From ff78c3bf5c3a73cf90f6517d9b2d6b8c12d22d68 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Tue, 18 Feb 2003 22:14:04 +0000 Subject: Regenerate (This used to be commit 1ab5a3b17feb677425bb1071357c3dbabcc46c7e) --- docs/htmldocs/winbind.html | 169 +++++++++++++++++++++++++++++++++------------ 1 file changed, 123 insertions(+), 46 deletions(-) (limited to 'docs/htmldocs/winbind.html') diff --git a/docs/htmldocs/winbind.html b/docs/htmldocs/winbind.html index 1558512a61..d587696817 100644 --- a/docs/htmldocs/winbind.html +++ b/docs/htmldocs/winbind.html @@ -5,8 +5,7 @@ >Unified Logons between Windows NT and UNIX using WinbindNext

Chapter 15. Unified Logons between Windows NT and UNIX using Winbind

Chapter 14. Unified Logons between Windows NT and UNIX using Winbind

15.1. Abstract

14.1. Abstract

Integration of UNIX and Microsoft Windows NT through a unified logon has been considered a "holy grail" in heterogeneous @@ -104,7 +107,9 @@ CLASS="SECT1" >

15.2. Introduction

14.2. Introduction

It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and @@ -156,7 +161,9 @@ CLASS="SECT1" >

15.3. What Winbind Provides

14.3. What Winbind Provides

Winbind unifies UNIX and Windows NT account management by allowing a UNIX box to become a full member of a NT domain. Once @@ -196,7 +203,9 @@ CLASS="SECT2" >

15.3.1. Target Uses

14.3.1. Target Uses

Winbind is targeted at organizations that have an existing NT based domain infrastructure into which they wish @@ -218,7 +227,9 @@ CLASS="SECT1" >

15.4. How Winbind Works

14.4. How Winbind Works

The winbind system is designed around a client/server architecture. A long running

15.4.1. Microsoft Remote Procedure Calls

14.4.1. Microsoft Remote Procedure Calls

Over the last two years, efforts have been underway +>Over the last few years, efforts have been underway by various Samba Team members to decode various aspects of the Microsoft Remote Procedure Call (MSRPC) system. This system is used for most network related operations between @@ -260,7 +273,28 @@ CLASS="SECT2" >

15.4.2. Name Service Switch

14.4.2. Microsoft Active Directory Services

Since late 2001, Samba has gained the ability to + interact with Microsoft Windows 2000 using its 'Native + Mode' protocols, rather than the NT4 RPC services. + Using LDAP and Kerberos, a domain member running + winbind can enumerate users and groups in exactly the + same way as a Win2k client would, and in so doing + provide a much more efficient and + effective winbind implementation. +

14.4.3. Name Service Switch

The Name Service Switch, or NSS, is a feature that is present in many UNIX operating systems. It allows system @@ -338,7 +372,9 @@ CLASS="SECT2" >

15.4.3. Pluggable Authentication Modules

14.4.4. Pluggable Authentication Modules

Pluggable Authentication Modules, also known as PAM, is a system for abstracting authentication and authorization @@ -385,7 +421,9 @@ CLASS="SECT2" >

15.4.4. User and Group ID Allocation

14.4.5. User and Group ID Allocation

When a user or group is created under Windows NT is it allocated a numerical relative identifier (RID). This is @@ -409,7 +447,9 @@ CLASS="SECT2" >

15.4.5. Result Caching

14.4.6. Result Caching

An active system can generate a lot of user and group name lookups. To reduce the network cost of these lookups winbind @@ -430,7 +470,9 @@ CLASS="SECT1" >

15.5. Installation and Configuration

14.5. Installation and Configuration

Many thanks to John Trostel

15.5.1. Introduction

14.5.1. Introduction

This HOWTO describes the procedures used to get winbind up and running on my RedHat 7.1 system. Winbind is capable of providing access @@ -512,7 +556,9 @@ CLASS="SECT2" >

15.5.2. Requirements

14.5.2. Requirements

If you have a samba configuration file that you are currently using...

15.5.3. Testing Things Out

14.5.3. Testing Things Out

Before starting, it is probably best to kill off all the SAMBA related daemons running on your server. Kill off all

15.5.3.1. Configure and compile SAMBA

14.5.3.1. Configure and compile SAMBA

The configuration and compilation of SAMBA is pretty straightforward. The first three steps may not be necessary depending upon @@ -657,7 +707,7 @@ CLASS="PROMPT" >root# ./configure --with-winbind./configure

15.5.3.2. Configure 14.5.3.2. Configure nsswitch.conf and the @@ -790,7 +842,9 @@ CLASS="SECT3" >

15.5.3.3. Configure smb.conf

14.5.3.3. Configure smb.conf

Several parameters are needed in the smb.conf file to control the behavior of 

[global]
-     <...>
+     <...>
      # separate domain and username with '+', like DOMAIN+username
      
15.5.3.4. Join the SAMBA server to the PDC domain
14.5.3.4. Join the SAMBA server to the PDC domain
Enter the following command to make the SAMBA server join the 
 PDC domain, where root# /usr/local/samba/bin/net rpc join -S PDC -U Administrator/usr/local/samba/bin/net join -S PDC -U Administrator
The proper response to the command should be: "Joined the domain 
@@ -907,7 +963,9 @@ CLASS="SECT3"
 >
15.5.3.5. Start up the winbindd daemon and test it!
14.5.3.5. Start up the winbindd daemon and test it!
Eventually, you will want to modify your smb startup script to 
 automatically invoke the winbindd daemon when the other parts of 
@@ -1028,13 +1086,17 @@ CLASS="SECT3"
 >
15.5.3.6. Fix the init.d startup scripts
14.5.3.6. Fix the init.d startup scripts
15.5.3.6.1. Linux
14.5.3.6.1. Linux
The 
15.5.3.6.2. Solaris
14.5.3.6.2. Solaris
On solaris, you need to modify the 
 
15.5.3.6.3. Restarting
14.5.3.6.3. Restarting
If you restart the 
15.5.3.7. Configure Winbind and PAM
14.5.3.7. Configure Winbind and PAM
If you have made it this far, you know that winbindd and samba are working
 together.  If you want to use winbind to provide authentication for other 
@@ -1275,7 +1343,9 @@ CLASS="SECT4"
 >
15.5.3.7.1. Linux/FreeBSD-specific PAM configuration
14.5.3.7.1. Linux/FreeBSD-specific PAM configuration
The 
15.5.3.7.2. Solaris-specific configuration
14.5.3.7.2. Solaris-specific configuration
The /etc/pam.conf needs to be changed. I changed this file so that my Domain
 users can logon both locally as well as telnet.The following are the changes
@@ -1476,7 +1548,7 @@ dtsession auth required	/usr/lib/security/$ISA/pam_unix.so.1
 >I also added a try_first_pass line after the winbind.so line to get rid of
 annoying double prompts for passwords.
Now restart your Samba & try connecting through your application that you
+>Now restart your Samba and try connecting through your application that you
 configured in the pam.conf.

15.6. Limitations

14.6. Limitations

Winbind has a number of limitations in its current released version that we hope to overcome in future @@ -1498,7 +1572,7 @@ NAME="AEN2542">15.6. Limitations

  • Winbind is currently only available for - the Linux operating system, although ports to other operating + the Linux, Solaris and IRIX operating systems, although ports to other operating systems are certainly possible. For such ports to be feasible, we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication @@ -1517,7 +1591,8 @@ NAME="AEN2542">15.6. Limitations

    Currently the winbind PAM module does not take into account possible workstation and logon time restrictions - that may be been set for Windows NT users.

    • 15.7. Conclusion

    14.7. Conclusion

    The winbind system, through the use of the Name Service Switch, Pluggable Authentication Modules, and appropriate @@ -1570,7 +1647,7 @@ WIDTH="33%" ALIGN="right" VALIGN="top" >NextPassdb MySQL pluginImproved browsing in samba