NOTE: CentOS Enterprise Linux is built from the Red Hat Enterprise Linux source code. Other than logo and name changes CentOS Enterprise Linux is compatible with the equivalent Red Hat version. This document applies equally to both Red Hat and CentOS Enterprise Linux.
NAME="GENERATOR" CONTENT="Modular DocBook HTML
Stylesheet Version 1.7">
The latest release of Samba offers many new features including
new password database backends not previously available. Samba
version 3.0.0 fully supports all databases used in previous
versions of Samba. However, although supported, many backends may
not be suitable for production use.
- Plain Text
Plain text backends are nothing more than the /etc/passwd type backends. With a plain text
backend, all usernames and passwords are sent unencrypted between
the client and the Samba server. This method is very insecure and
is not recommended for use by any means. It is possible that
different Windows clients connecting to the Samba server with plain
text passwords cannot support such an authentication method.
A popular backend used in previous Samba packages, the
smbpasswd backend utilizes a plain ASCII
text layout that includes the MS Windows LanMan and NT account, and
encrypted password information. The smbpasswd backend lacks the storage of the Windows
NT/2000/2003 SAM extended controls. The smbpasswd backend is not recommended because it does
not scale well or hold any Windows information, such as RIDs for
NT-based groups. The tdbsam backend solves
these issues for use in a smaller database (250 users), but is
still not an enterprise-class solution.
This type of backend may be deprecated for future releases and
replaced by the tdbsam backend, which does
include the SAM extended controls.
The ldapsam_compat backend allows
continued OpenLDAP support for use with upgraded versions of Samba.
This option is ideal for migration, but is not required. This tool
will eventually be deprecated.
The tdbsam backend provides an ideal
database backend for local servers, servers that do not need
built-in database replication, and servers that do not require the
scalability or complexity of LDAP. The tdbsam backend includes all of the smbpasswd database information as well as the
previously-excluded SAM information. The inclusion of the extended
SAM data allows Samba to implement the same account and system
access controls as seen with Windows NT/2000/2003-based
The tdbsam backend is recommended for
250 users at most. Larger organizations should require Active
Directory or LDAP integration due to scalability and possible
network infrastructure concerns.
The ldapsam backend provides an optimal
distributed account installation method for Samba. LDAP is optimal
because of its ability to replicate its database to any number of
servers using the OpenLDAP slurpd daemon.
LDAP databases are light-weight and scalable, perfect for most
organizations, especially large enterprises. LDAP is definitely the
"wave of the future" with regards to Samba. Improvements to LDAP
are constantly being added into Samba such as easing installation
and configuration issues.
The mysqlsam backend uses a MySQL-based
database backend. This is useful for sites that already implement
The xmlsam backend uses account and
password data that are stored in an XML formatted file. This method
can be useful for migration of different backend databases or