mirror of
https://github.com/samba-team/samba.git
synced 2024-12-28 07:21:54 +03:00
8d7c96a4e2
- Fix db2latex (it depended on the $Id$ tags) - Fix CUPS-Printing syntax - Update instructions in docbook.txt
215 lines
18 KiB
HTML
215 lines
18 KiB
HTML
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>winbindd</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"><a name="winbindd.8"></a><div class="titlepage"><div></div><div></div></div><div class="refnamediv"><h2>Name</h2><p>winbindd — Name Service Switch daemon for resolving names
|
|
from NT servers</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><tt class="command">winbindd</tt> [-F] [-S] [-i] [-B] [-d <debug level>] [-s <smb config file>] [-n]</p></div></div><div class="refsect1" lang="en"><h2>DESCRIPTION</h2><p>This program is part of the <a href="Samba.7.html"><span class="citerefentry"><span class="refentrytitle">Samba</span>(7)</span></a> suite.</p><p><b class="command">winbindd</b> is a daemon that provides
|
|
a service for the Name Service Switch capability that is present
|
|
in most modern C libraries. The Name Service Switch allows user
|
|
and system information to be obtained from different databases
|
|
services such as NIS or DNS. The exact behaviour can be configured
|
|
throught the <tt class="filename">/etc/nsswitch.conf</tt> file.
|
|
Users and groups are allocated as they are resolved to a range
|
|
of user and group ids specified by the administrator of the
|
|
Samba system.</p><p>The service provided by <b class="command">winbindd</b> is called `winbind' and
|
|
can be used to resolve user and group information from a
|
|
Windows NT server. The service can also provide authentication
|
|
services via an associated PAM module. </p><p>
|
|
The <tt class="filename">pam_winbind</tt> module in the 2.2.2 release only
|
|
supports the <i class="parameter"><tt>auth</tt></i> and <i class="parameter"><tt>account</tt></i>
|
|
module-types. The latter simply
|
|
performs a getpwnam() to verify that the system can obtain a uid for the
|
|
user. If the <tt class="filename">libnss_winbind</tt> library has been correctly
|
|
installed, this should always succeed.
|
|
</p><p>The following nsswitch databases are implemented by
|
|
the winbindd service: </p><div class="variablelist"><dl><dt><span class="term">hosts</span></dt><dd><p>User information traditionally stored in
|
|
the <tt class="filename">hosts(5)</tt> file and used by
|
|
<b class="command">gethostbyname(3)</b> functions. Names are
|
|
resolved through the WINS server or by broadcast.
|
|
</p></dd><dt><span class="term">passwd</span></dt><dd><p>User information traditionally stored in
|
|
the <tt class="filename">passwd(5)</tt> file and used by
|
|
<b class="command">getpwent(3)</b> functions. </p></dd><dt><span class="term">group</span></dt><dd><p>Group information traditionally stored in
|
|
the <tt class="filename">group(5)</tt> file and used by
|
|
<b class="command">getgrent(3)</b> functions. </p></dd></dl></div><p>For example, the following simple configuration in the
|
|
<tt class="filename">/etc/nsswitch.conf</tt> file can be used to initially
|
|
resolve user and group information from <tt class="filename">/etc/passwd
|
|
</tt> and <tt class="filename">/etc/group</tt> and then from the
|
|
Windows NT server.
|
|
</p><pre class="programlisting">
|
|
passwd: files winbind
|
|
group: files winbind
|
|
</pre><p>The following simple configuration in the
|
|
<tt class="filename">/etc/nsswitch.conf</tt> file can be used to initially
|
|
resolve hostnames from <tt class="filename">/etc/hosts</tt> and then from the
|
|
WINS server.</p></div><div class="refsect1" lang="en"><h2>OPTIONS</h2><div class="variablelist"><dl><dt><span class="term">-F</span></dt><dd><p>If specified, this parameter causes
|
|
the main <b class="command">winbindd</b> process to not daemonize,
|
|
i.e. double-fork and disassociate with the terminal.
|
|
Child processes are still created as normal to service
|
|
each connection request, but the main process does not
|
|
exit. This operation mode is suitable for running
|
|
<b class="command">winbindd</b> under process supervisors such
|
|
as <b class="command">supervise</b> and <b class="command">svscan</b>
|
|
from Daniel J. Bernstein's <b class="command">daemontools</b>
|
|
package, or the AIX process monitor.
|
|
</p></dd><dt><span class="term">-S</span></dt><dd><p>If specified, this parameter causes
|
|
<b class="command">winbindd</b> to log to standard output rather
|
|
than a file.</p></dd><dt><span class="term">-V</span></dt><dd><p>Prints the version number for
|
|
<b class="command">smbd</b>.</p></dd><dt><span class="term">-s <configuration file></span></dt><dd><p>The file specified contains the
|
|
configuration details required by the server. The
|
|
information in this file includes server-specific
|
|
information such as what printcap file to use, as well
|
|
as descriptions of all the services that the server is
|
|
to provide. See <a href="smb.conf.5.html" target="_top"><tt class="filename">
|
|
smb.conf(5)</tt></a> for more information.
|
|
The default configuration file name is determined at
|
|
compile time.</p></dd><dt><span class="term">-d|--debug=debuglevel</span></dt><dd><p><i class="replaceable"><tt>debuglevel</tt></i> is an integer
|
|
from 0 to 10. The default value if this parameter is
|
|
not specified is zero.</p><p>The higher this value, the more detail will be
|
|
logged to the log files about the activities of the
|
|
server. At level 0, only critical errors and serious
|
|
warnings will be logged. Level 1 is a reasonable level for
|
|
day to day running - it generates a small amount of
|
|
information about operations carried out.</p><p>Levels above 1 will generate considerable
|
|
amounts of log data, and should only be used when
|
|
investigating a problem. Levels above 3 are designed for
|
|
use only by developers and generate HUGE amounts of log
|
|
data, most of which is extremely cryptic.</p><p>Note that specifying this parameter here will
|
|
override the <a href="smb.conf.5.html#loglevel" target="_top">log
|
|
level</a> parameter in the <a href="smb.conf.5.html" target="_top">
|
|
<tt class="filename">smb.conf(5)</tt></a> file.</p></dd><dt><span class="term">-l|--logfile=logbasename</span></dt><dd><p>File name for log/debug files. The extension
|
|
<tt class="constant">".client"</tt> will be appended. The log file is
|
|
never removed by the client.
|
|
</p></dd><dt><span class="term">-h|--help</span></dt><dd><p>Print a summary of command line options.
|
|
</p></dd><dt><span class="term">-i</span></dt><dd><p>Tells <b class="command">winbindd</b> to not
|
|
become a daemon and detach from the current terminal. This
|
|
option is used by developers when interactive debugging
|
|
of <b class="command">winbindd</b> is required.
|
|
<b class="command">winbindd</b> also logs to standard output,
|
|
as if the <b class="command">-S</b> parameter had been given.
|
|
</p></dd><dt><span class="term">-n</span></dt><dd><p>Disable caching. This means winbindd will
|
|
always have to wait for a response from the domain controller
|
|
before it can respond to a client and this thus makes things
|
|
slower. The results will however be more accurate, since
|
|
results from the cache might not be up-to-date. This
|
|
might also temporarily hang winbindd if the DC doesn't respond.
|
|
</p></dd><dt><span class="term">-B</span></dt><dd><p>Dual daemon mode. This means winbindd will run
|
|
as 2 threads. The first will answer all requests from the cache,
|
|
thus making responses to clients faster. The other will
|
|
update the cache for the query that the first has just responded.
|
|
Advantage of this is that responses stay accurate and are faster.
|
|
</p></dd></dl></div></div><div class="refsect1" lang="en"><h2>NAME AND ID RESOLUTION</h2><p>Users and groups on a Windows NT server are assigned
|
|
a relative id (rid) which is unique for the domain when the
|
|
user or group is created. To convert the Windows NT user or group
|
|
into a unix user or group, a mapping between rids and unix user
|
|
and group ids is required. This is one of the jobs that <b class="command">
|
|
winbindd</b> performs. </p><p>As winbindd users and groups are resolved from a server, user
|
|
and group ids are allocated from a specified range. This
|
|
is done on a first come, first served basis, although all existing
|
|
users and groups will be mapped as soon as a client performs a user
|
|
or group enumeration command. The allocated unix ids are stored
|
|
in a database file under the Samba lock directory and will be
|
|
remembered. </p><p>WARNING: The rid to unix id database is the only location
|
|
where the user and group mappings are stored by winbindd. If this
|
|
file is deleted or corrupted, there is no way for winbindd to
|
|
determine which user and group ids correspond to Windows NT user
|
|
and group rids. </p></div><div class="refsect1" lang="en"><h2>CONFIGURATION</h2><p>Configuration of the <b class="command">winbindd</b> daemon
|
|
is done through configuration parameters in the <a href="smb.conf.5.html"><span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span></a> file. All parameters should be specified in the
|
|
[global] section of smb.conf. </p><div class="itemizedlist"><ul type="disc"><li><p><a href="smb.conf.5.html#WINBINDSEPARATOR" target="_top">
|
|
<i class="parameter"><tt>winbind separator</tt></i></a></p></li><li><p><a href="smb.conf.5.html#WINBINDUID" target="_top">
|
|
<i class="parameter"><tt>winbind uid</tt></i></a></p></li><li><p><a href="smb.conf.5.html#WINBINDGID" target="_top">
|
|
<i class="parameter"><tt>winbind gid</tt></i></a></p></li><li><p><a href="smb.conf.5.html#WINBINDCACHETIME" target="_top">
|
|
<i class="parameter"><tt>winbind cache time</tt></i></a></p></li><li><p><a href="smb.conf.5.html#WINBINDENUMUSERS" target="_top">
|
|
<i class="parameter"><tt>winbind enum users</tt></i></a></p></li><li><p><a href="smb.conf.5.html#WINBINDENUMGROUPS" target="_top">
|
|
<i class="parameter"><tt>winbind enum groups</tt></i></a></p></li><li><p><a href="smb.conf.5.html#TEMPLATEHOMEDIR" target="_top">
|
|
<i class="parameter"><tt>template homedir</tt></i></a></p></li><li><p><a href="smb.conf.5.html#TEMPLATESHELL" target="_top">
|
|
<i class="parameter"><tt>template shell</tt></i></a></p></li><li><p><a href="smb.conf.5.html#WINBINDUSEDEFAULTDOMAIN" target="_top">
|
|
<i class="parameter"><tt>winbind use default domain</tt></i></a></p></li></ul></div></div><div class="refsect1" lang="en"><h2>EXAMPLE SETUP</h2><p>To setup winbindd for user and group lookups plus
|
|
authentication from a domain controller use something like the
|
|
following setup. This was tested on a RedHat 6.2 Linux box. </p><p>In <tt class="filename">/etc/nsswitch.conf</tt> put the
|
|
following:
|
|
</p><pre class="programlisting">
|
|
passwd: files winbind
|
|
group: files winbind
|
|
</pre><p>In <tt class="filename">/etc/pam.d/*</tt> replace the <i class="parameter"><tt>
|
|
auth</tt></i> lines with something like this:
|
|
</p><pre class="programlisting">
|
|
auth required /lib/security/pam_securetty.so
|
|
auth required /lib/security/pam_nologin.so
|
|
auth sufficient /lib/security/pam_winbind.so
|
|
auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok
|
|
</pre><p>Note in particular the use of the <i class="parameter"><tt>sufficient
|
|
</tt></i> keyword and the <i class="parameter"><tt>use_first_pass</tt></i> keyword. </p><p>Now replace the account lines with this: </p><p><b class="command">account required /lib/security/pam_winbind.so
|
|
</b></p><p>The next step is to join the domain. To do that use the
|
|
<b class="command">net</b> program like this: </p><p><b class="command">net join -S PDC -U Administrator</b></p><p>The username after the <i class="parameter"><tt>-U</tt></i> can be any
|
|
Domain user that has administrator privileges on the machine.
|
|
Substitute the name or IP of your PDC for "PDC".</p><p>Next copy <tt class="filename">libnss_winbind.so</tt> to
|
|
<tt class="filename">/lib</tt> and <tt class="filename">pam_winbind.so
|
|
</tt> to <tt class="filename">/lib/security</tt>. A symbolic link needs to be
|
|
made from <tt class="filename">/lib/libnss_winbind.so</tt> to
|
|
<tt class="filename">/lib/libnss_winbind.so.2</tt>. If you are using an
|
|
older version of glibc then the target of the link should be
|
|
<tt class="filename">/lib/libnss_winbind.so.1</tt>.</p><p>Finally, setup a <a href="smb.conf.5.html"><span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span></a> containing directives like the
|
|
following:
|
|
</p><pre class="programlisting">
|
|
[global]
|
|
winbind separator = +
|
|
winbind cache time = 10
|
|
template shell = /bin/bash
|
|
template homedir = /home/%D/%U
|
|
winbind uid = 10000-20000
|
|
winbind gid = 10000-20000
|
|
workgroup = DOMAIN
|
|
security = domain
|
|
password server = *
|
|
</pre><p>Now start winbindd and you should find that your user and
|
|
group database is expanded to include your NT users and groups,
|
|
and that you can login to your unix box as a domain user, using
|
|
the DOMAIN+user syntax for the username. You may wish to use the
|
|
commands <b class="command">getent passwd</b> and <b class="command">getent group
|
|
</b> to confirm the correct operation of winbindd.</p></div><div class="refsect1" lang="en"><h2>NOTES</h2><p>The following notes are useful when configuring and
|
|
running <b class="command">winbindd</b>: </p><p><a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> must be running on the local machine
|
|
for <b class="command">winbindd</b> to work. <b class="command">winbindd</b> queries
|
|
the list of trusted domains for the Windows NT server
|
|
on startup and when a SIGHUP is received. Thus, for a running <b class="command">
|
|
winbindd</b> to become aware of new trust relationships between
|
|
servers, it must be sent a SIGHUP signal. </p><p>PAM is really easy to misconfigure. Make sure you know what
|
|
you are doing when modifying PAM configuration files. It is possible
|
|
to set up PAM such that you can no longer log into your system. </p><p>If more than one UNIX machine is running <b class="command">winbindd</b>,
|
|
then in general the user and groups ids allocated by winbindd will not
|
|
be the same. The user and group ids will only be valid for the local
|
|
machine.</p><p>If the the Windows NT RID to UNIX user and group id mapping
|
|
file is damaged or destroyed then the mappings will be lost. </p></div><div class="refsect1" lang="en"><h2>SIGNALS</h2><p>The following signals can be used to manipulate the
|
|
<b class="command">winbindd</b> daemon. </p><div class="variablelist"><dl><dt><span class="term">SIGHUP</span></dt><dd><p>Reload the <a href="smb.conf.5.html"><span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span></a> file and
|
|
apply any parameter changes to the running
|
|
version of winbindd. This signal also clears any cached
|
|
user and group information. The list of other domains trusted
|
|
by winbindd is also reloaded. </p></dd><dt><span class="term">SIGUSR1</span></dt><dd><p>The SIGUSR1 signal will cause <b class="command">
|
|
winbindd</b> to write status information to the winbind
|
|
log file including information about the number of user and
|
|
group ids allocated by <b class="command">winbindd</b>.</p><p>Log files are stored in the filename specified by the
|
|
log file parameter.</p></dd></dl></div></div><div class="refsect1" lang="en"><h2>FILES</h2><div class="variablelist"><dl><dt><span class="term"><tt class="filename">/etc/nsswitch.conf(5)</tt></span></dt><dd><p>Name service switch configuration file.</p></dd><dt><span class="term">/tmp/.winbindd/pipe</span></dt><dd><p>The UNIX pipe over which clients communicate with
|
|
the <b class="command">winbindd</b> program. For security reasons, the
|
|
winbind client will only attempt to connect to the winbindd daemon
|
|
if both the <tt class="filename">/tmp/.winbindd</tt> directory
|
|
and <tt class="filename">/tmp/.winbindd/pipe</tt> file are owned by
|
|
root. </p></dd><dt><span class="term">$LOCKDIR/winbindd_privilaged/pipe</span></dt><dd><p>The UNIX pipe over which 'privilaged' clients
|
|
communicate with the <b class="command">winbindd</b> program. For security
|
|
reasons, access to some winbindd functions - like those needed by
|
|
the <b class="command">ntlm_auth</b> utility - is restricted. By default,
|
|
only users in the 'root' group will get this access, however the administrator
|
|
may change the group permissions on $LOCKDIR/winbindd_privilaged to allow
|
|
programs like 'squid' to use ntlm_auth.
|
|
Note that the winbind client will only attempt to connect to the winbindd daemon
|
|
if both the <tt class="filename">$LOCKDIR/winbindd_privilaged</tt> directory
|
|
and <tt class="filename">$LOCKDIR/winbindd_privilaged/pipe</tt> file are owned by
|
|
root. </p></dd><dt><span class="term">/lib/libnss_winbind.so.X</span></dt><dd><p>Implementation of name service switch library.
|
|
</p></dd><dt><span class="term">$LOCKDIR/winbindd_idmap.tdb</span></dt><dd><p>Storage for the Windows NT rid to UNIX user/group
|
|
id mapping. The lock directory is specified when Samba is initially
|
|
compiled using the <i class="parameter"><tt>--with-lockdir</tt></i> option.
|
|
This directory is by default <tt class="filename">/usr/local/samba/var/locks
|
|
</tt>. </p></dd><dt><span class="term">$LOCKDIR/winbindd_cache.tdb</span></dt><dd><p>Storage for cached user and group information.
|
|
</p></dd></dl></div></div><div class="refsect1" lang="en"><h2>VERSION</h2><p>This man page is correct for version 3.0 of
|
|
the Samba suite.</p></div><div class="refsect1" lang="en"><h2>SEE ALSO</h2><p><tt class="filename">nsswitch.conf(5)</tt>, <a href="Samba.7.html"><span class="citerefentry"><span class="refentrytitle">Samba</span>(7)</span></a>, <a href="wbinfo.8.html"><span class="citerefentry"><span class="refentrytitle">wbinfo</span>(8)</span></a>, <a href="smb.conf.5.html"><span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span></a></p></div><div class="refsect1" lang="en"><h2>AUTHOR</h2><p>The original Samba software and related utilities
|
|
were created by Andrew Tridgell. Samba is now developed
|
|
by the Samba Team as an Open Source project similar
|
|
to the way the Linux kernel is developed.</p><p><b class="command">wbinfo</b> and <b class="command">winbindd</b> were
|
|
written by Tim Potter.</p><p>The conversion to DocBook for Samba 2.2 was done
|
|
by Gerald Carter. The conversion to DocBook XML 4.2 for
|
|
Samba 3.0 was done by Alexander Bokovoy.</p></div></div></body></html>
|