mirror of
https://github.com/samba-team/samba.git
synced 2025-01-28 17:47:29 +03:00
323 lines
14 KiB
HTML
323 lines
14 KiB
HTML
|
|
|
|
|
|
|
|
|
|
<html><head><title>winbindd (8)</title>
|
|
|
|
<link rev="made" href="mailto:samba-bugs@samba.org">
|
|
</head>
|
|
<body>
|
|
|
|
<hr>
|
|
|
|
<h1>winbindd (8)</h1>
|
|
<h2>Samba</h2>
|
|
<h2>13 Jun 2000</h2>
|
|
|
|
|
|
|
|
<p><a name="NAME"></a>
|
|
<h2>NAME</h2>
|
|
winbindd - Name Service Switch daemon for resolving names from NT servers
|
|
<p><a name="SYNOPSIS"></a>
|
|
<h2>SYNOPSIS</h2>
|
|
|
|
<p><strong>winbindd</strong> [<a href="winbindd.8.html#minusd">-d debuglevel</a>] [<a href="winbindd.8.html#minusi">-i</a>]
|
|
<p><a name="DESCRIPTION"></a>
|
|
<h2>DESCRIPTION</h2>
|
|
|
|
<p>This program is part of the <strong>Samba</strong> suite version 3.0 and describes
|
|
functionality not yet implemented in the main version of Samba.
|
|
<p><strong>winbindd</strong> is a daemon that provides a service for the Name Service
|
|
Switch capability that is present in most modern C libraries. The Name
|
|
Service Switch allows user and system information to be obtained from
|
|
different databases services such as NIS or DNS. The exact behaviour can
|
|
be configured throught the <code>/etc/nsswitch.conf</code> file. Users and groups
|
|
are allocated as they are resolved to a range of user and group ids
|
|
specified by the administrator of the Samba system.
|
|
<p>The service provided by <strong>winbindd</strong> is called `winbind' and can be
|
|
used to resolve user and group information from a Windows NT server.
|
|
The service can also provide authentication services via an associated
|
|
PAM module.
|
|
<p>The following nsswitch databases are implemented by the <strong>winbindd</strong>
|
|
service:
|
|
<p><dl>
|
|
<p><p></p><dt><strong>passwd</strong><dd>
|
|
<p>User information traditionally stored in the <strong>passwd(5)</strong> file and used by
|
|
<strong>getpwent(3)</strong> functions.
|
|
<p><p></p><dt><strong>group</strong><dd>
|
|
<p>Group information traditionally stored in the <strong>group(5)</strong> file and used by
|
|
<strong>getgrent(3)</strong> functions.
|
|
<p></dl>
|
|
<p>For example, the following simple configuration in the
|
|
<code>/etc/nsswitch.conf</code> file can be used to initially resolve user and group
|
|
information from <code>/etc/passwd</code> and <code>/etc/group</code> and then from the
|
|
Windows NT server.
|
|
<p><pre>
|
|
|
|
passwd: files winbind
|
|
group: files winbind
|
|
|
|
</pre>
|
|
|
|
<p><a name="OPTIONS"></a>
|
|
<h2>OPTIONS</h2>
|
|
|
|
<p>The following options are available to the <strong>winbindd</strong> daemon:
|
|
<p><dl>
|
|
<p><a name="minusd"></a>
|
|
<p></p><dt><strong><strong>-d debuglevel</strong></strong><dd>
|
|
Sets the debuglevel to an integer between 0 and 100. 0 is for no debugging
|
|
and 100 is for reams and reams. To submit a bug report to the Samba Team,
|
|
use debug level 100 (see <strong>BUGS.txt</strong>).
|
|
<p><a name="minusi"></a>
|
|
<p></p><dt><strong><strong>-i</strong></strong><dd>
|
|
Tells <strong>winbindd</strong> to not become a daemon and detach from the current terminal.
|
|
This option is used by developers when interactive debugging of <strong>winbindd</strong> is
|
|
required.
|
|
<p></dl>
|
|
<p><a name="NAMEANDIDRESOLUTION"></a>
|
|
<h2>NAME AND ID RESOLUTION</h2>
|
|
|
|
<p>Users and groups on a Windows NT server are assigned a relative id (rid)
|
|
which is unique for the domain when the user or group is created. To
|
|
convert the Windows NT user or group into a unix user or group, a mapping
|
|
between rids and unix user and group ids is required. This is one of the
|
|
jobs that <strong>winbindd</strong> performs.
|
|
<p>As <strong>winbindd</strong> users and groups are resolved from a server, user and group
|
|
ids are allocated from a specified range. This is done on a first come,
|
|
first served basis, although all existing users and groups will be mapped
|
|
as soon as a client performs a user or group enumeration command. The
|
|
allocated unix ids are stored in a database file under the Samba lock
|
|
directory and will be remembered.
|
|
<p>WARNING: The rid to unix id database is the only location where the user
|
|
and group mappings are stored by <strong>winbindd</strong>. If this file is deleted or
|
|
corrupted, there is no way for <strong>winbindd</strong> to determine which user and
|
|
group ids correspond to Windows NT user and group rids.
|
|
<p><a name="CONFIGURATION"></a>
|
|
<h2>CONFIGURATION</h2>
|
|
|
|
<p>Configuration of the <strong>winbindd</strong> daemon is done through configuration
|
|
parameters in the <a href="smb.conf.5.html"><strong>smb.conf</strong></a> file. All parameters
|
|
should be specified in the [global] section of
|
|
<a href="smb.conf.5.html"><strong>smb.conf</strong></a>.
|
|
<p><dl>
|
|
<p><p></p><dt><strong>winbind separator</strong><dd>
|
|
<p>The winbind separator option allows you to specify how NT domain names
|
|
and user names are combined into unix user names when presented to
|
|
users. By default winbind will use the traditional \ separator so
|
|
that the unix user names look like DOMAIN\username. In some cases
|
|
this separator character may cause problems as the \ character has
|
|
special meaning in unix shells. In that case you can use the winbind
|
|
separator option to specify an alternative sepataror character. Good
|
|
alternatives may be / (although that conflicts with the unix directory
|
|
separator) or a + character. The + character appears to be the best
|
|
choice for 100% compatibility with existing unix utilities, but may be
|
|
an aesthetically bad choice depending on your taste.
|
|
<p><strong>Default:</strong>
|
|
<code> winbind separator = \</code>
|
|
<p><strong>Example:</strong>
|
|
<code> winbind separator = +</code>
|
|
<p><p></p><dt><strong>winbind uid</strong><dd>
|
|
<p>The winbind uid parameter specifies the range of user ids that are
|
|
allocated by the <strong>winbindd</strong> daemon. This range of
|
|
ids should have no existing local or nis users within it as strange
|
|
conflicts can occur otherwise.
|
|
<p><strong>Default:</strong>
|
|
<code> winbind uid = <empty string></code>
|
|
<p><strong>Example:</strong>
|
|
<code> winbind uid = 10000-20000</code>
|
|
<p><p></p><dt><strong>winbind gid</strong><dd>
|
|
<p>The winbind gid parameter specifies the range of group ids that are
|
|
allocated by the <strong>winbindd</strong> daemon. This range of group ids should have
|
|
no existing local or nis groups within it as strange conflicts can occur
|
|
otherwise.
|
|
<p><strong>Default:</strong>
|
|
<code> winbind gid = <empty string></code>
|
|
<p><strong>Example:</strong>
|
|
<code> winbind gid = 10000-20000</code>
|
|
<p><p></p><dt><strong>winbind cache time</strong><dd>
|
|
<p>This parameter specifies the number of seconds the <strong>winbindd</strong> daemon will
|
|
cache user and group information before querying a Windows NT server
|
|
again. When a item in the cache is older than this time <strong>winbindd</strong> will ask
|
|
the domain controller for the sequence number of the servers account
|
|
database. If the sequence number has not changed then the cached item is
|
|
marked as valid for a further "winbind cache time" seconds. Otherwise the
|
|
item is fetched from the server. This means that as long as the account
|
|
database is not actively changing <strong>winbindd</strong> will only have to send one
|
|
sequence number query packet every "winbind cache time" seconds.
|
|
<p><strong>Default:</strong>
|
|
<code> winbind cache time = 15</code>
|
|
<p><p></p><dt><strong>template homedir</strong><dd>
|
|
<p>When filling out the user information for a Windows NT user, the
|
|
<strong>winbindd</strong> daemon uses this parameter to fill in the home directory for
|
|
that user. If the string <code>%D</code> is present it is substituted with the
|
|
user's Windows NT domain name. If the string <code>%U</code> is present it is
|
|
substituted with the user's Windows NT user name.
|
|
<p><strong>Default:</strong>
|
|
<code> template homedir = /home/%D/%U</code>
|
|
<p><p></p><dt><strong>template shell</strong><dd>
|
|
<p>When filling out the user information for a Windows NT user, the
|
|
<strong>winbindd</strong> daemon uses this parameter to fill in the shell for that user.
|
|
<p><strong>Default:</strong>
|
|
<code> template shell = /bin/false</code>
|
|
<p></dl>
|
|
<p><a name="EXAMPLESETUP"></a>
|
|
<h2>EXAMPLE SETUP</h2>
|
|
|
|
<p>To setup <strong>winbindd</strong> for user and group lookups plus authentication from
|
|
a domain controller use something like the following setup. This was
|
|
tested on a RedHat 6.2 Linux box.
|
|
<p>In <code>/etc/nsswitch.conf</code> put the following:
|
|
<pre>
|
|
|
|
passwd: files winbind
|
|
group: files winbind
|
|
|
|
</pre>
|
|
|
|
<p>In <code>/etc/pam.d/*</code> replace the <code>auth</code> lines with something like this:
|
|
<pre>
|
|
|
|
auth required /lib/security/pam_securetty.so
|
|
auth required /lib/security/pam_nologin.so
|
|
auth sufficient /lib/security/pam_winbind.so
|
|
auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok
|
|
|
|
</pre>
|
|
|
|
<p>Note in particular the use of the <code>sufficient</code> keyword and the
|
|
<code>use_first_pass</code> keyword.
|
|
<p>Now replace the account lines with this:
|
|
<pre>
|
|
|
|
account required /lib/security/pam_winbind.so
|
|
|
|
</pre>
|
|
|
|
<p>The next step is to join the domain. To do that use the samedit
|
|
program like this:
|
|
<pre>
|
|
|
|
samedit -S '*' -W DOMAIN -UAdministrator
|
|
|
|
</pre>
|
|
|
|
<p>Then within samedit run the command:
|
|
<pre>
|
|
|
|
createuser MACHINE$ -j DOMAIN -L
|
|
|
|
</pre>
|
|
|
|
<p>This assumes your domain is called <code>DOMAIN</code> and your Samba workstation
|
|
is called <code>MACHINE</code>.
|
|
<p>Next copy <code>libnss_winbind.so.2</code> to <code>/lib</code> and <code>pam_winbind.so</code> to
|
|
<code>/lib/security</code>.
|
|
<p>Finally, setup a smb.conf containing directives like the following:
|
|
<pre>
|
|
|
|
[global]
|
|
winbind separator = +
|
|
winbind cache time = 10
|
|
template shell = /bin/bash
|
|
template homedir = /home/%D/%U
|
|
winbind uid = 10000-20000
|
|
winbind gid = 10000-20000
|
|
workgroup = DOMAIN
|
|
security = domain
|
|
password server = *
|
|
|
|
</pre>
|
|
|
|
<p>Now start <strong>winbindd</strong> and you should find that your user and group
|
|
database is expanded to include your NT users and groups, and that you
|
|
can login to your unix box as a domain user, using the <code>DOMAIN+user</code>
|
|
syntax for the username. You may wish to use the commands "getent
|
|
passwd" and "getent group" to confirm the correct operation of
|
|
<strong>winbindd</strong>.
|
|
<p><a name="NOTES"></a>
|
|
<h2>NOTES</h2>
|
|
|
|
<p>The following notes are useful when configuring and running <strong>winbindd</strong>:
|
|
<p><dl>
|
|
<p><p></p><dt><strong></strong><dd>
|
|
<a href="nmbd.8.html"><strong>nmbd</strong></a> must be running on the local machine for
|
|
<strong>winbindd</strong> to work.
|
|
<p><p></p><dt><strong></strong><dd>
|
|
<strong>winbindd</strong> queries the list of trusted domains for the Windows NT server
|
|
on startup and when a SIGHUP is received. Thus, for a running <strong>winbindd</strong>
|
|
to become aware of new trust relationships between servers, it must be sent
|
|
a SIGHUP signal.
|
|
<p><p></p><dt><strong></strong><dd>
|
|
Client processes resolving names through the <strong>winbindd</strong> nsswitch module
|
|
read an environment variable named <code>WINBINDD_DOMAIN</code>. If this variable
|
|
contains a comma separated list of Windows NT domain names, then <strong>winbindd</strong>
|
|
will only resolve users and groups within those Windows NT domains.
|
|
<p><p></p><dt><strong></strong><dd>
|
|
PAM is really easy to misconfigure. Make sure you know what you are doing
|
|
when modifying PAM configuration files. It is possible to set up PAM
|
|
such that you can no longer log into your system.
|
|
<p><p></p><dt><strong></strong><dd>
|
|
If more than one UNIX machine is running <strong>winbindd</strong>, then in general the
|
|
user and groups ids allocated by <strong>winbindd</strong> will not be the same. The
|
|
user and group ids will only be valid for the local machine.
|
|
<p><p></p><dt><strong></strong><dd>
|
|
If the the Windows NT RID to UNIX user and group id mapping file
|
|
is damaged or destroyed then the mappings will be lost.
|
|
<p></dl>
|
|
<p><a name="SIGNALS"></a>
|
|
<h2>SIGNALS</h2>
|
|
|
|
<p>The following signals can be used to manipulate the <strong>winbindd</strong> daemon.
|
|
<p><dl>
|
|
<p><p></p><dt><strong><code>SIGHUP</code></strong><dd>
|
|
<p>Reload the <code>smb.conf</code> file and apply any parameter changes to the running
|
|
version of <strong>winbindd</strong>. This signal also clears any cached user and group
|
|
information. The list of other domains trusted by <strong>winbindd</strong> is also
|
|
reloaded.
|
|
<p><p></p><dt><strong><code>SIGUSR1</code></strong><dd>
|
|
<p>The <code>SIGUSR1</code> signal will cause <strong>winbindd</strong> to write status information
|
|
to the winbind log file including information about the number of user and
|
|
group ids allocated by <strong>winbindd</strong>.
|
|
<p>Log files are stored in the filename specified by the <strong>log file</strong> parameter.
|
|
<p></dl>
|
|
<p><a name="FILES"></a>
|
|
<h2>FILES</h2>
|
|
|
|
<p>The following files are relevant to the operation of the <strong>winbindd</strong>
|
|
daemon.
|
|
<p><dl>
|
|
<p><p></p><dt><strong>/etc/nsswitch.conf(5)</strong><dd>
|
|
<p>Name service switch configuration file.
|
|
<p><p></p><dt><strong>/tmp/.winbindd/pipe</strong><dd>
|
|
<p>The UNIX pipe over which clients communicate with the <strong>winbindd</strong> program.
|
|
For security reasons, the winbind client will only attempt to connect to the
|
|
<strong>winbindd</strong> daemon if both the <code>/tmp/.winbindd</code> directory and
|
|
<code>/tmp/.winbindd/pipe</code> file are owned by root.
|
|
<p><p></p><dt><strong>/lib/libnss_winbind.so.X</strong><dd>
|
|
<p>Implementation of name service switch library.
|
|
<p><p></p><dt><strong>$LOCKDIR/winbindd_idmap.tdb</strong><dd>
|
|
<p>Storage for the Windows NT rid to UNIX user/group id mapping. The lock
|
|
directory is specified when Samba is initially compiled using the
|
|
<code>--with-lockdir</code> option. This directory is by default
|
|
<code>/usr/local/samba/var/locks</code>.
|
|
<p><p></p><dt><strong>$LOCKDIR/winbindd_cache.tdb</strong><dd>
|
|
<p>Storage for cached user and group information.
|
|
<p></dl>
|
|
<p><a name="SEEALSO"></a>
|
|
<h2>SEE ALSO</h2>
|
|
|
|
<p><a href="samba.7.html"><strong>samba(7)</strong></a>, <a href="smb.conf.5.html"><strong>smb.conf(5)</strong></a>,
|
|
<strong>nsswitch.conf(5)</strong>, <a href="wbinfo.1.html"><strong>wbinfo(1)</strong></a>
|
|
<p><a name="AUTHOR"></a>
|
|
<h2>AUTHOR</h2>
|
|
|
|
<p>The original Samba software and related utilities were created by
|
|
Andrew Tridgell. Samba is now developed by the Samba Team as an Open
|
|
Source project.
|
|
<p><strong>winbindd</strong> was written by Tim Potter.
|
|
</body>
|
|
</html>
|