Account can only be used to login one at a time

[Andrew Bartlett]

On Tue, 2004-10-05 at 20:26, Wong Onn Chee wrote:
> Hi Andrew,
> 
> You are right.
> I am sorry that, upon further verification, this feature is not in NT.
> However, I have users who requested for this feature though they have 
> mistaken that this is available in NT.
> 
> Any chance that we can put this in future Samba releases?
>  From a security standpoint, this is actually a very useful feature.
> Furthermore, having this feature will also further enhance Samba's 
> advantages over Windows solutions.
> 
> At least I can go around to tell my folks that Samba can do this which 
> Windows can't.
> 
> Just my thoughts.
> :-)

I've had discussions on IRC about this, and was pointed to
http://www.giac.org/practical/GSEC/Gene_Burton_GSEC.pdf

This presents some interesting solutions, all workstation
'self-exclusion' based hacks.  These should work just as well against
Samba as NT.

On the server-side, we have quite a few problems that make this hard:

 - How do you tell the client has 'logged out':
  - There is no reliable 'logged out' message from the clients.
  - There is no connection that the client *must* hold open to remain
'logged on'.
 - What happens if the client (holding the session) reboots, or worse is
just unplugged?

 - How do you replicate this information to multiple DCs, in a way that
is efficient, effective and safe?  (Consider if the servers are split,
but both operating as normal).

 - If you chose not to replicate (hard to do right for this data), how
do you cope with the single point of failure?

That all said, I'm happy to see proposals for 'partial solutions' here,
that work in reasonable scenarios.  This is a 'hard problem'.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet at samba.org
Authentication Developer, Samba Team            http://samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba-technical/attachments/20041005/4dbd52eb/attachment.bin