mirror of
https://github.com/samba-team/samba.git
synced 2024-12-24 21:34:56 +03:00
PDC docs, made from DocBook source, comments ?
This commit is contained in:
parent
04ebcf954c
commit
551a0eebb7
2157
docs/htmldocs/samba-pdc-faq.html
Normal file
2157
docs/htmldocs/samba-pdc-faq.html
Normal file
File diff suppressed because it is too large
Load Diff
2096
docs/htmldocs/samba-pdc-howto.html
Normal file
2096
docs/htmldocs/samba-pdc-howto.html
Normal file
File diff suppressed because it is too large
Load Diff
923
docs/textdocs/samba-pdc-faq.txt
Normal file
923
docs/textdocs/samba-pdc-faq.txt
Normal file
@ -0,0 +1,923 @@
|
|||||||
|
|
||||||
|
The Samba 2.2 PDC FAQ
|
||||||
|
|
||||||
|
David Bannon
|
||||||
|
|
||||||
|
La Trobe University
|
||||||
|
_________________________________________________________________
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Comments, corrections and additions to <D.Bannon@latrobe.edu.au>
|
||||||
|
|
||||||
|
This is the FAQ for Samba 2.2 as an NTDomain controller. This document
|
||||||
|
is derived from the origional FAQ that was built and maintained by
|
||||||
|
Gerald Carter from the early days of Samba NTDomain development up
|
||||||
|
until recently. It is now being updated as significent changes are
|
||||||
|
made to 2.2.0.
|
||||||
|
|
||||||
|
Please note it does not apply to Samba2.2alpha0, Samba2.2alpha1, Samba
|
||||||
|
2.0.7, TNG nor HEAD branch.
|
||||||
|
|
||||||
|
I'll repeat, it does not apply to the current snapshot [ftp
|
||||||
|
mirror]:/pub/samba/alpha/samba-2.2.0-alpha1.tar.gz, only to the to the
|
||||||
|
current cvs.
|
||||||
|
|
||||||
|
Also available is a Samba 2.2 PDC HowTo that takes you, step by step,
|
||||||
|
over the process of setting up a very basic Samba 2.2 Primary Domain
|
||||||
|
Controller
|
||||||
|
|
||||||
|
Note: Please read the Introduction for the current state of play.
|
||||||
|
|
||||||
|
Table of Contents
|
||||||
|
1. Introduction
|
||||||
|
|
||||||
|
State of Play
|
||||||
|
Introduction
|
||||||
|
|
||||||
|
2. General Information
|
||||||
|
|
||||||
|
What can we do ?
|
||||||
|
|
||||||
|
What can Samba Primary Domain Controller (PDC) do ?
|
||||||
|
Can I have a Windows 2000 client logon to a Samba
|
||||||
|
controlled domain?
|
||||||
|
|
||||||
|
What's the status of print spool (spoolss) support in the
|
||||||
|
NTDOM code?
|
||||||
|
|
||||||
|
CVS
|
||||||
|
|
||||||
|
What are the different Samba branches available in CVS ?
|
||||||
|
What are the CVS commands ?
|
||||||
|
|
||||||
|
3. Establishing Connections
|
||||||
|
|
||||||
|
How do I get my NT4 or W2000 Workstation to login to the
|
||||||
|
Samba controlled Domain?
|
||||||
|
|
||||||
|
What is a 'machine account' ?
|
||||||
|
"The machine account for this computer either does not
|
||||||
|
exist or is not accessable."
|
||||||
|
|
||||||
|
How do I create machine accounts manually ?
|
||||||
|
I cannot include a '$' in a machine name.
|
||||||
|
I get told "You already have a connection to the
|
||||||
|
Domain...." when creating a machine account.
|
||||||
|
|
||||||
|
I get told "Cannot join domain, the credentials supplied
|
||||||
|
conflict with an existing set.."
|
||||||
|
|
||||||
|
"The system can not log you on (C000019B)...."
|
||||||
|
|
||||||
|
4. User Account Management
|
||||||
|
|
||||||
|
Domain Admins
|
||||||
|
|
||||||
|
How do I configure an account as a domain administrator?
|
||||||
|
|
||||||
|
Profiles
|
||||||
|
|
||||||
|
Why is it bad to set "logon path = \\%N\%U\profile" in
|
||||||
|
smb.conf? ?
|
||||||
|
|
||||||
|
Why are all the users listed in the "domain admin users"
|
||||||
|
using the same profile?
|
||||||
|
|
||||||
|
The roaming profiles do not seem to be updating on the
|
||||||
|
server.
|
||||||
|
|
||||||
|
Policies
|
||||||
|
|
||||||
|
What are 'Policies' ?.
|
||||||
|
I can't get system policies to work.
|
||||||
|
What about Windows NT Policy Editor ?
|
||||||
|
Can Win95 do Policies ?
|
||||||
|
|
||||||
|
Passwords
|
||||||
|
|
||||||
|
What is password sync and should I use it ?
|
||||||
|
How do I get remote password (unix and SMB) changing
|
||||||
|
working ?
|
||||||
|
|
||||||
|
5. Miscellaneous
|
||||||
|
|
||||||
|
What editor can I use in DOS/Windows that won't mess with
|
||||||
|
my unix EOF
|
||||||
|
|
||||||
|
How do I get 'User Manager' and 'Server Manager'
|
||||||
|
The time setting from a Samba server does not work.
|
||||||
|
"trust account xxx should be in DOMAIN_GROUP_RID_USERS"
|
||||||
|
How do I get my samba server to become a member ( not PDC )
|
||||||
|
of an NT domain?
|
||||||
|
|
||||||
|
6. Troubleshooting and Bug Reporting
|
||||||
|
|
||||||
|
Diagnostic tools
|
||||||
|
|
||||||
|
What are some diagnostics tools I can use to debug the
|
||||||
|
domain logon process and where can I find them?
|
||||||
|
|
||||||
|
How do I install 'Network Monitor' on an NT Workstation or
|
||||||
|
a Windows 9x box?
|
||||||
|
|
||||||
|
What other help can I get ?
|
||||||
|
|
||||||
|
URLs and similar
|
||||||
|
How do I get help from the mailing lists ?
|
||||||
|
How do I get off the mailing lists ?
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 1. Introduction
|
||||||
|
|
||||||
|
State of Play
|
||||||
|
|
||||||
|
It should be noted that 2.2.0 in its pre-release form still has a few
|
||||||
|
problems, I'll try and keep this section current while things are
|
||||||
|
still dynamic. At the time of this update (November 13, 2000) the
|
||||||
|
current state of play is :
|
||||||
|
|
||||||
|
Comments here about W2K joining the domain apply only to Samba 2.2
|
||||||
|
from the CVS after November 27th. The 'snapshot' release
|
||||||
|
Samba2.2alpha1 does not work !!! See below on how to get a CVS tree.
|
||||||
|
|
||||||
|
Client Side creation of Machine accounts does work but is not
|
||||||
|
complete. Firstly, the add user script runs as the user who's name was
|
||||||
|
entered, not as root. Secondly, the machine name passed to the script
|
||||||
|
(%U) has an underscore at the end, not a '$'. One alternative is to
|
||||||
|
use %m and add the $. This method is documented in the HowTo. And
|
||||||
|
thirdly, it does not work with NT4ws.
|
||||||
|
|
||||||
|
A W2K machine can join the domain. See the HowTo which explains the
|
||||||
|
process. The methods described are 'work arounds' and should be
|
||||||
|
regarded as temporary. Although I (drb) have tested these procedures a
|
||||||
|
number of people have had difficulty so there may be other issues at
|
||||||
|
work. JFM is aware of these problems and will attend to them when he
|
||||||
|
can.
|
||||||
|
|
||||||
|
A Domain Admin account is required and at present it appears that only
|
||||||
|
root is a suitable candidate.
|
||||||
|
|
||||||
|
Much of the related code does work. For example, if an NT is removed
|
||||||
|
from the domain and then rejoins, the Create a Computer Account in the
|
||||||
|
Domain dialog will let you reset the smbpasswd. That is you don't need
|
||||||
|
to do it from the unix box. However, at the present, you do need to
|
||||||
|
have root as an administrator and use the root user name and password.
|
||||||
|
|
||||||
|
Actually I'm not sure that last paragraph is correct ....
|
||||||
|
|
||||||
|
Policies do work on a W2K machine. MS says that recent builds of W2K
|
||||||
|
dont observe an NT policy but it appears it does in 'legacy' mode.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Introduction
|
||||||
|
|
||||||
|
This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing
|
||||||
|
with the 'old head' version of Samba and its NTDomain facilities. It
|
||||||
|
is being rewritten by David Bannon (drb) so that it addresses more
|
||||||
|
accurately the Samba 2.2 planned for release late 2000.
|
||||||
|
|
||||||
|
This document probably still contains some material that does not
|
||||||
|
apply to Samba 2.2 but most (all?) of the really misleading stuff has
|
||||||
|
been removed. Some issues are not dealt with or are dealt with badly.
|
||||||
|
Please send corrections and additions to David Bannon at
|
||||||
|
D.Bannon@latrobe.edu.au
|
||||||
|
|
||||||
|
Hopefully, as we all become familiar with the Samba 2.2 as a PDC this
|
||||||
|
document will become much more usefull.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 2. General Information
|
||||||
|
|
||||||
|
What can we do ?
|
||||||
|
|
||||||
|
What can Samba Primary Domain Controller (PDC) do ?
|
||||||
|
|
||||||
|
If you wish to have Samba act as a PDC for Windows NT 3.51.and 4.0 or
|
||||||
|
W2000 client, then you will need to obtain the 2.2.0 version,
|
||||||
|
currently in pre-release. Release of a stable, full featured Samba PDC
|
||||||
|
is currently slated for version 3.0.
|
||||||
|
|
||||||
|
The following is a list of included features currently in Samba 2.2:
|
||||||
|
|
||||||
|
* The ability to act as a limited PDC for Windows NT and W2000
|
||||||
|
clients. This includes adding NT and W2K machines to the domain
|
||||||
|
and authenticating users logging into the domain.
|
||||||
|
* Domain account can be viewed using the User Manager for Domains
|
||||||
|
????
|
||||||
|
* Viewing resources on the Samba PDC via the Server Manager for
|
||||||
|
Domains from the NT client. ??
|
||||||
|
* Windows 95 clients will allow user level security to be set but
|
||||||
|
will not currently allow browsing of accounts.
|
||||||
|
* Machine account password updates.
|
||||||
|
* Changing of user passwords from an NT client.
|
||||||
|
* Partial support for Windows NT group and username mapping.
|
||||||
|
* Support for a LDAP password database backend.
|
||||||
|
* Printing.
|
||||||
|
|
||||||
|
These things are note expected to work in the forseeable future
|
||||||
|
* Trust relationships
|
||||||
|
* PDC and BDC integration
|
||||||
|
* Windows NT ACLs (on the Samba shares)
|
||||||
|
* Offer a list of domain users to User Manager for Domains (or the
|
||||||
|
Security Tab etc).
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Can I have a Windows 2000 client logon to a Samba controlled domain?
|
||||||
|
|
||||||
|
The 2.2 release branch of Samba supports Windows 2000 domain clients
|
||||||
|
in legacy mode, ie as if the PDC is a NTServer, not a W2K server.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
What's the status of print spool (spoolss) support in the NTDOM code?
|
||||||
|
|
||||||
|
The implementation of support for SPOOLSS pipe is complete and it will
|
||||||
|
be available in the 2.2.0 release. This means that Samba will support
|
||||||
|
the automatic downloading of printer drivers for Windows NT clients
|
||||||
|
just as it currently does for Windows 9x clients.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
CVS
|
||||||
|
|
||||||
|
CVS is a programme (publically available) that the Samba developers
|
||||||
|
use to maintain the central source code. Non developers can get access
|
||||||
|
to the source in a read only capacity. Many flavours of unix now
|
||||||
|
arrive with cvs installed.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
What are the different Samba branches available in CVS ?
|
||||||
|
|
||||||
|
You can find out more about obtaining Samba's via anonymous CVS from
|
||||||
|
http://pserver.samba.org/samba/cvs.html".
|
||||||
|
|
||||||
|
There are basically four branches to watch at the moment :
|
||||||
|
|
||||||
|
HEAD
|
||||||
|
Samba 3.0 ? This code boasts all the main development work in
|
||||||
|
Samba. Two things that most people are not aware of which live
|
||||||
|
in the HEAD branch code are winbind NSS module and Tim Potter's
|
||||||
|
VFS implementation. Due to its developmental nature, its not
|
||||||
|
really suitable for production work.
|
||||||
|
|
||||||
|
SAMBA_2_0
|
||||||
|
This branch contains the current stable release release. At the
|
||||||
|
moment it contains 2.0.7, a version that will do some limited
|
||||||
|
PDC stuff. If you are really going to do PDC things then I
|
||||||
|
(drb) suggest that you consider 2.2 instead.
|
||||||
|
|
||||||
|
SAMBA_2_2
|
||||||
|
The next stable release, currently in a 'alpha' form. It
|
||||||
|
provides the Samba developers, testers and interested people
|
||||||
|
with an approximation of what is to come. This document
|
||||||
|
addresses only SAMBA_2_2.
|
||||||
|
|
||||||
|
SAMBA_TNG
|
||||||
|
This branch is no longer maintained from the Samba sites.
|
||||||
|
Please see http://www.samba-tng.org/. It has been requested
|
||||||
|
that questions about TNG are not posted to the regular Samba
|
||||||
|
mailing lists including samba-ntdom and samba-technical.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
What are the CVS commands ?
|
||||||
|
|
||||||
|
See http://pserver.samba.org/samba/cvs.html
|
||||||
|
|
||||||
|
To get the Samba 2.2 version, tag SAMBA_2_2 you would do :
|
||||||
|
* For example : cd /usr/local/src/
|
||||||
|
* cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login
|
||||||
|
* When prompted enter a password of cvs
|
||||||
|
* cvs -d :pserver:cvs@pserver.samba.org:/cvsroot co -r SAMBA_2_2
|
||||||
|
samba
|
||||||
|
|
||||||
|
Then to update that directory at some later time,
|
||||||
|
* cd /usr/local/src/samba
|
||||||
|
* cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login
|
||||||
|
* When prompted enter a password of 'cvs'.
|
||||||
|
* cvs update -d -P
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 3. Establishing Connections
|
||||||
|
|
||||||
|
How do I get my NT4 or W2000 Workstation to login to the Samba controlled
|
||||||
|
Domain?
|
||||||
|
|
||||||
|
There is a comprehensive Samba PDC HowTo accessable from the samba web
|
||||||
|
site under 'Documentation'. Its currently located at
|
||||||
|
http://bioserve.latrobe.edu.au/samba. Read it.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
What is a 'machine account' ?
|
||||||
|
|
||||||
|
Every NT, W2K or Samba machine that joins a Samba controlled domain
|
||||||
|
must be known to the Samba PDC. There are two entries required, one in
|
||||||
|
(typically) /etc/passwd and the other in (typically)
|
||||||
|
/usr/local/samba/private/smbpasswd. Under some circumstances these
|
||||||
|
entries are made manually, the HowTo discusses ways of creating them
|
||||||
|
automatically.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
"The machine account for this computer either does not exist or is not
|
||||||
|
accessable."
|
||||||
|
|
||||||
|
When I try to join the domain I get the message "The machine account
|
||||||
|
for this computer either does not exist or is not accessable". Whats
|
||||||
|
wrong ?
|
||||||
|
|
||||||
|
This problem is caused by the PDC not having a suitable machine
|
||||||
|
account. If you are using the add user script = method to create
|
||||||
|
accounts then this would indicate that it has not worked. Ensure the
|
||||||
|
domain admin user system is working.
|
||||||
|
|
||||||
|
Alternatively if you are creating account entries manually then they
|
||||||
|
have not been created correctly. Make sure that you have the entry
|
||||||
|
correct for the machine account in smbpasswd file on the Samba PDC. If
|
||||||
|
you added the account using an editor rather than using the smbpasswd
|
||||||
|
utility, make sure that the account name is the machine netbios name
|
||||||
|
with a '$' appended to it ( ie. computer_name$ ). There must be an
|
||||||
|
entry in both /etc/passwd and the smbpasswd file. Some people have
|
||||||
|
reported that inconsistent subnet masks between the Samba server and
|
||||||
|
the NT client have caused this problem. Make sure that these are
|
||||||
|
consistent for both client and server.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
How do I create machine accounts manually ?
|
||||||
|
|
||||||
|
This was the only option until recently, now in version 2.2 better
|
||||||
|
means are available. You might still need to do it manually for a
|
||||||
|
couple of reasons. A machine account consists of two entries (assuming
|
||||||
|
a standard install and /etc/passwd use), one in /etc/passwd and the
|
||||||
|
other in /usr/local/samba/private/smbpasswd. The /etc/passwd entry
|
||||||
|
will list the machine name with a $ appended, won't have a passwd,
|
||||||
|
will have a null shell and no home directory. For example a machine
|
||||||
|
called 'doppy' would have an /etc/passwd entry like this :
|
||||||
|
|
||||||
|
doppy$:x:505:501:NTMachine:/dev/null:/bin/false
|
||||||
|
|
||||||
|
On a linux system for example, you would typically add it like this :
|
||||||
|
|
||||||
|
adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n doppy$
|
||||||
|
|
||||||
|
Then you need to add that entry to smbpasswd, assuming you have a
|
||||||
|
suitable path to the smbpasswd programme, do this :
|
||||||
|
|
||||||
|
smbpasswd -a -m doppy$
|
||||||
|
|
||||||
|
The entry will be created with a well known password, so any machine
|
||||||
|
that says its doppy could join the domain as long as it gets in first.
|
||||||
|
So don't create the accounts any earlier than you need them.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
I cannot include a '$' in a machine name.
|
||||||
|
|
||||||
|
A 'machine name' in (typically) /etc/passwd consists of the machine
|
||||||
|
name with a '$' appended. FreeBSD (and other BSD systems ?) won't
|
||||||
|
create a user with a '$' in their name.
|
||||||
|
|
||||||
|
The problem is only in the program used to make the entry, once made,
|
||||||
|
it works perfectly. So create a user without the '$' and use vipw to
|
||||||
|
edit the entry, adding the '$'. Or create the whole entry with vipw if
|
||||||
|
you like, make sure you use a unique uid !
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
I get told "You already have a connection to the Domain...." when creating a
|
||||||
|
machine account.
|
||||||
|
|
||||||
|
This happens if you try to create a machine account from the machine
|
||||||
|
itself and use a user name that does not work (for whatever reason)
|
||||||
|
and then try another (possibly valid) user name. Exit out of the
|
||||||
|
network applet to close the initial connection and try again.
|
||||||
|
|
||||||
|
Further, if the machine is a already a 'member of a workgroup' that is
|
||||||
|
the same name as the domain you are joining (bad idea) you will get
|
||||||
|
this message. Change the workgroup name to something else, it does not
|
||||||
|
matter what, reboot, and try again.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
I get told "Cannot join domain, the credentials supplied conflict with an
|
||||||
|
existing set.."
|
||||||
|
|
||||||
|
This is the same basic problem as mentioned above, "You already have a
|
||||||
|
connection..."
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
"The system can not log you on (C000019B)...."
|
||||||
|
|
||||||
|
I joined the domain successfully but after upgrading to a newer
|
||||||
|
version of the Samba code I get the message, "The system can not log
|
||||||
|
you on (C000019B), Please try a gain or consult your system
|
||||||
|
administrator" when attempting to logon.
|
||||||
|
|
||||||
|
This occurs when the domain SID stored in private/WORKGROUP.SID is
|
||||||
|
changed. For example, you remove the file and smbd automatically
|
||||||
|
creates a new one. Or you are swapping back and forth between versions
|
||||||
|
2.0.7, TNG and the HEAD branch code (not recommended). The only way to
|
||||||
|
correct the problem is to restore the original domain SID or remove
|
||||||
|
the domain client from the domain and rejoin.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 4. User Account Management
|
||||||
|
|
||||||
|
Domain Admins
|
||||||
|
|
||||||
|
How do I configure an account as a domain administrator?
|
||||||
|
|
||||||
|
See the NTDom HowTo.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Profiles
|
||||||
|
|
||||||
|
Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?
|
||||||
|
|
||||||
|
Sometimes Windows clients will maintain a connection to the \\homes\ (
|
||||||
|
or [%U] ) share even after the user has logged out. Consider the
|
||||||
|
following scenario.
|
||||||
|
|
||||||
|
* user1 logs into the Windows NT machine. Therefore the [homes]
|
||||||
|
share is set to \\server\user1.
|
||||||
|
* user1 works for a while and then logs out.
|
||||||
|
* user2 logs into the same Windows NT machine.
|
||||||
|
|
||||||
|
However, since the NT box has maintained a connection to [homes] which
|
||||||
|
was previously set to \\server\user1, when the operating system
|
||||||
|
attempts to get the profile and if it can read users1's profile, will
|
||||||
|
get it otherwise it will return an error. You get the picture.
|
||||||
|
|
||||||
|
A better solution is to use a separate [profiles] share and set the
|
||||||
|
"logon path = \\%N\profiles\%U"
|
||||||
|
|
||||||
|
Note: Is this still a problem ????
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Why are all the users listed in the "domain admin users" using the same
|
||||||
|
profile?
|
||||||
|
|
||||||
|
You are using a very very old development version of Samba. Upgrade.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
The roaming profiles do not seem to be updating on the server.
|
||||||
|
|
||||||
|
There can be several reasons for this.
|
||||||
|
|
||||||
|
Make sure that the time on the client and the PDC are synchronized.
|
||||||
|
You can accomplish this by executing a net time \\server /set /yes
|
||||||
|
replacing server with the name of your PDC (or another synchronized
|
||||||
|
SMB server). See about Setting Time
|
||||||
|
|
||||||
|
Make sure that the logon path is writeable by the user and make sure
|
||||||
|
that the connection to the logon path location is by the current user.
|
||||||
|
Sometimes Windows client do not drop the connection immediately upon
|
||||||
|
logoff.
|
||||||
|
|
||||||
|
Some people have reported that the logon path location should also be
|
||||||
|
browseable. I (GC) have yet to emperically verify this, but you can
|
||||||
|
try.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Policies
|
||||||
|
|
||||||
|
What are 'Policies' ?.
|
||||||
|
|
||||||
|
When a user logs onto the domain via a client machine, the PDC sends
|
||||||
|
the client machine a list of things contained in the 'policy' (if it
|
||||||
|
exists). This list may do things like suppress a splach screen, format
|
||||||
|
the dates the way you like them or perhaps remove locally stored
|
||||||
|
profiles.
|
||||||
|
|
||||||
|
On a samba PDC this list is obtained from a file called ntconfig.pol
|
||||||
|
and located in the [netlogon]share. The file is created with a policy
|
||||||
|
editor and must be readable by anyone and writeable by only root. See
|
||||||
|
below for how to get a suitable editor.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
I can't get system policies to work.
|
||||||
|
|
||||||
|
There are two possible reasons for system policies not functioning
|
||||||
|
correctly. Make sure that you have the following parameters set in
|
||||||
|
smb.conf
|
||||||
|
[netlogon]
|
||||||
|
....
|
||||||
|
locking = no
|
||||||
|
public = no
|
||||||
|
browseable = yes
|
||||||
|
....
|
||||||
|
|
||||||
|
|
||||||
|
A policy file must be in the [netlogon] share and must be readable by
|
||||||
|
everyone and writeable by only root. The file must be created by an
|
||||||
|
NTServer Policy Editor.
|
||||||
|
|
||||||
|
Last time I (drb) looked in the source, it was looking for
|
||||||
|
ntconfig.pol first then several other combinations of upper and lower
|
||||||
|
case. People have reported success using NTconfig.pol, NTconfig.POL
|
||||||
|
and ntconfig.pol. These are the case settings that I (GC) use with the
|
||||||
|
filename ntconfig.pol
|
||||||
|
case sensitive = no
|
||||||
|
case preserve = yes
|
||||||
|
default case = yes
|
||||||
|
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
What about Windows NT Policy Editor ?
|
||||||
|
|
||||||
|
To create or edit ntconfig.pol you must use the NT Server Policy
|
||||||
|
Editor, poledit.exe which is included with NT Server but not NT
|
||||||
|
Workstation. There is a Policy Editor on a NTws but it is not suitable
|
||||||
|
for creating Domain Policies. Further, although the Windows 95 Policy
|
||||||
|
Editor can be installed on an NT Workstation/Server, it will not work
|
||||||
|
with NT policies because the registry key that are set by the policy
|
||||||
|
templates. However, the files from the NT Server will run happily
|
||||||
|
enough on an NTws. You need poledit.exe, common.adm and winnt.adm. It
|
||||||
|
is convenient to put the two *.adm files in c:\winnt\inf which is
|
||||||
|
where the binary will look for them unless told otherwise. Note also
|
||||||
|
that that directory is 'hidden'.
|
||||||
|
|
||||||
|
The Windows NT policy editor is also included with the Service Pack 3
|
||||||
|
(and later) for Windows NT 4.0. Extract the files using
|
||||||
|
servicepackname /x, ie thats Nt4sp6ai.exe /x for service pack 6a. The
|
||||||
|
policy editor, poledt.exe and the associated template files (*.adm)
|
||||||
|
should be extracted as well. It is also possible to downloaded the
|
||||||
|
policy template files for Office97 and get a copy of the policy
|
||||||
|
editor. Another possible location is with the Zero Administration Kit
|
||||||
|
available for download from Microsoft.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Can Win95 do Policies ?
|
||||||
|
|
||||||
|
Install the group policy handler for Win9x to pick up group policies.
|
||||||
|
Look on the Win98 CD in \tools\reskit\netadmin\poledit. Install group
|
||||||
|
policies on a Win9x client by double-clicking grouppol.inf. Log off
|
||||||
|
and on again a couple of times and see if Win98 picks up group
|
||||||
|
policies. Unfortunately this needs to be done on every Win9x machine
|
||||||
|
that uses group policies....
|
||||||
|
|
||||||
|
If group policies don't work one reports suggests getting the updated
|
||||||
|
(read: working) grouppol.dll for Windows 9x. The group list is grabbed
|
||||||
|
from /etc/group.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Passwords
|
||||||
|
|
||||||
|
What is password sync and should I use it ?
|
||||||
|
|
||||||
|
NTws users can change their domain password by pressing Ctrl-Alt-Del
|
||||||
|
and choosing 'Change Password'. By default however, this does not
|
||||||
|
change the unix password (typically in /etc/passwd or /etc/shadow). In
|
||||||
|
lots of situations thats OK, for example :
|
||||||
|
|
||||||
|
* The server is only accessible to the user via samba.
|
||||||
|
* Pam_smb or similar is installed so other applications still refer
|
||||||
|
to the samba password.
|
||||||
|
|
||||||
|
But sometimes you really do need to maintain two seperate password
|
||||||
|
databases and there are good reasons to keep then in sync. Trying to
|
||||||
|
explain to users that they need to change their passwords in two
|
||||||
|
seperate places or use two seperate passwords is not fun.
|
||||||
|
|
||||||
|
However do understand that setting up password sync is not without
|
||||||
|
problems either. The chief difficulty is the interface between Samba
|
||||||
|
and the passwd command, it can be a fiddle to set up and if the
|
||||||
|
password the user has entered fails, the resulting errors are
|
||||||
|
ambiguously reported and the user is confused. Further, you need to
|
||||||
|
take steps to ensure that users only ever change their passwords via
|
||||||
|
samba (or use smbpasswd), otherwise they will only be changing the
|
||||||
|
unix password.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
How do I get remote password (unix and SMB) changing working ?
|
||||||
|
|
||||||
|
Have a practice changing a user's password (as root) to see what
|
||||||
|
discussion takes place and change the text in the 'passwd chat' line
|
||||||
|
below as necessary. The line as shown works for recent RH Linux but
|
||||||
|
most other systems seem to like to do something different. The '*' is
|
||||||
|
a wild card and will match anything (or nothing).
|
||||||
|
|
||||||
|
Add these lines to smb.conf under [Global]
|
||||||
|
|
||||||
|
|
||||||
|
unix password sync = true
|
||||||
|
passwd program = /usr/bin/passwd %u
|
||||||
|
passwd chat = *password* %n\n *password* %n\n *successful*
|
||||||
|
|
||||||
|
As mentioned above, the change to the unix password happens as root,
|
||||||
|
not as the user, as is indicated in ~/smbd/chgpasswd.c If you are
|
||||||
|
using NIS, the Samba server must be running on the NIS master machine.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 5. Miscellaneous
|
||||||
|
|
||||||
|
What editor can I use in DOS/Windows that won't mess with my unix EOF
|
||||||
|
|
||||||
|
There are a number of Windows or DOS based editors that will
|
||||||
|
understand, and leave intact, the unix eof (as opposed to a DOS
|
||||||
|
CL/LF). List members suggested :
|
||||||
|
|
||||||
|
* UltraEdit at www.ultraedit.com
|
||||||
|
* VI for windows at home.snafu.de/ramo/WinViEn.htm
|
||||||
|
* The author prefers PFE at www.lancs.ac.uk/people/cpaap/pfe/ but
|
||||||
|
its no longer being developed...
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
How do I get 'User Manager' and 'Server Manager'
|
||||||
|
|
||||||
|
Since I don't need to buy an NT Server CD now, how do I get the 'User
|
||||||
|
Manager for Domains', the 'Server Manager' ?
|
||||||
|
|
||||||
|
Microsoft distributes a version of these tools called nexus for
|
||||||
|
installation on Windows 95 systems. The tools set includes
|
||||||
|
* Server Manager
|
||||||
|
* User Manager for Domains
|
||||||
|
* Event Viewer
|
||||||
|
|
||||||
|
Click here to download the archived file
|
||||||
|
ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE
|
||||||
|
|
||||||
|
The Windows NT 4.0 version of the 'User Manager for Domains' and
|
||||||
|
'Server Manager' are available from Microsoft via ftp from
|
||||||
|
ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
The time setting from a Samba server does not work.
|
||||||
|
|
||||||
|
If it works OK when you log on as Domain Admin then the problem is
|
||||||
|
that ordinary users don't have permission to change the time. (The
|
||||||
|
system is running with their permission at logon time.) This is not a
|
||||||
|
Samba problem, you will have the same problem where ever you connect.
|
||||||
|
You can give 'everyone' permission to change the time from the User
|
||||||
|
Manager.
|
||||||
|
|
||||||
|
Anyone know what the registry settings are so this could be done with
|
||||||
|
a Policy ?
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
"trust account xxx should be in DOMAIN_GROUP_RID_USERS"
|
||||||
|
|
||||||
|
I keep getting the message "trust account xxx should be in
|
||||||
|
DOMAIN_GROUP_RID_USERS." in the logs. What do I need to do?
|
||||||
|
|
||||||
|
You are using one of the old development versions. Upgrade. (The
|
||||||
|
message is unimportant, was a reminder to a developer)
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
How do I get my samba server to become a member ( not PDC ) of an NT domain?
|
||||||
|
|
||||||
|
In a domain that has a number of servers you only need one password
|
||||||
|
database. The machines that don't have their own ask the PDC to check
|
||||||
|
for them. This will work fine for a domain controlled by either a
|
||||||
|
Samba or NT machine. The following lines in smb.conf are typical,
|
||||||
|
'password server' points to the samba machine (or an NT) that has the
|
||||||
|
password list :
|
||||||
|
|
||||||
|
|
||||||
|
[global]
|
||||||
|
...
|
||||||
|
security = domain
|
||||||
|
workgroup = { Put your domain name here }
|
||||||
|
password server = { Put the ip of the PDC here }
|
||||||
|
encrypt passwords = yes
|
||||||
|
...
|
||||||
|
|
||||||
|
The samba server in question will have to 'join the domain', that
|
||||||
|
requires the domain controller to have a machine account for it. This
|
||||||
|
is no different to the machine account requirements to allow a NTws to
|
||||||
|
join the domain. For example, if we want a unix box called sleepy to
|
||||||
|
ask the PDC called grumpy to do its authentication then grumpy will
|
||||||
|
need an entry in its smbpasswd (assuming it's also samba) that starts
|
||||||
|
with sleepy$. It would have to be created manually.
|
||||||
|
|
||||||
|
If the domain is controlled by an NTServer then the "Server Manager
|
||||||
|
for Domains" tool must be used to add 'sleepy' to the domain list.
|
||||||
|
|
||||||
|
In either case we then join the domain. If the domain is called forest
|
||||||
|
then on sleepy we would join the domain by typing :
|
||||||
|
|
||||||
|
smbpasswd -j forest
|
||||||
|
|
||||||
|
Note that the directory where the smbpasswd file would be located
|
||||||
|
should exist as this is where smbd will generate the MACHINE.SID file.
|
||||||
|
This might be /usr/local/samba/private/FOREST.SLEEPY.SID and it
|
||||||
|
contains the trust account password for the domain member. The
|
||||||
|
permissions are (and should remain) "rw-------
|
||||||
|
|
||||||
|
Note the Samba Servers without the password list will most likely
|
||||||
|
still need an account for each user, this means a line in its
|
||||||
|
/etc/passwd. Because authentication is being handled at the domain
|
||||||
|
level the /etc/passwd line does not need a password. If the shares
|
||||||
|
being offered are not user specific, ie a common (read only ?) area or
|
||||||
|
perhaps just printing then the user's /etc/passwd does not need a home
|
||||||
|
directory. A typical line in /etc/passwd for a server that allows
|
||||||
|
domain users to connect to the samba shares but does not offer a home
|
||||||
|
share ('cos that's on the PDC) and does not allow logon to the unix
|
||||||
|
prompt would be like this :
|
||||||
|
jblow:x:542:100:Joe Blow:/dev/null:/bin/false
|
||||||
|
|
||||||
|
* When removing those 'dummy' users, watch the 'remove user'
|
||||||
|
scripts, some OS think they should remove a users directory even
|
||||||
|
when its not owned by the user !
|
||||||
|
* The username map = parameter might help you to avoid having all
|
||||||
|
those accounts created.
|
||||||
|
* You should investigate the smb.conf parameter 'add user script',
|
||||||
|
it will be used to create accounts on secondary servers when that
|
||||||
|
account already exists on the PDC. Very nice. Something like :
|
||||||
|
[Global]
|
||||||
|
....
|
||||||
|
add user script = /usr/sbin/adduser -n -g users -c User -d /dev/null -s /bi
|
||||||
|
n/false %U
|
||||||
|
....
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 6. Troubleshooting and Bug Reporting
|
||||||
|
|
||||||
|
Diagnostic tools
|
||||||
|
|
||||||
|
What are some diagnostics tools I can use to debug the domain logon process
|
||||||
|
and where can I find them?
|
||||||
|
|
||||||
|
One of the best diagnostic tools for debugging problems is Samba
|
||||||
|
itself. You can use the -d option for both smbd and nmbd to specifiy
|
||||||
|
what 'debug level' at which to run. See the man pages on smbd, nmbd
|
||||||
|
and smb.conf for more information on debugging options. The debug
|
||||||
|
level can range from 1 (the default) to around 100 but a debug level
|
||||||
|
of about 20 will normally help you find any errors that samba is
|
||||||
|
encountering. Another helpful method of debugging is to compile samba
|
||||||
|
using the gcc -g flag. This will include debug information in the
|
||||||
|
binaries and allow you to attch gdb to the running smbd / nmbd
|
||||||
|
process. In order to attach gdb to an smbd process for an NT
|
||||||
|
workstation, first get the workstation to make the connection.
|
||||||
|
Pressing ctrl-alt-delete and going down to the domain box is
|
||||||
|
sufficient (at least, on the first time you join the domain) to
|
||||||
|
generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation
|
||||||
|
maintains an open connection, and therefore there will be an smbd
|
||||||
|
process running (assuming that you haven't set a really short smbd
|
||||||
|
idle timeout) So, in between pressing ctrl alt delete, and actually
|
||||||
|
typing in your password, you can gdb attach and continue.
|
||||||
|
|
||||||
|
Some usefull samba commands worth investigating:
|
||||||
|
* testparam | more
|
||||||
|
* smbclient -L //{netbios name of server}
|
||||||
|
|
||||||
|
An SMB enabled version of tcpdump is available from
|
||||||
|
ftp://samba.org/pub/samba/tcpdump-smb/
|
||||||
|
|
||||||
|
Capconvert is a small C program for translating output from
|
||||||
|
tcpdump-smb to CAP format that can be read by netmon. You will need to
|
||||||
|
use the raw output from tcp dump ( ie. tcpdump -w output.dump ). Good
|
||||||
|
news! Now you can convert Solaris' snoop output as well. The C source
|
||||||
|
code for snoop2cap is available for download.
|
||||||
|
|
||||||
|
For tracing things on the Microsoft Windows NT, Network Monitor (aka.
|
||||||
|
netmon) is available on the Microsoft Developer Network CD's, the
|
||||||
|
Windows NT Server install CD and the SMS CD's. The version of netmon
|
||||||
|
that ships with SMS allows for dumping packets between any two
|
||||||
|
computers (ie. placing the network interface in promiscuous mode). The
|
||||||
|
version on the NT Server install CD will only allow monitoring of
|
||||||
|
network traffic directed to the local NT box and broadcasts on the
|
||||||
|
local subnet.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?
|
||||||
|
|
||||||
|
Installing netmon on an NT workstation requires a couple of steps. The
|
||||||
|
following are for installing Netmon V4.00.349, which comes with
|
||||||
|
Microsoft Windows NT Server 4.0, on Microsoft Windows NT Workstation
|
||||||
|
4.0. The process should be similar for other version of Windows NT /
|
||||||
|
Netmon. You will need both the Microsoft Windows NT Server 4.0 Install
|
||||||
|
CD and the Workstation 4.0 Install CD.
|
||||||
|
|
||||||
|
Initially you will need to install 'Network Monitor Tools and Agent'
|
||||||
|
on the NT Server. To do this
|
||||||
|
|
||||||
|
* Goto Start - Settings - Control Panel - Network - Services - Add
|
||||||
|
* Select the 'Network Monitor Tools and Agent' and click on 'OK'.
|
||||||
|
* Click 'OK' on the Network Control Panel.
|
||||||
|
* Insert the Windows NT Server 4.0 install CD when prompted.
|
||||||
|
|
||||||
|
At this point the Netmon files should exist in
|
||||||
|
%SYSTEMROOT%\System32\netmon\*.*. Two subdirectories exist as well,
|
||||||
|
parsers\ which contains the necessary DLL's for parsing the netmon
|
||||||
|
packet dump, and captures\.
|
||||||
|
|
||||||
|
In order to install the Netmon tools on an NT Workstation, you will
|
||||||
|
first need to install the 'Network Monitor Agent' from the Workstation
|
||||||
|
install CD.
|
||||||
|
|
||||||
|
* Goto Start - Settings - Control Panel - Network - Services - Add
|
||||||
|
* Select the 'Network Monitor Agent' and click on 'OK'.
|
||||||
|
* Click 'OK' on the Network Control Panel.
|
||||||
|
* Insert the Windows NT Workstation 4.0 install CD when prompted.
|
||||||
|
|
||||||
|
Now copy the files from the NT Server in
|
||||||
|
%SYSTEMROOT%\System32\netmon\*.* to %SYSTEMROOT%\System32\netmon\*.*
|
||||||
|
on the Workstation and set permissions as you deem appropriate for
|
||||||
|
your site. You will need administrative rights on the NT box to run
|
||||||
|
netmon.
|
||||||
|
|
||||||
|
To install Netmon on a Windows 9x box install the network monitor
|
||||||
|
agent from the Windows 9x CD (\admin\nettools\netmon). There is a
|
||||||
|
readme file located with the netmon driver files on the CD if you need
|
||||||
|
information on how to do this. Copy the files from a working Netmon
|
||||||
|
installation.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
What other help can I get ?
|
||||||
|
|
||||||
|
There are many sources of information available in the form of mailing
|
||||||
|
lists, RFC's and documentation. The docs that come with the samba
|
||||||
|
distribution contain very good explanations of general SMB topics such
|
||||||
|
as browsing.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
URLs and similar
|
||||||
|
|
||||||
|
* Home of Samba site http://samba.org. We have a mirror near you !
|
||||||
|
* The Development document on the Samba mirrors might mention your
|
||||||
|
problem. If so, it might mean that the developers are working on
|
||||||
|
it.
|
||||||
|
* Ignacio Coupeau has a very comprehesive look at LDAP with Samba at
|
||||||
|
http://www.unav.es/cti/ldap-smb-howto.html Be a little carefull
|
||||||
|
however, I suspect that it does not specificly address samba
|
||||||
|
2.2.x. The HEAD pre-2.1 may possibly be the best stream to look
|
||||||
|
at.
|
||||||
|
* Lars Kneschke's site covers Samba-TNG at
|
||||||
|
http://www.kneschke.de/projekte/samba_tng, but again, a lot of it
|
||||||
|
does not apply to the main stream Samba.
|
||||||
|
* Although 2.0.7 has almost had its day as a PDC, I (drb) will keep
|
||||||
|
the 2.0.7 PDC pages at http://bioserve.latrobe.edu.au/samba going
|
||||||
|
for a while yet.
|
||||||
|
* Misc links to CIFS information http://samba.org/cifs/
|
||||||
|
* NT Domains for Unix http://mailhost.cb1.com/~lkcl/ntdom/
|
||||||
|
* FTP site for older SMB specs:
|
||||||
|
ftp://ftp.microsoft.com/developr/drg/CIFS/
|
||||||
|
|
||||||
|
There are a number of documents that no longer appear to live at their
|
||||||
|
origional home. Any one know where the following may be found ?
|
||||||
|
* CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt
|
||||||
|
* CIFS Remote Administration Protocol
|
||||||
|
draft-leach-cifs-rap-spec-00.txt
|
||||||
|
* CIFS Logon and Pass Through Authentication
|
||||||
|
draft-leach-cifs-logon-spec-00.txt
|
||||||
|
* A Common Internet File System (CIFS/1.0) Protocol
|
||||||
|
draft-leach-cifs-v1-spec-01.txt
|
||||||
|
* CIFS Printing Specification draft-leach-cifs-print-spec-00.txt
|
||||||
|
* RFC1001 (March '87) Protocol standard for a NetBIOS service on a
|
||||||
|
TCP/UDP transport: Concepts and methods.
|
||||||
|
http://ds.internic.net/rfc/rfc1001.txt
|
||||||
|
* RFC1002 (March '87) Protocol standard for a NetBIOS service on a
|
||||||
|
TCP/UDP transport: Detailed specifications.
|
||||||
|
http://ds.internic.net/rfc/rfc1002.txt
|
||||||
|
* Microsoft's main CIFS page:
|
||||||
|
http://www.microsoft.com/workshop/networking/cifs/
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
How do I get help from the mailing lists ?
|
||||||
|
|
||||||
|
There are a number of Samba related mailing lists. Go to
|
||||||
|
http://samba.org, click on your nearest mirror and then click on
|
||||||
|
Support and then click on Samba related mailing lists.
|
||||||
|
|
||||||
|
For questions relating to Samba TNG go to http://www.samba-tng.org/ It
|
||||||
|
has been requested that you don't post questions about Samba-TNG to
|
||||||
|
the main stream Samba lists.
|
||||||
|
|
||||||
|
If you post a message to one of the lists please observe the following
|
||||||
|
guide lines :
|
||||||
|
* Always remember that the developers are volunteers, they are not
|
||||||
|
paid and they never guarantee to produce a particular feature at a
|
||||||
|
particular time. Any time lines are 'best guess' and nothing more.
|
||||||
|
* Always mention what version of samba you are using and what
|
||||||
|
operating system its running under. You should probably list the
|
||||||
|
relevant sections of your smb.conf file, at least the options in
|
||||||
|
[global] that affect PDC support.
|
||||||
|
* In addition to the version, if you obtained Samba via CVS mention
|
||||||
|
the date when you last checked it out.
|
||||||
|
* Try and make your question clear and brief, lots of long,
|
||||||
|
convoluted questions get deleted before they are completely read !
|
||||||
|
Don't post html encoded messages (if you can select colour or font
|
||||||
|
size its html).
|
||||||
|
* If you run one of those niffy 'I'm on holidays' things when you
|
||||||
|
are away, make sure its configured to not answer mailing lists.
|
||||||
|
* Don't cross post. Work out which is the best list to post to and
|
||||||
|
see what happens, ie don't post to both samba-ntdom and
|
||||||
|
samba-technical. Many people active on the lists subscribe to more
|
||||||
|
than one list and get annoyed to see the same message two or more
|
||||||
|
times. Often someone will see a message and thinking it would be
|
||||||
|
better dealt with on another, will forward it on for you.
|
||||||
|
* You might include partial log files written at a debug level set
|
||||||
|
to as much as 20. Please don't send the entire log but enough to
|
||||||
|
give the context of the error messages.
|
||||||
|
* (Possibly) If you have a complete netmon trace ( from the opening
|
||||||
|
of the pipe to the error ) you can send the *.CAP file as well.
|
||||||
|
* Please think carefully before attaching a document to an email.
|
||||||
|
Consider pasting the relevant parts into the body of the message.
|
||||||
|
The samba mailing lists go to a huge number of people, do they all
|
||||||
|
need a copy of your smb.conf in their attach directory ?
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
How do I get off the mailing lists ?
|
||||||
|
|
||||||
|
To have your name removed from a samba mailing list, go to the same
|
||||||
|
place you went to to get on it. Go to http://samba.org, click on your
|
||||||
|
nearest mirror and then click on Support and then click on Samba
|
||||||
|
related mailing lists. Or perhaps see here
|
||||||
|
|
||||||
|
Please don't post messages to the list asking to be removed, you will
|
||||||
|
just be refered to the above address (unless that process failed in
|
||||||
|
some way...)
|
703
docs/textdocs/samba-pdc-howto.txt
Normal file
703
docs/textdocs/samba-pdc-howto.txt
Normal file
@ -0,0 +1,703 @@
|
|||||||
|
|
||||||
|
The Samba 2.2 PDC HowTo
|
||||||
|
|
||||||
|
David Bannon
|
||||||
|
|
||||||
|
La Trobe University
|
||||||
|
_________________________________________________________________
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Comments, corrections and additions to <D.Bannon@latrobe.edu.au>
|
||||||
|
|
||||||
|
This document explains how to setup Samba as a Primary Domain
|
||||||
|
Controller and applies to version 2.2.0. Before using these functions
|
||||||
|
make sure you understand what the controller can and cannot do. Please
|
||||||
|
read the sections below in the Introduction. As 2.2.0 is incrementally
|
||||||
|
updated this document will change or become out of date very quickly,
|
||||||
|
make sure you are reading the most current version.
|
||||||
|
|
||||||
|
Please note this document does not apply to Samba2.2alpha0,
|
||||||
|
Samba2.2alpha1, Samba 2.0.7, TNG nor HEAD branch.
|
||||||
|
|
||||||
|
It does apply to the current (post November 27th) cvs.
|
||||||
|
|
||||||
|
Also available is an updated version of Jerry Carter's NTDom FAQ that
|
||||||
|
will answer lots of the special 'tuning' questions that are not
|
||||||
|
covered here. Over the next couple of weeks some of the items here
|
||||||
|
will be moved to the FAQ.
|
||||||
|
|
||||||
|
Table of Contents
|
||||||
|
1. Introduction
|
||||||
|
|
||||||
|
What can we do ?
|
||||||
|
What can't we do ?
|
||||||
|
|
||||||
|
2. Installing
|
||||||
|
|
||||||
|
Start Up Script
|
||||||
|
Config File
|
||||||
|
|
||||||
|
A sample conf file
|
||||||
|
PDC Config Parameters
|
||||||
|
|
||||||
|
Special directories
|
||||||
|
|
||||||
|
3. User and Machine Accounts
|
||||||
|
|
||||||
|
Logon Accounts
|
||||||
|
Machine Accounts
|
||||||
|
Joining the Domain
|
||||||
|
User Accounts
|
||||||
|
Domain Admin Accounts
|
||||||
|
|
||||||
|
4. Profiles, Policies and Logon Scripts
|
||||||
|
|
||||||
|
Profiles
|
||||||
|
Policies
|
||||||
|
Logon Scripts
|
||||||
|
|
||||||
|
5. Passwords and Authentication
|
||||||
|
|
||||||
|
Syncing Passwords
|
||||||
|
Using PAM
|
||||||
|
Authenticating other Samba Servers
|
||||||
|
|
||||||
|
6. Background
|
||||||
|
|
||||||
|
History
|
||||||
|
The Future
|
||||||
|
Getting further help
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 1. Introduction
|
||||||
|
|
||||||
|
This document will show you one way of making Version 2.2.0 of Samba
|
||||||
|
perform some of the tasks of a NT Primary Domain Controller. The
|
||||||
|
facilities described are built into Samba as a result of development
|
||||||
|
work done over a number of years by a large number of people. These
|
||||||
|
facilities are only just beginning to be officially supported and
|
||||||
|
although they do appear to work reliably, if you use them then you
|
||||||
|
take the risks upon your self. This document does not cover the
|
||||||
|
developmental versions of Samba, particularly Samba-TNG
|
||||||
|
|
||||||
|
Note that Samba 2.0.7 supports significently less of the NT Domain
|
||||||
|
facilities compared with 2.2.0
|
||||||
|
|
||||||
|
This document does not replace the text files DOMAIN_CONTROL.txt,
|
||||||
|
DOMAIN.txt (by John H Terpstra) or NTDOMAIN.txt (by Luke Kenneth
|
||||||
|
Casson Leighton). Those documents provide more detail and an insight
|
||||||
|
to the development cycle and should be considered 'further reading'.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
What can we do ?
|
||||||
|
|
||||||
|
* Permit 'domain logons' for Win95/98, NT4 and W2K workstations from
|
||||||
|
one central password database. WRT W2K, please see the section
|
||||||
|
about adding machine accounts and the Intro in the FAQ.
|
||||||
|
* Grant Administrator privileges to particular domain users on an NT
|
||||||
|
or W2K workstation.
|
||||||
|
* Apply policies from a domain policy file to NT and W2K (?)
|
||||||
|
workstation.
|
||||||
|
* Run the appropriate logon script when a user logs on to the domain
|
||||||
|
.
|
||||||
|
* Maintain a user's local profile on the server.
|
||||||
|
* Validate a user using another system via smb (such as smb_pam) and
|
||||||
|
soon winbind (?).
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
What can't we do ?
|
||||||
|
|
||||||
|
* Become or work with a Backup Domain Controller (a BDC).
|
||||||
|
* Participate in any sort of trust relationship (with either Samba
|
||||||
|
or NT Servers).
|
||||||
|
* Offer a list of domain users to User Manager for Domains on the
|
||||||
|
Security Tab etc).
|
||||||
|
* Be a W2K type of Domain Controller. Samba PDC will behave like an
|
||||||
|
NT PDC, W2K workstations connect in legacy mode.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 2. Installing
|
||||||
|
|
||||||
|
Installing consists of the usual download, configure, make and make
|
||||||
|
install process. These steps are well documented elsewhere. The FAQ
|
||||||
|
discusses getting pre-release versions via CVS. Then you need to
|
||||||
|
configure the server.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Start Up Script
|
||||||
|
|
||||||
|
Skip this section if you have a working Samba already. Everyone has
|
||||||
|
their own favourite startup script. Here is mine, offered with no
|
||||||
|
warrantee at all !
|
||||||
|
|
||||||
|
|
||||||
|
#!/bin/sh
|
||||||
|
# Script to control Samba server, David Bannon, 14-6-96
|
||||||
|
#
|
||||||
|
#
|
||||||
|
PATH=/bin:/usr/sbin:/usr/bin
|
||||||
|
export PATH
|
||||||
|
case "$1" in
|
||||||
|
'start')
|
||||||
|
if [ -f /usr/local/samba/bin/smbd ]
|
||||||
|
then
|
||||||
|
/usr/local/samba/bin/smbd -D
|
||||||
|
/usr/local/samba/bin/nmbd -D
|
||||||
|
echo "Starting Samba Server"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
'conf')
|
||||||
|
if [ -f /usr/local/samba/lib/smb.conf ]
|
||||||
|
then
|
||||||
|
vi /usr/local/samba/lib/smb.conf
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
'pw')
|
||||||
|
if [ -f /usr/local/samba/private/smbpasswd ]
|
||||||
|
then
|
||||||
|
vi /usr/local/samba/private/smbpasswd
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
'who')
|
||||||
|
/usr/local/samba/bin/smbstatus -b
|
||||||
|
;;
|
||||||
|
'restart')
|
||||||
|
psline=`/bin/ps x | grep smbd | grep -v grep`
|
||||||
|
|
||||||
|
if [ "$psline" != "" ]
|
||||||
|
then
|
||||||
|
while [ "$psline" != "" ]
|
||||||
|
do
|
||||||
|
psline=`/bin/ps x | fgrep smbd | grep -v grep`
|
||||||
|
if [ "$psline" ]
|
||||||
|
then
|
||||||
|
set -- $psline
|
||||||
|
pid=$1
|
||||||
|
/bin/kill -HUP $pid
|
||||||
|
echo "Stopped $pid line = $psline"
|
||||||
|
sleep 2
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
echo "Stopped Samba servers"
|
||||||
|
;;
|
||||||
|
'stop')
|
||||||
|
psline=`/bin/ps x | grep smbd | grep -v grep`
|
||||||
|
|
||||||
|
if [ "$psline" != "" ]
|
||||||
|
then
|
||||||
|
while [ "$psline" != "" ]
|
||||||
|
do
|
||||||
|
psline=`/bin/ps x | fgrep smbd | grep -v grep`
|
||||||
|
if [ "$psline" ]
|
||||||
|
then
|
||||||
|
set -- $psline
|
||||||
|
pid=$1
|
||||||
|
/bin/kill -9 $pid
|
||||||
|
echo "Stopped $pid line = $psline"
|
||||||
|
sleep 2
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
echo "Stopped Samba servers"
|
||||||
|
psline=`/bin/ps x | grep nmbd | grep -v grep`
|
||||||
|
if [ "$psline" ]
|
||||||
|
then
|
||||||
|
set -- $psline
|
||||||
|
pid=$1
|
||||||
|
/bin/kill -9 $pid
|
||||||
|
echo "Stopped Name Server "
|
||||||
|
fi
|
||||||
|
echo "Stopped Name Servers"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "usage: samba {start | restart |stop | conf | pw | who}"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
|
||||||
|
Use this script, or some other one, you will need to ensure its used
|
||||||
|
while the machine is booting. (This typically involves /etc/rc.d,
|
||||||
|
we'll be assuming that there is a script called samba in
|
||||||
|
/etc/rc.d/init.d further down in this document.)
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Config File
|
||||||
|
|
||||||
|
A sample conf file
|
||||||
|
|
||||||
|
Here is a fairly minimal config file to do PDC. It will also make the
|
||||||
|
server become the browse master for the specified domain (not
|
||||||
|
necessary but usually desirable). You will need to change only two
|
||||||
|
parameters to make this file work, wins server and workgroup, plus you
|
||||||
|
will need to put your own name (not mine!) in the domain admin users
|
||||||
|
fields. Some of the parameters are discussed further down this
|
||||||
|
document.
|
||||||
|
|
||||||
|
Assuming you have used the default install directories, this file
|
||||||
|
should appear as /usr/local/samba/lib/smb.conf. It should not be
|
||||||
|
writable by anyone except root.
|
||||||
|
|
||||||
|
Note: The 'add user script' parameter is a work-around, watch for
|
||||||
|
changes !
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
[global]
|
||||||
|
security = user
|
||||||
|
status = yes
|
||||||
|
workgroup = { Your domain name here }
|
||||||
|
wins server = { ip of a wins server if you have one }
|
||||||
|
encrypt passwords = yes
|
||||||
|
domain logons =yes
|
||||||
|
logon script = scripts\%U.bat
|
||||||
|
domain admin users = root dbannon andrew
|
||||||
|
add user script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/n
|
||||||
|
ull -s /bin/false %m$
|
||||||
|
guest account = ftp
|
||||||
|
share modes=no
|
||||||
|
os level=65
|
||||||
|
[homes]
|
||||||
|
guest ok = no
|
||||||
|
read only = no
|
||||||
|
create mask = 0700
|
||||||
|
directory mask = 0700
|
||||||
|
oplocks = false
|
||||||
|
locking = no
|
||||||
|
[netlogon]
|
||||||
|
path = /usr/local/samba/netlogon
|
||||||
|
writeable = no
|
||||||
|
guest ok = no
|
||||||
|
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
PDC Config Parameters
|
||||||
|
|
||||||
|
There are a huge range of parameters that may appear in a smb.conf
|
||||||
|
file. Some that may be of interest to a PDC are :
|
||||||
|
|
||||||
|
add user script
|
||||||
|
This parameter specifies a script (or program) that will be run
|
||||||
|
to add a user to the system. Here it is being used to add a
|
||||||
|
machine, not a user. This is probably not very nice and may
|
||||||
|
change. But it does work !
|
||||||
|
|
||||||
|
For this example, I have a group called 'machines', entries can
|
||||||
|
be added to /etc/passwd using a programme called /usr/adduser
|
||||||
|
and the other parameters are chosen as suitable for a machine
|
||||||
|
account. Works for RH Linux, your system may require changes.
|
||||||
|
|
||||||
|
domain admin users = user1 users2
|
||||||
|
This parameter specifies a unix user who will be granted admin
|
||||||
|
privileges on a NT workstation when logged onto that
|
||||||
|
workstation. See the section called Domain Admin Accounts.
|
||||||
|
|
||||||
|
encrypt passwords = yes
|
||||||
|
This parameter must be 'yes' to allow any of the recent service
|
||||||
|
pack NTs to logon. There are some reg hacks that turn off
|
||||||
|
encrypted passwords on the NTws itself but if you are going to
|
||||||
|
use the smbpasswd system (and you should) you must use
|
||||||
|
encrypted passwords.
|
||||||
|
|
||||||
|
logon script = scripts\%U.bat
|
||||||
|
This will make samba look for a logon script named after the
|
||||||
|
user (eg joeblow.bat). See the section further on called Logon
|
||||||
|
Scripts
|
||||||
|
|
||||||
|
Note: Note that the slash is like this '\', not like this '/'. NT
|
||||||
|
is happy with both, win95 is not !
|
||||||
|
|
||||||
|
logon path
|
||||||
|
Lets you specify where you would like users profiles kept. The
|
||||||
|
default, that is in the users home directory, does encourage a
|
||||||
|
bit of fiddling.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Special directories
|
||||||
|
|
||||||
|
You need to create a couple of special files and directories. Its nice
|
||||||
|
to have some of the binaries handy too, so I create links to them.
|
||||||
|
Assuming you have used the default samba location and have not changed
|
||||||
|
the locations mentioned in the sample config file, do the following :
|
||||||
|
|
||||||
|
|
||||||
|
mkdir /usr/local/samba/netlogon
|
||||||
|
mkdir /usr/local/samba/netlogon/scripts
|
||||||
|
mkdir /usr/local/samba/private
|
||||||
|
touch /usr/local/samba/private/smbpasswd
|
||||||
|
chmod go-rwx /usr/local/samba/private/smbpasswd
|
||||||
|
cd /usr/local/sbin
|
||||||
|
ln -s /usr/local/samba/bin/smbpasswd
|
||||||
|
ln -s /usr/local/samba/bin/smbclient
|
||||||
|
ln -s /etc/rc.d/init.d/samba
|
||||||
|
|
||||||
|
Make sure permissions are appropriate !
|
||||||
|
|
||||||
|
OK, if you have used the scripts above and have a path to where the
|
||||||
|
links are do this to start up the Samba Server :
|
||||||
|
|
||||||
|
samba start
|
||||||
|
|
||||||
|
Instead, you might like to reboot the machine to make sure that you
|
||||||
|
got the init stuff right. Any way, a quick look in the logs
|
||||||
|
/usr/local/samba/var/log.smbd and /usr/local/samba/var/log/nmbd will
|
||||||
|
give you an idea of what's happening. Assuming all is well, lets
|
||||||
|
create some accounts...
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 3. User and Machine Accounts
|
||||||
|
|
||||||
|
Logon Accounts
|
||||||
|
|
||||||
|
This section is very nearly out of date already ! It appears that
|
||||||
|
while you are reading it, Jean Francois Micou is making it redundant !
|
||||||
|
Jean Francois is adding facilities to add users (via User Manager) and
|
||||||
|
machines (when joining the domain) and it looks like these facilities
|
||||||
|
will make it into the official release of 2.2.
|
||||||
|
|
||||||
|
Every user and NTws (and other samba servers) that will be on the
|
||||||
|
domain must have its own passwd entry in both /etc/passwd and
|
||||||
|
/usr/local/samba/private/smbpasswd . The /etc/passwd entry is really
|
||||||
|
only to reserve a user ID. The NT encrypted password is stored in
|
||||||
|
/usr/local/samba/private/smbpasswd. (Note that win95/98 machines don't
|
||||||
|
need an account as they don't do any security aware things.)
|
||||||
|
|
||||||
|
Samba 2.2 will now create these entries for us. Carefull set up is
|
||||||
|
required and there may well be some changes to this system before its
|
||||||
|
released.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Machine Accounts
|
||||||
|
|
||||||
|
Note: There is an entry in the ntdom FAQ explaining how to create
|
||||||
|
machine entries manually.
|
||||||
|
|
||||||
|
At present to have the machine accounts created when a machine joins
|
||||||
|
the domain a number of conditions must be met :
|
||||||
|
|
||||||
|
Only root can do it !
|
||||||
|
There must be an entry in /usr/local/samba/private/smbpasswd
|
||||||
|
for root and root must be mentioned in domain admins. This may
|
||||||
|
be fixed some time in the future so any 'domain admin' can do
|
||||||
|
it. If you don't like having root as a windows logon account,
|
||||||
|
make the machine entries manually (both of them).
|
||||||
|
|
||||||
|
Use the add user script
|
||||||
|
Again, this looks a bit like a 'work around'. Use a suitable
|
||||||
|
command line to add a machine account see above, and pass it
|
||||||
|
%m$, that is %m to get machine name plus the '$'. Now, this
|
||||||
|
means you cannot use the add user script to really add users
|
||||||
|
....
|
||||||
|
|
||||||
|
Only for W2K
|
||||||
|
This automatic creation of machine accounts does not work for
|
||||||
|
NT4ws at present. Watch this space.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Joining the Domain
|
||||||
|
|
||||||
|
You must have either added the machine account entries manually (NT4
|
||||||
|
ws) or set up the automatic system (W2K), see Machine Accounts before
|
||||||
|
proceeding.
|
||||||
|
|
||||||
|
Windows NT
|
||||||
|
|
||||||
|
+ (this step may not be necessary some time in the near
|
||||||
|
future). On the samba server that is the PDC, add a machine
|
||||||
|
account manually as per the instructions in the FAQ Then give
|
||||||
|
the command smbpasswd -a -m {machine} substituting in the
|
||||||
|
client machine name.
|
||||||
|
+ Logon to the NTws in question as a local admin, go to the
|
||||||
|
Control Panel, Network IdentificationTag.
|
||||||
|
+ Press the Change button.
|
||||||
|
+ Enter the Domain name (from the 'Workgroup' parameter,
|
||||||
|
smb.conf) in the Domain Field.
|
||||||
|
+ Press OK and after a few seconds you will get a 'Welcome to
|
||||||
|
Whatever Domain'. Allow to reboot.
|
||||||
|
|
||||||
|
Windows 2000
|
||||||
|
|
||||||
|
+ Logon to the W2k machine as Administrator, go to the Control
|
||||||
|
Panel and double click on Network and Dialup Connections.
|
||||||
|
+ Pull down the Advanced menu and choose Network
|
||||||
|
Identification. Press Properties .
|
||||||
|
+ Choose Domain and enter the domain name. Press 'OK'.
|
||||||
|
+ Now enter a user name and password for a Domain Admin (Who
|
||||||
|
must be root until a pre-release bug is fixed) and press
|
||||||
|
'OK'.
|
||||||
|
+ Wait for the confirmation, reboot when prompted.
|
||||||
|
|
||||||
|
To remove a W2K machine from the domain, follow the first two
|
||||||
|
steps then choose Workgroup, enter a work group name (or just
|
||||||
|
WORKGROUP) and follow the prompts.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
User Accounts
|
||||||
|
|
||||||
|
Again, doing it manually (cos' the auto way is not working
|
||||||
|
pre-release). In our simple case every domain user should have an
|
||||||
|
account on the PDC. The account may have a null shell if they are not
|
||||||
|
allowed to log on to the unix prompt. Again they need an entry in both
|
||||||
|
the /etc/passwd and /usr/local/samba/private/smbpasswd. Again a
|
||||||
|
password is not necessary in /etc/passwd but the location of the home
|
||||||
|
directory is honoured. To make an entry for a user called Joe Blow you
|
||||||
|
would typically do the following :
|
||||||
|
|
||||||
|
adduser -g users -c 'Joe Blow' -s /bin/false -n joeblow
|
||||||
|
|
||||||
|
smbpasswd -a joeblow
|
||||||
|
|
||||||
|
And you will prompted to enter a password for Joe. Ideally he will be
|
||||||
|
hovering over your shoulder and will, when asked, type in a password
|
||||||
|
of his choice. There are a number of scripts and systems to ease the
|
||||||
|
migration of users from somewhere to samba. Better start looking !
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Domain Admin Accounts
|
||||||
|
|
||||||
|
Certain operations demand that the logged on user has Administrator
|
||||||
|
privileges, typically installing software and doing maintenance tasks.
|
||||||
|
It is very simple to appoint some users as Domain Admins, most likely
|
||||||
|
yourself. Make sure you trust the appointee !
|
||||||
|
|
||||||
|
Samba 2.2 recognizes particular users as being domain admins and tells
|
||||||
|
the NTws when it thinks that it has got one logged on. In the smb.conf
|
||||||
|
file we declare that the Domain Admin users = user1 user2. Any user
|
||||||
|
mentioned here will be treated as a Domain Admin by a NTws when logged
|
||||||
|
onto the Domain. They will have full Administrator rights including
|
||||||
|
the rights to change permissions on files and run the system utilities
|
||||||
|
such as Disk Administrator.
|
||||||
|
|
||||||
|
Further, and this is very new, they will be allowed to create a new
|
||||||
|
machine account when first connecting a new NT or W2K machine to the
|
||||||
|
domain. At present, ie pre-release, only a Domain Admin who also
|
||||||
|
happens to be root can do so.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 4. Profiles, Policies and Logon Scripts
|
||||||
|
|
||||||
|
Profiles
|
||||||
|
|
||||||
|
NT Profiles should work if you have followed the setup so far. A
|
||||||
|
user's profile contains a whole lot of their personal settings, the
|
||||||
|
contents of their desktop, personal 'My Documents' and so on. When
|
||||||
|
they log off, all of the profile is copied to their directory on the
|
||||||
|
server and is downloaded again when they logon on again, possibly on
|
||||||
|
another client machine.
|
||||||
|
|
||||||
|
Sounds great but can be a bit of a bug bear sometimes. Users let their
|
||||||
|
profiles get too big and then complain about how long it takes to log
|
||||||
|
on each time. This sample setup only supports NT profiles, rumor has
|
||||||
|
it that it is also possible to do the same on Win95, my users don't
|
||||||
|
know and I'm not telling them.
|
||||||
|
|
||||||
|
Note: There is more info about Profiles (including for W95/98) in
|
||||||
|
the FAQ.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Policies
|
||||||
|
|
||||||
|
Policies are an easy way to make or enforce specific characteristics
|
||||||
|
across your network. You create a ntconfig.pol file and every time
|
||||||
|
someone logs on with their NTws, the settings you put in ntconfig.pol
|
||||||
|
are applied to the NTws. Typical setting are things like making the
|
||||||
|
date appear the way you want it (none of these 2 figure years here) or
|
||||||
|
maybe suppressing one of the splash screens. Perhaps you want to set
|
||||||
|
the NTws so it does not keep users profiles on the local machine.
|
||||||
|
Cool. The only problem is making the ntconfig.pol file itself. You
|
||||||
|
cannot use the policy editor that comes with NTws.
|
||||||
|
|
||||||
|
Note: See the FAQ for pointers on how to get a suitable Policy
|
||||||
|
Editor.
|
||||||
|
|
||||||
|
The Policy Editor (and associated files) will create a ntconfig.pol
|
||||||
|
file using the parameters Microsoft thought of and parameters you
|
||||||
|
specify by making your own template file.
|
||||||
|
|
||||||
|
In our example configuration here, Samba will expect to find the
|
||||||
|
ntconfig.pol file in /usr/local/samba/netlogon. Needless to say (I
|
||||||
|
hope !), it is vitally important that ordinary users don't have write
|
||||||
|
permission to the Policy files.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Logon Scripts
|
||||||
|
|
||||||
|
In the sample config file above there is a line logon script =
|
||||||
|
scripts\%U.bat
|
||||||
|
|
||||||
|
Note: Note that the slash is like this '\' not like this '/'. NT is
|
||||||
|
happy with both, win95 is not !
|
||||||
|
|
||||||
|
This allows you to run a dos batch file every time someone logs on.
|
||||||
|
The batch file is located on the server, in the sample install
|
||||||
|
mentioned here, its in /usr/local/samba/netlogon/scripts and is named
|
||||||
|
after the user with .bat appended, eg Joe Blow's script is called
|
||||||
|
/usr/local/samba/netlogon/scripts/joeblow.bat.
|
||||||
|
|
||||||
|
Note: There is a suggestion that user names longer than 8
|
||||||
|
characters may cause problems with some systems being unable to run
|
||||||
|
logon scripts. This is confirmed in earlier versions when
|
||||||
|
connecting using W95, comments about other combinations ??
|
||||||
|
|
||||||
|
You could use a line like this logon script = default.bat and samba
|
||||||
|
will supply /usr/local/samba/netlogon/default.bat for any client and
|
||||||
|
every user. Maybe you could use %m and get a client machine dependant
|
||||||
|
logon script. You get the idea...
|
||||||
|
|
||||||
|
Note that the file is a dos batch file not a Unix script. It runs dos
|
||||||
|
commands on the client computer with the logon user's permissions. It
|
||||||
|
must be a dos file with each line ending with the dos cr/lf not a nice
|
||||||
|
clean newline. Generally, its best to create the initial file on a DOS
|
||||||
|
system and copy it across.
|
||||||
|
|
||||||
|
There is lots of very clever uses of the Samba replaceable variables
|
||||||
|
such ( %U = user, %G = primary group, %H = client machine, see the
|
||||||
|
'man 5 smb.conf') to give you control over which script runs when a
|
||||||
|
particular person logs on. (Gee, it would be nice to have a
|
||||||
|
default.bat run when nothing else is available.)
|
||||||
|
|
||||||
|
Again, it is vitally important that ordinary users don't have write
|
||||||
|
permission to other peoples, or even probably their own, logon script
|
||||||
|
files.
|
||||||
|
|
||||||
|
A typical logon script is reproduced below. Note that it runs separate
|
||||||
|
commands for win95 and NT, that's because NT has slightly different
|
||||||
|
behaviour when using the net use .. command. Its useful for lots of
|
||||||
|
other situations too. I don't know what syntax to use for win98, I
|
||||||
|
don't use it here.
|
||||||
|
|
||||||
|
|
||||||
|
rem Default logon script, create links to this file.
|
||||||
|
|
||||||
|
net time \\bioserve /set /yes
|
||||||
|
@echo off
|
||||||
|
if %OS%.==Windows_NT. goto WinNT
|
||||||
|
|
||||||
|
:Win95
|
||||||
|
net use k: \\trillion\bio_prog
|
||||||
|
net use p: \\bcfile\homes
|
||||||
|
goto end
|
||||||
|
:WinNT
|
||||||
|
net use k: \\trillion\bio_prog /persistent:no
|
||||||
|
net use p: \\bcfile\homes /persistent:no
|
||||||
|
|
||||||
|
:end
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 5. Passwords and Authentication
|
||||||
|
|
||||||
|
So far our configuration assumes that ordinary users don't have unix
|
||||||
|
logon access. A change to the adduser line above would allow unix
|
||||||
|
logon but it would be with passwords that may be different from the NT
|
||||||
|
logon. Clearly that won't suit everyone. Trying to explain to users
|
||||||
|
that they need to change their passwords in two seperate places is not
|
||||||
|
fun. Further, even if they cannot do a unix logon there are other
|
||||||
|
processes that might require authentication. We have a nice securely
|
||||||
|
encrypted password in /usr/local/samba/private/smbpasswd, why not use
|
||||||
|
it ?
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Syncing Passwords
|
||||||
|
|
||||||
|
Yes, its possible and seems the easiest way (initially anyway). The
|
||||||
|
FAQ details how to do so in the sections What is password sync and
|
||||||
|
should I use it ? and How do I get remote password (unix and SMB)
|
||||||
|
changing working ?
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Using PAM
|
||||||
|
|
||||||
|
Pam enabled systems have a much better solution available. The Samba
|
||||||
|
PDC server will offer to authenticate domain users to other processes
|
||||||
|
(either on this server or on the domain). With a suitable pam stack
|
||||||
|
such as Pam_smb you can get any pam aware application looking to the
|
||||||
|
samba password and can leave the password field in /etc/shadow or
|
||||||
|
/etc/passwd invalid.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Authenticating other Samba Servers
|
||||||
|
|
||||||
|
In a domain that has a number of servers you only need one password
|
||||||
|
database. The machines that don't have their own ask the PDC to check
|
||||||
|
for them. This will work fine for a domain controlled by either a
|
||||||
|
Samba or NT machine.
|
||||||
|
|
||||||
|
To do so the Samba machine must be told to refer to the PDC and where
|
||||||
|
the PDC is. See the section in the NTDom FAQ called How do I get my
|
||||||
|
samba server to become a member ( not PDC ) of an NT domain?
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Chapter 6. Background
|
||||||
|
|
||||||
|
History
|
||||||
|
|
||||||
|
It might help you understand the limitations of the PDC in Samba if
|
||||||
|
you read something of its history. Well, the history as I understand
|
||||||
|
it anyway.
|
||||||
|
|
||||||
|
For many years the Samba team have been developing Samba, some time
|
||||||
|
ago a number of people, possibly lead by Luke Leighton started
|
||||||
|
contributing NT PDC stuff. This was added to the 'head' stream (that
|
||||||
|
would eventually become the next version) and later to a seperate
|
||||||
|
stream (NTDom). They did so much that eventually this development
|
||||||
|
stream was so mutated that it could not be merged back into the main
|
||||||
|
stream and was abandoned towards the end of 1999. And that was very
|
||||||
|
sad because many users, myself include had become heavily dependant on
|
||||||
|
the NTController facilities it offered. Oh well...
|
||||||
|
|
||||||
|
The NTDom team continued on with their new found knowledge however and
|
||||||
|
built the TNG stream. Intended to be carefully controlled so that it
|
||||||
|
can be merged back into the main stream and benefiting from what they
|
||||||
|
learnt, it is a very different product to the origional NTDom product.
|
||||||
|
However, for a number of reasons, the merge did not take place and now
|
||||||
|
TNG is being developed at http://www.samba-tng.org.
|
||||||
|
|
||||||
|
Now, the NTDom things that the main strean 2.0.x version does is based
|
||||||
|
more on the old (initial version) abandoned code than on the TNG
|
||||||
|
ideas. It appears that version 2.2.0 will also include an improved
|
||||||
|
version of the 2.0.7 domain controller charactistics, not the TNG
|
||||||
|
ways. The developers have indicated that 2.2.0 will be further
|
||||||
|
developed incrementally and the ideas from TNG incorporated into it.
|
||||||
|
|
||||||
|
One more little wriggle is worth mentioning. At one stage the NTDom
|
||||||
|
stream was called Samba 2.1.0-prealpha and similar names. This is most
|
||||||
|
unfortunate because at least one book published advises people who
|
||||||
|
want to use NTDom Samba to get version 2.1.0 or later. As main stream
|
||||||
|
Samba will soon be called 2.2.0 and NOT officially supporting NTDom
|
||||||
|
Controlling functions, the potential for confusion is certainly there.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
The Future
|
||||||
|
|
||||||
|
There is a document on the Samba mirrors called 'Development' . It
|
||||||
|
offers the 'best guess' of what is planned for future releases of
|
||||||
|
Samba.
|
||||||
|
|
||||||
|
The future of Samba as a Primary Domain Controller appears rosie,
|
||||||
|
however be aware that its the future, not the present. The developers
|
||||||
|
are strongly committed to building a full featured PDC into Samba but
|
||||||
|
it will take time. If this version does not meet your requirements
|
||||||
|
then you should consider (in no particular order) :
|
||||||
|
|
||||||
|
* Wait. No, we don't know how long. Repeated asking won't help.
|
||||||
|
* Investigate the development versions, TNG perhaps or HEAD where
|
||||||
|
new code is being added all the time. Realise that development
|
||||||
|
code is often unstable, poorly documented and subject to change.
|
||||||
|
You will need to use cvs to download development versions.
|
||||||
|
* Join one of the Samba mailing lists so that you can find out what
|
||||||
|
is happening on the 'bleeding edge'.
|
||||||
|
_________________________________________________________________
|
||||||
|
|
||||||
|
Getting further help
|
||||||
|
|
||||||
|
This document cannot possibly answer all your questions. Please
|
||||||
|
understand that its very likely that someone has been confrounted by
|
||||||
|
the same problem that you have. The FAQ discusses a number of possible
|
||||||
|
paths to take to get further help :
|
||||||
|
|
||||||
|
* Documents on the Samba Sites.
|
||||||
|
* Other web sites.
|
||||||
|
* Mailing list.
|
||||||
|
|
||||||
|
There is some discussion about guide lines for using the Mailing Lists
|
||||||
|
on the accompanying FAQ, please read them before posting.
|
Loading…
Reference in New Issue
Block a user