samba - May 1999 - NT/UNIX/Samba passwords synchronization

I have a prerelease version of Samba 2.0.4 running successfully on MacOSX
Server with encrypted passwords and domain security. (Thanks to help from
Bill Chin and others on the list, and Jeremy Allison and rest of the samba
team) I have just started work on testing Samba as a NT domain member, and
want to know if I have the right ideas from my reading of the docs:

With security = domain, the Samba server redirects all authentication to the
domain members, right? Is there any way to go without the smbpasswd file (I
guess it's necessary to link the local UNIX password permissions with the
requesting NT user, right?) or to have this automatically synched? I
remember reading about a config that has new users created as they log in.
Is this only for unencrypted users logging in for the first time with
encryption off?  It seemed like there was also another option, but now that
I think about it, it doesn't make sense that there would be. Any ideas on
solutions that would allow for easy synchronizing or at least setup for (a)
moving NT accounts to my UNIX Samba host, (b) replicating my passwds into
smbpasswds, (c) and updating the smbpasswd file as users log in without
turning off encryption? 

I have some Solaris boxes, a new MacOSX Server, and a medium-sized NT
domain. I would like to simplify authentication as much as possible, Does it
make sense to look at NIS as a security model for my UNIX systems as a group
(right now they are all separately authenticating systems) and try to tie in
that system with NT's domain (I really have no experience with NIS), 

Thanks for any experiences you can share,



Tony Drolson
Information Systems Director
UCSF Positive Health Program at SFGH-MC
995 Potrero Ave, Ward 84	fax	(415) 476-6953	
San Francisco, CA 94110	phone	(415) 476-4082 ext. 123

Tony,

You may want to take a look at http://www.syntunix.com.  They make a
product called Passync (formerly SyNTUnix) which will synchronize NT and
Unix passwords in both directions, even using NIS.  We have a number of
Solaris machines in a NIS domain and several NT boxes as well and syntunix
has been terrific.  It allows us to changes passwords however we like
whether it be passwd, any user manager sort of tool, whatever, and it
synchronises itself between our PDC and our NIS master.  The passwords are
sent encrypted from server to server, it hasn't corrupted our password
tables and it's simple for the users who, to some extent, believe they
have one password.  Additionally, in our environment, we can use the PDC 
for authentication and don't need a samba password file.  

If you'd like details visit their website. Likewise feel free to contact
me if you'd like to know more about my experience with this product or how
we've configured it and samba for our users.

Good Luck,

Nate Partenheimer
Information Resources
Butler University
npartenh@butler.edu