HP CIFS Server Administrator's Guide Version A.03.01.01 (5900-1282, May 2011)

encrypt passwords = yes
security = user
[netlogon]
comment = The domain logon service
path = /var/opt/samba/netlogon
writeable = no
guest ok = no
• The smb.conf file is as shown if the HP CIFS Server acting as a BDC uses the LDAP backend
to store UNIX and Samba account databases:
[global]
workgroup = SAMBADOM #Samba Domain
security = user
domain logon = yes
domain master = no
encrypt passwords = yes
passdb backend = ldapsam:ldap://ldapserver:389
• When you configure the relative domain controller parameters, ensure that the
/var/opt/samba/netlogon subdirectory for the domain logon service exists.
HP CIFS does not implement a true SAM database and nor its replication. HP CIFS implementation
of BDCs is very much like a PDC with one important difference. A BDC is configured like a PDC
except the smb.conf parameter, domain master, must be set to no.
NOTE: security: Set this parameter to user to ensure that Windows users, client machine
accounts, and passwords are stored and managed in the smbpasswd file or LDAP backend.
domain master: Set this parameter to no in order for the HP CIFS Server to act as a BDC.
domain logon: Set this parameter to yes to provide netlogon services.
Encrypt passwords: You set this parameter to yes, the passwords used to authenticate users
are encrypted. You must set this parameter to yes when you configure HP CIFS Server to act as
a BDC.
Promote a BDC to a PDC in a Samba Domain
If a PDC fails or needs to be taken out of services, simply set "domain master = yes" on a
BDC. It will then register the appropriate NetBIOS names and will assume the PDC role.
Domain Member Server
Configure the HP CIFS Server as a Member Server
When configuring HP CIFS Server to act as a domain member server, you need to configure the
relative domain parameters in the /etc/opt/samba/smb.conf file by using the SWAT tool or
an editor. The smb.conf file is shown as follows:
• The smb.conf file is as shown if the HP CIFS Server acting as a member server does not use
the LDAP backend:
[global]
workgroup = NTDOM
security = domain
Domain Member Server 57