docs/htmldocs/domain-security.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   2 <HTML
   3 ><HEAD
   4 ><TITLE
   5 >Samba as a NT4 or Win2k domain member</TITLE
   6 ><META
   7 NAME="GENERATOR"
   8 CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK
   9 REL="HOME"
  10 TITLE="SAMBA Project Documentation"
  11 HREF="samba-howto-collection.html"><LINK
  12 REL="UP"
  13 TITLE="Type of installation"
  14 HREF="type.html"><LINK
  15 REL="PREVIOUS"
  16 TITLE="Samba as a ADS domain member"
  17 HREF="ads.html"><LINK
  18 REL="NEXT"
  19 TITLE="Advanced Configuration"
  20 HREF="optional.html"></HEAD
  21 ><BODY
  22 CLASS="CHAPTER"
  23 BGCOLOR="#FFFFFF"
  24 TEXT="#000000"
  25 LINK="#0000FF"
  26 VLINK="#840084"
  27 ALINK="#0000FF"
  28 ><DIV
  29 CLASS="NAVHEADER"
  30 ><TABLE
  31 SUMMARY="Header navigation table"
  32 WIDTH="100%"
  33 BORDER="0"
  34 CELLPADDING="0"
  35 CELLSPACING="0"
  36 ><TR
  37 ><TH
  38 COLSPAN="3"
  39 ALIGN="center"
  40 >SAMBA Project Documentation</TH
  41 ></TR
  42 ><TR
  43 ><TD
  44 WIDTH="10%"
  45 ALIGN="left"
  46 VALIGN="bottom"
  47 ><A
  48 HREF="ads.html"
  49 ACCESSKEY="P"
  50 >Prev</A
  51 ></TD
  52 ><TD
  53 WIDTH="80%"
  54 ALIGN="center"
  55 VALIGN="bottom"
  56 ></TD
  57 ><TD
  58 WIDTH="10%"
  59 ALIGN="right"
  60 VALIGN="bottom"
  61 ><A
  62 HREF="optional.html"
  63 ACCESSKEY="N"
  64 >Next</A
  65 ></TD
  66 ></TR
  67 ></TABLE
  68 ><HR
  69 ALIGN="LEFT"
  70 WIDTH="100%"></DIV
  71 ><DIV
  72 CLASS="CHAPTER"
  73 ><H1
  74 ><A
  75 NAME="DOMAIN-SECURITY"
  76 ></A
  77 >Chapter 9. Samba as a NT4 or Win2k domain member</H1
  78 ><DIV
  79 CLASS="SECT1"
  80 ><H1
  81 CLASS="SECT1"
  82 ><A
  83 NAME="AEN1439"
  84 >9.1. Joining an NT Domain with Samba 3.0</A
  85 ></H1
  86 ><P
  87 >Assume you have a Samba 3.0 server with a NetBIOS name of
  88         <CODE
  89 CLASS="CONSTANT"
  90 >SERV1</CODE
  91 > and are joining an or Win2k NT domain called
  92         <CODE
  93 CLASS="CONSTANT"
  94 >DOM</CODE
  95 >, which has a PDC with a NetBIOS name
  96         of <CODE
  97 CLASS="CONSTANT"
  98 >DOMPDC</CODE
  99 > and two backup domain controllers
 100         with NetBIOS names <CODE
 101 CLASS="CONSTANT"
 102 >DOMBDC1</CODE
 103 > and <CODE
 104 CLASS="CONSTANT"
 105 >DOMBDC2
 106         </CODE
 107 >.</P
 108 ><P
 109 >Firstly, you must edit your <TT
 110 CLASS="FILENAME"
 111 >smb.conf</TT
 112 > file to tell Samba it should
 113         now use domain security.</P
 114 ><P
 115 >Change (or add) your <A
 116 HREF="smb.conf.5.html#SECURITY"
 117 TARGET="_top"
 118 >       <VAR
 119 CLASS="PARAMETER"
 120 >security =</VAR
 121 ></A
 122 > line in the [global] section
 123         of your <TT
 124 CLASS="FILENAME"
 125 >smb.conf</TT
 126 > to read:</P
 127 ><P
 128 ><B
 129 CLASS="COMMAND"
 130 >security = domain</B
 131 ></P
 132 ><P
 133 >Next change the <A
 134 HREF="smb.conf.5.html#WORKGROUP"
 135 TARGET="_top"
 136 ><VAR
 137 CLASS="PARAMETER"
 138 >       workgroup =</VAR
 139 ></A
 140 > line in the [global] section to read: </P
 141 ><P
 142 ><B
 143 CLASS="COMMAND"
 144 >workgroup = DOM</B
 145 ></P
 146 ><P
 147 >as this is the name of the domain we are joining. </P
 148 ><P
 149 >You must also have the parameter <A
 150 HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
 151 TARGET="_top"
 152 >       <VAR
 153 CLASS="PARAMETER"
 154 >encrypt passwords</VAR
 155 ></A
 156 > set to <CODE
 157 CLASS="CONSTANT"
 158 >yes
 159         </CODE
 160 > in order for your users to authenticate to the NT PDC.</P
 161 ><P
 162 >Finally, add (or modify) a <A
 163 HREF="smb.conf.5.html#PASSWORDSERVER"
 164 TARGET="_top"
 165 >       <VAR
 166 CLASS="PARAMETER"
 167 >password server =</VAR
 168 ></A
 169 > line in the [global]
 170         section to read: </P
 171 ><P
 172 ><B
 173 CLASS="COMMAND"
 174 >password server = DOMPDC DOMBDC1 DOMBDC2</B
 175 ></P
 176 ><P
 177 >These are the primary and backup domain controllers Samba
 178         will attempt to contact in order to authenticate users. Samba will
 179         try to contact each of these servers in order, so you may want to
 180         rearrange this list in order to spread out the authentication load
 181         among domain controllers.</P
 182 ><P
 183 >Alternatively, if you want smbd to automatically determine
 184         the list of Domain controllers to use for authentication, you may
 185         set this line to be :</P
 186 ><P
 187 ><B
 188 CLASS="COMMAND"
 189 >password server = *</B
 190 ></P
 191 ><P
 192 >This method, allows Samba to use exactly the same
 193         mechanism that NT does. This
 194         method either broadcasts or uses a WINS database in order to
 195         find domain controllers to authenticate against.</P
 196 ><P
 197 >In order to actually join the domain, you must run this
 198         command:</P
 199 ><P
 200 ><SAMP
 201 CLASS="PROMPT"
 202 >root# </SAMP
 203 ><KBD
 204 CLASS="USERINPUT"
 205 >net rpc join -S DOMPDC
 206         -U<VAR
 207 CLASS="REPLACEABLE"
 208 >Administrator%password</VAR
 209 ></KBD
 210 ></P
 211 ><P
 212 >as we are joining the domain DOM and the PDC for that domain
 213         (the only machine that has write access to the domain SAM database)
 214         is DOMPDC. The <VAR
 215 CLASS="REPLACEABLE"
 216 >Administrator%password</VAR
 217 > is
 218         the login name and password for an account which has the necessary
 219         privilege to add machines to the domain.  If this is successful
 220         you will see the message:</P
 221 ><P
 222 ><SAMP
 223 CLASS="COMPUTEROUTPUT"
 224 >Joined domain DOM.</SAMP
 225 >
 226         or <SAMP
 227 CLASS="COMPUTEROUTPUT"
 228 >Joined 'SERV1' to realm 'MYREALM'</SAMP
 229 >
 230         </P
 231 ><P
 232 >in your terminal window. See the <A
 233 HREF="net.8.html"
 234 TARGET="_top"
 235 >       net(8)</A
 236 > man page for more details.</P
 237 ><P
 238 >This process joins the server to thedomain
 239         without having to create the machine trust account on the PDC
 240         beforehand.</P
 241 ><P
 242 >This command goes through the machine account password
 243         change protocol, then writes the new (random) machine account
 244         password for this Samba server into a file in the same directory
 245         in which an smbpasswd file would be stored - normally :</P
 246 ><P
 247 ><TT
 248 CLASS="FILENAME"
 249 >/usr/local/samba/private/secrets.tdb</TT
 250 ></P
 251 ><P
 252 >This file is created and owned by root and is not
 253         readable by any other user. It is the key to the domain-level
 254         security for your system, and should be treated as carefully
 255         as a shadow password file.</P
 256 ><P
 257 >Finally, restart your Samba daemons and get ready for
 258         clients to begin using domain security!</P
 259 ></DIV
 260 ><DIV
 261 CLASS="SECT1"
 262 ><H1
 263 CLASS="SECT1"
 264 ><A
 265 NAME="AEN1493"
 266 >9.2. Why is this better than security = server?</A
 267 ></H1
 268 ><P
 269 >Currently, domain security in Samba doesn't free you from
 270         having to create local Unix users to represent the users attaching
 271         to your server. This means that if domain user <CODE
 272 CLASS="CONSTANT"
 273 >DOM\fred
 274         </CODE
 275 > attaches to your domain security Samba server, there needs
 276         to be a local Unix user fred to represent that user in the Unix
 277         filesystem. This is very similar to the older Samba security mode
 278         <A
 279 HREF="smb.conf.5.html#SECURITYEQUALSSERVER"
 280 TARGET="_top"
 281 >security = server</A
 282 >,
 283         where Samba would pass through the authentication request to a Windows
 284         NT server in the same way as a Windows 95 or Windows 98 server would.
 285         </P
 286 ><P
 287 >Please refer to the <A
 288 HREF="winbind.html"
 289 TARGET="_top"
 290 >Winbind
 291         paper</A
 292 > for information on a system to automatically
 293         assign UNIX uids and gids to Windows NT Domain users and groups.
 294         This code is available in development branches only at the moment,
 295         but will be moved to release branches soon.</P
 296 ><P
 297 >The advantage to domain-level security is that the
 298         authentication in domain-level security is passed down the authenticated
 299         RPC channel in exactly the same way that an NT server would do it. This
 300         means Samba servers now participate in domain trust relationships in
 301         exactly the same way NT servers do (i.e., you can add Samba servers into
 302         a resource domain and have the authentication passed on from a resource
 303         domain PDC to an account domain PDC.</P
 304 ><P
 305 >In addition, with <B
 306 CLASS="COMMAND"
 307 >security = server</B
 308 > every Samba
 309         daemon on a server has to keep a connection open to the
 310         authenticating server for as long as that daemon lasts. This can drain
 311         the connection resources on a Microsoft NT server and cause it to run
 312         out of available connections. With <B
 313 CLASS="COMMAND"
 314 >security = domain</B
 315 >,
 316         however, the Samba daemons connect to the PDC/BDC only for as long
 317         as is necessary to authenticate the user, and then drop the connection,
 318         thus conserving PDC connection resources.</P
 319 ><P
 320 >And finally, acting in the same manner as an NT server
 321         authenticating to a PDC means that as part of the authentication
 322         reply, the Samba server gets the user identification information such
 323         as the user SID, the list of NT groups the user belongs to, etc. </P
 324 ><DIV
 325 CLASS="NOTE"
 326 ><P
 327 ></P
 328 ><TABLE
 329 CLASS="NOTE"
 330 WIDTH="100%"
 331 BORDER="0"
 332 ><TR
 333 ><TD
 334 WIDTH="25"
 335 ALIGN="CENTER"
 336 VALIGN="TOP"
 337 ><IMG
 338 SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
 339 HSPACE="5"
 340 ALT="Note"></TD
 341 ><TD
 342 ALIGN="LEFT"
 343 VALIGN="TOP"
 344 ><P
 345 > Much of the text of this document
 346         was first published in the Web magazine <A
 347 HREF="http://www.linuxworld.com"
 348 TARGET="_top"
 349 >
 350         LinuxWorld</A
 351 > as the article <A
 352 HREF="http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html"
 353 TARGET="_top"
 354 >Doing
 355         the NIS/NT Samba</A
 356 >.</P
 357 ></TD
 358 ></TR
 359 ></TABLE
 360 ></DIV
 361 ></DIV
 362 ></DIV
 363 ><DIV
 364 CLASS="NAVFOOTER"
 365 ><HR
 366 ALIGN="LEFT"
 367 WIDTH="100%"><TABLE
 368 SUMMARY="Footer navigation table"
 369 WIDTH="100%"
 370 BORDER="0"
 371 CELLPADDING="0"
 372 CELLSPACING="0"
 373 ><TR
 374 ><TD
 375 WIDTH="33%"
 376 ALIGN="left"
 377 VALIGN="top"
 378 ><A
 379 HREF="ads.html"
 380 ACCESSKEY="P"
 381 >Prev</A
 382 ></TD
 383 ><TD
 384 WIDTH="34%"
 385 ALIGN="center"
 386 VALIGN="top"
 387 ><A
 388 HREF="samba-howto-collection.html"
 389 ACCESSKEY="H"
 390 >Home</A
 391 ></TD
 392 ><TD
 393 WIDTH="33%"
 394 ALIGN="right"
 395 VALIGN="top"
 396 ><A
 397 HREF="optional.html"
 398 ACCESSKEY="N"
 399 >Next</A
 400 ></TD
 401 ></TR
 402 ><TR
 403 ><TD
 404 WIDTH="33%"
 405 ALIGN="left"
 406 VALIGN="top"
 407 >Samba as a ADS domain member</TD
 408 ><TD
 409 WIDTH="34%"
 410 ALIGN="center"
 411 VALIGN="top"
 412 ><A
 413 HREF="type.html"
 414 ACCESSKEY="U"
 415 >Up</A
 416 ></TD
 417 ><TD
 418 WIDTH="33%"
 419 ALIGN="right"
 420 VALIGN="top"
 421 >Advanced Configuration</TD
 422 ></TR
 423 ></TABLE
 424 ></DIV
 425 ></BODY
 426 ></HTML
 427 >