mirror of
https://github.com/samba-team/samba.git
synced 2024-12-24 21:34:56 +03:00
351 lines
12 KiB
XML
351 lines
12 KiB
XML
|
<chapter id="AdvancedNetworkManagement">
|
||
|
<chapterinfo>
|
||
|
&author.jht;
|
||
|
<pubdate>April 3 2003</pubdate>
|
||
|
</chapterinfo>
|
||
|
|
||
|
<title>Advanced Network Management</title>
|
||
|
|
||
|
<para>
|
||
|
This section documents peripheral issues that are of great importance to network
|
||
|
administrators who want to improve network resource access control, to automate the user
|
||
|
environment and to make their lives a little easier.
|
||
|
</para>
|
||
|
|
||
|
<sect1>
|
||
|
<title>Features and Benefits</title>
|
||
|
|
||
|
<para>
|
||
|
Often the difference between a working network environment and a well appreciated one can
|
||
|
best be measured by the <emphasis>little things</emphasis> that make everything work more
|
||
|
harmoniously. A key part of every network environment solution is the
|
||
|
ability to remotely
|
||
|
manage MS Windows workstations, remotely access the Samba server, provide customized
|
||
|
logon scripts, as well as other housekeeping activities that help to sustain more reliable
|
||
|
network operations.
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
This chapter presents information on each of these areas. They are placed here, and not in
|
||
|
other chapters, for ease of reference.
|
||
|
</para>
|
||
|
|
||
|
</sect1>
|
||
|
|
||
|
<sect1>
|
||
|
<title>Remote Server Administration</title>
|
||
|
|
||
|
|
||
|
<para><quote>How do I get `User Manager' and `Server Manager'?</quote></para>
|
||
|
|
||
|
<para>
|
||
|
<indexterm><primary>User Manager</primary></indexterm>
|
||
|
<indexterm><primary>Server Manager</primary></indexterm>
|
||
|
<indexterm><primary>Event Viewer</primary></indexterm>
|
||
|
Since I do not need to buy an <application>NT4 Server</application>, how do I get the `User Manager for Domains'
|
||
|
and the `Server Manager'?
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
<indexterm><primary>Nexus.exe</primary></indexterm>
|
||
|
Microsoft distributes a version of these tools called <filename>Nexus.exe</filename> for installation
|
||
|
on <application>Windows 9x/Me</application> systems. The tools set includes:
|
||
|
</para>
|
||
|
|
||
|
<itemizedlist>
|
||
|
<listitem>Server Manager</listitem>
|
||
|
<listitem>User Manager for Domains</listitem>
|
||
|
<listitem>Event Viewer</listitem>
|
||
|
</itemizedlist>
|
||
|
|
||
|
<para>
|
||
|
Download the archived file at <ulink noescape="1" url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE.</ulink>
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
<indexterm><primary>SRVTOOLS.EXE</primary></indexterm>
|
||
|
The <application>Windows NT 4.0</application> version of the `User Manager for
|
||
|
Domains' and `Server Manager' are available from Microsoft <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">via ftp</ulink>.
|
||
|
</para>
|
||
|
|
||
|
</sect1>
|
||
|
|
||
|
<sect1>
|
||
|
<title>Remote Desktop Management</title>
|
||
|
|
||
|
<para>
|
||
|
There are a number of possible remote desktop management solutions that range from free
|
||
|
through costly. Do not let that put you off. Sometimes the most costly solution is the
|
||
|
most cost effective. In any case, you will need to draw your own conclusions as to which
|
||
|
is the best tool in your network environment.
|
||
|
</para>
|
||
|
|
||
|
<sect2>
|
||
|
<title>Remote Management from NoMachine.Com</title>
|
||
|
|
||
|
<para>
|
||
|
<indexterm><primary>NoMachine.Com</primary></indexterm>
|
||
|
The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003.
|
||
|
It is presented in slightly edited form (with author details omitted for privacy reasons).
|
||
|
The entire answer is reproduced below with some comments removed.
|
||
|
</para>
|
||
|
|
||
|
<para><quote>
|
||
|
I have a wonderful Linux/Samba server running as pdc for a network. Now I would like to add remote
|
||
|
desktop capabilities so users outside could login to the system and get their desktop up from home or
|
||
|
another country.
|
||
|
</quote></para>
|
||
|
|
||
|
<para><quote>
|
||
|
Is there a way to accomplish this? Do I need a Windows Terminal Server? Do I need to configure it so
|
||
|
it is a member of the domain or a BDC,PDC? Are there any hacks for MS Windows XP to enable remote login
|
||
|
even if the computer is in a domain?
|
||
|
</quote></para>
|
||
|
|
||
|
<para>
|
||
|
Answer provided: Check out the new offer of <quote>NX</quote> software from
|
||
|
<ulink noescape="1" url="http://www.nomachine.com/">NoMachine</ulink>.
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
It implements an easy-to-use interface to the Remote X protocol as
|
||
|
well as incorporating VNC/RFB and rdesktop/RDP into it, but at a speed
|
||
|
performance much better than anything you may have ever seen.
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
Remote X is not new at all, but what they did achieve successfully is
|
||
|
a new way of compression and caching technologies that makes the thing
|
||
|
fast enough to run even over slow modem/ISDN connections.
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
I could test drive their (public) Red Hat machine in Italy, over a loaded
|
||
|
Internet connection, with enabled thumbnail previews in KDE konqueror
|
||
|
which popped up immediately on <quote>mouse-over</quote>. From inside that (remote X)
|
||
|
session I started a rdesktop session on another, a Windows XP machine.
|
||
|
To test the performance, I played Pinball. I am proud to announce
|
||
|
that my score was 631750 points at first try.
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
NX performs better on my local LAN than any of the other <quote>pure</quote>
|
||
|
connection methods I am using from time to time: TightVNC, rdesktop or
|
||
|
Remote X. It is even faster than a direct crosslink connection between
|
||
|
two nodes.
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
I even got sound playing from the Remote X app to my local boxes, and
|
||
|
had a working <quote>copy'n'paste</quote> from an NX window (running a KDE session
|
||
|
in Italy) to my Mozilla mailing agent. These guys are certainly doing
|
||
|
something right!
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
I recommend to test drive NX to anybody with a only a passing interest in remote computing
|
||
|
<ulink noescape="1" url="http://www.nomachine.com/testdrive.php">http://www.nomachine.com/testdrive.php</ulink>.
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
Just download the free of charge client software (available for Red Hat,
|
||
|
SuSE, Debian and Windows) and be up and running within five minutes (they
|
||
|
need to send you your account data, though, because you are assigned
|
||
|
a real UNIX account on their testdrive.nomachine.com box.
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
They plan to get to the point were you can have NX application servers
|
||
|
running as a cluster of nodes, and users simply start an NX session locally,
|
||
|
and can select applications to run transparently (apps may even run on
|
||
|
another NX node, but pretend to be on the same as used for initial login,
|
||
|
because it displays in the same window. You also can run it
|
||
|
full-screen, and after a short time you forget that it is a remote session
|
||
|
at all).
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
Now the best thing for last: All the core compression and caching
|
||
|
technologies are released under the GPL and available as source code
|
||
|
to anybody who wants to build on it! These technologies are working,
|
||
|
albeit started from the command line only (and very inconvenient to
|
||
|
use in order to get a fully running remote X session up and running.)
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
To answer your questions:
|
||
|
</para>
|
||
|
|
||
|
<itemizedlist>
|
||
|
<listitem><para>
|
||
|
You do not need to install a terminal server; XP has RDP support built in.
|
||
|
</para></listitem>
|
||
|
|
||
|
<listitem><para>
|
||
|
NX is much cheaper than Citrix &smbmdash; and comparable in performance, probably faster.
|
||
|
</para></listitem>
|
||
|
|
||
|
<listitem><para>
|
||
|
You do not need to hack XP &smbmdash; it just works.
|
||
|
</para></listitem>
|
||
|
|
||
|
<listitem><para>
|
||
|
You log into the XP box from remote transparently (and I think there is no
|
||
|
need to change anything to get a connection, even if authentication is against a domain).
|
||
|
</para></listitem>
|
||
|
|
||
|
<listitem><para>
|
||
|
The NX core technologies are all Open Source and released under the GPL &smbmdash;
|
||
|
you can now use a (very inconvenient) command-line at no cost,
|
||
|
but you can buy a comfortable (proprietary) NX GUI front end for money.
|
||
|
</para></listitem>
|
||
|
|
||
|
<listitem><para>
|
||
|
NoMachine are encouraging and offering help to OSS/Free Software implementations
|
||
|
for such a front end too, even if it means competition to them (they have written
|
||
|
to this effect even to the LTSP, KDE and GNOME developer mailing lists).
|
||
|
</para></listitem>
|
||
|
</itemizedlist>
|
||
|
|
||
|
</sect2>
|
||
|
|
||
|
</sect1>
|
||
|
|
||
|
<sect1>
|
||
|
<title>Network Logon Script Magic</title>
|
||
|
|
||
|
<para>
|
||
|
There are several opportunities for creating a custom network startup configuration environment.
|
||
|
</para>
|
||
|
|
||
|
<itemizedlist>
|
||
|
<listitem>No Logon Script.</listitem>
|
||
|
<listitem>Simple universal Logon Script that applies to all users.</listitem>
|
||
|
<listitem>Use of a conditional Logon Script that applies per user or per group attributes.</listitem>
|
||
|
<listitem>Use of Samba's preexec and postexec functions on access to the NETLOGON share to create
|
||
|
a custom logon script and then execute it.</listitem>
|
||
|
<listitem>User of a tool such as KixStart.</listitem>
|
||
|
</itemizedlist>
|
||
|
|
||
|
<para>
|
||
|
The Samba source code tree includes two logon script generation/execution tools.
|
||
|
See <filename>examples</filename> directory <filename>genlogon</filename> and
|
||
|
<filename>ntlogon</filename> subdirectories.
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
The following listings are from the genlogon directory.
|
||
|
</para>
|
||
|
|
||
|
|
||
|
<para>
|
||
|
<indexterm><primary>genlogon.pl</primary></indexterm>
|
||
|
This is the <filename>genlogon.pl</filename> file:
|
||
|
|
||
|
<smbfile name="genlogon.pl">
|
||
|
<programlisting>
|
||
|
#!/usr/bin/perl
|
||
|
#
|
||
|
# genlogon.pl
|
||
|
#
|
||
|
# Perl script to generate user logon scripts on the fly, when users
|
||
|
# connect from a Windows client. This script should be called from
|
||
|
# smb.conf with the %U, %G and %L parameters. I.e:
|
||
|
#
|
||
|
# root preexec = genlogon.pl %U %G %L
|
||
|
#
|
||
|
# The script generated will perform
|
||
|
# the following:
|
||
|
#
|
||
|
# 1. Log the user connection to /var/log/samba/netlogon.log
|
||
|
# 2. Set the PC's time to the Linux server time (which is maintained
|
||
|
# daily to the National Institute of Standards Atomic clock on the
|
||
|
# internet.
|
||
|
# 3. Connect the user's home drive to H: (H for Home).
|
||
|
# 4. Connect common drives that everyone uses.
|
||
|
# 5. Connect group-specific drives for certain user groups.
|
||
|
# 6. Connect user-specific drives for certain users.
|
||
|
# 7. Connect network printers.
|
||
|
|
||
|
# Log client connection
|
||
|
#($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
|
||
|
($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
|
||
|
open LOG, ">>/var/log/samba/netlogon.log";
|
||
|
print LOG "$mon/$mday/$year $hour:$min:$sec";
|
||
|
print LOG " - User $ARGV[0] logged into $ARGV[1]\n";
|
||
|
close LOG;
|
||
|
|
||
|
# Start generating logon script
|
||
|
open LOGON, ">/shared/netlogon/$ARGV[0].bat";
|
||
|
print LOGON "\@ECHO OFF\r\n";
|
||
|
|
||
|
# Connect shares just use by Software Development group
|
||
|
if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev")
|
||
|
{
|
||
|
print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n";
|
||
|
}
|
||
|
|
||
|
# Connect shares just use by Technical Support staff
|
||
|
if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support")
|
||
|
{
|
||
|
print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n";
|
||
|
}
|
||
|
|
||
|
# Connect shares just used by Administration staff
|
||
|
If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin")
|
||
|
{
|
||
|
print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n";
|
||
|
print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n";
|
||
|
}
|
||
|
|
||
|
# Now connect Printers. We handle just two or three users a little
|
||
|
# differently, because they are the exceptions that have desktop
|
||
|
# printers on LPT1: - all other user's go to the LaserJet on the
|
||
|
# server.
|
||
|
if ($ARGV[0] eq 'jim'
|
||
|
|| $ARGV[0] eq 'yvonne')
|
||
|
{
|
||
|
print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n";
|
||
|
print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
|
||
|
}
|
||
|
else
|
||
|
{
|
||
|
print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n";
|
||
|
print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
|
||
|
}
|
||
|
|
||
|
# All done! Close the output file.
|
||
|
close LOGON;
|
||
|
</programlisting>
|
||
|
</smbfile>
|
||
|
</para>
|
||
|
|
||
|
<para>
|
||
|
Those wishing to use more elaborate or capable logon processing system should check out these sites:
|
||
|
</para>
|
||
|
|
||
|
<itemizedlist>
|
||
|
<listitem><ulink noescape="1" url="http://www.craigelachie.org/rhacer/ntlogon">http://www.craigelachie.org/rhacer/ntlogon</ulink></listitem>
|
||
|
<listitem><ulink noescape="1" url="http://www.kixtart.org">http://www.kixtart.org</ulink></listitem>
|
||
|
</itemizedlist>
|
||
|
|
||
|
<sect2>
|
||
|
<title>Adding Printers without User Intervention</title>
|
||
|
|
||
|
|
||
|
<para>
|
||
|
<indexterm><primary>rundll32</primary></indexterm>
|
||
|
Printers may be added automatically during logon script processing through the use of:
|
||
|
|
||
|
<screen>
|
||
|
&dosprompt;<userinput>rundll32 printui.dll,PrintUIEntry /?</userinput>
|
||
|
</screen>
|
||
|
|
||
|
See the documentation in the <ulink url="http://support.microsoft.com/default.asp?scid=kb;en-us;189105">Microsoft knowledgebase article 189105.</ulink>
|
||
|
</para>
|
||
|
</sect2>
|
||
|
|
||
|
</sect1>
|
||
|
|
||
|
</chapter>
|