samba - Nov 2003 - FreeBSD and Samba Windbind questions

Hello,

I am getting ready to migrate from a Novell Server and wanted to use Samba as a
PDC. I am planning on using FreeBSD, Samba 3 and LDAP.  The problem I encounter
is that one of our business applications is only supported on Novell or Windows.
What I was hoping to do was configure a Samba PDC and have a W2K server that
houses that application join the Samba Domain.  Then when I access the
application on the W2K server it will authenticate to the Samba PDC.  I have
already configured a FreeBSD 4.8 and Samba 2.2.8a with LDAP before, but never
integrated any W2K servers before.  As you can see I am a litte confused on how
Winbind plays a role.  I have read the HowTos and the man pages, but still have
the following questions.

1.Will I need to configure Winbind?  I understand that windbind provides the
group mapping betweeen Windows and Unix.  Or is Windbind only necessary when
your PDC is a true blue Microsoft PDC?

2.Will I need users accounts on the W2K server, I expect no, because it should
authenticate through the PDC.

3.How do I specify group permissions on the W2K server shares?  Will Winbind
take care of this? Will standard unix groups work.?  Should I host a DFS share
through Samba to control directory access?

4.If I need Winbind should I store the group information in LDAP?

5.What is the differnce between ?with winbind and ?with winbind-auth-challenge?

Thanks to all the Samba Developers for a fine product.

John Robertson


__________________________________________________________________
McAfee VirusScan Online from the Netscape Network.
Comprehensive protection for your entire computer. Get your free trial today!
http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397

Get AOL Instant Messenger 5.1 free of charge.  Download Now!
http://aim.aol.com/aimnew/Aim/register.adp?promo=380455

On Wed, 2003-11-12 at 03:50, flatfendercj2a@netscape.net wrote:
> 5.What is the differnce between ?with winbind and 
>    ?with winbind-auth-challenge?
This is only an option in Samba 2.2, not 3.0, and controlled exposure of
an interface to winbind that could be argued as a security hole - if you
squinted right.  That is, it was something we didn't want to enable on
all systems - just on systems that needed it for squid interoperability.

In Samba 3.0, we fixed it by implementing an ACL mechanism, so we didn't
need to make it a compile-time on-or-off.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet@pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet@samba.org
Student Network Administrator, Hawker College   abartlet@hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :
http://lists.samba.org/archive/samba/attachments/20031112/6a9df57a/attachment.bin

Thank You, It appears the Port maintained hasn't updated the Makefile

What about --with-utemp?
>>> Andrew Bartlett <abartlet@samba.org> 11/11/03 07:06PM
>>>
On Wed, 2003-11-12 at 03:50, flatfendercj2a@netscape.net wrote:
> 5.What is the differnce between *with winbind and 
>    *with winbind-auth-challenge?
This is only an option in Samba 2.2, not 3.0, and controlled exposure of
an interface to winbind that could be argued as a security hole - if you
squinted right.  That is, it was something we didn't want to enable on
all systems - just on systems that needed it for squid interoperability.

In Samba 3.0, we fixed it by implementing an ACL mechanism, so we didn't
need to make it a compile-time on-or-off.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet@pcug.org.au 
Manager, Authentication Subsystems, Samba Team  abartlet@samba.org 
Student Network Administrator, Hawker College   abartlet@hawkerc.net 
http://samba.org     http://build.samba.org     http://hawkerc.net