Samba on FreeBSD

[James B. Byrne via freebsd-questions]

I am contemplating creating a SAMBA-4.4 Domain Controller on
FreeBSD-10.3. Has anyone here done this? If anyone has, and would
care to share their experience with me I have a number of questions:

1. Is the SAMBA instance the only DC in your domain?

2. If the SAMBA service is not the only DC what OS's do the other DCs
run.

3. Did you migrate from an existing MS based DC?

4. Did you run SAMBA as a jail or as a BHyve VM. If either applies,
why one and not the other?
--
*** e-Mail is NOT a SECURE channel ***
Do NOT transmit sensitive data via e-Mail
Do NOT open attachments nor follow links sent by e-Mail

James B. Byrne mailto:***@Harte-Lyne.ca
Harte & Lyne Limited http://www.harte-lyne.ca
9 Brockley Drive vox: [phone]
Hamilton, Ontario fax: [phone]
Canada L8E 3C3

[Andrea Venturoli]

Post by James B. Byrne via freebsd-questions
I am contemplating creating a SAMBA-4.4 Domain Controller on
FreeBSD-10.3. Has anyone here done this?

You mean an NT4 DC or an AD DC?

NT4: Yes, in several cases.
AD: Yes, in at least two installations (possibly growing in a near future).

Post by James B. Byrne via freebsd-questions
If anyone has, and would
1. Is the SAMBA instance the only DC in your domain?

NT4: Currently yes, but I used to have a PDC and a BDC in a couple of cases.
AD: Yes (although I might be setting up a secondary DC on one network in
the future).

Post by James B. Byrne via freebsd-questions
2. If the SAMBA service is not the only DC what OS's do the other DCs
run.

NT4: FreeBSD
AD: that would be FreeBSD again.

Post by James B. Byrne via freebsd-questions
3. Did you migrate from an existing MS based DC?

No.

Post by James B. Byrne via freebsd-questions
4. Did you run SAMBA as a jail or as a BHyve VM.

NT4: no.
AD: Yes, in a jail (mainly, but not only, because on an AD DC there are
some limitations WRT to NSS; that lets the base system or another jail
act as file server).

Post by James B. Byrne via freebsd-questions
If either applies, why one and not the other?

I've been using Jails for a while, but never tried bhyve yet (last time
I checked it was still not considered production-ready).
I believe usual considerations (i.e. nothing Samba specific) apply to
the choice between the two.



Feel free to ask if you have other questions.

bye
av.

[Andrea Venturoli]

Post by Andrea Venturoli
AD: Yes, in a jail (mainly, but not only, because on an AD DC there
are some limitations WRT to NSS; that lets the base system or another
jail act as file server).

Could you explain this issue in greater detail? I am aware that the
Samba team advise against having a SAMBA file-server act as a DC. I
have not followed the reasoning very well however.
What are the NSS issues to which you refer?

Suppose you want (for whatever reason) to see the Samba users as UNIX
users: you'll put something like "passwd: files winbind" in
/etc/nsswitch.conf.
AFAICT that's not going to work on the machine (phyisical, virtual,
jail, etc...) where Samba is configured to be an AD DC (*).
I'm not sure why, I think it has something to do with the way winbindd
works, which is different on the DC.

So I use a jail for the DC (where I'll have no need for UNIX users) and
configure any other instance be a domain member.

(*) Notice "AD DC"; it will work on an NT DC.



The only nuisance is the need to use that jail for DNS.

What are the issues with Bhyve that make it not production ready?

I never investigated (yet), so I can't answer.
It's also possible I've fallen behind and bhyve now works well.

Additionally, if the SAMBA DC was hosted on a Bhyve VM and another
SAMBA file-share server for that domain was hosted in a different
Bhyve VM would that be a problem in your opinion?

(Leaving aside bhyve specific problems, which, as I said earlier, I'm
not entitled to consider), I don't think there would be any problem:
that's what I'm doing with jails.

Thank you for your response. I greatly appreciate it. I have kept my
reply to you off-list since it is probably outside the scope of being
FreeBSD related. However, I have no objection to anything I write
herein showing up on the list should you deem it appropriate.

Why? I thinks the community might benefit from this... let them decide :)

bye
av.