Microsoft Distributed File System (DFS) continue...

Creating a DFS Root

Creating a DFS tree is not a complicated task when using a graphical interface such as the one provided by the MMC and by the wizards that walk you through setting up your file system. To create a new DFS root, use the following steps:

1. Click Start, Programs (All Programs for Windows Server 2003), Administrative Tools, Distributed File System.
2. When the management console appears, select New Root from the Action menu. A wizard pops up. Click Next.
3. You can select to create a file system that makes use of the Active Directory for storing the DFS configuration information. You can also select to not use the Active Directory. For the purposes of this example, I've chosen to not use the Active Directory. After making the selection, click Next.
4. The next dialog box prompts you to enter the name of the server that will host the distributed file system. The default is usually the server on which you are running the wizard. Use the default or enter another server. Click Next to continue.
5. The wizard next prompts you to enter the name of the new root DFS file system. Note that what you enter here shows up in the field Share to Be Used at the bottom of the dialog box. You can use the name of an existing share in the Root Name field, or create the share to be used after you complete this wizard.

6. If you entered a share that does not yet exist, you can now choose the folder to share by entering it in the field or by using the Browse button.

7. Finally, the wizard displays a summary of the information you have entered. Click the Finish button to complete the process of creating the new DFS root.

Adding Links to the DFS Root

After you've created the initial root for your file system, you can add one or more links. Links, as yo will recall, are actual directories (or folders, depending on which terminology you prefer) that will be accessible from your DFS root.

DFS is a domain-wide file system. You can easily browse a file share located on another server in the domain. Thus, you can hide the physical location of files from users. Instead of having to remember servers and share names, the user only has to remember the share name. Because the share name is domain-wide, you can't use the same share name on one server that you do on another. Users can then simply connect to the share \ \domainname\share. They don't need to know the server names on which the actual folders in this share are located.

You can use the Action menu to add or delete a DFS root. You can also use the Action menu to manage links and replication.

DFS does not add any additional security features to the file system. Instead, the usual rights and permissions that are already in place on the server are used when evaluating a client's access to a file or directory in the DFS tree.

One major difference between NFS and DFS is that DFS is built using SMB messaging techniques for the most part and is not compatible with all NFS servers. If you have a mixed-environment network in which most of your data files are offered via NFS on Unix servers, it would be more economical to acquire PC-based NFS client software than it would be to replace all your existing servers with NT DFS servers.

Using the SMB/CIFS Protocol on Non-Microsoft Clients: Samba

SMB/CIFS is a protocol that is highly entrenched in the Microsoft world of operating systems and networking products. It makes sense, then, that there would be a way in which these workstations and servers could be integrated into a Unix/Linux environment without a lot of difficulty. The answer to this problem is called Samba, which is a set of products that provide for SMB conversations between SMB servers, such as Microsoft Windows operating systems, and those that do not use it natively,such as many different variants of Unix or Linux systems. In addition, Samba has been ported to several other popular operating systems, including OpenVMS.

Samba was originally developed by Andrew Tridgell and is now maintained by him and other developers (the "Samba Team") on the Internet.

From this Web site you can choose a mirror Web site for your country, and then you can view the documentation for Samba and download the most recent version. The software is freely distributed under the GNU public license.

You can configure Samba servers on your Unix boxes to enable high-performance machines to beused as file servers on the Windows network. You can still manage the servers using Unix file administration procedures, and yet to the client computers, the shares appear no different than those offered by other Windows-based file servers.

Troubleshooting a Samba server can be made easier by starting the Samba server software using the - d parameter to specify a debug level (from 1 to 100), which will cause more output messages, depending on the level you specify.

You can also use a LAN analyzer to view the sequence of exchange of SMB messages between server and client. Available as a download from the Samba home page is an extension to the tcpdump utility, called tcpdump-smb. You can use this to capture smb packets and decode the header information.

The Common Internet File System (CIFS)

CIFS is intended to be a replacement, or an upgrade, of the SMB protocol. Design considerations include making it platform-independent. While SMB resides in the NetBIOS legacy environment, CIFS runs on top of TCP. Other improvements over SMB include the following:

• Unicode filenames are used. Because the Internet is global, it's helpful to be able to encode char acters that support multiple languages.
• Service is automatically restored after a network disruption.
• CIFS is not proprietary to Microsoft. It is an Open Group standard (X/Open CAE Specification C209). It has also been proposed as an Internet standard to the Internet Engineering Task Force (IETF). This is an improvement over the earlier SMB protocol.
• DNS is used to translate between computer hostnames and IP addresses.
• Both share-level authentication and user-level authentication are supported. With user-level authentication, the user must be authenticated (using a username/password valid on the server) before access is granted.
• CIFS has been optimized to make communications across a slow link—such as a dial-up modem—possible.
• CIFS is basically an enhanced version of SMB and still uses server message block messaging. Better security and the use of DNS are necessary additions if the protocol is to be used on the Internet.

System Daemons and Services continue…

Delegating Authority

In a network of any size other than a simple workgroup, it is usually necessary to delegate authority to other administrators or middle-level management personnel. When you find that you must create accounts that have privileges to perform administrative functions, do not give carte blanche access to every account. Keep track of the exact functions an account will be used for, and grant only the access rights and permissions needed.

For example, if an operator will be performing backup functions on a server, he does not need to have full rights and privileges on the server. Under Windows Servers, you can place the user's account into the Backup Operators user group to give him the capabilities he needs, without compromising all files on the system. If you have users who must be able to add or modify user accounts, check the operating-system documentation and give the users access only to the resources and data files they need.

User Accounts

Generic accounts might seem like a good idea at first thought, but they provide nothing in the way auditing. If you simply let one or more users share the root account on a Unix system, or the Administrator account on a Windows server, you will have no way of determining tracking, and resolving who did what when something goes wrong. Indeed, because you can grant the same capabilities to any new account you can create, why not do so?

Give each user who requires elevated capabilities her own account, and grant the necessary privileges to the account. This way you can track each user to be sure she does not abuse her account or use it in a way you do not expect.

When you have more than one user using the same account, there is also the likelihood that the password will be compromised and someone who is not authorized to use the account will do so.

Application Servers, Print Servers, and Web Servers

One particularly common error you can make is to put all your eggs in one basket. Instead of using one server to provide print services or file services or Web services, many administrators use one server to provide all three. This is not necessarily a good idea.

Specialized servers can limit the damage that can be done by intruders and also can make it easier to delegate authority so that a particular administrator can concentrate on a limited set of functions for a certain server. Web servers are particularly prone to attempts by hackers to intrude onto your network. New applications and technologies are being developed and deployed all the time, and the newer they are, the more likely it is that they will have bugs or other loopholes that make them more risky than other applications that run on the network.

Placing sensitive data files on a Web server simply because it is convenient to use the machine's resources is not a good idea if it is also being used as a Web server. Make it more difficult to get at these files by dedicating a file server computer to them instead.

Delegating servers is almost like delegating authority to users. When you divide up resources and partition them into manageable groups, you make it less likely that an attack on one object will result in damage to all objects.

Denial of Service (DoS) attacks are very common on networks now. This kind of attack can be done by a malicious person who takes advantage of a known weakness in a protocol or an implementation of a particular service. One common mistake that administrators make when setting up an FTP site is to place it on an ordinary server.

For example, you might want to have an FTP server that allows customers to log in to your system and download information, patches, or other files. You also might want to be able to let them upload files or messages to your site. If you are going to allow anonymous FTP access, be absolutely sure that the service is configured so that it can access only a dedicated disk or set of disks. Do not allowanonymous access to an FTP service that writes to a system disk or a data disk that is important in your network. It is quite easy for an outsider to simply fill up the disk with meaningless data, causing a system to lock up or crash, depending on the operating system. If an important data disk becomes full, it can cause an extended period of downtime, putting employees out of work for hours while yo try to first determine the cause and then remedy it!

Build Your Digital Command Canter Part 1

The popularity of Star Trek is based, in part, upon our fascination with advanced technology. We're excited when Captain Picardorders his crew to take The Enterprise to another galaxy with the simple command "Make it so." In the distant future, it seems, we'll be able to entertain our merest whim by pushing a button or by telling a computer what we want done. Powerful machines will do the rest.

To succeed at digital marketing, you need to build your own version of The Starship Enterprise. You need to develop a digital command center in your company to communicate on a day-by-day basis with your customers and prospects. Unlike a traditional marketing department — often far removed from direct contact with customers — a digital marketing department must be hardwired to Customers. E-mail messages, for example, must be read and replied to Within hours, if not minutes, and your Web site content may need to be updated and changed daily. In addition, your customer database should be constantly churning with new information uploaded from your salespeople, your customer service representatives, and your customers.

Integration in the Digital Economy

To gather, store, process, and distribute digital information, you need to integrate your company into the digital economy. In the next three to five years, you will need the following capabilities in your company.

• Every computer is connected over a network using highspeed cable. This network includes an internal e-mail system that allows for the sending and receiving of Internet e-mail messages.
• Everyone involved in your company — employees, customers, and suppliers — are able to communicate by e-mail with everyone else in your company. As bandwidth becomes greater, you can upgrade your e-mail capability to include video-mail and live video-conferencing.
• Employees and contract workers are able to work at home, or at satellite offices, as easily as if they were in the office. Note: In the digital world, you may not have an office; your entire operation may run over a central server that electronically connects your organization.
• Your internal computer network is connected directly to the Internet over high-speed telephone or cable lines. This means every computer on your network is connected to the Internet at all times. In fact, it means your computer network is actually part of the Internet.
• You have security measures in place which restrict access to private corporate information on your network. One solution is to set up an Internet fire wall.
• Your marketing presentations, internal communications, and training courses exist in a multimedia format which combines text, graphics, sound, and video. You have software that allows for the easy development of multimedia content.
• You have one or many different types of online servers running on your network. This includes one or more Web servers, a BBS network server, and online database servers. Each of these servers are available to selected people within your organization over an Intranet, or outside your organization by way of the Internet.
• As an alternative to internal online servers, you can lease space with service bureaus. For example, you can rent space on a Web site that is halfway around the world. You can update its content as if the server was in your office. You may use a service bureau to set up and run your online BBS system. Remember, you don't need to buy expensive digital equipment in order to use it — you can rent it as well.
• Your customers access information about your business using a variety of digital communications tools including the telephone, fax, e-mail, the World Wide Web, interactive kiosks, and CD-ROM, and perhaps also through some sort of virtual reality (VR) device. Ideally, your customers are able to purchase your products and services electronically.
• You have an extensive database on all your customers and prospects. This database is relational in structure. All your digital communications and your digital marketing promotions are aimed at increasing the size, quality, and complexity of this database.
• All your computer systems are compatible. In the computer industry, this is known as "Open Systems Architecture." This means all your corporate information is accessible, no matter what type of computer is used. As well, your information should be accessible through all digital devices, not just computer-related ones.
• Your employees are fully fluent in the ways of basic digital technology. Everyone in your organization knows how to use the three major types of software programs: word processing, spreadsheet, and database. They are comfortable creating _and viewing multimedia content. They understand the basic concepts of the Internet, and can find the information they need on it.

In order to succeed at digital marketing over the long term, you need to set up this type of infrastructure within your company. However, man didn't get to the moon in one day. So take it one step at a time. Here's an explanation of how to take the first steps:

Sun Network Information System

NIS is used on Unix networks to keep important system files, such as the password file, synchronized among a group of servers. Remember that on Unix systems, each server has a password file, a user group file, and other important files that are managed locally on each server by default. This is similar to using a Windows computer in a standalone manner where each Windows computer has its own user account database.

NIS uses a database of maps that contain entries for the files the system administrator chooses to keep synchronized. For redundancy purposes, a master NIS server can be used along with slave NIS servers that receive updates from the master server.

SFU version 3.5 contains a component that can be used to allow a Windows Server domain controller to operate as a NIS server. The Windows server can operate as either a master or slave NIS server. However, if it is to operate as a slave server, the master NIS server on the network must also be a Windows server. This is due to the way NIS is implemented in Windows Server: The information that Unix NIS servers store in a map database is stored in the Active Directory. The Active Directory schema is extended to include a class for each NIS map. Then objects are created based on this class for each map entry.

NIS uses its own protocol to send updates from a master NIS server to slave servers. The Active Directory, on the other hand, has its own method for replication information to other Active Directory replicas. The two methods are not compatible. That's the reason why a Windows domain controller cannot be made a slave NIS server to a Unix master NIS server. However, Microsoft does provide support for the NIS protocol so that Unix systems can become slaves to a Windows 2000 master NIS server! So, if you decide to integrate NIS into the Windows 2000 portion of your network, you'll have to make a Windows domain controller the master NIS server.

The advantages of using NIS should be obvious. On Unix networks, NIS relieves the administrator of having to manually coordinate important system files on multiple servers. By incorporating the SFU NIS server into the network on a Windows domain controller, you can use the tools designed around the Active Directory to manage not only your Windows users but also users on your Unix systems.

Another advantage to using a Windows-based NIS server is that the Active Directory is a hierarchical database, whereas the NIS database format is a flat namespace. You can place NIS maps into any container in the Active Directory, such as an organizational unit (OU). You can probably figure out from this that you can support multiple NIS domains in the same Active Directory database.