This is a question that most EJB 3/Java EE 5 references cover in detail (EJB 3 in Action certainly does). As a brief summary, the choice is really up to you. You can put business logic in session beans while using a separate DAO layer to encapsulate persistence code. This is the traditional Java EE layered architecture. If you wish, you can omit the DAO layer while using JPA. Some folks have argued that JPA makes the DAO layer obsolete. You can also use domain driven design (DDD) and put business logic in domain objects that are invoked by session beans.
Hope it helps,
Independent Consultant — Author, EJB 3 in Action — Expert Group Member, Java EE 6 and EJB 3.1