Chapter 6. Backup Domain Control

Before you continue reading in this section, please make sure that you are comfortable with configuring a Samba Domain Controller as described in the Domain Control Chapter. -

Features And Benefits

This is one of the most difficult chapters to summarise. It matters not what we say here for someone will still draw conclusions and / or approach the Samba-Team with expectations that are either not yet capable of being delivered, or that can be achieved for more @@ -63,7 +64,7 @@ lets consider each possible option and look at the pro's and con's for each theo Arguments Against: All machine trust accounts and user accounts will be locally maintained. Domain users will NOT be able to roam from office to office. This is a broken and flawed solution. Do NOT do this. -

Essential Background Information

A Domain Controller is a machine that is able to answer logon requests from network workstations. Microsoft LanManager and IBM LanServer were two early products that provided this capability. The technology has become known as the LanMan Netlogon service. @@ -73,7 +74,7 @@ and with it a new form of the network logon service that has extended functional This service became known as the NT NetLogon Service. The nature of this service has changed with the evolution of MS Windows NT and today provides a very complex array of services that are implemented over a complex spectrum of technologies. -

MS Windows NT4 Style Domain Control

Whenever a user logs into a Windows NT4 / 200x / XP Profresional Workstation, the workstation connects to a Domain Controller (authentication server) to validate the username and password that the user entered are valid. If the information entered @@ -131,7 +132,7 @@ one of the BDCs can be promoted to a PDC. If this happens while the original PDC line then it is automatically demoted to a BDC. This is an important aspect of Domain Controller management. The tool that is used to affect a promotion or a demotion is the Server Manager for Domains. -

Example PDC Configuration

Since version 2.2 Samba officially supports domain logons for all current Windows Clients, including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some parameters in the [global]-section of the smb.conf have to be set: @@ -143,20 +144,20 @@ parameters in the [global]-section of the [homes] and a [netlogon] share also need to be set along with settings for the profile path, the users home drive, etc.. This will not be covered in this chapter, for more information please refer to the chapter on Domain Control. -

`Active Directory Domain Control`

+

`Active Directory Domain Control`

As of the release of MS Windows 2000 and Active Directory, this information is now stored in a directory that can be replicated and for which partial or full administrative control can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT act as a Backup Domain Contoller to an Active Directory Domain Controller. -

`What qualifies a Domain Controller on the network?`

+

`What qualifies a Domain Controller on the network?`

Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network. The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server. The name type <#1b> name is normally reserved for the Domain Master Browser, a role that has nothing to do with anything related to authentication, but the Microsoft Domain implementation requires the domain master browser to be on the same machine as the PDC. -

`How does a Workstation find its domain controller?`

+

`How does a Workstation find its domain controller?`

An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a local user to be authenticated has to find the domain controller for SAMBA. It does this by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each @@ -164,7 +165,7 @@ of the machines it gets back from the queries is a domain controller and can ans requests. To not open security holes both the workstation and the selected domain controller authenticate each other. After that the workstation sends the user's credentials (name and password) to the local Domain Controller, for valdation. -

`Backup Domain Controller Configuration`

+

`Backup Domain Controller Configuration`

Several things have to be done:

The domain SID has to be the same on the PDC and the BDC. This used to @@ -193,7 +194,7 @@ Several things have to be done: BDC. This can be done manually whenever login scripts are changed, or it can be done automatically together with the smbpasswd synchronization. -

`Example Configuration`

+

`Example Configuration`

Finally, the BDC has to be found by the workstations. This can be done by setting:

 	workgroup = SAMBA
@@ -206,10 +207,10 @@ problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to
 be registered by more than one machine. The parameter 'domain master =
 no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS
 name is reserved for the Primary Domain Controller.
-

`Common Errors`

+

`Common Errors`

As this is a rather new area for Samba there are not many examples that we may refer to. Keep watching for updates to this section. -

`Machine Accounts keep expiring, what can I do?`

+

`Machine Accounts keep expiring, what can I do?`

This problem will occur when occur when the passdb (SAM) files are copied from a central server but the local Backup Domain Controllers. Local machine trust account password updates are not copied back to the central server. The newer machine account password is then over @@ -217,7 +218,7 @@ written when the SAM is copied from the PDC. The result is that the Domain membe on start up will find that it's passwords does not match the one now in the database and since the startup security check will now fail, this machine will not allow logon attempts to procede and the account expiry error will be reported. -

`Can Samba be a Backup Domain Controller to an NT4 PDC?`

+

`Can Samba be a Backup Domain Controller to an NT4 PDC?`

With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully implemented. The Samba Team is working on understanding and implementing the protocols, but this work has not been finished for version 2.2. @@ -228,7 +229,7 @@ mechanism has progressed, and some form of NT4 BDC support is expected soon. Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to service logon requests whenever the PDC is down. -

`How do I replicate the smbpasswd file?`

+

`How do I replicate the smbpasswd file?`

Replication of the smbpasswd file is sensitive. It has to be done whenever changes to the SAM are made. Every user's password change is done in the smbpasswd file and has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. @@ -238,7 +239,7 @@ sent unencrypted over the wire. The best way to set up smbpasswd replication fro the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. Ssh itself can be set up to accept *only* rsync transfer without requiring the user to type a password. -

`Can I do this all with LDAP?`

+

`Can I do this all with LDAP?`

The simple answer is YES. Samba's pdb_ldap code supports binding to a replica LDAP server, and will also follow referrals and rebind to the master if it ever needs to make a modification to the database. (Normally BDCs are read only, so -- cgit