1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
5 >How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain</TITLE
8 CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+
11 TITLE="SAMBA Project Documentation"
12 HREF="samba-howto-collection.html"><LINK
14 TITLE="Type of installation"
15 HREF="type.html"><LINK
17 TITLE="How to Configure Samba as a NT4 Primary Domain Controller"
18 HREF="samba-pdc.html"><LINK
20 TITLE="Samba as a ADS domain member"
21 HREF="ads.html"></HEAD
32 SUMMARY="Header navigation table"
41 >SAMBA Project Documentation</TH
76 NAME="SAMBA-BDC">Chapter 7. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain</H1
82 NAME="AEN1127">7.1. Prerequisite Reading</H1
84 >Before you continue reading in this chapter, please make sure
85 that you are comfortable with configuring a Samba PDC
86 as described in the <A
87 HREF="Samba-PDC-HOWTO.html"
97 NAME="AEN1131">7.2. Background</H1
99 >What is a Domain Controller? It is a machine that is able to answer
100 logon requests from workstations in a Windows NT Domain. Whenever a
101 user logs into a Windows NT Workstation, the workstation connects to a
102 Domain Controller and asks him whether the username and password the
103 user typed in is correct. The Domain Controller replies with a lot of
104 information about the user, for example the place where the users
105 profile is stored, the users full name of the user. All this
106 information is stored in the NT user database, the so-called SAM.</P
108 >There are two kinds of Domain Controller in a NT 4 compatible Domain:
109 A Primary Domain Controller (PDC) and one or more Backup Domain
110 Controllers (BDC). The PDC contains the master copy of the
111 SAM. Whenever the SAM has to change, for example when a user changes
112 his password, this change has to be done on the PDC. A Backup Domain
113 Controller is a machine that maintains a read-only copy of the
114 SAM. This way it is able to reply to logon requests and authenticate
115 users in case the PDC is not available. During this time no changes to
116 the SAM are possible. Whenever changes to the SAM are done on the PDC,
117 all BDC receive the changes from the PDC.</P
119 >Since version 2.2 Samba officially supports domain logons for all
120 current Windows Clients, including Windows 2000 and XP. This text
121 assumes the domain to be named SAMBA. To be able to act as a PDC, some
122 parameters in the [global]-section of the smb.conf have to be set:</P
125 CLASS="PROGRAMLISTING"
128 domain logons = yes</PRE
131 >Several other things like a [homes] and a [netlogon] share also may be
132 set along with settings for the profile path, the users home drive and
133 others. This will not be covered in this document.</P
140 NAME="AEN1139">7.3. What qualifies a Domain Controller on the network?</H1
142 >Every machine that is a Domain Controller for the domain SAMBA has to
143 register the NetBIOS group name SAMBA#1c with the WINS server and/or
144 by broadcast on the local network. The PDC also registers the unique
145 NetBIOS name SAMBA#1b with the WINS server. The name type #1b is
146 normally reserved for the domain master browser, a role that has
147 nothing to do with anything related to authentication, but the
148 Microsoft Domain implementation requires the domain master browser to
149 be on the same machine as the PDC.</P
155 NAME="AEN1142">7.3.1. How does a Workstation find its domain controller?</H2
157 >A NT workstation in the domain SAMBA that wants a local user to be
158 authenticated has to find the domain controller for SAMBA. It does
159 this by doing a NetBIOS name query for the group name SAMBA#1c. It
160 assumes that each of the machines it gets back from the queries is a
161 domain controller and can answer logon requests. To not open security
162 holes both the workstation and the selected (TODO: How is the DC
163 chosen) domain controller authenticate each other. After that the
164 workstation sends the user's credentials (his name and password) to
165 the domain controller, asking for approval.</P
172 NAME="AEN1145">7.3.2. When is the PDC needed?</H2
174 >Whenever a user wants to change his password, this has to be done on
175 the PDC. To find the PDC, the workstation does a NetBIOS name query
176 for SAMBA#1b, assuming this machine maintains the master copy of the
177 SAM. The workstation contacts the PDC, both mutually authenticate and
178 the password change is done.</P
186 NAME="AEN1148">7.4. Can Samba be a Backup Domain Controller?</H1
188 >With version 2.2, no. The native NT SAM replication protocols have
189 not yet been fully implemented. The Samba Team is working on
190 understanding and implementing the protocols, but this work has not
191 been finished for version 2.2.</P
193 >Can I get the benefits of a BDC with Samba? Yes. The main reason for
194 implementing a BDC is availability. If the PDC is a Samba machine,
195 a second Samba machine can be set up to
196 service logon requests whenever the PDC is down.</P
203 NAME="AEN1152">7.5. How do I set up a Samba BDC?</H1
205 >Several things have to be done:</P
211 >The domain SID has to be the same on the PDC and the BDC. This used to
212 be stored in the file private/MACHINE.SID. This file is not created
213 anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is
214 stored in the file private/secrets.tdb. Simply copying the secrets.tdb
215 from the PDC to the BDC does not work, as the BDC would
216 generate a new SID for itself and override the domain SID with this
219 >To retrieve the domain SID from the PDC or an existing BDC and store it in the
220 secrets.tdb, execute 'net rpc getsid' on the BDC.</P
224 >The Unix user database has to be synchronized from the PDC to the
225 BDC. This means that both the /etc/passwd and /etc/group have to be
226 replicated from the PDC to the BDC. This can be done manually
227 whenever changes are made, or the PDC is set up as a NIS master
228 server and the BDC as a NIS slave server. To set up the BDC as a
229 mere NIS client would not be enough, as the BDC would not be able to
230 access its user database in case of a PDC failure.</P
234 >The Samba password database in the file private/smbpasswd has to be
235 replicated from the PDC to the BDC. This is a bit tricky, see the
240 >Any netlogon share has to be replicated from the PDC to the
241 BDC. This can be done manually whenever login scripts are changed,
242 or it can be done automatically together with the smbpasswd
247 >Finally, the BDC has to be found by the workstations. This can be done
251 CLASS="PROGRAMLISTING"
254 domain logons = yes</PRE
257 >in the [global]-section of the smb.conf of the BDC. This makes the BDC
258 only register the name SAMBA#1c with the WINS server. This is no
259 problem as the name SAMBA#1c is a NetBIOS group name that is meant to
260 be registered by more than one machine. The parameter 'domain master =
261 no' forces the BDC not to register SAMBA#1b which as a unique NetBIOS
262 name is reserved for the Primary Domain Controller.</P
268 NAME="AEN1169">7.5.1. How do I replicate the smbpasswd file?</H2
270 >Replication of the smbpasswd file is sensitive. It has to be done
271 whenever changes to the SAM are made. Every user's password change is
272 done in the smbpasswd file and has to be replicated to the BDC. So
273 replicating the smbpasswd file very often is necessary.</P
275 >As the smbpasswd file contains plain text password equivalents, it
276 must not be sent unencrypted over the wire. The best way to set up
277 smbpasswd replication from the PDC to the BDC is to use the utility
278 rsync. rsync can use ssh as a transport. ssh itself can be set up to
279 accept *only* rsync transfer without requiring the user to type a
289 SUMMARY="Footer navigation table"
300 HREF="samba-pdc.html"
309 HREF="samba-howto-collection.html"
328 >How to Configure Samba as a NT4 Primary Domain Controller</TD
342 >Samba as a ADS domain member</TD
git.samba.org / kai / samba.git / blob