From a967ddf3de101e2010695421b6d5373dbc6909f4 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Sun, 2 Jan 2005 21:36:44 +0000 Subject: [PATCH] Address some inaccracies (such as BDC solutions that might have worked, but Samba never got the code to support), clarify some things that pedents have raised on the lists/in bugs, and explain about the 'ldap replication sleep' hack. Andrew Bartlett (This used to be commit dd9bd7b42e6818697f7e2dd913f6480406d24e60) --- docs/Samba-HOWTO-Collection/BDC.xml | 30 ++++++++++++++++++------------ docs/Samba-HOWTO-Collection/Passdb.xml | 13 ++++++------- 2 files changed, 24 insertions(+), 19 deletions(-) diff --git a/docs/Samba-HOWTO-Collection/BDC.xml b/docs/Samba-HOWTO-Collection/BDC.xml index d1f61dc3cb2..a43f5ad4923 100644 --- a/docs/Samba-HOWTO-Collection/BDC.xml +++ b/docs/Samba-HOWTO-Collection/BDC.xml @@ -104,10 +104,8 @@ let's consider each possible option and look at the pros and cons for each possi tdbsam tdbsam + net rpc vampire - Does not work with Samba-3.0.0; may be implemented in a later release. The downside of this solution - is that an external process will control account database integrity. This solution may appeal to sites - that wish to avoid the complexity of LDAP. The net rpc vampire is used to - synchronize domain accounts from the PDC to the BDC. + Does not work with Samba-3.0; as Samba does not implement the + server-side protocols required. @@ -115,8 +113,9 @@ let's consider each possible option and look at the pros and cons for each possi tdbsam + rsync Do not use this configuration. - Does not work because the TDB files are live and data may not have been flushed to disk. - Use rsync to synchronize the TDB database files from the PDC to the BDC. + Does not work because the TDB files are live and data may not + have been flushed to disk. Furthermore, this will cause + domain trust breakdown. @@ -124,9 +123,9 @@ let's consider each possible option and look at the pros and cons for each possi smbpasswd file Do not use this configuration. - Not an elegant solution due to the delays in synchronization. - Use rsync to synchronize the smbpasswd file from the PDC to the BDC. - Can be made to work using a cron job to synchronize data from the PDC to the BDC. + Not an elegant solution due to the delays in synchronization + and also suffers + from the issue of domain trust breakdown. @@ -308,12 +307,19 @@ certificate is recreated with a correct hostname. -Do not install a Samba PDC on a OpenLDAP slave server. Joining client machines to the domain +For preference, do not install a Samba PDC on a OpenLDAP slave server. Joining client machines to the domain will fail in this configuration because the change to the machine account in the LDAP tree must take place on the master LDAP server. This is not replicated rapidly enough to the slave -server that the PDC queries. It therfore gives an error message on the client machine about +server that the PDC queries. It therefore gives an error message on the client machine about not being able to set up account credentials. The machine account is created on the LDAP server -but the password fields will be empty. +but the password fields will be empty. Unfortunately, some sites are +unable to avoid such configurations, and these sites should review the +ldap replication +sleep parameter, intended to slow down Samba sufficiently +for the replication to catch up. This is a kludge, and one that the +administrator must manually duplicate in any scripts (such as the +add machine script) that +they use. diff --git a/docs/Samba-HOWTO-Collection/Passdb.xml b/docs/Samba-HOWTO-Collection/Passdb.xml index f9d4f6637ac..06f34b48471 100644 --- a/docs/Samba-HOWTO-Collection/Passdb.xml +++ b/docs/Samba-HOWTO-Collection/Passdb.xml @@ -51,8 +51,12 @@ as follows: Plain Text - This option uses nothing but the UNIX/Linux /etc/passwd - style backend. On systems that have Pluggable Authentication Modules (PAM) + This isn't really a backend at all, but is + listed here for simplicity. Samba can be + configured to pass plaintext authentication + requests to the traditional UNIX/Linux + /etc/passwd and /etc/shadow + style subsystems. On systems that have Pluggable Authentication Modules (PAM) support, all PAM modules are supported. The behavior is just as it was with Samba-2.2.x, and the protocol limitations imposed by MS Windows clients apply likewise. Please refer to Technical Information for more information @@ -1718,11 +1722,6 @@ access to attrs=SambaLMPassword,SambaNTPassword for example, auth methodsguest sam. - - This is the exact opposite of the requirement for the passdb backend - option, where it must be the LAST parameter on the line. - - -- 2.11.4.GIT