Translations by Daniel LeBlanc

Backup Domain Controller

With a Primary Domain Controller (PDC) on the network it is best to have a Backup Domain Controller (BDC) as well. This will allow clients to authenticate in case the PDC becomes unavailable.

When configuring Samba as a BDC you need a way to sync account information with the PDC. There are multiple ways of accomplishing this <application>scp</application>, <application>rsync</application>, or by using <application>LDAP</application> as the <emphasis>passdb backend</emphasis>.

Using LDAP is the most robust way to sync account information, because both domain controllers can use the same information in real time. However, setting up a LDAP server may be overly complicated for a small number of user and computer accounts. See <xref linkend="samba-ldap"/> for details.

First, install <application>samba</application> and <application>libpam-smbpass</application>. From a terminal enter:

Now, edit <filename>/etc/samba/smb.conf</filename> and uncomment the following in the <emphasis>[global]</emphasis>:

In the commented <emphasis>Domains</emphasis> uncomment or add:

domain logons = yes domain master = no

Make sure a user has rights to read the files in <filename>/var/lib/samba</filename>. For example, to allow users in the <emphasis>admin</emphasis> group to <application>scp</application> the files, enter:

sudo chgrp -R admin /var/lib/samba

Next, sync the user accounts, using <application>scp</application> to copy the <filename>/var/lib/samba</filename> directory from the PDC:

sudo scp -r username@pdc:/var/lib/samba /var/lib

Replace <emphasis>username</emphasis> with a valid username and <emphasis>pdc</emphasis> with the hostname or IP Address of your actual PDC.

Finally, restart <application>samba</application>:

You can test that your Backup Domain controller is working by stopping the Samba daemon on the PDC, then trying to login to a Windows client joined to the domain.

Another thing to keep in mind is if you have configured the <emphasis>logon home</emphasis> option as a directory on the PDC, and the PDC becomes unavailable, access to the user's <emphasis>Home</emphasis> drive will also be unavailable. For this reason it is best to configure the <emphasis>logon home</emphasis> to reside on a separate file server from the PDC and BDC.

<ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/samba-pdc.html">Chapter 4</ulink> of the Samba HOWTO Collection explains setting up a Primary Domain Controller.

<ulink url="http://us3.samba.org/samba/docs/man/Samba-HOWTO-Collection/samba-bdc.html">Chapter 5</ulink> of the Samba HOWTO Collection explains setting up a Backup Domain Controller.

Samba Active Directory Integration

Accessing a Samba Share

Another, use for Samba is to integrate into an existing Windows network. Once part of an Active Directory domain, Samba can provide file and print services to AD users.

The simplest way to join an AD domain is to use <application>Likewise-open</application>. For detailed instructions see <xref linkend="likewise-open"/>.

sudo apt-get install samba smbfs smbclient

Since the <application>likewise-open</application> and <application>samba</application> packages use separate <filename>secrets.tdb</filename> files, a symlink will need to be created in <filename role="directory">/var/lib/samba</filename>:

sudo mv /var/lib/samba/secrets.tdb /var/lib/samba/secrets.tdb.orig

sudo ln -s /etc/samba/secrets.tdb /var/lib/samba

Next, edit <filename>/etc/samba/smb.conf</filename> changing:

workgroup = EXAMPLE ... security = ads realm = EXAMPLE.COM ... idmap backend = lwopen idmap uid = 50-9999999999 idmap gid = 50-9999999999

Restart <application>samba</application> for the new settings to take effect:

You should now be able to access any <application>Samba</application> shares from a Windows client. However, be sure to give the appropriate AD users or groups access to the share directory. See <xref linkend="samba-fileprint-security"/> for more details.

Accessing a Windows Share

Now that the Samba server is part of the Active Directory domain you can access any Windows server shares:

To mount a Windows file share enter the following in a terminal prompt:

mount.cifs //fs01.example.com/share mount_point

It is also possible to access shares on computers not part of an AD domain, but a username and password will need to be provided.

To mount the share during boot place an entry in <filename>/etc/fstab</filename>, for example:

//192.168.0.5/share /mnt/windows cifs auto,username=steve,password=secret,rw 0 0

Another way to copy files from a Windows server is to use the <application>smbclient</application> utility. To list the files in a Windows share:

smbclient //fs01.example.com/share -k -c "ls"

To copy a file from the share, enter:

smbclient //fs01.example.com/share -k -c "get file.txt"

This will copy the <filename>file.txt</filename> into the current directory.

And to copy a file to the share:

smbclient //fs01.example.com/share -k -c "put /etc/hosts hosts"

The <emphasis>-c</emphasis> option used above allows you to execute the <application>smbclient</application> command all at once. This is useful for scripting and minor file operations. To enter the <emphasis>smb: \&gt;</emphasis> prompt, a FTP like prompt where you can execute normal file and directory commands, simply execute:

smbclient //fs01.example.com/share -k

Replace all instances of <emphasis>fs01.example.com/share</emphasis>, <emphasis>//192.168.0.5/share</emphasis>, <emphasis>username=steve,password=secret</emphasis>, and <emphasis>file.txt</emphasis> with your server's IP, hostname, share name, file name, and an actual username and password with rights to the share.

Likewise Open

<application>Likewise Open</application> simplifies the necessary configuration needed to authenticate a Linux machine to an Active Directory domain. Based on <application>winbind</application>, the <application>likewise-open</application> package takes the pain out of integrating Ubuntu authentication into an existing Windows network.

There are two ways to use Likewise Open, <application>likewise-open</application> the command line utility and <application>likewise-open-gui</application>. This section focuses on the command line utility.