The latest release of Samba offers many new features including new
password database backends not previously available. Samba version 3.0.0
fully supports all databases used in previous versions of
Samba. However, although supported, many backends may not be suitable
for production use.
Plain text backends are nothing more than the
/etc/passwd type backends. With a plain text
backend, all usernames and passwords are sent unencrypted
between the client and the Samba server. This method is very
insecure and is not recommended for use by any means. It is
possible that different Windows clients connecting to the Samba
server with plain text passwords cannot support such an
authentication method.
smbpasswd
A popular backend used in previous Samba packages, the
smbpasswd backend utilizes a plain ASCII text
layout that includes the MS Windows LanMan and NT account, and
encrypted password information. The smbpasswd
backend lacks the storage of the Windows NT/2000/2003 SAM
extended controls. The smbpasswd backend is
not recommended because it does not scale well or hold any
Windows information, such as RIDs for NT-based groups. The
tdbsam backend solves these issues for use in
a smaller database (250 users), but is still not an
enterprise-class solution.
Warning
This type of backend may be deprecated for future releases
and replaced by the tdbsam backend,
which does include the SAM extended controls.
ldapsam_compat
The ldapsam_compat backend allows continued
OpenLDAP support for use with upgraded versions of Samba. This
option is ideal for migration, but is not required. This tool
will eventually be deprecated.
The tdbsam backend provides an ideal
database backend for local servers, servers that do not need
built-in database replication, and servers that do not require
the scalability or complexity of LDAP. The
tdbsam backend includes all of the
smbpasswd database information as well as the
previously-excluded SAM information. The inclusion of the
extended SAM data allows Samba to implement the same account and
system access controls as seen with Windows NT/2000/2003-based
systems.
The tdbsam backend is recommended for 250
users at most. Larger organizations should require Active
Directory or LDAP integration due to scalability and possible
network infrastructure concerns.
ldapsam
The ldapsam backend provides an optimal
distributed account installation method for Samba. LDAP is
optimal because of its ability to replicate its database to any
number of servers using the OpenLDAP slurpd
daemon. LDAP databases are light-weight and scalable, perfect
for most organizations, especially large enterprises. LDAP is
definitely the "wave of the future" with regards to
Samba. Improvements to LDAP are constantly being added into
Samba such as easing installation and configuration issues.
mysqlsam
The mysqlsam backend uses a MySQL-based
database backend. This is useful for sites that already
implement MySQL.
xmlsam
The xmlsam backend uses account and password
data that are stored in an XML formatted file. This method can be
useful for migration of different backend databases or backups.
