docs/docbook/projdoc/DOMAIN_MEMBER.sgml

   1 <chapter id="domain-security">
   2
   3 <chapterinfo>
   4         &author.jeremy;
   5         &author.jerry;
   6         <pubdate>16 Apr 2001</pubdate>
   7 </chapterinfo>
   8
   9
  10 <title>Samba as a NT4 or Win2k domain member</title>
  11
  12 <sect1>
  13
  14         <title>Joining an NT Domain with Samba 3.0</title>
  15
  16         <para>Assume you have a Samba 3.0 server with a NetBIOS name of
  17         <constant>SERV1</constant> and are joining an or Win2k NT domain called
  18         <constant>DOM</constant>, which has a PDC with a NetBIOS name
  19         of <constant>DOMPDC</constant> and two backup domain controllers
  20         with NetBIOS names <constant>DOMBDC1</constant> and <constant>DOMBDC2
  21         </constant>.</para>
  22
  23         <para>Firstly, you must edit your &smb.conf; file to tell Samba it should
  24         now use domain security.</para>
  25
  26         <para>Change (or add) your <ulink url="smb.conf.5.html#SECURITY">
  27         <parameter>security =</parameter></ulink> line in the [global] section
  28         of your &smb.conf; to read:</para>
  29
  30         <para><command>security = domain</command></para>
  31
  32         <para>Next change the <ulink url="smb.conf.5.html#WORKGROUP"><parameter>
  33         workgroup =</parameter></ulink> line in the [global] section to read: </para>
  34
  35         <para><command>workgroup = DOM</command></para>
  36
  37         <para>as this is the name of the domain we are joining. </para>
  38
  39         <para>You must also have the parameter <ulink url="smb.conf.5.html#ENCRYPTPASSWORDS">
  40         <parameter>encrypt passwords</parameter></ulink> set to <constant>yes
  41         </constant> in order for your users to authenticate to the NT PDC.</para>
  42
  43         <para>Finally, add (or modify) a <ulink url="smb.conf.5.html#PASSWORDSERVER">
  44         <parameter>password server =</parameter></ulink> line in the [global]
  45         section to read: </para>
  46
  47         <para><command>password server = DOMPDC DOMBDC1 DOMBDC2</command></para>
  48
  49         <para>These are the primary and backup domain controllers Samba
  50         will attempt to contact in order to authenticate users. Samba will
  51         try to contact each of these servers in order, so you may want to
  52         rearrange this list in order to spread out the authentication load
  53         among domain controllers.</para>
  54
  55         <para>Alternatively, if you want smbd to automatically determine
  56         the list of Domain controllers to use for authentication, you may
  57         set this line to be :</para>
  58
  59         <para><command>password server = *</command></para>
  60
  61         <para>This method, allows Samba to use exactly the same
  62         mechanism that NT does. This
  63         method either broadcasts or uses a WINS database in order to
  64         find domain controllers to authenticate against.</para>
  65
  66         <para>In order to actually join the domain, you must run this
  67         command:</para>
  68
  69         <para><prompt>root# </prompt><userinput>net rpc join -S DOMPDC
  70         -U<replaceable>Administrator%password</replaceable></userinput></para>
  71
  72         <para>as we are joining the domain DOM and the PDC for that domain
  73         (the only machine that has write access to the domain SAM database)
  74         is DOMPDC. The <replaceable>Administrator%password</replaceable> is
  75         the login name and password for an account which has the necessary
  76         privilege to add machines to the domain.  If this is successful
  77         you will see the message:</para>
  78
  79         <para><computeroutput>Joined domain DOM.</computeroutput>
  80         or <computeroutput>Joined 'SERV1' to realm 'MYREALM'</computeroutput>
  81         </para>
  82
  83         <para>in your terminal window. See the <ulink url="net.8.html">
  84         net(8)</ulink> man page for more details.</para>
  85
  86         <para>This process joins the server to thedomain
  87         without having to create the machine trust account on the PDC
  88         beforehand.</para>
  89
  90         <para>This command goes through the machine account password
  91         change protocol, then writes the new (random) machine account
  92         password for this Samba server into a file in the same directory
  93         in which an smbpasswd file would be stored - normally :</para>
  94
  95         <para><filename>/usr/local/samba/private/secrets.tdb</filename></para>
  96
  97         <para>This file is created and owned by root and is not
  98         readable by any other user. It is the key to the domain-level
  99         security for your system, and should be treated as carefully
 100         as a shadow password file.</para>
 101
 102         <para>Finally, restart your Samba daemons and get ready for
 103         clients to begin using domain security!</para>
 104 </sect1>
 105
 106 <sect1>
 107         <title>Why is this better than security = server?</title>
 108
 109         <para>Currently, domain security in Samba doesn't free you from
 110         having to create local Unix users to represent the users attaching
 111         to your server. This means that if domain user <constant>DOM\fred
 112         </constant> attaches to your domain security Samba server, there needs
 113         to be a local Unix user fred to represent that user in the Unix
 114         filesystem. This is very similar to the older Samba security mode
 115         <ulink url="smb.conf.5.html#SECURITYEQUALSSERVER">security = server</ulink>,
 116         where Samba would pass through the authentication request to a Windows
 117         NT server in the same way as a Windows 95 or Windows 98 server would.
 118         </para>
 119
 120         <para>Please refer to the <ulink url="winbind.html">Winbind
 121         paper</ulink> for information on a system to automatically
 122         assign UNIX uids and gids to Windows NT Domain users and groups.
 123         This code is available in development branches only at the moment,
 124         but will be moved to release branches soon.</para>
 125
 126         <para>The advantage to domain-level security is that the
 127         authentication in domain-level security is passed down the authenticated
 128         RPC channel in exactly the same way that an NT server would do it. This
 129         means Samba servers now participate in domain trust relationships in
 130         exactly the same way NT servers do (i.e., you can add Samba servers into
 131         a resource domain and have the authentication passed on from a resource
 132         domain PDC to an account domain PDC.</para>
 133
 134         <para>In addition, with <command>security = server</command> every Samba
 135         daemon on a server has to keep a connection open to the
 136         authenticating server for as long as that daemon lasts. This can drain
 137         the connection resources on a Microsoft NT server and cause it to run
 138         out of available connections. With <command>security = domain</command>,
 139         however, the Samba daemons connect to the PDC/BDC only for as long
 140         as is necessary to authenticate the user, and then drop the connection,
 141         thus conserving PDC connection resources.</para>
 142
 143         <para>And finally, acting in the same manner as an NT server
 144         authenticating to a PDC means that as part of the authentication
 145         reply, the Samba server gets the user identification information such
 146         as the user SID, the list of NT groups the user belongs to, etc. </para>
 147
 148         <note><para> Much of the text of this document
 149         was first published in the Web magazine <ulink url="http://www.linuxworld.com">
 150         LinuxWorld</ulink> as the article <ulink
 151         url="http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html">Doing
 152         the NIS/NT Samba</ulink>.</para></note>
 153
 154 </sect1>
 155
 156 </chapter>