mirror of
https://github.com/samba-team/samba.git
synced 2025-01-17 02:05:21 +03:00
Fix typos and speeling meesteaks.
This commit is contained in:
John Terpstra
Gerald W. Carter
parent
e07294f5a4
commit
fe743517f2
@ -86,7 +86,7 @@
|
||||
and Help desk in New York, plus one <emphasis>floater</emphasis> for
|
||||
Washington DC.</para>
|
||||
|
||||
<para>You have outsourced all desktop deployment and management to
|
||||
<para>You have out-sourced all desktop deployment and management to
|
||||
DirectPointe,Inc. Your concern is server maintenance and third-level
|
||||
support. Build a plan and show what must be done.</para>
|
||||
|
||||
|
||||
@ -1689,7 +1689,7 @@ net groupmap add ntgroup="Insurance Group" unixgroup=piops type=d
|
||||
When you are satisfied that the staging systems are complete, use the appropriate procedure to
|
||||
remove the client from the domain. Reboot the system, and then log on as the local administrator
|
||||
and clean out all temporary files stored on the system. Before shutting down, use the disk
|
||||
defragmentation tool so that the file system is in an optimal condition before replication.
|
||||
de-fragmentation tool so that the file system is in an optimal condition before replication.
|
||||
</para></step>
|
||||
|
||||
<step><para>
|
||||
|
||||
@ -479,7 +479,7 @@
|
||||
</indexterm><indexterm>
|
||||
<primary>nisplus</primary>
|
||||
</indexterm><indexterm>
|
||||
<primary>hesoid</primary>
|
||||
<primary>hesiod</primary>
|
||||
</indexterm><indexterm>
|
||||
<primary>ldap</primary>
|
||||
</indexterm><indexterm>
|
||||
@ -489,7 +489,7 @@
|
||||
</indexterm>
|
||||
Resolution via NSS. On NSS-enabled systems, there is usually a facility to resolve IDs
|
||||
via multiple methods. The methods typically include: <command>files, compat, db, ldap,
|
||||
nis, nisplus, hesoid.</command> When correctly installed, Samba adds to this list
|
||||
nis, nisplus, hesiod.</command> When correctly installed, Samba adds to this list
|
||||
the <command>winbindd</command> facility. The ldap facility is frequently the nss_ldap
|
||||
tool provided by PADL Software.
|
||||
</para></listitem>
|
||||
@ -651,7 +651,7 @@ Joined domain MEGANET2.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Failure to join the domain could be caused by any number of vaiables. The most common
|
||||
Failure to join the domain could be caused by any number of variables. The most common
|
||||
causes of failure to join are:
|
||||
</para>
|
||||
|
||||
@ -705,7 +705,7 @@ Join to 'MEGANET2' failed.
|
||||
|
||||
<step><para>
|
||||
<indexterm><primary>wbinfo</primary></indexterm>
|
||||
Just joining the Domain is not quite enough, you must now provide a priviledged set
|
||||
Just joining the Domain is not quite enough, you must now provide a privileged set
|
||||
of credentials through which <command>winbindd</command> can interact with the ADS
|
||||
Domain servers. Execute the following to implant the necessary credentials:
|
||||
<screen>
|
||||
@ -1270,7 +1270,7 @@ Joined domain MEGANET2.
|
||||
HAVE_KRB5_STRING_TO_KEY_SALT
|
||||
HAVE_LIBKRB5
|
||||
</screen>
|
||||
The above output was obtained on a SuSE Linux system and shows the output for
|
||||
The above output was obtained on a SUSE Linux system and shows the output for
|
||||
Samba that has been compiled and linked with the Heimdal Kerberos libraries.
|
||||
The following is a typical output that will be found on a Red Hat Linux system that
|
||||
has been linked with the MIT Kerberos libraries:
|
||||
@ -1434,7 +1434,7 @@ Joined 'FRAN' to realm 'LONDON.ABMAS.BIZ'
|
||||
<primary>name resolution</primary>
|
||||
<secondary>Defective</secondary>
|
||||
</indexterm>
|
||||
Defective or misconfigured DNS name resolution.
|
||||
Defective or mis-configured DNS name resolution.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para><indexterm>
|
||||
@ -1948,7 +1948,7 @@ BIGJOE$@'s password:
|
||||
Join to domain is not valid
|
||||
</screen>
|
||||
The specific error message may differ from the above as it depends on the type of failure that
|
||||
may have occured. Increase the <parameter>log level</parameter> to 10, repeat the above test
|
||||
may have occurred. Increase the <parameter>log level</parameter> to 10, repeat the above test
|
||||
and then examine the log files produced to identify the nature of the failure.
|
||||
</para></step>
|
||||
|
||||
@ -2164,7 +2164,7 @@ Joined 'GOODELF' to realm 'SNOWSHOW.COM'
|
||||
|
||||
<para>
|
||||
<indexterm><primary>diagnostic</primary></indexterm>
|
||||
Follow the diagnositic procedures shown earlier in this chapter to identify success or failure of the join.
|
||||
Follow the diagnostic procedures shown earlier in this chapter to identify success or failure of the join.
|
||||
In many cases a failure is indicated by a silent return to the command prompt with no indication of the
|
||||
reason for failure.
|
||||
</para>
|
||||
@ -2743,7 +2743,7 @@ session sufficient /lib/security/$ISA/pam_winbind.so use_first_pass
|
||||
<primary>mapped drives</primary>
|
||||
</indexterm>
|
||||
Many UNIX administrators mock the model that the Personal Computer industry has adopted
|
||||
as normative since the early days of Novell Netware. One may well argue that the old
|
||||
as normative since the early days of Novell NetWare. One may well argue that the old
|
||||
perception of the necessity to keep users off file and print servers was a result of
|
||||
fears concerning the security and integrity of data. It was a simple and generally
|
||||
effective measure to keep users away from servers, except through mapped drives.
|
||||
|
||||
@ -160,7 +160,7 @@
|
||||
</para>
|
||||
|
||||
<para><indexterm>
|
||||
<primary>Free Standards Grou</primary>
|
||||
<primary>Free Standards Group</primary>
|
||||
<see>FSG</see>
|
||||
</indexterm><indexterm>
|
||||
<primary>FSG</primary>
|
||||
@ -297,7 +297,7 @@ samba3-cifsmount-3.0.15-1
|
||||
</para>
|
||||
|
||||
<example id="ch12SL">
|
||||
<title>A Useful Samba Control Script for SuSE Linux</title>
|
||||
<title>A Useful Samba Control Script for SUSE Linux</title>
|
||||
<screen>
|
||||
#!/bin/bash
|
||||
#
|
||||
@ -597,9 +597,9 @@ M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33
|
||||
<primary>SID</primary>
|
||||
</indexterm>
|
||||
The first step to get the LDAP server ready for action is to create the LDIF file from
|
||||
which the LDAP database will be preloaded. This is necessary to create the containers
|
||||
which the LDAP database will be pre-loaded. This is necessary to create the containers
|
||||
into which the user, group, and so on, accounts is written. It is also necessary to
|
||||
preload the well-known Windows NT Domain Groups, as they must have the correct SID so
|
||||
pre-load the well-known Windows NT Domain Groups, as they must have the correct SID so
|
||||
that they can be recognized as special NT Groups by the MS Windows clients.
|
||||
</para>
|
||||
|
||||
@ -670,7 +670,7 @@ Enter the top level org name or press Enter to continue:
|
||||
</para></step>
|
||||
|
||||
<step><para>
|
||||
It is now time to preload the LDAP database with the following
|
||||
It is now time to pre-load the LDAP database with the following
|
||||
command:
|
||||
<screen>
|
||||
&rootprompt; slapadd -v -l MEGANET2.ldif
|
||||
@ -1102,7 +1102,7 @@ example:
|
||||
|
||||
<step><para>
|
||||
Copy the extracted files to the document root directory of your Web server.
|
||||
For example, on SuSE Linux Enterprise Server 8, copy to the
|
||||
For example, on SUSE Linux Enterprise Server 8, copy to the
|
||||
<filename>/srv/web/htdocs</filename> directory.
|
||||
</para></step>
|
||||
|
||||
@ -1538,14 +1538,14 @@ drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt
|
||||
<title>Opportunistic Locking Controls</title>
|
||||
|
||||
<para><indexterm>
|
||||
<primary>file cacheing</primary>
|
||||
<primary>file caching</primary>
|
||||
</indexterm>
|
||||
Third-party Windows applications may not be compatible with the use of opportunistic file
|
||||
and record locking. For applications that are known not to be compatible,<footnote>Refer to
|
||||
the application manufacturers' installation guidelines and knowledge base for specific
|
||||
information regarding compatibility. It is often safe to assume that if the software
|
||||
manufacturer does not specifically mention incompatibilities with opportunistic file
|
||||
and record locking, or with Windows client file cacheing, the application is probably
|
||||
and record locking, or with Windows client file caching, the application is probably
|
||||
compatible with Windows (as well as Samba) default settings.</footnote> oplock
|
||||
support may need to be disabled both on the Samba server and on the Windows workstations.
|
||||
</para>
|
||||
|
||||
@ -51,7 +51,7 @@
|
||||
<note><para>
|
||||
The successful completion of this chapter requires that you capture network traffic
|
||||
using <command>ethereal</command>. It is recommended that you use a hub, not an
|
||||
etherswitch. It is necessary for the device used to act as a repeater, not as a
|
||||
Ethernet switch. It is necessary for the device used to act as a repeater, not as a
|
||||
filter. Ethernet switches may filter out traffic that is not directed at the machine
|
||||
that is used to monitor traffic; this would not allow you to complete the projects.
|
||||
</para></note>
|
||||
@ -271,7 +271,7 @@
|
||||
|
||||
<para>
|
||||
The summary of the first 10 minutes of the packet capture should look like <link linkend="pktcap01"/>.
|
||||
A screenshot of a later stage of the same capture is shown in <link linkend="pktcap02"/>.
|
||||
A screen-shot of a later stage of the same capture is shown in <link linkend="pktcap02"/>.
|
||||
</para>
|
||||
|
||||
<image id="pktcap01">
|
||||
|
||||
@ -40,7 +40,7 @@
|
||||
<para>
|
||||
With this acquisition comes new challenges for you and your team. Abmas Snack
|
||||
Foods is a well-developed business with a huge and heterogeneous network. They
|
||||
already have Windows, Netware, and Proprietary UNIX, but as yet no Samba or Linux.
|
||||
already have Windows, NetWare, and Proprietary UNIX, but as yet no Samba or Linux.
|
||||
The network is mature and well established, and there is no question of their chosen
|
||||
user authentication scheme being changed for now. You need to take a wise new
|
||||
approach.
|
||||
@ -181,7 +181,7 @@
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>
|
||||
Preparing the necessary environment using preconfigured packages
|
||||
Preparing the necessary environment using pre-configured packages
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
@ -299,7 +299,7 @@
|
||||
</indexterm><indexterm>
|
||||
<primary>MIT</primary>
|
||||
</indexterm>
|
||||
If the requirement is for interoperation with MS Windows Server 2003, it
|
||||
If the requirement is for inter-operation with MS Windows Server 2003, it
|
||||
will be necessary to ensure that you are using MIT Kerberos version 1.3.1
|
||||
or later. Red Hat Linux 9 ships with MIT Kerberos 1.2.7 and thus requires
|
||||
updating.
|
||||
@ -320,7 +320,7 @@
|
||||
<para><indexterm>
|
||||
<primary>Squid</primary>
|
||||
</indexterm>
|
||||
If Samba and/or Squid rpms are installed, they should be updated. You can
|
||||
If Samba and/or Squid RPMs are installed, they should be updated. You can
|
||||
build both from source.
|
||||
</para>
|
||||
|
||||
@ -331,7 +331,7 @@
|
||||
</indexterm><indexterm>
|
||||
<primary>squid</primary>
|
||||
</indexterm>
|
||||
Locating the packages to be uninstalled can be achieved by running:
|
||||
Locating the packages to be un-installed can be achieved by running:
|
||||
<screen>
|
||||
&rootprompt; rpm -qa | grep -i samba
|
||||
&rootprompt; rpm -qa | grep -i squid
|
||||
|
||||
@ -88,7 +88,7 @@
|
||||
</indexterm>
|
||||
Problems reported by users fall into three categories: configurations that do not work, those
|
||||
that have broken behavior, and poor performance. The term <emphasis>broken behavior</emphasis>
|
||||
means that the function of a partciluar Samba component appears to work sometimes, but not at
|
||||
means that the function of a particular Samba component appears to work sometimes, but not at
|
||||
others. The resulting intermittent operation is clearly unacceptable. An example of
|
||||
<emphasis>broken behavior</emphasis> known to many Windows networking users occurs when the
|
||||
list of Windows machines in MS Explorer changes, sometimes listing machines that are running
|
||||
@ -379,7 +379,7 @@
|
||||
<secondary>collisions</secondary>
|
||||
</indexterm><indexterm>
|
||||
<primary>network</primary>
|
||||
<secondary>tiemouts</secondary>
|
||||
<secondary>timeouts</secondary>
|
||||
</indexterm><indexterm>
|
||||
<primary>collision rates</primary>
|
||||
</indexterm><indexterm>
|
||||
|
||||
@ -95,7 +95,7 @@ clients is conservative and if followed will minimize problems - but it is not a
|
||||
Defective networking hardware. Over the past few years, we have seen
|
||||
on the Samba mailing list a significant increase in the number of
|
||||
problems that were traced to a defective network interface controller,
|
||||
a defective HUB or Etherswitch, or defective cabling. In most cases,
|
||||
a defective HUB or Ethernet switch, or defective cabling. In most cases,
|
||||
it was the erratic nature of the problem that ultimately pointed to
|
||||
the cause of the problem.
|
||||
</para></listitem>
|
||||
@ -485,7 +485,7 @@ clients is conservative and if followed will minimize problems - but it is not a
|
||||
</indexterm><indexterm>
|
||||
<primary>passdb backend</primary>
|
||||
</indexterm>
|
||||
You may wish to consider outsourcing the development of your OpenLDAP directory to an expert, particularly
|
||||
You may wish to consider out-sourcing the development of your OpenLDAP directory to an expert, particularly
|
||||
if you find the challenge of learning about LDAP directories, schemas, configuration, and management
|
||||
tools, and the creation of shell and Perl scripts a bit
|
||||
challenging. OpenLDAP can be easily customized, though it includes
|
||||
@ -608,7 +608,7 @@ clients is conservative and if followed will minimize problems - but it is not a
|
||||
<ulink url="http://www.padl.com/Contents/OpenSourceSoftware.html">PADL LDAP tools.</ulink> The resolution
|
||||
of the UNIX group name to its GID must be enabled from either the
|
||||
<filename>/etc/group</filename>
|
||||
or from the LDAP backend. This requires the use of the PADL <filename>nss_ldap</filename> toolset
|
||||
or from the LDAP backend. This requires the use of the PADL <filename>nss_ldap</filename> tool-set
|
||||
that integrates with the name service switch (NSS). The same requirements exist for resolution
|
||||
of the UNIX username to the UID. The relationships are demonstrated in <link linkend="sbehap-LDAPdiag"/>.
|
||||
</para>
|
||||
@ -772,7 +772,7 @@ clients is conservative and if followed will minimize problems - but it is not a
|
||||
from the profile server as roaming profiles are processed. This includes removing
|
||||
all the shortcuts in the Recent directory, making sure the cache used by the web browser
|
||||
is not being dumped into the <filename>Application Data</filename> folder, removing the
|
||||
Java plug-in's cache (the .jpi_cache directory in the profile), as well as training the
|
||||
Java plug-ins cache (the .jpi_cache directory in the profile), as well as training the
|
||||
user to not place large files on the Desktop and to use his mapped home directory for
|
||||
saving documents instead of the <filename>My Documents</filename> folder.
|
||||
</para>
|
||||
@ -1007,7 +1007,7 @@ clients is conservative and if followed will minimize problems - but it is not a
|
||||
<title>The Name Service Caching Daemon (nscd)</title>
|
||||
|
||||
<para>
|
||||
The name service caching daemon (nscd) is a primary cause of diffculties with name
|
||||
The name service caching daemon (nscd) is a primary cause of difficulties with name
|
||||
resolution, particularly where <command>winbind</command> is used. Winbind does its
|
||||
own caching, thus nscd causes double caching which can lead to peculiar problems during
|
||||
debugging. As a rule it is a good idea to turn off the name service caching daemon.
|
||||
@ -1161,7 +1161,7 @@ dn: cn=Replicators,ou=Groups,dc=abmas,dc=biz
|
||||
</screen>
|
||||
The first line is the DIT entry point for the container for POSIX groups. The correct entry
|
||||
for the <filename>/etc/ldap.conf</filename> for the <constant>nss_base_group</constant>
|
||||
parameter therefore is the destinguished name (dn) as applied here:
|
||||
parameter therefore is the distinguished name (dn) as applied here:
|
||||
<screen>
|
||||
nss_base_group ou=Groups,dc=abmas,dc=biz?one
|
||||
</screen>
|
||||
@ -1173,7 +1173,7 @@ nss_base_group ou=Groups,dc=abmas,dc=biz?one
|
||||
nss_base_passwd dc=abmas,dc=biz?sub
|
||||
</screen>
|
||||
This instructs LDAP to search for machine as well as user entries from the top of the DIT
|
||||
down. This is inefficient, but at least should work. Note: It is possible to specify mulitple
|
||||
down. This is inefficient, but at least should work. Note: It is possible to specify multiple
|
||||
<constant>nss_base_passwd</constant> entries in the <filename>/etc/ldap.conf</filename> file, they
|
||||
will be evaluated sequentially. Let us consider an example of use where the following DIT
|
||||
has been implemented:
|
||||
@ -1286,7 +1286,7 @@ slapd[12164]: conn=1 fd=10 closed
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Search for hints of what may have failed by lokking for the words <emphasis>fail</emphasis>
|
||||
Search for hints of what may have failed by looking for the words <emphasis>fail</emphasis>
|
||||
and <emphasis>error</emphasis>.
|
||||
</para>
|
||||
|
||||
@ -1400,7 +1400,7 @@ slapd[12164]: conn=1 fd=10 closed
|
||||
</indexterm><indexterm>
|
||||
<primary>Red Hat Linux</primary>
|
||||
</indexterm>
|
||||
All configuration files and locations are shown for SUSE Linux 9.2 and are equaly valid for SUSE
|
||||
All configuration files and locations are shown for SUSE Linux 9.2 and are equally valid for SUSE
|
||||
Linux Enterprise Server 9. The file locations for Red Hat Linux are similar. You may need to
|
||||
adjust the locations for your particular Linux system distribution/implementation.
|
||||
</para>
|
||||
@ -1516,7 +1516,7 @@ drwx------ 2 ldap ldap 48 Dec 15 22:11 ldap
|
||||
</para></step>
|
||||
|
||||
<step><para><indexterm><primary>syslog</primary></indexterm>
|
||||
Performance logging can be enabled and should preferrably be sent to a file on
|
||||
Performance logging can be enabled and should preferably be sent to a file on
|
||||
a file system that is large enough to handle significantly sized logs. To enable
|
||||
the logging at a verbose level to permit detailed analysis uncomment the entry in
|
||||
the <filename>/etc/openldap/slapd.conf</filename> shown as <quote>loglevel 256</quote>.
|
||||
@ -1835,7 +1835,7 @@ session optional pam_mail.so
|
||||
before following the steps below. If Samba-3.0.15 (or later) is not installed, you have the
|
||||
choice to either build your own or to obtain the packages from a dependable source.
|
||||
Packages for SUSE Linux 8.x, 9.x and SUSE Linux Enterprise Server 9, as well as for
|
||||
Red Hat Fedora Core and Red Hat Enteprise Linux Server 3 and 4 are included on the CD-ROM that
|
||||
Red Hat Fedora Core and Red Hat Enterprise Linux Server 3 and 4 are included on the CD-ROM that
|
||||
is included at the back of this book.
|
||||
</para>
|
||||
|
||||
@ -2063,7 +2063,7 @@ SID for domain MASSIVE is: S-1-5-21-3504140859-1010554828-2431957765
|
||||
be directly <ulink url="http://samba.idealx.org/dist/smbldap-tools-0.8.8.tgz">downloaded</ulink>
|
||||
for this site, also. Alternately, you may obtain the
|
||||
<ulink url="http://samba.idealx.org/dist/smbldap-tools-0.8.8-3.src.rpm">smbldap-tools-0.8.8-3.src.rpm</ulink>
|
||||
file that may be used to build an installable RPM package for your Linux system.
|
||||
file that may be used to build an install-able RPM package for your Linux system.
|
||||
</para>
|
||||
|
||||
<note><para>
|
||||
@ -2191,7 +2191,7 @@ my $smbldap_bind_conf="/etc/smbldap-tools/smbldap_bind.conf";
|
||||
<screen>
|
||||
&rootprompt; rpmbuild -ba -v smbldap-tools.spec
|
||||
</screen>
|
||||
A build process that has completed without error will place the installable binary
|
||||
A build process that has completed without error will place the install-able binary
|
||||
files in the directory <filename>../RPMS/noarch</filename>.
|
||||
</para></step>
|
||||
|
||||
@ -2251,7 +2251,7 @@ Before starting, check
|
||||
. if the domain SID is defined (you can get it with the 'net getlocalsid')
|
||||
|
||||
. you can leave the configuration using the Crtl-c key combination
|
||||
. empty value can be set with the "." caracter
|
||||
. empty value can be set with the "." character
|
||||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
Looking for configuration files...
|
||||
|
||||
@ -2265,7 +2265,7 @@ Let's start configuring the smbldap-tools scripts ...
|
||||
|
||||
. workgroup name: name of the domain Samba act as a PDC
|
||||
workgroup name [MEGANET2] >
|
||||
. netbios name: netbios name of the samba controler
|
||||
. netbios name: netbios name of the samba controller
|
||||
netbios name [MASSIVE] >
|
||||
. logon drive: local path to which the home directory
|
||||
will be connected (for NT Workstations). Ex: 'H:'
|
||||
@ -2292,7 +2292,7 @@ Let's start configuring the smbldap-tools scripts ...
|
||||
and gidNumber available for new users and groups
|
||||
sambaUnixIdPooldn object (relative to ${suffix})
|
||||
[cn=NextFreeUnixId] > sambaDomainName=MEGANET2
|
||||
. ldap master server: IP adress or DNS name
|
||||
. ldap master server: IP address or DNS name
|
||||
of the master (writable) ldap server
|
||||
Use of uninitialized value in scalar chomp at ./configure.pl
|
||||
line 138, <STDIN> line 17.
|
||||
@ -2306,7 +2306,7 @@ Use of uninitialized value in string at ./configure.pl
|
||||
. ldap master port [389] >
|
||||
. ldap master bind dn [cn=Manager,dc=abmas,dc=biz] >
|
||||
. ldap master bind password [] >
|
||||
. ldap slave server: IP adress or DNS name of the slave
|
||||
. ldap slave server: IP address or DNS name of the slave
|
||||
ldap server: can also be the master one
|
||||
Use of uninitialized value in scalar chomp at ./configure.pl
|
||||
line 138, <STDIN> line 21.
|
||||
@ -2331,7 +2331,7 @@ Use of uninitialized value in string at ./configure.pl line 145,
|
||||
. default user gidNumber [513] >
|
||||
. default computer gidNumber [515] >
|
||||
. default login shell [/bin/bash] >
|
||||
. default domain name to append to mail adress [] > abmas.biz
|
||||
. default domain name to append to mail address [] > abmas.biz
|
||||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||||
backup old configuration files:
|
||||
/etc/smbldap-tools/smbldap.conf->
|
||||
@ -2723,7 +2723,7 @@ Domain Computers:x:553:
|
||||
This demonstrates that the <command>nss_ldap</command> library is functioning
|
||||
as it should. If these two steps fail to produce this information refer to
|
||||
<link linkend="sbeavoid"/> for diagnostic procedures that can be followed to
|
||||
isolate the cause of the problem. Procede to the next step only when the steps
|
||||
isolate the cause of the problem. Proceed to the next step only when the steps
|
||||
above have been successfully completed.
|
||||
</para></step>
|
||||
|
||||
@ -2767,11 +2767,11 @@ stans:x:1001:513:System User:/home/stans:/bin/bash
|
||||
chrisr:x:1002:513:System User:/home/chrisr:/bin/bash
|
||||
maryv:x:1003:513:System User:/home/maryv:/bin/bash
|
||||
</screen>
|
||||
This demonstates that user account resolution via LDAP is working.
|
||||
This demonstrates that user account resolution via LDAP is working.
|
||||
</para></step>
|
||||
|
||||
<step><para>
|
||||
This step will determin
|
||||
This step will determine
|
||||
<screen>
|
||||
&rootprompt; id chrisr
|
||||
uid=1002(chrisr) gid=513(Domain Users) groups=513(Domain Users)
|
||||
@ -2911,7 +2911,7 @@ PIOps (S-1-5-21-3504140859-1010554828-2431957765-3005) -> PIOps
|
||||
</screen>
|
||||
This is looking good. Congratulations &smbmdash; it works! Note that in the above output
|
||||
the lines where shortened by replacing the middle value (1010554828) of the SID with the
|
||||
elipsis (...).
|
||||
ellipsis (...).
|
||||
</para></step>
|
||||
|
||||
<step><para>
|
||||
@ -4148,7 +4148,7 @@ HKEY_LOCAL_MACHINE\Default\Software\Microsoft\Windows\
|
||||
<step><para>
|
||||
The printer properties panel for the <guimenu>ps01-color</guimenu> printer on the server
|
||||
<constant>MASSIVE</constant> is displayed. Click the <guimenu>Advanced</guimenu> tab.
|
||||
Note that the box labelled <guimenu>Driver</guimenu> is empty. Click the <guimenu>New Driver</guimenu>
|
||||
Note that the box labeled <guimenu>Driver</guimenu> is empty. Click the <guimenu>New Driver</guimenu>
|
||||
button that is next to the <guimenu>Driver</guimenu> box. This launches the quote<quote>Add Printer Wizard</quote>.
|
||||
</para></step>
|
||||
|
||||
@ -4257,7 +4257,7 @@ HKEY_LOCAL_MACHINE\Default\Software\Microsoft\Windows\
|
||||
</para></blockquote>
|
||||
|
||||
<blockquote><para>
|
||||
Defragment the hard disk &smbmdash; While not obvious to the uninitiated, defragmentation results
|
||||
De-fragment the hard disk &smbmdash; While not obvious to the uninitiated, de-fragmentation results
|
||||
in better performance and often significantly reduces the size of the compressed disk image. That
|
||||
also means it will take less time to deploy the image onto 500 workstations.
|
||||
</para></blockquote>
|
||||
@ -4307,8 +4307,8 @@ HKEY_LOCAL_MACHINE\Default\Software\Microsoft\Windows\
|
||||
|
||||
<listitem><para>
|
||||
Implementation of Samba Primary and Secondary Domain Controllers with a common LDAP backend
|
||||
for user and group accounts that is shared with the UNIX system through the PADL nns_ldap and
|
||||
pam_ldap toolsets.
|
||||
for user and group accounts that is shared with the UNIX system through the PADL nss_ldap and
|
||||
pam_ldap tool-sets.
|
||||
</para></listitem>
|
||||
|
||||
<listitem><para>
|
||||
@ -4406,7 +4406,7 @@ HKEY_LOCAL_MACHINE\Default\Software\Microsoft\Windows\
|
||||
need to be familiar with. Over the years many people have approached me wanting to
|
||||
know the details of exactly how to implement a DHCP and Dynamic DNS server with Samba
|
||||
and WINS. In this chapter, it is plain to see what needs to be configured to provide
|
||||
transparent interoperability. Likewise for CUPS and Samba interoperation. These are
|
||||
transparent interoperability. Likewise for CUPS and Samba inter-operation. These are
|
||||
key stumbling areas for many people.
|
||||
</para>
|
||||
|
||||
|
||||
@ -249,7 +249,7 @@
|
||||
<para>
|
||||
Before proceeding to NT4 migration using either a tdbsam or ldapsam it is most strongly recommended to
|
||||
review <link linkend="ch5-dnshcp-setup"/> for DNS and DHCP configuration. The importance of correctly
|
||||
functioning name resolution must be recognized. This applies equally for hostname as for netBIOS names
|
||||
functioning name resolution must be recognized. This applies equally for hostname as for NetBIOS names
|
||||
(machine names, computer names, domain names, workgroup names &smbmdash; ALL names!).
|
||||
</para>
|
||||
|
||||
@ -623,7 +623,7 @@ ssl off
|
||||
This is deliberate. If these entries are active (not commented out), and the
|
||||
<filename>/ec/ldap.conf</filename> file has been configured, when the LDAP server
|
||||
is started, the process of starting the LDAP server will cause LDAP lookups. This
|
||||
causes the LDAP server <command>slapd</command> to hang becasue it finds port 389
|
||||
causes the LDAP server <command>slapd</command> to hang because it finds port 389
|
||||
open and therefore can not gain exclusive control of it. By commenting these entries
|
||||
out it is possible to avoid this grid-lock situation and thus the over-all
|
||||
installation and configuration will progress more smoothly.
|
||||
@ -651,7 +651,7 @@ bootparams: files
|
||||
automount: files nis
|
||||
aliases: files
|
||||
#passwd_compat: ldap #Not needed.
|
||||
#group_compat: ldapa #Not needed.
|
||||
#group_compat: ldap #Not needed.
|
||||
</screen>
|
||||
</example>
|
||||
|
||||
@ -717,7 +717,7 @@ Before starting, check
|
||||
. if the domain SID is defined (you can get it with the 'net getlocalsid')
|
||||
|
||||
. you can leave the configuration using the Crtl-c key combination
|
||||
. empty value can be set with the "." caracter
|
||||
. empty value can be set with the "." character
|
||||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||||
Looking for configuration files...
|
||||
|
||||
@ -731,7 +731,7 @@ Let's start configuring the smbldap-tools scripts ...
|
||||
|
||||
. workgroup name: name of the domain Samba act as a PDC
|
||||
workgroup name [DAMNATION] >
|
||||
. netbios name: netbios name of the samba controler
|
||||
. netbios name: netbios name of the samba controller
|
||||
netbios name [MERLIN] >
|
||||
. logon drive: local path to which the home directory
|
||||
will be connected (for NT Workstations). Ex: 'H:'
|
||||
@ -758,12 +758,12 @@ Let's start configuring the smbldap-tools scripts ...
|
||||
sambaUnixIdPooldn object (relative to ${suffix})
|
||||
[cn=NextFreeUnixId] > sambaDomainName=DAMNATION
|
||||
. ldap master server:
|
||||
IP adress or DNS name of the master (writable) ldap server
|
||||
IP address or DNS name of the master (writable) ldap server
|
||||
ldap master server [] > 127.0.0.1
|
||||
. ldap master port [389] >
|
||||
. ldap master bind dn [cn=Manager,dc=terpstra-world,dc=org] >
|
||||
. ldap master bind password [] >
|
||||
. ldap slave server: IP adress or DNS name of the slave ldap server:
|
||||
. ldap slave server: IP address or DNS name of the slave ldap server:
|
||||
can also be the master one
|
||||
ldap slave server [] > 127.0.0.1
|
||||
. ldap slave port [389] >
|
||||
@ -779,7 +779,7 @@ Let's start configuring the smbldap-tools scripts ...
|
||||
. default user gidNumber [513] >
|
||||
. default computer gidNumber [515] >
|
||||
. default login shell [/bin/bash] >
|
||||
. default domain name to append to mail adress [] > terpstra-world.org
|
||||
. default domain name to append to mail address [] > terpstra-world.org
|
||||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||||
backup old configuration files:
|
||||
/etc/smbldap-tools/smbldap.conf->
|
||||
@ -833,7 +833,7 @@ bootparams: files
|
||||
automount: files nis
|
||||
aliases: files
|
||||
#passwd_compat: ldap #Not needed.
|
||||
#group_compat: ldapa #Not needed.
|
||||
#group_compat: ldap #Not needed.
|
||||
</screen>
|
||||
</example>
|
||||
|
||||
@ -871,7 +871,7 @@ adding new entry: cn=Print Operators,ou=Groups,dc=terpstra-world,dc=org
|
||||
adding new entry: cn=Backup Operators,ou=Groups,dc=terpstra-world,dc=org
|
||||
adding new entry: cn=Replicators,ou=Groups,dc=terpstra-world,dc=org
|
||||
</screen>
|
||||
The script trys to add the ou=People container twice, hence the error message.
|
||||
The script tries to add the ou=People container twice, hence the error message.
|
||||
This is expected behavior.
|
||||
</para></step>
|
||||
|
||||
@ -1056,7 +1056,7 @@ Users (S-1-5-32-545) -> Users
|
||||
<step><para>
|
||||
The final responsibility in the migration process is to create identical
|
||||
shares and printing resources on the new Samba-3 server, copy all data
|
||||
across, set up privilieges and set share and file/directory access controls.
|
||||
across, set up privileges and set share and file/directory access controls.
|
||||
</para></step>
|
||||
|
||||
<step><para>
|
||||
@ -1080,7 +1080,7 @@ Users (S-1-5-32-545) -> Users
|
||||
</para></step>
|
||||
|
||||
<step><para>
|
||||
The configuration of Samba-3 BDC servers can be accomplised now, or at any
|
||||
The configuration of Samba-3 BDC servers can be accomplished now, or at any
|
||||
convenient time in the future. Please refer to the carefully detailed process
|
||||
for doing this that has been outlined in <link linkend="sbehap-bldg1"/>.
|
||||
</para></step>
|
||||
@ -1525,7 +1525,7 @@ Users Ordinary users
|
||||
When migrating a <filename>smbpasswd</filename> file to an LDAP backend, the
|
||||
UID of each account is taken together with the account information in the
|
||||
<filename>/etc/passwd</filename> and both sets of data are used to create the account
|
||||
entrt in the LDAP database.
|
||||
entry in the LDAP database.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
|
||||
@ -64,7 +64,7 @@
|
||||
|
||||
<para>
|
||||
File paths have been modified to permit use of RPM packages provided by Novell. In the
|
||||
original documenation contributed by Misty a the Courier-IMAP package had been built
|
||||
original documentation contributed by Misty a the Courier-IMAP package had been built
|
||||
directly from the original source tarball.
|
||||
</para>
|
||||
|
||||
@ -145,9 +145,9 @@
|
||||
The complete removal of all site-specific information in order to produce
|
||||
a generic migration solution would rob this chapter of its character.
|
||||
It should be recognized therefore, that the examples given will require
|
||||
significant adaptation to suit local needs and thus it is recoognized that
|
||||
significant adaptation to suit local needs and thus it is recognized that
|
||||
there are some gaps in the example files. That is not Misty's fault, it
|
||||
is the result of treatement given to her files in an attempt to make
|
||||
is the result of treatment given to her files in an attempt to make
|
||||
the overall information more useful to you.
|
||||
</para>
|
||||
|
||||
@ -239,7 +239,7 @@
|
||||
|
||||
<para>
|
||||
Given that a decision had been made to use Courier-IMAP the schema <quote>authldap.schema</quote>
|
||||
from the Courier-IMAP source tarball is ncessary to resolve Courier-specific LDAP directory
|
||||
from the Courier-IMAP source tarball is necessary to resolve Courier-specific LDAP directory
|
||||
needs. Where the Courier-IMAP file provided by SUSE is used this file is named
|
||||
<filename>courier.schema</filename>.
|
||||
</para>
|
||||
@ -253,13 +253,13 @@
|
||||
|
||||
<para>
|
||||
An attempt was made to use the PADL POSIX account migration scripts but I gave up trying to
|
||||
make them work. Instead, even though it is most ineligant, I wrote a simple script that did
|
||||
make them work. Instead, even though it is most inelegant, I wrote a simple script that did
|
||||
what I needed. It is enclosed as a simple example to demonstrate that you do not need to be
|
||||
a guru to make light of otherwise painful repetition. This file is listed in <link linkend="sbeamg"/>.
|
||||
</para>
|
||||
|
||||
<example id="sbeamg">
|
||||
<title>A Rought Tool to Create an LDIF File from the System Account Files</title>
|
||||
<title>A Rough Tool to Create an LDIF File from the System Account Files</title>
|
||||
<screen>
|
||||
#!/bin/bash
|
||||
|
||||
@ -290,7 +290,7 @@ done
|
||||
<title>Editors' Note</title>
|
||||
The PADL MigrationTools are recommended for migration of the UNIX account information into
|
||||
the LDAP directory. The tools consist of a set of Perl scripts for migration of users, groups,
|
||||
aliases, hosts, netgroups, networks, protocols, PRCs, and services from the existing ascii text
|
||||
aliases, hosts, netgroups, networks, protocols, PRCs, and services from the existing ASCII text
|
||||
files (or from a name service such as NIS). This too set can be obtained from the <ulink url=
|
||||
"http://www.padl.com">PADL</ulink> web site.
|
||||
</para></note>
|
||||
@ -529,7 +529,7 @@ ldap_version 3
|
||||
rootbinddn cn=Manager,dc=abmas,dc=biz
|
||||
|
||||
# Filter to AND with uid=%s
|
||||
pam_filter objectclass=posixAccoun
|
||||
pam_filter objectclass=posixAccount
|
||||
|
||||
# The user ID attribute (defaults to uid)
|
||||
pam_login_attribute uid
|
||||
@ -893,7 +893,7 @@ session: none
|
||||
is shown in <link linkend="sbexcld"/>. The reason I had to have the
|
||||
<command>rsync</command> daemon running on a system which could be
|
||||
rebooted frequently is because <constant>ncpfs</constant>
|
||||
(part of the MARS Netware Emulation package) has a nasty habit of creating stale
|
||||
(part of the MARS NetWare Emulation package) has a nasty habit of creating stale
|
||||
mount points which cannot be recovered without a reboot. The reason for hourly
|
||||
synchronization is because some part of the chain was very slow and
|
||||
performance-heavy (whether <command>rsync</command> itself, the network,
|
||||
@ -1141,9 +1141,9 @@ userHomeDrive=""
|
||||
|
||||
# The default user netlogon script name (%U username substitution)
|
||||
# if not used, will be automatically username.cmd
|
||||
# make sure script file is edited under dos
|
||||
# make sure script file is edited under DOS
|
||||
# Ex: %U.cmd
|
||||
# userScript="startup.cmd" # make sure script file is edited under dos
|
||||
# userScript="startup.cmd" # make sure script file is edited under DOS
|
||||
userScript=""
|
||||
|
||||
# Domain appended to the users "mail"-attribute
|
||||
@ -1182,7 +1182,7 @@ smbpasswd="/usr/bin/smbpasswd"
|
||||
############################
|
||||
# Credential Configuration #
|
||||
############################
|
||||
# Notes: you can specify two differents configuration if you use a
|
||||
# Notes: you can specify two different configuration if you use a
|
||||
# master ldap for writing access and a slave ldap server for reading access
|
||||
# By default, we will use the same DN (so it will work for standard Samba
|
||||
# release)
|
||||
@ -1250,7 +1250,7 @@ ou: Idmap
|
||||
<indexterm><primary>smbldap-groupadd</primary></indexterm>
|
||||
<indexterm><primary>RID</primary></indexterm>
|
||||
<indexterm><primary>sambaGroupMapping</primary></indexterm>
|
||||
With the LDAP directory now intialized it is time to create the Windows and POSIX
|
||||
With the LDAP directory now initialized it is time to create the Windows and POSIX
|
||||
(UNIX) group accounts as well as the mappings from Windows groups to UNIX groups.
|
||||
The easiest way to do this is to use <command>smbldap-groupadd</command> command.
|
||||
It will create the group with the posixGroup and sambaGroupMapping attributes, a
|
||||
@ -1381,7 +1381,7 @@ sambaAcctFlags: [W ]
|
||||
So now I can log in with a test user from the machine w2kengrspare. It's all fine and
|
||||
good, but that user is in no groups yet so has pretty boring access. We can fix that
|
||||
by writing the login script! To write the login script, I used
|
||||
<ulink url="http://www.kixtart.org">Kixstart</ulink>. I used it because it will work
|
||||
<ulink url="http://www.kixtart.org">Kixtart</ulink>. I used it because it will work
|
||||
with every architecture of Windows, has an active and helpful user base, and was both
|
||||
easier to learn and more powerful than the standard netlogon scripts I have seen.
|
||||
I also did not have to do a logon script per user or per group.
|
||||
@ -1409,7 +1409,7 @@ kxrpc.exe <-- Probably useless as it has to run on the server and can
|
||||
</para>
|
||||
|
||||
<example id="ch8kix">
|
||||
<title>Kixstart Control File &smbmdash; File: logon.kix</title>
|
||||
<title>Kixtart Control File &smbmdash; File: logon.kix</title>
|
||||
<screen>
|
||||
; This script just calls the other scripts.
|
||||
|
||||
@ -1440,7 +1440,7 @@ ENDIF
|
||||
</example>
|
||||
|
||||
<example id="ch8kix2">
|
||||
<title>Kixstart Control File &smbmdash; File: main.kix</title>
|
||||
<title>Kixtart Control File &smbmdash; File: main.kix</title>
|
||||
<screen>
|
||||
break on
|
||||
|
||||
@ -1476,19 +1476,19 @@ USE N: \\massive\network
|
||||
</example>
|
||||
|
||||
<example id="ch8kix3">
|
||||
<title>Kixstart Control File &smbmdash; File: setup.kix, Part A</title>
|
||||
<title>Kixtart Control File &smbmdash; File: setup.kix, Part A</title>
|
||||
<screen>
|
||||
; My setup.kix is where all of the redirection stuff happens. Note that with
|
||||
; the use of registry keys, ths only happens the first time they log in ,or if
|
||||
; the use of registry keys, this only happens the first time they log in ,or if
|
||||
; I delete the pertinent registry keys which triggers it to happen again:
|
||||
|
||||
; Check to see if we have written the Borkholder subkey before
|
||||
$RETURNCODE = EXISTKEY("HKEY_CURRENT_USER\Borkholder")
|
||||
; Check to see if we have written the abmas sub-key before
|
||||
$RETURNCODE = EXISTKEY("HKEY_CURRENT_USER\abmas")
|
||||
IF NOT $RETURNCODE = 0
|
||||
; Add key for Borkholder-specific things on the first login
|
||||
ADDKEY("HKEY_CURRENT_USER\Borkholder")
|
||||
; Add key for abmas-specific things on the first login
|
||||
ADDKEY("HKEY_CURRENT_USER\abmas")
|
||||
; The following key gets deleted at the end of the first login
|
||||
ADDKEY("HKEY_CURRENT_USER\Borkholder\FIRST_LOGIN")
|
||||
ADDKEY("HKEY_CURRENT_USER\abmas\FIRST_LOGIN")
|
||||
ENDIF
|
||||
|
||||
; People with laptops need My Documents to be in their profile. People with
|
||||
@ -1498,14 +1498,14 @@ ENDIF
|
||||
; Check to see if this is the first login -- doesn't make sense to do this
|
||||
; at the very first login
|
||||
|
||||
$RETURNCODE = EXISTKEY("HKEY_CURRENT_USER\Borkholder\FIRST_LOGIN")
|
||||
$RETURNCODE = EXISTKEY("HKEY_CURRENT_USER\abmas\FIRST_LOGIN")
|
||||
IF NOT $RETURNCODE = 0
|
||||
|
||||
; We don't want to do this stuff for people with laptops or people in the FURN
|
||||
; group. (They store their profiles in a different server)
|
||||
|
||||
IF NOT INGROUP("MASSIVE\Laptop","MASSIVE\FURN")
|
||||
$RETURNCODE=EXISTKEY("HKEY_CURRENT_USER\Borkholder\profile_copied")
|
||||
$RETURNCODE=EXISTKEY("HKEY_CURRENT_USER\abmas\profile_copied")
|
||||
|
||||
; A crude way to tell what OS our profile is for and copy the "My Documents"
|
||||
; to the redirected folder on the server. It works because the profiles
|
||||
@ -1527,12 +1527,12 @@ IF NOT $RETURNCODE = 0
|
||||
</example>
|
||||
|
||||
<example id="ch8kix3b">
|
||||
<title>Kixstart Control File &smbmdash; File: setup.kix, Part B</title>
|
||||
<title>Kixtart Control File &smbmdash; File: setup.kix, Part B</title>
|
||||
<screen>
|
||||
; Now we will write the registry values to redirect the locations of "My
|
||||
Documents"
|
||||
; and other folders.
|
||||
ADDKEY("HKEY_CURRENT_USER\Borkholder\profile_copied")
|
||||
ADDKEY("HKEY_CURRENT_USER\abmas\profile_copied")
|
||||
WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
|
||||
Windows\CurrentVersion\Explorer\User
|
||||
Shell Folders", "Personal","\\massive\@userID","REG_SZ")
|
||||
@ -1554,18 +1554,18 @@ Shell Folders", "My eBooks", "\\massive\@userID\My eBooks", "REG_SZ")
|
||||
ENDIF
|
||||
ENDIF
|
||||
|
||||
; Now we will delete the FIRST_LOGIN subkey that we made before.
|
||||
; Note - to run this script again you will want to delete the HKCU\Borkholder
|
||||
; subkey, log out, and log back in.
|
||||
$RETURNVALUE = EXISTKEY("HKEY_CURRENT_USER\Borkholder\FIRST_LOGIN")
|
||||
; Now we will delete the FIRST_LOGIN sub-key that we made before.
|
||||
; Note - to run this script again you will want to delete the HKCU\abmas
|
||||
; sub-key, log out, and log back in.
|
||||
$RETURNVALUE = EXISTKEY("HKEY_CURRENT_USER\abmas\FIRST_LOGIN")
|
||||
IF $RETURNVALUE = 0
|
||||
DELKEY("HKEY_CURRENT_USER\Borkholder\FIRST_LOGIN")
|
||||
DELKEY("HKEY_CURRENT_USER\abmas\FIRST_LOGIN")
|
||||
ENDIF
|
||||
</screen>
|
||||
</example>
|
||||
|
||||
<example id="ch8kix4">
|
||||
<title>Kixstart Control File &smbmdash; File: acct.kix</title>
|
||||
<title>Kixtart Control File &smbmdash; File: acct.kix</title>
|
||||
<screen>
|
||||
; And here is one group-oriented script to show what can be
|
||||
; done that way: acct.kix:
|
||||
@ -1590,11 +1590,11 @@ ENDIF
|
||||
|
||||
<para>
|
||||
As you can see in the script, I redirect the My Documents to the user's home
|
||||
share if they are not in the “Laptop” group. I also add printers on a
|
||||
share if they are not in the Laptop group. I also add printers on a
|
||||
group-by-group basis, and if applicable I setthe group printer. For this to
|
||||
be effective, the print drivers must be installed on the Samba server in the
|
||||
<filename>[print$]</filename> share. Ample documentation exists about how to do that so I did not
|
||||
cover it.
|
||||
<filename>[print$]</filename> share. Ample documentation exists about how to
|
||||
do that so I did not cover it.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
@ -1609,11 +1609,12 @@ ENDIF
|
||||
<para>
|
||||
Also of note for Win9x is that the drive mappings and printer setup will not
|
||||
work because they rely on RPC. One merely has to put the appropriate settings
|
||||
into the <filename>c:\autoexec.bat</filename> file or map the drives manually. One option would
|
||||
be to check the OS as part of the Kixtart script, and if it is Win9x and if
|
||||
it is the first login, copy a pre-made <filename>autoexec.bat</filename> to the <filename>C:</filename> drive. I only
|
||||
have three such machines and one is going away in the very near future, so it
|
||||
was easier to do it by hand.
|
||||
into the <filename>c:\autoexec.bat</filename> file or map the drives manually.
|
||||
One option would be to check the OS as part of the Kixtart script, and if it
|
||||
is Win9x and if it is the first login, copy a pre-made
|
||||
<filename>autoexec.bat</filename> to the <filename>C:</filename> drive. I
|
||||
only have three such machines and one is going away in the very near future,
|
||||
so it was easier to do it by hand.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
@ -1621,7 +1622,7 @@ ENDIF
|
||||
At this point I was able to add the users. This is the part that really falls
|
||||
into upgrade. I moved the users over one group at a time, starting with the
|
||||
people who used the least amount of resources on the network. With each group
|
||||
that I moved, I first logged in as a “standard” user in that group and took
|
||||
that I moved, I first logged in as a standard user in that group and took
|
||||
careful note of their environment, mainly the printers they used, their PATH,
|
||||
and what network resources they had access to (most importantly which ones
|
||||
they actually needed access to).
|
||||
@ -1700,7 +1701,7 @@ ENDIF
|
||||
|
||||
<para>
|
||||
After all these steps are accomplished, only cleanup details are left. Make sure user's
|
||||
shortcuts and “Network Places” point to the appropriate place on the new server, check
|
||||
shortcuts and Network Places point to the appropriate place on the new server, check
|
||||
the important applications to be sure they work as expected and troubleshoot any problems
|
||||
that might arise, check to be sure the user's printers are present and working. By the
|
||||
way, if there are any network printers installed as system printers (the Novell way)
|
||||
@ -1742,7 +1743,7 @@ ENDIF
|
||||
the printer in a raw format. CUPS sends them in Postscript by default. I had
|
||||
to make a second printer definition for one printer and tell CUPS specifically
|
||||
to send raw data to the printer, and assign this printer to the LPT port with
|
||||
Kixtart's version of the “net use”command.
|
||||
Kixtart's version of the net use command.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
@ -1766,10 +1767,10 @@ ENDIF
|
||||
I went from a very high load on the server to an average load of between 1
|
||||
and 2 runnable processes on the server. I have improved the security and
|
||||
robustness of the system. I have also implemented
|
||||
<ulink url="http://www.clamav.net">ClamAV</ulink> Antivirus
|
||||
<ulink url="http://www.clamav.net">ClamAV</ulink> Anti-virus
|
||||
which scans the entire Samba server for viruses every two hours and
|
||||
quarantines them. I have found it much less problematic than our ancient
|
||||
version of Norton Antivirus Corporate Edition, and much more up-to-date.
|
||||
version of Norton Anti-virus Corporate Edition, and much more up-to-date.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
|
||||
@ -363,7 +363,7 @@ Basic OS 256.0 256 256
|
||||
estimate of 0.1 MBytes/sec per user. This would suggest that 100-Base-T (approx. 10 MBytes/sec)
|
||||
would deliver below acceptable capacity for the initial user load. It is, therefore, a good
|
||||
idea to begin with 1 Gigabit ethernet cards for the two internal networks, each attached
|
||||
to a 1 Gigabit Etherswitch that provides connectivity to an expandable array of 100-Base-T
|
||||
to a 1 Gigabit Ethernet switch that provides connectivity to an expandable array of 100-Base-T
|
||||
switched ports.
|
||||
</para>
|
||||
|
||||
@ -411,7 +411,7 @@ Given 500 Users and 2 years:
|
||||
<indexterm>
|
||||
<primary>storage capacity</primary>
|
||||
</indexterm>
|
||||
The preferred storage capacity should be approximately 1 TeraByte. Use of RAID level 5
|
||||
The preferred storage capacity should be approximately 1 Terabyte. Use of RAID level 5
|
||||
with two hot spare drives would require an 8 drive by 200 GByte capacity per drive array.
|
||||
</para>
|
||||
|
||||
|
||||
@ -7,7 +7,7 @@
|
||||
|
||||
<para>
|
||||
This is the start of the real journey toward the successful deployment of Samba. For some this chapter
|
||||
is the end of the road bacause their needs will have been adequately met. For others, this chapter is
|
||||
is the end of the road because their needs will have been adequately met. For others, this chapter is
|
||||
the beginning of a journey that will take them well past the contents of this book. This book provides
|
||||
example configurations of, for the greater part, complete networking solutions. The intent of this book
|
||||
is to help you to get your Samba installation working with least pain and agony.
|
||||
@ -71,7 +71,7 @@
|
||||
<para>
|
||||
Our fictitious company is called <emphasis>Abmas Design Inc.</emphasis> This is a three-person
|
||||
computer-aided design (CAD) business that often has more work than can be handled. The
|
||||
business owner hires contract draftspeople from wherever he can. They bring their own
|
||||
business owner hires contract drafts-people from wherever he can. They bring their own
|
||||
notebook computers into the office. There are four permanent drafting machines. Abmas has a
|
||||
collection of over 10 years of plans that must be available for all draftsmen to reference.
|
||||
Abmas hires the services of an experienced network engineer to update the
|
||||
|
||||
@ -187,8 +187,8 @@
|
||||
</para>
|
||||
|
||||
<para>
|
||||
<indexterm><primary>ethernet switch</primary></indexterm>
|
||||
You have split the network into two separate areas. Each has its own ethernet switch.
|
||||
<indexterm><primary>Ethernet switch</primary></indexterm>
|
||||
You have split the network into two separate areas. Each has its own Ethernet switch.
|
||||
There are 20 users on the accounting network and 32 users on the financial services
|
||||
network. The server has two network interfaces, one serving each network. The
|
||||
network printers will be located in a central area. You plan to install the new
|
||||
@ -611,7 +611,7 @@ subnet 127.0.0.0 netmask 255.0.0.0 {
|
||||
<primary>chkconfig</primary>
|
||||
</indexterm>
|
||||
<screen>
|
||||
&rootprompt; chkconfig dhpc on
|
||||
&rootprompt; chkconfig dhcp on
|
||||
&rootprompt; chkconfig smb on
|
||||
&rootprompt; chkconfig cups on
|
||||
&rootprompt; /etc/rc.d/init.d/dhcp restart
|
||||
|
||||
@ -487,7 +487,7 @@ Paths:
|
||||
<para>
|
||||
<indexterm><primary>8-bit</primary></indexterm>
|
||||
Non-English users whose national language character set has special characters and who upgrade naively will
|
||||
find that many files that have the special chracters in the file name will see them garbled and jumbled up.
|
||||
find that many files that have the special characters in the file name will see them garbled and jumbled up.
|
||||
This typically happens with umlauts and accents because these characters were particular to the codepage
|
||||
that was in use with Samba-2.x using an 8-bit encoding scheme.
|
||||
</para>
|
||||
@ -581,8 +581,8 @@ Samba-2.x could be compiled with LDAP support.
|
||||
|
||||
<step><para>
|
||||
<indexterm><primary>RPM</primary></indexterm>
|
||||
It is now safe to ugrade the Samba installation. On Linux systems
|
||||
it is not necessary to remove the Samba RPMs becasue a simple
|
||||
It is now safe to upgrade the Samba installation. On Linux systems
|
||||
it is not necessary to remove the Samba RPMs because a simple
|
||||
upgrade installation will automatically remove the old files.
|
||||
</para>
|
||||
|
||||
@ -683,7 +683,7 @@ Samba-2.x could be compiled with LDAP support.
|
||||
<indexterm><primary>add machine script</primary></indexterm>
|
||||
<indexterm><primary>add user script</primary></indexterm>
|
||||
The <parameter>add machine script</parameter> functionality was previously
|
||||
hanlded by the <parameter>add user script</parameter>, which in Samba-3 is
|
||||
handled by the <parameter>add user script</parameter>, which in Samba-3 is
|
||||
used exclusively to add user accounts.
|
||||
</para>
|
||||
|
||||
@ -709,7 +709,7 @@ Samba-2.x could be compiled with LDAP support.
|
||||
<indexterm><primary>Idealx</primary></indexterm>
|
||||
Where the <parameter>passdb backend</parameter> makes use of an LDAP directory
|
||||
it will be necessary either to use the <constant>smbldap-tools</constant> provided
|
||||
by Idealx, or else to use an alternate toolset either provided by another third
|
||||
by Idealx, or else to use an alternate tool-set either provided by another third
|
||||
party, or else home crafted tools to manage the LDAP directory accounts.
|
||||
</para>
|
||||
|
||||
@ -779,7 +779,7 @@ aware of when moving to Samba 3.0.
|
||||
Kerberos 5 and LDAP protocols.
|
||||
|
||||
MIT kerberos 1.3.1 supports the ARCFOUR-HMAC-MD5 encryption
|
||||
type which is neccessary for servers on which the
|
||||
type which is necessary for servers on which the
|
||||
administrator password has not been changed, or kerberos-enabled
|
||||
SMB connections to servers that require Kerberos SMB signing.
|
||||
Besides this one difference, either MIT or Heimdal Kerberos
|
||||
@ -914,7 +914,7 @@ Clearly, such agreement is further away than a pipe-dream.
|
||||
|
||||
<para>
|
||||
<indexterm><primary>vendors</primary></indexterm>
|
||||
Vendors and packagers who produce Samba binary installable packages do not,
|
||||
Vendors and packagers who produce Samba binary install-able packages do not,
|
||||
as a rule, use the default paths used by the Samba-Team for the location of
|
||||
the binary files, the &smb.conf; file, and the Samba control files (tdb's
|
||||
as well as files such as <filename>secrets.tdb</filename>. This means that
|
||||
@ -959,7 +959,7 @@ the procedure outlined above.
|
||||
<para>
|
||||
With the provision that the binary Samba-3 package has been built
|
||||
with the same path and feature settings as the existing Samba-3
|
||||
package that is being updated, an update of Samab-3 versions 3.0.0
|
||||
package that is being updated, an update of Samba-3 versions 3.0.0
|
||||
through 3.0.4 can be updated to 3.0.5 without loss of functionality
|
||||
and without need to change either the &smb.conf; file or, where
|
||||
used, the LDAP schema.
|
||||
@ -990,7 +990,7 @@ the procedure outlined above.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
After updating the LDAP schema, do not forget to reindex the LDAP database.
|
||||
After updating the LDAP schema, do not forget to re-index the LDAP database.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
||||
@ -60,7 +60,7 @@
|
||||
</para>
|
||||
|
||||
<para>
|
||||
The Samba mailing list's users have asked for sample configuration files
|
||||
The Samba mailing lists users have asked for sample configuration files
|
||||
that work. It is natural to question one's own ability to correctly
|
||||
configure a complex tool such as Samba until a minimum necessary
|
||||
knowledge level has been attained.
|
||||
@ -272,7 +272,7 @@
|
||||
<para>
|
||||
Clearly the first edition contained most of what was needed and that was missing
|
||||
from other books that cover this difficult subject. The new arrangement adds
|
||||
additional material to meet consumer requests and includeis changes that originated
|
||||
additional material to meet consumer requests and includes changes that originated
|
||||
as suggestions for improvement.
|
||||
</para>
|
||||
|
||||
@ -463,7 +463,7 @@
|
||||
information that is not covered elsewhere in the Samba documentation.
|
||||
</para>
|
||||
|
||||
<para><emphasis>Technifo</emphasis> &smbmdash; Samba stores a lot of essential network
|
||||
<para><emphasis>TechInfo</emphasis> &smbmdash; Samba stores a lot of essential network
|
||||
information in a large and growing collection of files. This chapter documents the
|
||||
essentials of where those files may be located and how to find them. It also provide
|
||||
an insight into inter-related matters that affect a Samba installation.
|
||||
@ -496,7 +496,7 @@
|
||||
</para>
|
||||
|
||||
<para><emphasis>TechInfo</emphasis> &smbmdash; The documentation provided demonstrates
|
||||
how one site miigrated from NetWare to Samba. Some alternatives tools are mentioned. These
|
||||
how one site migrated from NetWare to Samba. Some alternatives tools are mentioned. These
|
||||
could be used to provide another pathway to a successful migration.
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
@ -57,7 +57,7 @@ The examples have been tested with Red Hat Fedora Core 2, Novell SUSE Linux Prof
|
||||
9.2 and Novell SUSE Linux Enterprise Server (SLES) 9. The principals of implementation
|
||||
apply to all Linux and UNIX systems in general, though some system files and tools will
|
||||
be different and the location of some Samba file locations will be different since these
|
||||
are determinered by the person who packages Samba for each platform.
|
||||
are determined by the person who packages Samba for each platform.
|
||||
</para>
|
||||
|
||||
</partintro>
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user