mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
doc: Remove documentation for obsolete ldapsam_compat.
This commit is contained in:
Andreas Schneider
parent
02c239c6d3
commit
571a4b6cd2
@ -827,73 +827,11 @@ The recommended passdb backends at this time are
|
||||
replacement for stand alone servers
|
||||
* ldapsam - attribute rich account storage and retrieval
|
||||
backend utilizing an LDAP directory.
|
||||
* ldapsam_compat - a 2.2 backward compatible LDAP account
|
||||
backend
|
||||
|
||||
Certain functions of the smbpasswd(8) tool have been split between the
|
||||
new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8)
|
||||
utility. See the respective man pages for details.
|
||||
|
||||
######################################################################
|
||||
LDAP
|
||||
####
|
||||
|
||||
This section outlines the new features affecting Samba / LDAP
|
||||
integration.
|
||||
|
||||
New Schema
|
||||
----------
|
||||
|
||||
A new object class (sambaSamAccount) has been introduced to replace
|
||||
the old sambaAccount. This change aids us in the renaming of
|
||||
attributes to prevent clashes with attributes from other vendors.
|
||||
There is a conversion script (examples/LDAP/convertSambaAccount) to
|
||||
modify and LDIF file to the new schema.
|
||||
|
||||
Example:
|
||||
|
||||
$ ldapsearch .... -b "ou=people,dc=..." > sambaAcct.ldif
|
||||
$ convertSambaAccount --sid=<Domain SID> \
|
||||
--input=sambaAcct.ldif --output=sambaSamAcct.ldif \
|
||||
--changetype=[modify|add]
|
||||
|
||||
The <DOM SID> can be obtained by running 'net getlocalsid
|
||||
<DOMAINNAME>' on the Samba PDC as root. The changetype determines
|
||||
the format of the generated LDIF output--either create new entries
|
||||
or modify existing entries.
|
||||
|
||||
The old sambaAccount schema may still be used by specifying the
|
||||
"ldapsam_compat" passdb backend. However, the sambaAccount and
|
||||
associated attributes have been moved to the historical section of
|
||||
the schema file and must be uncommented before use if needed.
|
||||
The 2.2 object class declaration for a sambaAccount has not changed
|
||||
in the 3.0 samba.schema file.
|
||||
|
||||
Other new object classes and their uses include:
|
||||
|
||||
* sambaDomain - domain information used to allocate rids
|
||||
for users and groups as necessary. The attributes are added
|
||||
in 'ldap suffix' directory entry automatically if
|
||||
an idmap uid/gid range has been set and the 'ldapsam'
|
||||
passdb backend has been selected.
|
||||
|
||||
* sambaGroupMapping - an object representing the
|
||||
relationship between a posixGroup and a Windows
|
||||
group/SID. These entries are stored in the 'ldap
|
||||
group suffix' and managed by the 'net groupmap' command.
|
||||
|
||||
* sambaUnixIdPool - created in the 'ldap idmap suffix' entry
|
||||
automatically and contains the next available 'idmap uid' and
|
||||
'idmap gid'
|
||||
|
||||
* sambaIdmapEntry - object storing a mapping between a
|
||||
SID and a UNIX uid/gid. These objects are created by the
|
||||
idmap_ldap module as needed.
|
||||
|
||||
* sambaSidEntry - object representing a SID alone, as a Structural
|
||||
class on which to build the sambaIdmapEntry.
|
||||
|
||||
|
||||
New Suffix for Searching
|
||||
------------------------
|
||||
|
||||
|
||||
@ -67,14 +67,6 @@ entities.
|
||||
<sect1>
|
||||
<title>Features and Benefits</title>
|
||||
|
||||
<para>
|
||||
Samba-3 provides for complete backward compatibility with Samba-2.2.x functionality
|
||||
as follows:
|
||||
<indexterm><primary>SAM backend</primary><secondary>smbpasswd</secondary></indexterm>
|
||||
<indexterm><primary>SAM backend</primary><secondary>ldapsam_compat</secondary></indexterm>
|
||||
<indexterm><primary>encrypted passwords</primary></indexterm>
|
||||
</para>
|
||||
|
||||
<sect2>
|
||||
<title>Backward Compatibility Account Storage Systems</title>
|
||||
|
||||
@ -120,21 +112,6 @@ as follows:
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry><term>ldapsam_compat (Samba-2.2 LDAP Compatibility)</term>
|
||||
<listitem>
|
||||
<para>
|
||||
<indexterm><primary>ldapsam_compat</primary></indexterm>
|
||||
<indexterm><primary>Samba-2.2.x LDAP schema</primary></indexterm>
|
||||
<indexterm><primary>OpenLDAP backend</primary></indexterm>
|
||||
There is a password backend option that allows continued operation with
|
||||
an existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension.
|
||||
This option is provided primarily as a migration tool, although there is
|
||||
no reason to force migration at this time. This tool will eventually
|
||||
be deprecated.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
||||
</sect2>
|
||||
|
||||
@ -1,966 +0,0 @@
|
||||
<?xml version="1.0" encoding="iso-8859-1"?>
|
||||
<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
||||
<chapter id="upgrading-to-3.0">
|
||||
<chapterinfo>
|
||||
&author.jelmer;
|
||||
&author.jht;
|
||||
&author.jerry;
|
||||
<pubdate>August 16, 2007</pubdate>
|
||||
</chapterinfo>
|
||||
|
||||
<title>Updating and Upgrading Samba</title>
|
||||
<para>
|
||||
This chapter provides a detailed record of changes made during the 3.x series releases. At this time this
|
||||
series consists of the 3.0.x series that is under the GNU GPL version 2 license, and the Samba 3.2.x series
|
||||
that is being released under the terms of the GNU GPL version 3 license.
|
||||
</para>
|
||||
|
||||
<sect1>
|
||||
<title>Key Update Requirements</title>
|
||||
<para>
|
||||
Samba is a fluid product in which there may be significant changes between releases. Some of these changes are
|
||||
brought about as a result of changes in the protocols that are used by Microsoft Windows network clients as a
|
||||
result of security or functionality updates through official Microsoft patches and updates. Samba must track
|
||||
such changes, particularly where they affect the internal operation of Samba itself.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Please refer to any notes below that make explicit mention of the version of Samba you are using. In general,
|
||||
all changes that apply to a new release will apply to follow-on releases also. For example, changes to Samba
|
||||
3.0.23 affect all releases up to an including 3.0.25 and later. Samba 3.2.x was originaly cut from Samba
|
||||
3.0.25 before 3.2.0-specific changes were applied. Unless a 3.0.x series feature is specifically revoked, the
|
||||
behavior of the 3.2.x series can be expected to follow the earlier pattern.
|
||||
</para>
|
||||
|
||||
<sect2>
|
||||
<title>Upgrading from Samba-3.0.x to Samba-3.2.0</title>
|
||||
<para>
|
||||
</para>
|
||||
</sect2>
|
||||
|
||||
<sect2 id="oldupdatenotes">
|
||||
<title>Upgrading from Samba-2.x to Samba-3.0.25</title>
|
||||
<para>
|
||||
<indexterm><primary>Samba differences</primary></indexterm>
|
||||
<indexterm><primary>changed parameters</primary></indexterm>
|
||||
<indexterm><primary>simple guide</primary></indexterm>
|
||||
This chapter deals exclusively with the differences between Samba-3.0.25 and Samba-2.2.8a.
|
||||
It points out where configuration parameters have changed, and provides a simple guide for
|
||||
the move from 2.2.x to 3.0.25.
|
||||
</para>
|
||||
</sect2>
|
||||
|
||||
<sect2>
|
||||
<title>Quick Migration Guide</title>
|
||||
|
||||
<para>
|
||||
Samba-3.0.25 default behavior should be approximately the same as Samba-2.2.x.
|
||||
The default behavior when the new parameter <smbconfoption name="passdb backend"/>
|
||||
is not defined in the &smb.conf; file provides the same default behavior as Samba-2.2.x
|
||||
with <smbconfoption name="encrypt passwords">Yes</smbconfoption> and
|
||||
will use the <filename>smbpasswd</filename> database.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>behavior approximately same</primary></indexterm>
|
||||
<indexterm><primary>differing protocol</primary></indexterm>
|
||||
So why say that <emphasis>behavior should be approximately the same as Samba-2.2.x</emphasis>? Because
|
||||
Samba-3.0.25 can negotiate new protocols, such as support for native Unicode, that may result in
|
||||
differing protocol code paths being taken. The new behavior under such circumstances is not
|
||||
exactly the same as the old one. The good news is that the domain and machine SIDs will be
|
||||
preserved across the upgrade.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>LDAP backend</primary></indexterm>
|
||||
<indexterm><primary>database</primary></indexterm>
|
||||
<indexterm><primary>pdbedit</primary></indexterm>
|
||||
<indexterm><primary>Samba-3-compatible LDAP backend</primary></indexterm>
|
||||
If the Samba-2.2.x system is using an LDAP backend, and there is no time to update the LDAP
|
||||
database, then make sure that <smbconfoption name="passdb backend">ldapsam_compat</smbconfoption>
|
||||
is specified in the &smb.conf; file. For the rest, behavior should remain more or less the same.
|
||||
At a later date, when there is time to implement a new Samba-3-compatible LDAP backend, it is possible
|
||||
to migrate the old LDAP database to the new one through use of the <command>pdbedit</command>.
|
||||
See <link linkend="pdbeditthing">The <emphasis>pdbedit</emphasis> Command</link>.
|
||||
</para>
|
||||
|
||||
</sect2>
|
||||
</sect1>
|
||||
|
||||
<sect1>
|
||||
<title>New Features in Samba-3.x Series</title>
|
||||
<para>
|
||||
</para>
|
||||
|
||||
<sect2>
|
||||
<title>New Features in Samba-3.2.x Series</title>
|
||||
|
||||
<para>Samba is now distributed under the version 3
|
||||
of the new GNU General Public License.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
The major new features are:
|
||||
</para>
|
||||
|
||||
|
||||
<orderedlist numeration="arabic">
|
||||
<listitem><para>
|
||||
<indexterm><primary>File Service</primary></indexterm>
|
||||
<indexterm><primary>limit</primary></indexterm>
|
||||
Removal of the 1024 byte limit on pathnames and 256 byte limit on
|
||||
filename components to honor the MAX_PATH setting from the host OS.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>Registory</primary></indexterm>
|
||||
<indexterm><primary>Configuration</primary></indexterm>
|
||||
Introduction of a registry based configuration system.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>cluster</primary></indexterm>
|
||||
Experimental support for file serving clusters.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>IPv6</primary></indexterm>
|
||||
Support for IPv6 in the server, and client tools and libraries.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>alternate data streams</primary></indexterm>
|
||||
Support for storing alternate data streams in xattrs.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>Encrypted SMB transport</primary></indexterm>
|
||||
Encrypted SMB transport in client tools and libraries, and server.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>Windows Vista</primary></indexterm>
|
||||
Support for Vista clients authenticating via Kerberos.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>Winbind</primary></indexterm>
|
||||
<indexterm><primary>forest</primary></indexterm>
|
||||
Full support for Windows 2003 cross-forest, transitive trusts
|
||||
and one-way domain trusts.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>pam_winbind</primary></indexterm>
|
||||
Support for userPrincipalName logons via pam_winbind and NSS lookups.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>LDAP</primary></indexterm>
|
||||
<indexterm><primary>Active Directory</primary></indexterm>
|
||||
<indexterm><primary>Signing</primary></indexterm>
|
||||
Support for Active Directory LDAP Signing policy.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>Licence</primary></indexterm>
|
||||
<indexterm><primary>GPL</primary></indexterm>
|
||||
New LGPL Winbind client library (libwbclient.so).
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>domain</primary></indexterm>
|
||||
<indexterm><primary>domain trust</primary></indexterm>
|
||||
Support for establishing interdomain trust relationships with Windows 2008.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>joining</primary></indexterm>
|
||||
New client and server support for remotely joining and unjoining Domains.
|
||||
</para></listitem>
|
||||
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>joining</primary></indexterm>
|
||||
Support for joining into Windows 2008 domains.
|
||||
</para></listitem>
|
||||
|
||||
</orderedlist>
|
||||
|
||||
<para>
|
||||
Plus lots of other improvements!
|
||||
</para>
|
||||
|
||||
|
||||
</sect2>
|
||||
|
||||
<sect2>
|
||||
<title>New Features in Samba-3.0.x</title>
|
||||
|
||||
<para>
|
||||
The major new features are:
|
||||
</para>
|
||||
|
||||
<orderedlist numeration="arabic">
|
||||
<listitem><para>
|
||||
<indexterm><primary>ADS</primary></indexterm>
|
||||
<indexterm><primary>LDAP/Kerberos</primary></indexterm>
|
||||
Active Directory support. This release is able to join an ADS realm
|
||||
as a member server and authenticate users using LDAP/Kerberos.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>Unicode</primary></indexterm>
|
||||
<indexterm><primary>multibyte character sets</primary></indexterm>
|
||||
Unicode support. Samba will now negotiate Unicode on the wire, and
|
||||
internally there is a much better infrastructure for multibyte
|
||||
and Unicode character sets.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>authentication system</primary></indexterm>
|
||||
New authentication system. The internal authentication system has
|
||||
been almost completely rewritten. Most of the changes are internal,
|
||||
but the new authoring system is also very configurable.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>filename mangling</primary></indexterm>
|
||||
New filename mangling system. The filename mangling system has been
|
||||
completely rewritten. An internal database now stores mangling maps
|
||||
persistently.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>net command</primary></indexterm>
|
||||
New <quote>net</quote> command. A new <quote>net</quote> command has been added. It is
|
||||
somewhat similar to the <quote>net</quote> command in Windows. Eventually, we
|
||||
plan to replace a bunch of other utilities (such as smbpasswd)
|
||||
with subcommands in <quote>net</quote>.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>status32 codes</primary></indexterm>
|
||||
Samba now negotiates NT-style status32 codes on the wire. This
|
||||
considerably improves error handling.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>printer attributes publishing</primary></indexterm>
|
||||
Better Windows 200x/XP printing support, including publishing
|
||||
printer attributes in Active Directory.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>RPC modules</primary></indexterm>
|
||||
<indexterm><primary>passdb backends</primary></indexterm>
|
||||
<indexterm><primary>character sets</primary></indexterm>
|
||||
New loadable RPC modules for passdb backends and character sets.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>dual-daemon winbindd</primary></indexterm>
|
||||
New default dual-daemon winbindd support for better performance.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>migrating</primary></indexterm>
|
||||
<indexterm><primary>maintaining ids</primary></indexterm>
|
||||
<indexterm><primary>SID</primary></indexterm>
|
||||
Support for migrating from a Windows NT 4.0 domain to a Samba
|
||||
domain and maintaining user, group, and domain SIDs.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>trust relationships</primary></indexterm>
|
||||
<indexterm><primary>domain controllers</primary></indexterm>
|
||||
Support for establishing trust relationships with Windows NT 4.0
|
||||
domain controllers.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>Winbind architecture</primary></indexterm>
|
||||
<indexterm><primary>LDAP directory</primary></indexterm>
|
||||
<indexterm><primary>ID mapping</primary></indexterm>
|
||||
Initial support for a distributed Winbind architecture using
|
||||
an LDAP directory for storing SID to UID/GID mappings.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
Major updates to the Samba documentation tree.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>SMB signing</primary></indexterm>
|
||||
<indexterm><primary>security settings</primary></indexterm>
|
||||
Full support for client and server SMB signing to ensure
|
||||
compatibility with default Windows 2003 security settings.
|
||||
</para></listitem>
|
||||
</orderedlist>
|
||||
|
||||
<para>
|
||||
Plus lots of other improvements!
|
||||
</para>
|
||||
|
||||
|
||||
<sect3>
|
||||
<title>Configuration Parameter Changes</title>
|
||||
|
||||
<para>
|
||||
This section contains a brief listing of changes to &smb.conf; options since the Samba-2.2.x series up to and
|
||||
including Samba-3.0.25.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Please refer to the smb.conf(5) man page for complete descriptions of new or modified
|
||||
parameters.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Whenever a Samba update or upgrade is performed it is highly recommended to read the file called
|
||||
<emphasis>WHATSNEW.txt</emphasis> that is part of the Samba distribution tarball. This file may also
|
||||
be obtain on-line from the Samba <ulink url="http://www.samba.org/samba/">web site</ulink>, in
|
||||
the right column, under Current Stable Release, by clicking on <emphasis>Release Notes</emphasis>.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
||||
<sect3>
|
||||
<title>Removed Parameters</title>
|
||||
|
||||
<indexterm><primary>deleted parameters</primary></indexterm>
|
||||
<para>
|
||||
In alphabetical order, these are the parameters eliminated from Samba-2.2.x through 3.0.25.
|
||||
</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>admin log</para></listitem>
|
||||
<listitem><para>alternate permissions</para></listitem>
|
||||
<listitem><para>character set</para></listitem>
|
||||
<listitem><para>client codepage</para></listitem>
|
||||
<listitem><para>code page directory</para></listitem>
|
||||
<listitem><para>coding system</para></listitem>
|
||||
<listitem><para>domain admin group</para></listitem>
|
||||
<listitem><para>domain guest group</para></listitem>
|
||||
<listitem><para>enable rid algorithm</para></listitem>
|
||||
<listitem><para>enable svcctl</para></listitem>
|
||||
<listitem><para>force unknown acl user</para></listitem>
|
||||
<listitem><para>hosts equiv</para></listitem>
|
||||
<listitem><para>ldap filter</para></listitem>
|
||||
<listitem><para>min password length</para></listitem>
|
||||
<listitem><para>nt smb support</para></listitem>
|
||||
<listitem><para>post script</para></listitem>
|
||||
<listitem><para>printer driver</para></listitem>
|
||||
<listitem><para>printer driver file</para></listitem>
|
||||
<listitem><para>printer driver location</para></listitem>
|
||||
<listitem><para>read size</para></listitem>
|
||||
<listitem><para>source environment</para></listitem>
|
||||
<listitem><para>status </para></listitem>
|
||||
<listitem><para>strip dot </para></listitem>
|
||||
<listitem><para>total print jobs</para></listitem>
|
||||
<listitem><para>unicode</para></listitem>
|
||||
<listitem><para>use rhosts</para></listitem>
|
||||
<listitem><para>valid chars</para></listitem>
|
||||
<listitem><para>vfs options</para></listitem>
|
||||
<listitem><para>winbind enable local accounts</para></listitem>
|
||||
<listitem><para>winbind max idle children</para></listitem>
|
||||
<listitem><para>wins partners</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
</sect3>
|
||||
|
||||
<sect3>
|
||||
<title>New Parameters</title>
|
||||
|
||||
<para>The following new parameters have been released up to and including Samba 3.0.25 (grouped by function:)</para>
|
||||
|
||||
<para>Remote Management</para>
|
||||
|
||||
<indexterm><primary>new parameters</primary></indexterm>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>abort shutdown script</para></listitem>
|
||||
<listitem><para>shutdown script</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>User and Group Account Management</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>add group script</para></listitem>
|
||||
<listitem><para>add machine script</para></listitem>
|
||||
<listitem><para>add user to group script</para></listitem>
|
||||
<listitem><para>algorithmic rid base</para></listitem>
|
||||
<listitem><para>delete group script</para></listitem>
|
||||
<listitem><para>delete user from group script</para></listitem>
|
||||
<listitem><para>passdb backend</para></listitem>
|
||||
<listitem><para>rename user script</para></listitem>
|
||||
<listitem><para>set primary group script</para></listitem>
|
||||
<listitem><para>username map script</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>Authentication</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>auth methods</para></listitem>
|
||||
<listitem><para>ldap password sync</para></listitem>
|
||||
<listitem><para>passdb expand explicit</para></listitem>
|
||||
<listitem><para>realm</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>Protocol Options</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>add port command</para></listitem>
|
||||
<listitem><para>afs token lifetime</para></listitem>
|
||||
<listitem><para>client lanman auth</para></listitem>
|
||||
<listitem><para>client NTLMv2 auth</para></listitem>
|
||||
<listitem><para>client schannel</para></listitem>
|
||||
<listitem><para>client signing</para></listitem>
|
||||
<listitem><para>client use spnego</para></listitem>
|
||||
<listitem><para>defer sharing violations</para></listitem>
|
||||
<listitem><para>disable netbios</para></listitem>
|
||||
<listitem><para>dmapi support</para></listitem>
|
||||
<listitem><para>enable privileges</para></listitem>
|
||||
<listitem><para>use kerberos keytab</para></listitem>
|
||||
<listitem><para>log nt token command</para></listitem>
|
||||
<listitem><para>ntlm auth</para></listitem>
|
||||
<listitem><para>paranoid server security </para></listitem>
|
||||
<listitem><para>sendfile</para></listitem>
|
||||
<listitem><para>server schannel</para></listitem>
|
||||
<listitem><para>server signing</para></listitem>
|
||||
<listitem><para>smb ports</para></listitem>
|
||||
<listitem><para>svcctl list</para></listitem>
|
||||
<listitem><para>use spnego</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>File Service</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>allocation roundup size</para></listitem>
|
||||
<listitem><para>acl check permissions</para></listitem>
|
||||
<listitem><para>acl group control</para></listitem>
|
||||
<listitem><para>acl map full control</para></listitem>
|
||||
<listitem><para>aio read size</para></listitem>
|
||||
<listitem><para>aio write size</para></listitem>
|
||||
<listitem><para>dfree cache time</para></listitem>
|
||||
<listitem><para>dfree command</para></listitem>
|
||||
<listitem><para>ea support</para></listitem>
|
||||
<listitem><para>enable asu support</para></listitem>
|
||||
<listitem><para>fam change notify</para></listitem>
|
||||
<listitem><para>force unknown acl user</para></listitem>
|
||||
<listitem><para>get quota command</para></listitem>
|
||||
<listitem><para>hide special files</para></listitem>
|
||||
<listitem><para>hide unwriteable files</para></listitem>
|
||||
<listitem><para>inherit owner</para></listitem>
|
||||
<listitem><para>hostname lookups</para></listitem>
|
||||
<listitem><para>kernel change notify</para></listitem>
|
||||
<listitem><para>mangle prefix</para></listitem>
|
||||
<listitem><para>map acl inherit</para></listitem>
|
||||
<listitem><para>map read only</para></listitem>
|
||||
<listitem><para>max stat cache size</para></listitem>
|
||||
<listitem><para>msdfs proxy</para></listitem>
|
||||
<listitem><para>open files database hash size</para></listitem>
|
||||
<listitem><para>set quota command</para></listitem>
|
||||
<listitem><para>store dos attributes</para></listitem>
|
||||
<listitem><para>use sendfile</para></listitem>
|
||||
<listitem><para>usershare allow guests</para></listitem>
|
||||
<listitem><para>usershare max shares</para></listitem>
|
||||
<listitem><para>usershare owner only</para></listitem>
|
||||
<listitem><para>usershare path</para></listitem>
|
||||
<listitem><para>usershare prefix allow list</para></listitem>
|
||||
<listitem><para>usershare prefix deny list</para></listitem>
|
||||
<listitem><para>usershare template share</para></listitem>
|
||||
<listitem><para>vfs objects</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>Printing</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>cups options</para></listitem>
|
||||
<listitem><para>cups server</para></listitem>
|
||||
<listitem><para>force printername</para></listitem>
|
||||
<listitem><para>iprint server</para></listitem>
|
||||
<listitem><para>max reported print jobs</para></listitem>
|
||||
<listitem><para>printcap cache time</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
|
||||
<para>Unicode and Character Sets</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>display charset</para></listitem>
|
||||
<listitem><para>dos charset</para></listitem>
|
||||
<listitem><para>UNIX charset</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>SID to UID/GID Mappings</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>idmap backend</para></listitem>
|
||||
<listitem><para>idmap gid</para></listitem>
|
||||
<listitem><para>idmap uid</para></listitem>
|
||||
<listitem><para>username map script</para></listitem>
|
||||
<listitem><para>winbind nss info</para></listitem>
|
||||
<listitem><para>winbind offline logon</para></listitem>
|
||||
<listitem><para>winbind refresh tickets</para></listitem>
|
||||
<listitem><para>winbind trusted domains only</para></listitem>
|
||||
<listitem><para>template primary group</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>LDAP</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>ldap delete dn</para></listitem>
|
||||
<listitem><para>ldap group suffix</para></listitem>
|
||||
<listitem><para>ldap idmap suffix</para></listitem>
|
||||
<listitem><para>ldap machine suffix</para></listitem>
|
||||
<listitem><para>ldap passwd sync</para></listitem>
|
||||
<listitem><para>ldap replication sleep</para></listitem>
|
||||
<listitem><para>ldap timeout</para></listitem>
|
||||
<listitem><para>ldap user suffix</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>General Configuration</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>eventlog list</para></listitem>
|
||||
<listitem><para>preload modules</para></listitem>
|
||||
<listitem><para>reset on zero vc</para></listitem>
|
||||
<listitem><para>privatedir</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
</sect3>
|
||||
|
||||
<sect3>
|
||||
<title>Modified Parameters (Changes in Behavior)</title>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>acl group control (new default is No, deprecated parameter)</para></listitem>
|
||||
<listitem><para>change notify timeout (scope changed)</para></listitem>
|
||||
<listitem><para>dos filemode (disabled by default)</para></listitem>
|
||||
<listitem><para>dos filetimes (enabled by default)</para></listitem>
|
||||
<listitem><para>enable asu support (disabled by default)</para></listitem>
|
||||
<listitem><para>enable privileges (enabled by default)</para></listitem>
|
||||
<listitem><para>encrypt passwords (enabled by default) </para></listitem>
|
||||
<listitem><para>host msdfs (enabled by default)</para></listitem>
|
||||
<listitem><para>mangling method (set to hash2 by default) </para></listitem>
|
||||
<listitem><para>map to guest</para></listitem>
|
||||
<listitem><para>only user (deprecated)</para></listitem>
|
||||
<listitem><para>passwd chat</para></listitem>
|
||||
<listitem><para>passwd program</para></listitem>
|
||||
<listitem><para>password server</para></listitem>
|
||||
<listitem><para>restrict anonymous (integer value)</para></listitem>
|
||||
<listitem><para>security (new ads value)</para></listitem>
|
||||
<listitem><para>strict locking (auto by default)</para></listitem>
|
||||
<listitem><para>winbind cache time (increased to 5 minutes)</para></listitem>
|
||||
<listitem><para>winbind enum groups (disabled by default)</para></listitem>
|
||||
<listitem><para>winbind enum users (disabled by default)</para></listitem>
|
||||
<listitem><para>winbind nested groups (enabled by default)</para></listitem>
|
||||
<listitem><para>winbind uid (deprecated in favor of idmap uid)</para></listitem>
|
||||
<listitem><para>winbind gid (deprecated in favor of idmap gid)</para></listitem>
|
||||
<listitem><para>winbindd nss info</para></listitem>
|
||||
<listitem><para>write cache (deprecated)</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
</sect3>
|
||||
|
||||
</sect2>
|
||||
|
||||
<sect2>
|
||||
<title>New Functionality</title>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>major changes</primary></indexterm>
|
||||
The major changes in behavior since that Samba-2.2.x series are documented in this section.
|
||||
Please refer to the <filename>WHATSNEW.txt</filename> file that ships with every release of
|
||||
Samba to obtain detailed information regarding the changes that have been made during the
|
||||
life of the current Samba release.
|
||||
</para>
|
||||
|
||||
<sect3>
|
||||
<title>TDB Data Files</title>
|
||||
|
||||
<indexterm><primary>tdb data files</primary></indexterm>
|
||||
<para>
|
||||
Refer to <link linkend="install">Installation, Chapter 1</link>, <link linkend="tdbdocs">Chapter 1</link>
|
||||
for information pertaining to the Samba-3 data files, their location and the information that must be
|
||||
preserved across server migrations, updates and upgrades.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>tdb file backup</primary></indexterm>
|
||||
Please remember to back up your existing ${lock directory}/*tdb before upgrading to Samba-3. If necessary,
|
||||
Samba will upgrade databases as they are opened. Downgrading from Samba-3 to 2.2, or reversion to an earlier
|
||||
version of Samba-3 from a later release, is an unsupported path.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>tdb file descriptions</primary></indexterm>
|
||||
The old Samba-2.2.x tdb files are described in <link linkend="oldtdbfiledesc">the next table</link>.
|
||||
</para>
|
||||
|
||||
|
||||
<table frame='all' id="oldtdbfiledesc"><title>Samba-2.2.x TDB File Descriptions</title>
|
||||
<tgroup cols='3'>
|
||||
<colspec align="left"/>
|
||||
<colspec align="justify" colwidth="1*"/>
|
||||
<colspec align="left"/>
|
||||
<thead>
|
||||
<row>
|
||||
<entry align="left">Name</entry>
|
||||
<entry align="justify">Description</entry>
|
||||
<entry align="center">Backup?</entry>
|
||||
</row>
|
||||
</thead>
|
||||
<tbody>
|
||||
<row>
|
||||
<entry>account_policy</entry>
|
||||
<entry>User policy settings</entry>
|
||||
<entry>yes</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>brlock</entry>
|
||||
<entry>Byte-range file locking information.</entry>
|
||||
<entry>no</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>connections</entry>
|
||||
<entry><para>Client connection information</para></entry>
|
||||
<entry>no</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>locking</entry>
|
||||
<entry>Temporary file locking data.</entry>
|
||||
<entry>no</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>messages</entry>
|
||||
<entry><para>Temporary storage of messages being processed by smbd.</para></entry>
|
||||
<entry>no</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>ntdrivers</entry>
|
||||
<entry><para>Stores per-printer driver information.</para></entry>
|
||||
<entry>yes</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>ntforms</entry>
|
||||
<entry><para>Stores per-printer forms information.</para></entry>
|
||||
<entry>yes</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>ntprinters</entry>
|
||||
<entry><para>Stores the per-printer devmode configuration settings.</para></entry>
|
||||
<entry>yes</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>printing/*.tdb</entry>
|
||||
<entry><para>Cached output from lpq command created on a per-print-service basis.</para></entry>
|
||||
<entry>no</entry>
|
||||
</row>
|
||||
<row>
|
||||
|
||||
<entry>registry</entry>
|
||||
<entry><para>Read-only Samba registry skeleton that provides support for
|
||||
exporting various database tables via the winreg RPCs.</para></entry>
|
||||
<entry>no</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>sessionid</entry>
|
||||
<entry><para>Temporary cache for miscellaneous session information.</para></entry>
|
||||
<entry>no</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>share_info</entry>
|
||||
<entry>Share ACL settings.</entry>
|
||||
<entry>yes</entry>
|
||||
</row>
|
||||
<row>
|
||||
|
||||
<entry>unexpected</entry>
|
||||
<entry><para>Packets received for which no process was listening.</para></entry>
|
||||
<entry>no</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>winbindd_cache</entry>
|
||||
<entry><para>Cache of identity information received from an NT4 or an ADS domain.</para></entry>
|
||||
<entry>yes</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>winbindd_idmap</entry>
|
||||
<entry><para>New ID map table from SIDS to UNIX UIDs/GIDs.</para></entry>
|
||||
<entry>yes</entry>
|
||||
</row>
|
||||
</tbody>
|
||||
</tgroup>
|
||||
</table>
|
||||
|
||||
</sect3>
|
||||
|
||||
<sect3>
|
||||
<title>Changes in Behavior</title>
|
||||
|
||||
<para>
|
||||
The following issues are known changes in behavior between Samba-2.2 and
|
||||
Samba-3 that may affect certain installations of Samba.
|
||||
</para>
|
||||
|
||||
<orderedlist>
|
||||
<listitem><para>
|
||||
<indexterm><primary>Windows domain</primary></indexterm>
|
||||
<indexterm><primary>getpwnam() call</primary></indexterm>
|
||||
<indexterm><primary>NT_STATUS_LOGON_FAILURE</primary></indexterm>
|
||||
When operating as a member of a Windows domain, Samba-2.2 would map any users authenticated by the remote DC
|
||||
to the <quote>guest account</quote> if a UID could not be obtained via the getpwnam() call. Samba-3 rejects
|
||||
the connection with the error message <quote>NT_STATUS_LOGON_FAILURE.</quote> There is no current workaround
|
||||
to re-establish the Samba-2.2 behavior.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>add user script</primary></indexterm>
|
||||
<indexterm><primary>add machine script</primary></indexterm>
|
||||
When adding machines to a Samba-2.2 controlled domain, the
|
||||
<quote>add user script</quote> was used to create the UNIX identity of the
|
||||
machine trust account. Samba-3 introduces a new <quote>add machine
|
||||
script</quote> that must be specified for this purpose. Samba-3 will
|
||||
not fall back to using the <quote>add user script</quote> in the absence of
|
||||
an <quote>add machine script</quote>.
|
||||
</para></listitem>
|
||||
</orderedlist>
|
||||
|
||||
</sect3>
|
||||
|
||||
<sect3>
|
||||
<title>Passdb Backends and Authentication</title>
|
||||
|
||||
<para>
|
||||
There have been a few new changes that Samba administrators should be
|
||||
aware of when moving to Samba-3.
|
||||
</para>
|
||||
|
||||
<orderedlist>
|
||||
<listitem><para>
|
||||
<indexterm><primary>encrypted passwords</primary></indexterm>
|
||||
Encrypted passwords have been enabled by default in order to
|
||||
interoperate better with out-of-the-box Windows client
|
||||
installations. This does mean that either (a) a Samba account
|
||||
must be created for each user, or (b) <quote>encrypt passwords = no</quote>
|
||||
must be explicitly defined in &smb.conf;.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>ADS</primary></indexterm>
|
||||
<indexterm><primary>Kerberos</primary></indexterm>
|
||||
<indexterm><primary>LDAP</primary></indexterm>
|
||||
Inclusion of new <smbconfoption name="security">ads</smbconfoption> option for integration
|
||||
with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols.
|
||||
</para></listitem>
|
||||
</orderedlist>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>account storage backends</primary></indexterm>
|
||||
Samba-3 also includes the possibility of setting up chains of authentication methods (<smbconfoption
|
||||
name="auth methods"/>) and account storage backends (<smbconfoption name="passdb backend"/>). Please refer to
|
||||
the &smb.conf; man page and <link linkend="passdb">Account Information Databases</link>, for
|
||||
details. While both parameters assume sane default values, it is likely that you will need to understand what
|
||||
the values actually mean in order to ensure Samba operates correctly.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>pdbedit</primary></indexterm>
|
||||
<indexterm><primary>smbpasswd</primary></indexterm>
|
||||
<indexterm><primary>net tool</primary></indexterm>
|
||||
Certain functions of the <command>smbpasswd</command> tool have been split between the
|
||||
new <command>smbpasswd</command> utility, the <command>net</command> tool, and the new <command>pdbedit</command>
|
||||
utility. See the respective man pages for details.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
||||
<sect3>
|
||||
<title>LDAP</title>
|
||||
|
||||
<para>
|
||||
This section outlines the new features effecting Samba/LDAP integration.
|
||||
</para>
|
||||
|
||||
<sect4>
|
||||
<title>New Schema</title>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>object class</primary></indexterm>
|
||||
<indexterm><primary>sambaSamAccount</primary></indexterm>
|
||||
<indexterm><primary>LDIF</primary></indexterm>
|
||||
<indexterm><primary>attributes</primary></indexterm>
|
||||
A new object class (sambaSamAccount) has been introduced to replace
|
||||
the old sambaAccount. This change aids in the renaming of attributes
|
||||
to prevent clashes with attributes from other vendors. There is a
|
||||
conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF
|
||||
file to the new schema.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Example:
|
||||
<indexterm><primary>ldapsearch</primary></indexterm>
|
||||
</para>
|
||||
<para><screen>
|
||||
&prompt;ldapsearch .... -LLL -b "ou=people,dc=..." > old.ldif
|
||||
&prompt;convertSambaAccount --sid <DOM SID> --input old.ldif --output new.ldif
|
||||
</screen></para>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm>
|
||||
The <DOM SID> can be obtained by running
|
||||
<screen>
|
||||
&prompt;<userinput>net getlocalsid <DOMAINNAME></userinput>
|
||||
</screen>
|
||||
<indexterm><primary>PDC</primary></indexterm>
|
||||
on the Samba PDC as root.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Under Samba-2.x the domain SID can be obtained by executing:
|
||||
<indexterm><primary>smbpasswd</primary></indexterm>
|
||||
<screen>
|
||||
&prompt;<userinput>smbpasswd -S <DOMAINNAME></userinput>
|
||||
</screen>
|
||||
</para>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>old sambaAccount</primary></indexterm>
|
||||
<indexterm><primary>ldapsam_compat</primary></indexterm>
|
||||
<indexterm><primary>object class declaration</primary></indexterm>
|
||||
<indexterm><primary>samba.schema</primary></indexterm>
|
||||
The old <literal>sambaAccount</literal> schema may still be used by specifying the
|
||||
<parameter>ldapsam_compat</parameter> passdb backend. However, the sambaAccount and
|
||||
associated attributes have been moved to the historical section of
|
||||
the schema file and must be uncommented before use if needed.
|
||||
The Samba-2.2 object class declaration for a <literal>sambaAccount</literal> has not changed
|
||||
in the Samba-3 <filename>samba.schema</filename> file.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Other new object classes and their uses include:
|
||||
</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>
|
||||
<indexterm><primary>sambaDomain</primary></indexterm>
|
||||
<indexterm><primary>domain information</primary></indexterm>
|
||||
<indexterm><primary>RID</primary></indexterm>
|
||||
<indexterm><primary>ldap suffix</primary></indexterm>
|
||||
<indexterm><primary>ldapsam</primary></indexterm>
|
||||
<indexterm><primary>idmap</primary></indexterm>
|
||||
<literal>sambaDomain</literal> &smbmdash; domain information used to allocate RIDs
|
||||
for users and groups as necessary. The attributes are added
|
||||
in <quote>ldap suffix</quote> directory entry automatically if
|
||||
an idmap UID/GID range has been set and the <quote>ldapsam</quote>
|
||||
passdb backend has been selected.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>sambaGroupMapping</primary></indexterm>
|
||||
<indexterm><primary>ldap group suffix</primary></indexterm>
|
||||
<indexterm><primary>net groupmap</primary></indexterm>
|
||||
sambaGroupMapping &smbmdash; an object representing the
|
||||
relationship between a posixGroup and a Windows
|
||||
group/SID. These entries are stored in the <quote>ldap
|
||||
group suffix</quote> and managed by the <quote>net groupmap</quote> command.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>sambaUNIXIdPool</primary></indexterm>
|
||||
<indexterm><primary>ldap idmap suffix</primary></indexterm>
|
||||
<indexterm><primary>idmap UID</primary></indexterm>
|
||||
<indexterm><primary>idmap GID</primary></indexterm>
|
||||
<literal>sambaUNIXIdPool</literal> &smbmdash; created in the <quote>ldap idmap suffix</quote> entry
|
||||
automatically and contains the next available <quote>idmap UID</quote> and
|
||||
<quote>idmap GID</quote>.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
<indexterm><primary>sambaIdmapEntry</primary></indexterm>
|
||||
<indexterm><primary>idmap_ldap module</primary></indexterm>
|
||||
<literal>sambaIdmapEntry</literal> &smbmdash; object storing a mapping between a
|
||||
SID and a UNIX UID/GID. These objects are created by the
|
||||
idmap_ldap module as needed.
|
||||
</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
</sect4>
|
||||
|
||||
<sect4>
|
||||
<title>New Suffix for Searching</title>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>LDAP queries</primary></indexterm>
|
||||
<indexterm><primary>passdb backend</primary></indexterm>
|
||||
<indexterm><primary>ldap suffix</primary></indexterm>
|
||||
<indexterm><primary>ldap user suffix</primary></indexterm>
|
||||
<indexterm><primary>ldap machine suffix</primary></indexterm>
|
||||
<indexterm><primary>ldap group suffix</primary></indexterm>
|
||||
<indexterm><primary>ldap idmap suffix</primary></indexterm>
|
||||
The following new &smb.conf; parameters have been added to aid in directing
|
||||
certain LDAP queries when <parameter>passdb backend = ldapsam://...</parameter> has been
|
||||
specified.
|
||||
</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>ldap suffix &smbmdash; used to search for user and computer accounts.</para></listitem>
|
||||
<listitem><para>ldap user suffix &smbmdash; used to store user accounts.</para></listitem>
|
||||
<listitem><para>ldap machine suffix &smbmdash; used to store machine trust accounts.</para></listitem>
|
||||
<listitem><para>ldap group suffix &smbmdash; location of posixGroup/sambaGroupMapping entries.</para></listitem>
|
||||
<listitem><para>ldap idmap suffix &smbmdash; location of sambaIdmapEntry objects.</para></listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>ldap suffix</primary></indexterm>
|
||||
<indexterm><primary>subsuffix parameters</primary></indexterm>
|
||||
If an <parameter>ldap suffix</parameter> is defined, it will be appended to all of the
|
||||
remaining subsuffix parameters. In this case, the order of the suffix
|
||||
listings in &smb.conf; is important. Always place the <parameter>ldap suffix</parameter> first
|
||||
in the list.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Due to a limitation in Samba's &smb.conf; parsing, you should not surround
|
||||
the domain names with quotation marks.
|
||||
</para>
|
||||
|
||||
</sect4>
|
||||
|
||||
<sect4>
|
||||
<title>IdMap LDAP Support</title>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>idmap backend</primary></indexterm>
|
||||
Samba-3 supports an LDAP backend for the idmap subsystem. The
|
||||
following options inform Samba that the idmap table should be
|
||||
stored on the directory server <emphasis>onterose</emphasis> in the ou=Idmap,dc=quenya,dc=org partition.
|
||||
</para>
|
||||
|
||||
<smbconfblock>
|
||||
<smbconfsection name="[global]"/>
|
||||
<member>...</member>
|
||||
<smbconfoption name="idmap backend">ldap:ldap://onterose/</smbconfoption>
|
||||
<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
|
||||
<smbconfoption name="idmap uid">40000-50000</smbconfoption>
|
||||
<smbconfoption name="idmap gid">40000-50000</smbconfoption>
|
||||
</smbconfblock>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>NFS</primary></indexterm>
|
||||
This configuration allows Winbind installations on multiple servers to
|
||||
share a UID/GID number space, thus avoiding the interoperability problems
|
||||
with NFS that were present in Samba-2.2.
|
||||
</para>
|
||||
|
||||
</sect4>
|
||||
|
||||
</sect3>
|
||||
|
||||
</sect2>
|
||||
|
||||
</sect1>
|
||||
|
||||
</chapter>
|
||||
@ -173,8 +173,6 @@ The chapters in this part each cover specific Samba features.
|
||||
<part id="migration">
|
||||
<title>Migration and Updating</title>
|
||||
|
||||
<?latex \cleardoublepage ?>
|
||||
<xi:include href="TOSHARG-upgrading-to-3.0.xml"/>
|
||||
<?latex \cleardoublepage ?>
|
||||
<xi:include href="TOSHARG-NT4Migration.xml"/>
|
||||
<?latex \cleardoublepage ?>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user