SAMBA3 e LDAP

Felipe Augusto van de Wiel (faw)

Brasil, São Paulo, 06 de novembro de 2004.

Base sólida para

redes heterogêneas.

Quem sou eu?

Projeto Debian-BR

Projeto Debian-PR

PHP Community

Voluntário

Certificado

Conectiva (2x)

LPIC1

Contato com GNU/Linux em 1998

Contato com Debian em 2002

Admin. Redes e Sistemas

Instrutor Rede Conectiva de Treinamentos

“No mundo”

Quem sou eu?

Administro Servidor Debian-PR

Moderador da lista debian-pr

Líder GUD-PR

“No mundo Debian”

Voluntário PSL-PR / MSL-PR / CGNU

Traduções e documentações

Nossos Objetivos

SAMBA

- História & Conceitos

- Samba 2.2 / 3.0 / 3.2 / 4.0 / HEAD

LDAP

- DAP, X.500 e AD

- LDAP e OpenLDAP

SAMBA3 e LDAP

- Integração

- Vantagens e Desvantagens

SAMBA

Opening Windows to a Wider World

Serviços de impressão e arquivos

para clientes SMB/CIFS

Interoperabilidade entre

Linux/Unix e Windows

Desde 1992!!!

Andrew Tridgell (rsync)

SAMBA

CIFS/SMB

SAMBA

SMB

CIFS

Common Internet File System (MS)

Server Message Block

NetBIOS - Network Input Output System

NetBEUI - NetBIOS Enhanced User Interface

Pontos Chave

SAMBA

(A) Compartilhamento de arquivos e impressoras

smbd & nmbd

(B) Autenticação e Autorização

(C) Resolução de Nomes

(D) Anúncio (browsing)

SMB Daemon -> A; B(share/user)

NMB Daemon -> C; D

Festival de nomes

SAMBA

Domínio NT

Local Master Browser (LMB)

Domain Master Browser (DMB)

NetBIOS Name Service (NBNS)

Windows Internet Name Service (WINS)

Primary Domain Controller (PDC)

Backup Domain Controller (BDC)

Active Directory (AD)

Visão Geral

SAMBA

Versões

SAMBA

2.2 obsoleto

3.0 atual

3.2 (final de 2004)

4.0 (...)

Implementação completa CIFS

Reorganização de código

Componentes

SAMBA

Repositório de senhas

SMBD & NMBD

smb.conf

LOGs

Recursos e Benefícios

SAMBA

Samba3 pode substituir um NT4 (DC)

Interoperabilidade Dominios NT4 e AD

Confiança entre domínios NT4

Múltiplos backends de contas

Senhas podem ser replicadas e/ou distribuídas

Tipos de Servidor

SAMBA

Domain Controller

PDC

BDC

ADS DC

Domain Member

AD DS

NT4-style DS

Stand Alone

Modos de Segurança

SAMBA

Share

User

Domain

ADS

Server

Verificação de Senhas

SAMBA

Senhas criptografas (challenge/response)

NTLMv1 NTLMv2

Senhas texto puro

MD4 (unicode) - NT hash

upper(senha) - 14 bytes

5 bytes NULL

Dividido em 2 chaves DES de 56bits

''magic'' 8 bytes

16 bytes -> LanMan hash

Domínio

SAMBA

LDAP

LDAP

Lightweight Directory Access Protocol (LDAP)

Alternativa ao X.500 DAP

OpenSource

Universidade de Michigan

RFC 3377: LDAP (v3): Technical Specification

RFC 2251: LDAP (v3)

RFC 2252: LDAPv3: Attribute Syntax Definitions

RFC 2253: LDAPv3: UTF-8 String Representation of DN

RFC 2254: The String Repres. of LDAP Search Filters

RFC 2255: The LDAP URL Format

RFC 2256: A Summary of the X.500(96) User Schema...

RFC 2829: Authentication Methods for LDAP

RFC 2830: LDAPv3: Extension for TLS

RFC 3771: LDAP: Intermediate Response Message

LDAP

LDAP

LDAP version 2 (LDAPv2) é histórica (RFC 3494).

Objetivo

LDAP

Busca e navegação de informações

SAMBA

MTA

DNS

PAM

APACHE

Catálogo de Endereços

“phonebook”

Árvore LDAP

LDAP

Directory

Information

Tree

Árvore LDAP (dc)

LDAP

phpLDAPadmin

LDAP

GNU/GPL

Home / Commercial ($ 49.95)

Livre

Agilidade

Tempo vs. Custo

Master LDAP Server

Slave LDAP Server

The optimal solution that provides high integrity. The SAM will be replicated to a common master LDAP server.

Single Central LDAP Server

Single Central LDAP Server

A workable solution without fail-over ability. This is a usable solution, but not optimal.

tdbsam

tdbsam + net rpc vampire

Does not work with Samba-3.0.0; may be implemented in a later release. The downside of this solution is that an external process will control account database integrity. This solution may appeal to sites that wish to avoid the complexity of LDAP. The net rpc vampire is used to synchronize domain accounts from the PDC to the BDC.

tdbsam

tdbsam + rsync

Do not use this configuration. Does not work because the TDB files are live and data may not have been flushed to disk. Use rsync to synchronize the TDB database files from the PDC to the BDC.

smbpasswd file

smbpasswd file

Do not use this configuration. Not an elegant solution due to the delays in synchronization. Use rsync to synchronize the smbpasswd file from the PDC to the BDC. Can be made to work using a cron job to synchronize data from the PDC to the BDC.

SAMBA + LDAP

SMB/LDAP

IDEALX (http://www.idealx.{com,org}

smbldaptools

samba-console

SAMBA + LDAP

SMB/LDAP

PDC

BDC

Master LDAP

Slave LDAP

Central LDAP

Central LDAP

tdbsam

tdbsam

rsync

tdbsam

tdbsam

rpc net vampire

smbpasswd

smbpasswd

SAMBA	http://www.samba.org

OpenLDAP	http://www.openldap.org

Agradecimentos

Projeto Debian-PR e Debian-BR

Grupo de Usuários Debian-PR e Debian-BR

SEDU/PARANACIDADE

Conisli

Felipe Augusto van de Wiel

felipe@cathedrallabs.org

felipe.wiel@gmail.com

Obrigado! :o)

SAMBA

Andrew Tridgell (rsync)

NetBIOS – Network Basic Input/Output System

Server Message Block (SMB)

Common Internet File System (CIFS)

TCP / UDP

NetBEUI – NetBIOS Enhanced User Interface

2004-08-19T00:25:56