From 2fb5c7c580a3fff3c7d477b65a1c4852af86433b Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 1 Oct 2002 17:16:07 +0000 Subject: merge from HEAD (This used to be commit c0ca286e36d49deba6c73690114b0d867cbfd63e) --- docs/htmldocs/winbind.html | 320 +++++++++++++++++++++++++++------------------ 1 file changed, 194 insertions(+), 126 deletions(-) (limited to 'docs/htmldocs/winbind.html') diff --git a/docs/htmldocs/winbind.html b/docs/htmldocs/winbind.html index 7d45b174dd..cac9a70a6d 100644 --- a/docs/htmldocs/winbind.html +++ b/docs/htmldocs/winbind.html @@ -1,43 +1,92 @@ + Unified Logons between Windows NT and UNIX using Winbind
SAMBA Project Documentation
PrevNext

Unified Logons between Windows NT and UNIX using Winbind

Chapter 11. Unified Logons between Windows NT and UNIX using Winbind

Abstract

11.1. Abstract

Integration of UNIX and Microsoft Windows NT through a unified logon has been considered a "holy grail" in heterogeneous computing environments for a long time. We present - winbind, a component of the Samba suite of programs as a solution to the unified logon problem. Winbind uses a UNIX implementation @@ -49,12 +98,10 @@ CLASS="EMPHASIS" >

Introduction

11.2. Introduction

It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and @@ -103,12 +150,10 @@ NAME="AEN7" >

What Winbind Provides

11.3. What Winbind Provides

Winbind unifies UNIX and Windows NT account management by allowing a UNIX box to become a full member of a NT domain. Once @@ -145,12 +190,10 @@ NAME="AEN20" location (on the domain controller).

Target Uses

11.3.1. Target Uses

Winbind is targeted at organizations that have an existing NT based domain infrastructure into which they wish @@ -169,12 +212,10 @@ NAME="AEN27" >

How Winbind Works

11.4. How Winbind Works

The winbind system is designed around a client/server architecture. A long running

Microsoft Remote Procedure Calls

11.4.1. Microsoft Remote Procedure Calls

Over the last two years, efforts have been underway by various Samba Team members to decode various aspects of @@ -215,12 +254,10 @@ NAME="AEN36" >

Name Service Switch

11.4.2. Name Service Switch

The Name Service Switch, or NSS, is a feature that is present in many UNIX operating systems. It allows system @@ -295,12 +332,10 @@ CLASS="FILENAME" >

Pluggable Authentication Modules

11.4.3. Pluggable Authentication Modules

Pluggable Authentication Modules, also known as PAM, is a system for abstracting authentication and authorization @@ -344,12 +379,10 @@ CLASS="FILENAME" >

User and Group ID Allocation

11.4.4. User and Group ID Allocation

When a user or group is created under Windows NT is it allocated a numerical relative identifier (RID). This is @@ -370,12 +403,10 @@ NAME="AEN64" >

Result Caching

11.4.5. Result Caching

An active system can generate a lot of user and group name lookups. To reduce the network cost of these lookups winbind @@ -393,12 +424,10 @@ NAME="AEN68" >

Installation and Configuration

11.5. Installation and Configuration

Many thanks to John Trostel

Introduction

11.5.1. Introduction

This HOWTO describes the procedures used to get winbind up and running on my RedHat 7.1 system. Winbind is capable of providing access @@ -441,9 +468,12 @@ somewhat to fit the way your distribution works.

  • Why should I to this?

  • Who should be reading this document?

Requirements

11.5.2. Requirements

If you have a samba configuration file that you are currently -using... BACK IT UP! If your system already uses PAM, -back up the /etc/pam.d directory contents! If you haven't already made a boot disk, -MAKE ONE NOW!

Messing with the pam configuration files can make it nearly impossible @@ -534,12 +574,10 @@ CLASS="FILENAME" >

Testing Things Out

11.5.3. Testing Things Out

Before starting, it is probably best to kill off all the SAMBA related daemons running on your server. Kill off all RPMs installed.

Configure and compile SAMBA

11.5.3.1. Configure and compile SAMBA

The configuration and compilation of SAMBA is pretty straightforward. The first three steps may not be necessary depending upon @@ -645,16 +681,14 @@ It will also build the winbindd executable and libraries.

Configure 11.5.3.2. Configure nsswitch.conf and the -winbind libraries

The libraries needed to run the

Configure smb.conf

11.5.3.3. Configure smb.conf

Several parameters are needed in the smb.conf file to control the behavior of

Join the SAMBA server to the PDC domain

11.5.3.4. Join the SAMBA server to the PDC domain

Enter the following command to make the SAMBA server join the PDC domain, where

Start up the winbindd daemon and test it!

11.5.3.5. Start up the winbindd daemon and test it!

Eventually, you will want to modify your smb startup script to automatically invoke the winbindd daemon when the other parts of @@ -994,20 +1022,16 @@ CLASS="COMMAND" >

Fix the init.d startup scripts

11.5.3.6. Fix the init.d startup scripts

Linux

11.5.3.6.1. Linux

The

Solaris

11.5.3.6.2. Solaris

On solaris, you need to modify the

Restarting

11.5.3.6.3. Restarting

If you restart the

Configure Winbind and PAM

11.5.3.7. Configure Winbind and PAM

If you have made it this far, you know that winbindd and samba are working together. If you want to use winbind to provide authentication for other @@ -1251,12 +1269,10 @@ CLASS="COMMAND" >

Linux/FreeBSD-specific PAM configuration

11.5.3.7.1. Linux/FreeBSD-specific PAM configuration

The

Solaris-specific configuration

11.5.3.7.2. Solaris-specific configuration

The /etc/pam.conf needs to be changed. I changed this file so that my Domain users can logon both locally as well as telnet.The following are the changes @@ -1467,12 +1481,10 @@ configured in the pam.conf.

Limitations

11.6. Limitations

Winbind has a number of limitations in its current released version that we hope to overcome in future @@ -1508,12 +1520,10 @@ NAME="AEN320" >

Conclusion

11.7. Conclusion

The winbind system, through the use of the Name Service Switch, Pluggable Authentication Modules, and appropriate @@ -1523,6 +1533,64 @@ NAME="AEN330" cost of running a mixed UNIX and NT network.

PrevHomeNext
security = domain in Samba 2.x How to Configure Samba 2.2 as a Primary Domain Controller
\ No newline at end of file -- cgit