1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�5.�Backup Domain Control</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.66.1"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="type.html" title="Part�II.�Server Configuration Basics"><link rel="prev" href="samba-pdc.html" title="Chapter�4.�Domain Control"><link rel="next" href="domain-member.html" title="Chapter�6.�Domain Membership"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�5.�Backup Domain Control</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="samba-pdc.html">Prev</a>�</td><th width="60%" align="center">Part�II.�Server Configuration Basics</th><td width="20%" align="right">�<a accesskey="n" href="domain-member.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="samba-bdc"></a>Chapter�5.�Backup Domain Control</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="surname">Deschner</span></h3><span class="contrib">LDAP updates</span><div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><tt class="email"><<a href="mailto:gd@suse.de">gd@suse.de</a>></tt></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="samba-bdc.html#id2538978">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="samba-bdc.html#id2539276">Essential Background Information</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2539300">MS Windows NT4-style Domain Control</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2539607">LDAP Configuration Notes</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2539815">Active Directory Domain Control</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2539832">What Qualifies a Domain Controller on the Network?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2539870">How does a Workstation find its Domain Controller?</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-bdc.html#id2539968">Backup Domain Controller Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2540184">Example Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-bdc.html#id2540414">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-bdc.html#id2540433">Machine Accounts Keep Expiring</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2540479">Can Samba Be a Backup Domain Controller to an NT4 PDC?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2540508">How Do I Replicate the smbpasswd File?</a></span></dt><dt><span class="sect2"><a href="samba-bdc.html#id2540565">Can I Do This All with LDAP?</a></span></dt></dl></dd></dl></div><p> 2Before you continue reading this section, please make sure that you are comfortable 3with configuring a Samba Domain Controller as described in <a href="samba-pdc.html" title="Chapter�4.�Domain Control">Domain Control</a>. 4</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2538978"></a>Features and Benefits</h2></div></div></div><p> 5This is one of the most difficult chapters to summarize. It does not matter what we say here 6for someone will still draw conclusions and/or approach the Samba Team with expectations 7that are either not yet capable of being delivered, or that can be achieved far more 8effectively using a totally different approach. In the event that you should have a persistent 9concern that is not addressed in this book, please email <a href="mailto:jht@samba.org" target="_top">John H. Terpstra</a> 10clearly setting out your requirements and/or question and we will do our best to provide a solution. 11</p><p> 12<a class="indexterm" name="id2539004"></a> 13Samba-3 is capable of acting as a Backup Domain Controller (BDC) to another Samba Primary Domain 14Controller (PDC). A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be 15either a common master LDAP server, or a slave server. The use of a slave LDAP server has the 16benefit that when the master is down, clients may still be able to log onto the network. 17This effectively gives Samba a high degree of scalability and is an effective solution 18for large organizations. If you use an LDAP slave server for a PDC, 19you will need to ensure the master's continued availability - if the 20slave finds it's master down at the wrong time, you will have 21stability and operational problems. 22</p><p> 23<a class="indexterm" name="id2539028"></a> 24While it is possible to run a Samba-3 BDC with non-LDAP backend, that 25backend must allow some form of 'two way' propagation, of changes 26from the BDC to the master. Only LDAP is capable of this at this stage. 27</p><p> 28<a class="indexterm" name="id2539044"></a> 29The use of a non-LDAP backend SAM database is particularly problematic because Domain Member 30servers and workstations periodically change the Machine Trust Account password. The new 31password is then stored only locally. This means that in the absence of a centrally stored 32accounts database (such as that provided with an LDAP-based solution) if Samba-3 is running 33as a BDC, the BDC instance of the Domain Member trust account password will not reach the 34PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs, this results in 35overwriting the SAM that contains the updated (changed) trust account password with resulting 36breakage of the domain trust. 37</p><p> 38Considering the number of comments and questions raised concerning how to configure a BDC, 39let's consider each possible option and look at the pros and cons for each possible solution. 40<a href="samba-bdc.html#pdc-bdc-table" title="Table�5.1.�Domain Backend Account Distribution Options">Following table</a> lists possible design configurations for a PDC/BDC infrastructure. 41<a class="indexterm" name="id2539080"></a> 42<a class="indexterm" name="id2539089"></a> 43<a class="indexterm" name="id2539098"></a> 44<a class="indexterm" name="id2539107"></a> 45</p><div class="table"><a name="pdc-bdc-table"></a><p class="title"><b>Table�5.1.�Domain Backend Account Distribution Options</b></p><table summary="Domain Backend Account Distribution Options" border="1"><colgroup><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="center">PDC Backend</th><th align="center">BDC Backend</th><th align="left">Notes/Discussion</th></tr></thead><tbody><tr><td align="center"><p>Master LDAP Server</p></td><td align="center"><p>Slave LDAP Server</p></td><td align="left"><p>The optimal solution that provides high integrity. The SAM will be 46 replicated to a common master LDAP server.</p></td></tr><tr><td align="center"><p>Single Central LDAP Server</p></td><td align="center"><p>Single Central LDAP Server</p></td><td align="left"><p> 47 A workable solution without fail-over ability. This is a usable solution, but not optimal. 48 </p></td></tr><tr><td align="center"><p>tdbsam</p></td><td align="center"><p>tdbsam + <span><b class="command">net rpc vampire</b></span></p></td><td align="left"><p> 49 Does not work with Samba-3.0; as Samba does not implement the 50 server-side protocols required. 51 </p></td></tr><tr><td align="center"><p>tdbsam</p></td><td align="center"><p>tdbsam + <span><b class="command">rsync</b></span></p></td><td align="left"><p> 52 Do not use this configuration. 53 Does not work because the TDB files are live and data may not 54 have been flushed to disk. Furthermore, this will cause 55 domain trust breakdown. 56 </p></td></tr><tr><td align="center"><p>smbpasswd file</p></td><td align="center"><p>smbpasswd file</p></td><td align="left"><p> 57 Do not use this configuration. 58 Not an elegant solution due to the delays in synchronization 59 and also suffers 60 from the issue of domain trust breakdown. 61 </p></td></tr></tbody></table></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2539276"></a>Essential Background Information</h2></div></div></div><p> 62A Domain Controller is a machine that is able to answer logon requests from network 63workstations. Microsoft LanManager and IBM LanServer were two early products that 64provided this capability. The technology has become known as the LanMan Netlogon service. 65</p><p> 66When MS Windows NT3.10 was first released, it supported a new style of Domain Control 67and with it a new form of the network logon service that has extended functionality. 68This service became known as the NT NetLogon Service. The nature of this service has 69changed with the evolution of MS Windows NT and today provides a complex array of 70services that are implemented over an intricate spectrum of technologies. 71</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2539300"></a>MS Windows NT4-style Domain Control</h3></div></div></div><p> 72Whenever a user logs into a Windows NT4/200x/XP Professional Workstation, 73the workstation connects to a Domain Controller (authentication server) to validate that 74the username and password the user entered are valid. If the information entered 75does not match account information that has been stored in the Domain 76Control database (the SAM, or Security Account Manager database), a set of error 77codes is returned to the workstation that has made the authentication request. 78</p><p> 79When the username/password pair has been validated, the Domain Controller 80(authentication server) will respond with full enumeration of the account information 81that has been stored regarding that user in the User and Machine Accounts database 82for that Domain. This information contains a complete network access profile for 83the user but excludes any information that is particular to the user's desktop profile, 84or for that matter it excludes all desktop profiles for groups that the user may 85belong to. It does include password time limits, password uniqueness controls, 86network access time limits, account validity information, machine names from which the 87user may access the network, and much more. All this information was stored in the SAM 88in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0). 89</p><p> 90<a class="indexterm" name="id2539349"></a> 91The account information (user and machine) on Domain Controllers is stored in two files, 92one containing the Security information and the other the SAM. These are stored in files 93by the same name in the <tt class="filename">%SystemRoot%\System32\config</tt> directory. 94This normally translates to the path <tt class="filename">C:\WinNT\System32\config</tt>. These 95are the files that are involved in replication of the SAM database where Backup Domain 96Controllers are present on the network. 97</p><p> 98There are two situations in which it is desirable to install Backup Domain Controllers: 99</p><div class="itemizedlist"><ul type="disc"><li><p> 100 On the local network that the Primary Domain Controller is on, if there are many 101 workstations and/or where the PDC is generally very busy. In this case the BDCs 102 will pick up network logon requests and help to add robustness to network services. 103 </p></li><li><p> 104 At each remote site, to reduce wide area network traffic and to add stability to 105 remote network operations. The design of the network, the strategic placement of 106 Backup Domain Controllers, together with an implementation that localizes as much 107 of network to client interchange as possible will help to minimize wide area network 108 bandwidth needs (and thus costs). 109 </p></li></ul></div><p> 110The inter-operation of a PDC and its BDCs in a true Windows NT4 environment is worth 111mentioning here. The PDC contains the master copy of the SAM. In the event that an 112administrator makes a change to the user account database while physically present 113on the local network that has the PDC, the change will likely be made directly to 114the PDC instance of the master copy of the SAM. In the event that this update may 115be performed in a branch office, the change will likely be stored in a delta file 116on the local BDC. The BDC will then send a trigger to the PDC to commence the process 117of SAM synchronization. The PDC will then request the delta from the BDC and apply 118it to the master SAM. The PDC will then contact all the BDCs in the Domain and 119trigger them to obtain the update and then apply that to their own copy of the SAM. 120</p><p> 121Samba-3 can not participate in true SAM replication and is therefore not able to 122employ precisely the same protocols used by MS Windows NT4. A Samba-3 BDC will 123not create SAM update delta files. It will not inter-operate with a PDC (NT4 or Samba) 124to synchronize the SAM from delta files that are held by BDCs. 125</p><p> 126Samba-3 cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 can not 127function correctly as a PDC to an MS Windows NT4 BDC. Both Samba-3 and MS Windows 128NT4 can function as a BDC to its own type of PDC. 129</p><p> 130The BDC is said to hold a <span class="emphasis"><em>read-only</em></span> of the SAM from which 131it is able to process network logon requests and authenticate users. The BDC can 132continue to provide this service, particularly while, for example, the wide area 133network link to the PDC is down. A BDC plays a very important role in both the 134maintenance of Domain Security as well as in network integrity. 135</p><p> 136In the event that the NT4 PDC should need to be taken out of service, or if it dies, 137one of the NT4 BDCs can be promoted to a PDC. If this happens while the original NT4 PDC is on 138line, it is automatically demoted to an NT4 BDC. This is an important aspect of Domain 139Controller management. The tool that is used to effect a promotion or a demotion is the 140Server Manager for Domains. It should be noted that Samba-3 BDCs can not be promoted 141in this manner because reconfiguration of Samba requires changes to the <tt class="filename">smb.conf</tt> file. 142</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2539469"></a>Example PDC Configuration</h4></div></div></div><p> 143Beginning with Version 2.2, Samba officially supports domain logons for all current Windows clients, 144including Windows NT4, 2003 and XP Professional. For Samba to be enabled as a PDC, some 145parameters in the <i class="parameter"><tt>[global]</tt></i>-section of the <tt class="filename">smb.conf</tt> have to be set. 146Refer to <a href="samba-bdc.html#minimalPDC" title="Example�5.1.�Minimal smb.conf for a PDC in Use With a BDC LDAP Server on PDC.">following configuration</a> for an example of the minimum required settings. 147</p><div class="example"><a name="minimalPDC"></a><p class="title"><b>Example�5.1.�Minimal smb.conf for a PDC in Use With a BDC LDAP Server on PDC.</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2539517"></a><i class="parameter"><tt> 148 149 workgroup = MIDEARTH</tt></i></td></tr><tr><td><a class="indexterm" name="id2539532"></a><i class="parameter"><tt> 150 151 passdb backend = ldapsam://localhost:389</tt></i></td></tr><tr><td><a class="indexterm" name="id2539549"></a><i class="parameter"><tt> 152 153 domain master = yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2539564"></a><i class="parameter"><tt> 154 155 domain logons = yes</tt></i></td></tr></table></div><p> 156Several other things like a <i class="parameter"><tt>[homes]</tt></i> and a 157<i class="parameter"><tt>[netlogon]</tt></i> share also need to be set along with 158settings for the profile path, the user's home drive, and so on. This is not covered in this 159chapter; for more information please refer to <a href="samba-pdc.html" title="Chapter�4.�Domain Control">Domain Control</a>. 160</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2539607"></a>LDAP Configuration Notes</h3></div></div></div><p> 161When configuring a master and a slave LDAP server, it is advisable to use the master LDAP server 162for the PDC and slave LDAP servers for the BDCs. It is not essential to use slave LDAP servers, however, 163many administrators will want to do so in order to provide redundant services. Of course, one or more BDCs 164may use any slave LDAP server. Then again, it is entirely possible to use a single LDAP server for the 165entire network. 166</p><p> 167When configuring a master LDAP server that will have slave LDAP servers, do not forget to configure 168this in the <tt class="filename">/etc/openldap/slapd.conf</tt> file. It must be noted that the DN of a 169server certificate must use the CN attribute to name the server, and the CN must carry the servers' 170fully qualified domain name. Additional alias names and wildcards may be present in the 171subjectAltName certificate extension. More details on server certificate names are in RFC2830. 172</p><p> 173It does not really fit within the scope of this document, but a working LDAP installation is 174basic to LDAP enabled Samba operation. When using an OpenLDAP server with Transport Layer Security 175(TLS), the machine name in <tt class="filename">/etc/ssl/certs/slapd.pem</tt> must be the 176same as in <tt class="filename">/etc/openldap/sldap.conf</tt>. The Red Hat Linux startup script 177creates the <tt class="filename">slapd.pem</tt> file with hostname “<span class="quote"><span class="emphasis"><em>localhost.localdomain.</em></span></span>” 178It is impossible to access this LDAP server from a slave LDAP server (i.e., a Samba BDC) unless the 179certificate is recreated with a correct hostname. 180</p><p> 181For preference, do not install a Samba PDC on a OpenLDAP slave server. Joining client machines to the domain 182will fail in this configuration because the change to the machine account in the LDAP tree 183must take place on the master LDAP server. This is not replicated rapidly enough to the slave 184server that the PDC queries. It therefore gives an error message on the client machine about 185not being able to set up account credentials. The machine account is created on the LDAP server 186but the password fields will be empty. Unfortunately, some sites are 187unable to avoid such configurations, and these sites should review the 188<a class="indexterm" name="id2539687"></a>ldap replication sleep parameter, intended to slow down Samba sufficiently 189for the replication to catch up. This is a kludge, and one that the 190administrator must manually duplicate in any scripts (such as the 191<a class="indexterm" name="id2539698"></a>add machine script) that 192they use. 193</p><p> 194Possible PDC/BDC plus LDAP configurations include: 195</p><div class="itemizedlist"><ul type="disc"><li><p> 196 PDC+BDC -> One Central LDAP Server. 197 </p></li><li><p> 198 PDC -> LDAP master server, BDC -> LDAP slave server. 199 </p></li><li><p> 200 PDC -> LDAP master, with secondary slave LDAP server. 201 </p><p> 202 BDC -> LDAP master, with secondary slave LDAP server. 203 </p></li><li><p> 204 PDC -> LDAP master, with secondary slave LDAP server. 205 </p><p> 206 BDC -> LDAP slave server, with secondary master LDAP server. 207 </p></li></ul></div><p> 208In order to have a fall-back configuration (secondary) LDAP server one would specify 209the secondary LDAP server in the <tt class="filename">smb.conf</tt> file as shown in <a href="samba-bdc.html#mulitldapcfg" title="Example�5.2.�Multiple LDAP Servers in smb.conf">following example</a>. 210</p><p> 211</p><div class="example"><a name="mulitldapcfg"></a><p class="title"><b>Example�5.2.�Multiple LDAP Servers in smb.conf</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td>...</td></tr><tr><td><a class="indexterm" name="id2539786"></a><i class="parameter"><tt> 212 213 passdb backend = </tt></i></td></tr><tr><td><i class="parameter"><tt>ldapsam:"ldap://master.quenya.org ldap://slave.quenya.org"</tt></i></td></tr><tr><td>...</td></tr></table></div><p> 214</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2539815"></a>Active Directory Domain Control</h3></div></div></div><p> 215As of the release of MS Windows 2000 and Active Directory, this information is now stored 216in a directory that can be replicated and for which partial or full administrative control 217can be delegated. Samba-3 is not able to be a Domain Controller within an Active Directory 218tree, and it cannot be an Active Directory server. This means that Samba-3 also cannot 219act as a Backup Domain Controller to an Active Directory Domain Controller. 220</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2539832"></a>What Qualifies a Domain Controller on the Network?</h3></div></div></div><p> 221Every machine that is a Domain Controller for the domain MIDEARTH has to register the NetBIOS 222group name MIDEARTH<#1c> with the WINS server and/or by broadcast on the local network. 223The PDC also registers the unique NetBIOS name MIDEARTH<#1b> with the WINS server. 224The name type <#1b> name is normally reserved for the Domain Master Browser, a role 225that has nothing to do with anything related to authentication, but the Microsoft Domain 226implementation requires the Domain Master Browser to be on the same machine as the PDC. 227</p><p> 228Where a WINS server is not used, broadcast name registrations alone must suffice. Refer to 229<a href="NetworkBrowsing.html#netdiscuss" title="Discussion">Network Browsing: Discussion</a> for more information regarding TCP/IP network protocols and how 230 SMB/CIFS names are handled. 231</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2539870"></a>How does a Workstation find its Domain Controller?</h3></div></div></div><p> 232There are two different mechanisms to locate a domain controller, one method is used when 233NetBIOS over TCP/IP is enabled and the other when it has been disabled in the TCP/IP 234network configuration. 235</p><p> 236Where NetBIOS over TCP/IP is disabled, all name resolution involves the use of DNS, broadcast 237messaging over UDP, as well as Active Directory communication technologies. In this type of 238environment all machines require appropriate DNS entries. More information may be found in 239<a href="NetworkBrowsing.html#adsdnstech" title="DNS and Active Directory">DNS and Active Directory</a>. 240</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2539899"></a>NetBIOS Over TCP/IP Enabled</h4></div></div></div><p> 241An MS Windows NT4/200x/XP Professional workstation in the domain MIDEARTH that wants a 242local user to be authenticated has to find the Domain Controller for MIDEARTH. It does this 243by doing a NetBIOS name query for the group name MIDEARTH<#1c>. It assumes that each 244of the machines it gets back from the queries is a Domain Controller and can answer logon 245requests. To not open security holes, both the workstation and the selected Domain Controller 246authenticate each other. After that the workstation sends the user's credentials (name and 247password) to the local Domain Controller for validation. 248</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2539937"></a>NetBIOS Over TCP/IP Disabled</h4></div></div></div><p> 249An MS Windows NT4/200x/XP Professional workstation in the realm <tt class="constant">quenya.org</tt> 250that has a need to affect user logon authentication will locate the Domain Controller by 251re-querying DNS servers for the <tt class="constant">_ldap._tcp.pdc._msdcs.quenya.org</tt> record. 252More information regarding this subject may be found in <a href="NetworkBrowsing.html#adsdnstech" title="DNS and Active Directory">DNS and Active Directory</a>. 253</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2539968"></a>Backup Domain Controller Configuration</h2></div></div></div><p> 254The creation of a BDC requires some steps to prepare the Samba server before 255<span class="application">smbd</span> is executed for the first time. These steps are outlines as follows: 256<a class="indexterm" name="id2539984"></a> 257</p><div class="itemizedlist"><ul type="disc"><li><p> 258 The domain SID has to be the same on the PDC and the BDC. In Samba versions 259 pre-2.2.5, the domain SID was stored in the file <tt class="filename">private/MACHINE.SID</tt>. 260 The domain SID is now stored in the file <tt class="filename">private/secrets.tdb</tt>. This file 261 is unique to each server and can not be copied from a PDC to a BDC, the BDC will generate 262 a new SID at start-up. It will over-write the PDC domain SID with the newly created BDC SID. 263 There is a procedure that will allow the BDC to aquire the Domain SID. This is described here. 264 </p><p> 265 To retrieve the domain SID from the PDC or an existing BDC and store it in the 266 <tt class="filename">secrets.tdb</tt>, execute: 267 </p><pre class="screen"> 268<tt class="prompt">root# </tt><b class="userinput"><tt>net rpc getsid</tt></b> 269</pre></li><li><p> 270 Specification of the <a class="indexterm" name="id2540050"></a>ldap admin dn is obligatory. 271 This also requires the LDAP administration password to be set in the <tt class="filename">secrets.tdb</tt> 272 using the <span><b class="command">smbpasswd -w <i class="replaceable"><tt>mysecret</tt></i></b></span>. 273 </p></li><li><p> 274 Either <a class="indexterm" name="id2540078"></a>ldap suffix or 275 <a class="indexterm" name="id2540085"></a>ldap idmap suffix must be specified in 276 the <tt class="filename">smb.conf</tt> file. 277 </p></li><li><p> 278<a class="indexterm" name="id2540103"></a> 279 The UNIX user database has to be synchronized from the PDC to the 280 BDC. This means that both the <tt class="filename">/etc/passwd</tt> and 281 <tt class="filename">/etc/group</tt> have to be replicated from the PDC 282 to the BDC. This can be done manually whenever changes are made. 283 Alternately, the PDC is set up as an NIS master server and the BDC as an NIS slave 284 server. To set up the BDC as a mere NIS client would not be enough, 285 as the BDC would not be able to access its user database in case of 286 a PDC failure. NIS is by no means the only method to synchronize 287 passwords. An LDAP solution would also work. 288 </p></li><li><p> 289 The Samba password database must be replicated from the PDC to the BDC. 290 Although it is possible to synchronize the <tt class="filename">smbpasswd</tt> 291 file with <span><b class="command">rsync</b></span> and <span><b class="command">ssh</b></span>, this method 292 is broken and flawed, and is therefore not recommended. A better solution 293 is to set up slave LDAP servers for each BDC and a master LDAP server for the PDC. 294 </p></li><li><p> 295 The netlogon share has to be replicated from the PDC to the 296 BDC. This can be done manually whenever login scripts are changed, 297 or it can be done automatically using a <span><b class="command">cron</b></span> job 298 that will replicate the directory structure in this share using a tool 299 like <span><b class="command">rsync</b></span>. 300 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2540184"></a>Example Configuration</h3></div></div></div><p> Finally, the BDC has to be found by the workstations. This can be 301done by setting Samba as shown in <a href="samba-bdc.html#minim-bdc" title="Example�5.3.�Minimal setup for being a BDC">the next example</a>. 302</p><div class="example"><a name="minim-bdc"></a><p class="title"><b>Example�5.3.�Minimal setup for being a BDC</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2540216"></a><i class="parameter"><tt> 303 304 workgroup = MIDEARTH</tt></i></td></tr><tr><td><a class="indexterm" name="id2540232"></a><i class="parameter"><tt> 305 306 passdb backend = ldapsam:ldap://slave-ldap.quenya.org</tt></i></td></tr><tr><td><a class="indexterm" name="id2540248"></a><i class="parameter"><tt> 307 308 domain master = no</tt></i></td></tr><tr><td><a class="indexterm" name="id2540263"></a><i class="parameter"><tt> 309 310 domain logons = yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2540279"></a><i class="parameter"><tt> 311 312 idmap backend = ldap:ldap://slave-ldap.quenya.org</tt></i></td></tr></table></div><p> 313In the <i class="parameter"><tt>[global]</tt></i>-section of the <tt class="filename">smb.conf</tt> of the BDC. This makes the BDC 314only register the name MIDEARTH<#1c> with the WINS server. This is no 315problem as the name MIDEARTH<#1c> is a NetBIOS group name that is meant to 316be registered by more than one machine. The parameter 317<a class="indexterm" name="id2540316"></a>domain master = no 318forces the BDC not to register MIDEARTH<#1b> which as a unique NetBIOS 319name is reserved for the Primary Domain Controller. 320</p><p> 321<a class="indexterm" name="id2540333"></a> 322<a class="indexterm" name="id2540340"></a> 323The <i class="parameter"><tt>idmap backend</tt></i> will redirect the <span><b class="command">winbindd</b></span> utility to 324use the LDAP database to resolve all UIDs and GIDs for UNIX accounts. 325</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 326<a class="indexterm" name="id2540364"></a> 327Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it 328allows greater flexibility in how user and group IDs are handled in respect to NT Domain User and Group 329SIDs. One of the new facilities provides for explicitly ensuring that UNIX/Linux UID and GID values 330will be consistent on the PDC, all BDCs and all Domain Member servers. The parameter that controls this 331is called <i class="parameter"><tt>idmap backend</tt></i>. Please refer to the man page for <tt class="filename">smb.conf</tt> for more information 332regarding its behavior. 333</p></div><p> 334The use of the <a class="indexterm" name="id2540398"></a>idmap backend = ldap:ldap://master.quenya.org 335option on a BDC only make sense where ldapsam is used on a PDC. The purpose for an LDAP based idmap backend is 336also to allow a domain-member (without its own passdb backend) to use winbindd to resolve Windows network users 337and groups to common UID/GIDs. In other words, this option is generally intended for use on BDCs and on Domain 338Member servers. 339</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2540414"></a>Common Errors</h2></div></div></div><p> 340As this is a rather new area for Samba, there are not many examples that we may refer to. 341Updates will be published as they become available and may be found in later Samba releases or 342from the Samba web <a href="http://samba.org" target="_top">site.</a> 343</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2540433"></a>Machine Accounts Keep Expiring</h3></div></div></div><p> 344<a class="indexterm" name="id2540441"></a> 345This problem will occur when the passdb (SAM) files are copied from a central 346server but the local Backup Domain Controller is acting as a PDC. This results in the application of 347Local Machine Trust Account password updates to the local SAM. Such updates 348are not copied back to the central server. The newer machine account password is then over 349written when the SAM is re-copied from the PDC. The result is that the Domain Member machine 350on start up will find that its passwords do not match the one now in the database and 351since the startup security check will now fail, this machine will not allow logon attempts 352to proceed and the account expiry error will be reported. 353</p><p> 354The solution is to use a more robust passdb backend, such as the ldapsam backend, setting up 355a slave LDAP server for each BDC, and a master LDAP server for the PDC. 356</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2540479"></a>Can Samba Be a Backup Domain Controller to an NT4 PDC?</h3></div></div></div><p> 357<a class="indexterm" name="id2540488"></a> 358No. The native NT4 SAM replication protocols have not yet been fully implemented. 359</p><p> 360Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC.The 361main reason for implementing a BDC is availability. If the PDC is a Samba 362machine, a second Samba machine can be set up to service logon requests whenever 363the PDC is down. 364</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2540508"></a>How Do I Replicate the smbpasswd File?</h3></div></div></div><p> 365<a class="indexterm" name="id2540516"></a> 366Replication of the smbpasswd file is sensitive. It has to be done whenever changes 367to the SAM are made. Every user's password change is done in the smbpasswd file and 368has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. 369</p><p> 370As the smbpasswd file contains plain text password equivalents, it must not be 371sent unencrypted over the wire. The best way to set up smbpasswd replication from 372the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. 373<span><b class="command">ssh</b></span> itself can be set up to accept <span class="emphasis"><em>only</em></span> 374<span><b class="command">rsync</b></span> transfer without requiring the user to type a password. 375</p><p> 376As said a few times before, use of this method is broken and flawed. Machine trust 377accounts will go out of sync, resulting in a broken domain. This method is 378<span class="emphasis"><em>not</em></span> recommended. Try using LDAP instead. 379</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2540565"></a>Can I Do This All with LDAP?</h3></div></div></div><p> 380The simple answer is yes. Samba's pdb_ldap code supports binding to a replica 381LDAP server, and will also follow referrals and re-bind to the master if it ever 382needs to make a modification to the database. (Normally BDCs are read only, so 383this will not occur often). 384</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="samba-pdc.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="type.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="domain-member.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�4.�Domain Control�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�6.�Domain Membership</td></tr></table></div></body></html> 385