On Sat, 2005-12-03 at 23:57 -0800, SAMBA wrote:
Other than NIS is extremely insecure, and anyone concerned with security
would not use it. If you are using SFU, just use LDAP/Kerberos instead
of NIS. You'll get the same results, but with more security.
The main issues with NIS security (compared with unsigned LDAP
connections) is that passwords my be present in the tables. This isn't
the case with the AD implementation anyway (I think you would need to
use Kerberos authentication, as there are no NIS compatible passwords in
AD, to my knowlege).
You don't have to use IDMAP to have GID/UID based on SID. You can
manually enter it yourself as per design you're your network. Also
check out PADL NSS/PAM modules. There's also I think some scripts for
automating migration from NIS to LDAP.
In Samba, IDMAP is the plugin interface for assigning the UID/GID
mappings, and can be backed onto many sources, including attributes in
the AD LDAP server (that would be used by the SFU 3.5 NIS server).
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Jim Hatfield
Sent: Friday, November 25, 2005 2:51 AM
To: samba@lists.samba.org
Subject: [Samba] Any downsides to using MS Services for Unix NIS server?
I have both an AD domain and an existing NIS setup, and would like
to merge the accounts. It would seem from reading the help files
that installing Services for Unix on my domain controllers and using
the AD-integrated NIS server would work well. I wouldn't need to use
winbind, and I would have not only consistent but predictable ID
mapping, ie I can ensure that INTERNAL\jhatfield maps to UID 115,
which is what it is on the existing NIS server.
Are there any downsides to doing this - it seems much simpler than
deploying winbind that I feel there must be a catch!
I think you should be able to use winbindd, which assists with windows
clients (which expect SIDs), while still maintaining your centralised
mapping. See idmap_ad.
Andrew Bartlett
--
Andrew Bartletthttp://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Student Network Administrator, Hawker College http://hawkerc.net
signature.asc
Description: This is a digitally signed message part
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
