| [274] | 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. Domain Control</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="prev" href="ServerType.html" title="Chapter 3. Server Types and Security Modes"><link rel="next" href="samba-bdc.html" title="Chapter 5. Backup Domain Control"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. Domain Control</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ServerType.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="samba-bdc.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="samba-pdc"></a>Chapter 4. Domain Control</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="orgname">Samba Team</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">David</span> <span class="orgname">Samba Team</span> <span class="surname">Bannon</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="orgname">SuSE</span> <span class="surname">Deschner</span></h3><span class="contrib">LDAP updates</span> <div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="samba-pdc.html#id2561262">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="samba-pdc.html#id2561896">Single Sign-On and Domain Security</a></span></dt><dt><span class="sect1"><a href="samba-pdc.html#id2562485">Basics of Domain Control</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-pdc.html#id2562505">Domain Controller Types</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id2563009">Preparing for Domain Control</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-pdc.html#id2563520">Domain Control: Example Configuration</a></span></dt><dt><span class="sect1"><a href="samba-pdc.html#id2564263">Samba ADS Domain Control</a></span></dt><dt><span class="sect1"><a href="samba-pdc.html#id2564316">Domain and Network Logon Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-pdc.html#id2564335">Domain Network Logon Service</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id2564926">Security Mode and Master Browsers</a></span></dt></dl></dd><dt><span class="sect1"><a href="samba-pdc.html#id2565206">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="samba-pdc.html#id2565212">$ Cannot Be Included in Machine Name</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id2565312">Joining Domain Fails Because of Existing Machine Account</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id2565377">The System Cannot Log You On (C000019B)</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id2565454">The Machine Trust Account Is Not Accessible</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id2565573">Account Disabled</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id2565600">Domain Controller Unavailable</a></span></dt><dt><span class="sect2"><a href="samba-pdc.html#id2565619">Cannot Log onto Domain Member Workstation After Joining Domain</a></span></dt></dl></dd></dl></div><p>
|
|---|
| 2 | There are many who approach MS Windows networking with incredible misconceptions.
|
|---|
| 3 | That's okay, because it gives the rest of us plenty of opportunity to be of assistance.
|
|---|
| 4 | Those who really want help are well advised to become familiar with information
|
|---|
| 5 | that is already available.
|
|---|
| 6 | </p><p>
|
|---|
| 7 | <a class="indexterm" name="id2561124"></a>
|
|---|
| 8 | You are advised not to tackle this section without having first understood
|
|---|
| 9 | and mastered some basics. MS Windows networking is not particularly forgiving of
|
|---|
| 10 | misconfiguration. Users of MS Windows networking are likely to complain
|
|---|
| 11 | of persistent niggles that may be caused by a broken network configuration.
|
|---|
| 12 | To a great many people, however, MS Windows networking starts with a domain controller
|
|---|
| 13 | that in some magical way is expected to solve all network operational ills.
|
|---|
| 14 | </p><p>
|
|---|
| 15 | <a class="link" href="samba-pdc.html#domain-example" title="Figure 4.1. An Example Domain.">The Example Domain Illustration</a> shows a typical MS Windows domain security
|
|---|
| 16 | network environment. Workstations A, B, and C are representative of many physical MS Windows
|
|---|
| 17 | network clients.
|
|---|
| 18 | </p><div class="figure"><a name="domain-example"></a><p class="title"><b>Figure 4.1. An Example Domain.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/domain.png" width="216" alt="An Example Domain."></div></div></div><br class="figure-break"><p>
|
|---|
| 19 | From the Samba mailing list we can readily identify many common networking issues.
|
|---|
| 20 | If you are not clear on the following subjects, then it will do much good to read the
|
|---|
| 21 | sections of this HOWTO that deal with it. These are the most common causes of MS Windows
|
|---|
| 22 | networking problems:
|
|---|
| 23 | </p><div class="itemizedlist"><ul type="disc"><li><p>Basic TCP/IP configuration.</p></li><li><p>NetBIOS name resolution.</p></li><li><p>Authentication configuration.</p></li><li><p>User and group configuration.</p></li><li><p>Basic file and directory permission control in UNIX/Linux.</p></li><li><p>Understanding how MS Windows clients interoperate in a network environment.</p></li></ul></div><p>
|
|---|
| 24 | Do not be put off; on the surface of it MS Windows networking seems so simple that anyone
|
|---|
| 25 | can do it. In fact, it is not a good idea to set up an MS Windows network with
|
|---|
| 26 | inadequate training and preparation. But let's get our first indelible principle out of the
|
|---|
| 27 | way: <span class="emphasis"><em>It is perfectly okay to make mistakes!</em></span> In the right place and at
|
|---|
| 28 | the right time, mistakes are the essence of learning. It is very much not okay to make
|
|---|
| 29 | mistakes that cause loss of productivity and impose an avoidable financial burden on an
|
|---|
| 30 | organization.
|
|---|
| 31 | </p><p>
|
|---|
| 32 | Where is the right place to make mistakes? Only out of harms way. If you are going to
|
|---|
| 33 | make mistakes, then please do it on a test network, away from users, and in such a way as
|
|---|
| 34 | to not inflict pain on others. Do your learning on a test network.
|
|---|
| 35 | </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2561262"></a>Features and Benefits</h2></div></div></div><p>
|
|---|
| 36 | <a class="indexterm" name="id2561270"></a>
|
|---|
| 37 | <span class="emphasis"><em>What is the key benefit of Microsoft Domain Security?</em></span>
|
|---|
| 38 | </p><p>
|
|---|
| 39 | <a class="indexterm" name="id2561284"></a>
|
|---|
| 40 | <a class="indexterm" name="id2561294"></a>
|
|---|
| 41 | <a class="indexterm" name="id2561300"></a>
|
|---|
| 42 | <a class="indexterm" name="id2561307"></a>
|
|---|
| 43 | In a word, <span class="emphasis"><em>single sign-on</em></span>, or SSO for short. To many, this is the Holy Grail of MS
|
|---|
| 44 | Windows NT and beyond networking. SSO allows users in a well-designed network to log onto any workstation that
|
|---|
| 45 | is a member of the domain that contains their user account (or in a domain that has an appropriate trust
|
|---|
| 46 | relationship with the domain they are visiting) and they will be able to log onto the network and access
|
|---|
| 47 | resources (shares, files, and printers) as if they are sitting at their home (personal) workstation. This is a
|
|---|
| 48 | feature of the domain security protocols.
|
|---|
| 49 | </p><p>
|
|---|
| 50 | <a class="indexterm" name="id2561335"></a>
|
|---|
| 51 | <a class="indexterm" name="id2561342"></a>
|
|---|
| 52 | <a class="indexterm" name="id2561349"></a>
|
|---|
| 53 | <a class="indexterm" name="id2561358"></a>
|
|---|
| 54 | <a class="indexterm" name="id2561367"></a>
|
|---|
| 55 | The benefits of domain security are available to those sites that deploy a Samba PDC. A domain provides a
|
|---|
| 56 | unique network security identifier (SID). Domain user and group security identifiers are comprised of the
|
|---|
| 57 | network SID plus a relative identifier (RID) that is unique to the account. User and group SIDs (the network
|
|---|
| 58 | SID plus the RID) can be used to create access control lists (ACLs) attached to network resources to provide
|
|---|
| 59 | organizational access control. UNIX systems recognize only local security identifiers.
|
|---|
| 60 | </p><p>
|
|---|
| 61 | <a class="indexterm" name="id2561386"></a>
|
|---|
| 62 | A SID represents a security context. For example, every Windows machine has local accounts within the security
|
|---|
| 63 | context of the local machine which has a unique SID. Every domain (NT4, ADS, Samba) contains accounts that
|
|---|
| 64 | exist within the domain security context which is defined by the domain SID.
|
|---|
| 65 | </p><p>
|
|---|
| 66 | <a class="indexterm" name="id2561401"></a>
|
|---|
| 67 | <a class="indexterm" name="id2561407"></a>
|
|---|
| 68 | A domain member server will have a SID that differs from the domain SID. The domain member server can be
|
|---|
| 69 | configured to regard all domain users as local users. It can also be configured to recognize domain users and
|
|---|
| 70 | groups as non-local. SIDs are persistent. A typical domain of user SID looks like this:
|
|---|
| 71 | </p><pre class="screen">
|
|---|
| 72 | S-1-5-21-726309263-4128913605-1168186429
|
|---|
| 73 | </pre><p>
|
|---|
| 74 | Every account (user, group, machine, trust, etc.) is assigned a RID. This is done automatically as an account
|
|---|
| 75 | is created. Samba produces the RID algorithmically. The UNIX operating system uses a separate name space for
|
|---|
| 76 | user and group identifiers (the UID and GID) but Windows allocates the RID from a single name space. A Windows
|
|---|
| 77 | user and a Windows group can not have the same RID. Just as the UNIX user <code class="literal">root</code> has the
|
|---|
| 78 | UID=0, the Windows Administrator has the well-known RID=500. The RID is catenated to the Windows domain SID,
|
|---|
| 79 | so Administrator account for a domain that has the above SID will have the user SID
|
|---|
| 80 | </p><pre class="screen">
|
|---|
| 81 | S-1-5-21-726309263-4128913605-1168186429-500
|
|---|
| 82 | </pre><p>
|
|---|
| 83 | The result is that every account in the Windows networking world has a globally unique security identifier.
|
|---|
| 84 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 85 | <a class="indexterm" name="id2561454"></a>
|
|---|
| 86 | <a class="indexterm" name="id2561464"></a>
|
|---|
| 87 | <a class="indexterm" name="id2561470"></a>
|
|---|
| 88 | Network clients of an MS Windows domain security environment must be domain members to be able to gain access
|
|---|
| 89 | to the advanced features provided. Domain membership involves more than just setting the workgroup name to the
|
|---|
| 90 | domain name. It requires the creation of a domain trust account for the workstation (called a machine
|
|---|
| 91 | account). Refer to <a class="link" href="domain-member.html" title="Chapter 6. Domain Membership">Domain Membership</a> for more information.
|
|---|
| 92 | </p></div><p>
|
|---|
| 93 | The following functionalities are new to the Samba-3 release:
|
|---|
| 94 | </p><div class="itemizedlist"><ul type="disc"><li><p>
|
|---|
| 95 | <a class="indexterm" name="id2561504"></a>
|
|---|
| 96 | Samba-3 supports the use of a choice of backends that may be used in which user, group and machine
|
|---|
| 97 | accounts may be stored. Multiple passwd backends can be used in combination, either as additive backend
|
|---|
| 98 | data sets, or as fail-over data sets.
|
|---|
| 99 | </p><p>
|
|---|
| 100 | <a class="indexterm" name="id2561521"></a>
|
|---|
| 101 | <a class="indexterm" name="id2561528"></a>
|
|---|
| 102 | <a class="indexterm" name="id2561534"></a>
|
|---|
| 103 | <a class="indexterm" name="id2561541"></a>
|
|---|
| 104 | <a class="indexterm" name="id2561548"></a>
|
|---|
| 105 | An LDAP passdb backend confers the benefit that the account backend can be distributed and replicated,
|
|---|
| 106 | which is of great value because it confers scalability and provides a high degree of reliability.
|
|---|
| 107 | </p></li><li><p>
|
|---|
| 108 | <a class="indexterm" name="id2561563"></a>
|
|---|
| |
|---|
