Dear list,
I have a question about automatic ADS server fallback of a Samba domain member
in a W2k3 environment.
I describe now a little our real production ADS environment;
Madrid: 2 W2k3 ADS servers (ADM01 and ADM02) in a cluster; both are a global
catalog server in the XXXX.COM realm.
Berlin; 1 W2k3 ADS server (ADM03); is also a global catalog server in the
XXXX.COM realm.
The ADS servers in Madrid and Berlin are replicated.
D?sseldorf; RHL9 server with Samba 3.0.4 (compiled with MIT 1.3.1-7 and CUPS)
as a domain member of the XXXX.COM realm. Winbind and Kerberos are used as
authentication method against ADS.
Connections between the various sites: Intranet, 128 Kb/s
The RHL9 server in D?sseldorf is joined to the domain and is working properly.
XP
clients in D?sseldorf logon to the ADS domain and via the login script they?ll
get their
shares on the local Samba server and this works fine.
Normally the Samba server is communicating with the ADM03 server in Berlin (The
1st DNS server is the ADM03 server; ADS is configured that clients and domain
members in the subnet of D?sseldorf first contact the ADS server in Berlin).
Question:
How can I configure Samba 3.0.4 that an automatic ADS server fallback is
executed
if the connection with the ADS server in Berlin fails?
In other words; when communication with the ADM03 server fails, Samba must
automatically contact the ADM01 or ADM03 server in Madrid for its ADS queries.
I already used the entry ? password server = adm03.XXXX.com, adm02.XXXX.com,
* ? in my smb.conf file.
My krb5.conf file doesn?t exist, because MIT 1.3.1 searches its KDC servers via
DNS, or must I specify for Kerberos also a fallback?
The winbind cache time is default (300 sec). Must I specify a larger value (e.g.
900
sec.) on remote sites with a relative slow connection?
Thanx for any suggestion,
Alex.
Here is my smb.conf file (only the global section):
# Global parameters
[global]
workgroup = XXXX
realm = XXXX.COM
server string = %h server (Samba %v)
security = ADS
password server = adm03.XXXX.com, adm01.XXXX.com, *
passwd program = /usr/bin/passwd %u
passwd chat = *New*password* %n\n *Retype*new*password* %n\n
*passwd:*all*authentication*tokens*updated*successfully*
unix password sync = Yes
log file = /var/log/samba/%m.log
max log size = 0
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u
add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M
%u
domain master = No
dns proxy = No
idmap uid = 10000-20000
idmap gid = 10000-20000
template homedir = /data/hom/%U
template shell = /bin/bash
printer admin = root, '@XXXX.COM\Domain Admins',
@XXXX.COM\DEP_ADMIN_GERMANY
oplocks = No
level2 oplocks = No
