Samba4

What is Samba4? ● A replacement for Active Directory ● The centre of a windows domain: – Windows domain logon server – Windows-compatible LDAP server – Kerberos KDC, supporting Microsoft extensions ● Moving Samba beyond NT4 domains ● Also a fileserver – but not the topic here

Making life easier for sysadmins ● A focus on creating automated solutions ● Samba4 should 'just work' – Even when it needs to integrate with another package ● Generated configuration files for: – phpLDAPAdmin – BIND – Optional OpenLDAP Backend

New Samba4 Features ● Multi-master replication with OpenLDAP – Instead of local ldb, Samba4 can use OpenLDAP ● Smart-card login support ● Group Policy support ● Python as the scripting language ● NTP signing support – When patch to ntpd applied

The provision script ● Python script ● Sets up Samba4, ready to use – configuration files – DNS zones – Schema – Skeleton database ● Template driven ● Easy to extend templates and script

Provision-backend for OpenLDAP ● Samba4 can use OpenLDAP as a data store – OpenLDAP can be quite hard to configure ● Samba4 has very specific requirements – AD schema – Modules to handle linked attributes ● Python script to generate the slapd.conf and schema

Samba4 needs Sysadmins ● Sysadmins have many useful skills – Perl wrangler – Python handler – Configuration manager – Systems integrator – Wireshark sniffer – Live environment tester – and even occasional Programmer

Samba4 isn't just C anymore ● Not all Samba4 development tasks are deep C coding – There is still plenty of C coding, however ● Python Bindings – All our main libraries have some level of python binding ● Python scripts – Key tools such as 'provision' are written in python

Practical examples of assistance

Multi-master replication ● If OpenLDAP is hard, multi-master replication is harder ● Oliver Liebel extended the provision-backend – Getting a multi-master Samba4 install is now just a configuration option!

PAC Validation ● My 'russian connection' had a strange error – 'PAC Validation failed'. ● PAC: Privilage Attribute Certificate – A Microsoft extension to attach groups to a Kerberos ticket – Windows XP must check the PAC with the KDC – But only rarely – so I never saw it in my testing

Using the full AD schema ● Microsoft has provided a copy of it's schema – But in 'not quite LDIF' format – And with syntax errors ● These we can resolve... ● I asked for help writing a conversion script – Sreepathi Pai took on the – End result can be integrated into our provision script

Account expiry ● Some bugs just take time to discover ● Samba4 a hard-coded 28 day password expiry – Samba also incorrectly ignored the 'no expiry' flag – Only found once testers stopped having to re provision regularly

Dropping out of the domain ● Again, found by my Russian connection. – Windows clients would just stop working, after around a month. ● Monthly password change – To a Random byte buffer – Samba4 could not convert a random byte buffer into a UTF8 string – Samba actually set the password to “” – Fix was eventually to rework the whole password setting stack

NTP signing ● The client time at the russian install kept drifting – This breaks Kerberos quite badly ● Windows clients tried (and failed) to get time from the Samba4 DC ● Needed to implement the Microsoft-only NTP authentication extensions – MS-SNTP ● Patch now available, and well tested

Help still needed ● Testing Samba4 with other software is the remaining big challenge – For example, just how much more do we need to support Exchange? – Non-windows clients ● Developing administration tools ● Re-start the web interface – If administrators still want that kind of thing

LDAP schema mapping ● Is it a problem that Samba4 uses the AD schema? ● Do administrators want Samba4 to use a different backend schema? – Perhaps on the same server as Linux clients use? ● Can someone help me come up with a sensible mapping? – Samba3-like minimal mapping (just add kerberos) – Samba4 full schema to 'posix like' backend

The road ahead ● Domain Trusts ● Replication – Once-off (vampire) – Read-only copy – Full read-write replication

Taking it in our stride ● I've made it my aim to help Sysadmins with their deployments ● We are starting to get a community – I'm not the only one answering questions ● With the feedback from sysadmins, we can better direct Samba4 development ● I'm not asking to switch everything today – Just to tell me what stops you from using Samba4

Demo Time ● Demo of Samba's provision and a WinXP join