From 46ed5a6acde3b2b43ee4c32ff4ace950dba79b8c Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Mon, 21 May 2001 08:34:49 +0000 Subject: working on updates for the 2.2.1 release --- docs/htmldocs/Samba-PDC-HOWTO.html | 520 ++++++++++++++++++++++++------------- 1 file changed, 338 insertions(+), 182 deletions(-) (limited to 'docs/htmldocs/Samba-PDC-HOWTO.html') diff --git a/docs/htmldocs/Samba-PDC-HOWTO.html b/docs/htmldocs/Samba-PDC-HOWTO.html index 668f7f9aff3..6dc467ed9ed 100644 --- a/docs/htmldocs/Samba-PDC-HOWTO.html +++ b/docs/htmldocs/Samba-PDC-HOWTO.html @@ -1,7 +1,7 @@ How to Configure Samba 2.2.x as a Primary Domain ControllerHow to Configure Samba 2.2 as a Primary Domain ControllerHow to Configure Samba 2.2.x as a Primary Domain ControllerHow to Configure Samba 2.2 as a Primary Domain Controller
Background

Note: Author's Note : This document -is a combination of David Bannon's Samba 2.2 PDC HOWTO -and the Samba NT Domain FAQ. Both documents are superceeded by this one.

This document is a combination +of David Bannon's Samba 2.2 PDC HOWTO and the Samba NT Domain FAQ. +Both documents are superceeded by this one.

Version of Samba prior to release 2.2 had marginal capabilities to act as a Windows NT 4.0 Primary Domain Controller (PDC). The following -functionality should work in 2.2.0:

UNIX_INSTALL.html, please make sure that your server -is configured correctly before proceeding. Another good +> UNIX_INSTALL.html, please make sure +that your server is configured correctly before proceeding. Another good resource in the

  • Configuring the Samba Domain Controller +> Configuring the Samba PDC

  • Creating machine trust accounts - and joining clients to the domain

    Creating machine trust accounts and joining clients + to the domain +

    • Configuring the Samba Domain Controller

    = \\homeserver\%u ; specify a generic logon script for all users - ; this is a relative path to the [netlogon] share + ; this is a relative **DOS** path to the [netlogon] share = 0700

    There are a couple of points to emphasize in the above -configuration.

    There are a couple of points to emphasize in the above configuration.

    As Samba 2.2 does not offer a complete implementation of group mapping between Windows NT groups and UNIX groups (this is really quite complicated to explain in a short space), you should refer to the domain admin users

    Creating Machine Trust Accounts and Joining Clients to the Domain

    First you must understand what a machine trust account is and what -it is used for.

    A machine trust account is a user account owned by a computer. +>A machine trust account is a samba user account owned by a computer. The account password acts as the shared secret for secure -communication with the Domain Controller. Hence the reason that -a Windows 9x host is never a true member of a domain because -it does not posses a machine trust account and thus has no shared -secret with the DC.

    On a Windows NT PDC, these machine trust account passwords are stored -in the registry. A Samba PDC stores these accounts in he same location +in the registry. A Samba PDC stores these accounts in the same location as user LanMan and NT password hashes (currently smbpasswd). -However, machine trust accounts only possess the NT password hash.

    There are two means of creating machine trust accounts.

    Because Samba requires machine accounts to possess a UNIX uid from which an Windows NT SID can be generated, all of these accounts -will have an entry in /etc/passwd and smbpasswd. @@ -408,7 +405,23 @@ Future releases will alleviate the need to create /etc/passwd entries.

    entries. For those who wish to avoid +editing the passwd file manually the command below should work well:

    root# /usr/sbin/useradd -g 100 -d /dev/null -c machine_nickname -m -s /bin/false machine_name$

    The 

    doppy$:x:505:501:NTMachine:/dev/null:/bin/false
    doppy$:x:505:501:machine_nickname:/dev/null:/bin/false

    If you are manually creating the machine accounts, it is necessary -to add the /etc/passwd (or NIS passwd -map) entry prior to adding the smbpasswd -entry. The following command will create a new machine account -ready for use.

    Above, machine_nickname can be any descriptive name for the +pc i.e. BasementComputer. The machine_name absolutely must be +the netbios name of the pc to be added to the domain. The "$" must append the netbios +name of the pc or samba will not recognize this as a machine account

    Now that the UNIX account has been created, +the following command shows how to create a new machine account, +enabling the machine to join the domain.

    There are two means of creating machine trust accounts.

    • Manual creation before joining the client to the domain. In this case, + the password is set to a known value -- the lower case of the + machine's netbios name. +

    • Creation of the account at the time of joining the domain. In + this case, the session key of the administrative account used to join + the client to the domain acts as an encryption key for setting the + password to a random value (This is the recommended method). +

    machine_name is the machine's netbios -name.

    If you manually create a machine account, immediately join -the client to the domain. An open account like this -can allow intruders to gain access to user account information -in your domain.

    The second way of creating machine trust accounts is to add -them on the fly at the time the client is joined to the domain. -You will need to include a value for the -If you manually create a +machine account, immediately join the client to the domain. +An open account like this can allow intruders to gain access to user +account information in your domain.

    The second, and again recommended way of creating machine trust accounts +is to add them on the fly at the time the client is joined to the domain. +You will need to include a value for the add user scriptadd user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u

    In Samba 2.2.0, In Samba 2.2, only the root account can be used to create -machine accounts on the fly like this. Therefore, it is required -to create an entry in smbpasswd for root. -The password . The password +SHOULD be set to s different -password that the associated be set to s different password that the +associated /etc/passwd -entry for security reasons.

    entry for security reasons.

    Common Problems and Errors

    System Policies and Profiles

    What other help can I get ?

    URLs and similar

    Mailing Lists

    DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba