Red Hat Training
A Red Hat training course is available for Red Hat Enterprise Linux
22.8. Samba Account Information Databases
The latest release of Samba offers many new features including new password database backends not previously available. Samba version 3.0.0 fully supports all databases used in previous versions of Samba. However, although supported, many backends may not be suitable for production use.
The following is a list different backends you can use with Samba. Other backends not listed here may also be available.
- Plain Text
- Plain text backends are nothing more than the
/etc/passwdtype backends. With a plain text backend, all usernames and passwords are sent unencrypted between the client and the Samba server. This method is very unsecure and is not recommended for use by any means. It is possible that different Windows clients connecting to the Samba server with plain text passwords cannot support such an authentication method.
- A popular backend used in previous Samba packages, the
smbpasswdbackend utilizes a plain ASCII text layout that includes the MS Windows LanMan and NT account, and encrypted password information. The
smbpasswdbackend lacks the storage of the Windows NT/2000/2003 SAM extended controls. The
smbpasswdbackend is not recommended because it does not scale well or hold any Windows information, such as RIDs for NT-based groups. The
tdbsambackend solves these issues for use in a smaller database (250 users), but is still not an enterprise-class solution.
ldapsam_compatbackend allows continued OpenLDAP support for use with upgraded versions of Samba. This option normally used when migrating to Samba 3.0.
tdbsambackend provides an ideal database backend for local servers, servers that do not need built-in database replication, and servers that do not require the scalability or complexity of LDAP. The
tdbsambackend includes all of the
smbpasswddatabase information as well as the previously-excluded SAM information. The inclusion of the extended SAM data allows Samba to implement the same account and system access controls as seen with Windows NT/2000/2003-based systems.The
tdbsambackend is recommended for 250 users at most. Larger organizations should require Active Directory or LDAP integration due to scalability and possible network infrastructure concerns.
ldapsambackend provides an optimal distributed account installation method for Samba. LDAP is optimal because of its ability to replicate its database to any number of servers using the OpenLDAP
slurpddaemon. LDAP databases are light-weight and scalable, and as such are preferred by large enterprises.If you are upgrading from a previous version of Samba to 3.0, note that the
/usr/share/doc/samba-<version>/LDAP/samba.schemahas changed. This file contains the attribute syntax definitions and objectclass definitions that the
ldapsambackend will need in order to function properly.As such, if you are using the
ldapsambackend for your Samba server, you will need to configure
slapdto include this schema file. Refer to Section 28.5, “The
/etc/openldap/schema/Directory” for directions on how to do this.
NoteYou will need to have the
openldap-serverpackage installed if you want to use the
mysqlsambackend uses a MySQL-based database backend. This is useful for sites that already implement MySQL. At present,
mysqlsamis now packed in a module separate from Samba, and as such is not officially supported by Samba.