519 485 a PDC, one or more BDCs, and/or one or more domain member servers. Why is this important? … … 1009 975 in compliance with government laws and regulations is clear to all. The <command>pdbedit</command> is 1010 976 currently the only Samba tool that provides the capacity to manage account and systems access controls 1011 and policies. During the remaining life-cycle of the Samba -3series it is possible the new tools may977 and policies. During the remaining life-cycle of the Samba series it is possible the new tools may 1012 978 be implemented to aid in this important area. 1013 979 </para> … … 1601 1567 <listitem><para>minimum password age = 7 days.</para></listitem> 1602 1568 <listitem><para>bad lockout attempt = 8 bad logon attempts.</para></listitem> 1603 <listitem><para>lockout duration = forever, account must be manually re enabled.</para></listitem>1569 <listitem><para>lockout duration = forever, account must be manually re-enabled.</para></listitem> 1604 1570 </orderedlist> 1605 1571 … … 1635 1601 Account policies must be set individually on each PDC and BDC. At this time (Samba 3.0.11 to Samba 3.0.14a) 1636 1602 account policies are not replicated automatically. This may be fixed before Samba 3.0.20 ships or some 1637 time there after. Please check the WHATSNEW.txt file in the Samba -3tarball for specific update notiations1603 time there after. Please check the WHATSNEW.txt file in the Samba tarball for specific update notiations 1638 1604 regarding this facility. 1639 1605 </para></warning> … … 1677 1643 <sect1> 1678 1644 <title>Password Backends</title> 1679 1680 <para>1681 <indexterm><primary>account database</primary></indexterm>1682 <indexterm><primary>SMB/CIFS server</primary></indexterm>1683 Samba offers flexibility in backend account database design. The flexibility is immediately obvious as one1684 begins to explore this capability. Recent changes to Samba (since 3.0.23) have removed the mulitple backend1685 feature in order to simplify problems that broke some installations. This removal has made the internal1686 operation of Samba-3 more consistent and predictable.1687 </para>1688 1689 <para>1690 <indexterm><primary>multiple backends</primary></indexterm>1691 <indexterm><primary>tdbsam databases</primary></indexterm>1692 Beginning with Samba 3.0.23 it is no longer possible to specify use of mulitple passdb backends. Earlier1693 versions of Samba-3 made it possible to specify multiple password backends, and even multiple1694 backends of the same type. The multiple passdb backend capability caused many problems with name to SID and1695 SID to name ID resolution. The Samba team wrestled with the challenges and decided that this feature needed1696 to be removed.1697 </para>1698 1645 1699 1646 <sect2> … … 2117 2064 dc: quenya 2118 2065 o: Quenya Org Network 2119 description: The Samba -3Network LDAP Example2066 description: The Samba Network LDAP Example 2120 2067 2121 2068 # Organizational Role for Directory Management … … 2194 2141 <indexterm><primary>secrets.tdb</primary></indexterm> 2195 2142 Before Samba can access the LDAP server, you need to store the LDAP admin password 2196 in the Samba -3<filename>secrets.tdb</filename> database by:2143 in the Samba <filename>secrets.tdb</filename> database by: 2197 2144 <indexterm><primary>smbpasswd</primary></indexterm> 2198 2145 <screen> … … 2324 2271 <indexterm><primary>Domain Groups</primary></indexterm> 2325 2272 <indexterm><primary>ADS</primary></indexterm> 2326 In Samba -3, the group management system is based on POSIX2273 In Samba, the group management system is based on POSIX 2327 2274 groups. This means that Samba makes use of the posixGroup ObjectClass. 2328 2275 For now, there is no NT-like group system management (global and local 2329 groups). Samba -3knows only about <constant>Domain Groups</constant>2330 and, unlike MS Windows 2000 and Active Directory, Samba -3does not2276 groups). Samba knows only about <constant>Domain Groups</constant> 2277 and, unlike MS Windows 2000 and Active Directory, Samba does not 2331 2278 support nested groups. 2332 2279 </para> … … 2591 2538 2592 2539 <para> 2593 Samba -3and later can update the non-Samba (LDAP) password stored with an account. When2540 Samba and later can update the non-Samba (LDAP) password stored with an account. When 2594 2541 using pam_ldap, this allows changing both UNIX and Windows passwords at once. 2595 2542 </para> … … 2659 2606 2660 2607 </sect2> 2661 2662 <sect2>2663 <title>Configuration of <parameter>auth methods</parameter></title>2664 2665 <para>2666 When explicitly setting an <smbconfoption name="auth methods"/> parameter,2667 <parameter>guest</parameter> must be specified as the first entry on the line &smbmdash;2668 for example, <smbconfoption name="auth methods">guest sam</smbconfoption>.2669 </para>2670 2671 </sect2>2672 2673 2608 </sect1> 2674 2609
Note:
See TracChangeset
for help on using the changeset viewer.
