|
LISA 2000 Abstract
Fokstraut and Samba - Dealing with Authentication and Performance Issues On A Large Scale Samba Service
Robert Beck & Steve Holstead, University of Alberta
Abstract
At the University of Alberta, we have approximately 55,000 user
id's using central services authenticated by Kerberos. We use AFS for
central file service. We use Samba to provide Windows compatible
access to much of our central file service. Samba contains a number of
useful features for Microsoft Windows compatibility, including a
kludge to deal with the problem of Windows sending an all uppercase
version of a user's password. We observed that when Windows connects
to a share, it frequently attempts many incorrect passwords repeatedly
before trying the correct one. This created a very heavy
authentication load on our central Samba service when users would
connect every morning and authenticate. We observed this load and
noticed that most of our problems were caused by repeated attempts to
authenticate, and the high cost of checking these attempts. To
help reduce the load due to authentication, we implemented FOKSTRAUT,
a set of modifications to Samba to cache recent password failures and
successes in a DBM database built by the Samba server as it runs. By
caching the recent failures we avoid expensive re-checks of the (many)
other passwords Windows likes to send us. We also cache the correct
case of the real password, and by doing so we avoid the expensive
overhead of ``cracking'' an all uppercase password When Windows
decides to send one. We also use FOKSTRAUT to cache the NT and LanMan
password hashes of a users password once we see a successful
authentication. This then allows us to use the newer Windows NT
password hash after the user has connected once, without having to
centrally convert and maintain a large SMB password file, and while
maintaining the ability of our server to access services such as AFS
which can not be authenticated against using the Windows password hash
alone. Performance on our service has been drastically improved since
the implementation of FOKSTRAUT.
|
Need help? Use our Contacts page.
