Chemnitzer Linuxtage 2019

Volker Lendecke

Samba Team / SerNet

17. M¨arz2019 Who am I?

I Co-Founder of SerNet in G¨ottingen, Germany

I First patches in 1994

I Early Samba Team member

I Samba infrastructure (tdb, tevent, etc)

I File server

I Clustered Samba

I Winbind I AD controller is my colleague Stefan Metzmacher’s domain

I Stefan implemented AD multi-master replication in Samba

Volker Lendecke Samba Status (2 / 1) What is Samba?

I www.samba.org: Samba is the standard Windows interoperability suite of programs for and Unix I Server- and Client-Implementation of the (SMB) protocol

I SMB is the Windows protocol to share drives across the network I Comparable to NFS (NFSv4 copied many SMB features ...)

I Print server for Windows clients I Active Directory domain member

I Make Active Directory users and groups available on Linux I Active Directory domain controller

I Provide user database for Windows and Unix clients

Volker Lendecke Samba Status (3 / 1) Samba Release Cycles

I Regular release cycle is six to nine months I Current release fully supported (4.9)

I Bug fixes, some new features I Previous release (4.8)

I Only bug fixes I Before previous release (4.7)

I Security fixes only

I Samba 4.6 went out of security support with 4.9

I 1.5 to 2 years of security support

I https://wiki.samba.org/index.php/Samba Release Planning has a nice table

Volker Lendecke Samba Status (4 / 1) Active Directory

I Microsoft’s central user database

I Successor to NT4-based Security Account Manager (SAM) I It’s what eDirectory is for the Bindery ( anyone?)

I Kerberos KDC with an LDAP database backend

I Multi-Master replicated LDAP database I Highly specific LDAP schema with custom extensions

I A lot of internal magic and validity checks

I Authentication server for Challenge-Response based schemes

I DNS database for server lookup

Volker Lendecke Samba Status (5 / 1) LDAP data store

I For historical reasons, Samba implements its own LDAP server

I The custom extensions were not well received by OpenLDAP I This has changed now, but it’s a huge effort to change this I Samba LDAP stores AD in tdb

I TDB (Trivial DataBase) is a simple key/value store I Mainly for small, highly volatile records (AD is not volatile) I Transactions were added later I TDB is limited to 4GB (32-bit) I Howard Chu has developed LMDB for OpenLDAP

I Highly tuned btree implementation I 64-bit, so no size limitations

I Samba 4.9 allows the use of lmdb

Volker Lendecke Samba Status (6 / 1) Trust Relationships

I Active Directory can scale to huge numbers of users

I A single administrator account for the whole database I Organizations don’t always trust each other I Multiple ADs can be linked by Trust Relationships

I Domain A trusts Domain B ⇒ Users from B can log in to A

I Pure domain member (winbind) has supported trusts for ages I Samba 4.8 starts to support trusts as an AD DC

I Some limitations: Domains have to fully trust each other I Main goal not yet achived, but we’re close

Volker Lendecke Samba Status (7 / 1) Audit Logging

I For compliance reasons, many users need detailed logs of all authentication-related actions

I Samba 4.9 adds logging in JSON format

I { ”timestamp”: ”2019-03-16T08:29:32.635688+0100”, ”account”: ”vlendec”, ”sid”: ”S-1-5-21-3898457107-206185458-3872133680-1000”, ”logonServer”: ”DC1”, ... Lots of other information }

I Consumable by many backends

Volker Lendecke Samba Status (8 / 1) Active Directory Backup

I AD backup is not like other backups

I Multi-Master replication creates any number of valid copies I A single DC that lost its db can be purged and re-joined I Normal replication will restore the full database

I Samba 4.9 adds “samba-tool domain backup online”

I Samba 4.10 extends to “samba-tool domain backup online” I Restore must be done very carefully

I All Domain Controllers must be switched off I One DC is restored from backup I All other DCs must be re-joined and replicated I Otherwise, replication is destroyed

Volker Lendecke Samba Status (9 / 1) Clustered Samba

I Samba can provide a single SMB server across multiple nodes

I Underlying clustered file system I GFS, Ceph, Gluster, OCFS, GPFS, StorNext, CXFS, Panasas

I Main task: Helper for smbd to distribute internal databases ⇒ Clustered TDB (CTDB) I CTDB provides a cluster manager

I Node membership I Service monitoring I IP address assignment I All these tasks are becoming modularized

I Integration into existing clustering solutions gets easier I Monitoring and IP management now someone else’s problem I Configuration changed radically with 4.9

I No longer just arguments to ctdb, we now have a proper config file

Volker Lendecke Samba Status (10 / 1) SMB2 unix extensions

I SMB implements the semantics Windows clients expect for files I Cool SMB features:

I Security: Authentication, Signing, Encryption I High performance through multi-channel, SMB over RDMA I Cache coherence protocol I NFS can do most of it, but only with NFSv4.1

I Linux clients can mount SMB shares I Not everything works as with a local file system

I File names are case insensitive: test.txt and Test.txt are the same I No symlinks, sockets, device nodes I Different locking semantics

Volker Lendecke Samba Status (11 / 1) SMB2 unix extensions

I Goal: Run home directories off SMB (kill NFS?)

I SMB1 was extended to do all this: “unix extensions = yes” I SMB1 is deprecated, insecure, slow I Apple switched from AFP (Apple File Protocol) to SMB

I Semantic extensions for Apple specific features I Optimizations for resource fork and Finder metadata I ⇒ Protocol is extensible I OS/X is Unix based, why not use those extensions?

I Not quite what we need I For example, no symlinks

I SMB2 extensions: Minimum required change

I Status: Mostly works with Jeremy Allison’s patches, now working to get them upstream

Volker Lendecke Samba Status (12 / 1) Questions?

[email protected] / [email protected] http://www.sambaxp.org/

Volker Lendecke Samba Status (13 / 1)