diff options
Diffstat (limited to 'docs/textdocs')
| -rw-r--r-- | docs/textdocs/samba-pdc-faq.txt | 923 | ||||
| -rw-r--r-- | docs/textdocs/samba-pdc-howto.txt | 703 |
2 files changed, 1626 insertions, 0 deletions
diff --git a/docs/textdocs/samba-pdc-faq.txt b/docs/textdocs/samba-pdc-faq.txt new file mode 100644 index 0000000000..4b54c4d3ef --- /dev/null +++ b/docs/textdocs/samba-pdc-faq.txt @@ -0,0 +1,923 @@ + +The Samba 2.2 PDC FAQ + +David Bannon + + La Trobe University + _________________________________________________________________ + _________________________________________________________________ + + Comments, corrections and additions to <D.Bannon@latrobe.edu.au> + + This is the FAQ for Samba 2.2 as an NTDomain controller. This document + is derived from the origional FAQ that was built and maintained by + Gerald Carter from the early days of Samba NTDomain development up + until recently. It is now being updated as significent changes are + made to 2.2.0. + + Please note it does not apply to Samba2.2alpha0, Samba2.2alpha1, Samba + 2.0.7, TNG nor HEAD branch. + + I'll repeat, it does not apply to the current snapshot [ftp + mirror]:/pub/samba/alpha/samba-2.2.0-alpha1.tar.gz, only to the to the + current cvs. + + Also available is a Samba 2.2 PDC HowTo that takes you, step by step, + over the process of setting up a very basic Samba 2.2 Primary Domain + Controller + + Note: Please read the Introduction for the current state of play. + + Table of Contents + 1. Introduction + + State of Play + Introduction + + 2. General Information + + What can we do ? + + What can Samba Primary Domain Controller (PDC) do ? + Can I have a Windows 2000 client logon to a Samba + controlled domain? + + What's the status of print spool (spoolss) support in the + NTDOM code? + + CVS + + What are the different Samba branches available in CVS ? + What are the CVS commands ? + + 3. Establishing Connections + + How do I get my NT4 or W2000 Workstation to login to the + Samba controlled Domain? + + What is a 'machine account' ? + "The machine account for this computer either does not + exist or is not accessable." + + How do I create machine accounts manually ? + I cannot include a '$' in a machine name. + I get told "You already have a connection to the + Domain...." when creating a machine account. + + I get told "Cannot join domain, the credentials supplied + conflict with an existing set.." + + "The system can not log you on (C000019B)...." + + 4. User Account Management + + Domain Admins + + How do I configure an account as a domain administrator? + + Profiles + + Why is it bad to set "logon path = \\%N\%U\profile" in + smb.conf? ? + + Why are all the users listed in the "domain admin users" + using the same profile? + + The roaming profiles do not seem to be updating on the + server. + + Policies + + What are 'Policies' ?. + I can't get system policies to work. + What about Windows NT Policy Editor ? + Can Win95 do Policies ? + + Passwords + + What is password sync and should I use it ? + How do I get remote password (unix and SMB) changing + working ? + + 5. Miscellaneous + + What editor can I use in DOS/Windows that won't mess with + my unix EOF + + How do I get 'User Manager' and 'Server Manager' + The time setting from a Samba server does not work. + "trust account xxx should be in DOMAIN_GROUP_RID_USERS" + How do I get my samba server to become a member ( not PDC ) + of an NT domain? + + 6. Troubleshooting and Bug Reporting + + Diagnostic tools + + What are some diagnostics tools I can use to debug the + domain logon process and where can I find them? + + How do I install 'Network Monitor' on an NT Workstation or + a Windows 9x box? + + What other help can I get ? + + URLs and similar + How do I get help from the mailing lists ? + How do I get off the mailing lists ? + _________________________________________________________________ + +Chapter 1. Introduction + +State of Play + + It should be noted that 2.2.0 in its pre-release form still has a few + problems, I'll try and keep this section current while things are + still dynamic. At the time of this update (November 13, 2000) the + current state of play is : + + Comments here about W2K joining the domain apply only to Samba 2.2 + from the CVS after November 27th. The 'snapshot' release + Samba2.2alpha1 does not work !!! See below on how to get a CVS tree. + + Client Side creation of Machine accounts does work but is not + complete. Firstly, the add user script runs as the user who's name was + entered, not as root. Secondly, the machine name passed to the script + (%U) has an underscore at the end, not a '$'. One alternative is to + use %m and add the $. This method is documented in the HowTo. And + thirdly, it does not work with NT4ws. + + A W2K machine can join the domain. See the HowTo which explains the + process. The methods described are 'work arounds' and should be + regarded as temporary. Although I (drb) have tested these procedures a + number of people have had difficulty so there may be other issues at + work. JFM is aware of these problems and will attend to them when he + can. + + A Domain Admin account is required and at present it appears that only + root is a suitable candidate. + + Much of the related code does work. For example, if an NT is removed + from the domain and then rejoins, the Create a Computer Account in the + Domain dialog will let you reset the smbpasswd. That is you don't need + to do it from the unix box. However, at the present, you do need to + have root as an administrator and use the root user name and password. + + Actually I'm not sure that last paragraph is correct .... + + Policies do work on a W2K machine. MS says that recent builds of W2K + dont observe an NT policy but it appears it does in 'legacy' mode. + _________________________________________________________________ + +Introduction + + This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing + with the 'old head' version of Samba and its NTDomain facilities. It + is being rewritten by David Bannon (drb) so that it addresses more + accurately the Samba 2.2 planned for release late 2000. + + This document probably still contains some material that does not + apply to Samba 2.2 but most (all?) of the really misleading stuff has + been removed. Some issues are not dealt with or are dealt with badly. + Please send corrections and additions to David Bannon at + D.Bannon@latrobe.edu.au + + Hopefully, as we all become familiar with the Samba 2.2 as a PDC this + document will become much more usefull. + _________________________________________________________________ + +Chapter 2. General Information + +What can we do ? + +What can Samba Primary Domain Controller (PDC) do ? + + If you wish to have Samba act as a PDC for Windows NT 3.51.and 4.0 or + W2000 client, then you will need to obtain the 2.2.0 version, + currently in pre-release. Release of a stable, full featured Samba PDC + is currently slated for version 3.0. + + The following is a list of included features currently in Samba 2.2: + + * The ability to act as a limited PDC for Windows NT and W2000 + clients. This includes adding NT and W2K machines to the domain + and authenticating users logging into the domain. + * Domain account can be viewed using the User Manager for Domains + ???? + * Viewing resources on the Samba PDC via the Server Manager for + Domains from the NT client. ?? + * Windows 95 clients will allow user level security to be set but + will not currently allow browsing of accounts. + * Machine account password updates. + * Changing of user passwords from an NT client. + * Partial support for Windows NT group and username mapping. + * Support for a LDAP password database backend. + * Printing. + + These things are note expected to work in the forseeable future + * Trust relationships + * PDC and BDC integration + * Windows NT ACLs (on the Samba shares) + * Offer a list of domain users to User Manager for Domains (or the + Security Tab etc). + _________________________________________________________________ + +Can I have a Windows 2000 client logon to a Samba controlled domain? + + The 2.2 release branch of Samba supports Windows 2000 domain clients + in legacy mode, ie as if the PDC is a NTServer, not a W2K server. + _________________________________________________________________ + +What's the status of print spool (spoolss) support in the NTDOM code? + + The implementation of support for SPOOLSS pipe is complete and it will + be available in the 2.2.0 release. This means that Samba will support + the automatic downloading of printer drivers for Windows NT clients + just as it currently does for Windows 9x clients. + _________________________________________________________________ + +CVS + + CVS is a programme (publically available) that the Samba developers + use to maintain the central source code. Non developers can get access + to the source in a read only capacity. Many flavours of unix now + arrive with cvs installed. + _________________________________________________________________ + +What are the different Samba branches available in CVS ? + + You can find out more about obtaining Samba's via anonymous CVS from + http://pserver.samba.org/samba/cvs.html". + + There are basically four branches to watch at the moment : + + HEAD + Samba 3.0 ? This code boasts all the main development work in + Samba. Two things that most people are not aware of which live + in the HEAD branch code are winbind NSS module and Tim Potter's + VFS implementation. Due to its developmental nature, its not + really suitable for production work. + + SAMBA_2_0 + This branch contains the current stable release release. At the + moment it contains 2.0.7, a version that will do some limited + PDC stuff. If you are really going to do PDC things then I + (drb) suggest that you consider 2.2 instead. + + SAMBA_2_2 + The next stable release, currently in a 'alpha' form. It + provides the Samba developers, testers and interested people + with an approximation of what is to come. This document + addresses only SAMBA_2_2. + + SAMBA_TNG + This branch is no longer maintained from the Samba sites. + Please see http://www.samba-tng.org/. It has been requested + that questions about TNG are not posted to the regular Samba + mailing lists including samba-ntdom and samba-technical. + _________________________________________________________________ + +What are the CVS commands ? + + See http://pserver.samba.org/samba/cvs.html + + To get the Samba 2.2 version, tag SAMBA_2_2 you would do : + * For example : cd /usr/local/src/ + * cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login + * When prompted enter a password of cvs + * cvs -d :pserver:cvs@pserver.samba.org:/cvsroot co -r SAMBA_2_2 + samba + + Then to update that directory at some later time, + * cd /usr/local/src/samba + * cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login + * When prompted enter a password of 'cvs'. + * cvs update -d -P + _________________________________________________________________ + +Chapter 3. Establishing Connections + +How do I get my NT4 or W2000 Workstation to login to the Samba controlled +Domain? + + There is a comprehensive Samba PDC HowTo accessable from the samba web + site under 'Documentation'. Its currently located at + http://bioserve.latrobe.edu.au/samba. Read it. + _________________________________________________________________ + +What is a 'machine account' ? + + Every NT, W2K or Samba machine that joins a Samba controlled domain + must be known to the Samba PDC. There are two entries required, one in + (typically) /etc/passwd and the other in (typically) + /usr/local/samba/private/smbpasswd. Under some circumstances these + entries are made manually, the HowTo discusses ways of creating them + automatically. + _________________________________________________________________ + +"The machine account for this computer either does not exist or is not +accessable." + + When I try to join the domain I get the message "The machine account + for this computer either does not exist or is not accessable". Whats + wrong ? + + This problem is caused by the PDC not having a suitable machine + account. If you are using the add user script = method to create + accounts then this would indicate that it has not worked. Ensure the + domain admin user system is working. + + Alternatively if you are creating account entries manually then they + have not been created correctly. Make sure that you have the entry + correct for the machine account in smbpasswd file on the Samba PDC. If + you added the account using an editor rather than using the smbpasswd + utility, make sure that the account name is the machine netbios name + with a '$' appended to it ( ie. computer_name$ ). There must be an + entry in both /etc/passwd and the smbpasswd file. Some people have + reported that inconsistent subnet masks between the Samba server and + the NT client have caused this problem. Make sure that these are + consistent for both client and server. + _________________________________________________________________ + +How do I create machine accounts manually ? + + This was the only option until recently, now in version 2.2 better + means are available. You might still need to do it manually for a + couple of reasons. A machine account consists of two entries (assuming + a standard install and /etc/passwd use), one in /etc/passwd and the + other in /usr/local/samba/private/smbpasswd. The /etc/passwd entry + will list the machine name with a $ appended, won't have a passwd, + will have a null shell and no home directory. For example a machine + called 'doppy' would have an /etc/passwd entry like this : + + doppy$:x:505:501:NTMachine:/dev/null:/bin/false + + On a linux system for example, you would typically add it like this : + + adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n doppy$ + + Then you need to add that entry to smbpasswd, assuming you have a + suitable path to the smbpasswd programme, do this : + + smbpasswd -a -m doppy$ + + The entry will be created with a well known password, so any machine + that says its doppy could join the domain as long as it gets in first. + So don't create the accounts any earlier than you need them. + _________________________________________________________________ + +I cannot include a '$' in a machine name. + + A 'machine name' in (typically) /etc/passwd consists of the machine + name with a '$' appended. FreeBSD (and other BSD systems ?) won't + create a user with a '$' in their name. + + The problem is only in the program used to make the entry, once made, + it works perfectly. So create a user without the '$' and use vipw to + edit the entry, adding the '$'. Or create the whole entry with vipw if + you like, make sure you use a unique uid ! + _________________________________________________________________ + +I get told "You already have a connection to the Domain...." when creating a +machine account. + + This happens if you try to create a machine account from the machine + itself and use a user name that does not work (for whatever reason) + and then try another (possibly valid) user name. Exit out of the + network applet to close the initial connection and try again. + + Further, if the machine is a already a 'member of a workgroup' that is + the same name as the domain you are joining (bad idea) you will get + this message. Change the workgroup name to something else, it does not + matter what, reboot, and try again. + _________________________________________________________________ + +I get told "Cannot join domain, the credentials supplied conflict with an +existing set.." + + This is the same basic problem as mentioned above, "You already have a + connection..." + _________________________________________________________________ + +"The system can not log you on (C000019B)...." + + I joined the domain successfully but after upgrading to a newer + version of the Samba code I get the message, "The system can not log + you on (C000019B), Please try a gain or consult your system + administrator" when attempting to logon. + + This occurs when the domain SID stored in private/WORKGROUP.SID is + changed. For example, you remove the file and smbd automatically + creates a new one. Or you are swapping back and forth between versions + 2.0.7, TNG and the HEAD branch code (not recommended). The only way to + correct the problem is to restore the original domain SID or remove + the domain client from the domain and rejoin. + _________________________________________________________________ + +Chapter 4. User Account Management + +Domain Admins + +How do I configure an account as a domain administrator? + + See the NTDom HowTo. + _________________________________________________________________ + +Profiles + +Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ? + + Sometimes Windows clients will maintain a connection to the \\homes\ ( + or [%U] ) share even after the user has logged out. Consider the + following scenario. + + * user1 logs into the Windows NT machine. Therefore the [homes] + share is set to \\server\user1. + * user1 works for a while and then logs out. + * user2 logs into the same Windows NT machine. + + However, since the NT box has maintained a connection to [homes] which + was previously set to \\server\user1, when the operating system + attempts to get the profile and if it can read users1's profile, will + get it otherwise it will return an error. You get the picture. + + A better solution is to use a separate [profiles] share and set the + "logon path = \\%N\profiles\%U" + + Note: Is this still a problem ???? + _________________________________________________________________ + +Why are all the users listed in the "domain admin users" using the same +profile? + + You are using a very very old development version of Samba. Upgrade. + _________________________________________________________________ + +The roaming profiles do not seem to be updating on the server. + + There can be several reasons for this. + + Make sure that the time on the client and the PDC are synchronized. + You can accomplish this by executing a net time \\server /set /yes + replacing server with the name of your PDC (or another synchronized + SMB server). See about Setting Time + + Make sure that the logon path is writeable by the user and make sure + that the connection to the logon path location is by the current user. + Sometimes Windows client do not drop the connection immediately upon + logoff. + + Some people have reported that the logon path location should also be + browseable. I (GC) have yet to emperically verify this, but you can + try. + _________________________________________________________________ + +Policies + +What are 'Policies' ?. + + When a user logs onto the domain via a client machine, the PDC sends + the client machine a list of things contained in the 'policy' (if it + exists). This list may do things like suppress a splach screen, format + the dates the way you like them or perhaps remove locally stored + profiles. + + On a samba PDC this list is obtained from a file called ntconfig.pol + and located in the [netlogon]share. The file is created with a policy + editor and must be readable by anyone and writeable by only root. See + below for how to get a suitable editor. + _________________________________________________________________ + +I can't get system policies to work. + + There are two possible reasons for system policies not functioning + correctly. Make sure that you have the following parameters set in + smb.conf + [netlogon] + .... + locking = no + public = no + browseable = yes + .... + + + A policy file must be in the [netlogon] share and must be readable by + everyone and writeable by only root. The file must be created by an + NTServer Policy Editor. + + Last time I (drb) looked in the source, it was looking for + ntconfig.pol first then several other combinations of upper and lower + case. People have reported success using NTconfig.pol, NTconfig.POL + and ntconfig.pol. These are the case settings that I (GC) use with the + filename ntconfig.pol + case sensitive = no + case preserve = yes + default case = yes + + _________________________________________________________________ + +What about Windows NT Policy Editor ? + + To create or edit ntconfig.pol you must use the NT Server Policy + Editor, poledit.exe which is included with NT Server but not NT + Workstation. There is a Policy Editor on a NTws but it is not suitable + for creating Domain Policies. Further, although the Windows 95 Policy + Editor can be installed on an NT Workstation/Server, it will not work + with NT policies because the registry key that are set by the policy + templates. However, the files from the NT Server will run happily + enough on an NTws. You need poledit.exe, common.adm and winnt.adm. It + is convenient to put the two *.adm files in c:\winnt\inf which is + where the binary will look for them unless told otherwise. Note also + that that directory is 'hidden'. + + The Windows NT policy editor is also included with the Service Pack 3 + (and later) for Windows NT 4.0. Extract the files using + servicepackname /x, ie thats Nt4sp6ai.exe /x for service pack 6a. The + policy editor, poledt.exe and the associated template files (*.adm) + should be extracted as well. It is also possible to downloaded the + policy template files for Office97 and get a copy of the policy + editor. Another possible location is with the Zero Administration Kit + available for download from Microsoft. + _________________________________________________________________ + +Can Win95 do Policies ? + + Install the group policy handler for Win9x to pick up group policies. + Look on the Win98 CD in \tools\reskit\netadmin\poledit. Install group + policies on a Win9x client by double-clicking grouppol.inf. Log off + and on again a couple of times and see if Win98 picks up group + policies. Unfortunately this needs to be done on every Win9x machine + that uses group policies.... + + If group policies don't work one reports suggests getting the updated + (read: working) grouppol.dll for Windows 9x. The group list is grabbed + from /etc/group. + _________________________________________________________________ + +Passwords + +What is password sync and should I use it ? + + NTws users can change their domain password by pressing Ctrl-Alt-Del + and choosing 'Change Password'. By default however, this does not + change the unix password (typically in /etc/passwd or /etc/shadow). In + lots of situations thats OK, for example : + + * The server is only accessible to the user via samba. + * Pam_smb or similar is installed so other applications still refer + to the samba password. + + But sometimes you really do need to maintain two seperate password + databases and there are good reasons to keep then in sync. Trying to + explain to users that they need to change their passwords in two + seperate places or use two seperate passwords is not fun. + + However do understand that setting up password sync is not without + problems either. The chief difficulty is the interface between Samba + and the passwd command, it can be a fiddle to set up and if the + password the user has entered fails, the resulting errors are + ambiguously reported and the user is confused. Further, you need to + take steps to ensure that users only ever change their passwords via + samba (or use smbpasswd), otherwise they will only be changing the + unix password. + _________________________________________________________________ + +How do I get remote password (unix and SMB) changing working ? + + Have a practice changing a user's password (as root) to see what + discussion takes place and change the text in the 'passwd chat' line + below as necessary. The line as shown works for recent RH Linux but + most other systems seem to like to do something different. The '*' is + a wild card and will match anything (or nothing). + + Add these lines to smb.conf under [Global] + + + unix password sync = true + passwd program = /usr/bin/passwd %u + passwd chat = *password* %n\n *password* %n\n *successful* + + As mentioned above, the change to the unix password happens as root, + not as the user, as is indicated in ~/smbd/chgpasswd.c If you are + using NIS, the Samba server must be running on the NIS master machine. + _________________________________________________________________ + +Chapter 5. Miscellaneous + +What editor can I use in DOS/Windows that won't mess with my unix EOF + + There are a number of Windows or DOS based editors that will + understand, and leave intact, the unix eof (as opposed to a DOS + CL/LF). List members suggested : + + * UltraEdit at www.ultraedit.com + * VI for windows at home.snafu.de/ramo/WinViEn.htm + * The author prefers PFE at www.lancs.ac.uk/people/cpaap/pfe/ but + its no longer being developed... + _________________________________________________________________ + +How do I get 'User Manager' and 'Server Manager' + + Since I don't need to buy an NT Server CD now, how do I get the 'User + Manager for Domains', the 'Server Manager' ? + + Microsoft distributes a version of these tools called nexus for + installation on Windows 95 systems. The tools set includes + * Server Manager + * User Manager for Domains + * Event Viewer + + Click here to download the archived file + ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE + + The Windows NT 4.0 version of the 'User Manager for Domains' and + 'Server Manager' are available from Microsoft via ftp from + ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE + _________________________________________________________________ + +The time setting from a Samba server does not work. + + If it works OK when you log on as Domain Admin then the problem is + that ordinary users don't have permission to change the time. (The + system is running with their permission at logon time.) This is not a + Samba problem, you will have the same problem where ever you connect. + You can give 'everyone' permission to change the time from the User + Manager. + + Anyone know what the registry settings are so this could be done with + a Policy ? + _________________________________________________________________ + +"trust account xxx should be in DOMAIN_GROUP_RID_USERS" + + I keep getting the message "trust account xxx should be in + DOMAIN_GROUP_RID_USERS." in the logs. What do I need to do? + + You are using one of the old development versions. Upgrade. (The + message is unimportant, was a reminder to a developer) + _________________________________________________________________ + +How do I get my samba server to become a member ( not PDC ) of an NT domain? + + In a domain that has a number of servers you only need one password + database. The machines that don't have their own ask the PDC to check + for them. This will work fine for a domain controlled by either a + Samba or NT machine. The following lines in smb.conf are typical, + 'password server' points to the samba machine (or an NT) that has the + password list : + + + [global] + ... + security = domain + workgroup = { Put your domain name here } + password server = { Put the ip of the PDC here } + encrypt passwords = yes + ... + + The samba server in question will have to 'join the domain', that + requires the domain controller to have a machine account for it. This + is no different to the machine account requirements to allow a NTws to + join the domain. For example, if we want a unix box called sleepy to + ask the PDC called grumpy to do its authentication then grumpy will + need an entry in its smbpasswd (assuming it's also samba) that starts + with sleepy$. It would have to be created manually. + + If the domain is controlled by an NTServer then the "Server Manager + for Domains" tool must be used to add 'sleepy' to the domain list. + + In either case we then join the domain. If the domain is called forest + then on sleepy we would join the domain by typing : + + smbpasswd -j forest + + Note that the directory where the smbpasswd file would be located + should exist as this is where smbd will generate the MACHINE.SID file. + This might be /usr/local/samba/private/FOREST.SLEEPY.SID and it + contains the trust account password for the domain member. The + permissions are (and should remain) "rw------- + + Note the Samba Servers without the password list will most likely + still need an account for each user, this means a line in its + /etc/passwd. Because authentication is being handled at the domain + level the /etc/passwd line does not need a password. If the shares + being offered are not user specific, ie a common (read only ?) area or + perhaps just printing then the user's /etc/passwd does not need a home + directory. A typical line in /etc/passwd for a server that allows + domain users to connect to the samba shares but does not offer a home + share ('cos that's on the PDC) and does not allow logon to the unix + prompt would be like this : +jblow:x:542:100:Joe Blow:/dev/null:/bin/false + + * When removing those 'dummy' users, watch the 'remove user' + scripts, some OS think they should remove a users directory even + when its not owned by the user ! + * The username map = parameter might help you to avoid having all + those accounts created. + * You should investigate the smb.conf parameter 'add user script', + it will be used to create accounts on secondary servers when that + account already exists on the PDC. Very nice. Something like : + [Global] + .... + add user script = /usr/sbin/adduser -n -g users -c User -d /dev/null -s /bi +n/false %U + .... + _________________________________________________________________ + +Chapter 6. Troubleshooting and Bug Reporting + +Diagnostic tools + +What are some diagnostics tools I can use to debug the domain logon process +and where can I find them? + + One of the best diagnostic tools for debugging problems is Samba + itself. You can use the -d option for both smbd and nmbd to specifiy + what 'debug level' at which to run. See the man pages on smbd, nmbd + and smb.conf for more information on debugging options. The debug + level can range from 1 (the default) to around 100 but a debug level + of about 20 will normally help you find any errors that samba is + encountering. Another helpful method of debugging is to compile samba + using the gcc -g flag. This will include debug information in the + binaries and allow you to attch gdb to the running smbd / nmbd + process. In order to attach gdb to an smbd process for an NT + workstation, first get the workstation to make the connection. + Pressing ctrl-alt-delete and going down to the domain box is + sufficient (at least, on the first time you join the domain) to + generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation + maintains an open connection, and therefore there will be an smbd + process running (assuming that you haven't set a really short smbd + idle timeout) So, in between pressing ctrl alt delete, and actually + typing in your password, you can gdb attach and continue. + + Some usefull samba commands worth investigating: + * testparam | more + * smbclient -L //{netbios name of server} + + An SMB enabled version of tcpdump is available from + ftp://samba.org/pub/samba/tcpdump-smb/ + + Capconvert is a small C program for translating output from + tcpdump-smb to CAP format that can be read by netmon. You will need to + use the raw output from tcp dump ( ie. tcpdump -w output.dump ). Good + news! Now you can convert Solaris' snoop output as well. The C source + code for snoop2cap is available for download. + + For tracing things on the Microsoft Windows NT, Network Monitor (aka. + netmon) is available on the Microsoft Developer Network CD's, the + Windows NT Server install CD and the SMS CD's. The version of netmon + that ships with SMS allows for dumping packets between any two + computers (ie. placing the network interface in promiscuous mode). The + version on the NT Server install CD will only allow monitoring of + network traffic directed to the local NT box and broadcasts on the + local subnet. + _________________________________________________________________ + +How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box? + + Installing netmon on an NT workstation requires a couple of steps. The + following are for installing Netmon V4.00.349, which comes with + Microsoft Windows NT Server 4.0, on Microsoft Windows NT Workstation + 4.0. The process should be similar for other version of Windows NT / + Netmon. You will need both the Microsoft Windows NT Server 4.0 Install + CD and the Workstation 4.0 Install CD. + + Initially you will need to install 'Network Monitor Tools and Agent' + on the NT Server. To do this + + * Goto Start - Settings - Control Panel - Network - Services - Add + * Select the 'Network Monitor Tools and Agent' and click on 'OK'. + * Click 'OK' on the Network Control Panel. + * Insert the Windows NT Server 4.0 install CD when prompted. + + At this point the Netmon files should exist in + %SYSTEMROOT%\System32\netmon\*.*. Two subdirectories exist as well, + parsers\ which contains the necessary DLL's for parsing the netmon + packet dump, and captures\. + + In order to install the Netmon tools on an NT Workstation, you will + first need to install the 'Network Monitor Agent' from the Workstation + install CD. + + * Goto Start - Settings - Control Panel - Network - Services - Add + * Select the 'Network Monitor Agent' and click on 'OK'. + * Click 'OK' on the Network Control Panel. + * Insert the Windows NT Workstation 4.0 install CD when prompted. + + Now copy the files from the NT Server in + %SYSTEMROOT%\System32\netmon\*.* to %SYSTEMROOT%\System32\netmon\*.* + on the Workstation and set permissions as you deem appropriate for + your site. You will need administrative rights on the NT box to run + netmon. + + To install Netmon on a Windows 9x box install the network monitor + agent from the Windows 9x CD (\admin\nettools\netmon). There is a + readme file located with the netmon driver files on the CD if you need + information on how to do this. Copy the files from a working Netmon + installation. + _________________________________________________________________ + +What other help can I get ? + + There are many sources of information available in the form of mailing + lists, RFC's and documentation. The docs that come with the samba + distribution contain very good explanations of general SMB topics such + as browsing. + _________________________________________________________________ + +URLs and similar + + * Home of Samba site http://samba.org. We have a mirror near you ! + * The Development document on the Samba mirrors might mention your + problem. If so, it might mean that the developers are working on + it. + * Ignacio Coupeau has a very comprehesive look at LDAP with Samba at + http://www.unav.es/cti/ldap-smb-howto.html Be a little carefull + however, I suspect that it does not specificly address samba + 2.2.x. The HEAD pre-2.1 may possibly be the best stream to look + at. + * Lars Kneschke's site covers Samba-TNG at + http://www.kneschke.de/projekte/samba_tng, but again, a lot of it + does not apply to the main stream Samba. + * Although 2.0.7 has almost had its day as a PDC, I (drb) will keep + the 2.0.7 PDC pages at http://bioserve.latrobe.edu.au/samba going + for a while yet. + * Misc links to CIFS information http://samba.org/cifs/ + * NT Domains for Unix http://mailhost.cb1.com/~lkcl/ntdom/ + * FTP site for older SMB specs: + ftp://ftp.microsoft.com/developr/drg/CIFS/ + + There are a number of documents that no longer appear to live at their + origional home. Any one know where the following may be found ? + * CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt + * CIFS Remote Administration Protocol + draft-leach-cifs-rap-spec-00.txt + * CIFS Logon and Pass Through Authentication + draft-leach-cifs-logon-spec-00.txt + * A Common Internet File System (CIFS/1.0) Protocol + draft-leach-cifs-v1-spec-01.txt + * CIFS Printing Specification draft-leach-cifs-print-spec-00.txt + * RFC1001 (March '87) Protocol standard for a NetBIOS service on a + TCP/UDP transport: Concepts and methods. + http://ds.internic.net/rfc/rfc1001.txt + * RFC1002 (March '87) Protocol standard for a NetBIOS service on a + TCP/UDP transport: Detailed specifications. + http://ds.internic.net/rfc/rfc1002.txt + * Microsoft's main CIFS page: + http://www.microsoft.com/workshop/networking/cifs/ + _________________________________________________________________ + +How do I get help from the mailing lists ? + + There are a number of Samba related mailing lists. Go to + http://samba.org, click on your nearest mirror and then click on + Support and then click on Samba related mailing lists. + + For questions relating to Samba TNG go to http://www.samba-tng.org/ It + has been requested that you don't post questions about Samba-TNG to + the main stream Samba lists. + + If you post a message to one of the lists please observe the following + guide lines : + * Always remember that the developers are volunteers, they are not + paid and they never guarantee to produce a particular feature at a + particular time. Any time lines are 'best guess' and nothing more. + * Always mention what version of samba you are using and what + operating system its running under. You should probably list the + relevant sections of your smb.conf file, at least the options in + [global] that affect PDC support. + * In addition to the version, if you obtained Samba via CVS mention + the date when you last checked it out. + * Try and make your question clear and brief, lots of long, + convoluted questions get deleted before they are completely read ! + Don't post html encoded messages (if you can select colour or font + size its html). + * If you run one of those niffy 'I'm on holidays' things when you + are away, make sure its configured to not answer mailing lists. + * Don't cross post. Work out which is the best list to post to and + see what happens, ie don't post to both samba-ntdom and + samba-technical. Many people active on the lists subscribe to more + than one list and get annoyed to see the same message two or more + times. Often someone will see a message and thinking it would be + better dealt with on another, will forward it on for you. + * You might include partial log files written at a debug level set + to as much as 20. Please don't send the entire log but enough to + give the context of the error messages. + * (Possibly) If you have a complete netmon trace ( from the opening + of the pipe to the error ) you can send the *.CAP file as well. + * Please think carefully before attaching a document to an email. + Consider pasting the relevant parts into the body of the message. + The samba mailing lists go to a huge number of people, do they all + need a copy of your smb.conf in their attach directory ? + _________________________________________________________________ + +How do I get off the mailing lists ? + + To have your name removed from a samba mailing list, go to the same + place you went to to get on it. Go to http://samba.org, click on your + nearest mirror and then click on Support and then click on Samba + related mailing lists. Or perhaps see here + + Please don't post messages to the list asking to be removed, you will + just be refered to the above address (unless that process failed in + some way...) diff --git a/docs/textdocs/samba-pdc-howto.txt b/docs/textdocs/samba-pdc-howto.txt new file mode 100644 index 0000000000..0073d2947b --- /dev/null +++ b/docs/textdocs/samba-pdc-howto.txt @@ -0,0 +1,703 @@ + +The Samba 2.2 PDC HowTo + +David Bannon + + La Trobe University + _________________________________________________________________ + _________________________________________________________________ + + Comments, corrections and additions to <D.Bannon@latrobe.edu.au> + + This document explains how to setup Samba as a Primary Domain + Controller and applies to version 2.2.0. Before using these functions + make sure you understand what the controller can and cannot do. Please + read the sections below in the Introduction. As 2.2.0 is incrementally + updated this document will change or become out of date very quickly, + make sure you are reading the most current version. + + Please note this document does not apply to Samba2.2alpha0, + Samba2.2alpha1, Samba 2.0.7, TNG nor HEAD branch. + + It does apply to the current (post November 27th) cvs. + + Also available is an updated version of Jerry Carter's NTDom FAQ that + will answer lots of the special 'tuning' questions that are not + covered here. Over the next couple of weeks some of the items here + will be moved to the FAQ. + + Table of Contents + 1. Introduction + + What can we do ? + What can't we do ? + + 2. Installing + + Start Up Script + Config File + + A sample conf file + PDC Config Parameters + + Special directories + + 3. User and Machine Accounts + + Logon Accounts + Machine Accounts + Joining the Domain + User Accounts + Domain Admin Accounts + + 4. Profiles, Policies and Logon Scripts + + Profiles + Policies + Logon Scripts + + 5. Passwords and Authentication + + Syncing Passwords + Using PAM + Authenticating other Samba Servers + + 6. Background + + History + The Future + Getting further help + _________________________________________________________________ + +Chapter 1. Introduction + + This document will show you one way of making Version 2.2.0 of Samba + perform some of the tasks of a NT Primary Domain Controller. The + facilities described are built into Samba as a result of development + work done over a number of years by a large number of people. These + facilities are only just beginning to be officially supported and + although they do appear to work reliably, if you use them then you + take the risks upon your self. This document does not cover the + developmental versions of Samba, particularly Samba-TNG + + Note that Samba 2.0.7 supports significently less of the NT Domain + facilities compared with 2.2.0 + + This document does not replace the text files DOMAIN_CONTROL.txt, + DOMAIN.txt (by John H Terpstra) or NTDOMAIN.txt (by Luke Kenneth + Casson Leighton). Those documents provide more detail and an insight + to the development cycle and should be considered 'further reading'. + _________________________________________________________________ + +What can we do ? + + * Permit 'domain logons' for Win95/98, NT4 and W2K workstations from + one central password database. WRT W2K, please see the section + about adding machine accounts and the Intro in the FAQ. + * Grant Administrator privileges to particular domain users on an NT + or W2K workstation. + * Apply policies from a domain policy file to NT and W2K (?) + workstation. + * Run the appropriate logon script when a user logs on to the domain + . + * Maintain a user's local profile on the server. + * Validate a user using another system via smb (such as smb_pam) and + soon winbind (?). + _________________________________________________________________ + +What can't we do ? + + * Become or work with a Backup Domain Controller (a BDC). + * Participate in any sort of trust relationship (with either Samba + or NT Servers). + * Offer a list of domain users to User Manager for Domains on the + Security Tab etc). + * Be a W2K type of Domain Controller. Samba PDC will behave like an + NT PDC, W2K workstations connect in legacy mode. + _________________________________________________________________ + +Chapter 2. Installing + + Installing consists of the usual download, configure, make and make + install process. These steps are well documented elsewhere. The FAQ + discusses getting pre-release versions via CVS. Then you need to + configure the server. + _________________________________________________________________ + +Start Up Script + + Skip this section if you have a working Samba already. Everyone has + their own favourite startup script. Here is mine, offered with no + warrantee at all ! + + + #!/bin/sh + # Script to control Samba server, David Bannon, 14-6-96 + # + # + PATH=/bin:/usr/sbin:/usr/bin + export PATH + case "$1" in + 'start') + if [ -f /usr/local/samba/bin/smbd ] + then + /usr/local/samba/bin/smbd -D + /usr/local/samba/bin/nmbd -D + echo "Starting Samba Server" + fi + ;; + 'conf') + if [ -f /usr/local/samba/lib/smb.conf ] + then + vi /usr/local/samba/lib/smb.conf + fi + ;; + 'pw') + if [ -f /usr/local/samba/private/smbpasswd ] + then + vi /usr/local/samba/private/smbpasswd + fi + ;; + 'who') + /usr/local/samba/bin/smbstatus -b + ;; + 'restart') + psline=`/bin/ps x | grep smbd | grep -v grep` + + if [ "$psline" != "" ] + then + while [ "$psline" != "" ] + do + psline=`/bin/ps x | fgrep smbd | grep -v grep` + if [ "$psline" ] + then + set -- $psline + pid=$1 + /bin/kill -HUP $pid + echo "Stopped $pid line = $psline" + sleep 2 + fi + done + fi + echo "Stopped Samba servers" + ;; + 'stop') + psline=`/bin/ps x | grep smbd | grep -v grep` + + if [ "$psline" != "" ] + then + while [ "$psline" != "" ] + do + psline=`/bin/ps x | fgrep smbd | grep -v grep` + if [ "$psline" ] + then + set -- $psline + pid=$1 + /bin/kill -9 $pid + echo "Stopped $pid line = $psline" + sleep 2 + fi + done + fi + echo "Stopped Samba servers" + psline=`/bin/ps x | grep nmbd | grep -v grep` + if [ "$psline" ] + then + set -- $psline + pid=$1 + /bin/kill -9 $pid + echo "Stopped Name Server " + fi + echo "Stopped Name Servers" + ;; + *) + echo "usage: samba {start | restart |stop | conf | pw | who}" + ;; + esac + + + Use this script, or some other one, you will need to ensure its used + while the machine is booting. (This typically involves /etc/rc.d, + we'll be assuming that there is a script called samba in + /etc/rc.d/init.d further down in this document.) + _________________________________________________________________ + +Config File + +A sample conf file + + Here is a fairly minimal config file to do PDC. It will also make the + server become the browse master for the specified domain (not + necessary but usually desirable). You will need to change only two + parameters to make this file work, wins server and workgroup, plus you + will need to put your own name (not mine!) in the domain admin users + fields. Some of the parameters are discussed further down this + document. + + Assuming you have used the default install directories, this file + should appear as /usr/local/samba/lib/smb.conf. It should not be + writable by anyone except root. + + Note: The 'add user script' parameter is a work-around, watch for + changes ! + + + + [global] + security = user + status = yes + workgroup = { Your domain name here } + wins server = { ip of a wins server if you have one } + encrypt passwords = yes + domain logons =yes + logon script = scripts\%U.bat + domain admin users = root dbannon andrew + add user script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/n +ull -s /bin/false %m$ + guest account = ftp + share modes=no + os level=65 + [homes] + guest ok = no + read only = no + create mask = 0700 + directory mask = 0700 + oplocks = false + locking = no + [netlogon] + path = /usr/local/samba/netlogon + writeable = no + guest ok = no + + _________________________________________________________________ + +PDC Config Parameters + + There are a huge range of parameters that may appear in a smb.conf + file. Some that may be of interest to a PDC are : + + add user script + This parameter specifies a script (or program) that will be run + to add a user to the system. Here it is being used to add a + machine, not a user. This is probably not very nice and may + change. But it does work ! + + For this example, I have a group called 'machines', entries can + be added to /etc/passwd using a programme called /usr/adduser + and the other parameters are chosen as suitable for a machine + account. Works for RH Linux, your system may require changes. + + domain admin users = user1 users2 + This parameter specifies a unix user who will be granted admin + privileges on a NT workstation when logged onto that + workstation. See the section called Domain Admin Accounts. + + encrypt passwords = yes + This parameter must be 'yes' to allow any of the recent service + pack NTs to logon. There are some reg hacks that turn off + encrypted passwords on the NTws itself but if you are going to + use the smbpasswd system (and you should) you must use + encrypted passwords. + + logon script = scripts\%U.bat + This will make samba look for a logon script named after the + user (eg joeblow.bat). See the section further on called Logon + Scripts + + Note: Note that the slash is like this '\', not like this '/'. NT + is happy with both, win95 is not ! + + logon path + Lets you specify where you would like users profiles kept. The + default, that is in the users home directory, does encourage a + bit of fiddling. + _________________________________________________________________ + +Special directories + + You need to create a couple of special files and directories. Its nice + to have some of the binaries handy too, so I create links to them. + Assuming you have used the default samba location and have not changed + the locations mentioned in the sample config file, do the following : + + + mkdir /usr/local/samba/netlogon + mkdir /usr/local/samba/netlogon/scripts + mkdir /usr/local/samba/private + touch /usr/local/samba/private/smbpasswd + chmod go-rwx /usr/local/samba/private/smbpasswd + cd /usr/local/sbin + ln -s /usr/local/samba/bin/smbpasswd + ln -s /usr/local/samba/bin/smbclient + ln -s /etc/rc.d/init.d/samba + + Make sure permissions are appropriate ! + + OK, if you have used the scripts above and have a path to where the + links are do this to start up the Samba Server : + + samba start + + Instead, you might like to reboot the machine to make sure that you + got the init stuff right. Any way, a quick look in the logs + /usr/local/samba/var/log.smbd and /usr/local/samba/var/log/nmbd will + give you an idea of what's happening. Assuming all is well, lets + create some accounts... + _________________________________________________________________ + +Chapter 3. User and Machine Accounts + +Logon Accounts + + This section is very nearly out of date already ! It appears that + while you are reading it, Jean Francois Micou is making it redundant ! + Jean Francois is adding facilities to add users (via User Manager) and + machines (when joining the domain) and it looks like these facilities + will make it into the official release of 2.2. + + Every user and NTws (and other samba servers) that will be on the + domain must have its own passwd entry in both /etc/passwd and + /usr/local/samba/private/smbpasswd . The /etc/passwd entry is really + only to reserve a user ID. The NT encrypted password is stored in + /usr/local/samba/private/smbpasswd. (Note that win95/98 machines don't + need an account as they don't do any security aware things.) + + Samba 2.2 will now create these entries for us. Carefull set up is + required and there may well be some changes to this system before its + released. + _________________________________________________________________ + +Machine Accounts + + Note: There is an entry in the ntdom FAQ explaining how to create + machine entries manually. + + At present to have the machine accounts created when a machine joins + the domain a number of conditions must be met : + + Only root can do it ! + There must be an entry in /usr/local/samba/private/smbpasswd + for root and root must be mentioned in domain admins. This may + be fixed some time in the future so any 'domain admin' can do + it. If you don't like having root as a windows logon account, + make the machine entries manually (both of them). + + Use the add user script + Again, this looks a bit like a 'work around'. Use a suitable + command line to add a machine account see above, and pass it + %m$, that is %m to get machine name plus the '$'. Now, this + means you cannot use the add user script to really add users + .... + + Only for W2K + This automatic creation of machine accounts does not work for + NT4ws at present. Watch this space. + _________________________________________________________________ + +Joining the Domain + + You must have either added the machine account entries manually (NT4 + ws) or set up the automatic system (W2K), see Machine Accounts before + proceeding. + + Windows NT + + + (this step may not be necessary some time in the near + future). On the samba server that is the PDC, add a machine + account manually as per the instructions in the FAQ Then give + the command smbpasswd -a -m {machine} substituting in the + client machine name. + + Logon to the NTws in question as a local admin, go to the + Control Panel, Network IdentificationTag. + + Press the Change button. + + Enter the Domain name (from the 'Workgroup' parameter, + smb.conf) in the Domain Field. + + Press OK and after a few seconds you will get a 'Welcome to + Whatever Domain'. Allow to reboot. + + Windows 2000 + + + Logon to the W2k machine as Administrator, go to the Control + Panel and double click on Network and Dialup Connections. + + Pull down the Advanced menu and choose Network + Identification. Press Properties . + + Choose Domain and enter the domain name. Press 'OK'. + + Now enter a user name and password for a Domain Admin (Who + must be root until a pre-release bug is fixed) and press + 'OK'. + + Wait for the confirmation, reboot when prompted. + + To remove a W2K machine from the domain, follow the first two + steps then choose Workgroup, enter a work group name (or just + WORKGROUP) and follow the prompts. + _________________________________________________________________ + +User Accounts + + Again, doing it manually (cos' the auto way is not working + pre-release). In our simple case every domain user should have an + account on the PDC. The account may have a null shell if they are not + allowed to log on to the unix prompt. Again they need an entry in both + the /etc/passwd and /usr/local/samba/private/smbpasswd. Again a + password is not necessary in /etc/passwd but the location of the home + directory is honoured. To make an entry for a user called Joe Blow you + would typically do the following : + + adduser -g users -c 'Joe Blow' -s /bin/false -n joeblow + + smbpasswd -a joeblow + + And you will prompted to enter a password for Joe. Ideally he will be + hovering over your shoulder and will, when asked, type in a password + of his choice. There are a number of scripts and systems to ease the + migration of users from somewhere to samba. Better start looking ! + _________________________________________________________________ + +Domain Admin Accounts + + Certain operations demand that the logged on user has Administrator + privileges, typically installing software and doing maintenance tasks. + It is very simple to appoint some users as Domain Admins, most likely + yourself. Make sure you trust the appointee ! + + Samba 2.2 recognizes particular users as being domain admins and tells + the NTws when it thinks that it has got one logged on. In the smb.conf + file we declare that the Domain Admin users = user1 user2. Any user + mentioned here will be treated as a Domain Admin by a NTws when logged + onto the Domain. They will have full Administrator rights including + the rights to change permissions on files and run the system utilities + such as Disk Administrator. + + Further, and this is very new, they will be allowed to create a new + machine account when first connecting a new NT or W2K machine to the + domain. At present, ie pre-release, only a Domain Admin who also + happens to be root can do so. + _________________________________________________________________ + +Chapter 4. Profiles, Policies and Logon Scripts + +Profiles + + NT Profiles should work if you have followed the setup so far. A + user's profile contains a whole lot of their personal settings, the + contents of their desktop, personal 'My Documents' and so on. When + they log off, all of the profile is copied to their directory on the + server and is downloaded again when they logon on again, possibly on + another client machine. + + Sounds great but can be a bit of a bug bear sometimes. Users let their + profiles get too big and then complain about how long it takes to log + on each time. This sample setup only supports NT profiles, rumor has + it that it is also possible to do the same on Win95, my users don't + know and I'm not telling them. + + Note: There is more info about Profiles (including for W95/98) in + the FAQ. + _________________________________________________________________ + +Policies + + Policies are an easy way to make or enforce specific characteristics + across your network. You create a ntconfig.pol file and every time + someone logs on with their NTws, the settings you put in ntconfig.pol + are applied to the NTws. Typical setting are things like making the + date appear the way you want it (none of these 2 figure years here) or + maybe suppressing one of the splash screens. Perhaps you want to set + the NTws so it does not keep users profiles on the local machine. + Cool. The only problem is making the ntconfig.pol file itself. You + cannot use the policy editor that comes with NTws. + + Note: See the FAQ for pointers on how to get a suitable Policy + Editor. + + The Policy Editor (and associated files) will create a ntconfig.pol + file using the parameters Microsoft thought of and parameters you + specify by making your own template file. + + In our example configuration here, Samba will expect to find the + ntconfig.pol file in /usr/local/samba/netlogon. Needless to say (I + hope !), it is vitally important that ordinary users don't have write + permission to the Policy files. + _________________________________________________________________ + +Logon Scripts + + In the sample config file above there is a line logon script = + scripts\%U.bat + + Note: Note that the slash is like this '\' not like this '/'. NT is + happy with both, win95 is not ! + + This allows you to run a dos batch file every time someone logs on. + The batch file is located on the server, in the sample install + mentioned here, its in /usr/local/samba/netlogon/scripts and is named + after the user with .bat appended, eg Joe Blow's script is called + /usr/local/samba/netlogon/scripts/joeblow.bat. + + Note: There is a suggestion that user names longer than 8 + characters may cause problems with some systems being unable to run + logon scripts. This is confirmed in earlier versions when + connecting using W95, comments about other combinations ?? + + You could use a line like this logon script = default.bat and samba + will supply /usr/local/samba/netlogon/default.bat for any client and + every user. Maybe you could use %m and get a client machine dependant + logon script. You get the idea... + + Note that the file is a dos batch file not a Unix script. It runs dos + commands on the client computer with the logon user's permissions. It + must be a dos file with each line ending with the dos cr/lf not a nice + clean newline. Generally, its best to create the initial file on a DOS + system and copy it across. + + There is lots of very clever uses of the Samba replaceable variables + such ( %U = user, %G = primary group, %H = client machine, see the + 'man 5 smb.conf') to give you control over which script runs when a + particular person logs on. (Gee, it would be nice to have a + default.bat run when nothing else is available.) + + Again, it is vitally important that ordinary users don't have write + permission to other peoples, or even probably their own, logon script + files. + + A typical logon script is reproduced below. Note that it runs separate + commands for win95 and NT, that's because NT has slightly different + behaviour when using the net use .. command. Its useful for lots of + other situations too. I don't know what syntax to use for win98, I + don't use it here. + + + rem Default logon script, create links to this file. + + net time \\bioserve /set /yes + @echo off + if %OS%.==Windows_NT. goto WinNT + + :Win95 + net use k: \\trillion\bio_prog + net use p: \\bcfile\homes + goto end + :WinNT + net use k: \\trillion\bio_prog /persistent:no + net use p: \\bcfile\homes /persistent:no + + :end + _________________________________________________________________ + +Chapter 5. Passwords and Authentication + + So far our configuration assumes that ordinary users don't have unix + logon access. A change to the adduser line above would allow unix + logon but it would be with passwords that may be different from the NT + logon. Clearly that won't suit everyone. Trying to explain to users + that they need to change their passwords in two seperate places is not + fun. Further, even if they cannot do a unix logon there are other + processes that might require authentication. We have a nice securely + encrypted password in /usr/local/samba/private/smbpasswd, why not use + it ? + _________________________________________________________________ + +Syncing Passwords + + Yes, its possible and seems the easiest way (initially anyway). The + FAQ details how to do so in the sections What is password sync and + should I use it ? and How do I get remote password (unix and SMB) + changing working ? + _________________________________________________________________ + +Using PAM + + Pam enabled systems have a much better solution available. The Samba + PDC server will offer to authenticate domain users to other processes + (either on this server or on the domain). With a suitable pam stack + such as Pam_smb you can get any pam aware application looking to the + samba password and can leave the password field in /etc/shadow or + /etc/passwd invalid. + _________________________________________________________________ + +Authenticating other Samba Servers + + In a domain that has a number of servers you only need one password + database. The machines that don't have their own ask the PDC to check + for them. This will work fine for a domain controlled by either a + Samba or NT machine. + + To do so the Samba machine must be told to refer to the PDC and where + the PDC is. See the section in the NTDom FAQ called How do I get my + samba server to become a member ( not PDC ) of an NT domain? + _________________________________________________________________ + +Chapter 6. Background + +History + + It might help you understand the limitations of the PDC in Samba if + you read something of its history. Well, the history as I understand + it anyway. + + For many years the Samba team have been developing Samba, some time + ago a number of people, possibly lead by Luke Leighton started + contributing NT PDC stuff. This was added to the 'head' stream (that + would eventually become the next version) and later to a seperate + stream (NTDom). They did so much that eventually this development + stream was so mutated that it could not be merged back into the main + stream and was abandoned towards the end of 1999. And that was very + sad because many users, myself include had become heavily dependant on + the NTController facilities it offered. Oh well... + + The NTDom team continued on with their new found knowledge however and + built the TNG stream. Intended to be carefully controlled so that it + can be merged back into the main stream and benefiting from what they + learnt, it is a very different product to the origional NTDom product. + However, for a number of reasons, the merge did not take place and now + TNG is being developed at http://www.samba-tng.org. + + Now, the NTDom things that the main strean 2.0.x version does is based + more on the old (initial version) abandoned code than on the TNG + ideas. It appears that version 2.2.0 will also include an improved + version of the 2.0.7 domain controller charactistics, not the TNG + ways. The developers have indicated that 2.2.0 will be further + developed incrementally and the ideas from TNG incorporated into it. + + One more little wriggle is worth mentioning. At one stage the NTDom + stream was called Samba 2.1.0-prealpha and similar names. This is most + unfortunate because at least one book published advises people who + want to use NTDom Samba to get version 2.1.0 or later. As main stream + Samba will soon be called 2.2.0 and NOT officially supporting NTDom + Controlling functions, the potential for confusion is certainly there. + _________________________________________________________________ + +The Future + + There is a document on the Samba mirrors called 'Development' . It + offers the 'best guess' of what is planned for future releases of + Samba. + + The future of Samba as a Primary Domain Controller appears rosie, + however be aware that its the future, not the present. The developers + are strongly committed to building a full featured PDC into Samba but + it will take time. If this version does not meet your requirements + then you should consider (in no particular order) : + + * Wait. No, we don't know how long. Repeated asking won't help. + * Investigate the development versions, TNG perhaps or HEAD where + new code is being added all the time. Realise that development + code is often unstable, poorly documented and subject to change. + You will need to use cvs to download development versions. + * Join one of the Samba mailing lists so that you can find out what + is happening on the 'bleeding edge'. + _________________________________________________________________ + +Getting further help + + This document cannot possibly answer all your questions. Please + understand that its very likely that someone has been confrounted by + the same problem that you have. The FAQ discusses a number of possible + paths to take to get further help : + + * Documents on the Samba Sites. + * Other web sites. + * Mailing list. + + There is some discussion about guide lines for using the Mailing Lists + on the accompanying FAQ, please read them before posting. |