Samba and Windows 2003 as PDC

[enrico.nic]

Hi all

Some people requested me to join my HP-UX 11.0/Samba 2.2.8a machine to a Windows 2003 new domain. They requested me this to validate all Samba users through the MS Windows server, that holds all print queues (not a great reason in my opinion, but that's it).
I am somewhat concerned about the security matter that this "migration" involves.
In particular, I wonder to know what a "maliced" MS Win Administrator could do on the disk shares, or eventually on all the system.
Or maybe I am beginning to be somewhat paranoid, and all of these doubts should be forgotten as soon as possible.

Thank you for your help

Enrico

[Geoff Wild]

A good idea - that way users can be authenticated via the Windows server - less admin on your part.

The NT Admins can't damage your config nor your server - so no worries - though they might be able to delete all files in a share :)

Make sure your Samba shares are backed up.

Rgds...Geoff

[Steven E. Protter]

You will have less admin headaches under this plan. Its been done, and the security issues involve problems with the Windows Server OS.

On the Linux side, if the Windows PDC says the user is valid you are fine.

There is no need to be paranoid. Work with the Windows admin and this can make you more secure. Having the password file on another server makes it harder to hack your Linux box.

SEP