| blob | 64ced919a48111bcf88e54d016e73fbebf58eb0d |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
5 <!-- entities files to use -->
6 <!ENTITY % global_entities SYSTEM '../entities/global.entities'>
7 %global_entities;
9 ]>
11 <chapter id="2000users">
12 <title>A Distributed 2000 User Network</title>
14 <para>There is something indeed mystical about things that are
15 big. Large networks exhibit a certain magnetism and exude a sense of
16 importance that obscures reality. You and I know that it is no more
17 difficult to secure a large network than it is a small one. We all
18 know that over and above a particular number of network clients, the
19 rules no longer change; the only real dynamic is the size of the domain
20 (much like a kingdom) over which the network ruler (oops, administrator)
21 has control. The real dynamic then transforms from the technical to the
22 political. Then again, that point is often reached well before the
23 kingdom (or queendom) grows large.</para>
25 <para>If you have systematically worked your way to this chapter, hopefully you
26 have found some gems and techniques that are applicable in your
27 world. The network designs you have worked with in this book with have their
28 strong points as well as weak ones. That is to be expected given that
29 they are based on real business environments, excepting that the facts
30 have been moulded to serve the purposes of this book.</para>
32 <para>This chapter is intent on wrapping up issues that are central to
33 implementation and design of progressively larger networks. Are you ready
34 for this chapter? Good, it is time to move on.</para>
36 <para>In previous chapters, you made the assumption that your network
37 administration staff need detailed instruction right down to the
38 nuts-and-bolts of implementing the solution. That's is still the case,
39 but they have graduated now. You decide to document only those issues,
40 methods and techniques that are new or complex. Routine tasks such as
41 implementing a DNS or a DHCP server are under control. Even the basics of
42 Samba are largely under control. So in this section you focus on the
43 specifics of implementing LDAP changes, Samba changes, and approach and
44 design of the solution and its deployment.</para>
46 <sect1>
47 <title>Introduction</title>
49 <para>
50 Abmas is a miracle company. Most businesses would have collapsed under
51 the weight of rapid expansion that this company has experienced. Samba
52 is flexible, so there is no need to reinstall the whole operating
53 system just because you need to implement a new network design. In fact,
54 you can keep an old server running right up to the moment of cut-over
55 and then do a near-live conversion. There is no need to reinstall a
56 Samba server just to change the way your network should function.
57 </para>
59 <para><indexterm>
60 <primary>LDAP</primary>
61 </indexterm>
62 Network growth is common to all organizations. In this exercise,
63 your preoccupation is with the mechanics of implementing Samba and
64 LDAP so that network users on each network segment can work
65 without impediment.</para>
67 <sect2>
68 <title>Assignment Tasks</title>
70 <para>
71 Starting with the configuration files for the server called
72 <constant>MASSIVE</constant> in Chapter 6, you now deal with the
73 issues that are particular to large distributed networks. Your task
74 is simple &smbmdash; identify the challenges, consider the
75 alternatives, and then design and implement a solution.</para>
77 <para><indexterm>
78 <primary>VPN</primary>
79 </indexterm>
80 Remember, you have users based in London (UK), Los Angeles,
81 Washington DC, and three buildings in New York. A significant portion
82 of your workforce have notebook computers and roam all over the
83 world. Some dial into the office, others use VPN connections over the
84 Internet and others just move between buildings.</para>
86 <para>What do you say to an employee who normally uses a desktop
87 system but must spend six weeks on the road with a notebook computer?
88 She is concerned over email access and how to keep co-workers current
89 with changing documents.</para>
91 <para>To top it all off, you have one network support person and one
92 Help desk person based in London, a single person dedicated to all
93 network operations in Los Angeles, five staff for user administration
94 and Help desk in New York, plus one <emphasis>floater</emphasis> for
95 Washington DC.</para>
97 <para>You have outsourced all desktop deployment and management to
98 DirectPointe,Inc. Your concern is server maintenance and third-level
99 support. Build a plan and show what must be done.</para>
101 </sect2>
102 </sect1>
104 <sect1>
105 <title>Dissection and Discussion</title>
107 <para><indexterm>
108 <primary>passdb backend</primary>
109 </indexterm><indexterm>
110 <primary>LDAP</primary>
111 </indexterm>
112 In the previous chapter, you implemented an LDAP server that provided the
113 <parameter>passdb backend</parameter> for the Samba servers. You
114 explored ways to accelerate Windows desktop profile handling and you
115 took control of network performance.
116 </para>
118 <para><indexterm>
119 <primary>ldapsam</primary>
120 </indexterm><indexterm>
121 <primary>tdbsam</primary>
122 </indexterm><indexterm>
123 <primary>smbpasswd</primary>
124 </indexterm><indexterm>
125 <primary>replicated</primary>
126 </indexterm>
127 The implementation of an LDAP-based passdb backend (known as
128 <emphasis>ldapsam</emphasis> in Samba parlance), or some form of database
129 that can be distributed, is essential to permit the deployment of Samba
130 Primary and Backup Domain Controllers (PDC/BDCs). You see, the problem
131 is that the <emphasis>tdbsam</emphasis> style passdb backend does not
132 lend itself to being replicated. The older plain-text-based
133 <emphasis>smbpasswd</emphasis> style passdb backend can be replicated
134 using a tool such as <command>rsync</command>, but
135 <emphasis>smbpasswd</emphasis> suffers the drawback that it does not
136 support the range of account facilities demanded by modern network
137 managers.</para>
139 <para><indexterm>
140 <primary>XML</primary>
141 </indexterm><indexterm>
142 <primary>SQL</primary>
143 </indexterm>
144 The new <emphasis>tdbsam</emphasis> facility supports functionality
145 that is similar to an <emphasis>ldapsam</emphasis>, but the lack of
146 distributed infrastructure sorely limits the scope for its
147 deployment. This does raise the following questions: "Why can't I just use
148 an XML based backend, or for that matter, why not use an SQL based
149 backend?" "Is support for these tools broken?" No. Answers to these
150 questions require a bit of background.</para>
152 <para><indexterm>
153 <primary>directory</primary>
154 </indexterm><indexterm>
155 <primary>database</primary>
156 </indexterm><indexterm>
157 <primary>transaction processing</primary>
158 </indexterm><indexterm>
159 <primary>LDAP</primary>
160 </indexterm>
161 <emphasis>What is a directory?</emphasis> A directory is a
162 collection of information regarding objects that can be accessed to
163 rapidly find information that is relevant in a particular and
164 consistent manner. A directory differs from a database in that it is
165 generally more often searched (read) than updated. As a consequence, the
166 information is organized to facilitate read access rather than to
167 support transaction processing.</para>
169 <para><indexterm>
170 <primary>Lightweight Directory Access Protocol </primary>
171 <see>LDAP</see>
172 </indexterm><indexterm>
173 <primary>LDAP</primary>
174 </indexterm><indexterm>
175 <primary>master</primary>
176 </indexterm><indexterm>
177 <primary>slave</primary>
178 </indexterm>
179 The Lightweight Directory Access Protocol (LDAP) differs
180 considerably from a traditional database. It has a simple search
181 facility that uniquely makes a highly preferred mechanism for managing
182 user identities. LDAP provides a scalable mechanism for distributing
183 the data repository and for keeping all copies (slaves) in sync with
184 the master repository.</para>
186 <para><indexterm>
187 <primary>identity management</primary>
188 </indexterm><indexterm>
189 <primary>Active Directory</primary>
190 </indexterm><indexterm>
191 <primary>OpenLDAP</primary>
192 </indexterm>
193 Samba is a flexible and powerful file and print sharing
194 technology. It can use many external authentication sources and can be
195 part of a total authentication and identity management
196 infrastructure. The two most important external sources for large sites
197 are Microsoft Active Directory and LDAP. Sites that specifically wish to
198 avoid the proprietary implications of Microsoft Active Directory
199 naturally gravitate toward OpenLDAP.</para>
201 <para><indexterm>
202 <primary>network</primary>
203 <secondary>routed</secondary>
204 </indexterm>
205 In Chapter 6, you had to deal with a locally routed
206 network. All deployment concerns focused around making users happy,
207 and that simply means taking control over all network practices and
208 usage so that no one user is disadvantaged by any other. The real
209 lesson is one of understanding that no matter how much network
210 bandwidth you provide, bandwidth remains a precious resource.</para>
212 <para>In this chapter, you must now consider how the overall network must
213 function. In particular, you must be concerned with users who move
214 between offices. You must take into account the way users need to
215 access information globally. And you must make the network robust
216 enough so that it can sustain partial breakdown without causing loss of
217 productivity.</para>
219 <sect2>
220 <title>Technical Issues</title>
222 <para>There are at least three areas that need to be addressed as you
223 approach the challenge of designing a network solution for the newly
224 expanded business. These are:</para>
226 <itemizedlist>
227 <listitem>
228 <para><indexterm>
229 <primary>mobility</primary>
230 </indexterm>
231 User needs such as mobility and data access</para>
232 </listitem>
233 <listitem>
234 <para>The nature of Windows networking protocols</para>
235 </listitem>
236 <listitem>
237 <para>Identity management infrastructure needs</para>
238 </listitem>
239 </itemizedlist>
241 <para>Let's look at each in turn.</para>
243 <sect3>
244 <title>User Needs</title>
246 <para>The new company has three divisions. Staff for each division
247 are spread across the company. Some staff are office-bound and
248 some are mobile users. Mobile users travel globally. Some spend
249 considerable periods working in other offices. Everyone wants to be
250 able to work without constraint of productivity.</para>
252 <para>The challenge is not insignificant. In some parts of the world,
253 even dial-up connectivity is poor, while in other regions political
254 encumbrances severely curtail user needs. Parts of the global
255 Internet infrastructure remain shielded-off for reasons outside
256 the scope of this discussion.</para>
258 <para><indexterm>
259 <primary>synchronize</primary>
260 </indexterm>
261 Decisions must be made regarding where data is to be stored, how
262 it will be replicated (if at all), and what the network bandwidth
263 implications are. For example, one decision that can be made is
264 to give each office its own master file storage area that can be
265 synchronized to a central repository in New York. This would permit
266 global data to be backed up from a single location. The
267 synchronization tool could be <command>rsync,</command> run via a
268 cron job. Mobile users may use off-line file storage under Windows
269 XP Professional. This way, they can synchronize all files that have
270 changed since each logon to the network.</para>
272 <para><indexterm>
273 <primary>bandwidth</primary>
274 <secondary>requirements</secondary>
275 </indexterm><indexterm>
276 <primary>roaming profile</primary>
277 </indexterm>
278 No matter which way you look at this, the bandwidth requirements
279 for acceptable performance are substantial even if only 10 percent of
280 staff are global data users. A company with 3500 employees
281 and 280 of those were mobile users, and who used a similarly distributed
282 network, found they needed at least 2 Megabit/sec connectivity
283 between the UK and US offices. Even over 2 Mb/s bandwidth, this
284 company abandoned any attempt to run roaming profile usage for
285 mobile users. At that time, the average roaming profile took 480
286 Kbytes, while today the minimum Windows XP Professional roaming
287 profile involves a transfer of over 750 Kbytes from the profile
288 server to/from the client.</para>
290 <para><indexterm>
291 <primary>wide-area</primary>
292 </indexterm>
293 Obviously then, user needs and wide-area practicalities
294 dictate the economic and technical aspects of your network
295 design as well as for standard operating procedures.</para>
297 </sect3>
299 <sect3>
300 <title>The Nature of Windows Networking Protocols</title>
302 <para><indexterm>
303 <primary>profile</primary>
304 <secondary>mandatory</secondary>
305 </indexterm>
306 Network logons that include roaming profile handling requires
307 from 140 Kbytes to 2 Mbytes. The inclusion of support for a minimal
308 set of common desktop applications can push the size of a complete
309 profile to over 15 Mbytes. This has substantial implications so far
310 as location of user profiles is concerned. Additionally, it is a
311 significant factor in determining the nature and style of mandatory
312 profiles that may be enforced as part of a total service level
313 assurance program that might be implemented.</para>
315 <para><indexterm>
316 <primary>logon traffic</primary>
317 </indexterm><indexterm>
318 <primary>redirected folders</primary>
319 </indexterm>
320 One way to reduce the network bandwidth impact of user logon
321 traffic is through folder redirection. In Chapter 6, you
322 implemented this in the new Windows XP Professional standard
323 desktop configuration. When desktop folders such as <guimenu>My
324 Documents</guimenu> are redirected to a network drive, they should
325 also be excluded from synchronization to/from the server on
326 logon/out. Redirected folders are analogous to network drive
327 connections.</para>
329 <para><indexterm>
330 <primary>application servers</primary>
331 </indexterm>
332 Of course, network applications should only be run off
333 local application servers. As a general rule, even with 2 Mbit/sec
334 network bandwidth, it would not make sense at all for someone who
335 is working out of the London office to run applications off a
336 server that is located in New York.</para>
338 <para><indexterm>
339 <primary>affordability</primary>
340 </indexterm>
341 When network bandwidth becomes a precious commodity (that is most
342 of the time), there is a significant demand to understand network
343 processes and to mould the limits of acceptability around the
344 constraints of affordability.</para>
346 <para>When a Windows NT4/200x/XP Professional client user logs onto
347 the network, several important things must happen.</para>
349 <itemizedlist>
350 <listitem>
351 <para><indexterm>
352 <primary>DHCP</primary>
353 </indexterm>
354 The client obtains an IP address via DHCP. (DHCP is
355 necessary so that users can roam between offices.)</para>
356 </listitem>
357 <listitem>
358 <para><indexterm>
359 <primary>WINS</primary>
360 </indexterm><indexterm>
361 <primary>DNS</primary>
362 </indexterm>
363 The client must register itself with the WINS and/or DNS
364 server.</para>
365 </listitem>
366 <listitem>
367 <para><indexterm>
368 <primary>Domain Controller</primary>
369 <secondary>closest</secondary>
370 </indexterm>
371 The client must locate the closest Domain Controller.</para>
372 </listitem>
373 <listitem>
374 <para>The client must log onto a Domain Controller and obtain as
375 part of that process the location of the user's profile, load
376 it, connect to redirected folders, and establish all network
377 drive and printer connections.</para>
378 </listitem>
379 <listitem>
380 <para>The Domain Controller must be able to resolve the user's
381 credentials before the logon process is fully implemented.</para>
382 </listitem>
383 </itemizedlist>
385 <para>Given that this book is about Samba and the fact that it
386 implements the Windows NT4 style domain semantics, it makes little
387 sense to compare Samba with Microsoft Active Directory insofar as
388 the logon protocols and principles of operation are
389 concerned. The following information pertains exclusively to the
390 interaction between a Windows XP Professional workstation and a
391 Samba-3.0.2 server. In the discussion that follows, use is made of
392 DHCP and WINS.</para>
394 <para>As soon as the Windows workstation starts up, it obtains an
395 IP address. This is immediately followed by registration of its
396 name both by broadcast and Unicast registration that is directed
397 at the WINS server.</para>
399 <para><indexterm>
400 <primary>Unicast</primary>
401 </indexterm><indexterm>
402 <primary>broadcast</primary>
403 <secondary>directed</secondary>
404 </indexterm><indexterm>
405 <primary>NetBIOS</primary>
406 </indexterm>
407 Given that the client is already a Domain Member, it then sends
408 a directed (Unicast) request to the WINS server seeking the list of
409 IP addresses for domain controllers (NetBIOS name type 0x1C). The
410 WINS server replies with the information requested.</para>
412 <para><indexterm>
413 <primary>broadcast</primary>
414 <secondary>mailslot</secondary>
415 </indexterm><indexterm>
416 <primary>Unicast</primary>
417 </indexterm><indexterm>
418 <primary>WINS</primary>
419 </indexterm>
420 The client sends two netlogon mailslot broadcast requests
421 to the local network and to each of the IP addresses returned by
422 the WINS server. Whichever answers this request first appears to
423 be the machine that the Windows XP client attempts to use to
424 process the network logon. The mailslot messages use UDP broadcast
425 to the local network and UDP Unicast directed at each machine that
426 was listed in the WINS server response to a request for the list of
427 Domain Controllers.</para>
429 <para><indexterm>
430 <primary>protocol</primary>
431 <secondary>negotiation</secondary>
432 </indexterm><indexterm>
433 <primary>logon server</primary>
434 </indexterm><indexterm>
435 <primary>fail</primary>
436 </indexterm>
437 The logon process begins with negotiation of the SMB/CIFS
438 protocols that are to be used; this is followed by an exchange of
439 information that ultimately includes the client sending the
440 credentials with which the user is attempting to logon. The logon
441 server must now approve the further establishment of the
442 connection, but that is a good point to halt for now. The priority
443 here must center around identification of network infrastructure
444 needs. A secondary fact we need to know is, what happens when
445 local Domain Controllers fail or break?</para>
447 <para><indexterm>
448 <primary>Domain Controller</primary>
449 </indexterm><indexterm>
450 <primary>PDC</primary>
451 </indexterm><indexterm>
452 <primary>BDC</primary>
453 </indexterm><indexterm>
454 <primary>netlogon</primary>
455 </indexterm>
456 Under most circumstances, the nearest Domain Controller
457 responds to the netlogon mailslot broadcast. The exception to this
458 norm occurs when the nearest Domain Controller is too busy or is out
459 of service. Herein lies an important fact. This means it is
460 important that every network segment should have at least two
461 Domain Controllers. Since there can be only one Primary Domain
462 Controller (PDC), all additional Domain Controllers are by definition
463 Backup Domain Controllers (BDCs).</para>
465 <para><indexterm>
466 <primary>authentication</primary>
467 </indexterm><indexterm>
468 <primary>Identity Management</primary>
469 </indexterm>
470 The provision of sufficient servers that are BDCs is an
471 important design factor. The second important design factor
472 involves how each of the BDCs obtains user authentication
473 data. That is the subject of the next section as it involves key
474 decisions regarding Identity Management facilities.</para>
476 </sect3>
478 <sect3>
479 <title>Identity Management Needs</title>
481 <para><indexterm>
482 <primary>privacy</primary>
483 </indexterm><indexterm>
484 <primary>user credentials</primary>
485 </indexterm><indexterm>
486 <primary>validated</primary>
487 </indexterm><indexterm>
488 <primary>privileges</primary>
489 </indexterm>
490 Network managers recognize that in large organizations users
491 generally need to be given resource access based on needs, while
492 being excluded from other resources for reasons of privacy. It is,
493 therefore, essential that all users identify themselves at the
494 point of network access. The network logon is the principal means
495 by which user credentials are validated and filtered, and appropriate
496 rights and privileges are allocated.</para>
498 <para><indexterm>
499 <primary>Identity Management</primary>
500 </indexterm><indexterm>
501 <primary>Yellow Pages</primary>
502 </indexterm><indexterm>
503 <primary>NIS</primary>
504 </indexterm>
505 Unfortunately, network resources tend to have their own Identity
506 Management facilities, the quality and manageability of which varies
507 from quite poor to exceptionally good. Corporations that use a mixture
508 of systems soon discover that until recently, few systems were
509 designed to interoperate. For example, UNIX systems each have an
510 independent user database. Sun Microsystems developed a facility that
511 was originally called <constant>Yellow Pages</constant>, and was renamed
512 when a telephone company objected to the use of its trademark.
513 What was once called <constant>Yellow Pages</constant> is today known
514 as <constant>Network Information System</constant> (NIS).</para>
516 <para><indexterm>
517 <primary>NIS+</primary>
518 </indexterm>
519 NIS gained a strong following throughout the UNIX/VMS space in a
520 short period of time and retained that appeal and use
521 for over a decade. Security concerns as well as inherent limitations
522 have caused it to enter its twilight. NIS did not gain widespread
523 appeal outside of the UNIX world and was not universally
524 adopted. Sun updated this to a more secure implementation called
525 NIS+, but even it has fallen victim to changing demands as the
526 demand for directory services that can be coupled with other
527 information systems is catching on.</para>
529 <para><indexterm>
530 <primary>NIS</primary>
531 </indexterm><indexterm>
532 <primary>government</primary>
533 </indexterm><indexterm>
534 <primary>education</primary>
535 </indexterm>
536 Nevertheless, both NIS and NIS+ continue to hold ground in
537 business areas where UNIX still has major sway. Examples of
538 organizations that remain firmly attached to the use of NIS and
539 NIS+ includes large government departments, education institutions,
540 as well as large corporations that have a scientific or engineering
541 focus.</para>
543 <para><indexterm>
544 <primary>scalable</primary>
545 </indexterm><indexterm>
546 <primary>distributed</primary>
547 </indexterm>
548 Today's networking world needs a scalable, distributed Identity
549 Management infrastructure, commonly called a directory. The most
550 popular technologies today are Microsoft Active Directory service
551 and a number of LDAP implementations.</para>
553 <para><indexterm>
554 <primary>multiple directories</primary>
555 </indexterm>
556 The problem of managing multiple directories has become a focal
557 point over the past decade. This has created a large market for
558 meta-directory products and services that allow organizations that
559 have multiple directories and multiple management and control
560 centers to provision information from one directory into
561 another. The attendant benefit to end users is the promise of
562 having to remember and deal with fewer login identities and
563 passwords.</para>
565 <para><indexterm>
566 <primary>network</primary>
567 <secondary>bandwidth</secondary>
568 </indexterm>
569 The challenge of every large network is to find the optimum
570 balance of internal systems and facilities for Identity
571 Management resources. How well the solution is chosen and
572 implemented has potentially significant impact on network bandwidth
573 and systems response needs.</para>
575 <para><indexterm>
576 <primary>LDAP server</primary>
577 </indexterm><indexterm>
578 <primary>LDAP</primary>
579 <secondary>master</secondary>
580 </indexterm><indexterm>
581 <primary>LDAP</primary>
582 <secondary>slave</secondary>
583 </indexterm>
584 In Chapter 6, you implemented a single LDAP server for the
585 entire network. This may work for smaller networks, but almost
586 certainly fails to meet the needs of large and complex networks. The
587 following section documents how one may implement a single
588 master LDAP server, with multiple slave servers.</para>
590 <para>What is the best method for implementing master/slave LDAP
591 servers within the context of a distributed 2000 user network is a
592 question that remains to be answered.</para>
594 <para><indexterm>
595 <primary>distributed domain</primary>
596 </indexterm><indexterm>
597 <primary>wide-area</primary>
598 </indexterm>
599 One possibility that has great appeal is to create one single
600 large distributed domain. The practical implications of this
601 design (see <link linkend="chap7net"/>) demands the placement of
602 sufficient BDCs in each location. Additionally, network
603 administrators must make sure that profiles are not transferred
604 over the wide-area links, except as a totally unavoidable
605 measure. Network design must balance the risk of loss of user
606 productivity against the cost of network management and
607 maintenance.</para>
609 <para><indexterm>
610 <primary>domain name space</primary>
611 </indexterm>
612 The network design in <link linkend="chap7net2"/> takes the
613 approach that management of networks that are too remote to be
614 capable of being managed effectively from New York ought
615 to be given a certain degree of autonomy. With this rationale, the
616 Los Angeles and London networks, though fully integrated with that
617 on the east coast of the USA, each have their own domain name space
618 and can be independently managed and controlled. One of the key
619 drawbacks of this design is that it flies in the face of the
620 ability for network users to roam globally without some compromise
621 in how they may access global resources.</para>
623 <para><indexterm>
624 <primary>interdomain trusts</primary>
625 </indexterm>
626 Desk-bound users need not be negatively affected by this
627 design, since the use of interdomain trusts can be used to satisfy
628 the need for global data sharing.</para>
630 <para><indexterm>
631 <primary>LDAP</primary>
632 </indexterm><indexterm>
633 <primary>LDAP</primary>
634 <secondary>backend</secondary>
635 </indexterm><indexterm>
636 <primary>SID</primary>
637 </indexterm>
638 When Samba-3 is configured to use an LDAP backend, it stores the domain
639 account information in a directory entry. This account entry contains
640 the domain SID. An unintended but exploitable side effect is that
641 this makes it possible to operate with more than one PDC on a
642 distributed network.</para>
644 <para><indexterm>
645 <primary>WINS</primary>
646 </indexterm><indexterm>
647 <primary>wins.dat</primary>
648 </indexterm><indexterm>
649 <primary>SID</primary>
650 </indexterm>
651 How might this peculiar feature be exploited? The answer is
652 simple. It is imperative that each network segment should have its
653 own WINS server. Major servers on remote network segments can be
654 given a static WINS entry in the <filename>wins.dat</filename> file
655 on each WINS server. This allows all essential data to be
656 visible from all locations. Each location would, however, function
657 as if it is an independent domain, while all sharing the same
658 domain SID. Since all domain account information can be stored in a
659 single LDAP backend, users have unfettered ability to
660 roam.</para>
662 <para><indexterm>
663 <primary>NetBIOS name</primary>
664 <secondary>aliases</secondary>
665 </indexterm><indexterm>
666 <primary>fail-over</primary>
667 </indexterm>
668 This concept has not been exhaustively validated, though we can
669 see no reason why this should not work. The important facets
670 are: The name of the domain must be identical in all
671 locations. Each network segment must have its own WINS server. The
672 name of the PDC must be the same in all locations; this
673 necessitates the use of NetBIOS name aliases for each PDC so that
674 they can be accessed globally using the alias and not the PDC's
675 primary name. A single master LDAP server can be based in New York,
676 with multiple LDAP slave servers located on every network
677 segment. Finally, the BDCs should each use fail-over LDAP servers
678 that are in fact slave LDAP servers on the local segments.</para>
680 <para><indexterm>
681 <primary>LDAP</primary>
682 <secondary>updates</secondary>
683 </indexterm><indexterm>
684 <primary>domain tree</primary>
685 </indexterm><indexterm>
686 <primary>LDAP</primary>
687 <secondary>database</secondary>
688 </indexterm><indexterm>
689 <primary>LDAP</primary>
690 <secondary>directory</secondary>
691 </indexterm>
692 With a single master LDAP server, all network updates are
693 effected on a single server. In the event that this should become
694 excessively fragile or network bandwidth limiting, one could
695 implement a delegated LDAP domain. This is also known as a
696 partitioned (or multiple partition) LDAP database
697 and as a distributed LDAP directory.</para>
699 <para>As the LDAP directory grows, it becomes increasingly important
700 that its structure is implemented in a manner that mirrors
701 organizational needs, so as to limit network update and
702 referential traffic. It should be noted that all directory
703 administrators must of necessity follow the same standard
704 procedures for managing the directory, as retroactive correction of
705 inconsistent directory information can be exceedingly difficult.</para>
707 <image id="chap7net">
708 <imagedescription>Network Topology &smbmdash; 2000 User Complex Design A</imagedescription>
709 <imagefile scale="80">chap7-net-Ar</imagefile>
710 </image>
712 <image id="chap7net2">
713 <imagedescription>Network Topology &smbmdash; 2000 User Complex Design B</imagedescription>
714 <imagefile scale="80">chap7-net2-Br</imagefile>
715 </image>
717 </sect3>
719 </sect2>
722 <sect2>
723 <title>Political Issues</title>
725 <para>As organizations grow, the number of points of control increase
726 also. In a large distributed organization, it is important that the
727 Identity Management system must be capable of being updated from
728 many locations, and it is equally important that changes made should
729 become capable of being used in a reasonable period, typically
730 minutes rather than days (the old limitation of highly manual
731 systems).</para>
733 </sect2>
735 </sect1>
737 <sect1>
738 <title>Implementation</title>
740 <para><indexterm>
741 <primary>winbind</primary>
742 </indexterm><indexterm>
743 <primary>LDAP</primary>
744 </indexterm><indexterm>
745 <primary>UID</primary>
746 </indexterm><indexterm>
747 <primary>GID</primary>
748 </indexterm>
749 Samba-3 has the ability to use multiple password (authentication
750 and identity resolution) backends. The diagram in <link
751 linkend="chap7idres"/> demonstrates how Samba uses winbind, LDAP,
752 and NIS, the traditional system password database. The diagram only
753 documents the mechanisms for authentication and identity resolution
754 (obtaining a UNIX UID/GID) using the specific systems shown.
755 </para>
757 <image id="chap7idres">
758 <imagedescription>Samba and Authentication Backend Search Pathways</imagedescription>
759 <imagefile scale="80">chap7-idresol</imagefile>
760 </image>
762 <para><indexterm>
763 <primary>smbpasswd</primary>
764 </indexterm><indexterm>
765 <primary>xmlsam</primary>
766 </indexterm><indexterm>
767 <primary>SMB passwords</primary>
768 </indexterm><indexterm>
769 <primary>tdbsam</primary>
770 </indexterm><indexterm>
771 <primary>mysqlsam</primary>
772 </indexterm><indexterm>
773 <primary>LDAP</primary>
774 </indexterm><indexterm>
775 <primary>distributed</primary>
776 </indexterm>
777 Samba is capable of using the <constant>smbpasswd</constant>,
778 <constant>tdbsam</constant>, <constant>xmlsam</constant>,
779 and <constant>mysqlsam</constant> authentication databases. The SMB
780 passwords can, of course, also be stored in an LDAP ldapsam
781 backend. LDAP is the preferred passdb backend for distributed network
782 operations.</para>
784 <para><indexterm>
785 <primary>passdb backend</primary>
786 </indexterm>
787 Additionally, it is possible to use multiple passdb backends
788 concurrently as well as have multiple LDAP backends. As a result, one
789 can specify a fail-over LDAP backend. The syntax for specifying a
790 single LDAP backend in &smb.conf; is:
791 <screen>
792 ...
793 passdb backend = ldapsam:ldap://master.abmas.biz
794 ...
795 </screen>
796 This configuration tells Samba to use a single LDAP server as shown in
797 <link linkend="ch7singleLDAP"/>.
798 <image id="ch7singleLDAP">
799 <imagedescription>Samba Configuration to Use a Single LDAP Server</imagedescription>
800 <imagefile scale="100">ch7-singleLDAP</imagefile>
801 </image>
802 <indexterm>
803 <primary>LDAP</primary>
804 <secondary>fail-over</secondary>
805 </indexterm><indexterm>
806 <primary>fail-over</primary>
807 </indexterm>
808 The addition of a fail-over LDAP server can simply be done by adding a
809 second entry for the fail-over server to the single
810 <parameter>ldapsam</parameter> entry as shown here (note the particular
811 use of the double quotes):
812 <screen>
813 ...
814 passdb backend = ldapsam:"ldap://master.abmas.biz \
815 ldap://slave.abmas.biz"
816 ...
817 </screen>
818 This configuration tells Samba to use a master LDAP server, with fail-over to a slave server if necessary,
819 as shown in <link linkend="ch7dualLDAP"/>.
820 <image id="ch7dualLDAP">
821 <imagedescription>Samba Configuration to Use a Dual (Fail-over) LDAP Server</imagedescription>
822 <imagefile scale="100">ch7-fail-overLDAP</imagefile>
823 </image>
824 </para>
826 <para>Some folks have tried to implement this without the use of
827 double quotes as shown above. This is the type of entry they had
828 created:
829 <screen>
830 ...
831 passdb backend = ldapsam:ldap://master.abmas.biz \
832 ldapsam:ldap://slave.abmas.biz
833 ...
834 </screen>
835 <indexterm>
836 <primary>contiguous directory</primary>
837 </indexterm>
838 The effect of this style of entry is that Samba lists the users
839 that are in both LDAP databases. If both contain the same information,
840 it results in each record being shown twice. This is, of course, not the
841 solution desired for a fail-over implementation. The net effect of this
842 configuration is shown in <link linkend="ch7dualadd"/>
843 </para>
845 <image id="ch7dualadd">
846 <imagedescription>Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</imagedescription>
847 <imagefile scale="80">ch7-dual-additive-LDAP</imagefile>
848 </image>
850 <para>
851 If, however, each LDAP database contains unique information, this may
852 well be an advantageous way to effectively integrate multiple LDAP databases
853 into one seemingly contiguous directory. Only the first database will be updated.
854 An example of this configuration is shown in <link linkend="ch7dualok"/>.
855 </para>
857 <image id="ch7dualok">
858 <imagedescription>Samba Configuration to Use Two LDAP Databases - The result is additive.</imagedescription>
859 <imagefile scale="80">ch7-dual-additive-LDAP-Ok</imagefile>
860 </image>
862 <note><para>
863 When the use of ldapsam is specified twice, as shown here, it is imperative
864 that the two LDAP directories must be disjoint. If the entries are for a
865 master LDAP server as well as its own slave server, updates to the LDAP
866 database may end up being lost or corrupted. You may safely use multiple
867 LDAP backends only so long as both are entirely separate from each other.
868 </para></note>
870 <para>It is assumed that the network you are working with follows in a
871 pattern similar to what has been covered in Chapter 6. The following steps
872 permit the operation of a Master/Slave OpenLDAP arrangement.</para>
874 <procedure>
876 <step><para>
877 <indexterm>
878 <primary>SUSE Linux</primary>
879 </indexterm><indexterm>
880 <primary>Red Hat Linux</primary>
881 </indexterm>
882 Log onto the master LDAP server as <constant>root</constant>.
883 You are about to change the configuration of the LDAP server, so it
884 makes sense to temporarily halt it. Stop OpenLDAP from running on
885 SUSE Linux by executing:
886 <screen>
887 &rootprompt; rcldap stop
888 </screen>
889 On Red Hat Linux, you can do this by executing:
890 <screen>
891 &rootprompt; service ldap stop
892 </screen>
893 </para></step>
895 <step><para><indexterm>
896 <primary>/etc/openldap/slapd.conf</primary>
897 </indexterm>
898 Edit the <filename>/etc/openldap/slapd.conf</filename> file so it
899 matches the content of <link linkend="ch7-LDAP-master"/>.
900 </para></step>
902 <step><para><indexterm>
903 <primary>LDIF</primary>
904 </indexterm><indexterm>
905 <primary>LDAP</primary>
906 <secondary>preload</secondary>
907 </indexterm>
908 Change directory to a suitable place to dump the contents of the
909 LDAP server. The dump file (and LDIF file) is used to preload
910 the Slave LDAP server database. You can dump the database by executing:
911 <screen>
912 &rootprompt; slapcat -v -l LDAP-transfer-LDIF.txt
913 </screen>
914 Each record is written to the file.
915 </para></step>
917 <step><para><indexterm>
918 <primary>LDAP-transfer-LDIF.txt</primary>
919 </indexterm>
920 Copy the file <filename>LDAP-transfer-LDIF.txt</filename> to the intended
921 slave LDAP server. A good location could be in the directory
922 <filename>/etc/openldap/preload</filename>.
923 </para></step>
925 <step><para>
926 Log onto the slave LDAP server as <constant>root</constant>. You can
927 now configure this server so the <filename>/etc/openldap/slapd.conf</filename>
928 file matches the content of <link linkend="ch7-LDAP-slave"/>.
929 </para></step>
931 <step><para>
932 Change directory to the location in which you stored the
933 <filename>LDAP-transfer-LDIF.txt</filename> file (<filename>/etc/openldap/preload</filename>).
934 While in this directory, execute:
935 <screen>
936 &rootprompt; slapadd -v -l LDAP-transfer-LDIF.txt
937 </screen>
938 If all goes well, the following output confirms that the data is being loaded
939 as intended:
940 <screen>
941 added: "dc=abmas,dc=biz" (00000001)
942 added: "cn=sambaadmin,dc=abmas,dc=biz" (00000002)
943 added: "cn=updateuser,dc=abmas,dc=biz" (00000003)
944 added: "ou=People,dc=abmas,dc=biz" (00000004)
945 added: "ou=Groups,dc=abmas,dc=biz" (00000005)
946 added: "ou=Computers,dc=abmas,dc=biz" (00000006)
947 added: "uid=Administrator,ou=People,dc=abmas,dc=biz" (00000007)
948 added: "uid=nobody,ou=People,dc=abmas,dc=biz" (00000008)
949 added: "cn=Domain Admins,ou=Groups,dc=abmas,dc=biz" (00000009)
950 added: "cn=Domain Users,ou=Groups,dc=abmas,dc=biz" (0000000a)
951 added: "cn=Domain Guests,ou=Groups,dc=abmas,dc=biz" (0000000b)
952 added: "uid=bobj,ou=People,dc=abmas,dc=biz" (0000000c)
953 added: "sambaDomainName=MEGANET2,dc=abmas,dc=biz" (0000000d)
954 added: "uid=stans,ou=People,dc=abmas,dc=biz" (0000000e)
955 added: "uid=chrisr,ou=People,dc=abmas,dc=biz" (0000000f)
956 added: "uid=maryv,ou=People,dc=abmas,dc=biz" (00000010)
957 added: "cn=Accounts,ou=Groups,dc=abmas,dc=biz" (00000011)
958 added: "cn=Finances,ou=Groups,dc=abmas,dc=biz" (00000012)
959 added: "cn=PIOps,ou=Groups,dc=abmas,dc=biz" (00000013)
960 </screen>
961 </para></step>
963 <step><para>
964 Now start the LDAP server and set it to run automatically on system reboot
965 by executing:
966 <screen>
967 &rootprompt; rcldap start
968 &rootprompt; chkconfig ldap on
969 </screen>
970 On Red Hat Linux, you would execute the following:
971 <screen>
972 &rootprompt; service ldap start
973 &rootprompt; chkconfig ldap on
974 </screen>
975 <indexterm>
976 <primary>chkconfig</primary>
977 </indexterm><indexterm>
978 <primary>service</primary>
979 </indexterm><indexterm>
980 <primary>rcldap</primary>
981 </indexterm>
982 </para></step>
984 <step><para>
985 Go back to the master LDAP server. Execute the following to start LDAP as well
986 as <command>slurpd</command>, the synchronization daemon, as shown here:
987 <screen>
988 &rootprompt; rcldap start
989 &rootprompt; chkconfig ldap on
990 &rootprompt; rcslurpd start
991 &rootprompt; chkconfig slurpd on
992 </screen>
993 <indexterm>
994 <primary>slurpd</primary>
995 </indexterm>
996 On Red Hat Linux, check the equivalent command to start <command>slurpd</command>.
997 </para></step>
999 <step><para><indexterm>
1000 <primary>smbldap-useradd.pl</primary>
1001 </indexterm>
1002 On the master ldap server you may now add an account to validate that replication
1003 is working. Assuming the configuration shown in Chapter 6, execute:
1004 <screen>
1005 &rootprompt; /var/lib/samba/sbin/smbldap-useradd.pl -a fruitloop
1006 </screen>
1007 </para></step>
1009 <step><para>
1010 On the slave LDAP server, change to the directory <filename>/var/lib/ldap</filename>.
1011 There should now be a file called <filename>replogfile</filename>. If replication worked
1012 as expected, the content of this file should be:
1013 <screen>
1014 time: 1072486403
1015 dn: uid=fruitloop,ou=People,dc=abmas,dc=biz
1016 changetype: modify
1017 replace: sambaProfilePath
1018 sambaProfilePath: \\MASSIVE\profiles\fruitloop
1019 -
1020 replace: sambaHomePath
1021 sambaHomePath: \\MASSIVE\homes
1022 -
1023 replace: entryCSN
1024 entryCSN: 2003122700:43:38Z#0x0005#0#0000
1025 -
1026 replace: modifiersName
1027 modifiersName: cn=Manager,dc=abmas,dc=biz
1028 -
1029 replace: modifyTimestamp
1030 modifyTimestamp: 20031227004338Z
1031 -
1032 </screen>
1033 </para></step>
1035 <step><para>
1036 Given that this first slave LDAP server is now working correctly, you may now
1037 implement additional slave LDAP servers as required.
1038 </para></step>
1040 </procedure>
1042 <example id="ch7-LDAP-master">
1043 <title>LDAP Master Server Configuration File &smbmdash; <filename>/etc/openldap/slapd.conf</filename></title>
1044 <screen>
1045 include /etc/openldap/schema/core.schema
1046 include /etc/openldap/schema/cosine.schema
1047 include /etc/openldap/schema/inetorgperson.schema
1048 include /etc/openldap/schema/nis.schema
1049 include /etc/openldap/schema/samba.schema
1051 pidfile /var/run/slapd/slapd.pid
1052 argsfile /var/run/slapd/slapd.args
1054 database ldbm
1055 suffix "dc=abmas,dc=biz"
1056 rootdn "cn=Manager,dc=abmas,dc=biz"
1058 # rootpw = not24get
1059 rootpw {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
1061 replica host=lapdc.abmas.biz:389
1062 suffix="dc=abmas,dc=biz"
1063 binddn="cn=updateuser,dc=abmas,dc=biz"
1064 bindmethod=simple credentials=not24get
1066 access to attrs=sambaLMPassword,sambaNTPassword
1067 by dn="cn=updateuser,dc=abmas,dc=biz" write
1068 by * none
1070 replogfile /var/lib/ldap/replogfile
1072 directory /var/lib/ldap
1074 # Indices to maintain
1075 index objectClass eq
1076 index cn pres,sub,eq
1077 index sn pres,sub,eq
1078 index uid pres,sub,eq
1079 index displayName pres,sub,eq
1080 index uidNumber eq
1081 index gidNumber eq
1082 index memberUID eq
1083 index sambaSID eq
1084 index sambaPrimaryGroupSID eq
1085 index sambaDomainName eq
1086 index default sub
1087 </screen>
1088 </example>
1090 <example id="ch7-LDAP-slave">
1091 <title>LDAP Slave Configuration File &smbmdash; <filename>/etc/openldap/slapd.conf</filename></title>
1092 <screen>
1093 include /etc/openldap/schema/core.schema
1094 include /etc/openldap/schema/cosine.schema
1095 include /etc/openldap/schema/inetorgperson.schema
1096 include /etc/openldap/schema/nis.schema
1097 include /etc/openldap/schema/samba.schema
1099 pidfile /var/run/slapd/slapd.pid
1100 argsfile /var/run/slapd/slapd.args
1102 database ldbm
1103 suffix "dc=abmas,dc=biz"
1104 rootdn "cn=Manager,dc=abmas,dc=biz"
1106 # rootpw = not24get
1107 rootpw {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
1109 access to *
1110 by dn=cn=updateuser,dc=abmas,dc=biz write
1111 by * read
1113 updatedn cn=updateuser,dc=abmas,dc=biz
1114 updateref ldap://massive.abmas.biz
1115 replogfile /var/lib/ldap/replogfile
1117 directory /var/lib/ldap
1119 # Indices to maintain
1120 index objectClass eq
1121 index cn pres,sub,eq
1122 index sn pres,sub,eq
1123 index uid pres,sub,eq
1124 index displayName pres,sub,eq
1125 index uidNumber eq
1126 index gidNumber eq
1127 index memberUID eq
1128 index sambaSID eq
1129 index sambaPrimaryGroupSID eq
1130 index sambaDomainName eq
1131 index default sub
1132 </screen>
1133 </example>
1135 <smbconfexample id="ch7-massmbconfA">
1136 <title>Primary Domain Controller &smb.conf; File &smbmdash; Part A</title>
1137 <smbconfcomment>Global parameters</smbconfcomment>
1138 <smbconfsection>[global]</smbconfsection>
1139 <smbconfoption><name>unix charset</name><value>LOCALE</value></smbconfoption>
1140 <smbconfoption><name>workgroup</name><value>MEGANET2</value></smbconfoption>
1141 <smbconfoption><name>passdb backend</name><value>ldapsam:ldap://massive.abmas.biz</value></smbconfoption>
1142 <smbconfoption><name>username map</name><value>/etc/samba/smbusers</value></smbconfoption>
1143 <smbconfoption><name>log level</name><value>1</value></smbconfoption>
1144 <smbconfoption><name>syslog</name><value>0</value></smbconfoption>
1145 <smbconfoption><name>log file</name><value>/var/log/samba/%m</value></smbconfoption>
1146 <smbconfoption><name>max log size</name><value>0</value></smbconfoption>
1147 <smbconfoption><name>smb ports</name><value>139 445</value></smbconfoption>
1148 <smbconfoption><name>name resolve order</name><value>wins bcast hosts</value></smbconfoption>
1149 <smbconfoption><name>time server</name><value>Yes</value></smbconfoption>
1150 <smbconfoption><name>printcap name</name><value>CUPS</value></smbconfoption>
1151 <smbconfoption><name>add user script</name><value>/var/lib/samba/sbin/smbldap-useradd.pl -a -m '%u'</value></smbconfoption>
1152 <smbconfoption><name>delete user script</name><value>/var/lib/samba/sbin/smbldap-userdel.pl %u</value></smbconfoption>
1153 <smbconfoption><name>add group script</name><value>/var/lib/samba/sbin/smbldap-groupadd.pl -p '%g'</value></smbconfoption>
1154 <smbconfoption><name>delete group script</name><value>/var/lib/samba/sbin/smbldap-groupdel.pl '%g'</value></smbconfoption>
1155 <smbconfoption><name>add user to group script</name><value>/var/lib/samba/sbin/</value></smbconfoption>
1156 <member><parameter>smbldap-groupmod.pl -m '%g' '%u'</parameter></member>
1157 <smbconfoption><name>delete user from group script</name><value>/var/lib/samba/sbin/</value></smbconfoption>
1158 <member><parameter>smbldap-groupmod.pl -x '%g' '%u'</parameter></member>
1159 <smbconfoption><name>set primary group script</name><value>/var/lib/samba/sbin/</value></smbconfoption>
1160 <member><parameter>smbldap-usermod.pl -g '%g' '%u'</parameter></member>
1161 <smbconfoption><name>add machine script</name><value>/var/lib/samba/sbin/</value></smbconfoption>
1162 <member><parameter>smbldap-useradd.pl -w '%u'</parameter></member>
1163 <smbconfoption><name>shutdown script</name><value>/var/lib/samba/scripts/shutdown.sh</value></smbconfoption>
1164 <smbconfoption><name>abort shutdown script</name><value>/sbin/shutdown -c</value></smbconfoption>
1165 <smbconfoption><name>logon script</name><value>scripts\logon.bat</value></smbconfoption>
1166 <smbconfoption><name>logon path</name><value>\\%L\profiles\%U</value></smbconfoption>
1167 <smbconfoption><name>logon drive</name><value>X:</value></smbconfoption>
1168 <smbconfoption><name>domain logons</name><value>Yes</value></smbconfoption>
1169 <smbconfoption><name>domain master</name><value>Yes</value></smbconfoption>
1170 <smbconfoption><name>wins support</name><value>Yes</value></smbconfoption>
1171 <smbconfoption><name>ldap suffix</name><value>dc=abmas,dc=biz</value></smbconfoption>
1172 <smbconfoption><name>ldap machine suffix</name><value>ou=People</value></smbconfoption>
1173 <smbconfoption><name>ldap user suffix</name><value>ou=People</value></smbconfoption>
1174 <smbconfoption><name>ldap group suffix</name><value>ou=Groups</value></smbconfoption>
1175 <smbconfoption><name>ldap idmap suffix</name><value>ou=Idmap</value></smbconfoption>
1176 <smbconfoption><name>ldap admin dn</name><value>cn=Manager,dc=abmas,dc=biz</value></smbconfoption>
1177 <smbconfoption><name>idmap backend</name><value>ldap://massive.abmas.biz</value></smbconfoption>
1178 <smbconfoption><name>idmap uid</name><value>10000-20000</value></smbconfoption>
1179 <smbconfoption><name>idmap gid</name><value>10000-20000</value></smbconfoption>
1180 <smbconfoption><name>printer admin</name><value>root</value></smbconfoption>
1181 <smbconfoption><name>printing</name><value>cups</value></smbconfoption>
1182 </smbconfexample>
1184 <smbconfexample id="ch7-massmbconfB">
1185 <title>Primary Domain Controller &smb.conf; File &smbmdash; Part B</title>
1186 <smbconfsection>[IPC$]</smbconfsection>
1187 <smbconfoption><name>path</name><value>/tmp</value></smbconfoption>
1189 <smbconfsection>[accounts]</smbconfsection>
1190 <smbconfoption><name>comment</name><value>Accounting Files</value></smbconfoption>
1191 <smbconfoption><name>path</name><value>/data/accounts</value></smbconfoption>
1192 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1194 <smbconfsection>[service]</smbconfsection>
1195 <smbconfoption><name>comment</name><value>Financial Services Files</value></smbconfoption>
1196 <smbconfoption><name>path</name><value>/data/service</value></smbconfoption>
1197 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1199 <smbconfsection>[pidata]</smbconfsection>
1200 <smbconfoption><name>comment</name><value>Property Insurance Files</value></smbconfoption>
1201 <smbconfoption><name>path</name><value>/data/pidata</value></smbconfoption>
1202 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1204 <smbconfsection>[homes]</smbconfsection>
1205 <smbconfoption><name>comment</name><value>Home Directories</value></smbconfoption>
1206 <smbconfoption><name>valid users</name><value>%S</value></smbconfoption>
1207 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1208 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
1210 <smbconfsection>[printers]</smbconfsection>
1211 <smbconfoption><name>comment</name><value>SMB Print Spool</value></smbconfoption>
1212 <smbconfoption><name>path</name><value>/var/spool/samba</value></smbconfoption>
1213 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
1214 <smbconfoption><name>printable</name><value>Yes</value></smbconfoption>
1215 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
1216 </smbconfexample>
1218 <smbconfexample id="ch7-massmbconfC">
1219 <title>Primary Domain Controller &smb.conf; File &smbmdash; Part C</title>
1220 <smbconfsection>[apps]</smbconfsection>
1221 <smbconfoption><name>comment</name><value>Application Files</value></smbconfoption>
1222 <smbconfoption><name>path</name><value>/apps</value></smbconfoption>
1223 <smbconfoption><name>admin users</name><value>bjones</value></smbconfoption>
1224 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1226 <smbconfsection>[netlogon]</smbconfsection>
1227 <smbconfoption><name>comment</name><value>Network Logon Service</value></smbconfoption>
1228 <smbconfoption><name>path</name><value>/var/lib/samba/netlogon</value></smbconfoption>
1229 <smbconfoption><name>admin users</name><value>root, Administrator</value></smbconfoption>
1230 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
1231 <smbconfoption><name>locking</name><value>No</value></smbconfoption>
1233 <smbconfsection>[profiles]</smbconfsection>
1234 <smbconfoption><name>comment</name><value>Profile Share</value></smbconfoption>
1235 <smbconfoption><name>path</name><value>/var/lib/samba/profiles</value></smbconfoption>
1236 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1237 <smbconfoption><name>profile acls</name><value>Yes</value></smbconfoption>
1239 <smbconfsection>[profdata]</smbconfsection>
1240 <smbconfoption><name>comment</name><value>Profile Data Share</value></smbconfoption>
1241 <smbconfoption><name>path</name><value>/var/lib/samba/profdata</value></smbconfoption>
1242 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1243 <smbconfoption><name>profile acls</name><value>Yes</value></smbconfoption>
1245 <smbconfsection>[print$]</smbconfsection>
1246 <smbconfoption><name>comment</name><value>Printer Drivers</value></smbconfoption>
1247 <smbconfoption><name>path</name><value>/var/lib/samba/drivers</value></smbconfoption>
1248 <smbconfoption><name>write list</name><value>root</value></smbconfoption>
1249 <smbconfoption><name>admin users</name><value>root, Administrator</value></smbconfoption>
1250 </smbconfexample>
1252 <smbconfexample id="ch7-slvsmbocnfA">
1253 <title>Backup Domain Controller &smb.conf; File &smbmdash; Part A</title>
1254 <smbconfcomment># Global parameters</smbconfcomment>
1255 <smbconfsection>[global]</smbconfsection>
1256 <smbconfoption><name>unix charset</name><value>LOCALE</value></smbconfoption>
1257 <smbconfoption><name>workgroup</name><value>MEGANET2</value></smbconfoption>
1258 <smbconfoption><name>netbios name</name><value>BLDG1</value></smbconfoption>
1259 <smbconfoption><name>passdb backend</name><value>ldapsam:ldap://lapdc.abmas.biz</value></smbconfoption>
1260 <smbconfoption><name>username map</name><value>/etc/samba/smbusers</value></smbconfoption>
1261 <smbconfoption><name>log level</name><value>1</value></smbconfoption>
1262 <smbconfoption><name>syslog</name><value>0</value></smbconfoption>
1263 <smbconfoption><name>log file</name><value>/var/log/samba/%m</value></smbconfoption>
1264 <smbconfoption><name>max log size</name><value>50</value></smbconfoption>
1265 <smbconfoption><name>smb ports</name><value>139 445</value></smbconfoption>
1266 <smbconfoption><name>name resolve order</name><value>wins bcast hosts</value></smbconfoption>
1267 <smbconfoption><name>printcap name</name><value>CUPS</value></smbconfoption>
1268 <smbconfoption><name>show add printer wizard</name><value>No</value></smbconfoption>
1269 <smbconfoption><name>logon script</name><value>scripts\logon.bat</value></smbconfoption>
1270 <smbconfoption><name>logon path</name><value>\\%L\profiles\%U</value></smbconfoption>
1271 <smbconfoption><name>logon drive</name><value>X:</value></smbconfoption>
1272 <smbconfoption><name>domain logons</name><value>Yes</value></smbconfoption>
1273 <smbconfoption><name>os level</name><value>63</value></smbconfoption>
1274 <smbconfoption><name>domain master</name><value>No</value></smbconfoption>
1275 <smbconfoption><name>wins server</name><value>192.168.2.1</value></smbconfoption>
1276 <smbconfoption><name>ldap suffix</name><value>dc=abmas,dc=biz</value></smbconfoption>
1277 <smbconfoption><name>ldap machine suffix</name><value>ou=People</value></smbconfoption>
1278 <smbconfoption><name>ldap user suffix</name><value>ou=People</value></smbconfoption>
1279 <smbconfoption><name>ldap group suffix</name><value>ou=Groups</value></smbconfoption>
1280 <smbconfoption><name>ldap idmap suffix</name><value>ou=Idmap</value></smbconfoption>
1281 <smbconfoption><name>ldap admin dn</name><value>cn=Manager,dc=abmas,dc=biz</value></smbconfoption>
1282 <smbconfoption><name>utmp</name><value>Yes</value></smbconfoption>
1283 <smbconfoption><name>idmap backend</name><value>ldap://massive.abmas.biz</value></smbconfoption>
1284 <smbconfoption><name>idmap uid</name><value>10000-20000</value></smbconfoption>
1285 <smbconfoption><name>idmap gid</name><value>10000-20000</value></smbconfoption>
1286 <smbconfoption><name>printing</name><value>cups</value></smbconfoption>
1288 <smbconfsection>[accounts]</smbconfsection>
1289 <smbconfoption><name>comment</name><value>Accounting Files</value></smbconfoption>
1290 <smbconfoption><name>path</name><value>/data/accounts</value></smbconfoption>
1291 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1293 <smbconfsection>[service]</smbconfsection>
1294 <smbconfoption><name>comment</name><value>Financial Services Files</value></smbconfoption>
1295 <smbconfoption><name>path</name><value>/data/service</value></smbconfoption>
1296 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1297 </smbconfexample>
1299 <smbconfexample id="ch7-slvsmbocnfB">
1300 <title>Backup Domain Controller &smb.conf; File &smbmdash; Part B</title>
1301 <smbconfsection>[pidata]</smbconfsection>
1302 <smbconfoption><name>comment</name><value>Property Insurance Files</value></smbconfoption>
1303 <smbconfoption><name>path</name><value>/data/pidata</value></smbconfoption>
1304 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1306 <smbconfsection>[homes]</smbconfsection>
1307 <smbconfoption><name>comment</name><value>Home Directories</value></smbconfoption>
1308 <smbconfoption><name>valid users</name><value>%S</value></smbconfoption>
1309 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1310 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
1312 <smbconfsection>[printers]</smbconfsection>
1313 <smbconfoption><name>comment</name><value>SMB Print Spool</value></smbconfoption>
1314 <smbconfoption><name>path</name><value>/var/spool/samba</value></smbconfoption>
1315 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
1316 <smbconfoption><name>printable</name><value>Yes</value></smbconfoption>
1317 <smbconfoption><name>browseable</name><value>No</value></smbconfoption>
1319 <smbconfsection>[apps]</smbconfsection>
1320 <smbconfoption><name>comment</name><value>Application Files</value></smbconfoption>
1321 <smbconfoption><name>path</name><value>/apps</value></smbconfoption>
1322 <smbconfoption><name>admin users</name><value>bjones</value></smbconfoption>
1323 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1325 <smbconfsection>[netlogon]</smbconfsection>
1326 <smbconfoption><name>comment</name><value>Network Logon Service</value></smbconfoption>
1327 <smbconfoption><name>path</name><value>/var/lib/samba/netlogon</value></smbconfoption>
1328 <smbconfoption><name>guest ok</name><value>Yes</value></smbconfoption>
1329 <smbconfoption><name>locking</name><value>No</value></smbconfoption>
1331 <smbconfsection>[profiles]</smbconfsection>
1332 <smbconfoption><name>comment</name><value>Profile Share</value></smbconfoption>
1333 <smbconfoption><name>path</name><value>/var/lib/samba/profiles</value></smbconfoption>
1334 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1335 <smbconfoption><name>profile acls</name><value>Yes</value></smbconfoption>
1337 <smbconfsection>[profdata]</smbconfsection>
1338 <smbconfoption><name>comment</name><value>Profile Data Share</value></smbconfoption>
1339 <smbconfoption><name>path</name><value>/var/lib/samba/profdata</value></smbconfoption>
1340 <smbconfoption><name>read only</name><value>No</value></smbconfoption>
1341 <smbconfoption><name>profile acls</name><value>Yes</value></smbconfoption>
1342 </smbconfexample>
1344 <sect2>
1345 <title>Key Points Learned</title>
1347 <para>
1348 </para>
1350 <itemizedlist>
1351 <listitem><para><indexterm>
1352 <primary>LDAP</primary>
1353 </indexterm><indexterm>
1354 <primary>BDC</primary>
1355 </indexterm>
1356 Where Samba-3 is used as a Domain Controller, the use of LDAP is an
1357 essential component necessary to permit the use of BDCs.
1358 </para></listitem>
1360 <listitem><para><indexterm>
1361 <primary>wide-area</primary>
1362 </indexterm>
1363 Replication of the LDAP master server to create a network of BDCs
1364 is an important mechanism for limiting wide-area network traffic.
1365 </para></listitem>
1367 <listitem><para>
1368 Network administration presents many complex challenges, most of which
1369 can be satisfied by good design, but that also require sound communication
1370 and unification of management practices. This can be highly challenging in
1371 a large, globally distributed network.
1372 </para></listitem>
1374 <listitem><para>
1375 Roaming profiles must be contained to the local network segment. Any
1376 departure from this may clog wide-area arteries and slow legitimate network
1377 traffic to a crawl.
1378 </para></listitem>
1379 </itemizedlist>
1381 </sect2>
1383 </sect1>
1385 <sect1>
1386 <title>Questions and Answers</title>
1388 <para>
1389 There is much rumor and misinformation regarding the use of MS Windows networking protocols.
1390 These questions are just a few of those frequently asked.
1391 </para>
1393 <qandaset defaultlabel="chap07qa">
1394 <qandaentry>
1395 <question>
1397 <para><indexterm>
1398 <primary>DHCP</primary>
1399 </indexterm><indexterm>
1400 <primary>network</primary>
1401 <secondary>bandwidth</secondary>
1402 </indexterm>
1403 Is it true that DHCP uses lots of wide-area network bandwidth?
1404 </para>
1406 </question>
1407 <answer>
1409 <para><indexterm>
1410 <primary>DHCP</primary>
1411 <secondary>Relay Agent</secondary>
1412 </indexterm><indexterm>
1413 <primary>routers</primary>
1414 </indexterm><indexterm>
1415 <primary>DHCP</primary>
1416 <secondary>servers</secondary>
1417 </indexterm>
1418 It is a smart practice to localize DHCP servers on each network segment. As a
1419 rule, there should be two DHCP servers per network segment. This means that if
1420 one server fails, there is always another to service user needs. DHCP requests use
1421 only UDP broadcast protocols. It is possible to run a DHCP Relay Agent on network
1422 routers. This makes it possible to run fewer DHCP servers.
1423 </para>
1425 <para><indexterm>
1426 <primary>DHCP</primary>
1427 <secondary>request</secondary>
1428 </indexterm><indexterm>
1429 <primary>DHCP</primary>
1430 <secondary>traffic</secondary>
1431 </indexterm>
1432 A DHCP network address request and confirmation usually results in about six UDP packets.
1433 The packets are from 60 to 568 bytes in length. Let us consider a site that has 300 DHCP
1434 clients and that uses a 24-hour IP address lease. This means that all clients renew
1435 their IP address lease every 24 hours. If we assume an average packet length equal to the
1436 maximum (just to be on the safe side), and we have a 128 Kbit/sec wide-area connection,
1437 how significant would the DHCP traffic be if all of it were to use DHCP Relay?
1438 </para>
1440 <para>
1441 I must stress that this is a bad design, but here is the calculation:
1442 <screen>
1443 Daily Network Capacity: 128,000 (Kbits/s) / 8 (bits/byte)
1444 x 3600 (sec/hr) x 24 (hrs/day)= 2288 Mbytes/day.
1446 DHCP traffic: 300 (clients) x 6 (packets)
1447 x 512 (bytes/packet) = 0.9 Mbytes/day.
1448 </screen>
1449 From this can be seen that the traffic impact would be minimal.
1450 </para>
1452 <para><indexterm>
1453 <primary>DNS</primary>
1454 <secondary>Dynamic</secondary>
1455 </indexterm><indexterm>
1456 <primary>DHCP</primary>
1457 </indexterm>
1458 Even when DHCP is configured to do DNS update (Dynamic DNS) over a wide-area link,
1459 the impact of the update is no more than the DHCP IP address renewal traffic and, thus,
1460 still insignificant for most practical purposes.
1461 </para>
1463 </answer>
1464 </qandaentry>
1466 <qandaentry>
1467 <question>
1469 <para><indexterm>
1470 <primary>background communication</primary>
1471 </indexterm><indexterm>
1472 <primary>LDAP</primary>
1473 <secondary>master/slave</secondary>
1474 <tertiary>background communication</tertiary>
1475 </indexterm>
1476 How much background communication takes place between a Master LDAP
1477 server and its slave LDAP servers?
1478 </para>
1480 </question>
1481 <answer>
1483 <para><indexterm>
1484 <primary>slurpd</primary>
1485 </indexterm>
1486 The process that controls the replication of data from the Master LDAP server to the Slave LDAP
1487 servers is called <command>slurpd</command>. The <command>slurpd</command> remains nascent (quiet)
1488 until an update must be propagated. The propagation traffic per LDAP salve to update (add/modify/delete)
1489 two user accounts requires less than 10Kbytes traffic.
1490 </para>
1492 </answer>
1493 </qandaentry>
1495 <qandaentry>
1496 <question>
1498 <para>
1499 LDAP has a database. Is LDAP not just a fancy database front end?
1500 </para>
1502 </question>
1503 <answer>
1505 <para><indexterm>
1506 <primary>database</primary>
1507 </indexterm><indexterm>
1508 <primary>LDAP</primary>
1509 <secondary>database</secondary>
1510 </indexterm><indexterm>
1511 <primary>SQL</primary>
1512 </indexterm><indexterm>
1513 <primary>transactional</primary>
1514 </indexterm>
1515 LDAP does store its data in a database of sorts. In fact the LDAP backend is an application-specific
1516 data storage system. This type of database is indexed so that records can be rapidly located, but the
1517 database is not generic and can be used only in particular pre-programmed ways. General external
1518 applications do not gain access to the data. This type of database is used also by SQL servers. Both
1519 an SQL server and an LDAP server provide ways to access the data. An SQL server has a transactional
1520 orientation and typically allows external programs to perform ad-hoc queries, even across data tables.
1521 An LDAP front end is a purpose-built tool that has a search orientation that is designed around specific
1522 simple queries. The term <constant>database</constant> is heavily overloaded and, thus, much misunderstood.
1523 </para>
1525 </answer>
1526 </qandaentry>
1528 <qandaentry>
1529 <question>
1531 <para><indexterm>
1532 <primary>OpenLDAP</primary>
1533 </indexterm>
1534 Can Active Directory obtain account information from an OpenLDAP server?
1535 </para>
1537 </question>
1538 <answer>
1540 <para><indexterm>
1541 <primary>meta-directory</primary>
1542 </indexterm>
1543 No, at least not directly. It is possible to provision Active Directory from/to an OpenLDAP
1544 database through use of a meta-directory server. Microsoft MMS (now called MIIS) can interface
1545 to OpenLDAP using standard LDAP queries/updates.
1546 </para>
1548 </answer>
1549 </qandaentry>
1551 <qandaentry>
1552 <question>
1554 <para>
1555 What are the parts of a roaming profile? How large is each part?
1556 </para>
1558 </question>
1559 <answer>
1561 <para><indexterm>
1562 <primary>roaming profile</primary>
1563 </indexterm>
1564 A roaming profile consists of:
1565 </para>
1567 <itemizedlist>
1568 <listitem><para>
1569 Desktop folders such as: <constant>Desktop, My Documents, My Pictures, My Music, Internet Files,
1570 Cookies, Application Data, Local Settings,</constant> and more. See <link linkend="XP-screen001"/>.
1571 </para>
1573 <para><indexterm>
1574 <primary>folder redirection</primary>
1575 </indexterm>
1576 Each of these can be anywhere from a few bytes to gigabytes in capacity. Fortunately, all
1577 such folders can be redirected to network drive resources. See <link linkend="redirfold"/>
1578 for more information regarding folder redirection.
1579 </para></listitem>
1581 <listitem><para>
1582 A static or re-writable portion that is typically only a few files (2-5 Kbytes of information).
1583 </para></listitem>
1585 <listitem><para><indexterm>
1586 <primary>NTUSER.DAT</primary>
1587 </indexterm><indexterm>
1588 <primary>HKEY_LOCAL_USER</primary>
1589 </indexterm>
1590 The registry load file that modifies the <constant>HKEY_LOCAL_USER</constant> hive. This is
1591 the <filename>NTUSER.DAT</filename> file. It can be from 0.4-1.5 MBytes.
1592 </para></listitem>
1593 </itemizedlist>
1595 <para><indexterm>
1596 <primary>Microsoft Outlook</primary>
1597 <secondary>PST files</secondary>
1598 </indexterm>
1599 Microsoft Outlook PST files may be stored in the <constant>Local Settings\Application Data</constant>
1600 folder. It can be up to 2 Gbytes in size per PST file.
1601 </para>
1603 </answer>
1604 </qandaentry>
1606 <qandaentry>
1607 <question>
1609 <para>
1610 Can the <constant>My Documents</constant> folder be stored on a network drive?
1611 </para>
1613 </question>
1614 <answer>
1616 <para><indexterm>
1617 <primary>UNC name</primary>
1618 </indexterm><indexterm>
1619 <primary>Universal Naming Convention</primary>
1620 <see>UNC name</see>
1621 </indexterm>
1622 Yes. More correctly, such folders can be redirected to network shares. No specific network drive
1623 connection is required. Registry settings permit this to be redirected directly to a UNC (Universal
1624 Naming Convention) resource, though it is possible to specify a network drive letter instead of a
1625 UNC name. See <link linkend="redirfold"/>.
1626 </para>
1628 </answer>
1629 </qandaentry>
1631 <qandaentry>
1632 <question>
1634 <para><indexterm>
1635 <primary>wide-area</primary>
1636 </indexterm><indexterm>
1637 <primary>network</primary>
1638 <secondary>bandwidth</secondary>
1639 </indexterm><indexterm>
1640 <primary>WINS</primary>
1641 </indexterm>
1642 How much wide-area network bandwidth does WINS consume?
1643 </para>
1645 </question>
1646 <answer>
1648 <para><indexterm>
1649 <primary>NetBIOS</primary>
1650 <secondary>name cache</secondary>
1651 </indexterm><indexterm>
1652 <primary>WINS server</primary>
1653 </indexterm><indexterm>
1654 <primary>domain replication</primary>
1655 </indexterm>
1656 MS Windows clients cache information obtained from WINS lookups in a local NetBIOS name cache.
1657 This keeps WINS lookups to a minimum. On a network with 3500 MS Windows clients and a central WINS
1658 server, the total bandwidth demand measured at the WINS server, averaged over an eight-hour working day,
1659 was less than 30 Kbytes/sec. Analysis of network traffic over a six-week period showed that the total
1660 of all background traffic consumed about 11 percent of available bandwidth over 64 Kbit/sec links.
1661 Back-ground traffic consisted of domain replication, WINS queries, DNS lookups, authentication
1662 traffic. Each of 11 branch offices had a 64 Kbit/sec wide-area link, with a 1.5 Mbit/sec main connection
1663 that aggregated the branch office connections plus an Internet connection.
1664 </para>
1666 <para>
1667 In conclusion, the total load afforded through WINS traffic is again marginal to total operational
1668 usage &smbmdash; as it should be.
1669 </para>
1671 </answer>
1672 </qandaentry>
1674 <qandaentry>
1675 <question>
1677 <para>
1678 How many BDCs should I have? What is the right number of Windows clients per server?
1679 </para>
1681 </question>
1682 <answer>
1684 <para>
1685 It is recommended to have at least one BDC per network segment, including the segment served
1686 by the PDC. Actual requirements vary depending on the working load on each of the BDCs and the
1687 load demand pattern of client usage. I have seen sites that function without problem with 200
1688 clients served by one BDC, and yet other sites that had one BDC per 20 clients. In one particular
1689 company, there was a drafting office that has 30 CAD/CAM operators served by one server, a print
1690 server; and an application server. While all three were BDCs, typically only the print server would
1691 service network logon requests after the first 10 users had started to use the network. This was
1692 a reflection of the service load placed on both the application server and the data server.
1693 </para>
1695 <para>
1696 As unsatisfactory as the answer might sound, it all depends on network and server load
1697 characteristics.
1698 </para>
1700 </answer>
1701 </qandaentry>
1703 <qandaentry>
1704 <question>
1706 <para><indexterm>
1707 <primary>NIS server</primary>
1708 </indexterm><indexterm>
1709 <primary>LDAP</primary>
1710 </indexterm>
1711 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to
1712 run an NIS server?
1713 </para>
1715 </question>
1716 <answer>
1718 <para>
1719 The correct answer to both questions is yes. But do understand that an LDAP server has
1720 a configurable schema that can store far more information for many more purposes than
1721 just NIS.
1722 </para>
1724 </answer>
1725 </qandaentry>
1727 <qandaentry>
1728 <question>
1730 <para>
1731 Can I use NIS in place of LDAP?
1732 </para>
1734 </question>
1735 <answer>
1737 <para><indexterm>
1738 <primary>NIS</primary>
1739 </indexterm><indexterm>
1740 <primary>NIS schema</primary>
1741 </indexterm>
1742 No. The NIS database does not have provision to store Microsoft encrypted passwords and does not deal
1743 with the types of data necessary for interoperability with Microsoft Windows networking. The use
1744 of LDAP with Samba requires the use of a number of schemas, one of which is the NIS schema, but also
1745 a Samba-specific schema extension.
1746 </para>
1748 </answer>
1749 </qandaentry>
1751 </qandaset>
1753 </sect1>
1755 </chapter>