mirror of
https://github.com/samba-team/samba.git
synced 2025-06-19 23:17:05 +03:00
7673 lines
179 KiB
HTML
7673 lines
179 KiB
HTML
<HTML
|
|
><HEAD
|
|
><TITLE
|
|
>SAMBA Project Documentation</TITLE
|
|
><META
|
|
NAME="GENERATOR"
|
|
CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
|
|
><BODY
|
|
CLASS="BOOK"
|
|
BGCOLOR="#FFFFFF"
|
|
TEXT="#000000"
|
|
LINK="#0000FF"
|
|
VLINK="#840084"
|
|
ALINK="#0000FF"
|
|
><DIV
|
|
CLASS="BOOK"
|
|
><A
|
|
NAME="SAMBA-PROJECT-DOCUMENTATION"
|
|
></A
|
|
><DIV
|
|
CLASS="TITLEPAGE"
|
|
><H1
|
|
CLASS="TITLE"
|
|
><A
|
|
NAME="SAMBA-PROJECT-DOCUMENTATION"
|
|
>SAMBA Project Documentation</A
|
|
></H1
|
|
><H3
|
|
CLASS="AUTHOR"
|
|
><A
|
|
NAME="AEN4"
|
|
>SAMBA Team</A
|
|
></H3
|
|
><HR></DIV
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN9"
|
|
>Abstract</A
|
|
></H1
|
|
><P
|
|
>This book is a collection of HOWTOs added to Samba documentation over the years.
|
|
I try to ensure that all are current, but sometimes the is a larger job
|
|
than one person can maintain. The most recent version of this document
|
|
can be found at <A
|
|
HREF="http://www.samba.org/"
|
|
TARGET="_top"
|
|
>http://www.samba.org/</A
|
|
>
|
|
on the "Documentation" page. Please send updates to <A
|
|
HREF="mailto:jerry@samba.org"
|
|
TARGET="_top"
|
|
>jerry@samba.org</A
|
|
>.</P
|
|
><P
|
|
>Cheers, jerry</P
|
|
><DIV
|
|
CLASS="TOC"
|
|
><DL
|
|
><DT
|
|
><B
|
|
>Table of Contents</B
|
|
></DT
|
|
><DT
|
|
>1. <A
|
|
HREF="#AEN15"
|
|
>How to Install and Test SAMBA</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>1.1. <A
|
|
HREF="#AEN17"
|
|
>Step 0: Read the man pages</A
|
|
></DT
|
|
><DT
|
|
>1.2. <A
|
|
HREF="#AEN25"
|
|
>Step 1: Building the Binaries</A
|
|
></DT
|
|
><DT
|
|
>1.3. <A
|
|
HREF="#AEN53"
|
|
>Step 2: The all important step</A
|
|
></DT
|
|
><DT
|
|
>1.4. <A
|
|
HREF="#AEN57"
|
|
>Step 3: Create the smb configuration file.</A
|
|
></DT
|
|
><DT
|
|
>1.5. <A
|
|
HREF="#AEN71"
|
|
>Step 4: Test your config file with
|
|
<B
|
|
CLASS="COMMAND"
|
|
>testparm</B
|
|
></A
|
|
></DT
|
|
><DT
|
|
>1.6. <A
|
|
HREF="#AEN77"
|
|
>Step 5: Starting the smbd and nmbd</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>1.6.1. <A
|
|
HREF="#AEN87"
|
|
>Step 5a: Starting from inetd.conf</A
|
|
></DT
|
|
><DT
|
|
>1.6.2. <A
|
|
HREF="#AEN116"
|
|
>Step 5b. Alternative: starting it as a daemon</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>1.7. <A
|
|
HREF="#AEN132"
|
|
>Step 6: Try listing the shares available on your
|
|
server</A
|
|
></DT
|
|
><DT
|
|
>1.8. <A
|
|
HREF="#AEN141"
|
|
>Step 7: Try connecting with the unix client</A
|
|
></DT
|
|
><DT
|
|
>1.9. <A
|
|
HREF="#AEN157"
|
|
>Step 8: Try connecting from a DOS, WfWg, Win9x, WinNT,
|
|
Win2k, OS/2, etc... client</A
|
|
></DT
|
|
><DT
|
|
>1.10. <A
|
|
HREF="#AEN171"
|
|
>What If Things Don't Work?</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>1.10.1. <A
|
|
HREF="#AEN176"
|
|
>Diagnosing Problems</A
|
|
></DT
|
|
><DT
|
|
>1.10.2. <A
|
|
HREF="#AEN180"
|
|
>Scope IDs</A
|
|
></DT
|
|
><DT
|
|
>1.10.3. <A
|
|
HREF="#AEN183"
|
|
>Choosing the Protocol Level</A
|
|
></DT
|
|
><DT
|
|
>1.10.4. <A
|
|
HREF="#AEN192"
|
|
>Printing from UNIX to a Client PC</A
|
|
></DT
|
|
><DT
|
|
>1.10.5. <A
|
|
HREF="#AEN196"
|
|
>Locking</A
|
|
></DT
|
|
><DT
|
|
>1.10.6. <A
|
|
HREF="#AEN206"
|
|
>Mapping Usernames</A
|
|
></DT
|
|
><DT
|
|
>1.10.7. <A
|
|
HREF="#AEN209"
|
|
>Other Character Sets</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>2. <A
|
|
HREF="#AEN212"
|
|
>LanMan and NT Password Encryption in Samba 2.x</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>2.1. <A
|
|
HREF="#AEN223"
|
|
>Introduction</A
|
|
></DT
|
|
><DT
|
|
>2.2. <A
|
|
HREF="#AEN227"
|
|
>How does it work?</A
|
|
></DT
|
|
><DT
|
|
>2.3. <A
|
|
HREF="#AEN238"
|
|
>Important Notes About Security</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>2.3.1. <A
|
|
HREF="#AEN257"
|
|
>Advantages of SMB Encryption</A
|
|
></DT
|
|
><DT
|
|
>2.3.2. <A
|
|
HREF="#AEN264"
|
|
>Advantages of non-encrypted passwords</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>2.4. <A
|
|
HREF="#AEN273"
|
|
><A
|
|
NAME="SMBPASSWDFILEFORMAT"
|
|
></A
|
|
>The smbpasswd file</A
|
|
></DT
|
|
><DT
|
|
>2.5. <A
|
|
HREF="#AEN325"
|
|
>The smbpasswd Command</A
|
|
></DT
|
|
><DT
|
|
>2.6. <A
|
|
HREF="#AEN364"
|
|
>Setting up Samba to support LanManager Encryption</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>3. <A
|
|
HREF="#AEN379"
|
|
>Hosting a Microsoft Distributed File System tree on Samba</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>3.1. <A
|
|
HREF="#AEN390"
|
|
>Instructions</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>3.1.1. <A
|
|
HREF="#AEN425"
|
|
>Notes</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>4. <A
|
|
HREF="#AEN434"
|
|
>Printing Support in Samba 2.2.x</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>4.1. <A
|
|
HREF="#AEN445"
|
|
>Introduction</A
|
|
></DT
|
|
><DT
|
|
>4.2. <A
|
|
HREF="#AEN467"
|
|
>Configuration</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>4.2.1. <A
|
|
HREF="#AEN478"
|
|
>Creating [print$]</A
|
|
></DT
|
|
><DT
|
|
>4.2.2. <A
|
|
HREF="#AEN513"
|
|
>Setting Drivers for Existing Printers</A
|
|
></DT
|
|
><DT
|
|
>4.2.3. <A
|
|
HREF="#AEN530"
|
|
>Support a large number of printers</A
|
|
></DT
|
|
><DT
|
|
>4.2.4. <A
|
|
HREF="#AEN541"
|
|
>Adding New Printers via the Windows NT APW</A
|
|
></DT
|
|
><DT
|
|
>4.2.5. <A
|
|
HREF="#AEN566"
|
|
>Samba and Printer Ports</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>4.3. <A
|
|
HREF="#AEN574"
|
|
>The Imprints Toolset</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>4.3.1. <A
|
|
HREF="#AEN578"
|
|
>What is Imprints?</A
|
|
></DT
|
|
><DT
|
|
>4.3.2. <A
|
|
HREF="#AEN588"
|
|
>Creating Printer Driver Packages</A
|
|
></DT
|
|
><DT
|
|
>4.3.3. <A
|
|
HREF="#AEN591"
|
|
>The Imprints server</A
|
|
></DT
|
|
><DT
|
|
>4.3.4. <A
|
|
HREF="#AEN595"
|
|
>The Installation Client</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>4.4. <A
|
|
HREF="#AEN617"
|
|
><A
|
|
NAME="MIGRATION"
|
|
></A
|
|
>Migration to from Samba 2.0.x to 2.2.x</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>5. <A
|
|
HREF="#AEN661"
|
|
>security = domain in Samba 2.x</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>5.1. <A
|
|
HREF="#AEN679"
|
|
>Joining an NT Domain with Samba 2.2</A
|
|
></DT
|
|
><DT
|
|
>5.2. <A
|
|
HREF="#AEN743"
|
|
>Samba and Windows 2000 Domains</A
|
|
></DT
|
|
><DT
|
|
>5.3. <A
|
|
HREF="#AEN748"
|
|
>Why is this better than security = server?</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>6. <A
|
|
HREF="#AEN764"
|
|
>How to Configure Samba 2.2 as a Primary Domain Controller</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>6.1. <A
|
|
HREF="#AEN781"
|
|
>Prerequisite Reading</A
|
|
></DT
|
|
><DT
|
|
>6.2. <A
|
|
HREF="#AEN787"
|
|
>Background</A
|
|
></DT
|
|
><DT
|
|
>6.3. <A
|
|
HREF="#AEN827"
|
|
>Configuring the Samba Domain Controller</A
|
|
></DT
|
|
><DT
|
|
>6.4. <A
|
|
HREF="#AEN870"
|
|
>Creating Machine Trust Accounts and Joining Clients
|
|
to the Domain</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>6.4.1. <A
|
|
HREF="#AEN884"
|
|
>Manually creating machine trust accounts</A
|
|
></DT
|
|
><DT
|
|
>6.4.2. <A
|
|
HREF="#AEN912"
|
|
>Creating machine trust accounts "on the fly"</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>6.5. <A
|
|
HREF="#AEN923"
|
|
>Common Problems and Errors</A
|
|
></DT
|
|
><DT
|
|
>6.6. <A
|
|
HREF="#AEN971"
|
|
>System Policies and Profiles</A
|
|
></DT
|
|
><DT
|
|
>6.7. <A
|
|
HREF="#AEN1015"
|
|
>What other help can I get ?</A
|
|
></DT
|
|
><DT
|
|
>6.8. <A
|
|
HREF="#AEN1129"
|
|
>Domain Control for Windows 9x/ME</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>6.8.1. <A
|
|
HREF="#AEN1159"
|
|
>Configuration Instructions: Network Logons</A
|
|
></DT
|
|
><DT
|
|
>6.8.2. <A
|
|
HREF="#AEN1193"
|
|
>Configuration Instructions: Setting up Roaming User Profiles</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>6.8.2.1. <A
|
|
HREF="#AEN1201"
|
|
>Windows NT Configuration</A
|
|
></DT
|
|
><DT
|
|
>6.8.2.2. <A
|
|
HREF="#AEN1209"
|
|
>Windows 9X Configuration</A
|
|
></DT
|
|
><DT
|
|
>6.8.2.3. <A
|
|
HREF="#AEN1217"
|
|
>Win9X and WinNT Configuration</A
|
|
></DT
|
|
><DT
|
|
>6.8.2.4. <A
|
|
HREF="#AEN1224"
|
|
>Windows 9X Profile Setup</A
|
|
></DT
|
|
><DT
|
|
>6.8.2.5. <A
|
|
HREF="#AEN1260"
|
|
>Windows NT Workstation 4.0</A
|
|
></DT
|
|
><DT
|
|
>6.8.2.6. <A
|
|
HREF="#AEN1273"
|
|
>Windows NT Server</A
|
|
></DT
|
|
><DT
|
|
>6.8.2.7. <A
|
|
HREF="#AEN1276"
|
|
>Sharing Profiles between W95 and NT Workstation 4.0</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>6.9. <A
|
|
HREF="#AEN1286"
|
|
>DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>7. <A
|
|
HREF="#AEN1311"
|
|
>Unifed Logons between Windows NT and UNIX using Winbind</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>7.1. <A
|
|
HREF="#AEN1329"
|
|
>Abstract</A
|
|
></DT
|
|
><DT
|
|
>7.2. <A
|
|
HREF="#AEN1333"
|
|
>Introduction</A
|
|
></DT
|
|
><DT
|
|
>7.3. <A
|
|
HREF="#AEN1346"
|
|
>What Winbind Provides</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>7.3.1. <A
|
|
HREF="#AEN1353"
|
|
>Target Uses</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>7.4. <A
|
|
HREF="#AEN1357"
|
|
>How Winbind Works</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>7.4.1. <A
|
|
HREF="#AEN1362"
|
|
>Microsoft Remote Procedure Calls</A
|
|
></DT
|
|
><DT
|
|
>7.4.2. <A
|
|
HREF="#AEN1366"
|
|
>Name Service Switch</A
|
|
></DT
|
|
><DT
|
|
>7.4.3. <A
|
|
HREF="#AEN1382"
|
|
>Pluggable Authentication Modules</A
|
|
></DT
|
|
><DT
|
|
>7.4.4. <A
|
|
HREF="#AEN1390"
|
|
>User and Group ID Allocation</A
|
|
></DT
|
|
><DT
|
|
>7.4.5. <A
|
|
HREF="#AEN1394"
|
|
>Result Caching</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>7.5. <A
|
|
HREF="#AEN1397"
|
|
>Installation and Configuration</A
|
|
></DT
|
|
><DT
|
|
>7.6. <A
|
|
HREF="#AEN1403"
|
|
>Limitations</A
|
|
></DT
|
|
><DT
|
|
>7.7. <A
|
|
HREF="#AEN1415"
|
|
>Conclusion</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>8. <A
|
|
HREF="#AEN1418"
|
|
>UNIX Permission Bits and WIndows NT Access Control Lists</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>8.1. <A
|
|
HREF="#AEN1429"
|
|
>Viewing and changing UNIX permissions using the NT
|
|
security dialogs</A
|
|
></DT
|
|
><DT
|
|
>8.2. <A
|
|
HREF="#AEN1438"
|
|
>How to view file security on a Samba share</A
|
|
></DT
|
|
><DT
|
|
>8.3. <A
|
|
HREF="#AEN1449"
|
|
>Viewing file ownership</A
|
|
></DT
|
|
><DT
|
|
>8.4. <A
|
|
HREF="#AEN1469"
|
|
>Viewing file or directory permissions</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>8.4.1. <A
|
|
HREF="#AEN1484"
|
|
>File Permissions</A
|
|
></DT
|
|
><DT
|
|
>8.4.2. <A
|
|
HREF="#AEN1498"
|
|
>Directory Permissions</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>8.5. <A
|
|
HREF="#AEN1505"
|
|
>Modifying file or directory permissions</A
|
|
></DT
|
|
><DT
|
|
>8.6. <A
|
|
HREF="#AEN1527"
|
|
>Interaction with the standard Samba create mask
|
|
parameters</A
|
|
></DT
|
|
><DT
|
|
>8.7. <A
|
|
HREF="#AEN1591"
|
|
>Interaction with the standard Samba file attribute
|
|
mapping</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>9. <A
|
|
HREF="#AEN1601"
|
|
>OS2 Client HOWTO</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>9.1. <A
|
|
HREF="#AEN1612"
|
|
>FAQs</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>9.1.1. <A
|
|
HREF="#AEN1614"
|
|
>How can I configure OS/2 Warp Connect or
|
|
OS/2 Warp 4 as a client for Samba?</A
|
|
></DT
|
|
><DT
|
|
>9.1.2. <A
|
|
HREF="#AEN1629"
|
|
>How can I configure OS/2 Warp 3 (not Connect),
|
|
OS/2 1.2, 1.3 or 2.x for Samba?</A
|
|
></DT
|
|
><DT
|
|
>9.1.3. <A
|
|
HREF="#AEN1638"
|
|
>Are there any other issues when OS/2 (any version)
|
|
is used as a client?</A
|
|
></DT
|
|
><DT
|
|
>9.1.4. <A
|
|
HREF="#AEN1642"
|
|
>How do I get printer driver download working
|
|
for OS/2 clients?</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
></DL
|
|
></DD
|
|
><DT
|
|
>10. <A
|
|
HREF="#AEN1651"
|
|
>HOWTO Access Samba source code via CVS</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>10.1. <A
|
|
HREF="#AEN1658"
|
|
>Introduction</A
|
|
></DT
|
|
><DT
|
|
>10.2. <A
|
|
HREF="#AEN1663"
|
|
>CVS Access to samba.org</A
|
|
></DT
|
|
><DD
|
|
><DL
|
|
><DT
|
|
>10.2.1. <A
|
|
HREF="#AEN1666"
|
|
>Access via CVSweb</A
|
|
></DT
|
|
><DT
|
|
>10.2.2. <A
|
|
HREF="#AEN1671"
|
|
>Access via cvs</A
|
|
></DT
|
|
></DL
|
|
></DD
|
|
></DL
|
|
></DD
|
|
></DL
|
|
></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN15"
|
|
>Chapter 1. How to Install and Test SAMBA</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN17"
|
|
>1.1. Step 0: Read the man pages</A
|
|
></H1
|
|
><P
|
|
>The man pages distributed with SAMBA contain
|
|
lots of useful info that will help to get you started.
|
|
If you don't know how to read man pages then try
|
|
something like:</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>$ </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>nroff -man smbd.8 | more
|
|
</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>Other sources of information are pointed to
|
|
by the Samba web site,<A
|
|
HREF="http://www.samba.org/"
|
|
TARGET="_top"
|
|
> http://www.samba.org</A
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN25"
|
|
>1.2. Step 1: Building the Binaries</A
|
|
></H1
|
|
><P
|
|
>To do this, first run the program <B
|
|
CLASS="COMMAND"
|
|
>./configure
|
|
</B
|
|
> in the source directory. This should automatically
|
|
configure Samba for your operating system. If you have unusual
|
|
needs then you may wish to run</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>./configure --help
|
|
</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>first to see what special options you can enable.
|
|
Then exectuting</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>make</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>will create the binaries. Once it's successfully
|
|
compiled you can use </P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>make install</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>to install the binaries and manual pages. You can
|
|
separately install the binaries and/or man pages using</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>make installbin
|
|
</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>and</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>make installman
|
|
</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>Note that if you are upgrading for a previous version
|
|
of Samba you might like to know that the old versions of
|
|
the binaries will be renamed with a ".old" extension. You
|
|
can go back to the previous version with</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>make revert
|
|
</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>if you find this version a disaster!</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN53"
|
|
>1.3. Step 2: The all important step</A
|
|
></H1
|
|
><P
|
|
>At this stage you must fetch yourself a
|
|
coffee or other drink you find stimulating. Getting the rest
|
|
of the install right can sometimes be tricky, so you will
|
|
probably need it.</P
|
|
><P
|
|
>If you have installed samba before then you can skip
|
|
this step.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN57"
|
|
>1.4. Step 3: Create the smb configuration file.</A
|
|
></H1
|
|
><P
|
|
>There are sample configuration files in the examples
|
|
subdirectory in the distribution. I suggest you read them
|
|
carefully so you can see how the options go together in
|
|
practice. See the man page for all the options.</P
|
|
><P
|
|
>The simplest useful configuration file would be
|
|
something like this:</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
> [global]
|
|
workgroup = MYGROUP
|
|
|
|
[homes]
|
|
guest ok = no
|
|
read only = no
|
|
</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>which would allow connections by anyone with an
|
|
account on the server, using either their login name or
|
|
"homes" as the service name. (Note that I also set the
|
|
workgroup that Samba is part of. See BROWSING.txt for defails)</P
|
|
><P
|
|
>Note that <B
|
|
CLASS="COMMAND"
|
|
>make install</B
|
|
> will not install
|
|
a <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
> file. You need to create it
|
|
yourself. </P
|
|
><P
|
|
>Make sure you put the smb.conf file in the same place
|
|
you specified in the<TT
|
|
CLASS="FILENAME"
|
|
>Makefile</TT
|
|
> (the default is to
|
|
look for it in <TT
|
|
CLASS="FILENAME"
|
|
>/usr/local/samba/lib/</TT
|
|
>).</P
|
|
><P
|
|
>For more information about security settings for the
|
|
[homes] share please refer to the document UNIX_SECURITY.txt.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN71"
|
|
>1.5. Step 4: Test your config file with
|
|
<B
|
|
CLASS="COMMAND"
|
|
>testparm</B
|
|
></A
|
|
></H1
|
|
><P
|
|
>It's important that you test the validity of your
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
> file using the testparm program.
|
|
If testparm runs OK then it will list the loaded services. If
|
|
not it will give an error message.</P
|
|
><P
|
|
>Make sure it runs OK and that the services look
|
|
resonable before proceeding. </P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN77"
|
|
>1.6. Step 5: Starting the smbd and nmbd</A
|
|
></H1
|
|
><P
|
|
>You must choose to start smbd and nmbd either
|
|
as daemons or from <B
|
|
CLASS="COMMAND"
|
|
>inetd</B
|
|
>. Don't try
|
|
to do both! Either you can put them in <TT
|
|
CLASS="FILENAME"
|
|
> inetd.conf</TT
|
|
> and have them started on demand
|
|
by <B
|
|
CLASS="COMMAND"
|
|
>inetd</B
|
|
>, or you can start them as
|
|
daemons either from the command line or in <TT
|
|
CLASS="FILENAME"
|
|
> /etc/rc.local</TT
|
|
>. See the man pages for details
|
|
on the command line options. Take particular care to read
|
|
the bit about what user you need to be in order to start
|
|
Samba. In many cases you must be root.</P
|
|
><P
|
|
>The main advantage of starting <B
|
|
CLASS="COMMAND"
|
|
>smbd</B
|
|
>
|
|
and <B
|
|
CLASS="COMMAND"
|
|
>nmbd</B
|
|
> as a daemon is that they will
|
|
respond slightly more quickly to an initial connection
|
|
request. This is, however, unlikely to be a problem.</P
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN87"
|
|
>1.6.1. Step 5a: Starting from inetd.conf</A
|
|
></H2
|
|
><P
|
|
>NOTE; The following will be different if
|
|
you use NIS or NIS+ to distributed services maps.</P
|
|
><P
|
|
>Look at your <TT
|
|
CLASS="FILENAME"
|
|
>/etc/services</TT
|
|
>.
|
|
What is defined at port 139/tcp. If nothing is defined
|
|
then add a line like this:</P
|
|
><P
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>netbios-ssn 139/tcp</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>similarly for 137/udp you should have an entry like:</P
|
|
><P
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>netbios-ns 137/udp</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>Next edit your <TT
|
|
CLASS="FILENAME"
|
|
>/etc/inetd.conf</TT
|
|
>
|
|
and add two lines something like this:</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
> netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd
|
|
netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd
|
|
</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>The exact syntax of <TT
|
|
CLASS="FILENAME"
|
|
>/etc/inetd.conf</TT
|
|
>
|
|
varies between unixes. Look at the other entries in inetd.conf
|
|
for a guide.</P
|
|
><P
|
|
>NOTE: Some unixes already have entries like netbios_ns
|
|
(note the underscore) in <TT
|
|
CLASS="FILENAME"
|
|
>/etc/services</TT
|
|
>.
|
|
You must either edit <TT
|
|
CLASS="FILENAME"
|
|
>/etc/services</TT
|
|
> or
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>/etc/inetd.conf</TT
|
|
> to make them consistant.</P
|
|
><P
|
|
>NOTE: On many systems you may need to use the
|
|
"interfaces" option in smb.conf to specify the IP address
|
|
and netmask of your interfaces. Run <B
|
|
CLASS="COMMAND"
|
|
>ifconfig</B
|
|
>
|
|
as root if you don't know what the broadcast is for your
|
|
net. <B
|
|
CLASS="COMMAND"
|
|
>nmbd</B
|
|
> tries to determine it at run
|
|
time, but fails on somunixes. See the section on "testing nmbd"
|
|
for a method of finding if you need to do this.</P
|
|
><P
|
|
>!!!WARNING!!! Many unixes only accept around 5
|
|
parameters on the command line in <TT
|
|
CLASS="FILENAME"
|
|
>inetd.conf</TT
|
|
>.
|
|
This means you shouldn't use spaces between the options and
|
|
arguments, or you should use a script, and start the script
|
|
from <B
|
|
CLASS="COMMAND"
|
|
>inetd</B
|
|
>.</P
|
|
><P
|
|
>Restart <B
|
|
CLASS="COMMAND"
|
|
>inetd</B
|
|
>, perhaps just send
|
|
it a HUP. If you have installed an earlier version of <B
|
|
CLASS="COMMAND"
|
|
> nmbd</B
|
|
> then you may need to kill nmbd as well.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN116"
|
|
>1.6.2. Step 5b. Alternative: starting it as a daemon</A
|
|
></H2
|
|
><P
|
|
>To start the server as a daemon you should create
|
|
a script something like this one, perhaps calling
|
|
it <TT
|
|
CLASS="FILENAME"
|
|
>startsmb</TT
|
|
>.</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
> #!/bin/sh
|
|
/usr/local/samba/bin/smbd -D
|
|
/usr/local/samba/bin/nmbd -D
|
|
</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>then make it executable with <B
|
|
CLASS="COMMAND"
|
|
>chmod
|
|
+x startsmb</B
|
|
></P
|
|
><P
|
|
>You can then run <B
|
|
CLASS="COMMAND"
|
|
>startsmb</B
|
|
> by
|
|
hand or execute it from <TT
|
|
CLASS="FILENAME"
|
|
>/etc/rc.local</TT
|
|
>
|
|
</P
|
|
><P
|
|
>To kill it send a kill signal to the processes
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nmbd</B
|
|
> and <B
|
|
CLASS="COMMAND"
|
|
>smbd</B
|
|
>.</P
|
|
><P
|
|
>NOTE: If you use the SVR4 style init system then
|
|
you may like to look at the <TT
|
|
CLASS="FILENAME"
|
|
>examples/svr4-startup</TT
|
|
>
|
|
script to make Samba fit into that system.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN132"
|
|
>1.7. Step 6: Try listing the shares available on your
|
|
server</A
|
|
></H1
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>$ </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>smbclient -L
|
|
<TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>yourhostname</I
|
|
></TT
|
|
></B
|
|
></TT
|
|
></P
|
|
><P
|
|
>Your should get back a list of shares available on
|
|
your server. If you don't then something is incorrectly setup.
|
|
Note that this method can also be used to see what shares
|
|
are available on other LanManager clients (such as WfWg).</P
|
|
><P
|
|
>If you choose user level security then you may find
|
|
that Samba requests a password before it will list the shares.
|
|
See the <B
|
|
CLASS="COMMAND"
|
|
>smbclient</B
|
|
> man page for details. (you
|
|
can force it to list the shares without a password by
|
|
adding the option -U% to the command line. This will not work
|
|
with non-Samba servers)</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN141"
|
|
>1.8. Step 7: Try connecting with the unix client</A
|
|
></H1
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>$ </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>smbclient <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
> //yourhostname/aservice</I
|
|
></TT
|
|
></B
|
|
></TT
|
|
></P
|
|
><P
|
|
>Typically the <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>yourhostname</I
|
|
></TT
|
|
>
|
|
would be the name of the host where you installed <B
|
|
CLASS="COMMAND"
|
|
> smbd</B
|
|
>. The <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>aservice</I
|
|
></TT
|
|
> is
|
|
any service you have defined in the <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
>
|
|
file. Try your user name if you just have a [homes] section
|
|
in <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
>.</P
|
|
><P
|
|
>For example if your unix host is bambi and your login
|
|
name is fred you would type:</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>$ </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>smbclient //bambi/fred
|
|
</B
|
|
></TT
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN157"
|
|
>1.9. Step 8: Try connecting from a DOS, WfWg, Win9x, WinNT,
|
|
Win2k, OS/2, etc... client</A
|
|
></H1
|
|
><P
|
|
>Try mounting disks. eg:</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>C:\WINDOWS\> </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>net use d: \\servername\service
|
|
</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>Try printing. eg:</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>C:\WINDOWS\> </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>net use lpt1:
|
|
\\servername\spoolservice</B
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>C:\WINDOWS\> </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>print filename
|
|
</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>Celebrate, or send me a bug report!</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN171"
|
|
>1.10. What If Things Don't Work?</A
|
|
></H1
|
|
><P
|
|
>If nothing works and you start to think "who wrote
|
|
this pile of trash" then I suggest you do step 2 again (and
|
|
again) till you calm down.</P
|
|
><P
|
|
>Then you might read the file DIAGNOSIS.txt and the
|
|
FAQ. If you are still stuck then try the mailing list or
|
|
newsgroup (look in the README for details). Samba has been
|
|
successfully installed at thousands of sites worldwide, so maybe
|
|
someone else has hit your problem and has overcome it. You could
|
|
also use the WWW site to scan back issues of the samba-digest.</P
|
|
><P
|
|
>When you fix the problem PLEASE send me some updates to the
|
|
documentation (or source code) so that the next person will find it
|
|
easier. </P
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN176"
|
|
>1.10.1. Diagnosing Problems</A
|
|
></H2
|
|
><P
|
|
>If you have instalation problems then go to
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>DIAGNOSIS.txt</TT
|
|
> to try to find the
|
|
problem.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN180"
|
|
>1.10.2. Scope IDs</A
|
|
></H2
|
|
><P
|
|
>By default Samba uses a blank scope ID. This means
|
|
all your windows boxes must also have a blank scope ID.
|
|
If you really want to use a non-blank scope ID then you will
|
|
need to use the -i <scope> option to nmbd, smbd, and
|
|
smbclient. All your PCs will need to have the same setting for
|
|
this to work. I do not recommend scope IDs.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN183"
|
|
>1.10.3. Choosing the Protocol Level</A
|
|
></H2
|
|
><P
|
|
>The SMB protocol has many dialects. Currently
|
|
Samba supports 5, called CORE, COREPLUS, LANMAN1,
|
|
LANMAN2 and NT1.</P
|
|
><P
|
|
>You can choose what maximum protocol to support
|
|
in the <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
> file. The default is
|
|
NT1 and that is the best for the vast majority of sites.</P
|
|
><P
|
|
>In older versions of Samba you may have found it
|
|
necessary to use COREPLUS. The limitations that led to
|
|
this have mostly been fixed. It is now less likely that you
|
|
will want to use less than LANMAN1. The only remaining advantage
|
|
of COREPLUS is that for some obscure reason WfWg preserves
|
|
the case of passwords in this protocol, whereas under LANMAN1,
|
|
LANMAN2 or NT1 it uppercases all passwords before sending them,
|
|
forcing you to use the "password level=" option in some cases.</P
|
|
><P
|
|
>The main advantage of LANMAN2 and NT1 is support for
|
|
long filenames with some clients (eg: smbclient, Windows NT
|
|
or Win95). </P
|
|
><P
|
|
>See the smb.conf(5) manual page for more details.</P
|
|
><P
|
|
>Note: To support print queue reporting you may find
|
|
that you have to use TCP/IP as the default protocol under
|
|
WfWg. For some reason if you leave Netbeui as the default
|
|
it may break the print queue reporting on some systems.
|
|
It is presumably a WfWg bug.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN192"
|
|
>1.10.4. Printing from UNIX to a Client PC</A
|
|
></H2
|
|
><P
|
|
>To use a printer that is available via a smb-based
|
|
server from a unix host you will need to compile the
|
|
smbclient program. You then need to install the script
|
|
"smbprint". Read the instruction in smbprint for more details.
|
|
</P
|
|
><P
|
|
>There is also a SYSV style script that does much
|
|
the same thing called smbprint.sysv. It contains instructions.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN196"
|
|
>1.10.5. Locking</A
|
|
></H2
|
|
><P
|
|
>One area which sometimes causes trouble is locking.</P
|
|
><P
|
|
>There are two types of locking which need to be
|
|
performed by a SMB server. The first is "record locking"
|
|
which allows a client to lock a range of bytes in a open file.
|
|
The second is the "deny modes" that are specified when a file
|
|
is open.</P
|
|
><P
|
|
>Samba supports "record locking" using the fcntl() unix system
|
|
call. This is often implemented using rpc calls to a rpc.lockd process
|
|
running on the system that owns the filesystem. Unfortunately many
|
|
rpc.lockd implementations are very buggy, particularly when made to
|
|
talk to versions from other vendors. It is not uncommon for the
|
|
rpc.lockd to crash.</P
|
|
><P
|
|
>There is also a problem translating the 32 bit lock
|
|
requests generated by PC clients to 31 bit requests supported
|
|
by most unixes. Unfortunately many PC applications (typically
|
|
OLE2 applications) use byte ranges with the top bit set
|
|
as semaphore sets. Samba attempts translation to support
|
|
these types of applications, and the translation has proved
|
|
to be quite successful.</P
|
|
><P
|
|
>Strictly a SMB server should check for locks before
|
|
every read and write call on a file. Unfortunately with the
|
|
way fcntl() works this can be slow and may overstress the
|
|
rpc.lockd. It is also almost always unnecessary as clients
|
|
are supposed to independently make locking calls before reads
|
|
and writes anyway if locking is important to them. By default
|
|
Samba only makes locking calls when explicitly asked
|
|
to by a client, but if you set "strict locking = yes" then it will
|
|
make lock checking calls on every read and write. </P
|
|
><P
|
|
>You can also disable by range locking completely
|
|
using "locking = no". This is useful for those shares that
|
|
don't support locking or don't need it (such as cdroms). In
|
|
this case Samba fakes the return codes of locking calls to
|
|
tell clients that everything is OK.</P
|
|
><P
|
|
>The second class of locking is the "deny modes". These
|
|
are set by an application when it opens a file to determine
|
|
what types of access should be allowed simultaneously with
|
|
its open. A client may ask for DENY_NONE, DENY_READ, DENY_WRITE
|
|
or DENY_ALL. There are also special compatability modes called
|
|
DENY_FCB and DENY_DOS.</P
|
|
><P
|
|
>You can disable share modes using "share modes = no".
|
|
This may be useful on a heavily loaded server as the share
|
|
modes code is very slow. See also the FAST_SHARE_MODES
|
|
option in the Makefile for a way to do full share modes
|
|
very fast using shared memory (if your OS supports it).</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN206"
|
|
>1.10.6. Mapping Usernames</A
|
|
></H2
|
|
><P
|
|
>If you have different usernames on the PCs and
|
|
the unix server then take a look at the "username map" option.
|
|
See the smb.conf man page for details.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN209"
|
|
>1.10.7. Other Character Sets</A
|
|
></H2
|
|
><P
|
|
>If you have problems using filenames with accented
|
|
characters in them (like the German, French or Scandinavian
|
|
character sets) then I recommmend you look at the "valid chars"
|
|
option in smb.conf and also take a look at the validchars
|
|
package in the examples directory.</P
|
|
></DIV
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN212"
|
|
>Chapter 2. LanMan and NT Password Encryption in Samba 2.x</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN223"
|
|
>2.1. Introduction</A
|
|
></H1
|
|
><P
|
|
>With the development of LanManager and Windows NT
|
|
compatible password encryption for Samba, it is now able
|
|
to validate user connections in exactly the same way as
|
|
a LanManager or Windows NT server.</P
|
|
><P
|
|
>This document describes how the SMB password encryption
|
|
algorithm works and what issues there are in choosing whether
|
|
you want to use it. You should read it carefully, especially
|
|
the part about security and the "PROS and CONS" section.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN227"
|
|
>2.2. How does it work?</A
|
|
></H1
|
|
><P
|
|
>LanManager encryption is somewhat similar to UNIX
|
|
password encryption. The server uses a file containing a
|
|
hashed value of a user's password. This is created by taking
|
|
the user's plaintext password, capitalising it, and either
|
|
truncating to 14 bytes or padding to 14 bytes with null bytes.
|
|
This 14 byte value is used as two 56 bit DES keys to encrypt
|
|
a 'magic' eight byte value, forming a 16 byte value which is
|
|
stored by the server and client. Let this value be known as
|
|
the "hashed password".</P
|
|
><P
|
|
>Windows NT encryption is a higher quality mechanism,
|
|
consisting of doing an MD4 hash on a Unicode version of the user's
|
|
password. This also produces a 16 byte hash value that is
|
|
non-reversible.</P
|
|
><P
|
|
>When a client (LanManager, Windows for WorkGroups, Windows
|
|
95 or Windows NT) wishes to mount a Samba drive (or use a Samba
|
|
resource), it first requests a connection and negotiates the
|
|
protocol that the client and server will use. In the reply to this
|
|
request the Samba server generates and appends an 8 byte, random
|
|
value - this is stored in the Samba server after the reply is sent
|
|
and is known as the "challenge". The challenge is different for
|
|
every client connection.</P
|
|
><P
|
|
>The client then uses the hashed password (16 byte values
|
|
described above), appended with 5 null bytes, as three 56 bit
|
|
DES keys, each of which is used to encrypt the challenge 8 byte
|
|
value, forming a 24 byte value known as the "response".</P
|
|
><P
|
|
>In the SMB call SMBsessionsetupX (when user level security
|
|
is selected) or the call SMBtconX (when share level security is
|
|
selected), the 24 byte response is returned by the client to the
|
|
Samba server. For Windows NT protocol levels the above calculation
|
|
is done on both hashes of the user's password and both responses are
|
|
returned in the SMB call, giving two 24 byte values.</P
|
|
><P
|
|
>The Samba server then reproduces the above calculation, using
|
|
its own stored value of the 16 byte hashed password (read from the
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>smbpasswd</TT
|
|
> file - described later) and the challenge
|
|
value that it kept from the negotiate protocol reply. It then checks
|
|
to see if the 24 byte value it calculates matches the 24 byte value
|
|
returned to it from the client.</P
|
|
><P
|
|
>If these values match exactly, then the client knew the
|
|
correct password (or the 16 byte hashed value - see security note
|
|
below) and is thus allowed access. If not, then the client did not
|
|
know the correct password and is denied access.</P
|
|
><P
|
|
>Note that the Samba server never knows or stores the cleartext
|
|
of the user's password - just the 16 byte hashed values derived from
|
|
it. Also note that the cleartext password or 16 byte hashed values
|
|
are never transmitted over the network - thus increasing security.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN238"
|
|
>2.3. Important Notes About Security</A
|
|
></H1
|
|
><P
|
|
>The unix and SMB password encryption techniques seem similar
|
|
on the surface. This similarity is, however, only skin deep. The unix
|
|
scheme typically sends clear text passwords over the nextwork when
|
|
logging in. This is bad. The SMB encryption scheme never sends the
|
|
cleartext password over the network but it does store the 16 byte
|
|
hashed values on disk. This is also bad. Why? Because the 16 byte hashed
|
|
values are a "password equivalent". You cannot derive the user's
|
|
password from them, but they could potentially be used in a modified
|
|
client to gain access to a server. This would require considerable
|
|
technical knowledge on behalf of the attacker but is perfectly possible.
|
|
You should thus treat the smbpasswd file as though it contained the
|
|
cleartext passwords of all your users. Its contents must be kept
|
|
secret, and the file should be protected accordingly.</P
|
|
><P
|
|
>Ideally we would like a password scheme which neither requires
|
|
plain text passwords on the net or on disk. Unfortunately this
|
|
is not available as Samba is stuck with being compatible with
|
|
other SMB systems (WinNT, WfWg, Win95 etc). </P
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
BORDER="1"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
ALIGN="CENTER"
|
|
><B
|
|
>Warning</B
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
ALIGN="LEFT"
|
|
><P
|
|
>Note that Windows NT 4.0 Service pack 3 changed the
|
|
default for permissible authentication so that plaintext
|
|
passwords are <EM
|
|
>never</EM
|
|
> sent over the wire.
|
|
The solution to this is either to switch to encrypted passwords
|
|
with Samba or edit the Windows NT registry to re-enable plaintext
|
|
passwords. See the document WinNT.txt for details on how to do
|
|
this.</P
|
|
><P
|
|
>Other Microsoft operating systems which also exhibit
|
|
this behavior includes</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>MS DOS Network client 3.0 with
|
|
the basic network redirector installed</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Windows 95 with the network redirector
|
|
update installed</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Windows 98 [se]</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Windows 2000</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
><EM
|
|
>Note :</EM
|
|
>All current release of
|
|
Microsoft SMB/CIFS clients support authentication via the
|
|
SMB Challenge/Response mechanism described here. Enabling
|
|
clear text authentication does not disable the ability
|
|
of the client to particpate in encrypted authentication.</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN257"
|
|
>2.3.1. Advantages of SMB Encryption</A
|
|
></H2
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>plain text passwords are not passed across
|
|
the network. Someone using a network sniffer cannot just
|
|
record passwords going to the SMB server.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>WinNT doesn't like talking to a server
|
|
that isn't using SMB encrypted passwords. It will refuse
|
|
to browse the server if the server is also in user level
|
|
security mode. It will insist on prompting the user for the
|
|
password on each connection, which is very annoying. The
|
|
only things you can do to stop this is to use SMB encryption.
|
|
</P
|
|
></LI
|
|
></UL
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN264"
|
|
>2.3.2. Advantages of non-encrypted passwords</A
|
|
></H2
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>plain text passwords are not kept
|
|
on disk. </P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>uses same password file as other unix
|
|
services such as login and ftp</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>you are probably already using other
|
|
services (such as telnet and ftp) which send plain text
|
|
passwords over the net, so sending them for SMB isn't
|
|
such a big deal.</P
|
|
></LI
|
|
></UL
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN273"
|
|
>2.4. <A
|
|
NAME="SMBPASSWDFILEFORMAT"
|
|
></A
|
|
>The smbpasswd file</A
|
|
></H1
|
|
><P
|
|
>In order for Samba to participate in the above protocol
|
|
it must be able to look up the 16 byte hashed values given a user name.
|
|
Unfortunately, as the UNIX password value is also a one way hash
|
|
function (ie. it is impossible to retrieve the cleartext of the user's
|
|
password given the UNIX hash of it), a separate password file
|
|
containing this 16 byte value must be kept. To minimise problems with
|
|
these two password files, getting out of sync, the UNIX <TT
|
|
CLASS="FILENAME"
|
|
> /etc/passwd</TT
|
|
> and the <TT
|
|
CLASS="FILENAME"
|
|
>smbpasswd</TT
|
|
> file,
|
|
a utility, <B
|
|
CLASS="COMMAND"
|
|
>mksmbpasswd.sh</B
|
|
>, is provided to generate
|
|
a smbpasswd file from a UNIX <TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd</TT
|
|
> file.
|
|
</P
|
|
><P
|
|
>To generate the smbpasswd file from your <TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd
|
|
</TT
|
|
> file use the following command :</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>$ </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>cat /etc/passwd | mksmbpasswd.sh
|
|
> /usr/local/samba/private/smbpasswd</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>If you are running on a system that uses NIS, use</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>$ </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>ypcat passwd | mksmbpasswd.sh
|
|
> /usr/local/samba/private/smbpasswd</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>The <B
|
|
CLASS="COMMAND"
|
|
>mksmbpasswd.sh</B
|
|
> program is found in
|
|
the Samba source directory. By default, the smbpasswd file is
|
|
stored in :</P
|
|
><P
|
|
><TT
|
|
CLASS="FILENAME"
|
|
>/usr/local/samba/private/smbpasswd</TT
|
|
></P
|
|
><P
|
|
>The owner of the <TT
|
|
CLASS="FILENAME"
|
|
>/usr/local/samba/private/</TT
|
|
>
|
|
directory should be set to root, and the permissions on it should
|
|
be set to 0500 (<B
|
|
CLASS="COMMAND"
|
|
>chmod 500 /usr/local/samba/private</B
|
|
>).
|
|
</P
|
|
><P
|
|
>Likewise, the smbpasswd file inside the private directory should
|
|
be owned by root and the permissions on is should be set to 0600
|
|
(<B
|
|
CLASS="COMMAND"
|
|
>chmod 600 smbpasswd</B
|
|
>).</P
|
|
><P
|
|
>The format of the smbpasswd file is (The line has been
|
|
wrapped here. It should appear as one entry per line in
|
|
your smbpasswd file.)</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>username:uid:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
|
|
[Account type]:LCT-<last-change-time>:Long name
|
|
</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>Although only the <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>username</I
|
|
></TT
|
|
>,
|
|
<TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>uid</I
|
|
></TT
|
|
>, <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</I
|
|
></TT
|
|
>,
|
|
[<TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>Account type</I
|
|
></TT
|
|
>] and <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
> last-change-time</I
|
|
></TT
|
|
> sections are significant
|
|
and are looked at in the Samba code.</P
|
|
><P
|
|
>It is <EM
|
|
>VITALLY</EM
|
|
> important that there by 32
|
|
'X' characters between the two ':' characters in the XXX sections -
|
|
the smbpasswd and Samba code will fail to validate any entries that
|
|
do not have 32 characters between ':' characters. The first XXX
|
|
section is for the Lanman password hash, the second is for the
|
|
Windows NT version.</P
|
|
><P
|
|
>When the password file is created all users have password entries
|
|
consisting of 32 'X' characters. By default this disallows any access
|
|
as this user. When a user has a password set, the 'X' characters change
|
|
to 32 ascii hexadecimal digits (0-9, A-F). These are an ascii
|
|
representation of the 16 byte hashed value of a user's password.</P
|
|
><P
|
|
>To set a user to have no password (not recommended), edit the file
|
|
using vi, and replace the first 11 characters with the ascii text
|
|
<TT
|
|
CLASS="CONSTANT"
|
|
>"NO PASSWORD"</TT
|
|
> (minus the quotes).</P
|
|
><P
|
|
>For example, to clear the password for user bob, his smbpasswd file
|
|
entry would look like :</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
> bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[U ]:LCT-00000000:Bob's full name:/bobhome:/bobshell
|
|
</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>If you are allowing users to use the smbpasswd command to set
|
|
their own passwords, you may want to give users NO PASSWORD initially
|
|
so they do not have to enter a previous password when changing to their
|
|
new password (not recommended). In order for you to allow this the
|
|
<B
|
|
CLASS="COMMAND"
|
|
>smbpasswd</B
|
|
> program must be able to connect to the
|
|
<B
|
|
CLASS="COMMAND"
|
|
>smbd</B
|
|
> daemon as that user with no password. Enable this
|
|
by adding the line :</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>null passwords = yes</B
|
|
></P
|
|
><P
|
|
>to the [global] section of the smb.conf file (this is why
|
|
the above scenario is not recommended). Preferably, allocate your
|
|
users a default password to begin with, so you do not have
|
|
to enable this on your server.</P
|
|
><P
|
|
><EM
|
|
>Note : </EM
|
|
>This file should be protected very
|
|
carefully. Anyone with access to this file can (with enough knowledge of
|
|
the protocols) gain access to your SMB server. The file is thus more
|
|
sensitive than a normal unix <TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd</TT
|
|
> file.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN325"
|
|
>2.5. The smbpasswd Command</A
|
|
></H1
|
|
><P
|
|
>The smbpasswd command maintains the two 32 byte password fields
|
|
in the smbpasswd file. If you wish to make it similar to the unix
|
|
<B
|
|
CLASS="COMMAND"
|
|
>passwd</B
|
|
> or <B
|
|
CLASS="COMMAND"
|
|
>yppasswd</B
|
|
> programs,
|
|
install it in <TT
|
|
CLASS="FILENAME"
|
|
>/usr/local/samba/bin/</TT
|
|
> (or your
|
|
main Samba binary directory).</P
|
|
><P
|
|
>Note that as of Samba 1.9.18p4 this program <EM
|
|
>MUST NOT
|
|
BE INSTALLED</EM
|
|
> setuid root (the new <B
|
|
CLASS="COMMAND"
|
|
>smbpasswd</B
|
|
>
|
|
code enforces this restriction so it cannot be run this way by
|
|
accident).</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>smbpasswd</B
|
|
> now works in a client-server mode
|
|
where it contacts the local smbd to change the user's password on its
|
|
behalf. This has enormous benefits - as follows.</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>smbpasswd no longer has to be setuid root -
|
|
an enormous range of potential security problems is
|
|
eliminated.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>smbpasswd</B
|
|
> now has the capability
|
|
to change passwords on Windows NT servers (this only works when
|
|
the request is sent to the NT Primary Domain Controller if you
|
|
are changing an NT Domain user's password).</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>To run smbpasswd as a normal user just type :</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>$ </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>smbpasswd</B
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>Old SMB password: </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
><type old value here -
|
|
or hit return if there was no old password></B
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>New SMB Password: </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
><type new value>
|
|
</B
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>Repeat New SMB Password: </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
><re-type new value
|
|
</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>If the old value does not match the current value stored for
|
|
that user, or the two new values do not match each other, then the
|
|
password will not be changed.</P
|
|
><P
|
|
>If invoked by an ordinary user it will only allow the user
|
|
to change his or her own Samba password.</P
|
|
><P
|
|
>If run by the root user smbpasswd may take an optional
|
|
argument, specifying the user name whose SMB password you wish to
|
|
change. Note that when run as root smbpasswd does not prompt for
|
|
or check the old password value, thus allowing root to set passwords
|
|
for users who have forgotten their passwords.</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>smbpasswd</B
|
|
> is designed to work in the same way
|
|
and be familiar to UNIX users who use the <B
|
|
CLASS="COMMAND"
|
|
>passwd</B
|
|
> or
|
|
<B
|
|
CLASS="COMMAND"
|
|
>yppasswd</B
|
|
> commands.</P
|
|
><P
|
|
>For more details on using <B
|
|
CLASS="COMMAND"
|
|
>smbpasswd</B
|
|
> refer
|
|
to the man page which will always be the definitive reference.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN364"
|
|
>2.6. Setting up Samba to support LanManager Encryption</A
|
|
></H1
|
|
><P
|
|
>This is a very brief description on how to setup samba to
|
|
support password encryption. </P
|
|
><P
|
|
></P
|
|
><OL
|
|
TYPE="1"
|
|
><LI
|
|
><P
|
|
>compile and install samba as usual</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>enable encrypted passwords in <TT
|
|
CLASS="FILENAME"
|
|
> smb.conf</TT
|
|
> by adding the line <B
|
|
CLASS="COMMAND"
|
|
>encrypt
|
|
passwords = yes</B
|
|
> in the [global] section</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>create the initial <TT
|
|
CLASS="FILENAME"
|
|
>smbpasswd</TT
|
|
>
|
|
password file in the place you specified in the Makefile
|
|
(--prefix=<dir>). See the notes under the <A
|
|
HREF="#SMBPASSWDFILEFORMAT"
|
|
>The smbpasswd File</A
|
|
>
|
|
section earlier in the document for details.</P
|
|
></LI
|
|
></OL
|
|
><P
|
|
>Note that you can test things using smbclient.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN379"
|
|
>Chapter 3. Hosting a Microsoft Distributed File System tree on Samba</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN390"
|
|
>3.1. Instructions</A
|
|
></H1
|
|
><P
|
|
>The Distributed File System (or Dfs) provides a means of
|
|
separating the logical view of files and directories that users
|
|
see from the actual physical locations of these resources on the
|
|
network. It allows for higher availability, smoother storage expansion,
|
|
load balancing etc. For more information about Dfs, refer to <A
|
|
HREF="http://www.microsoft.com/NTServer/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp"
|
|
TARGET="_top"
|
|
> Microsoft documentation</A
|
|
>. </P
|
|
><P
|
|
>This document explains how to host a Dfs tree on a Unix
|
|
machine (for Dfs-aware clients to browse) using Samba.</P
|
|
><P
|
|
>To enable SMB-based DFS for Samba, configure it with the
|
|
<TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>--with-msdfs</I
|
|
></TT
|
|
> option. Once built, a
|
|
Samba server can be made a Dfs server by setting the global
|
|
boolean <A
|
|
HREF="smb.conf.5.html#HOSTMSDFS"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
> host msdfs</I
|
|
></TT
|
|
></A
|
|
> parameter in the <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf
|
|
</TT
|
|
> file. You designate a share as a Dfs root using the share
|
|
level boolean <A
|
|
HREF="smb.conf.5.html#MSDFSROOT"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
> msdfs root</I
|
|
></TT
|
|
></A
|
|
> parameter. A Dfs root directory on
|
|
Samba hosts Dfs links in the form of symbolic links that point
|
|
to other servers. For example, a symbolic link
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>junction->msdfs:storage1\share1</TT
|
|
> in
|
|
the share directory acts as the Dfs junction. When Dfs-aware
|
|
clients attempt to access the junction link, they are redirected
|
|
to the storage location (in this case, \\storage1\share1).</P
|
|
><P
|
|
>Dfs trees on Samba work with all Dfs-aware clients ranging
|
|
from Windows 95 to 2000.</P
|
|
><P
|
|
>Here's an example of setting up a Dfs tree on a Samba
|
|
server.</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
># The smb.conf file:
|
|
[global]
|
|
netbios name = SAMBA
|
|
host msdfs = yes
|
|
|
|
[dfs]
|
|
path = /export/dfsroot
|
|
msdfs root = yes
|
|
</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>In the /export/dfsroot directory we set up our dfs links to
|
|
other servers on the network.</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>cd /export/dfsroot</B
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>chown root /export/dfsroot</B
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>chmod 755 /export/dfsroot</B
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>ln -s msdfs:storageA\\shareA linka</B
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>ln -s msdfs:serverB\\share,serverC\\share linkb</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>You should set up the permissions and ownership of
|
|
the directory acting as the Dfs root such that only designated
|
|
users can create, delete or modify the msdfs links. Also note
|
|
that symlink names should be all lowercase. This limitation exists
|
|
to have Samba avoid trying all the case combinations to get at
|
|
the link name. Finally set up the symbolic links to point to the
|
|
network shares you want, and start Samba.</P
|
|
><P
|
|
>Users on Dfs-aware clients can now browse the Dfs tree
|
|
on the Samba server at \\samba\dfs. Accessing
|
|
links linka or linkb (which appear as directories to the client)
|
|
takes users directly to the appropriate shares on the network.</P
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN425"
|
|
>3.1.1. Notes</A
|
|
></H2
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>Windows clients need to be rebooted
|
|
if a previously mounted non-dfs share is made a dfs
|
|
root or vice versa. A better way is to introduce a
|
|
new share and make it the dfs root.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Currently there's a restriction that msdfs
|
|
symlink names should all be lowercase.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>For security purposes, the directory
|
|
acting as the root of the Dfs tree should have ownership
|
|
and permissions set so that only designated users can
|
|
modify the symbolic links in the directory.</P
|
|
></LI
|
|
></UL
|
|
></DIV
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN434"
|
|
>Chapter 4. Printing Support in Samba 2.2.x</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN445"
|
|
>4.1. Introduction</A
|
|
></H1
|
|
><P
|
|
>Beginning with the 2.2.0 release, Samba supports
|
|
the native Windows NT printing mechanisms implemented via
|
|
MS-RPC (i.e. the SPOOLSS named pipe). Previous versions of
|
|
Samba only supported LanMan printing calls.</P
|
|
><P
|
|
>The additional functionality provided by the new
|
|
SPOOLSS support includes:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>Support for downloading printer driver
|
|
files to Windows 95/98/NT/2000 clients upon demand.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Uploading of printer drivers via the
|
|
Windows NT Add Printer Wizard (APW) or the
|
|
Imprints tool set (refer to <A
|
|
HREF="http://imprints.sourceforge.net"
|
|
TARGET="_top"
|
|
>http://imprints.sourceforge.net</A
|
|
>).
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Support for the native MS-RPC printing
|
|
calls such as StartDocPrinter, EnumJobs(), etc... (See
|
|
the MSDN documentation at <A
|
|
HREF="http://msdn.microsoft.com/"
|
|
TARGET="_top"
|
|
>http://msdn.microsoft.com/</A
|
|
>
|
|
for more information on the Win32 printing API)
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Support for NT Access Control Lists (ACL)
|
|
on printer objects</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Improved support for printer queue manipulation
|
|
through the use of an internal databases for spooled job
|
|
information</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>There has been some initial confusion about what all this means
|
|
and whether or not it is a requirement for printer drivers to be
|
|
installed on a Samba host in order to support printing from Windows
|
|
clients. A bug existed in Samba 2.2.0 which made Windows NT/2000 clients
|
|
require that the Samba server possess a valid driver for the printer.
|
|
This is fixed in Samba 2.2.1 and once again, Windows NT/2000 clients
|
|
can use the local APW for installing drivers to be used with a Samba
|
|
served printer. This is the same behavior exhibited by Windows 9x clients.
|
|
As a side note, Samba does not use these drivers in any way to process
|
|
spooled files. They are utilized entirely by the clients.</P
|
|
><P
|
|
>The following MS KB article, may be of some help if you are dealing with
|
|
Windows 2000 clients: <EM
|
|
>How to Add Printers with No User
|
|
Interaction in Windows 2000</EM
|
|
></P
|
|
><P
|
|
><A
|
|
HREF="http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP"
|
|
TARGET="_top"
|
|
>http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP</A
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN467"
|
|
>4.2. Configuration</A
|
|
></H1
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
BORDER="1"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
ALIGN="CENTER"
|
|
><B
|
|
>[print$] vs. [printer$]</B
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
ALIGN="LEFT"
|
|
><P
|
|
>Previous versions of Samba recommended using a share named [printer$].
|
|
This name was taken from the printer$ service created by Windows 9x
|
|
clients when a printer was shared. Windows 9x printer servers always have
|
|
a printer$ service which provides read-only access via no
|
|
password in order to support printer driver downloads.</P
|
|
><P
|
|
>However, the initial implementation allowed for a
|
|
parameter named <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>printer driver location</I
|
|
></TT
|
|
>
|
|
to be used on a per share basis to specify the location of
|
|
the driver files associated with that printer. Another
|
|
parameter named <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>printer driver</I
|
|
></TT
|
|
> provided
|
|
a means of defining the printer driver name to be sent to
|
|
the client.</P
|
|
><P
|
|
>These parameters, including <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>printer driver
|
|
file</I
|
|
></TT
|
|
> parameter, are being depreciated and should not
|
|
be used in new installations. For more information on this change,
|
|
you should refer to the <A
|
|
HREF="#MIGRATION"
|
|
>Migration section</A
|
|
>
|
|
of this document.</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN478"
|
|
>4.2.1. Creating [print$]</A
|
|
></H2
|
|
><P
|
|
>In order to support the uploading of printer driver
|
|
files, you must first configure a file share named [print$].
|
|
The name of this share is hard coded in Samba's internals so
|
|
the name is very important (print$ is the service used by
|
|
Windows NT print servers to provide support for printer driver
|
|
download).</P
|
|
><P
|
|
>You should modify the server's smb.conf file to create the
|
|
following file share (of course, some of the parameter values,
|
|
such as 'path' are arbitrary and should be replaced with
|
|
appropriate values for your site):</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>[print$]
|
|
path = /usr/local/samba/printers
|
|
guest ok = yes
|
|
browseable = yes
|
|
read only = yes
|
|
; since this share is configured as read only, then we need
|
|
; a 'write list'. Check the file system permissions to make
|
|
; sure this account can copy files to the share. If this
|
|
; is setup to a non-root account, then it should also exist
|
|
; as a 'printer admin'
|
|
write list = ntadmin</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>The <A
|
|
HREF="smb.conf.5.html#WRITELIST"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>write list</I
|
|
></TT
|
|
></A
|
|
> is used to allow administrative
|
|
level user accounts to have write access in order to update files
|
|
on the share. See the <A
|
|
HREF="smb./conf.5.html"
|
|
TARGET="_top"
|
|
>smb.conf(5)
|
|
man page</A
|
|
> for more information on configuring file shares.</P
|
|
><P
|
|
>The requirement for <A
|
|
HREF="smb.conf.5.html#GUESTOK"
|
|
TARGET="_top"
|
|
><B
|
|
CLASS="COMMAND"
|
|
>guest
|
|
ok = yes</B
|
|
></A
|
|
> depends upon how your
|
|
site is configured. If users will be guaranteed to have
|
|
an account on the Samba host, then this is a non-issue.</P
|
|
><DIV
|
|
CLASS="NOTE"
|
|
><BLOCKQUOTE
|
|
CLASS="NOTE"
|
|
><P
|
|
><B
|
|
>Author's Note: </B
|
|
>The non-issue is that if all your Windows NT users are guaranteed to be
|
|
authenticated by the Samba server (such as a domain member server and the NT
|
|
user has already been validated by the Domain Controller in
|
|
order to logon to the Windows NT console), then guest access
|
|
is not necessary. Of course, in a workgroup environment where
|
|
you just want to be able to print without worrying about
|
|
silly accounts and security, then configure the share for
|
|
guest access. You'll probably want to add <A
|
|
HREF="smb.conf.5.html#MAPTOGUEST"
|
|
TARGET="_top"
|
|
><B
|
|
CLASS="COMMAND"
|
|
>map to guest = Bad User</B
|
|
></A
|
|
> in the [global] section as well. Make sure
|
|
you understand what this parameter does before using it
|
|
though. --jerry</P
|
|
></BLOCKQUOTE
|
|
></DIV
|
|
><P
|
|
>In order for a Windows NT print server to support
|
|
the downloading of driver files by multiple client architectures,
|
|
it must create subdirectories within the [print$] service
|
|
which correspond to each of the supported client architectures.
|
|
Samba follows this model as well.</P
|
|
><P
|
|
>Next create the directory tree below the [print$] share
|
|
for each architecture you wish to support.</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>[print$]-----
|
|
|-W32X86 ; "Windows NT x86"
|
|
|-WIN40 ; "Windows 95/98"
|
|
|-W32ALPHA ; "Windows NT Alpha_AXP"
|
|
|-W32MIPS ; "Windows NT R4000"
|
|
|-W32PPC ; "Windows NT PowerPC"</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
BORDER="1"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
ALIGN="CENTER"
|
|
><B
|
|
>ATTENTION! REQUIRED PERMISSIONS</B
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
ALIGN="LEFT"
|
|
><P
|
|
>In order to currently add a new driver to you Samba host,
|
|
one of two conditions must hold true:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>The account used to connect to the Samba host
|
|
must have a uid of 0 (i.e. a root account)</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>The account used to connect to the Samba host
|
|
must be a member of the <A
|
|
HREF="smb.conf.5.html#PRINTERADMIN"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>printer
|
|
admin</I
|
|
></TT
|
|
></A
|
|
> list.</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>Of course, the connected account must still possess access
|
|
to add files to the subdirectories beneath [print$]. Remember
|
|
that all file shares are set to 'read only' by default.</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><P
|
|
>Once you have created the required [print$] service and
|
|
associated subdirectories, simply log onto the Samba server using
|
|
a root (or <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>printer admin</I
|
|
></TT
|
|
>) account
|
|
from a Windows NT 4.0 client. Navigate to the "Printers" folder
|
|
on the Samba server. You should see an initial listing of printers
|
|
that matches the printer shares defined on your Samba host.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN513"
|
|
>4.2.2. Setting Drivers for Existing Printers</A
|
|
></H2
|
|
><P
|
|
>The initial listing of printers in the Samba host's
|
|
Printers folder will have no real printer driver assigned
|
|
to them. By default, in Samba 2.2.0 this driver name was set to
|
|
<EM
|
|
>NO PRINTER DRIVER AVAILABLE FOR THIS PRINTER</EM
|
|
>.
|
|
Later versions changed this to a NULL string to allow the use
|
|
tof the local Add Printer Wizard on NT/2000 clients.
|
|
Attempting to view the printer properties for a printer
|
|
which has this default driver assigned will result in
|
|
the error message:</P
|
|
><P
|
|
><EM
|
|
>Device settings cannot be displayed. The driver
|
|
for the specified printer is not installed, only spooler
|
|
properties will be displayed. Do you want to install the
|
|
driver now?</EM
|
|
></P
|
|
><P
|
|
>Click "No" in the error dialog and you will be presented with
|
|
the printer properties window. The way assign a driver to a
|
|
printer is to either</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>Use the "New Driver..." button to install
|
|
a new printer driver, or</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Select a driver from the popup list of
|
|
installed drivers. Initially this list will be empty.</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>If you wish to install printer drivers for client
|
|
operating systems other than "Windows NT x86", you will need
|
|
to use the "Sharing" tab of the printer properties dialog.</P
|
|
><P
|
|
>Assuming you have connected with a root account, you
|
|
will also be able modify other printer properties such as
|
|
ACLs and device settings using this dialog box.</P
|
|
><P
|
|
>A few closing comments for this section, it is possible
|
|
on a Windows NT print server to have printers
|
|
listed in the Printers folder which are not shared. Samba does
|
|
not make this distinction. By definition, the only printers of
|
|
which Samba is aware are those which are specified as shares in
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
>.</P
|
|
><P
|
|
>Another interesting side note is that Windows NT clients do
|
|
not use the SMB printer share, but rather can print directly
|
|
to any printer on another Windows NT host using MS-RPC. This
|
|
of course assumes that the printing client has the necessary
|
|
privileges on the remote host serving the printer. The default
|
|
permissions assigned by Windows NT to a printer gives the "Print"
|
|
permissions to the "Everyone" well-known group.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN530"
|
|
>4.2.3. Support a large number of printers</A
|
|
></H2
|
|
><P
|
|
>One issue that has arisen during the development
|
|
phase of Samba 2.2 is the need to support driver downloads for
|
|
100's of printers. Using the Windows NT APW is somewhat
|
|
awkward to say the list. If more than one printer are using the
|
|
same driver, the <A
|
|
HREF="rpcclient.1.html"
|
|
TARGET="_top"
|
|
><B
|
|
CLASS="COMMAND"
|
|
>rpcclient's
|
|
setdriver command</B
|
|
></A
|
|
> can be used to set the driver
|
|
associated with an installed driver. The following is example
|
|
of how this could be accomplished:</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>
|
|
<TT
|
|
CLASS="PROMPT"
|
|
>$ </TT
|
|
>rpcclient pogo -U root%secret -c "enumdrivers"
|
|
Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
|
|
|
|
[Windows NT x86]
|
|
Printer Driver Info 1:
|
|
Driver Name: [HP LaserJet 4000 Series PS]
|
|
|
|
Printer Driver Info 1:
|
|
Driver Name: [HP LaserJet 2100 Series PS]
|
|
|
|
Printer Driver Info 1:
|
|
Driver Name: [HP LaserJet 4Si/4SiMX PS]
|
|
|
|
<TT
|
|
CLASS="PROMPT"
|
|
>$ </TT
|
|
>rpcclient pogo -U root%secret -c "enumprinters"
|
|
Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
|
|
flags:[0x800000]
|
|
name:[\\POGO\hp-print]
|
|
description:[POGO\\POGO\hp-print,NO DRIVER AVAILABLE FOR THIS PRINTER,]
|
|
comment:[]
|
|
|
|
<TT
|
|
CLASS="PROMPT"
|
|
>$ </TT
|
|
>rpcclient pogo -U root%secret \
|
|
<TT
|
|
CLASS="PROMPT"
|
|
>> </TT
|
|
> -c "setdriver hp-print \"HP LaserJet 4000 Series PS\""
|
|
Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
|
|
Successfully set hp-print to driver HP LaserJet 4000 Series PS.</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN541"
|
|
>4.2.4. Adding New Printers via the Windows NT APW</A
|
|
></H2
|
|
><P
|
|
>By default, Samba offers all printer shares defined in <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
>
|
|
in the "Printers..." folder. Also existing in this folder is the Windows NT
|
|
Add Printer Wizard icon. The APW will be show only if</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>The connected user is able to successfully
|
|
execute an OpenPrinterEx(\\server) with administrative
|
|
priviledges (i.e. root or <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>printer admin</I
|
|
></TT
|
|
>).
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><A
|
|
HREF="smb.conf.5.html#SHOWADDPRINTERWIZARD"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>show
|
|
add printer wizard = yes</I
|
|
></TT
|
|
></A
|
|
> (the default).
|
|
</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>In order to be able to use the APW to successfully add a printer to a Samba
|
|
server, the <A
|
|
HREF="smb.conf.5.html#ADDPRINTERCOMMAND"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>add
|
|
printer command</I
|
|
></TT
|
|
></A
|
|
> must have a defined value. The program
|
|
hook must successfully add the printer to the system (i.e.
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>/etc/printcap</TT
|
|
> or appropriate files) and
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
> if necessary.</P
|
|
><P
|
|
>When using the APW from a client, if the named printer share does
|
|
not exist, <B
|
|
CLASS="COMMAND"
|
|
>smbd</B
|
|
> will execute the <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>add printer
|
|
command</I
|
|
></TT
|
|
> and reparse to the <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
>
|
|
to attempt to locate the new printer share. If the share is still not defined,
|
|
an error of "Access Denied" is returned to the client. Note that the
|
|
<TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>add printer program</I
|
|
></TT
|
|
> is executed under the context
|
|
of the connected user, not necessarily a root account.</P
|
|
><P
|
|
>There is a complementing <A
|
|
HREF="smb.conf.5.html#DELETEPRINTERCOMMAND"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>delete
|
|
printer command</I
|
|
></TT
|
|
></A
|
|
> for removing entries from the "Printers..."
|
|
folder.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN566"
|
|
>4.2.5. Samba and Printer Ports</A
|
|
></H2
|
|
><P
|
|
>Windows NT/2000 print servers associate a port with each printer. These normally
|
|
take the form of LPT1:, COM1:, FILE:, etc... Samba must also support the
|
|
concept of ports associated with a printer. By default, only one printer port,
|
|
named "Samba Printer Port", exists on a system. Samba does not really a port in
|
|
order to print, rather it is a requirement of Windows clients. </P
|
|
><P
|
|
>Note that Samba does not support the concept of "Printer Pooling" internally
|
|
either. This is when a logical printer is assigned to multiple ports as
|
|
a form of load balancing or fail over.</P
|
|
><P
|
|
>If you require that multiple ports be defined for some reason,
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
> possesses a <A
|
|
HREF="smb.conf.5.html#ENUMPORTSCOMMAND"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>enumports
|
|
command</I
|
|
></TT
|
|
></A
|
|
> which can be used to define an external program
|
|
that generates a listing of ports on a system.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN574"
|
|
>4.3. The Imprints Toolset</A
|
|
></H1
|
|
><P
|
|
>The Imprints tool set provides a UNIX equivalent of the
|
|
Windows NT Add Printer Wizard. For complete information, please
|
|
refer to the Imprints web site at <A
|
|
HREF="http://imprints.sourceforge.net/"
|
|
TARGET="_top"
|
|
> http://imprints.sourceforge.net/</A
|
|
> as well as the documentation
|
|
included with the imprints source distribution. This section will
|
|
only provide a brief introduction to the features of Imprints.</P
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN578"
|
|
>4.3.1. What is Imprints?</A
|
|
></H2
|
|
><P
|
|
>Imprints is a collection of tools for supporting the goals
|
|
of</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>Providing a central repository information
|
|
regarding Windows NT and 95/98 printer driver packages</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Providing the tools necessary for creating
|
|
the Imprints printer driver packages.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Providing an installation client which
|
|
will obtain and install printer drivers on remote Samba
|
|
and Windows NT 4 print servers.</P
|
|
></LI
|
|
></UL
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN588"
|
|
>4.3.2. Creating Printer Driver Packages</A
|
|
></H2
|
|
><P
|
|
>The process of creating printer driver packages is beyond
|
|
the scope of this document (refer to Imprints.txt also included
|
|
with the Samba distribution for more information). In short,
|
|
an Imprints driver package is a gzipped tarball containing the
|
|
driver files, related INF files, and a control file needed by the
|
|
installation client.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN591"
|
|
>4.3.3. The Imprints server</A
|
|
></H2
|
|
><P
|
|
>The Imprints server is really a database server that
|
|
may be queried via standard HTTP mechanisms. Each printer
|
|
entry in the database has an associated URL for the actual
|
|
downloading of the package. Each package is digitally signed
|
|
via GnuPG which can be used to verify that package downloaded
|
|
is actually the one referred in the Imprints database. It is
|
|
<EM
|
|
>not</EM
|
|
> recommended that this security check
|
|
be disabled.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN595"
|
|
>4.3.4. The Installation Client</A
|
|
></H2
|
|
><P
|
|
>More information regarding the Imprints installation client
|
|
is available in the <TT
|
|
CLASS="FILENAME"
|
|
>Imprints-Client-HOWTO.ps</TT
|
|
>
|
|
file included with the imprints source package.</P
|
|
><P
|
|
>The Imprints installation client comes in two forms.</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>a set of command line Perl scripts</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>a GTK+ based graphical interface to
|
|
the command line perl scripts</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>The installation client (in both forms) provides a means
|
|
of querying the Imprints database server for a matching
|
|
list of known printer model names as well as a means to
|
|
download and install the drivers on remote Samba and Windows
|
|
NT print servers.</P
|
|
><P
|
|
>The basic installation process is in four steps and
|
|
perl code is wrapped around <B
|
|
CLASS="COMMAND"
|
|
>smbclient</B
|
|
>
|
|
and <B
|
|
CLASS="COMMAND"
|
|
>rpcclient</B
|
|
>.</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>
|
|
foreach (supported architecture for a given driver)
|
|
{
|
|
1. rpcclient: Get the appropriate upload directory
|
|
on the remote server
|
|
2. smbclient: Upload the driver files
|
|
3. rpcclient: Issues an AddPrinterDriver() MS-RPC
|
|
}
|
|
|
|
4. rpcclient: Issue an AddPrinterEx() MS-RPC to actually
|
|
create the printer</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>One of the problems encountered when implementing
|
|
the Imprints tool set was the name space issues between
|
|
various supported client architectures. For example, Windows
|
|
NT includes a driver named "Apple LaserWriter II NTX v51.8"
|
|
and Windows 95 callsits version of this driver "Apple
|
|
LaserWriter II NTX"</P
|
|
><P
|
|
>The problem is how to know what client drivers have
|
|
been uploaded for a printer. As astute reader will remember
|
|
that the Windows NT Printer Properties dialog only includes
|
|
space for one printer driver name. A quick look in the
|
|
Windows NT 4.0 system registry at</P
|
|
><P
|
|
><TT
|
|
CLASS="FILENAME"
|
|
>HKLM\System\CurrentControlSet\Control\Print\Environment
|
|
</TT
|
|
></P
|
|
><P
|
|
>will reveal that Windows NT always uses the NT driver
|
|
name. This is ok as Windows NT always requires that at least
|
|
the Windows NT version of the printer driver is present.
|
|
However, Samba does not have the requirement internally.
|
|
Therefore, how can you use the NT driver name if is has not
|
|
already been installed?</P
|
|
><P
|
|
>The way of sidestepping this limitation is to require
|
|
that all Imprints printer driver packages include both the Intel
|
|
Windows NT and 95/98 printer drivers and that NT driver is
|
|
installed first.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN617"
|
|
>4.4. <A
|
|
NAME="MIGRATION"
|
|
></A
|
|
>Migration to from Samba 2.0.x to 2.2.x</A
|
|
></H1
|
|
><P
|
|
>Given that printer driver management has changed (we hope improved) in
|
|
2.2 over prior releases, migration from an existing setup to 2.2 can
|
|
follow several paths.</P
|
|
><P
|
|
>Windows clients have a tendency to remember things for quite a while.
|
|
For example, if a Windows NT client has attached to a Samba 2.0 server,
|
|
it will remember the server as a LanMan printer server. Upgrading
|
|
the Samba host to 2.2 makes support for MSRPC printing possible, but
|
|
the NT client will still remember the previous setting.</P
|
|
><P
|
|
>In order to give an NT client printing "amesia" (only necessary if you
|
|
want to use the newer MSRPC printing functionality in Samba), delete
|
|
the registry keys associated with the print server contained in
|
|
<TT
|
|
CLASS="CONSTANT"
|
|
>[HKLM\SYSTEM\CurrentControlSet\Control\Print]</TT
|
|
>. The
|
|
spooler service on the client should be stopped prior to doing this:</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>C:\WINNT\ ></TT
|
|
> <TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>net stop spooler</B
|
|
></TT
|
|
></P
|
|
><P
|
|
><EM
|
|
>All the normal disclaimers about editing the registry go
|
|
here.</EM
|
|
> Be careful, and know what you are doing.</P
|
|
><P
|
|
>The spooler service should be restarted after you have finished
|
|
removing the appropriate registry entries by replacing the
|
|
<B
|
|
CLASS="COMMAND"
|
|
>stop</B
|
|
> command above with <B
|
|
CLASS="COMMAND"
|
|
>start</B
|
|
>.</P
|
|
><P
|
|
>Windows 9x clients will continue to use LanMan printing calls
|
|
with a 2.2 Samba server so there is no need to perform any of these
|
|
modifications on non-NT clients.</P
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
BORDER="1"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
ALIGN="CENTER"
|
|
><B
|
|
>Achtung!</B
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
ALIGN="LEFT"
|
|
><P
|
|
>The following smb.conf parameters are considered to be depreciated and will
|
|
be removed soon. Do not use them in new installations</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>printer driver file (G)</I
|
|
></TT
|
|
>
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>printer driver (S)</I
|
|
></TT
|
|
>
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>printer driver location (S)</I
|
|
></TT
|
|
>
|
|
</P
|
|
></LI
|
|
></UL
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><P
|
|
>Here are the possible scenarios for supporting migration:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>If you do not desire the new Windows NT
|
|
print driver support, nothing needs to be done.
|
|
All existing parameters work the same.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>If you want to take advantage of NT printer
|
|
driver support but do not want to migrate the
|
|
9x drivers to the new setup, the leave the existing
|
|
printers.def file. When smbd attempts to locate a
|
|
9x driver for the printer in the TDB and fails it
|
|
will drop down to using the printers.def (and all
|
|
associated parameters). The <B
|
|
CLASS="COMMAND"
|
|
>make_printerdef</B
|
|
>
|
|
tool will also remain for backwards compatibility but will
|
|
be moved to the "this tool is the old way of doing it"
|
|
pile.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>If you install a Windows 9x driver for a printer
|
|
on your Samba host (in the printing TDB), this information will
|
|
take precedence and the three old printing parameters
|
|
will be ignored (including print driver location).</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>If you want to migrate an existing <TT
|
|
CLASS="FILENAME"
|
|
>printers.def</TT
|
|
>
|
|
file into the new setup, the current only solution is to use the Windows
|
|
NT APW to install the NT drivers and the 9x drivers. This can be scripted
|
|
using <B
|
|
CLASS="COMMAND"
|
|
>smbclient</B
|
|
> and <B
|
|
CLASS="COMMAND"
|
|
>rpcclient</B
|
|
>. See the
|
|
Imprints installation client at <A
|
|
HREF="http://imprints.sourceforge.net/"
|
|
TARGET="_top"
|
|
>http://imprints.sourceforge.net/</A
|
|
>
|
|
for an example.
|
|
</P
|
|
></LI
|
|
></UL
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN661"
|
|
>Chapter 5. security = domain in Samba 2.x</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN679"
|
|
>5.1. Joining an NT Domain with Samba 2.2</A
|
|
></H1
|
|
><P
|
|
>In order for a Samba-2 server to join an NT domain,
|
|
you must first add the NetBIOS name of the Samba server to the
|
|
NT domain on the PDC using Server Manager for Domains. This creates
|
|
the machine account in the domain (PDC) SAM. Note that you should
|
|
add the Samba server as a "Windows NT Workstation or Server",
|
|
<EM
|
|
>NOT</EM
|
|
> as a Primary or backup domain controller.</P
|
|
><P
|
|
>Assume you have a Samba-2 server with a NetBIOS name of
|
|
<TT
|
|
CLASS="CONSTANT"
|
|
>SERV1</TT
|
|
> and are joining an NT domain called
|
|
<TT
|
|
CLASS="CONSTANT"
|
|
>DOM</TT
|
|
>, which has a PDC with a NetBIOS name
|
|
of <TT
|
|
CLASS="CONSTANT"
|
|
>DOMPDC</TT
|
|
> and two backup domain controllers
|
|
with NetBIOS names <TT
|
|
CLASS="CONSTANT"
|
|
>DOMBDC1</TT
|
|
> and <TT
|
|
CLASS="CONSTANT"
|
|
>DOMBDC2
|
|
</TT
|
|
>.</P
|
|
><P
|
|
>In order to join the domain, first stop all Samba daemons
|
|
and run the command:</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
><TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>smbpasswd -j DOM -r DOMPDC
|
|
</B
|
|
></TT
|
|
></P
|
|
><P
|
|
>as we are joining the domain DOM and the PDC for that domain
|
|
(the only machine that has write access to the domain SAM database)
|
|
is DOMPDC. If this is successful you will see the message:</P
|
|
><P
|
|
><TT
|
|
CLASS="COMPUTEROUTPUT"
|
|
>smbpasswd: Joined domain DOM.</TT
|
|
>
|
|
</P
|
|
><P
|
|
>in your terminal window. See the <A
|
|
HREF="smbpasswd.8.html"
|
|
TARGET="_top"
|
|
> smbpasswd(8)</A
|
|
> man page for more details.</P
|
|
><P
|
|
>There is existing development code to join a domain
|
|
without having to create the machine trust account on the PDC
|
|
beforehand. This code will hopefully be available soon
|
|
in release branches as well.</P
|
|
><P
|
|
>This command goes through the machine account password
|
|
change protocol, then writes the new (random) machine account
|
|
password for this Samba server into a file in the same directory
|
|
in which an smbpasswd file would be stored - normally :</P
|
|
><P
|
|
><TT
|
|
CLASS="FILENAME"
|
|
>/usr/local/samba/private</TT
|
|
></P
|
|
><P
|
|
>In Samba 2.0.x, the filename looks like this:</P
|
|
><P
|
|
><TT
|
|
CLASS="FILENAME"
|
|
><TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
><NT DOMAIN NAME></I
|
|
></TT
|
|
>.<TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
><Samba
|
|
Server Name></I
|
|
></TT
|
|
>.mac</TT
|
|
></P
|
|
><P
|
|
>The <TT
|
|
CLASS="FILENAME"
|
|
>.mac</TT
|
|
> suffix stands for machine account
|
|
password file. So in our example above, the file would be called:</P
|
|
><P
|
|
><TT
|
|
CLASS="FILENAME"
|
|
>DOM.SERV1.mac</TT
|
|
></P
|
|
><P
|
|
>In Samba 2.2, this file has been replaced with a TDB
|
|
(Trivial Database) file named <TT
|
|
CLASS="FILENAME"
|
|
>secrets.tdb</TT
|
|
>.
|
|
</P
|
|
><P
|
|
>This file is created and owned by root and is not
|
|
readable by any other user. It is the key to the domain-level
|
|
security for your system, and should be treated as carefully
|
|
as a shadow password file.</P
|
|
><P
|
|
>Now, before restarting the Samba daemons you must
|
|
edit your <A
|
|
HREF="smb.conf.5.html"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="FILENAME"
|
|
>smb.conf(5)</TT
|
|
>
|
|
</A
|
|
> file to tell Samba it should now use domain security.</P
|
|
><P
|
|
>Change (or add) your <A
|
|
HREF="smb.conf.5.html#SECURITY"
|
|
TARGET="_top"
|
|
> <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>security =</I
|
|
></TT
|
|
></A
|
|
> line in the [global] section
|
|
of your smb.conf to read:</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>security = domain</B
|
|
></P
|
|
><P
|
|
>Next change the <A
|
|
HREF="smb.conf.5.html#WORKGROUP"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
> workgroup =</I
|
|
></TT
|
|
></A
|
|
> line in the [global] section to read: </P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>workgroup = DOM</B
|
|
></P
|
|
><P
|
|
>as this is the name of the domain we are joining. </P
|
|
><P
|
|
>You must also have the parameter <A
|
|
HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
|
|
TARGET="_top"
|
|
> <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>encrypt passwords</I
|
|
></TT
|
|
></A
|
|
> set to <TT
|
|
CLASS="CONSTANT"
|
|
>yes
|
|
</TT
|
|
> in order for your users to authenticate to the NT PDC.</P
|
|
><P
|
|
>Finally, add (or modify) a <A
|
|
HREF="smb.conf.5.html#PASSWORDSERVER"
|
|
TARGET="_top"
|
|
> <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>password server =</I
|
|
></TT
|
|
></A
|
|
> line in the [global]
|
|
section to read: </P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>password server = DOMPDC DOMBDC1 DOMBDC2</B
|
|
></P
|
|
><P
|
|
>These are the primary and backup domain controllers Samba
|
|
will attempt to contact in order to authenticate users. Samba will
|
|
try to contact each of these servers in order, so you may want to
|
|
rearrange this list in order to spread out the authentication load
|
|
among domain controllers.</P
|
|
><P
|
|
>Alternatively, if you want smbd to automatically determine
|
|
the list of Domain controllers to use for authentication, you may
|
|
set this line to be :</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>password server = *</B
|
|
></P
|
|
><P
|
|
>This method, which was introduced in Samba 2.0.6,
|
|
allows Samba to use exactly the same mechanism that NT does. This
|
|
method either broadcasts or uses a WINS database in order to
|
|
find domain controllers to authenticate against.</P
|
|
><P
|
|
>Finally, restart your Samba daemons and get ready for
|
|
clients to begin using domain security!</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN743"
|
|
>5.2. Samba and Windows 2000 Domains</A
|
|
></H1
|
|
><P
|
|
>Many people have asked regarding the state of Samba's ability to participate in
|
|
a Windows 2000 Domain. Samba 2.2 is able to act as a member server of a Windows
|
|
2000 domain operating in mixed or native mode.</P
|
|
><P
|
|
>There is much confusion between the circumstances that require a "mixed" mode
|
|
Win2k DC and a when this host can be switched to "native" mode. A "mixed" mode
|
|
Win2k domain controller is only needed if Windows NT BDCs must exist in the same
|
|
domain. By default, a Win2k DC in "native" mode will still support
|
|
NetBIOS and NTLMv1 for authentication of legacy clients such as Windows 9x and
|
|
NT 4.0. Samba has the same requirements as a Windows NT 4.0 member server.</P
|
|
><P
|
|
>The steps for adding a Samba 2.2 host to a Win2k domain are the same as those
|
|
for adding a Samba server to a Windows NT 4.0 domain. The only exception is that
|
|
the "Server Manager" from NT 4 has been replaced by the "Active Directory Users and
|
|
Computers" MMC (Microsoft Management Console) plugin.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN748"
|
|
>5.3. Why is this better than security = server?</A
|
|
></H1
|
|
><P
|
|
>Currently, domain security in Samba doesn't free you from
|
|
having to create local Unix users to represent the users attaching
|
|
to your server. This means that if domain user <TT
|
|
CLASS="CONSTANT"
|
|
>DOM\fred
|
|
</TT
|
|
> attaches to your domain security Samba server, there needs
|
|
to be a local Unix user fred to represent that user in the Unix
|
|
filesystem. This is very similar to the older Samba security mode
|
|
<A
|
|
HREF="smb.conf.5.html#SECURITYEQUALSSERVER"
|
|
TARGET="_top"
|
|
>security = server</A
|
|
>,
|
|
where Samba would pass through the authentication request to a Windows
|
|
NT server in the same way as a Windows 95 or Windows 98 server would.
|
|
</P
|
|
><P
|
|
>Please refer to the <A
|
|
HREF="winbind.html"
|
|
TARGET="_top"
|
|
>Winbind
|
|
paper</A
|
|
> for information on a system to automatically
|
|
assign UNIX uids and gids to Windows NT Domain users and groups.
|
|
This code is available in development branches only at the moment,
|
|
but will be moved to release branches soon.</P
|
|
><P
|
|
>The advantage to domain-level security is that the
|
|
authentication in domain-level security is passed down the authenticated
|
|
RPC channel in exactly the same way that an NT server would do it. This
|
|
means Samba servers now participate in domain trust relationships in
|
|
exactly the same way NT servers do (i.e., you can add Samba servers into
|
|
a resource domain and have the authentication passed on from a resource
|
|
domain PDC to an account domain PDC.</P
|
|
><P
|
|
>In addition, with <B
|
|
CLASS="COMMAND"
|
|
>security = server</B
|
|
> every Samba
|
|
daemon on a server has to keep a connection open to the
|
|
authenticating server for as long as that daemon lasts. This can drain
|
|
the connection resources on a Microsoft NT server and cause it to run
|
|
out of available connections. With <B
|
|
CLASS="COMMAND"
|
|
>security = domain</B
|
|
>,
|
|
however, the Samba daemons connect to the PDC/BDC only for as long
|
|
as is necessary to authenticate the user, and then drop the connection,
|
|
thus conserving PDC connection resources.</P
|
|
><P
|
|
>And finally, acting in the same manner as an NT server
|
|
authenticating to a PDC means that as part of the authentication
|
|
reply, the Samba server gets the user identification information such
|
|
as the user SID, the list of NT groups the user belongs to, etc. All
|
|
this information will allow Samba to be extended in the future into
|
|
a mode the developers currently call appliance mode. In this mode,
|
|
no local Unix users will be necessary, and Samba will generate Unix
|
|
uids and gids from the information passed back from the PDC when a
|
|
user is authenticated, making a Samba server truly plug and play
|
|
in an NT domain environment. Watch for this code soon.</P
|
|
><P
|
|
><EM
|
|
>NOTE:</EM
|
|
> Much of the text of this document
|
|
was first published in the Web magazine <A
|
|
HREF="http://www.linuxworld.com"
|
|
TARGET="_top"
|
|
>
|
|
LinuxWorld</A
|
|
> as the article <A
|
|
HREF="http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html"
|
|
TARGET="_top"
|
|
>Doing
|
|
the NIS/NT Samba</A
|
|
>.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN764"
|
|
>Chapter 6. How to Configure Samba 2.2 as a Primary Domain Controller</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN781"
|
|
>6.1. Prerequisite Reading</A
|
|
></H1
|
|
><P
|
|
>Before you continue readingin this chapter, please make sure
|
|
that you are comfortable with configuring basic files services
|
|
in smb.conf and how to enable and administrate password
|
|
encryption in Samba. Theses two topics are covered in the
|
|
<A
|
|
HREF="smb.conf.5.html"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="FILENAME"
|
|
>smb.conf(5)</TT
|
|
></A
|
|
>
|
|
manpage and the <A
|
|
HREF="EMCRYPTION.html"
|
|
TARGET="_top"
|
|
>Encryption chapter</A
|
|
>
|
|
of this HOWTO Collection.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN787"
|
|
>6.2. Background</A
|
|
></H1
|
|
><DIV
|
|
CLASS="NOTE"
|
|
><BLOCKQUOTE
|
|
CLASS="NOTE"
|
|
><P
|
|
><B
|
|
>Note: </B
|
|
><EM
|
|
>Author's Note :</EM
|
|
> This document is a combination
|
|
of David Bannon's Samba 2.2 PDC HOWTO and the Samba NT Domain FAQ.
|
|
Both documents are superceeded by this one.</P
|
|
></BLOCKQUOTE
|
|
></DIV
|
|
><P
|
|
>Version of Samba prior to release 2.2 had marginal capabilities to
|
|
act as a Windows NT 4.0 Primary Domain Controller (PDC). Beginning with
|
|
Samba 2.2.0, we are proud to announce official support for Windows NT 4.0
|
|
style domain logons from Windows NT 4.0 (through SP6) and Windows 2000 (through
|
|
SP1) clients. This article outlines the steps necessary for configuring Samba
|
|
as a PDC. It is necessary to have a working Samba server prior to implementing the
|
|
PDC functionality. If you have not followed the steps outlined in
|
|
<A
|
|
HREF="UNIX_INSTALL.html"
|
|
TARGET="_top"
|
|
> UNIX_INSTALL.html</A
|
|
>, please make sure
|
|
that your server is configured correctly before proceeding. Another good
|
|
resource in the <A
|
|
HREF="smb.conf.5.html"
|
|
TARGET="_top"
|
|
>smb.conf(5) man
|
|
page</A
|
|
>. The following functionality should work in 2.2:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
> domain logons for Windows NT 4.0/2000 clients.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> placing a Windows 9x client in user level security
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> retrieving a list of users and groups from a Samba PDC to
|
|
Windows 9x/NT/2000 clients
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> roving (roaming) user profiles
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Windows NT 4.0 style system policies
|
|
</P
|
|
></LI
|
|
></UL
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
BORDER="1"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
ALIGN="CENTER"
|
|
><B
|
|
>Windows 2000 Service Pack 2 Clients</B
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
ALIGN="LEFT"
|
|
><P
|
|
> Samba 2.2.1 is required for PDC functionality when using Windows 2000
|
|
SP2 clients.
|
|
</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><P
|
|
>The following pieces of functionality are not included in the 2.2 release:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
> Windows NT 4 domain trusts
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> SAM replication with Windows NT 4.0 Domain Controllers
|
|
(i.e. a Samba PDC and a Windows NT BDC or vice versa)
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Adding users via the User Manager for Domains
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Acting as a Windows 2000 Domain Controller (i.e. Kerberos and
|
|
Active Directory)
|
|
</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>Please note that Windows 9x clients are not true members of a domain
|
|
for reasons outlined in this article. Therefore the protocol for
|
|
support Windows 9x style domain logons is completely different
|
|
from NT4 domain logons and has been officially supported for some
|
|
time.</P
|
|
><P
|
|
>Implementing a Samba PDC can basically be divided into 2 broad
|
|
steps.</P
|
|
><P
|
|
></P
|
|
><OL
|
|
TYPE="1"
|
|
><LI
|
|
><P
|
|
> Configuring the Samba PDC
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Creating machine trust accounts and joining clients
|
|
to the domain
|
|
</P
|
|
></LI
|
|
></OL
|
|
><P
|
|
>There are other minor details such as user profiles, system
|
|
policies, etc... However, these are not necessarily specific
|
|
to a Samba PDC as much as they are related to Windows NT networking
|
|
concepts. They will be mentioned only briefly here.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN827"
|
|
>6.3. Configuring the Samba Domain Controller</A
|
|
></H1
|
|
><P
|
|
>The first step in creating a working Samba PDC is to
|
|
understand the parameters necessary in smb.conf. I will not
|
|
attempt to re-explain the parameters here as they are more that
|
|
adequately covered in <A
|
|
HREF="smb.conf.5.html"
|
|
TARGET="_top"
|
|
> the smb.conf
|
|
man page</A
|
|
>. For convenience, the parameters have been
|
|
linked with the actual smb.conf description.</P
|
|
><P
|
|
>Here is an example smb.conf for acting as a PDC:</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>[global]
|
|
; Basic server settings
|
|
<A
|
|
HREF="smb.conf.5.html#NETBIOSNAME"
|
|
TARGET="_top"
|
|
>netbios name</A
|
|
> = <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>POGO</I
|
|
></TT
|
|
>
|
|
<A
|
|
HREF="smb.conf.5.html#WORKGROUP"
|
|
TARGET="_top"
|
|
>workgroup</A
|
|
> = <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>NARNIA</I
|
|
></TT
|
|
>
|
|
|
|
; we should act as the domain and local master browser
|
|
<A
|
|
HREF="smb.conf.5.html#OSLEVEL"
|
|
TARGET="_top"
|
|
>os level</A
|
|
> = 64
|
|
<A
|
|
HREF="smb.conf.5.html#PERFERREDMASTER"
|
|
TARGET="_top"
|
|
>preferred master</A
|
|
> = yes
|
|
<A
|
|
HREF="smb.conf.5.html#DOMAINMASTER"
|
|
TARGET="_top"
|
|
>domain master</A
|
|
> = yes
|
|
<A
|
|
HREF="smb.conf.5.html#LOCALMASTER"
|
|
TARGET="_top"
|
|
>local master</A
|
|
> = yes
|
|
|
|
; security settings (must user security = user)
|
|
<A
|
|
HREF="smb.conf.5.html#SECURITYEQUALSUSER"
|
|
TARGET="_top"
|
|
>security</A
|
|
> = user
|
|
|
|
; encrypted passwords are a requirement for a PDC
|
|
<A
|
|
HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
|
|
TARGET="_top"
|
|
>encrypt passwords</A
|
|
> = yes
|
|
|
|
; support domain logons
|
|
<A
|
|
HREF="smb.conf.5.html#DOMAINLOGONS"
|
|
TARGET="_top"
|
|
>domain logons</A
|
|
> = yes
|
|
|
|
; where to store user profiles?
|
|
<A
|
|
HREF="smb.conf.5.html#LOGONPATH"
|
|
TARGET="_top"
|
|
>logon path</A
|
|
> = \\%N\profiles\%u
|
|
|
|
; where is a user's home directory and where should it
|
|
; be mounted at?
|
|
<A
|
|
HREF="smb.conf.5.html#LOGONDRIVE"
|
|
TARGET="_top"
|
|
>logon drive</A
|
|
> = H:
|
|
<A
|
|
HREF="smb.conf.5.html#LOGONHOME"
|
|
TARGET="_top"
|
|
>logon home</A
|
|
> = \\homeserver\%u
|
|
|
|
; specify a generic logon script for all users
|
|
; this is a relative **DOS** path to the [netlogon] share
|
|
<A
|
|
HREF="smb.conf.5.html#LOGONSCRIPT"
|
|
TARGET="_top"
|
|
>logon script</A
|
|
> = logon.cmd
|
|
|
|
; necessary share for domain controller
|
|
[netlogon]
|
|
<A
|
|
HREF="smb.conf.5.html#PATH"
|
|
TARGET="_top"
|
|
>path</A
|
|
> = /usr/local/samba/lib/netlogon
|
|
<A
|
|
HREF="smb.conf.5.html#WRITEABLE"
|
|
TARGET="_top"
|
|
>writeable</A
|
|
> = no
|
|
<A
|
|
HREF="smb.conf.5.html#WRITELIST"
|
|
TARGET="_top"
|
|
>write list</A
|
|
> = <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>ntadmin</I
|
|
></TT
|
|
>
|
|
|
|
; share for storing user profiles
|
|
[profiles]
|
|
<A
|
|
HREF="smb.conf.5.html#PATH"
|
|
TARGET="_top"
|
|
>path</A
|
|
> = /export/smb/ntprofile
|
|
<A
|
|
HREF="smb.conf.5.html#WRITEABLE"
|
|
TARGET="_top"
|
|
>writeable</A
|
|
> = yes
|
|
<A
|
|
HREF="smb.conf.5.html#CREATEMASK"
|
|
TARGET="_top"
|
|
>create mask</A
|
|
> = 0600
|
|
<A
|
|
HREF="smb.conf.5.html#DIRECTORYMASK"
|
|
TARGET="_top"
|
|
>directory mask</A
|
|
> = 0700</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>There are a couple of points to emphasize in the above configuration.</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
> Encrypted passwords must be enabled. For more details on how
|
|
to do this, refer to <A
|
|
HREF="ENCRYPTION.html"
|
|
TARGET="_top"
|
|
>ENCRYPTION.html</A
|
|
>.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> The server must support domain logons and a
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>[netlogon]</TT
|
|
> share
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> The server must be the domain master browser in order for Windows
|
|
client to locate the server as a DC. Please refer to the various
|
|
Network Browsing documentation included with this distribution for
|
|
details.
|
|
</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>As Samba 2.2 does not offer a complete implementation of group mapping between
|
|
Windows NT groups and UNIX groups (this is really quite complicated to explain
|
|
in a short space), you should refer to the <A
|
|
HREF="smb.conf.5.html#DOMAINADMINUSERS"
|
|
TARGET="_top"
|
|
>domain
|
|
admin users</A
|
|
> and <A
|
|
HREF="smb.conf.5.html#DOMAINADMINGROUP"
|
|
TARGET="_top"
|
|
>domain
|
|
admin group</A
|
|
> smb.conf parameters for information of creating a Domain Admins
|
|
style accounts.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN870"
|
|
>6.4. Creating Machine Trust Accounts and Joining Clients
|
|
to the Domain</A
|
|
></H1
|
|
><P
|
|
>A machine trust account is a samba user account owned by a computer.
|
|
The account password acts as the shared secret for secure
|
|
communication with the Domain Controller. This is a security feature
|
|
to prevent an unauthorized machine with the same netbios name from
|
|
joining the domain and gaining access to domain user/group accounts.
|
|
Hence a Windows 9x host is never a true member of a domain because it does
|
|
not posses a machine trust account, and thus has no shared secret with the DC.</P
|
|
><P
|
|
>On a Windows NT PDC, these machine trust account passwords are stored
|
|
in the registry. A Samba PDC stores these accounts in the same location
|
|
as user LanMan and NT password hashes (currently <TT
|
|
CLASS="FILENAME"
|
|
>smbpasswd</TT
|
|
>).
|
|
However, machine trust accounts only possess and use the NT password hash.</P
|
|
><P
|
|
>Because Samba requires machine accounts to possess a UNIX uid from
|
|
which an Windows NT SID can be generated, all of these accounts
|
|
must have an entry in <TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd</TT
|
|
> and smbpasswd.
|
|
Future releases will alleviate the need to create
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd</TT
|
|
> entries. </P
|
|
><P
|
|
>There are two means of creating machine trust accounts.</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
> Manual creation before joining the client to the domain. In this case,
|
|
the password is set to a known value -- the lower case of the
|
|
machine's netbios name.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Creation of the account at the time of joining the domain. In
|
|
this case, the session key of the administrative account used to join
|
|
the client to the domain acts as an encryption key for setting the
|
|
password to a random value (This is the recommended method).
|
|
</P
|
|
></LI
|
|
></UL
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN884"
|
|
>6.4.1. Manually creating machine trust accounts</A
|
|
></H2
|
|
><P
|
|
>The first step in creating a machine trust account by hand is to
|
|
create an entry for the machine in /etc/passwd. This can be done
|
|
using <B
|
|
CLASS="COMMAND"
|
|
>vipw</B
|
|
> or any 'add userr' command which is normally
|
|
used to create new UNIX accounts. The following is an example for a Linux
|
|
based Samba server:</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
>/usr/sbin/useradd -g 100 -d /dev/null -c <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>machine_nickname</I
|
|
></TT
|
|
> -m -s /bin/false <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>machine_name</I
|
|
></TT
|
|
>$</P
|
|
><P
|
|
>The <TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd</TT
|
|
> entry will list the machine name
|
|
with a $ appended, won't have a passwd, will have a null shell and no
|
|
home directory. For example a machine called 'doppy' would have an
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd</TT
|
|
> entry like this :</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>doppy$:x:505:501:<TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>machine_nickname</I
|
|
></TT
|
|
>:/dev/null:/bin/false</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>Above, <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>machine_nickname</I
|
|
></TT
|
|
> can be any descriptive name for the
|
|
pc i.e. BasementComputer. The <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>machine_name</I
|
|
></TT
|
|
> absolutely must be
|
|
the netbios name of the pc to be added to the domain. The "$" must append the netbios
|
|
name of the pc or samba will not recognize this as a machine account</P
|
|
><P
|
|
>Now that the UNIX account has been created, the next step is to create
|
|
the smbpasswd entry for the machine containing the well known initial
|
|
trust account password. This can be done using the <A
|
|
HREF="smbpasswd.6.html"
|
|
TARGET="_top"
|
|
><B
|
|
CLASS="COMMAND"
|
|
>smbpasswd(8)</B
|
|
></A
|
|
> command
|
|
as shown here:</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>root# </TT
|
|
> smbpasswd -a -m <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>machine_name</I
|
|
></TT
|
|
></P
|
|
><P
|
|
>where <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>machine_name</I
|
|
></TT
|
|
> is the machine's netbios
|
|
name. </P
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
BORDER="1"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
ALIGN="CENTER"
|
|
><B
|
|
>Join the client to the domain immediately</B
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
ALIGN="LEFT"
|
|
><P
|
|
> Manually creating a machine trust account using this method is the
|
|
equivalent of creating a machine account on a Windows NT PDC using
|
|
the "Server Manager". From the time at which the account is created
|
|
to the time which th client joins the domain and changes the password,
|
|
your domain is vulnerable to an intruder joining your domain using a
|
|
a machine with the same netbios name. A PDC inherently trusts
|
|
members of the domain and will serve out a large degree of user
|
|
information to such clients. You have been warned!
|
|
</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN912"
|
|
>6.4.2. Creating machine trust accounts "on the fly"</A
|
|
></H2
|
|
><P
|
|
>The second, and most recommended way of creating machine trust accounts
|
|
is to create them as needed at the time the client is joined to
|
|
the domain. You will need to include a value for the <A
|
|
HREF="smb.conf.5.html#ADDUSERSCRIPT"
|
|
TARGET="_top"
|
|
>add user script</A
|
|
>
|
|
parameter. Below is an example from a RedHat 6.2 Linux system.</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u </PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>In Samba 2.2.1, <EM
|
|
>only the root account</EM
|
|
> can be used to create
|
|
machine accounts like this. Therefore, it is required to create
|
|
an entry in smbpasswd for <EM
|
|
>root</EM
|
|
>. The password
|
|
<EM
|
|
>SHOULD</EM
|
|
> be set to s different password that the
|
|
associated <TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd</TT
|
|
> entry for security reasons.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN923"
|
|
>6.5. Common Problems and Errors</A
|
|
></H1
|
|
><P
|
|
></P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>I cannot include a '$' in a machine name.</EM
|
|
>
|
|
</P
|
|
><P
|
|
> A 'machine name' in (typically) <TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd</TT
|
|
>
|
|
of the machine name with a '$' appended. FreeBSD (and other BSD
|
|
systems ?) won't create a user with a '$' in their name.
|
|
</P
|
|
><P
|
|
> The problem is only in the program used to make the entry, once
|
|
made, it works perfectly. So create a user without the '$' and
|
|
use <B
|
|
CLASS="COMMAND"
|
|
>vipw</B
|
|
> to edit the entry, adding the '$'. Or create
|
|
the whole entry with vipw if you like, make sure you use a
|
|
unique uid !
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>I get told "You already have a connection to the Domain...."
|
|
or "Cannot join domain, the credentials supplied conflict with an
|
|
existing set.." when creating a machine account.</EM
|
|
>
|
|
</P
|
|
><P
|
|
> This happens if you try to create a machine account from the
|
|
machine itself and already have a connection (e.g. mapped drive)
|
|
to a share (or IPC$) on the Samba PDC. The following command
|
|
will remove all network drive connections:
|
|
</P
|
|
><P
|
|
> <TT
|
|
CLASS="PROMPT"
|
|
>C:\WINNT\></TT
|
|
> <B
|
|
CLASS="COMMAND"
|
|
>net use * /d</B
|
|
>
|
|
</P
|
|
><P
|
|
> Further, if the machine is a already a 'member of a workgroup' that
|
|
is the same name as the domain you are joining (bad idea) you will
|
|
get this message. Change the workgroup name to something else, it
|
|
does not matter what, reboot, and try again.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>The system can not log you on (C000019B)....</EM
|
|
>
|
|
</P
|
|
><P
|
|
>I joined the domain successfully but after upgrading
|
|
to a newer version of the Samba code I get the message, "The system
|
|
can not log you on (C000019B), Please try a gain or consult your
|
|
system administrator" when attempting to logon.
|
|
</P
|
|
><P
|
|
> This occurs when the domain SID stored in
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>private/WORKGROUP.SID</TT
|
|
> is
|
|
changed. For example, you remove the file and <B
|
|
CLASS="COMMAND"
|
|
>smbd</B
|
|
> automatically
|
|
creates a new one. Or you are swapping back and forth between
|
|
versions 2.0.7, TNG and the HEAD branch code (not recommended). The
|
|
only way to correct the problem is to restore the original domain
|
|
SID or remove the domain client from the domain and rejoin.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>The machine account for this computer either does not
|
|
exist or is not accessible.</EM
|
|
>
|
|
</P
|
|
><P
|
|
> When I try to join the domain I get the message "The machine account
|
|
for this computer either does not exist or is not accessible". Whats
|
|
wrong?
|
|
</P
|
|
><P
|
|
> This problem is caused by the PDC not having a suitable machine account.
|
|
If you are using the <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>add user script</I
|
|
></TT
|
|
> method to create
|
|
accounts then this would indicate that it has not worked. Ensure the domain
|
|
admin user system is working.
|
|
</P
|
|
><P
|
|
> Alternatively if you are creating account entries manually then they
|
|
have not been created correctly. Make sure that you have the entry
|
|
correct for the machine account in smbpasswd file on the Samba PDC.
|
|
If you added the account using an editor rather than using the smbpasswd
|
|
utility, make sure that the account name is the machine netbios name
|
|
with a '$' appended to it ( ie. computer_name$ ). There must be an entry
|
|
in both /etc/passwd and the smbpasswd file. Some people have reported
|
|
that inconsistent subnet masks between the Samba server and the NT
|
|
client have caused this problem. Make sure that these are consistent
|
|
for both client and server.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>When I attempt to login to a Samba Domain from a NT4/W2K workstation,
|
|
I get a message about my account being disabled.</EM
|
|
>
|
|
</P
|
|
><P
|
|
> This problem is caused by a PAM related bug in Samba 2.2.0. This bug is
|
|
fixed in 2.2.1. Other symptoms could be unaccessible shares on
|
|
NT/W2K member servers in the domain or the following error in your smbd.log:
|
|
passdb/pampass.c:pam_account(268) PAM: UNKNOWN ERROR for User: %user%
|
|
</P
|
|
><P
|
|
> At first be ensure to enable the useraccounts with <B
|
|
CLASS="COMMAND"
|
|
>smbpasswd -e
|
|
%user%</B
|
|
>, this is normaly done, when you create an account.
|
|
</P
|
|
><P
|
|
> In order to work around this problem in 2.2.0, configure the
|
|
<TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>account</I
|
|
></TT
|
|
> control flag in
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>/etc/pam.d/samba</TT
|
|
> file as follows:
|
|
</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="90%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
> account required pam_permit.so
|
|
</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
> If you want to remain backward compatibility to samba 2.0.x use
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>pam_permit.so</TT
|
|
>, it's also possible to use
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>pam_pwdb.so</TT
|
|
>. There are some bugs if you try to
|
|
use <TT
|
|
CLASS="FILENAME"
|
|
>pam_unix.so</TT
|
|
>, if you need this, be ensure to use
|
|
the most recent version of this file.
|
|
</P
|
|
></LI
|
|
></UL
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN971"
|
|
>6.6. System Policies and Profiles</A
|
|
></H1
|
|
><P
|
|
>Much of the information necessary to implement System Policies and
|
|
Roving User Profiles in a Samba domain is the same as that for
|
|
implementing these same items in a Windows NT 4.0 domain.
|
|
You should read the white paper <A
|
|
HREF="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp"
|
|
TARGET="_top"
|
|
>Implementing
|
|
Profiles and Policies in Windows NT 4.0</A
|
|
> available from Microsoft.</P
|
|
><P
|
|
>Here are some additional details:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>What about Windows NT Policy Editor ?</EM
|
|
>
|
|
</P
|
|
><P
|
|
> To create or edit <TT
|
|
CLASS="FILENAME"
|
|
>ntconfig.pol</TT
|
|
> you must use
|
|
the NT Server Policy Editor, <B
|
|
CLASS="COMMAND"
|
|
>poledit.exe</B
|
|
> which
|
|
is included with NT Server but <EM
|
|
>not NT Workstation</EM
|
|
>.
|
|
There is a Policy Editor on a NTws
|
|
but it is not suitable for creating <EM
|
|
>Domain Policies</EM
|
|
>.
|
|
Further, although the Windows 95
|
|
Policy Editor can be installed on an NT Workstation/Server, it will not
|
|
work with NT policies because the registry key that are set by the policy templates.
|
|
However, the files from the NT Server will run happily enough on an NTws.
|
|
You need <TT
|
|
CLASS="FILENAME"
|
|
>poledit.exe, common.adm</TT
|
|
> and <TT
|
|
CLASS="FILENAME"
|
|
>winnt.adm</TT
|
|
>. It is convenient
|
|
to put the two *.adm files in <TT
|
|
CLASS="FILENAME"
|
|
>c:\winnt\inf</TT
|
|
> which is where
|
|
the binary will look for them unless told otherwise. Note also that that
|
|
directory is 'hidden'.
|
|
</P
|
|
><P
|
|
> The Windows NT policy editor is also included with the Service Pack 3 (and
|
|
later) for Windows NT 4.0. Extract the files using <B
|
|
CLASS="COMMAND"
|
|
>servicepackname /x</B
|
|
>,
|
|
ie thats <B
|
|
CLASS="COMMAND"
|
|
>Nt4sp6ai.exe /x</B
|
|
> for service pack 6a. The policy editor,
|
|
<B
|
|
CLASS="COMMAND"
|
|
>poledit.exe</B
|
|
> and the associated template files (*.adm) should
|
|
be extracted as well. It is also possible to downloaded the policy template
|
|
files for Office97 and get a copy of the policy editor. Another possible
|
|
location is with the Zero Administration Kit available for download from Microsoft.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>Can Win95 do Policies ?</EM
|
|
>
|
|
</P
|
|
><P
|
|
> Install the group policy handler for Win9x to pick up group
|
|
policies. Look on the Win98 CD in <TT
|
|
CLASS="FILENAME"
|
|
>\tools\reskit\netadmin\poledit</TT
|
|
>.
|
|
Install group policies on a Win9x client by double-clicking
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>grouppol.inf</TT
|
|
>. Log off and on again a couple of
|
|
times and see if Win98 picks up group policies. Unfortunately this needs
|
|
to be done on every Win9x machine that uses group policies....
|
|
</P
|
|
><P
|
|
> If group policies don't work one reports suggests getting the updated
|
|
(read: working) grouppol.dll for Windows 9x. The group list is grabbed
|
|
from /etc/group.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>How do I get 'User Manager' and 'Server Manager'</EM
|
|
>
|
|
</P
|
|
><P
|
|
> Since I don't need to buy an NT Server CD now, how do I get
|
|
the 'User Manager for Domains', the 'Server Manager' ?
|
|
</P
|
|
><P
|
|
> Microsoft distributes a version of these tools called nexus for
|
|
installation on Windows 95 systems. The tools set includes
|
|
</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>Server Manager</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>User Manager for Domains</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Event Viewer</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
> Click here to download the archived file <A
|
|
HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE"
|
|
TARGET="_top"
|
|
>ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A
|
|
>
|
|
</P
|
|
><P
|
|
> The Windows NT 4.0 version of the 'User Manager for
|
|
Domains' and 'Server Manager' are available from Microsoft via ftp
|
|
from <A
|
|
HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE"
|
|
TARGET="_top"
|
|
>ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A
|
|
>
|
|
</P
|
|
></LI
|
|
></UL
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1015"
|
|
>6.7. What other help can I get ?</A
|
|
></H1
|
|
><P
|
|
>There are many sources of information available in the form
|
|
of mailing lists, RFC's and documentation. The docs that come
|
|
with the samba distribution contain very good explanations of
|
|
general SMB topics such as browsing.</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>What are some diagnostics tools I can use to debug the domain logon
|
|
process and where can I find them?</EM
|
|
>
|
|
</P
|
|
><P
|
|
> One of the best diagnostic tools for debugging problems is Samba itself.
|
|
You can use the -d option for both smbd and nmbd to specifiy what
|
|
'debug level' at which to run. See the man pages on smbd, nmbd and
|
|
smb.conf for more information on debugging options. The debug
|
|
level can range from 1 (the default) to 10 (100 for debugging passwords).
|
|
</P
|
|
><P
|
|
> Another helpful method of debugging is to compile samba using the
|
|
<B
|
|
CLASS="COMMAND"
|
|
>gcc -g </B
|
|
> flag. This will include debug
|
|
information in the binaries and allow you to attach gdb to the
|
|
running smbd / nmbd process. In order to attach gdb to an smbd
|
|
process for an NT workstation, first get the workstation to make the
|
|
connection. Pressing ctrl-alt-delete and going down to the domain box
|
|
is sufficient (at least, on the first time you join the domain) to
|
|
generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation
|
|
maintains an open connection, and therefore there will be an smbd
|
|
process running (assuming that you haven't set a really short smbd
|
|
idle timeout) So, in between pressing ctrl alt delete, and actually
|
|
typing in your password, you can gdb attach and continue.
|
|
</P
|
|
><P
|
|
> Some useful samba commands worth investigating:
|
|
</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>testparam | more</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>smbclient -L //{netbios name of server}</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
> An SMB enabled version of tcpdump is available from
|
|
<A
|
|
HREF="http://www.tcpdump.org/"
|
|
TARGET="_top"
|
|
>http://www.tcpdup.org/</A
|
|
>.
|
|
Ethereal, another good packet sniffer for UNIX and Win32
|
|
hosts, can be downloaded from <A
|
|
HREF="http://www.ethereal.com/"
|
|
TARGET="_top"
|
|
>http://www.ethereal.com</A
|
|
>.
|
|
</P
|
|
><P
|
|
> For tracing things on the Microsoft Windows NT, Network Monitor
|
|
(aka. netmon) is available on the Microsoft Developer Network CD's,
|
|
the Windows NT Server install CD and the SMS CD's. The version of
|
|
netmon that ships with SMS allows for dumping packets between any two
|
|
computers (ie. placing the network interface in promiscuous mode).
|
|
The version on the NT Server install CD will only allow monitoring
|
|
of network traffic directed to the local NT box and broadcasts on the
|
|
local subnet. Be aware that Ethereal can read and write netmon
|
|
formatted files.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>How do I install 'Network Monitor' on an NT Workstation
|
|
or a Windows 9x box?</EM
|
|
>
|
|
</P
|
|
><P
|
|
> Installing netmon on an NT workstation requires a couple
|
|
of steps. The following are for installing Netmon V4.00.349, which comes
|
|
with Microsoft Windows NT Server 4.0, on Microsoft Windows NT
|
|
Workstation 4.0. The process should be similar for other version of
|
|
Windows NT / Netmon. You will need both the Microsoft Windows
|
|
NT Server 4.0 Install CD and the Workstation 4.0 Install CD.
|
|
</P
|
|
><P
|
|
> Initially you will need to install 'Network Monitor Tools and Agent'
|
|
on the NT Server. To do this
|
|
</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>Goto Start - Settings - Control Panel -
|
|
Network - Services - Add </P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Select the 'Network Monitor Tools and Agent' and
|
|
click on 'OK'.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Click 'OK' on the Network Control Panel.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Insert the Windows NT Server 4.0 install CD
|
|
when prompted.</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
> At this point the Netmon files should exist in
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>%SYSTEMROOT%\System32\netmon\*.*</TT
|
|
>.
|
|
Two subdirectories exist as well, <TT
|
|
CLASS="FILENAME"
|
|
>parsers\</TT
|
|
>
|
|
which contains the necessary DLL's for parsing the netmon packet
|
|
dump, and <TT
|
|
CLASS="FILENAME"
|
|
>captures\</TT
|
|
>.
|
|
</P
|
|
><P
|
|
> In order to install the Netmon tools on an NT Workstation, you will
|
|
first need to install the 'Network Monitor Agent' from the Workstation
|
|
install CD.
|
|
</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>Goto Start - Settings - Control Panel -
|
|
Network - Services - Add</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Select the 'Network Monitor Agent' and click
|
|
on 'OK'.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Click 'OK' on the Network Control Panel.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Insert the Windows NT Workstation 4.0 install
|
|
CD when prompted.</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
> Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.*
|
|
to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set
|
|
permissions as you deem appropriate for your site. You will need
|
|
administrative rights on the NT box to run netmon.
|
|
</P
|
|
><P
|
|
> To install Netmon on a Windows 9x box install the network monitor agent
|
|
from the Windows 9x CD (\admin\nettools\netmon). There is a readme
|
|
file located with the netmon driver files on the CD if you need
|
|
information on how to do this. Copy the files from a working
|
|
Netmon installation.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> The following is a list if helpful URLs and other links:
|
|
</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>Home of Samba site <A
|
|
HREF="http://samba.org"
|
|
TARGET="_top"
|
|
> http://samba.org</A
|
|
>. We have a mirror near you !</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> The <EM
|
|
>Development</EM
|
|
> document
|
|
on the Samba mirrors might mention your problem. If so,
|
|
it might mean that the developers are working on it.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>See how Scott Merrill simulates a BDC behavior at
|
|
<A
|
|
HREF="http://www.skippy.net/linux/smb-howto.html"
|
|
TARGET="_top"
|
|
> http://www.skippy.net/linux/smb-howto.html</A
|
|
>. </P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Although 2.0.7 has almost had its day as a PDC, David Bannon will
|
|
keep the 2.0.7 PDC pages at <A
|
|
HREF="http://bioserve.latrobe.edu.au/samba"
|
|
TARGET="_top"
|
|
> http://bioserve.latrobe.edu.au/samba</A
|
|
> going for a while yet.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Misc links to CIFS information
|
|
<A
|
|
HREF="http://samba.org/cifs/"
|
|
TARGET="_top"
|
|
>http://samba.org/cifs/</A
|
|
></P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>NT Domains for Unix <A
|
|
HREF="http://mailhost.cb1.com/~lkcl/ntdom/"
|
|
TARGET="_top"
|
|
> http://mailhost.cb1.com/~lkcl/ntdom/</A
|
|
></P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>FTP site for older SMB specs:
|
|
<A
|
|
HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
|
|
TARGET="_top"
|
|
> ftp://ftp.microsoft.com/developr/drg/CIFS/</A
|
|
></P
|
|
></LI
|
|
></UL
|
|
></LI
|
|
></UL
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>How do I get help from the mailing lists ?</EM
|
|
>
|
|
</P
|
|
><P
|
|
> There are a number of Samba related mailing lists. Go to <A
|
|
HREF="http://samba.org"
|
|
TARGET="_top"
|
|
>http://samba.org</A
|
|
>, click on your nearest mirror
|
|
and then click on <B
|
|
CLASS="COMMAND"
|
|
>Support</B
|
|
> and then click on <B
|
|
CLASS="COMMAND"
|
|
> Samba related mailing lists</B
|
|
>.
|
|
</P
|
|
><P
|
|
> For questions relating to Samba TNG go to
|
|
<A
|
|
HREF="http://www.samba-tng.org/"
|
|
TARGET="_top"
|
|
>http://www.samba-tng.org/</A
|
|
>
|
|
It has been requested that you don't post questions about Samba-TNG to the
|
|
main stream Samba lists.</P
|
|
><P
|
|
> If you post a message to one of the lists please observe the following guide lines :
|
|
</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
> Always remember that the developers are volunteers, they are
|
|
not paid and they never guarantee to produce a particular feature at
|
|
a particular time. Any time lines are 'best guess' and nothing more.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Always mention what version of samba you are using and what
|
|
operating system its running under. You should probably list the
|
|
relevant sections of your smb.conf file, at least the options
|
|
in [global] that affect PDC support.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>In addition to the version, if you obtained Samba via
|
|
CVS mention the date when you last checked it out.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Try and make your question clear and brief, lots of long,
|
|
convoluted questions get deleted before they are completely read !
|
|
Don't post html encoded messages (if you can select colour or font
|
|
size its html).</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> If you run one of those nifty 'I'm on holidays' things when
|
|
you are away, make sure its configured to not answer mailing lists.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Don't cross post. Work out which is the best list to post to
|
|
and see what happens, ie don't post to both samba-ntdom and samba-technical.
|
|
Many people active on the lists subscribe to more
|
|
than one list and get annoyed to see the same message two or more times.
|
|
Often someone will see a message and thinking it would be better dealt
|
|
with on another, will forward it on for you.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>You might include <EM
|
|
>partial</EM
|
|
>
|
|
log files written at a debug level set to as much as 20.
|
|
Please don't send the entire log but enough to give the context of the
|
|
error messages.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>(Possibly) If you have a complete netmon trace ( from the opening of
|
|
the pipe to the error ) you can send the *.CAP file as well.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Please think carefully before attaching a document to an email.
|
|
Consider pasting the relevant parts into the body of the message. The samba
|
|
mailing lists go to a huge number of people, do they all need a copy of your
|
|
smb.conf in their attach directory ?</P
|
|
></LI
|
|
></UL
|
|
></LI
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>How do I get off the mailing lists ?</EM
|
|
>
|
|
</P
|
|
><P
|
|
>To have your name removed from a samba mailing list, go to the
|
|
same place you went to to get on it. Go to <A
|
|
HREF="http://lists.samba.org/"
|
|
TARGET="_top"
|
|
>http://lists.samba.org</A
|
|
>,
|
|
click on your nearest mirror and then click on <B
|
|
CLASS="COMMAND"
|
|
>Support</B
|
|
> and
|
|
then click on <B
|
|
CLASS="COMMAND"
|
|
> Samba related mailing lists</B
|
|
>. Or perhaps see
|
|
<A
|
|
HREF="http://lists.samba.org/mailman/roster/samba-ntdom"
|
|
TARGET="_top"
|
|
>here</A
|
|
>
|
|
</P
|
|
><P
|
|
> Please don't post messages to the list asking to be removed, you will just
|
|
be referred to the above address (unless that process failed in some way...)
|
|
</P
|
|
></LI
|
|
></UL
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1129"
|
|
>6.8. Domain Control for Windows 9x/ME</A
|
|
></H1
|
|
><DIV
|
|
CLASS="NOTE"
|
|
><BLOCKQUOTE
|
|
CLASS="NOTE"
|
|
><P
|
|
><B
|
|
>Note: </B
|
|
>The following section contains much of the original
|
|
DOMAIN.txt file previously included with Samba. Much of
|
|
the material is based on what went into the book Special
|
|
Edition, Using Samba. (Richard Sharpe)</P
|
|
></BLOCKQUOTE
|
|
></DIV
|
|
><P
|
|
>A domain and a workgroup are exactly the same thing in terms of network
|
|
browsing. The difference is that a distributable authentication
|
|
database is associated with a domain, for secure login access to a
|
|
network. Also, different access rights can be granted to users if they
|
|
successfully authenticate against a domain logon server (NT server and
|
|
other systems based on NT server support this, as does at least Samba TNG now).</P
|
|
><P
|
|
>The SMB client logging on to a domain has an expectation that every other
|
|
server in the domain should accept the same authentication information.
|
|
Network browsing functionality of domains and workgroups is
|
|
identical and is explained in BROWSING.txt. It should be noted, that browsing
|
|
is total orthogonal to logon support.</P
|
|
><P
|
|
>Issues related to the single-logon network model are discussed in this
|
|
document. Samba supports domain logons, network logon scripts, and user
|
|
profiles for MS Windows for workgroups and MS Windows 9X clients.</P
|
|
><P
|
|
>When an SMB client in a domain wishes to logon it broadcast requests for a
|
|
logon server. The first one to reply gets the job, and validates its
|
|
password using whatever mechanism the Samba administrator has installed.
|
|
It is possible (but very stupid) to create a domain where the user
|
|
database is not shared between servers, ie they are effectively workgroup
|
|
servers advertising themselves as participating in a domain. This
|
|
demonstrates how authentication is quite different from but closely
|
|
involved with domains.</P
|
|
><P
|
|
>Another thing commonly associated with single-logon domains is remote
|
|
administration over the SMB protocol. Again, there is no reason why this
|
|
cannot be implemented with an underlying username database which is
|
|
different from the Windows NT SAM. Support for the Remote Administration
|
|
Protocol is planned for a future release of Samba.</P
|
|
><P
|
|
>Network logon support as discussed in this section is aimed at Window for
|
|
Workgroups, and Windows 9X clients. </P
|
|
><P
|
|
>Support for profiles is confirmed as working for Win95, NT 4.0 and NT 3.51.
|
|
It is possible to specify: the profile location; script file to be loaded
|
|
on login; the user's home directory; and for NT a kick-off time could also
|
|
now easily be supported. However, there are some differences between Win9X
|
|
profile support and WinNT profile support. These are discussed below.</P
|
|
><P
|
|
>With NT Workstations, all this does not require the use or intervention of
|
|
an NT 4.0 or NT 3.51 server: Samba can now replace the logon services
|
|
provided by an NT server, to a limited and experimental degree (for example,
|
|
running "User Manager for Domains" will not provide you with access to
|
|
a domain created by a Samba Server).</P
|
|
><P
|
|
>With Win95, the help of an NT server can be enlisted, both for profile storage
|
|
and for user authentication. For details on user authentication, see
|
|
security_level.txt. For details on profile storage, see below.</P
|
|
><P
|
|
>Using these features you can make your clients verify their logon via
|
|
the Samba server; make clients run a batch file when they logon to
|
|
the network and download their preferences, desktop and start menu.</P
|
|
><P
|
|
>Before launching into the configuration instructions, it is worthwhile looking
|
|
at how a Win9X client performs a logon:</P
|
|
><P
|
|
></P
|
|
><OL
|
|
TYPE="1"
|
|
><LI
|
|
><P
|
|
> The client broadcasts (to the IP broadcast address of the subnet it is in)
|
|
a NetLogon request. This is sent to the NetBIOS address DOMAIN<00> at the
|
|
NetBIOS layer. The client chooses the first response it receives, which
|
|
contains the NetBIOS name of the logon server to use in the format of
|
|
\\SERVER.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> The client then connects to that server, logs on (does an SMBsessetupX) and
|
|
then connects to the IPC$ share (using an SMBtconX).
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> The client then does a NetWkstaUserLogon request, which retrieves the name
|
|
of the user's logon script.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> The client then connects to the NetLogon share and searches for this
|
|
and if it is found and can be read, is retrieved and executed by the client.
|
|
After this, the client disconnects from the NetLogon share.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> The client then sends a NetUserGetInfo request to the server, to retrieve
|
|
the user's home share, which is used to search for profiles. Since the
|
|
response to the NetUserGetInfo request does not contain much more
|
|
the user's home share, profiles for Win9X clients MUST reside in the user
|
|
home directory.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> The client then connects to the user's home share and searches for the
|
|
user's profile. As it turns out, you can specify the users home share as
|
|
a sharename and path. For example, \\server\fred\.profile.
|
|
If the profiles are found, they are implemented.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> The client then disconnects from the user's home share, and reconnects to
|
|
the NetLogon share and looks for CONFIG.POL, the policies file. If this is
|
|
found, it is read and implemented.
|
|
</P
|
|
></LI
|
|
></OL
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1159"
|
|
>6.8.1. Configuration Instructions: Network Logons</A
|
|
></H2
|
|
><P
|
|
>To use domain logons and profiles you need to do the following:</P
|
|
><P
|
|
></P
|
|
><OL
|
|
TYPE="1"
|
|
><LI
|
|
><P
|
|
> Create a share called [netlogon] in your smb.conf. This share should
|
|
be readable by all users, and probably should not be writeable. This
|
|
share will hold your network logon scripts, and the CONFIG.POL file
|
|
(Note: for details on the CONFIG.POL file, how to use it, what it is,
|
|
refer to the Microsoft Windows NT Administration documentation.
|
|
The format of these files is not known, so you will need to use
|
|
Microsoft tools).
|
|
</P
|
|
><P
|
|
> For example I have used:
|
|
</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="90%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>[netlogon]
|
|
path = /data/dos/netlogon
|
|
writeable = no
|
|
guest ok = no</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
> Note that it is important that this share is not writeable by ordinary
|
|
users, in a secure environment: ordinary users should not be allowed
|
|
to modify or add files that another user's computer would then download
|
|
when they log in.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> in the [global] section of smb.conf set the following:
|
|
</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="90%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>domain logons = yes
|
|
logon script = %U.bat
|
|
</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
> The choice of batch file is, of course, up to you. The above would
|
|
give each user a separate batch file as the %U will be changed to
|
|
their username automatically. The other standard % macros may also be
|
|
used. You can make the batch files come from a subdirectory by using
|
|
something like:
|
|
</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="90%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>logon script = scripts\%U.bat
|
|
</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> create the batch files to be run when the user logs in. If the batch
|
|
file doesn't exist then no batch file will be run.
|
|
</P
|
|
><P
|
|
> In the batch files you need to be careful to use DOS style cr/lf line
|
|
endings. If you don't then DOS may get confused. I suggest you use a
|
|
DOS editor to remotely edit the files if you don't know how to produce
|
|
DOS style files under unix.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Use smbclient with the -U option for some users to make sure that
|
|
the \\server\NETLOGON share is available, the batch files are
|
|
visible and they are readable by the users.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> you will probabaly find that your clients automatically mount the
|
|
\\SERVER\NETLOGON share as drive z: while logging in. You can put
|
|
some useful programs there to execute from the batch files.
|
|
</P
|
|
></LI
|
|
></OL
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
BORDER="1"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
ALIGN="CENTER"
|
|
><B
|
|
>security mode and master browsers</B
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
ALIGN="LEFT"
|
|
><P
|
|
>There are a few comments to make in order to tie up some
|
|
loose ends. There has been much debate over the issue of whether
|
|
or not it is ok to configure Samba as a Domain Controller in security
|
|
modes other than <TT
|
|
CLASS="CONSTANT"
|
|
>USER</TT
|
|
>. The only security mode
|
|
which will not work due to technical reasons is <TT
|
|
CLASS="CONSTANT"
|
|
>SHARE</TT
|
|
>
|
|
mode security. <TT
|
|
CLASS="CONSTANT"
|
|
>DOMAIN</TT
|
|
> and <TT
|
|
CLASS="CONSTANT"
|
|
>SERVER</TT
|
|
>
|
|
mode security is really just a variation on SMB user level security.</P
|
|
><P
|
|
>Actually, this issue is also closer tied to the debate on whether
|
|
or not Samba must be the domain master browser for its workgroup
|
|
when operating as a DC. While it may technically be possible
|
|
to configure a server as such (after all, browsing and domain logons
|
|
are two distinctly different functions), it is not a good idea to
|
|
so. You should remember that the DC must register the DOMAIN#1b netbios
|
|
name. This is the name used by Windows clients to locate the DC.
|
|
Windows clients do not distinguish between the DC and the DMB.
|
|
For this reason, it is very wise to configure the Samba DC as the DMB.</P
|
|
><P
|
|
>Now back to the issue of configuring a Samba DC to use a mode other
|
|
than "security = user". If a Samba host is configured to use
|
|
another SMB server or DC in order to validate user connection
|
|
requests, then it is a fact that some other machine on the network
|
|
(the "password server") knows more about user than the Samba host.
|
|
99% of the time, this other host is a domain controller. Now
|
|
in order to operate in domain mode security, the "workgroup" parameter
|
|
must be set to the name of the Windows NT domain (which already
|
|
has a domain controller, right?)</P
|
|
><P
|
|
>Therefore configuring a Samba box as a DC for a domain that
|
|
already by definition has a PDC is asking for trouble.
|
|
Therefore, you should always configure the Samba DC to be the DMB
|
|
for its domain.</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1193"
|
|
>6.8.2. Configuration Instructions: Setting up Roaming User Profiles</A
|
|
></H2
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
BORDER="1"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
ALIGN="CENTER"
|
|
><B
|
|
>Warning</B
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
ALIGN="LEFT"
|
|
><P
|
|
><EM
|
|
>NOTE!</EM
|
|
> Roaming profiles support is different
|
|
for Win9X and WinNT.</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><P
|
|
>Before discussing how to configure roaming profiles, it is useful to see how
|
|
Win9X and WinNT clients implement these features.</P
|
|
><P
|
|
>Win9X clients send a NetUserGetInfo request to the server to get the user's
|
|
profiles location. However, the response does not have room for a separate
|
|
profiles location field, only the users home share. This means that Win9X
|
|
profiles are restricted to being in the user's home directory.</P
|
|
><P
|
|
>WinNT clients send a NetSAMLogon RPC request, which contains many fields,
|
|
including a separate field for the location of the user's profiles.
|
|
This means that support for profiles is different for Win9X and WinNT.</P
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><HR><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN1201"
|
|
>6.8.2.1. Windows NT Configuration</A
|
|
></H3
|
|
><P
|
|
>To support WinNT clients, inn the [global] section of smb.conf set the
|
|
following (for example):</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>The default for this option is \\%N\%U\profile, namely
|
|
\\sambaserver\username\profile. The \\N%\%U service is created
|
|
automatically by the [homes] service.
|
|
If you are using a samba server for the profiles, you _must_ make the
|
|
share specified in the logon path browseable. </P
|
|
><DIV
|
|
CLASS="NOTE"
|
|
><BLOCKQUOTE
|
|
CLASS="NOTE"
|
|
><P
|
|
><B
|
|
>Note: </B
|
|
>[lkcl 26aug96 - we have discovered a problem where Windows clients can
|
|
maintain a connection to the [homes] share in between logins. The
|
|
[homes] share must NOT therefore be used in a profile path.]</P
|
|
></BLOCKQUOTE
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><HR><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN1209"
|
|
>6.8.2.2. Windows 9X Configuration</A
|
|
></H3
|
|
><P
|
|
>To support Win9X clients, you must use the "logon home" parameter. Samba has
|
|
now been fixed so that "net use/home" now works as well, and it, too, relies
|
|
on the "logon home" parameter.</P
|
|
><P
|
|
>By using the logon home parameter, you are restricted to putting Win9X
|
|
profiles in the user's home directory. But wait! There is a trick you
|
|
can use. If you set the following in the [global] section of your
|
|
smb.conf file:</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>logon home = \\%L\%U\.profiles</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>then your Win9X clients will dutifully put their clients in a subdirectory
|
|
of your home directory called .profiles (thus making them hidden).</P
|
|
><P
|
|
>Not only that, but 'net use/home' will also work, because of a feature in
|
|
Win9X. It removes any directory stuff off the end of the home directory area
|
|
and only uses the server and share portion. That is, it looks like you
|
|
specified \\%L\%U for "logon home".</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><HR><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN1217"
|
|
>6.8.2.3. Win9X and WinNT Configuration</A
|
|
></H3
|
|
><P
|
|
>You can support profiles for both Win9X and WinNT clients by setting both the
|
|
"logon home" and "logon path" parameters. For example:</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>logon home = \\%L\%U\.profiles
|
|
logon path = \\%L\profiles\%U</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><DIV
|
|
CLASS="NOTE"
|
|
><BLOCKQUOTE
|
|
CLASS="NOTE"
|
|
><P
|
|
><B
|
|
>Note: </B
|
|
>I have not checked what 'net use /home' does on NT when "logon home" is
|
|
set as above.</P
|
|
></BLOCKQUOTE
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><HR><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN1224"
|
|
>6.8.2.4. Windows 9X Profile Setup</A
|
|
></H3
|
|
><P
|
|
>When a user first logs in on Windows 9X, the file user.DAT is created,
|
|
as are folders "Start Menu", "Desktop", "Programs" and "Nethood".
|
|
These directories and their contents will be merged with the local
|
|
versions stored in c:\windows\profiles\username on subsequent logins,
|
|
taking the most recent from each. You will need to use the [global]
|
|
options "preserve case = yes", "short case preserve = yes" and
|
|
"case sensitive = no" in order to maintain capital letters in shortcuts
|
|
in any of the profile folders.</P
|
|
><P
|
|
>The user.DAT file contains all the user's preferences. If you wish to
|
|
enforce a set of preferences, rename their user.DAT file to user.MAN,
|
|
and deny them write access to this file.</P
|
|
><P
|
|
></P
|
|
><OL
|
|
TYPE="1"
|
|
><LI
|
|
><P
|
|
> On the Windows 95 machine, go to Control Panel | Passwords and
|
|
select the User Profiles tab. Select the required level of
|
|
roaming preferences. Press OK, but do _not_ allow the computer
|
|
to reboot.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> On the Windows 95 machine, go to Control Panel | Network |
|
|
Client for Microsoft Networks | Preferences. Select 'Log on to
|
|
NT Domain'. Then, ensure that the Primary Logon is 'Client for
|
|
Microsoft Networks'. Press OK, and this time allow the computer
|
|
to reboot.
|
|
</P
|
|
></LI
|
|
></OL
|
|
><P
|
|
>Under Windows 95, Profiles are downloaded from the Primary Logon.
|
|
If you have the Primary Logon as 'Client for Novell Networks', then
|
|
the profiles and logon script will be downloaded from your Novell
|
|
Server. If you have the Primary Logon as 'Windows Logon', then the
|
|
profiles will be loaded from the local machine - a bit against the
|
|
concept of roaming profiles, if you ask me.</P
|
|
><P
|
|
>You will now find that the Microsoft Networks Login box contains
|
|
[user, password, domain] instead of just [user, password]. Type in
|
|
the samba server's domain name (or any other domain known to exist,
|
|
but bear in mind that the user will be authenticated against this
|
|
domain and profiles downloaded from it, if that domain logon server
|
|
supports it), user name and user's password.</P
|
|
><P
|
|
>Once the user has been successfully validated, the Windows 95 machine
|
|
will inform you that 'The user has not logged on before' and asks you
|
|
if you wish to save the user's preferences? Select 'yes'.</P
|
|
><P
|
|
>Once the Windows 95 client comes up with the desktop, you should be able
|
|
to examine the contents of the directory specified in the "logon path"
|
|
on the samba server and verify that the "Desktop", "Start Menu",
|
|
"Programs" and "Nethood" folders have been created.</P
|
|
><P
|
|
>These folders will be cached locally on the client, and updated when
|
|
the user logs off (if you haven't made them read-only by then :-).
|
|
You will find that if the user creates further folders or short-cuts,
|
|
that the client will merge the profile contents downloaded with the
|
|
contents of the profile directory already on the local client, taking
|
|
the newest folders and short-cuts from each set.</P
|
|
><P
|
|
>If you have made the folders / files read-only on the samba server,
|
|
then you will get errors from the w95 machine on logon and logout, as
|
|
it attempts to merge the local and the remote profile. Basically, if
|
|
you have any errors reported by the w95 machine, check the unix file
|
|
permissions and ownership rights on the profile directory contents,
|
|
on the samba server.</P
|
|
><P
|
|
>If you have problems creating user profiles, you can reset the user's
|
|
local desktop cache, as shown below. When this user then next logs in,
|
|
they will be told that they are logging in "for the first time".</P
|
|
><P
|
|
></P
|
|
><OL
|
|
TYPE="1"
|
|
><LI
|
|
><P
|
|
> instead of logging in under the [user, password, domain] dialog,
|
|
press escape.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> run the regedit.exe program, and look in:
|
|
</P
|
|
><P
|
|
> HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList
|
|
</P
|
|
><P
|
|
> you will find an entry, for each user, of ProfilePath. Note the
|
|
contents of this key (likely to be c:\windows\profiles\username),
|
|
then delete the key ProfilePath for the required user.
|
|
</P
|
|
><P
|
|
> [Exit the registry editor].
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>WARNING</EM
|
|
> - before deleting the contents of the
|
|
directory listed in
|
|
the ProfilePath (this is likely to be c:\windows\profiles\username),
|
|
ask them if they have any important files stored on their desktop
|
|
or in their start menu. delete the contents of the directory
|
|
ProfilePath (making a backup if any of the files are needed).
|
|
</P
|
|
><P
|
|
> This will have the effect of removing the local (read-only hidden
|
|
system file) user.DAT in their profile directory, as well as the
|
|
local "desktop", "nethood", "start menu" and "programs" folders.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> search for the user's .PWL password-cacheing file in the c:\windows
|
|
directory, and delete it.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> log off the windows 95 client.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> check the contents of the profile path (see "logon path" described
|
|
above), and delete the user.DAT or user.MAN file for the user,
|
|
making a backup if required.
|
|
</P
|
|
></LI
|
|
></OL
|
|
><P
|
|
>If all else fails, increase samba's debug log levels to between 3 and 10,
|
|
and / or run a packet trace program such as tcpdump or netmon.exe, and
|
|
look for any error reports.</P
|
|
><P
|
|
>If you have access to an NT server, then first set up roaming profiles
|
|
and / or netlogons on the NT server. Make a packet trace, or examine
|
|
the example packet traces provided with NT server, and see what the
|
|
differences are with the equivalent samba trace.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><HR><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN1260"
|
|
>6.8.2.5. Windows NT Workstation 4.0</A
|
|
></H3
|
|
><P
|
|
>When a user first logs in to a Windows NT Workstation, the profile
|
|
NTuser.DAT is created. The profile location can be now specified
|
|
through the "logon path" parameter. </P
|
|
><DIV
|
|
CLASS="NOTE"
|
|
><BLOCKQUOTE
|
|
CLASS="NOTE"
|
|
><P
|
|
><B
|
|
>Note: </B
|
|
>[lkcl 10aug97 - i tried setting the path to
|
|
\\samba-server\homes\profile, and discovered that this fails because
|
|
a background process maintains the connection to the [homes] share
|
|
which does _not_ close down in between user logins. you have to
|
|
have \\samba-server\%L\profile, where user is the username created
|
|
from the [homes] share].</P
|
|
></BLOCKQUOTE
|
|
></DIV
|
|
><P
|
|
>There is a parameter that is now available for use with NT Profiles:
|
|
"logon drive". This should be set to "h:" or any other drive, and
|
|
should be used in conjunction with the new "logon home" parameter.</P
|
|
><P
|
|
>The entry for the NT 4.0 profile is a _directory_ not a file. The NT
|
|
help on profiles mentions that a directory is also created with a .PDS
|
|
extension. The user, while logging in, must have write permission to
|
|
create the full profile path (and the folder with the .PDS extension)
|
|
[lkcl 10aug97 - i found that the creation of the .PDS directory failed,
|
|
and had to create these manually for each user, with a shell script.
|
|
also, i presume, but have not tested, that the full profile path must
|
|
be browseable just as it is for w95, due to the manner in which they
|
|
attempt to create the full profile path: test existence of each path
|
|
component; create path component].</P
|
|
><P
|
|
>In the profile directory, NT creates more folders than 95. It creates
|
|
"Application Data" and others, as well as "Desktop", "Nethood",
|
|
"Start Menu" and "Programs". The profile itself is stored in a file
|
|
NTuser.DAT. Nothing appears to be stored in the .PDS directory, and
|
|
its purpose is currently unknown.</P
|
|
><P
|
|
>You can use the System Control Panel to copy a local profile onto
|
|
a samba server (see NT Help on profiles: it is also capable of firing
|
|
up the correct location in the System Control Panel for you). The
|
|
NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN
|
|
turns a profile into a mandatory one.</P
|
|
><DIV
|
|
CLASS="NOTE"
|
|
><BLOCKQUOTE
|
|
CLASS="NOTE"
|
|
><P
|
|
><B
|
|
>Note: </B
|
|
>[lkcl 10aug97 - i notice that NT Workstation tells me that it is
|
|
downloading a profile from a slow link. whether this is actually the
|
|
case, or whether there is some configuration issue, as yet unknown,
|
|
that makes NT Workstation _think_ that the link is a slow one is a
|
|
matter to be resolved].</P
|
|
><P
|
|
>[lkcl 20aug97 - after samba digest correspondance, one user found, and
|
|
another confirmed, that profiles cannot be loaded from a samba server
|
|
unless "security = user" and "encrypt passwords = yes" (see the file
|
|
ENCRYPTION.txt) or "security = server" and "password server = ip.address.
|
|
of.yourNTserver" are used. either of these options will allow the NT
|
|
workstation to access the samba server using LAN manager encrypted
|
|
passwords, without the user intervention normally required by NT
|
|
workstation for clear-text passwords].</P
|
|
><P
|
|
>[lkcl 25aug97 - more comments received about NT profiles: the case of
|
|
the profile _matters_. the file _must_ be called NTuser.DAT or, for
|
|
a mandatory profile, NTuser.MAN].</P
|
|
></BLOCKQUOTE
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><HR><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN1273"
|
|
>6.8.2.6. Windows NT Server</A
|
|
></H3
|
|
><P
|
|
>There is nothing to stop you specifying any path that you like for the
|
|
location of users' profiles. Therefore, you could specify that the
|
|
profile be stored on a samba server, or any other SMB server, as long as
|
|
that SMB server supports encrypted passwords.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><HR><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN1276"
|
|
>6.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0</A
|
|
></H3
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
BORDER="1"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
ALIGN="CENTER"
|
|
><B
|
|
>Potentially outdated or incorrect material follows</B
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
ALIGN="LEFT"
|
|
><P
|
|
>I think this is all bogus, but have not deleted it. (Richard Sharpe)</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><P
|
|
>The default logon path is \\%N\U%. NT Workstation will attempt to create
|
|
a directory "\\samba-server\username.PDS" if you specify the logon path
|
|
as "\\samba-server\username" with the NT User Manager. Therefore, you
|
|
will need to specify (for example) "\\samba-server\username\profile".
|
|
NT 4.0 will attempt to create "\\samba-server\username\profile.PDS", which
|
|
is more likely to succeed.</P
|
|
><P
|
|
>If you then want to share the same Start Menu / Desktop with W95, you will
|
|
need to specify "logon path = \\samba-server\username\profile" [lkcl 10aug97
|
|
this has its drawbacks: i created a shortcut to telnet.exe, which attempts
|
|
to run from the c:\winnt\system32 directory. this directory is obviously
|
|
unlikely to exist on a Win95-only host].</P
|
|
><P
|
|
> If you have this set up correctly, you will find separate user.DAT and
|
|
NTuser.DAT files in the same profile directory.</P
|
|
><DIV
|
|
CLASS="NOTE"
|
|
><BLOCKQUOTE
|
|
CLASS="NOTE"
|
|
><P
|
|
><B
|
|
>Note: </B
|
|
>[lkcl 25aug97 - there are some issues to resolve with downloading of
|
|
NT profiles, probably to do with time/date stamps. i have found that
|
|
NTuser.DAT is never updated on the workstation after the first time that
|
|
it is copied to the local workstation profile directory. this is in
|
|
contrast to w95, where it _does_ transfer / update profiles correctly].</P
|
|
></BLOCKQUOTE
|
|
></DIV
|
|
></DIV
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1286"
|
|
>6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba</A
|
|
></H1
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
BORDER="1"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
ALIGN="CENTER"
|
|
><B
|
|
>Possibly Outdated Material</B
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
ALIGN="LEFT"
|
|
><P
|
|
> This appendix was originally authored by John H Terpstra of
|
|
the Samba Team and is included here for posterity.
|
|
</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><P
|
|
><EM
|
|
>NOTE :</EM
|
|
>
|
|
The term "Domain Controller" and those related to it refer to one specific
|
|
method of authentication that can underly an SMB domain. Domain Controllers
|
|
prior to Windows NT Server 3.1 were sold by various companies and based on
|
|
private extensions to the LAN Manager 2.1 protocol. Windows NT introduced
|
|
Microsoft-specific ways of distributing the user authentication database.
|
|
See DOMAIN.txt for examples of how Samba can participate in or create
|
|
SMB domains based on shared authentication database schemes other than the
|
|
Windows NT SAM.</P
|
|
><P
|
|
>Windows NT Server can be installed as either a plain file and print server
|
|
(WORKGROUP workstation or server) or as a server that participates in Domain
|
|
Control (DOMAIN member, Primary Domain controller or Backup Domain controller).
|
|
The same is true for OS/2 Warp Server, Digital Pathworks and other similar
|
|
products, all of which can participate in Domain Control along with Windows NT.</P
|
|
><P
|
|
>To many people these terms can be confusing, so let's try to clear the air.</P
|
|
><P
|
|
>Every Windows NT system (workstation or server) has a registry database.
|
|
The registry contains entries that describe the initialization information
|
|
for all services (the equivalent of Unix Daemons) that run within the Windows
|
|
NT environment. The registry also contains entries that tell application
|
|
software where to find dynamically loadable libraries that they depend upon.
|
|
In fact, the registry contains entries that describes everything that anything
|
|
may need to know to interact with the rest of the system.</P
|
|
><P
|
|
>The registry files can be located on any Windows NT machine by opening a
|
|
command prompt and typing:</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>C:\WINNT\></TT
|
|
> dir %SystemRoot%\System32\config</P
|
|
><P
|
|
>The environment variable %SystemRoot% value can be obtained by typing:</P
|
|
><P
|
|
><TT
|
|
CLASS="PROMPT"
|
|
>C:\WINNT></TT
|
|
>echo %SystemRoot%</P
|
|
><P
|
|
>The active parts of the registry that you may want to be familiar with are
|
|
the files called: default, system, software, sam and security.</P
|
|
><P
|
|
>In a domain environment, Microsoft Windows NT domain controllers participate
|
|
in replication of the SAM and SECURITY files so that all controllers within
|
|
the domain have an exactly identical copy of each.</P
|
|
><P
|
|
>The Microsoft Windows NT system is structured within a security model that
|
|
says that all applications and services must authenticate themselves before
|
|
they can obtain permission from the security manager to do what they set out
|
|
to do.</P
|
|
><P
|
|
>The Windows NT User database also resides within the registry. This part of
|
|
the registry contains the user's security identifier, home directory, group
|
|
memberships, desktop profile, and so on.</P
|
|
><P
|
|
>Every Windows NT system (workstation as well as server) will have its own
|
|
registry. Windows NT Servers that participate in Domain Security control
|
|
have a database that they share in common - thus they do NOT own an
|
|
independent full registry database of their own, as do Workstations and
|
|
plain Servers.</P
|
|
><P
|
|
>The User database is called the SAM (Security Access Manager) database and
|
|
is used for all user authentication as well as for authentication of inter-
|
|
process authentication (ie: to ensure that the service action a user has
|
|
requested is permitted within the limits of that user's privileges).</P
|
|
><P
|
|
>The Samba team have produced a utility that can dump the Windows NT SAM into
|
|
smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and
|
|
/pub/samba/pwdump on your nearest Samba mirror for the utility. This
|
|
facility is useful but cannot be easily used to implement SAM replication
|
|
to Samba systems.</P
|
|
><P
|
|
>Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers
|
|
can participate in a Domain security system that is controlled by Windows NT
|
|
servers that have been correctly configured. At most every domain will have
|
|
ONE Primary Domain Controller (PDC). It is desirable that each domain will
|
|
have at least one Backup Domain Controller (BDC).</P
|
|
><P
|
|
>The PDC and BDCs then participate in replication of the SAM database so that
|
|
each Domain Controlling participant will have an up to date SAM component
|
|
within its registry.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN1311"
|
|
>Chapter 7. Unifed Logons between Windows NT and UNIX using Winbind</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1329"
|
|
>7.1. Abstract</A
|
|
></H1
|
|
><P
|
|
>Integration of UNIX and Microsoft Windows NT through
|
|
a unified logon has been considered a "holy grail" in heterogeneous
|
|
computing environments for a long time. We present <EM
|
|
>winbind
|
|
</EM
|
|
>, a component of the Samba suite of programs as a
|
|
solution to the unied logon problem. Winbind uses a UNIX implementation
|
|
of Microsoft RPC calls, Pluggable Authentication Modules, and the Name
|
|
Service Switch to allow Windows NT domain users to appear and operate
|
|
as UNIX users on a UNIX machine. This paper describes the winbind
|
|
system, explaining the functionality it provides, how it is configured,
|
|
and how it works internally.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1333"
|
|
>7.2. Introduction</A
|
|
></H1
|
|
><P
|
|
>It is well known that UNIX and Microsoft Windows NT have
|
|
different models for representing user and group information and
|
|
use different technologies for implementing them. This fact has
|
|
made it difficult to integrate the two systems in a satisfactory
|
|
manner.</P
|
|
><P
|
|
>One common solution in use today has been to create
|
|
identically named user accounts on both the UNIX and Windows systems
|
|
and use the Samba suite of programs to provide file and print services
|
|
between the two. This solution is far from perfect however, as
|
|
adding and deleting users on both sets of machines becomes a chore
|
|
and two sets of passwords are required both of which which
|
|
can lead to synchronization problems between the UNIX and Windows
|
|
systems and confusion for users.</P
|
|
><P
|
|
>We divide the unifed logon problem for UNIX machines into
|
|
three smaller problems:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>Obtaining Windows NT user and group information
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Authenticating Windows NT users
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Password changing for Windows NT users
|
|
</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>Ideally, a prospective solution to the unified logon problem
|
|
would satisfy all the above components without duplication of
|
|
information on the UNIX machines and without creating additional
|
|
tasks for the system administrator when maintaining users and
|
|
groups on either system. The winbind system provides a simple
|
|
and elegant solution to all three components of the unifed logon
|
|
problem.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1346"
|
|
>7.3. What Winbind Provides</A
|
|
></H1
|
|
><P
|
|
>Winbind unifies UNIX and Windows NT account management by
|
|
allowing a UNIX box to become a full member of a NT domain. Once
|
|
this is done the UNIX box will see NT users and groups as if
|
|
they were native UNIX users and groups, allowing the NT domain
|
|
to be used in much the same manner that NIS+ is used within
|
|
UNIX-only environments.</P
|
|
><P
|
|
>The end result is that whenever any
|
|
program on the UNIX machine asks the operating system to lookup
|
|
a user or group name, the query will be resolved by asking the
|
|
NT domain controller for the specied domain to do the lookup.
|
|
Because Winbind hooks into the operating system at a low level
|
|
(via the NSS name resolution modules in the C library) this
|
|
redirection to the NT domain controller is completely
|
|
transparent.</P
|
|
><P
|
|
>Users on the UNIX machine can then use NT user and group
|
|
names as they would use "native" UNIX names. They can chown files
|
|
so that they are owned by NT domain users or even login to the
|
|
UNIX machine and run a UNIX X-Window session as a domain user.</P
|
|
><P
|
|
>The only obvious indication that Winbind is being used is
|
|
that user and group names take the form DOMAIN\user and
|
|
DOMAIN\group. This is necessary as it allows Winbind to determine
|
|
that redirection to a domain controller is wanted for a particular
|
|
lookup and which trusted domain is being referenced.</P
|
|
><P
|
|
>Additionally, Winbind provides a authentication service
|
|
that hooks into the Pluggable Authentication Modules (PAM) system
|
|
to provide authentication via a NT domain to any PAM enabled
|
|
applications. This capability solves the problem of synchronizing
|
|
passwords between systems as all passwords are stored in a single
|
|
location (on the domain controller).</P
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1353"
|
|
>7.3.1. Target Uses</A
|
|
></H2
|
|
><P
|
|
>Winbind is targeted at organizations that have an
|
|
existing NT based domain infrastructure into which they wish
|
|
to put UNIX workstations or servers. Winbind will allow these
|
|
organizations to deploy UNIX workstations without having to
|
|
maintain a separate account infrastructure. This greatly simplies
|
|
the administrative overhead of deploying UNIX workstations into
|
|
a NT based organization.</P
|
|
><P
|
|
>Another interesting way in which we expect Winbind to
|
|
be used is as a central part of UNIX based appliances. Appliances
|
|
that provide file and print services to Microsoft based networks
|
|
will be able to use Winbind to provide seamless integration of
|
|
the appliance into the domain.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1357"
|
|
>7.4. How Winbind Works</A
|
|
></H1
|
|
><P
|
|
>The winbind system is designed around a client/server
|
|
architecture. A long running <B
|
|
CLASS="COMMAND"
|
|
>winbindd</B
|
|
> daemon
|
|
listens on a UNIX domain socket waiting for requests
|
|
to arrive. These requests are generated by the NSS and PAM
|
|
clients and processed sequentially.</P
|
|
><P
|
|
>The technologies used to implement winbind are described
|
|
in detail below.</P
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1362"
|
|
>7.4.1. Microsoft Remote Procedure Calls</A
|
|
></H2
|
|
><P
|
|
>Over the last two years, efforts have been underway
|
|
by various Samba Team members to decode various aspects of
|
|
the Microsoft Remote Procedure Call (MSRPC) system. This
|
|
system is used for most network related operations between
|
|
Windows NT machines including remote management, user authentication
|
|
and print spooling. Although initially this work was done
|
|
to aid the implementation of Primary Domain Controller (PDC)
|
|
functionality in Samba, it has also yielded a body of code which
|
|
can be used for other purposes.</P
|
|
><P
|
|
>Winbind uses various MSRPC calls to enumerate domain users
|
|
and groups and to obtain detailed information about individual
|
|
users or groups. Other MSRPC calls can be used to authenticate
|
|
NT domain users and to change user passwords. By directly querying
|
|
a Windows PDC for user and group information, winbind maps the
|
|
NT account information onto UNIX user and group names.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1366"
|
|
>7.4.2. Name Service Switch</A
|
|
></H2
|
|
><P
|
|
>The Name Service Switch, or NSS, is a feature that is
|
|
present in many UNIX operating systems. It allows system
|
|
information such as hostnames, mail aliases and user information
|
|
to be resolved from dierent sources. For example, a standalone
|
|
UNIX workstation may resolve system information from a series of
|
|
flat files stored on the local lesystem. A networked workstation
|
|
may first attempt to resolve system information from local files,
|
|
then consult a NIS database for user information or a DNS server
|
|
for hostname information.</P
|
|
><P
|
|
>The NSS application programming interface allows winbind
|
|
to present itself as a source of system information when
|
|
resolving UNIX usernames and groups. Winbind uses this interface,
|
|
and information obtained from a Windows NT server using MSRPC
|
|
calls to provide a new source of account enumeration. Using standard
|
|
UNIX library calls, one can enumerate the users and groups on
|
|
a UNIX machine running winbind and see all users and groups in
|
|
a NT domain plus any trusted domain as though they were local
|
|
users and groups.</P
|
|
><P
|
|
>The primary control le for NSS is <TT
|
|
CLASS="FILENAME"
|
|
>/etc/nsswitch.conf
|
|
</TT
|
|
>. When a UNIX application makes a request to do a lookup
|
|
the C library looks in <TT
|
|
CLASS="FILENAME"
|
|
>/etc/nsswitch.conf</TT
|
|
>
|
|
for a line which matches the service type being requested, for
|
|
example the "passwd" service type is used when user or group names
|
|
are looked up. This config line species which implementations
|
|
of that service should be tried andin what order. If the passwd
|
|
config line is:</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>passwd: files example</B
|
|
></P
|
|
><P
|
|
>then the C library will first load a module called
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>/lib/libnss_files.so</TT
|
|
> followed by
|
|
the module <TT
|
|
CLASS="FILENAME"
|
|
>/lib/libnss_example.so</TT
|
|
>. The
|
|
C library will dynamically load each of these modules in turn
|
|
and call resolver functions within the modules to try to resolve
|
|
the request. Once the request is resolved the C library returns the
|
|
result to the application.</P
|
|
><P
|
|
>This NSS interface provides a very easy way for Winbind
|
|
to hook into the operating system. All that needs to be done
|
|
is to put <TT
|
|
CLASS="FILENAME"
|
|
>libnss_winbind.so</TT
|
|
> in <TT
|
|
CLASS="FILENAME"
|
|
>/lib/</TT
|
|
>
|
|
then add "winbind" into <TT
|
|
CLASS="FILENAME"
|
|
>/etc/nsswitch.conf</TT
|
|
> at
|
|
the appropriate place. The C library will then call Winbind to
|
|
resolve user and group names.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1382"
|
|
>7.4.3. Pluggable Authentication Modules</A
|
|
></H2
|
|
><P
|
|
>Pluggable Authentication Modules, also known as PAM,
|
|
is a system for abstracting authentication and authorization
|
|
technologies. With a PAM module it is possible to specify different
|
|
authentication methods for dierent system applications without
|
|
having to recompile these applications. PAM is also useful
|
|
for implementing a particular policy for authorization. For example,
|
|
a system administrator may only allow console logins from users
|
|
stored in the local password file but only allow users resolved from
|
|
a NIS database to log in over the network.</P
|
|
><P
|
|
>Winbind uses the authentication management and password
|
|
management PAM interface to integrate Windows NT users into a
|
|
UNIX system. This allows Windows NT users to log in to a UNIX
|
|
machine and be authenticated against a suitable Primary Domain
|
|
Controller. These users can also change their passwords and have
|
|
this change take eect directly on the Primary Domain Controller.
|
|
</P
|
|
><P
|
|
>PAM is congured by providing control files in the directory
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>/etc/pam.d/</TT
|
|
> for each of the services that
|
|
require authentication. When an authentication request is made
|
|
by an application the PAM code in the C library looks up this
|
|
control file to determine what modules to load to do the
|
|
authentication check and in what order. This interface makes adding
|
|
a new authentication service for Winbind very easy, all that needs
|
|
to be done is that the <TT
|
|
CLASS="FILENAME"
|
|
>pam_winbind.so</TT
|
|
> module
|
|
is copied to <TT
|
|
CLASS="FILENAME"
|
|
>/lib/security/</TT
|
|
> and the pam
|
|
control files for relevant services are updated to allow
|
|
authentication via winbind. See the PAM documentation
|
|
for more details.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1390"
|
|
>7.4.4. User and Group ID Allocation</A
|
|
></H2
|
|
><P
|
|
>When a user or group is created under Windows NT
|
|
is it allocated a numerical relative identier (RID). This is
|
|
slightly dierent to UNIX which has a range of numbers which are
|
|
used to identify users, and the same range in which to identify
|
|
groups. It is winbind's job to convert RIDs to UNIX id numbers and
|
|
vice versa. When winbind is congured it is given part of the UNIX
|
|
user id space and a part of the UNIX group id space in which to
|
|
store Windows NT users and groups. If a Windows NT user is
|
|
resolved for the first time, it is allocated the next UNIX id from
|
|
the range. The same process applies for Windows NT groups. Over
|
|
time, winbind will have mapped all Windows NT users and groups
|
|
to UNIX user ids and group ids.</P
|
|
><P
|
|
>The results of this mapping are stored persistently in
|
|
a ID mapping database held in a tdb database). This ensures that
|
|
RIDs are mapped to UNIX IDs in a consistent way.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1394"
|
|
>7.4.5. Result Caching</A
|
|
></H2
|
|
><P
|
|
>An active system can generate a lot of user and group
|
|
name lookups. To reduce the network cost of these lookups winbind
|
|
uses a caching scheme based on the SAM sequence number supplied
|
|
by NT domain controllers. User or group information returned
|
|
by a PDC is cached by winbind along with a sequence number also
|
|
returned by the PDC. This sequence number is incremented by
|
|
Windows NT whenever any user or group information is modied. If
|
|
a cached entry has expired, the sequence number is requested from
|
|
the PDC and compared against the sequence number of the cached entry.
|
|
If the sequence numbers do not match, then the cached information
|
|
is discarded and up to date information is requested directly
|
|
from the PDC.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1397"
|
|
>7.5. Installation and Configuration</A
|
|
></H1
|
|
><P
|
|
>The easiest way to install winbind is by using the packages
|
|
provided in the <TT
|
|
CLASS="FILENAME"
|
|
>pub/samba/appliance/</TT
|
|
>
|
|
directory on your nearest
|
|
Samba mirror. These packages provide snapshots of the Samba source
|
|
code and binaries already setup to provide the full functionality
|
|
of winbind. This setup is a little more complex than a normal Samba
|
|
build as winbind needs a small amount of functionality from a
|
|
development code branch called SAMBA_TNG.</P
|
|
><P
|
|
>Once you have installed the packages you should read
|
|
the <B
|
|
CLASS="COMMAND"
|
|
>winbindd(8)</B
|
|
> man page which will provide you
|
|
with conguration information and give you sample conguration files.
|
|
You may also wish to update the main Samba daemons smbd and nmbd)
|
|
with a more recent development release, such as the recently
|
|
announced Samba 2.2 alpha release.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1403"
|
|
>7.6. Limitations</A
|
|
></H1
|
|
><P
|
|
>Winbind has a number of limitations in its current
|
|
released version which we hope to overcome in future
|
|
releases:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>Winbind is currently only available for
|
|
the Linux operating system, although ports to other operating
|
|
systems are certainly possible. For such ports to be feasible,
|
|
we require the C library of the target operating system to
|
|
support the Name Service Switch and Pluggable Authentication
|
|
Modules systems. This is becoming more common as NSS and
|
|
PAM gain support among UNIX vendors.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>The mappings of Windows NT RIDs to UNIX ids
|
|
is not made algorithmically and depends on the order in which
|
|
unmapped users or groups are seen by winbind. It may be difficult
|
|
to recover the mappings of rid to UNIX id mapping if the file
|
|
containing this information is corrupted or destroyed.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Currently the winbind PAM module does not take
|
|
into account possible workstation and logon time restrictions
|
|
that may be been set for Windows NT users.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Building winbind from source is currently
|
|
quite tedious as it requires combining source code from two Samba
|
|
branches. Work is underway to solve this by providing all
|
|
the necessary functionality in the main Samba code branch.</P
|
|
></LI
|
|
></UL
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1415"
|
|
>7.7. Conclusion</A
|
|
></H1
|
|
><P
|
|
>The winbind system, through the use of the Name Service
|
|
Switch, Pluggable Authentication Modules, and appropriate
|
|
Microsoft RPC calls have allowed us to provide seamless
|
|
integration of Microsoft Windows NT domain users on a
|
|
UNIX system. The result is a great reduction in the administrative
|
|
cost of running a mixed UNIX and NT network.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN1418"
|
|
>Chapter 8. UNIX Permission Bits and WIndows NT Access Control Lists</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1429"
|
|
>8.1. Viewing and changing UNIX permissions using the NT
|
|
security dialogs</A
|
|
></H1
|
|
><P
|
|
>New in the Samba 2.0.4 release is the ability for Windows
|
|
NT clients to use their native security settings dialog box to
|
|
view and modify the underlying UNIX permissions.</P
|
|
><P
|
|
>Note that this ability is careful not to compromise
|
|
the security of the UNIX host Samba is running on, and
|
|
still obeys all the file permission rules that a Samba
|
|
administrator can set.</P
|
|
><P
|
|
>In Samba 2.0.4 and above the default value of the
|
|
parameter <A
|
|
HREF="smb.conf.5.html#NTACLSUPPORT"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
> nt acl support</I
|
|
></TT
|
|
></A
|
|
> has been changed from
|
|
<TT
|
|
CLASS="CONSTANT"
|
|
>false</TT
|
|
> to <TT
|
|
CLASS="CONSTANT"
|
|
>true</TT
|
|
>, so
|
|
manipulation of permissions is turned on by default.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1438"
|
|
>8.2. How to view file security on a Samba share</A
|
|
></H1
|
|
><P
|
|
>From an NT 4.0 client, single-click with the right
|
|
mouse button on any file or directory in a Samba mounted
|
|
drive letter or UNC path. When the menu pops-up, click
|
|
on the <EM
|
|
>Properties</EM
|
|
> entry at the bottom of
|
|
the menu. This brings up the normal file properties dialog
|
|
box, but with Samba 2.0.4 this will have a new tab along the top
|
|
marked <EM
|
|
>Security</EM
|
|
>. Click on this tab and you
|
|
will see three buttons, <EM
|
|
>Permissions</EM
|
|
>,
|
|
<EM
|
|
>Auditing</EM
|
|
>, and <EM
|
|
>Ownership</EM
|
|
>.
|
|
The <EM
|
|
>Auditing</EM
|
|
> button will cause either
|
|
an error message <SPAN
|
|
CLASS="ERRORNAME"
|
|
>A requested privilege is not held
|
|
by the client</SPAN
|
|
> to appear if the user is not the
|
|
NT Administrator, or a dialog which is intended to allow an
|
|
Administrator to add auditing requirements to a file if the
|
|
user is logged on as the NT Administrator. This dialog is
|
|
non-functional with a Samba share at this time, as the only
|
|
useful button, the <B
|
|
CLASS="COMMAND"
|
|
>Add</B
|
|
> button will not currently
|
|
allow a list of users to be seen.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1449"
|
|
>8.3. Viewing file ownership</A
|
|
></H1
|
|
><P
|
|
>Clicking on the <B
|
|
CLASS="COMMAND"
|
|
>"Ownership"</B
|
|
> button
|
|
brings up a dialog box telling you who owns the given file. The
|
|
owner name will be of the form :</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>"SERVER\user (Long name)"</B
|
|
></P
|
|
><P
|
|
>Where <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>SERVER</I
|
|
></TT
|
|
> is the NetBIOS name of
|
|
the Samba server, <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>user</I
|
|
></TT
|
|
> is the user name of
|
|
the UNIX user who owns the file, and <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>(Long name)</I
|
|
></TT
|
|
>
|
|
is the discriptive string identifying the user (normally found in the
|
|
GECOS field of the UNIX password database). Click on the <B
|
|
CLASS="COMMAND"
|
|
>Close
|
|
</B
|
|
> button to remove this dialog.</P
|
|
><P
|
|
>If the parameter <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>nt acl support</I
|
|
></TT
|
|
>
|
|
is set to <TT
|
|
CLASS="CONSTANT"
|
|
>false</TT
|
|
> then the file owner will
|
|
be shown as the NT user <B
|
|
CLASS="COMMAND"
|
|
>"Everyone"</B
|
|
>.</P
|
|
><P
|
|
>The <B
|
|
CLASS="COMMAND"
|
|
>Take Ownership</B
|
|
> button will not allow
|
|
you to change the ownership of this file to yourself (clicking on
|
|
it will display a dialog box complaining that the user you are
|
|
currently logged onto the NT client cannot be found). The reason
|
|
for this is that changing the ownership of a file is a privilaged
|
|
operation in UNIX, available only to the <EM
|
|
>root</EM
|
|
>
|
|
user. As clicking on this button causes NT to attempt to change
|
|
the ownership of a file to the current user logged into the NT
|
|
client this will not work with Samba at this time.</P
|
|
><P
|
|
>There is an NT chown command that will work with Samba
|
|
and allow a user with Administrator privillage connected
|
|
to a Samba 2.0.4 server as root to change the ownership of
|
|
files on both a local NTFS filesystem or remote mounted NTFS
|
|
or Samba drive. This is available as part of the <EM
|
|
>Seclib
|
|
</EM
|
|
> NT security library written by Jeremy Allison of
|
|
the Samba Team, available from the main Samba ftp site.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1469"
|
|
>8.4. Viewing file or directory permissions</A
|
|
></H1
|
|
><P
|
|
>The third button is the <B
|
|
CLASS="COMMAND"
|
|
>"Permissions"</B
|
|
>
|
|
button. Clicking on this brings up a dialog box that shows both
|
|
the permissions and the UNIX owner of the file or directory.
|
|
The owner is displayed in the form :</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>"SERVER\user (Long name)"</B
|
|
></P
|
|
><P
|
|
>Where <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>SERVER</I
|
|
></TT
|
|
> is the NetBIOS name of
|
|
the Samba server, <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>user</I
|
|
></TT
|
|
> is the user name of
|
|
the UNIX user who owns the file, and <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>(Long name)</I
|
|
></TT
|
|
>
|
|
is the discriptive string identifying the user (normally found in the
|
|
GECOS field of the UNIX password database).</P
|
|
><P
|
|
>If the parameter <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>nt acl support</I
|
|
></TT
|
|
>
|
|
is set to <TT
|
|
CLASS="CONSTANT"
|
|
>false</TT
|
|
> then the file owner will
|
|
be shown as the NT user <B
|
|
CLASS="COMMAND"
|
|
>"Everyone"</B
|
|
> and the
|
|
permissions will be shown as NT "Full Control".</P
|
|
><P
|
|
>The permissions field is displayed differently for files
|
|
and directories, so I'll describe the way file permissions
|
|
are displayed first.</P
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1484"
|
|
>8.4.1. File Permissions</A
|
|
></H2
|
|
><P
|
|
>The standard UNIX user/group/world triple and
|
|
the correspinding "read", "write", "execute" permissions
|
|
triples are mapped by Samba into a three element NT ACL
|
|
with the 'r', 'w', and 'x' bits mapped into the corresponding
|
|
NT permissions. The UNIX world permissions are mapped into
|
|
the global NT group <B
|
|
CLASS="COMMAND"
|
|
>Everyone</B
|
|
>, followed
|
|
by the list of permissions allowed for UNIX world. The UNIX
|
|
owner and group permissions are displayed as an NT
|
|
<B
|
|
CLASS="COMMAND"
|
|
>user</B
|
|
> icon and an NT <B
|
|
CLASS="COMMAND"
|
|
>local
|
|
group</B
|
|
> icon respectively followed by the list
|
|
of permissions allowed for the UNIX user and group.</P
|
|
><P
|
|
>As many UNIX permission sets don't map into common
|
|
NT names such as <B
|
|
CLASS="COMMAND"
|
|
>"read"</B
|
|
>, <B
|
|
CLASS="COMMAND"
|
|
> "change"</B
|
|
> or <B
|
|
CLASS="COMMAND"
|
|
>"full control"</B
|
|
> then
|
|
usually the permissions will be prefixed by the words <B
|
|
CLASS="COMMAND"
|
|
> "Special Access"</B
|
|
> in the NT display list.</P
|
|
><P
|
|
>But what happens if the file has no permissions allowed
|
|
for a particular UNIX user group or world component ? In order
|
|
to allow "no permissions" to be seen and modified then Samba
|
|
overloads the NT <B
|
|
CLASS="COMMAND"
|
|
>"Take Ownership"</B
|
|
> ACL attribute
|
|
(which has no meaning in UNIX) and reports a component with
|
|
no permissions as having the NT <B
|
|
CLASS="COMMAND"
|
|
>"O"</B
|
|
> bit set.
|
|
This was chosen of course to make it look like a zero, meaning
|
|
zero permissions. More details on the decision behind this will
|
|
be given below.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1498"
|
|
>8.4.2. Directory Permissions</A
|
|
></H2
|
|
><P
|
|
>Directories on an NT NTFS file system have two
|
|
different sets of permissions. The first set of permissions
|
|
is the ACL set on the directory itself, this is usually displayed
|
|
in the first set of parentheses in the normal <B
|
|
CLASS="COMMAND"
|
|
>"RW"</B
|
|
>
|
|
NT style. This first set of permissions is created by Samba in
|
|
exactly the same way as normal file permissions are, described
|
|
above, and is displayed in the same way.</P
|
|
><P
|
|
>The second set of directory permissions has no real meaning
|
|
in the UNIX permissions world and represents the <B
|
|
CLASS="COMMAND"
|
|
> "inherited"</B
|
|
> permissions that any file created within
|
|
this directory would inherit.</P
|
|
><P
|
|
>Samba synthesises these inherited permissions for NT by
|
|
returning as an NT ACL the UNIX permission mode that a new file
|
|
created by Samba on this share would receive.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1505"
|
|
>8.5. Modifying file or directory permissions</A
|
|
></H1
|
|
><P
|
|
>Modifying file and directory permissions is as simple
|
|
as changing the displayed permissions in the dialog box, and
|
|
clicking the <B
|
|
CLASS="COMMAND"
|
|
>OK</B
|
|
> button. However, there are
|
|
limitations that a user needs to be aware of, and also interactions
|
|
with the standard Samba permission masks and mapping of DOS
|
|
attributes that need to also be taken into account.</P
|
|
><P
|
|
>If the parameter <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>nt acl support</I
|
|
></TT
|
|
>
|
|
is set to <TT
|
|
CLASS="CONSTANT"
|
|
>false</TT
|
|
> then any attempt to set
|
|
security permissions will fail with an <B
|
|
CLASS="COMMAND"
|
|
>"Access Denied"
|
|
</B
|
|
> message.</P
|
|
><P
|
|
>The first thing to note is that the <B
|
|
CLASS="COMMAND"
|
|
>"Add"</B
|
|
>
|
|
button will not return a list of users in Samba 2.0.4 (it will give
|
|
an error message of <B
|
|
CLASS="COMMAND"
|
|
>"The remote proceedure call failed
|
|
and did not execute"</B
|
|
>). This means that you can only
|
|
manipulate the current user/group/world permissions listed in
|
|
the dialog box. This actually works quite well as these are the
|
|
only permissions that UNIX actually has.</P
|
|
><P
|
|
>If a permission triple (either user, group, or world)
|
|
is removed from the list of permissions in the NT dialog box,
|
|
then when the <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> button is pressed it will
|
|
be applied as "no permissions" on the UNIX side. If you then
|
|
view the permissions again the "no permissions" entry will appear
|
|
as the NT <B
|
|
CLASS="COMMAND"
|
|
>"O"</B
|
|
> flag, as described above. This
|
|
allows you to add permissions back to a file or directory once
|
|
you have removed them from a triple component.</P
|
|
><P
|
|
>As UNIX supports only the "r", "w" and "x" bits of
|
|
an NT ACL then if other NT security attributes such as "Delete
|
|
access" are selected then they will be ignored when applied on
|
|
the Samba server.</P
|
|
><P
|
|
>When setting permissions on a directory the second
|
|
set of permissions (in the second set of parentheses) is
|
|
by default applied to all files within that directory. If this
|
|
is not what you want you must uncheck the <B
|
|
CLASS="COMMAND"
|
|
>"Replace
|
|
permissions on existing files"</B
|
|
> checkbox in the NT
|
|
dialog before clicking <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
>.</P
|
|
><P
|
|
>If you wish to remove all permissions from a
|
|
user/group/world component then you may either highlight the
|
|
component and click the <B
|
|
CLASS="COMMAND"
|
|
>"Remove"</B
|
|
> button,
|
|
or set the component to only have the special <B
|
|
CLASS="COMMAND"
|
|
>"Take
|
|
Ownership"</B
|
|
> permission (dsplayed as <B
|
|
CLASS="COMMAND"
|
|
>"O"
|
|
</B
|
|
>) highlighted.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1527"
|
|
>8.6. Interaction with the standard Samba create mask
|
|
parameters</A
|
|
></H1
|
|
><P
|
|
>Note that with Samba 2.0.5 there are four new parameters
|
|
to control this interaction. These are :</P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>security mask</I
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force security mode</I
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>directory security mask</I
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force directory security mode</I
|
|
></TT
|
|
></P
|
|
><P
|
|
>Once a user clicks <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> to apply the
|
|
permissions Samba maps the given permissions into a user/group/world
|
|
r/w/x triple set, and then will check the changed permissions for a
|
|
file against the bits set in the <A
|
|
HREF="smb.conf.5.html#SECURITYMASK"
|
|
TARGET="_top"
|
|
>
|
|
<TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>security mask</I
|
|
></TT
|
|
></A
|
|
> parameter. Any bits that
|
|
were changed that are not set to '1' in this parameter are left alone
|
|
in the file permissions.</P
|
|
><P
|
|
>Essentially, zero bits in the <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>security mask</I
|
|
></TT
|
|
>
|
|
mask may be treated as a set of bits the user is <EM
|
|
>not</EM
|
|
>
|
|
allowed to change, and one bits are those the user is allowed to change.
|
|
</P
|
|
><P
|
|
>If not set explicitly this parameter is set to the same value as
|
|
the <A
|
|
HREF="smb.conf.5.html#CREATEMASK"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>create mask
|
|
</I
|
|
></TT
|
|
></A
|
|
> parameter to provide compatibility with Samba 2.0.4
|
|
where this permission change facility was introduced. To allow a user to
|
|
modify all the user/group/world permissions on a file, set this parameter
|
|
to 0777.</P
|
|
><P
|
|
>Next Samba checks the changed permissions for a file against
|
|
the bits set in the <A
|
|
HREF="smb.conf.5.html#FORCESECURITYMODE"
|
|
TARGET="_top"
|
|
> <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force security mode</I
|
|
></TT
|
|
></A
|
|
> parameter. Any bits
|
|
that were changed that correspond to bits set to '1' in this parameter
|
|
are forced to be set.</P
|
|
><P
|
|
>Essentially, bits set in the <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force security mode
|
|
</I
|
|
></TT
|
|
> parameter may be treated as a set of bits that, when
|
|
modifying security on a file, the user has always set to be 'on'.</P
|
|
><P
|
|
>If not set explicitly this parameter is set to the same value
|
|
as the <A
|
|
HREF="smb.conf.5.html#FORCECREATEMODE"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force
|
|
create mode</I
|
|
></TT
|
|
></A
|
|
> parameter to provide compatibility
|
|
with Samba 2.0.4 where the permission change facility was introduced.
|
|
To allow a user to modify all the user/group/world permissions on a file,
|
|
with no restrictions set this parameter to 000.</P
|
|
><P
|
|
>The <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>security mask</I
|
|
></TT
|
|
> and <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force
|
|
security mode</I
|
|
></TT
|
|
> parameters are applied to the change
|
|
request in that order.</P
|
|
><P
|
|
>For a directory Samba will perform the same operations as
|
|
described above for a file except using the parameter <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
> directory security mask</I
|
|
></TT
|
|
> instead of <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>security
|
|
mask</I
|
|
></TT
|
|
>, and <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force directory security mode
|
|
</I
|
|
></TT
|
|
> parameter instead of <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force security mode
|
|
</I
|
|
></TT
|
|
>.</P
|
|
><P
|
|
>The <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>directory security mask</I
|
|
></TT
|
|
> parameter
|
|
by default is set to the same value as the <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>directory mask
|
|
</I
|
|
></TT
|
|
> parameter and the <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force directory security
|
|
mode</I
|
|
></TT
|
|
> parameter by default is set to the same value as
|
|
the <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force directory mode</I
|
|
></TT
|
|
> parameter to provide
|
|
compatibility with Samba 2.0.4 where the permission change facility
|
|
was introduced.</P
|
|
><P
|
|
>In this way Samba enforces the permission restrictions that
|
|
an administrator can set on a Samba share, whilst still allowing users
|
|
to modify the permission bits within that restriction.</P
|
|
><P
|
|
>If you want to set up a share that allows users full control
|
|
in modifying the permission bits on their files and directories and
|
|
doesn't force any particular bits to be set 'on', then set the following
|
|
parameters in the <A
|
|
HREF="smb.conf.5.html"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="FILENAME"
|
|
>smb.conf(5)
|
|
</TT
|
|
></A
|
|
> file in that share specific section :</P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>security mask = 0777</I
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force security mode = 0</I
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>directory security mask = 0777</I
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force directory security mode = 0</I
|
|
></TT
|
|
></P
|
|
><P
|
|
>As described, in Samba 2.0.4 the parameters :</P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>create mask</I
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force create mode</I
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>directory mask</I
|
|
></TT
|
|
></P
|
|
><P
|
|
><TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>force directory mode</I
|
|
></TT
|
|
></P
|
|
><P
|
|
>were used instead of the parameters discussed here.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1591"
|
|
>8.7. Interaction with the standard Samba file attribute
|
|
mapping</A
|
|
></H1
|
|
><P
|
|
>Samba maps some of the DOS attribute bits (such as "read
|
|
only") into the UNIX permissions of a file. This means there can
|
|
be a conflict between the permission bits set via the security
|
|
dialog and the permission bits set by the file attribute mapping.
|
|
</P
|
|
><P
|
|
>One way this can show up is if a file has no UNIX read access
|
|
for the owner it will show up as "read only" in the standard
|
|
file attributes tabbed dialog. Unfortunately this dialog is
|
|
the same one that contains the security info in another tab.</P
|
|
><P
|
|
>What this can mean is that if the owner changes the permissions
|
|
to allow themselves read access using the security dialog, clicks
|
|
<B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> to get back to the standard attributes tab
|
|
dialog, and then clicks <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> on that dialog, then
|
|
NT will set the file permissions back to read-only (as that is what
|
|
the attributes still say in the dialog). This means that after setting
|
|
permissions and clicking <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> to get back to the
|
|
attributes dialog you should always hit <B
|
|
CLASS="COMMAND"
|
|
>"Cancel"</B
|
|
>
|
|
rather than <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> to ensure that your changes
|
|
are not overridden.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN1601"
|
|
>Chapter 9. OS2 Client HOWTO</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1612"
|
|
>9.1. FAQs</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1614"
|
|
>9.1.1. How can I configure OS/2 Warp Connect or
|
|
OS/2 Warp 4 as a client for Samba?</A
|
|
></H2
|
|
><P
|
|
>A more complete answer to this question can be
|
|
found on <A
|
|
HREF="http://carol.wins.uva.nl/~leeuw/samba/warp.html"
|
|
TARGET="_top"
|
|
> http://carol.wins.uva.nl/~leeuw/samba/warp.html</A
|
|
>.</P
|
|
><P
|
|
>Basically, you need three components:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>The File and Print Client ('IBM Peer')
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>TCP/IP ('Internet support')
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>The "NetBIOS over TCP/IP" driver ('TCPBEUI')
|
|
</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>Installing the first two together with the base operating
|
|
system on a blank system is explained in the Warp manual. If Warp
|
|
has already been installed, but you now want to install the
|
|
networking support, use the "Selective Install for Networking"
|
|
object in the "System Setup" folder.</P
|
|
><P
|
|
>Adding the "NetBIOS over TCP/IP" driver is not described
|
|
in the manual and just barely in the online documentation. Start
|
|
MPTS.EXE, click on OK, click on "Configure LAPS" and click
|
|
on "IBM OS/2 NETBIOS OVER TCP/IP" in 'Protocols'. This line
|
|
is then moved to 'Current Configuration'. Select that line,
|
|
click on "Change number" and increase it from 0 to 1. Save this
|
|
configuration.</P
|
|
><P
|
|
>If the Samba server(s) is not on your local subnet, you
|
|
can optionally add IP names and addresses of these servers
|
|
to the "Names List", or specify a WINS server ('NetBIOS
|
|
Nameserver' in IBM and RFC terminology). For Warp Connect you
|
|
may need to download an update for 'IBM Peer' to bring it on
|
|
the same level as Warp 4. See the webpage mentioned above.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1629"
|
|
>9.1.2. How can I configure OS/2 Warp 3 (not Connect),
|
|
OS/2 1.2, 1.3 or 2.x for Samba?</A
|
|
></H2
|
|
><P
|
|
>You can use the free Microsoft LAN Manager 2.2c Client
|
|
for OS/2 from
|
|
<A
|
|
HREF="ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/"
|
|
TARGET="_top"
|
|
> ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/</A
|
|
>.
|
|
See <A
|
|
HREF="http://carol.wins.uva.nl/~leeuw/lanman.html"
|
|
TARGET="_top"
|
|
> http://carol.wins.uva.nl/~leeuw/lanman.html</A
|
|
> for
|
|
more information on how to install and use this client. In
|
|
a nutshell, edit the file \OS2VER in the root directory of
|
|
the OS/2 boot partition and add the lines:</P
|
|
><P
|
|
><TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
> 20=setup.exe
|
|
20=netwksta.sys
|
|
20=netvdd.sys
|
|
</PRE
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></P
|
|
><P
|
|
>before you install the client. Also, don't use the
|
|
included NE2000 driver because it is buggy. Try the NE2000
|
|
or NS2000 driver from
|
|
<A
|
|
HREF="ftp://ftp.cdrom.com/pub/os2/network/ndis/"
|
|
TARGET="_top"
|
|
> ftp://ftp.cdrom.com/pub/os2/network/ndis/</A
|
|
> instead.
|
|
</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1638"
|
|
>9.1.3. Are there any other issues when OS/2 (any version)
|
|
is used as a client?</A
|
|
></H2
|
|
><P
|
|
>When you do a NET VIEW or use the "File and Print
|
|
Client Resource Browser", no Samba servers show up. This can
|
|
be fixed by a patch from <A
|
|
HREF="http://carol.wins.uva.nl/~leeuw/samba/fix.html"
|
|
TARGET="_top"
|
|
> http://carol.wins.uva.nl/~leeuw/samba/fix.html</A
|
|
>.
|
|
The patch will be included in a later version of Samba. It also
|
|
fixes a couple of other problems, such as preserving long
|
|
filenames when objects are dragged from the Workplace Shell
|
|
to the Samba server. </P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1642"
|
|
>9.1.4. How do I get printer driver download working
|
|
for OS/2 clients?</A
|
|
></H2
|
|
><P
|
|
>First, create a share called [PRINTDRV] that is
|
|
world-readable. Copy your OS/2 driver files there. Note
|
|
that the .EA_ files must still be separate, so you will need
|
|
to use the original install files, and not copy an installed
|
|
driver from an OS/2 system.</P
|
|
><P
|
|
>Install the NT driver first for that printer. Then,
|
|
add to your smb.conf a paramater, "os2 driver map =
|
|
<TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>filename</I
|
|
></TT
|
|
>". Then, in the file
|
|
specified by <TT
|
|
CLASS="REPLACEABLE"
|
|
><I
|
|
>filename</I
|
|
></TT
|
|
>, map the
|
|
name of the NT driver name to the OS/2 driver name as
|
|
follows:</P
|
|
><P
|
|
><nt driver name> = <os2 driver
|
|
name>.<device name>, e.g.:
|
|
HP LaserJet 5L = LASERJET.HP LaserJet 5L</P
|
|
><P
|
|
>You can have multiple drivers mapped in this file.</P
|
|
><P
|
|
>If you only specify the OS/2 driver name, and not the
|
|
device name, the first attempt to download the driver will
|
|
actually download the files, but the OS/2 client will tell
|
|
you the driver is not available. On the second attempt, it
|
|
will work. This is fixed simply by adding the device name
|
|
to the mapping, after which it will work on the first attempt.
|
|
</P
|
|
></DIV
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><HR><H1
|
|
><A
|
|
NAME="AEN1651"
|
|
>Chapter 10. HOWTO Access Samba source code via CVS</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1658"
|
|
>10.1. Introduction</A
|
|
></H1
|
|
><P
|
|
>Samba is developed in an open environnment. Developers use CVS
|
|
(Concurrent Versioning System) to "checkin" (also known as
|
|
"commit") new source code. Samba's various CVS branches can
|
|
be accessed via anonymouns CVS using the instructions
|
|
detailed in this chapter.</P
|
|
><P
|
|
>This document is a modified version of the instructions found at
|
|
<A
|
|
HREF="http://samba.org/samba/cvs.html"
|
|
TARGET="_top"
|
|
>http://samba.org/samba/cvs.html</A
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><HR><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1663"
|
|
>10.2. CVS Access to samba.org</A
|
|
></H1
|
|
><P
|
|
>The machine samba.org runs a publicly accessible CVS
|
|
repository for access to the source code of several packages,
|
|
including samba, rsync and jitterbug. There are two main ways of
|
|
accessing the CVS server on this host.</P
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1666"
|
|
>10.2.1. Access via CVSweb</A
|
|
></H2
|
|
><P
|
|
>You can access the source code via your
|
|
favourite WWW browser. This allows you to access the contents of
|
|
individual files in the repository and also to look at the revision
|
|
history and commit logs of individual files. You can also ask for a diff
|
|
listing between any two versions on the repository.</P
|
|
><P
|
|
>Use the URL : <A
|
|
HREF="http://samba.org/cgi-bin/cvsweb"
|
|
TARGET="_top"
|
|
>http://samba.org/cgi-bin/cvsweb</A
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><HR><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1671"
|
|
>10.2.2. Access via cvs</A
|
|
></H2
|
|
><P
|
|
>You can also access the source code via a
|
|
normal cvs client. This gives you much more control over you can
|
|
do with the repository and allows you to checkout whole source trees
|
|
and keep them uptodate via normal cvs commands. This is the
|
|
preferred method of access if you are a developer and not
|
|
just a casual browser.</P
|
|
><P
|
|
>To download the latest cvs source code, point your
|
|
browser at the URL : <A
|
|
HREF="http://www.cyclic.com/"
|
|
TARGET="_top"
|
|
>http://www.cyclic.com/</A
|
|
>.
|
|
and click on the 'How to get cvs' link. CVS is free software under
|
|
the GNU GPL (as is Samba). Note that there are several graphical CVS clients
|
|
which provide a graphical interface to the sometimes mundane CVS commands.
|
|
Links to theses clients are also available from http://www.cyclic.com.</P
|
|
><P
|
|
>To gain access via anonymous cvs use the following steps.
|
|
For this example it is assumed that you want a copy of the
|
|
samba source code. For the other source code repositories
|
|
on this system just substitute the correct package name</P
|
|
><P
|
|
></P
|
|
><OL
|
|
TYPE="1"
|
|
><LI
|
|
><P
|
|
> Install a recent copy of cvs. All you really need is a
|
|
copy of the cvs client binary.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Run the command
|
|
</P
|
|
><P
|
|
> <B
|
|
CLASS="COMMAND"
|
|
>cvs -d :pserver:cvs@samba.org:/cvsroot login</B
|
|
>
|
|
</P
|
|
><P
|
|
> When it asks you for a password type <TT
|
|
CLASS="USERINPUT"
|
|
><B
|
|
>cvs</B
|
|
></TT
|
|
>.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Run the command
|
|
</P
|
|
><P
|
|
> <B
|
|
CLASS="COMMAND"
|
|
>cvs -d :pserver:cvs@samba.org:/cvsroot co samba</B
|
|
>
|
|
</P
|
|
><P
|
|
> This will create a directory called samba containing the
|
|
latest samba source code (i.e. the HEAD tagged cvs branch). This
|
|
currently corresponds to the 3.0 development tree.
|
|
</P
|
|
><P
|
|
> CVS branches other HEAD can be obtained by using the <TT
|
|
CLASS="PARAMETER"
|
|
><I
|
|
>-r</I
|
|
></TT
|
|
>
|
|
and defining a tag name. A list of branch tag names can be found on the
|
|
"Development" page of the samba web site. A common request is to obtain the
|
|
latest 2.2 release code. This could be done by using the following command.
|
|
</P
|
|
><P
|
|
> <B
|
|
CLASS="COMMAND"
|
|
>cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_2_2 samba</B
|
|
>
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
> Whenever you want to merge in the latest code changes use
|
|
the following command from within the samba directory:
|
|
</P
|
|
><P
|
|
> <B
|
|
CLASS="COMMAND"
|
|
>cvs update -d -P</B
|
|
>
|
|
</P
|
|
></LI
|
|
></OL
|
|
></DIV
|
|
></DIV
|
|
></DIV
|
|
></DIV
|
|
></BODY
|
|
></HTML
|
|
> |