samba - Mar 2004 - Multiple DB / fragmented information

Hi,

I wonder if it's possible to have multiple backend in order to fragment SAM
information. For example, i'd like to have a central LDAP directory for user
authentication purpose but a local tdb format for Machines accounts.

I want to minimize network traffic but still keep a central user account DB.

Has anybody tried this kind of config ?

On Mon, 2004-03-01 at 23:01, Lapin(c) wrote:
> Hi,
> 
> I wonder if it's possible to have multiple backend in order to fragment
SAM
> information. For example, i'd like to have a central LDAP directory for
user
> authentication purpose but a local tdb format for Machines accounts.
> 
> I want to minimize network traffic but still keep a central user account
DB.
> 
> Has anybody tried this kind of config ?
This is a really bad idea.  The network traffic (LDAP lookups) for
machine accounts really are minimal.  If you want to reduce network read
traffic, you might set up a local LDAP slave.

Get your system working, before you try to create a more complex system.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet@pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet@samba.org
Student Network Administrator, Hawker College   abartlet@hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :
http://lists.samba.org/archive/samba/attachments/20040301/5ec4fa61/attachment.bin

On Mon, 1 Mar 2004, Lapin(c) wrote:
>
>
> Hi,
>
> I wonder if it's possible to have multiple backend in order to fragment
SAM
> information. For example, i'd like to have a central LDAP directory for
user
> authentication purpose but a local tdb format for Machines accounts.
>
> I want to minimize network traffic but still keep a central user account
DB.
>
> Has anybody tried this kind of config ?
Yes. It can be done, but this will not scale for use with PDC/BDC
environments. Machine accounts change security password at regular
intervals. Machine account passwords must be identical on all PDC/BDC
machines. You will need to figure out a way to ensure that this happens -
somethings that can be done with LDAP but not with tdbsam backends.

- John T.
-- 
John H Terpstra
Email: jht@samba.org