diff options
| -rw-r--r-- | docs/Samba3-ByExample/SBE-preface.xml | 28 | ||||
| -rw-r--r-- | docs/Samba3-HOWTO/TOSHARG-Passdb.xml | 461 |
2 files changed, 470 insertions, 19 deletions
diff --git a/docs/Samba3-ByExample/SBE-preface.xml b/docs/Samba3-ByExample/SBE-preface.xml index 787e6ece20..d9d9cb9492 100644 --- a/docs/Samba3-ByExample/SBE-preface.xml +++ b/docs/Samba3-ByExample/SBE-preface.xml @@ -551,7 +551,33 @@ avoid Samba configuration options that will weigh the server down. MS distributed file services to make your network fly and much more. This chapter contains a good deal of <quote>Did I tell you about this...?</quote> type of hints to help keep your name on the top - performers list. (John, should there be entries for Chapter 14 and Apps A & C ???????) + performers list. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>Chapter 14 &smbmdash; Samba Support.</term><listitem> + <para> + This chapter has been added specifically to help those who are seeking professional + paid support for Samba. The critics of Open Source Software often assert that + there is no support for free software. Some critics argue that free software + undermines the service that proprietary commercial software vendors depend on. + This chapter explains what are the support options for Samba and the fact that + a growing number of businesses make money by providing commercial paid-for + Samba support. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>Appendix A &smbmdash; A Collection of Useful Tid-bits.</term><listitem> + <para> + Sometimes it seems that there is not a good place for certain odds and ends that + impact Samba deployment. Some readers would argue that everyone can be expected + to know this information, or at least be able to find it easily. So to avoid + offending a reader's sensitivities, the tid-bits have been placed in this Appendix. + Do check out the contents, you may find something of value among the loose ends. </para> </listitem> </varlistentry> diff --git a/docs/Samba3-HOWTO/TOSHARG-Passdb.xml b/docs/Samba3-HOWTO/TOSHARG-Passdb.xml index 5d2607f885..4ff0e842de 100644 --- a/docs/Samba3-HOWTO/TOSHARG-Passdb.xml +++ b/docs/Samba3-HOWTO/TOSHARG-Passdb.xml @@ -902,7 +902,7 @@ is being added to the <command>net</command> toolset (see <link linkend="NetComm </para> <sect2> - <title>The <command>smbpasswd</command> Utility</title> + <title>The <command>smbpasswd</command> Tool</title> <para> <indexterm><primary>smbpasswd</primary></indexterm> @@ -1003,36 +1003,164 @@ is being added to the <command>net</command> toolset (see <link linkend="NetComm </sect2> <sect2 id="pdbeditthing"> - <title>The <command>pdbedit</command> Utility</title> + <title>The <command>pdbedit</command> Tool</title> <para> <indexterm><primary>pdbedit</primary></indexterm> <indexterm><primary>User Management</primary></indexterm> + <indexterm><primary>account policy</primary></indexterm> <indexterm><primary>User Accounts</primary><secondary>Adding/Deleting</secondary></indexterm> <command>pdbedit</command> is a tool that can be used only by root. It is used to - manage the passdb backend. <command>pdbedit</command> can be used to: + manage the passdb backend, as well as domain-wide account policy settings. <command>pdbedit</command> + can be used to: </para> <itemizedlist> <listitem><para>add, remove, or modify user accounts.</para></listitem> <listitem><para>list user accounts.</para></listitem> <listitem><para>migrate user accounts.</para></listitem> + <listitem><para>migrate group accounts.</para></listitem> + <listitem><para>manage account policies.</para></listitem> + <listitem><para>manage domain access policy settings.</para></listitem> </itemizedlist> <para> - Domain global policy controls available include: + <indexterm><primary>Sarbanes-Oxley</primary></indexterm> + Under the terms of the Sarbanes-Oxley Act of 2002, American businessies and organizations are mandated to + implement a series of <literal>internal controls</literal> and procedures to communicate, store, + and protect financial data. The Sarbanes-Oxley Act has far reaching implications in respect of: </para> - <itemizedlist> - <listitem><para>Maximum Password Age</para></listitem> - <listitem><para>Minimum Password Age</para></listitem> - <listitem><para>Mimimum Password Length</para></listitem> - <listitem><para>Password Uniqueness (remembers number of prior passwords)</para></listitem> - <listitem><para>Account Lockout</para></listitem> - <listitem><para>Bad Logon Attempts</para></listitem> - <listitem><para>Lockout Reset Delay</para></listitem> - <listitem><para>Lockout Duration</para></listitem> - </itemizedlist> + <orderedlist> + <listitem><para>Who has access to information systems that store financial data.</para></listitem> + <listitem><para>How personal and finacial information is treated among employees and business + partners.</para></listitem> + <listitem><para>How security vulnerabilities are managed.</para></listitem> + <listitem><para>Security and patch level maintenance for all information systems.</para></listitem> + <listitem><para>How information systems changes are documented and tracked.</para></listitem> + <listitem><para>How information access controls are implemented and managed.</para></listitem> + <listitem><para>Auditability of all information systems in respect of change and security.</para></listitem> + <listitem><para>Disciplinary procedures and controls to ensure privacy.</para></listitem> + </orderedlist> + + <para> + <indexterm><primary>accountability</primary></indexterm> + <indexterm><primary>compliance</primary></indexterm> + In short, the Sarbanes-Oxley Act of 2002 is an instrument that enforces accountability in respect of + business related information systems so as to ensure the compliance of all information systems that + are used to store personal information and particularly for financial records processing. Similar + accountabilities are being demanded around the world. + </para> + + <para> + <indexterm><primary>laws</primary></indexterm> + <indexterm><primary>regulations</primary></indexterm> + <indexterm><primary>pdbedit</primary></indexterm> + <indexterm><primary>access controls</primary></indexterm> + <indexterm><primary>manage accounts</primary></indexterm> + The need to be familiar with the Samba tools and facilities that permit information systems operation + in compliance with government laws and regulations is clear to all. The <command>pdbedit</command> is + currently the only Samba tool that provides the capacity to manage account and systems access controls + and policies. During the remaining life-cycle of the Samba-3 series it is possible the new tools may + be implemented to aid in this important area. + </para> + + <para> + Domain global policy controls available in Windows NT4 compared with Samba + is shown in <link linkend="policycontrols">NT4 Domain v's Samba Policy Controls</link>. + </para> + + <table id="policycontrols"> + <title>NT4 Domain v's Samba Policy Controls</title> + <tgroup cols="5"> + <colspec align="left" colwidth="2*"/> + <colspec align="left" colwidth="2*"/> + <colspec align="center" colwidth="1*"/> + <colspec align="center" colwidth="1*"/> + <colspec align="center" colwidth="1*"/> + <thead> + <row> + <entry><para>NT4 policy Name</para></entry> + <entry><para>Samba Policy Name</para></entry> + <entry><para>NT4 Range</para></entry> + <entry><para>Samba Range</para></entry> + <entry><para>Samba Default</para></entry> + </row> + </thead> + <tbody> + <row> + <entry><para>Maximum Password Age</para></entry> + <entry><para>maximum password age</para></entry> + <entry><para>0 - 999 (days)</para></entry> + <entry><para>0 - 4294967295 (sec)</para></entry> + <entry><para>4294967295</para></entry> + </row> + <row> + <entry><para>Minimum Password Age</para></entry> + <entry><para>minimum password age</para></entry> + <entry><para>0 - 999 (days)</para></entry> + <entry><para>0 - 4294967295 (sec)</para></entry> + <entry><para>0</para></entry> + </row> + <row> + <entry><para>Mimimum Password Length</para></entry> + <entry><para>min password length</para></entry> + <entry><para>1 - 14 (Chars)</para></entry> + <entry><para>0 - 4294967295 (Chars)</para></entry> + <entry><para>5</para></entry> + </row> + <row> + <entry><para>Password Uniqueness</para></entry> + <entry><para>password history</para></entry> + <entry><para>0 - 23 (#)</para></entry> + <entry><para>0 - 4294967295 (#)</para></entry> + <entry><para>0</para></entry> + </row> + <row> + <entry><para>Account Lockout - Reset count after</para></entry> + <entry><para>reset count minutes</para></entry> + <entry><para>1 - 99998 (min)</para></entry> + <entry><para>0 - 4294967295 (min)</para></entry> + <entry><para>30</para></entry> + </row> + <row> + <entry><para>Lockout after bad logon attempts</para></entry> + <entry><para>bad lockout attempt</para></entry> + <entry><para>0 - 998 (#)</para></entry> + <entry><para>0 - 4294967295 (#)</para></entry> + <entry><para>0</para></entry> + </row> + <row> + <entry><para>*** Not Known ***</para></entry> + <entry><para>disconnect time</para></entry> + <entry><para>TBA</para></entry> + <entry><para>0 - 4294967295</para></entry> + <entry><para>0</para></entry> + </row> + <row> + <entry><para>Lockout Duration</para></entry> + <entry><para>lockout duration</para></entry> + <entry><para>1 - 99998 (min)</para></entry> + <entry><para>0 - 4294967295 (min)</para></entry> + <entry><para>30</para></entry> + </row> + <row> + <entry><para>Users must log on in order to change password</para></entry> + <entry><para>user must logon to change password</para></entry> + <entry><para>0/1</para></entry> + <entry><para>0 - 4294967295</para></entry> + <entry><para>0</para></entry> + </row> + <row> + <entry><para>*** Registry Setting ***</para></entry> + <entry><para>refuse machine password change</para></entry> + <entry><para>0/1</para></entry> + <entry><para>0 - 4294967295</para></entry> + <entry><para>0</para></entry> + </row> + </tbody> + </tgroup> + </table> <para> <indexterm><primary>pdbedit</primary></indexterm> @@ -1053,17 +1181,47 @@ is being added to the <command>net</command> toolset (see <link linkend="NetComm <link linkend="XMLpassdb">XML</link> password backend section of this chapter. </para> + <sect3> + <title>User Account Management</title> + + <para> +<indexterm><primary>pdbedit</primary></indexterm> +<indexterm><primary>smbpasswd</primary></indexterm> +<indexterm><primary>system accounts</primary></indexterm> +<indexterm><primary>user account</primary></indexterm> +<indexterm><primary>domain user manager</primary></indexterm> +<indexterm><primary>add user script</primary></indexterm> +<indexterm><primary>interface scripts</primary></indexterm> + The <command>pdbedit</command> tool, like the <command>smbpasswd</command> tool, requires + that a POSIX user account already exists in the UNIX/Linux system accounts database (backend). + Neither tool will call out to the operating system to create a user account because this is + considered to be the responsibility of the system administrator. When the Windows NT4 domain + user manager is used to add an account, Samba will implement the <literal>add user script</literal> + (as well as the other interface scripts) to ensure that user, group and machine accounts are + correctly created and changed. The use of the <command>pdbedit</command> tool does not + make use of these interface scripts. + </para> + + <para> +<indexterm><primary>pdbedit</primary></indexterm> +<indexterm><primary>POSIX account</primary></indexterm> + Before attempting to use the <command>pdbedit</command> tool to manage user and machine + accounts, make certain that a system (POSIX) account has already been created. + </para> + + <sect4> + <title>Listing User and Machine Accounts</title> + <para> <indexterm><primary>tdbsam</primary></indexterm> +<indexterm><primary>password backend</primary></indexterm> The following is an example of the user account information that is stored in a tdbsam password backend. This listing was produced by running: - </para> - <screen> &prompt;<userinput>pdbedit -Lv met</userinput> UNIX username: met -NT username: -Account Flags: [UX ] +NT username: met +Account Flags: [U ] User SID: S-1-5-21-1449123459-1407424037-3116680435-2004 Primary Group SID: S-1-5-21-1449123459-1407424037-3116680435-1201 Full Name: Melissa E Terpstra @@ -1082,6 +1240,272 @@ Password last set: Sat, 14 Dec 2002 14:37:03 GMT Password can change: Sat, 14 Dec 2002 14:37:03 GMT Password must change: Mon, 18 Jan 2038 20:14:07 GMT </screen> + </para> + + <para> +<indexterm><primary>smbpasswd format</primary></indexterm> + Accounts can also be listed in the older <literal>smbpasswd</literal> format: +<screen> +&rootprompt;<userinput>pdbedit -Lw</userinput> +root:0:84B0D8E14D158FF8417EAF50CFAC29C3: + AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[U ]:LCT-42681AB8: +jht:1000:6BBC4159020A52741486235A2333E4D2: + CC099521AD554A3C3CF2556274DBCFBC:[U ]:LCT-40D75B5B: +rcg:1002:E95D4331A6F23AF8AAD3B435B51404EE: + BB0F2C39B04CA6100F0E535DF8314B43:[U ]:LCT-40D7C5A3: +afw:1003:1AAFA7F9F6DC1DEAAAD3B435B51404EE: + CE92C2F9471594CDC4E7860CA6BC62DB:[T ]:LCT-40DA501F: +met:1004:A2848CB7E076B435AAD3B435B51404EE: + F25F5D3405085C555236B80B7B22C0D2:[U ]:LCT-4244FAB8: +aurora$:1005:060DE593EA638B8ACC4A19F14D2FF2BB: + 060DE593EA638B8ACC4A19F14D2FF2BB:[W ]:LCT-4173E5CC: +temptation$:1006:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: + A96703C014E404E33D4049F706C45EE9:[W ]:LCT-42BF0C57: +vaioboss$:1001:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: + 88A30A095160072784C88F811E89F98A:[W ]:LCT-41C3878D: +frodo$:1008:15891DC6B843ECA41249940C814E316B: + B68EADCCD18E17503D3DAD3E6B0B9A75:[W ]:LCT-42B7979F: +marvel$:1011:BF709959C3C94E0B3958B7B84A3BB6F3: + C610EFE9A385A3E8AA46ADFD576E6881:[W ]:LCT-40F07A4 +</screen> + </para> + + </sect4> + + <sect4> + <title>Adding User Accounts</title> + + <para> +<indexterm><primary>pdbedit</primary></indexterm> +<indexterm><primary>add a user account</primary></indexterm> +<indexterm><primary>standalone server</primary></indexterm> +<indexterm><primary>domain</primary></indexterm> +<indexterm><primary>SambaSAMAccount</primary></indexterm> + The <command>pdbedit</command> can be used to add a user account to a standalone server + or to a domain. In the example shown here the account for the user <literal>vlaan</literal> + has been created before attempting to add the SambaSAMAccount. +<screen> +&rootprompt; pdbedit -a vlaan +new password: secretpw +retype new password: secretpw +Unix username: vlaan +NT username: vlaan +Account Flags: [U ] +User SID: S-1-5-21-726309263-4128913605-1168186429-3014 +Primary Group SID: S-1-5-21-726309263-4128913605-1168186429-513 +Full Name: Victor Laan +Home Directory: \\frodo\vlaan +HomeDir Drive: H: +Logon Script: scripts\logon.bat +Profile Path: \\frodo\profiles\vlaan +Domain: &example.workgroup; +Account desc: Guest User +Workstations: +Munged dial: +Logon time: 0 +Logoff time: Mon, 18 Jan 2038 20:14:07 GMT +Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT +Password last set: Wed, 29 Jun 2005 19:35:12 GMT +Password can change: Wed, 29 Jun 2005 19:35:12 GMT +Password must change: Mon, 18 Jan 2038 20:14:07 GMT +Last bad password : 0 +Bad password count : 0 +Logon hours : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF +</screen> + </para> + + </sect4> + + <sect4> + <title>Deleting Accounts</title> + + <para> +<indexterm><primary>account deleted</primary></indexterm> +<indexterm><primary>SambaSAMAccount</primary></indexterm> +<indexterm><primary>pdbedit</primary></indexterm> +<indexterm><primary>passdb backend</primary></indexterm> + An account can be deleted from the SambaSAMAccount database +<screen> +&rootprompt; pdbedit -x vlaan +</screen> + The account is removed without further screen output. The account is removed only from the + SambaSAMAccount (passdb backend) database, it is not removed from the UNIX account backend. + </para> + + <para> +<indexterm><primary>delete user script</primary></indexterm> +<indexterm><primary>pdbedit</primary></indexterm> + The use of the NT4 domain user manager to delete an account will trigger the <parameter>delete user + script</parameter>, but not the <command>pdbedit</command> tool. + </para> + + </sect4> + + <sect4> + <title>Changing User Accounts</title> + + <para> +<indexterm><primary>pdbedit</primary></indexterm> + Refer to the <command>pdbedit</command> man page for a full synopsis of all operations + that are available with this tool. + </para> + + <para> +<indexterm><primary>pdbedit</primary></indexterm> + An example of a simple change in the user account information is the change of the full name + information shown here: +<screen> +&rootprompt; pdbedit -r --fullname="Victor Aluicious Laan" vlaan +... +Primary Group SID: S-1-5-21-726309263-4128913605-1168186429-513 +Full Name: Victor Aluicious Laan +Home Directory: \\frodo\vlaan +... +</screen> + </para> + + <para> +<indexterm><primary>grace time</primary></indexterm> +<indexterm><primary>password expired</primary></indexterm> +<indexterm><primary>expired password</primary></indexterm> + Let us assume for a moment that a user's password has expired and the user is unable to + change the password at this time. It may be necessary to give the user additional grace time + so that it is possible to continue to work with the account and the original password. This + demonstrates how the password expiration settings may be updated +<screen> +&rootprompt; pdbedit -Lv vlaan +... +Password last set: Sun, 09 Sep 2001 22:21:40 GMT +Password can change: Thu, 03 Jan 2002 15:08:35 GMT +Password must change: Thu, 03 Jan 2002 15:08:35 GMT +Last bad password : Thu, 03 Jan 2002 15:08:35 GMT +Bad password count : 2 +... +</screen> +<indexterm><primary>bad logon attempts</primary></indexterm> +<indexterm><primary>lock the account</primary></indexterm> + The user has recorded 2 bad logon attempts and the next will lock the account, but the + password is also expired. Here is how this account can be reset: +<screen> +&rootprompt; pdbedit -z vlaan +... +Password last set: Sun, 09 Sep 2001 22:21:40 GMT +Password can change: Thu, 03 Jan 2002 15:08:35 GMT +Password must change: Thu, 03 Jan 2002 15:08:35 GMT +Last bad password : 0 +Bad password count : 0 +... +</screen> + The <literal>Password must change:</literal> parameter can be reset like this: +<screen> +&rootprompt; pdbedit --pwd-must-change-time=1200000000 vlaan +... +Password last set: Sun, 09 Sep 2001 22:21:40 GMT +Password can change: Thu, 03 Jan 2002 15:08:35 GMT +Password must change: Thu, 10 Jan 2008 14:20:00 GMT +... +</screen> + Another way to use this tools is to set the date like this: +<screen> +&rootprompt; pdbedit --pwd-must-change-time="2010-01-01" \ + --time-format="%Y-%m-%d" vlaan +... +Password last set: Sun, 09 Sep 2001 22:21:40 GMT +Password can change: Thu, 03 Jan 2002 15:08:35 GMT +Password must change: Fri, 01 Jan 2010 00:00:00 GMT +... +</screen> +<indexterm><primary>strptime</primary></indexterm> +<indexterm><primary>time format</primary></indexterm> + Refer to the strptime man page for specific time format information. + </para> + + <para> +<indexterm><primary>pdbedit</primary></indexterm> +<indexterm><primary>SambaSAMAccount</primary></indexterm> + Please refer to the pdbedit man page for further information relating to SambaSAMAccount + management. + </para> + + </sect4> + + <sect4> + <title>Domain Account Policy Managment</title> + + <para> +<indexterm><primary>domain account access policies</primary></indexterm> +<indexterm><primary>access policies</primary></indexterm> + To view the domain account access policies that may be configured execute: +<screen> +&rootprompt; pdbedit -P ? +No account policy by that name +Account policy names are : +min password length +password history +user must logon to change password +maximum password age +minimum password age +lockout duration +reset count minutes +bad lockout attempt +disconnect time +refuse machine password change +</screen> + </para> + + <para> + Commands will be executed to establish controls for our domain as follows: + </para> + + <orderedlist> + <listitem><para>min password length = 8 characters.</para></listitem> + <listitem><para>password history = last 4 passwords.</para></listitem> + <listitem><para>maximum password age = 90 days.</para></listitem> + <listitem><para>minimum password age = 7 days.</para></listitem> + <listitem><para>bad lockout attempt = 8 bad logon attempts.</para></listitem> + <listitem><para>lockout duration = forever, account must be manually reenabled.</para></listitem> + </orderedlist> + + <para> + The following command execution will achieve these settings: +<screen> +&rootprompt; pdbedit -P "min password length" -C 8 +account policy value for min password length was 5 +account policy value for min password length is now 8 +&rootprompt; pdbedit -P "password history" -C 4 +account policy value for password history was 0 +account policy value for password history is now 4 +&rootprompt; pdbedit -P "maximum password age" -C 90 +account policy value for maximum password age was 4294967295 +account policy value for maximum password age is now 90 +&rootprompt; pdbedit -P "minimum password age" -C 7 +account policy value for minimum password age was 0 +account policy value for minimum password age is now 7 +&rootprompt; pdbedit -P "bad lockout attempt" -C 8 +account policy value for bad lockout attempt was 0 +account policy value for bad lockout attempt is now 8 +&rootprompt; pdbedit -P "lockout duration" -C -1 +account policy value for lockout duration was 30 +account policy value for lockout duration is now 4294967295 +</screen> + </para> + +<note><para> +To set the maximum (infinite) lockout time use the value of -1. +</para></note> + +<warning><para> +Account policies must be set individually on each PDC and BDC. At this time (Samba 3.0.11 to Samba 3.0.14a) +account policies are not replicated automatically. This may be fixed before Samba 3.0.20 ships or some +time there after. +</para></warning> + + </sect4> + + </sect3> + + <sect3> + <title>Account Migration</title> <para> <indexterm><primary>pdbedit</primary></indexterm> @@ -1113,6 +1537,7 @@ Password must change: Mon, 18 Jan 2038 20:14:07 GMT </para></step> </procedure> + </sect3> </sect2> </sect1> |