1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. Backup Domain Control</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><link rel="home" href="index.html" title="SAMBA Project Documentation"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="previous" href="samba-pdc.html" title="Chapter 5. Domain Control"><link rel="next" href="domain-member.html" title="Chapter 7. Domain Membership"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. Backup Domain Control</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="samba-pdc.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="domain-member.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="samba-bdc"></a>Chapter 6. Backup Domain Control</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="samba-bdc.html#id2896028">Features And Benefits</a></dt><dt><a href="samba-bdc.html#id2896201">Essential Background Information</a></dt><dd><dl><dt><a href="samba-bdc.html#id2896230">MS Windows NT4 Style Domain Control</a></dt><dt><a href="samba-bdc.html#id2896450">Active Directory Domain Control</a></dt><dt><a href="samba-bdc.html#id2896471">What qualifies a Domain Controller on the network?</a></dt><dt><a href="samba-bdc.html#id2896497">How does a Workstation find its domain controller?</a></dt></dl></dd><dt><a href="samba-bdc.html#id2896542">Backup Domain Controller Configuration</a></dt><dd><dl><dt><a href="samba-bdc.html#id2896645">Example Configuration</a></dt></dl></dd><dt><a href="samba-bdc.html#id2896706">Common Errors</a></dt><dd><dl><dt><a href="samba-bdc.html#id2896719">Machine Accounts keep expiring, what can I do?</a></dt><dt><a href="samba-bdc.html#id2896750">Can Samba be a Backup Domain Controller to an NT4 PDC?</a></dt><dt><a href="samba-bdc.html#id2896783">How do I replicate the smbpasswd file?</a></dt><dt><a href="samba-bdc.html#id2896828">Can I do this all with LDAP?</a></dt></dl></dd></dl></div><p>
2 Before you continue reading in this section, please make sure that you are comfortable
3 with configuring a Samba Domain Controller as described in the
4 <a href="samba-pdc.html" title="Chapter 5. Domain Control">Domain Control</a> chapter.
5 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2896028"></a>Features And Benefits</h2></div></div><div></div></div><p>
6 This is one of the most difficult chapters to summarise. It does not matter what we say here
7 for someone will still draw conclusions and / or approach the Samba-Team with expectations
8 that are either not yet capable of being delivered, or that can be achieved far more
9 effectively using a totally different approach. Since this HOWTO is already so large and
10 extensive, we have taken the decision to provide sufficient (but not comprehensive)
11 information regarding Backup Domain Control. In the event that you should have a persistent
12 concern that is not addressed in this HOWTO document then please email
13 <a href="mailto:jht@samba.org" target="_top">John H Terpstra</a> clearly setting out your requirements
14 and / or question and we will do our best to provide a solution.
16 Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain
17 Controller. A Samba-3 PDC can operate with an LDAP Account backend. The Samba-3 BDC can
18 operate with a slave LDAP server for the Account backend. This effectively gives samba a high
19 degree of scalability. This is a very sweet (nice) solution for large organisations.
21 While it is possible to run a Samba-3 BDC with non-LDAP backend, the administrator will
22 need to figure out precisely what is the best way to replicate (copy / distribute) the
23 user and machine Accounts backend.
25 The use of a non-LDAP backend SAM database is particularly problematic because Domain member
26 servers and workstations periodically change the machine trust account password. The new
27 password is then stored only locally. This means that in the absence of a centrally stored
28 accounts database (such as that provided with an LDAP based solution) if Samba-3 is running
29 as a BDC, the BDC instance of the Domain member trust account password will not reach the
30 PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs this results in
31 overwriting of the SAM that contains the updated (changed) trust account password with resulting
32 breakage of the domain trust.
34 Considering the number of comments and questions raised concerning how to configure a BDC
35 lets consider each possible option and look at the pro's and con's for each theoretical solution:
36 </p><div class="itemizedlist"><p class="title"><b>Backup Domain Backend Account Distribution Options</b></p><ul type="disc"><li><p>
37 Solution: Passwd Backend is LDAP based, BDCs use a slave LDAP server
39 Arguments For: This is a neat and manageable solution. The LDAP based SAM (ldapsam)
40 is constantly kept up to date.
42 Arguments Against: Complexity
44 Passdb Backend is tdbsam based, BDCs use cron based "net rpc vampire" to
45 suck down the Accounts database from the PDC
47 Arguments For: It would be a nice solution
49 Arguments Against: It does not work because Samba-3 does not support the required
50 protocols. This may become a later feature but is not available today.
52 Make use of rsync to replicate (pull down) copies of the essential account files
54 Arguments For: It is a simple solution, easy to set up as a scheduled job
56 Arguments Against: This will over-write the locally changed machine trust account
57 passwords. This is a broken and flawed solution. Do NOT do this.
59 Operate with an entirely local accounts database (not recommended)
61 Arguments For: Simple, easy to maintain
63 Arguments Against: All machine trust accounts and user accounts will be locally
64 maintained. Domain users will NOT be able to roam from office to office. This is
65 a broken and flawed solution. Do NOT do this.
66 </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2896201"></a>Essential Background Information</h2></div></div><div></div></div><p>
67 A Domain Controller is a machine that is able to answer logon requests from network
68 workstations. Microsoft LanManager and IBM LanServer were two early products that
69 provided this capability. The technology has become known as the LanMan Netlogon service.
71 When MS Windows NT3.10 was first released, it supported an new style of Domain Control
72 and with it a new form of the network logon service that has extended functionality.
73 This service became known as the NT NetLogon Service. The nature of this service has
74 changed with the evolution of MS Windows NT and today provides a very complex array of
75 services that are implemented over a complex spectrum of technologies.
76 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896230"></a>MS Windows NT4 Style Domain Control</h3></div></div><div></div></div><p>
77 Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation,
78 the workstation connects to a Domain Controller (authentication server) to validate
79 the username and password that the user entered are valid. If the information entered
80 does not validate against the account information that has been stored in the Domain
81 Control database (the SAM, or Security Account Manager database) then a set of error
82 codes is returned to the workstation that has made the authentication request.
84 When the username / password pair has been validated, the Domain Controller
85 (authentication server) will respond with full enumeration of the account information
86 that has been stored regarding that user in the User and Machine Accounts database
87 for that Domain. This information contains a complete network access profile for
88 the user but excludes any information that is particular to the user's desktop profile,
89 or for that matter it excludes all desktop profiles for groups that the user may
90 belong to. It does include password time limits, password uniqueness controls,
91 network access time limits, account validity information, machine names from which the
92 user may access the network, and much more. All this information was stored in the SAM
93 in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0).
95 The account information (user and machine) on Domain Controllers is stored in two files,
96 one containing the Security information and the other the SAM. These are stored in files
97 by the same name in the <tt class="filename">C:\WinNT\System32\config</tt> directory. These
98 are the files that are involved in replication of the SAM database where Backup Domain
99 Controllers are present on the network.
101 There are two situations in which it is desirable to install Backup Domain Controllers:
102 </p><div class="itemizedlist"><ul type="disc"><li><p>
103 On the local network that the Primary Domain Controller is on, if there are many
104 workstations and/or where the PDC is generally very busy. In this case the BDCs
105 will pick up network logon requests and help to add robustness to network services.
107 At each remote site, to reduce wide area network traffic and to add stability to
108 remote network operations. The design of the network, the strategic placement of
109 Backup Domain Controllers, together with an implementation that localises as much
110 of network to client interchange as possible will help to minimise wide area network
111 bandwidth needs (and thus costs).
112 </p></li></ul></div><p>
113 The PDC contains the master copy of the SAM. In the event that an administrator makes a
114 change to the user account database while physically present on the local network that
115 has the PDC, the change will likely be made directly to the PDC instance of the master
116 copy of the SAM. In the event that this update may be performed in a branch office the
117 change will likely be stored in a delta file on the local BDC. The BDC will then send
118 a trigger to the PDC to commence the process of SAM synchronisation. The PDC will then
119 request the delta from the BDC and apply it to the master SAM. The PDC will then contact
120 all the BDCs in the Domain and trigger them to obtain the update and then apply that to
121 their own copy of the SAM.
123 Thus the BDC is said to hold a <span class="emphasis"><em>read-only</em></span> of the SAM from which
124 it is able to process network logon requests and to authenticate users. The BDC can
125 continue to provide this service, particularly while, for example, the wide area
126 network link to the PDC is down. Thus a BDC plays a very important role in both
127 maintenance of Domain security as well as in network integrity.
129 In the event that the PDC should need to be taken out of service, or if it dies, then
130 one of the BDCs can be promoted to a PDC. If this happens while the original PDC is on
131 line then it is automatically demoted to a BDC. This is an important aspect of Domain
132 Controller management. The tool that is used to affect a promotion or a demotion is the
133 Server Manager for Domains.
134 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2896379"></a>Example PDC Configuration</h4></div></div><div></div></div><p>
135 Since version 2.2 Samba officially supports domain logons for all current Windows Clients,
136 including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some
137 parameters in the <i class="parameter"><tt>[global]</tt></i>-section of the <tt class="filename">smb.conf</tt> have to be set:
138 </p><pre class="programlisting">
143 Several other things like a <i class="parameter"><tt>[homes]</tt></i> and a <i class="parameter"><tt>[netlogon]</tt></i> share also need to be set along with
144 settings for the profile path, the users home drive, etc.. This will not be covered in this
145 chapter, for more information please refer to the chapter on <a href="samba-pdc.html" title="Chapter 5. Domain Control">Domain Control</a>.
146 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896450"></a>Active Directory Domain Control</h3></div></div><div></div></div><p>
147 As of the release of MS Windows 2000 and Active Directory, this information is now stored
148 in a directory that can be replicated and for which partial or full administrative control
149 can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory
150 tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT
151 act as a Backup Domain Controller to an Active Directory Domain Controller.
152 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896471"></a>What qualifies a Domain Controller on the network?</h3></div></div><div></div></div><p>
153 Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS
154 group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network.
155 The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server.
156 The name type <#1b> name is normally reserved for the Domain Master Browser, a role
157 that has nothing to do with anything related to authentication, but the Microsoft Domain
158 implementation requires the domain master browser to be on the same machine as the PDC.
159 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896497"></a>How does a Workstation find its domain controller?</h3></div></div><div></div></div><p>
160 An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a
161 local user to be authenticated has to find the domain controller for SAMBA. It does this
162 by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each
163 of the machines it gets back from the queries is a domain controller and can answer logon
164 requests. To not open security holes both the workstation and the selected domain controller
165 authenticate each other. After that the workstation sends the user's credentials (name and
166 password) to the local Domain Controller, for validation.
167 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2896542"></a>Backup Domain Controller Configuration</h2></div></div><div></div></div><p>
168 Several things have to be done:
169 </p><div class="itemizedlist"><ul type="disc"><li><p>
170 The domain SID has to be the same on the PDC and the BDC. This used to
171 be stored in the file private/MACHINE.SID. This file is not created
172 anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is
173 stored in the file private/secrets.tdb. Simply copying the secrets.tdb
174 from the PDC to the BDC does not work, as the BDC would
175 generate a new SID for itself and override the domain SID with this
177 To retrieve the domain SID from the PDC or an existing BDC and store it in the
178 secrets.tdb, execute:
179 </p><pre class="screen">
180 <tt class="prompt">root# </tt><b class="userinput"><tt>net rpc getsid</tt></b>
182 The Unix user database has to be synchronized from the PDC to the
183 BDC. This means that both the /etc/passwd and /etc/group have to be
184 replicated from the PDC to the BDC. This can be done manually
185 whenever changes are made, or the PDC is set up as a NIS master
186 server and the BDC as a NIS slave server. To set up the BDC as a
187 mere NIS client would not be enough, as the BDC would not be able to
188 access its user database in case of a PDC failure. NIS is by no means
189 the only method to synchronize passwords. An LDAP solution would work
192 The Samba password database has to be replicated from the PDC to the BDC.
193 As said above, though possible to synchronise the <tt class="filename">smbpasswd</tt>
194 file with rsync and ssh, this method is broken and flawed, and is
195 therefore not recommended. A better solution is to set up slave LDAP
196 servers for each BDC and a master LDAP server for the PDC.
198 Any netlogon share has to be replicated from the PDC to the
199 BDC. This can be done manually whenever login scripts are changed,
200 or it can be done automatically together with the smbpasswd
202 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896645"></a>Example Configuration</h3></div></div><div></div></div><p>
203 Finally, the BDC has to be found by the workstations. This can be done by setting:
204 </p><pre class="programlisting">
209 in the <i class="parameter"><tt>[global]</tt></i>-section of the <tt class="filename">smb.conf</tt> of the BDC. This makes the BDC
210 only register the name SAMBA<#1c> with the WINS server. This is no
211 problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to
212 be registered by more than one machine. The parameter 'domain master =
213 no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS
214 name is reserved for the Primary Domain Controller.
215 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2896706"></a>Common Errors</h2></div></div><div></div></div><p>
216 As this is a rather new area for Samba there are not many examples that we may refer to. Keep
217 watching for updates to this section.
218 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896719"></a>Machine Accounts keep expiring, what can I do?</h3></div></div><div></div></div><p>
219 This problem will occur when occur when the passdb (SAM) files are copied from a central
220 server but the local Backup Domain Controllers. Local machine trust account password updates
221 are not copied back to the central server. The newer machine account password is then over
222 written when the SAM is copied from the PDC. The result is that the Domain member machine
223 on start up will find that it's passwords does not match the one now in the database and
224 since the startup security check will now fail, this machine will not allow logon attempts
225 to proceed and the account expiry error will be reported.
227 The solution: use a more robust passdb backend, such as the ldapsam backend, setting up
228 an slave LDAP server for each BDC, and a master LDAP server for the PDC.
229 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896750"></a>Can Samba be a Backup Domain Controller to an NT4 PDC?</h3></div></div><div></div></div><p>
230 With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully
231 implemented. The Samba Team is working on understanding and implementing the protocols,
232 but this work has not been finished for version 2.2.
234 With version 3.0, the work on both the replication protocols and a suitable storage
235 mechanism has progressed, and some form of NT4 BDC support is expected soon.
237 Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a
238 BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to
239 service logon requests whenever the PDC is down.
240 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896783"></a>How do I replicate the smbpasswd file?</h3></div></div><div></div></div><p>
241 Replication of the smbpasswd file is sensitive. It has to be done whenever changes
242 to the SAM are made. Every user's password change is done in the smbpasswd file and
243 has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary.
245 As the smbpasswd file contains plain text password equivalents, it must not be
246 sent unencrypted over the wire. The best way to set up smbpasswd replication from
247 the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport.
248 Ssh itself can be set up to accept <span class="emphasis"><em>only</em></span> rsync transfer without requiring the user
251 As said a few times before, use of this method is broken and flawed. Machine trust
252 accounts will go out of sync, resulting in a very broken domain. This method is
253 <span class="emphasis"><em>not</em></span> recommended. Try using LDAP instead.
254 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896828"></a>Can I do this all with LDAP?</h3></div></div><div></div></div><p>
255 The simple answer is YES. Samba's pdb_ldap code supports binding to a replica
256 LDAP server, and will also follow referrals and rebind to the master if it ever
257 needs to make a modification to the database. (Normally BDCs are read only, so
258 this will not occur often).
259 </p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="samba-pdc.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="type.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="domain-member.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 5. Domain Control </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 7. Domain Membership</td></tr></table></div></body></html>
git.samba.org / gd / samba-autobuild / .git / blob