Table of Contents
- Features and Benefits
- File System Access Controls
- Share Definition Access Controls
- Access Controls on Shares
- MS Windows Access Control Lists and UNIX Interoperability
- Managing UNIX Permissions Using NT Security Dialogs
- Viewing File Security on a Samba Share
- Viewing File Ownership
- Viewing File or Directory Permissions
- Modifying File or Directory Permissions
- Interaction with the Standard Samba “create mask” Parameters
- Interaction with the Standard Samba File Attribute Mapping
- Windows NT/200X ACLs and POSIX ACLs Limitations
- Common Errors
Table of Contents
- Features and Benefits
- File System Access Controls
- Share Definition Access Controls
- Access Controls on Shares
- MS Windows Access Control Lists and UNIX Interoperability
- Managing UNIX Permissions Using NT Security Dialogs
- Viewing File Security on a Samba Share
- Viewing File Ownership
- Viewing File or Directory Permissions
- Modifying File or Directory Permissions
- Interaction with the Standard Samba “create mask” Parameters
- Interaction with the Standard Samba File Attribute Mapping
- Windows NT/200X ACLs and POSIX ACLs Limitations
- Common Errors
+ + + + Advanced MS Windows users are frequently perplexed when file, directory, and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network administrators are often confused regarding network access controls and how to provide users with the access they need while protecting resources from unauthorized access.
- - + + Many UNIX administrators are unfamiliar with the MS Windows environment and in particular have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file and directory access permissions.
- - - - + + + + The problem lies in the differences in how file and directory permissions and controls work between the two environments. This difference is one that Samba cannot completely hide, even though it does try to bridge the chasm to a degree.
- - - - + + + + POSIX Access Control List technology has been available (along with extended attributes) for UNIX for many years, yet there is little evidence today of any significant use. This explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows administrators are astounded at this, given that ACLs were a foundational capability of the now decade-old MS Windows NT operating system.
- + The purpose of this chapter is to present each of the points of control that are possible with Samba-3 in the hope that this will help the network administrator to find the optimum method for delivering the best environment for MS Windows desktop users.
- - + + This is an opportune point to mention that Samba was created to provide a means of interoperability and interchange of data between differing operating environments. Samba has no intent to change UNIX/Linux into a platform like MS Windows. Instead the purpose was and is to provide a sufficient level of exchange of data between the two environments. What is available today extends well beyond early plans and expectations, yet the gap continues to shrink. -
+
Samba offers much flexibility in file system access management. These are the key access control facilities present in Samba today:
Samba Access Control Facilities
- + UNIX File and Directory Permissions
- - - + + + Samba honors and implements UNIX file system access controls. Users who access a Samba server will do so as a particular MS Windows user. This information is passed to the Samba server as part of the logon or @@ -64,7 +64,7 @@
Samba Share Definitions
- + In configuring share settings and controls in the
smb.conffile, the network administrator can exercise overrides to native file system permissions and behaviors. This can be handy and convenient @@ -73,20 +73,20 @@ The basic options and techniques are described herein.- + Just as it is possible in MS Windows NT to set ACLs on shares themselves, so it is possible to do in Samba. Few people make use of this facility, yet it remains one of the easiest ways to affect access controls (restrictions) and can often do so with minimum invasiveness compared with other methods.
- - + + MS Windows ACLs through UNIX POSIX ACLs
- + The use of POSIX ACLs on UNIX/Linux is possible only if the underlying operating system supports them. If not, then this option will not be available to you. Current UNIX technology platforms have native support @@ -94,16 +94,16 @@ this support. Sadly, few Linux platforms ship today with native ACLs and extended attributes enabled. This chapter has pertinent information for users of platforms that support them. -
Perhaps the most important recognition to be made is the simple fact that MS Windows NT4/200x/XP implement a totally divergent file system technology from what is provided in the UNIX operating system environment. First we consider what the most significant differences are, then we look at how Samba helps to bridge the differences. -
+
+
+
+
Samba operates on top of the UNIX file system. This means it is subject to UNIX file system conventions
and permissions. It also means that if the MS Windows networking environment requires file system
behavior, that differs from UNIX file system behavior then somehow Samba is responsible for emulating
@@ -114,7 +114,7 @@
but for the greater part we stay within the bounds of default behavior. Those wishing to explore
the depths of control ability should review the smb.conf man page.
The following compares file system features for UNIX with those of MS Windows NT/200x: - +
- Name Space
MS Windows NT4/200x/XP file names may be up to 254 characters long, and UNIX file names @@ -123,8 +123,8 @@
What MS Windows calls a folder, UNIX calls a directory.
- Case Sensitivity
- - + + MS Windows file names are generally uppercase if made up of 8.3 (8-character file name and 3 character extension. File names that are longer than 8.3 are case preserving and case insensitive. @@ -151,26 +151,26 @@ event that the UNIX directory contains multiple files that would match a case insensitive file listing.
- Directory Separators
- + MS Windows and DOS use the backslash
\as a directory delimiter, and UNIX uses the forward-slash/as its directory delimiter. This is handled transparently by Samba.- Drive Identification
- + MS Windows products support a notion of drive letters, like C:, to represent disk partitions. UNIX has no concept of separate identifiers for file partitions; each such file system is mounted to become part of the overall directory tree. The UNIX directory tree begins at
/just as the root of a DOS drive is specified asC:\.- File Naming Conventions
- + MS Windows generally never experiences file names that begin with a dot (
.), while in UNIX these are commonly found in a user's home directory. Files that begin with a dot (.) are typically startup files for various UNIX applications, or they may be files that contain startup configuration data.- Links and Short-Cuts
- - - + + + MS Windows make use of links and shortcuts that are actually special types of files that will redirect an attempt to execute the file to the real location of the file. UNIX knows of file and directory links, but they are entirely different from what MS Windows users are used to. @@ -183,17 +183,17 @@ There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort in the process of becoming familiar with UNIX/Linux. These are best left for a text that is dedicated to the purpose of UNIX/Linux training and education. -
+ + + There are three basic operations for managing directories: create, delete, rename. Managing Directories with UNIX and Windows compares the commands in Windows and UNIX that implement these operations. -
+ + + The network administrator is strongly advised to read basic UNIX training manuals and reference materials regarding file and directory permissions maintenance. Much can be achieved with the basic UNIX permissions without having to resort to more complex facilities like POSIX ACLs or extended attributes (EAs). @@ -226,47 +226,47 @@
Any bit flag may be unset. An unset bit flag is the equivalent of "cannot" and is represented as a “-” character (see ???) - - - - - - + + + + + +
Example 15.1. Example File
-rwxr-x--- Means:
^^^ The owner (user) can read, write, execute
^^^ the group can read and execute
^^^ everyone else cannot do anything with it.
- - - - + + + + Additional possibilities in the [type] field are c = character device, b = block device, p = pipe device, s = UNIX Domain Socket.
-
-
-
-
-
+
+
+
+
+
The letters rwxXst set permissions for the user, group, and others as read (r), write (w),
execute (or access for directories) (x), execute only if the file is a directory or already has execute
permission for some user (X), set user (SUID) or group ID (SGID) on execution (s), sticky (t).
-
-
-
-
+
+
+
+
When the sticky bit is set on a directory, files in that directory may be unlinked (deleted) or renamed only by root or their owner.
Without the sticky bit, anyone able to write to the directory can delete or rename files. The sticky bit is commonly found on
directories, such as /tmp, that are world-writable.
- - - - - + + + + + When the set user or group ID bit (s) is set on a directory, then all files created within it will be owned by the user and/or group whose `set user or group' bit is set. This can be helpful in setting up directories for which it is desired that all users who are in a group should be able to write to and read from a file, particularly when it is undesirable for that file @@ -276,11 +276,11 @@ the (r) read flags are not set, files cannot be listed (seen) in the directory by anyone. The group can read files in the directory but cannot create new files. If files in the directory are set to be readable and writable for the group, then group members will be able to write to (or delete) them. -
+ + + + People have asked on the Samba mailing list how is it possible to protect files or directories from deletion by users. For example, Windows NT/2K/XP provides the capacity to set access controls on a directory into which people can write files but not delete them. It is possible to set an ACL on a Windows file that permits the file to be written to @@ -288,27 +288,27 @@ anyone who has the ability to create a file can write to it. Anyone who has write permission on the directory that contains a file and has write permission for it has the capability to delete it.
- - - + + + For the record, in the UNIX environment the ability to delete a file is controlled by the permissions on the directory that the file is in. In other words, a user can delete a file in a directory to which that user has write access, even if that user does not own the file.
- - - - + + + + Of necessity, Samba is subject to the file system semantics of the host operating system. Samba is therefore limited in the file system capabilities that can be made available through Windows ACLs, and therefore performs a "best fit" translation to POSIX ACLs. Some UNIX file systems do, however support, a feature known as extended attributes. Only the Windows concept of inheritance is implemented by Samba through the appropriate extended attribute.
-
-
-
-
+
+
+
+
The specific semantics of the extended attributes are not consistent across UNIX and UNIX-like systems such as Linux.
For example, it is possible on some implementations of the extended attributes to set a flag that prevents the directory
or file from being deleted. The extended attribute that may achieve this is called the immutible bit.
@@ -322,7 +322,7 @@
A simple test can be done to check if the immutible flag is supported on files in the file system of the Samba host server. -
Procedure 15.1. Test for File Immutibility Support
+
Procedure 15.1. Test for File Immutibility Support
Create a file called
filename.Login as the
rootuser, then set the immutibile flag on a test file as follows: @@ -340,17 +340,17 @@ that cannot be deleted. Check the man page on your particular host system to determine whether or not immutable directories are writable. If they are not, then the entire directory and its contents will effectively be protected from writing (file creation also) and deletion. -
+
The following parameters in the smb.conf file sections define a share control or affect access controls.
Before using any of the following options, please refer to the man page for smb.conf.
-
+
User- and group-based controls can prove quite useful. In some situations it is distinctly desirable to force all file system operations as if a single user were doing so. The use of the - force user and force group behavior will achieve this. + force user and force group behavior will achieve this. In other situations it may be necessary to use a paranoia level of control to ensure that only particular authorized persons will be able to access a share or its contents. Here the use of the - valid users or the invalid users parameter may be useful. + valid users or the invalid users parameter may be useful.
As always, it is highly advisable to use the easiest to maintain and the least ambiguous method for controlling access. Remember, when you leave the scene, someone else will need to provide assistance, and @@ -358,34 +358,34 @@ Samba being removed and an alternative solution being adopted.
User and Group Based Controls enumerates these controls. -
Table 15.2. User- and Group-Based Controls
Directory permission-based controls, if misused, can result in considerable difficulty in diagnosing the causes of misconfiguration. Use them sparingly and carefully. By gradually introducing each, one at a time, undesirable side effects may be detected. In the event of a problem, always comment all of them out and then gradually reintroduce @@ -393,126 +393,126 @@
Refer to File and Directory Permission Based Controls for information regarding the parameters that may be used to set file and directory permission-based access controls. -
Table 15.3. File and Directory Permission-Based Controls
| Control Parameter | Description, Action, Notes | ||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| create mask | + Table 15.3. File and Directory Permission-Based Controls
|
The parameter documented in Other Controls are often used by administrators
in ways that create inadvertent barriers to file access. Such are the consequences of not understanding the
full implications of smb.conf file settings.
Table 15.4. Other Controls
| Control Parameter | Description, Action, Notes |
|---|---|
| - case sensitive, - default case, - short preserve case + case sensitive, + default case, + short preserve case | This means that all file name lookup will be done in a case-sensitive manner. Files will be created with the precise file name Samba received from the MS Windows client. - |
| csc policy | + |
| csc policy | Client-side caching policy parallels MS Windows client-side file caching capabilities. - |
| dont descend | + |
| dont descend | Allows specifying a comma-delimited list of directories that the server should always show as empty. - |
| dos filetime resolution | + |
| dos filetime resolution | This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. - |
| dos filetimes | + |
| dos filetimes | DOS and Windows allow users to change file timestamps if they can write to the file. POSIX semantics prevent this. This option allows DOS and Windows behavior. - |
| fake oplocks | + |
| fake oplocks | Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an oplock, the client is free to assume that it is the only one accessing the file, and it will aggressively cache file data. |
| - hide dot files, - hide files, - veto files + hide dot files, + hide files, + veto files | Note: MS Windows Explorer allows override of files marked as hidden so they will still be visible. - |
| read only | + |
| read only | If this parameter is yes, then users of a service may not create or modify files in the service's directory. - |
| veto files | + |
| veto files | List of files and directories that are neither visible nor accessible. - |
+
+
+
+
+
This section deals with how to configure Samba per-share access control restrictions.
By default, Samba sets no restrictions on the share itself. Restrictions on the share itself
can be set on MS Windows NT4/200x/XP shares. This can be an effective way to limit who can
connect to a share. In the absence of specific restrictions, the default setting is to allow
the global user Everyone - Full Control (full control, change and read).
- - - + + + At this time Samba does not provide a tool for configuring access control settings on the share itself the only way to create those settings is to use either the NT4 Server Manager or the Windows 200x Microsoft Management Console (MMC) for Computer Management. There are currently no plans to provide this capability in the Samba command-line tool set.
-
-
-
-
+
+
+
+
Samba stores the per-share access control settings in a file called share_info.tdb.
The location of this file on your system will depend on how Samba was compiled. The default location
for Samba's tdb files is under /usr/local/samba/var. If the tdbdump
utility has been compiled and installed on your system, then you can examine the contents of this file
by executing tdbdump share_info.tdb in the directory containing the tdb files.
-
+
The best tool for share permissions management is platform-dependent. Choose the best tool for your environment. -
+ + + + The tool you need to manage share permissions on a Samba server from a Windows NT4 Workstation or Server is the NT Server Manager. Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. You can obtain the NT Server Manager for MS Windows NT4 Workstation from the Microsoft web site support section. -
Procedure 15.2. Instructions
+
Procedure 15.2. Instructions
Launch the NT4 Server Manager and click on the Samba server you want to administer. From the menu select , then click on .
Click on the share that you wish to manage and click the Properties tab, then click the Permissions tab. Now you can add or change access control settings as you wish. -
+ + + + On MS Windows NT4/200x/XP system, ACLs on the share itself are set using native tools, usually from File Manager. For example, in Windows 200x, right-click on the shared folder, then select , then click on Permissions. The default Windows NT4/200x permission allows "Everyone" full control on the share.
- - - + + + MS Windows 200x and later versions come with a tool called the Computer Management snap-in for the MMC. This tool is located by clicking on . -
Procedure 15.3. Instructions
+
Procedure 15.3. Instructions
After launching the MMC with the Computer Management snap-in, click the menu item and select Connect to another computer. If you are not logged onto a domain you will be prompted to enter a domain login user identifier and a password. This will authenticate you to the domain. @@ -523,7 +523,7 @@ System Tools, then on the next to Shared Folders in the left panel.
- + In the right panel, double-click on the share on which you wish to set access control permissions. Then click the tab Share Permissions. It is now possible to add access control entities to the shared folder. Remember to set what type of access (full control, change, read) you @@ -534,8 +534,8 @@ ACL precedence. Everyone with no access means that
MaryKwho is part of the groupEveryonewill have no access even if she is given explicit full control access. -
+ Windows NT clients can use their native security settings dialog box to view and modify the underlying UNIX permissions.
@@ -549,7 +549,7 @@ When trying to figure out file access problems, it is vitally important to find the identity of the Windows user as it is presented by Samba at the point of file access. This can best be determined from the Samba log files. -
From an NT4/2000/XP client, right-click on any file or directory in a Samba-mounted drive letter
or UNC path. When the menu pops up, click on the Properties entry at the bottom
of the menu. This brings up the file Properties dialog box. Click on the
@@ -560,7 +560,7 @@
to add auditing requirements to a file if the user is logged on as the NT administrator. This dialog is
nonfunctional with a Samba share at this time, because the only useful button, the
button, will not currently allow a list of users to be seen.
-
Clicking on the button brings up a dialog box telling you who owns the given file. The owner name will be displayed like this:
@@ -571,10 +571,10 @@ descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). Click on the button to remove this dialog.- If the parameter nt acl support is set to
false, + If the parameter nt acl support is set tofalse, the file owner will be shown as the NT user Everyone.- + The button will not allow you to change the ownership of this file to yourself (clicking it will display a dialog box complaining that the user as whom you are currently logged onto the NT client cannot be found). The reason for this is that changing the ownership of a file is a privileged @@ -582,14 +582,14 @@ NT to attempt to change the ownership of a file to the current user logged into the NT client, this will not work with Samba at this time.
- - - + + + There is an NT chown command that will work with Samba and allow a user with administrator privilege connected to a Samba server as root to change the ownership of files on both a local NTFS file system or remote mounted NTFS or Samba drive. This is available as part of the Seclib NT security library written by Jeremy Allison of the Samba Team and is downloadable from the main Samba FTP site. -
The third button is the button. Clicking on it brings up a dialog box that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed like this:
SERVER\
@@ -598,12 +598,12 @@
user is the username of the UNIX user who owns the file, and
(Long name) is the descriptive string identifying the user (normally found in the
GECOS field of the UNIX password database).
- If the parameter nt acl support is set to false,
+ If the parameter nt acl support is set to false,
the file owner will be shown as the NT user Everyone, and the permissions will be
shown as NT Full Control.
The permissions field is displayed differently for files and directories. Both are discussed next. -
+
The standard UNIX user/group/world triplet and the corresponding read, write,
execute permissions triplets are mapped by Samba into a three-element NT ACL with the
“r”, “w”, and “x” bits mapped into the corresponding NT
@@ -621,7 +621,7 @@
Take Ownership ACL attribute (which has no meaning in UNIX) and reports a component with
no permissions as having the NT O bit set. This was chosen, of course, to make it look
like a zero, meaning zero permissions. More details on the decision behind this action are given below.
-
Directories on an NT NTFS file system have two different sets of permissions. The first set is the ACL set on the
directory itself, which is usually displayed in the first set of parentheses in the normal RW
NT style. This first set of permissions is created by Samba in exactly the same way as normal file permissions are, described
@@ -632,13 +632,13 @@
Samba synthesizes these inherited permissions for NT by returning as an NT ACL the UNIX permission mode that a new file created by Samba on this share would receive. -
Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box and clicking on . However, there are limitations that a user needs to be aware of, and also interactions with the standard Samba permission masks and mapping of DOS attributes that also need to be taken into account.
- If the parameter nt acl support is set to false, any attempt to
+ If the parameter nt acl support is set to false, any attempt to
set security permissions will fail with an "Access Denied" message.
The first thing to note is that the button will not return a list of users in Samba
@@ -665,39 +665,39 @@
If you wish to remove all permissions from a user/group/world component, you may either highlight the
component and click on the button or set the component to only have the special
Take Ownership permission (displayed as O) highlighted.
-
There are four parameters that control interaction with the standard Samba create mask parameters:
+
There are four parameters that control interaction with the standard Samba create mask parameters:
-
+
When a user clicks on to apply the permissions, Samba maps the given permissions into a user/group/world r/w/x triplet set, and then checks the changed permissions for a file against the bits set in the - security mask parameter. Any bits that + security mask parameter. Any bits that were changed that are not set to 1 in this parameter are left alone in the file permissions.
- Essentially, zero bits in the security mask + Essentially, zero bits in the security mask may be treated as a set of bits the user is not allowed to change, and one bits are those the user is allowed to change.
If not explicitly set, this parameter defaults to the same value as - the create mask parameter. To allow a user to modify all the + the create mask parameter. To allow a user to modify all the user/group/world permissions on a file, set this parameter to 0777.
Next Samba checks the changed permissions for a file against the bits set in the - force security mode parameter. Any bits + force security mode parameter. Any bits that were changed that correspond to bits set to 1 in this parameter are forced to be set.
Essentially, bits set in the force security mode parameter
may be treated as a set of bits that, when modifying security on a file, the user
has always set to be on.
If not explicitly set, this parameter defaults to the same value
- as the force create mode parameter.
+ as the force create mode parameter.
To allow a user to modify all the user/group/world permissions on a file
with no restrictions, set this parameter to 000. The
- security mask and force
+ security mask and force
security mode parameters are applied to the change
request in that order.
For a directory, Samba performs the same operations as
@@ -706,11 +706,11 @@
mask, and force directory security mode
parameter instead of force security mode
.
- The directory security mask parameter
+ The directory security mask parameter
by default is set to the same value as the directory mask
parameter and the force directory security
mode parameter by default is set to the same value as
- the force directory mode parameter.
+ the force directory mode parameter.
In this way Samba enforces the permission restrictions that
an administrator can set on a Samba share, while still allowing users
to modify the permission bits within that restriction.
@@ -719,7 +719,7 @@
does not force any particular bits to be set on,
then set the following parameters in the smb.conf file in that
share-specific section:
-
security mask = 0777 |
force security mode = 0 |
directory security mask = 0777 |
force directory security mode = 0 |
Note
+
security mask = 0777 |
force security mode = 0 |
directory security mask = 0777 |
force directory security mode = 0 |
Note
Samba maps some of the DOS attribute bits (such as “read-only”) into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security @@ -740,7 +740,7 @@ attributes dialog, you should always press rather than to ensure that your changes are not overridden. -
Windows administrators are familiar with simple ACL controls, and they typically consider that UNIX user/group/other (ugo) permissions are inadequate and not sufficiently fine-grained. @@ -768,7 +768,7 @@ ACLs as implemented in UNIX file systems. Samba provides support for masks that permit normal ugo and ACLs functionality to be overrided. This further complicates the way in which Windows ACLs must be implemented. -
+
In examining POSIX ACLs we must consider the manner in which they operate for both files and directories. File ACLs have the following significance:
@@ -797,7 +797,7 @@ default:mask:rwx <-- inherited default mask default:other:--- <-- inherited permissions for everyone (other)
-
Microsoft Windows NT4/200X ACLs must of necessity be mapped to POSIX ACLs. The mappings for file permissions are shown in How Windows File ACLs Map to UNIX POSIX File ACLs. @@ -816,7 +816,7 @@ The UNIX administrator can set any directory permission from within the UNIX environment. The Windows administrator is more restricted in that it is not possible from within Windows Explorer to remove read permission for the file owner. -
Interesting things happen in the mapping of UNIX POSIX directory permissions and UNIX POSIX ACLs to Windows ACEs (Access Control Entries, the discrete components of an ACL) are mapped to Windows directory ACLs. @@ -824,10 +824,10 @@ Directory permissions function in much the same way as shown for file permissions, but there are some notable exceptions and a few peculiarities that the astute administrator will want to take into account in the setting up of directory permissions. -
File, directory, and share access problems are common topics on the mailing list. The following are examples recently taken from the mailing list. -
+
“
We are facing some troubles with file/directory permissions. I can log on the domain as admin user (root),
and there's a public share on which everyone needs to have permission to create/modify files, but only
@@ -885,17 +885,17 @@
Now in your
+
These procedures are needed only if your users are not members of the group
you have used that is, if within the OS they do not have write permission on the directory.
An alternative is to set in the
- smb.conf for the share add:
- force create mode = 0775force directory mode = 6775force create mode = 0775force directory mode = 6775Note
smb.conf entry for the share:
- force user = jackforce group = engr
+ When you have a user in admin users, Samba will always do file operations for + this user as root, even if force user has been set. +
Question: “When user B saves a word document that is owned by user A, the updated file is now owned by user B. Why is Samba doing this? How do I fix this?”
@@ -910,7 +910,7 @@
in which you are changing Word documents: chmod g+s `directory_name'. This ensures that all files will
be created with the group that owns the directory. In smb.conf share declaration section set:
-
force create mode = 0660 |
force directory mode = 0770 |
+
force create mode = 0660 |
force directory mode = 0770 |
These two settings will ensure that all directories and files that get created in the share will be readable/writable by the owner and group set on the directory itself. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/AdvancedNetworkManagement.html samba-3.0.20/docs/htmldocs/Samba3-HOWTO/AdvancedNetworkManagement.html --- samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/AdvancedNetworkManagement.html 2005-08-07 11:25:09.000000000 -0500 +++ samba-3.0.20/docs/htmldocs/Samba3-HOWTO/AdvancedNetworkManagement.html 2005-08-19 13:03:41.000000000 -0500 @@ -1,9 +1,9 @@ -
Table of Contents
Table of Contents
+ This section documents peripheral issues that are of great importance to network administrators who want to improve network resource access control, to automate the user environment, and to make their lives a little easier. -
+
Often the difference between a working network environment and a well-appreciated one can best be measured by the little things that make everything work more harmoniously. A key part of every network environment solution is the ability to remotely @@ -13,48 +13,48 @@
This chapter presents information on each of these areas. They are placed here, and not in other chapters, for ease of reference. -
“How do I get User Manager and Server Manager?”
+ + + Since I do not need to buy an NT4 server, how do I get the User Manager for Domains and the Server Manager?
-
-
+
+
Microsoft distributes a version of these tools called Nexus.exe for installation
on Windows 9x/Me systems. The tools set includes:
Server Manager
User Manager for Domains
Event Viewer
Download the archived file at the Microsoft Nexus link.
- - - + + + The Windows NT 4.0 version of the User Manager for Domains and Server Manager are available from Microsoft via ftp. -
+ + There are a number of possible remote desktop management solutions that range from free through costly. Do not let that put you off. Sometimes the most costly solution is the most cost effective. In any case, you will need to draw your own conclusions as to which is the best tool in your network environment. -
+ The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. It is presented in slightly edited form (with author details omitted for privacy reasons). The entire answer is reproduced below with some comments removed.
“ - + I have a wonderful Linux/Samba server running as PDC for a network. Now I would like to add remote desktop capabilities so users outside could login to the system and get their desktop up from home or another country. ”
“ - - - - + + + + Is there a way to accomplish this? Do I need a Windows Terminal server? Do I need to configure it so it is a member of the domain or a BDC or PDC? Are there any hacks for MS Windows XP to enable remote login even if the computer is in a domain? @@ -62,22 +62,22 @@ Answer provided: Check out the new offer of “NX” software from NoMachine.
- - - + + + It implements an easy-to-use interface to the Remote X protocol as well as incorporating VNC/RFB and rdesktop/RDP into it, but at a speed performance much better than anything you may have ever seen.
- + Remote X is not new at all, but what they did achieve successfully is a new way of compression and caching technologies that makes the thing fast enough to run even over slow modem/ISDN connections.
- - - - + + + + I test drove their (public) Red Hat machine in Italy, over a loaded Internet connection, with enabled thumbnail previews in KDE konqueror, which popped up immediately on “mouse-over”. From inside that (remote X) @@ -85,18 +85,18 @@ To test the performance, I played Pinball. I am proud to announce that my score was 631,750 points at first try.
- - - - + + + + NX performs better on my local LAN than any of the other “pure” connection methods I use from time to time: TightVNC, rdesktop or Remote X. It is even faster than a direct crosslink connection between two nodes.
- - - + + + I even got sound playing from the Remote X app to my local boxes, and had a working “copy'n'paste” from an NX window (running a KDE session in Italy) to my Mozilla mailing agent. These guys are certainly doing @@ -118,7 +118,7 @@ full-screen, and after a short time you forget that it is a remote session at all).
- + Now the best thing for last: All the core compression and caching technologies are released under the GPL and available as source code to anybody who wants to build on it! These technologies are working, @@ -140,15 +140,15 @@ you can now use a (very inconvenient) command line at no cost, but you can buy a comfortable (proprietary) NX GUI front end for money.
- - - - - + + + + + NoMachine is encouraging and offering help to OSS/Free Software implementations for such a front-end too, even if it means competition to them (they have written to this effect even to the LTSP, KDE, and GNOME developer mailing lists). -
There are several opportunities for creating a custom network startup configuration environment.
No Logon Script.
Simple universal Logon Script that applies to all users.
Use of a conditional Logon Script that applies per-user or per-group attributes.
Use of Samba's preexec and postexec functions on access to the NETLOGON share to create a custom logon script and then execute it.
User of a tool such as KixStart.
@@ -158,7 +158,7 @@
The following listings are from the genlogon directory.
-
+
This is the genlogon.pl file:
@@ -237,15 +237,15 @@
Those wishing to use a more elaborate or capable logon processing system should check out these sites: -
+ Printers may be added automatically during logon script processing through the use of:
C:\>rundll32 printui.dll,PrintUIEntry /?
See the documentation in the Microsoft Knowledge Base article 189105. -
Sometimes it is necessary to limit the number of concurrent connections to a Samba shared resource. For example, a site may wish to permit only one network logon per user. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/Appendix.html samba-3.0.20/docs/htmldocs/Samba3-HOWTO/Appendix.html --- samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/Appendix.html 2005-08-07 11:25:20.000000000 -0500 +++ samba-3.0.20/docs/htmldocs/Samba3-HOWTO/Appendix.html 2005-08-19 13:03:50.000000000 -0500 @@ -1 +1 @@ -
Table of Contents
- 40. How to Compile Samba
- 41. Portability
- 42. Samba and Other CIFS Clients
- 43. Samba Performance Tuning
- 44. LDAP and Transport Layer Security
- 45. Samba Support
- 46. DNS and DHCP Configuration Guide
Table of Contents
- 40. How to Compile Samba
- 41. Portability
- 42. Samba and Other CIFS Clients
- 43. Samba Performance Tuning
- 44. LDAP and Transport Layer Security
- 45. Samba Support
- 46. DNS and DHCP Configuration Guide
Table of Contents
Table of Contents
+ + + + The Samba project is over 10 years old. During the early history of Samba, UNIX administrators were its key implementors. UNIX administrators use UNIX system tools to backup UNIX system files. Over the past 4 years, an increasing number of Microsoft network administrators have taken an interest in Samba. This is reflected in the questions about backup in general on the Samba mailing lists. -
+ + During discussions at a Microsoft Windows training course, one of the pro-UNIX delegates stunned the class when he pointed out that Windows NT4 is limiting compared with UNIX. He likened UNIX to a Meccano set that has an unlimited number of tools that are simple, efficient, and, in combination, capable of achieving any desired outcome.
- - + + One of the Windows networking advocates retorted that if she wanted a Meccano set, she would buy one. She made it clear that a complex single tool that does more than is needed but does it with a clear purpose and intent is preferred by some like her.
- - - + + + Please note that all information here is provided as is and without recommendation of fitness or suitability. The network administrator is strongly encouraged to perform due diligence research before implementing any backup solution, whether free @@ -38,31 +38,31 @@ www.allmerchants.com.
The following three free software projects might also merit consideration. -
+ + + BackupPC version 2.0.0 has been released on SourceForge. New features include support for rsync/rsyncd and internationalization of the CGI interface (including English, French, Spanish, and German).
- - - - - - - - + + + + + + + + BackupPC is a high-performance Perl-based package for backing up Linux, UNIX, and Windows PCs and laptops to a server's disk. BackupPC is highly configurable and easy to install and maintain. SMB (via smbclient), tar over rsh/ssh, or rsync/rsyncd are used to extract client data.
- - - + + + Given the ever-decreasing cost of disks and RAID systems, it is now practical and cost effective to backup a large number of machines onto a server's local disk or network storage. This is what BackupPC does. @@ -71,24 +71,24 @@ space), compression, and a comprehensive CGI interface that allows users to browse backups and restore files.
- + BackupPC is free software distributed under a GNU GPL license. BackupPC runs on Linux/UNIX/freenix servers and has been tested on Linux, UNIX, Windows 9x/Me, Windows 98, Windows 200x, Windows XP, and Mac OSX clients. -
+ + + + + + rsync is a flexible program for efficiently copying files or directory trees.
rsync has many options to select which files will be copied and how they are to be transferred. It may be used as an alternative to ftp, http, scp, or rcp.
- - - + + + The rsync remote-update protocol allows rsync to transfer just the differences between two sets of files across the network link, using an efficient checksum-search algorithm described in the @@ -107,10 +107,10 @@
Support for anonymous or authenticated rsync servers (ideal for mirroring). -
+ + + Amanda, the Advanced Maryland Automatic Network Disk Archiver, is a backup system that allows the administrator of a LAN to set up a single master backup server to back up multiple hosts to a single large capacity tape drive. Amanda uses native dump and/or @@ -119,8 +119,8 @@
For more information regarding Amanda, please check the www.amanda.org/ site. -
+ Browseable Online Backup System (BOBS) is a complete online backup system. Uses large disks for storing backups and lets users browse the files using a Web browser. Handles some special files like AppleDouble and icon files. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/bugreport.html samba-3.0.20/docs/htmldocs/Samba3-HOWTO/bugreport.html --- samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/bugreport.html 2005-08-07 11:25:17.000000000 -0500 +++ samba-3.0.20/docs/htmldocs/Samba3-HOWTO/bugreport.html 2005-08-19 13:03:48.000000000 -0500 @@ -1,6 +1,6 @@ -
Table of Contents
Table of Contents
+ + Please report bugs using Samba's Bugzilla facilities and take the time to read this file before you submit a bug report. Also, check to see if it has changed between releases, as we may be changing the bug reporting mechanism at some point. @@ -12,9 +12,9 @@ and a fix if you send us a “developer-friendly” bug report that lets us fix it fast.
- - - + + + If you post the bug to the comp.protocols.smb newsgroup or the mailing list, do not assume that we will read it. If you suspect that your problem is not a bug but a configuration problem, it is better to send @@ -24,7 +24,7 @@ You may also like to look though the recent mailing list archives, which are conveniently accessible on the Samba Web pages at http://samba.org/samba/. -
Before submitting a bug report, check your config for silly errors. Look in your log files for obvious messages that tell you've misconfigured something. Run testparm to check your config @@ -42,42 +42,42 @@ 10 showing the problem may be appropriate. A higher level gives more detail but may use too much disk space.
-
-
-To set the debug level, use the log level in your
+
+
+To set the debug level, use the log level in your
smb.conf. You may also find it useful to set the log
level higher for just one machine and keep separate logs for each machine.
To do this, add the following lines to your main smb.conf file:
-
log level = 10 |
log file = /usr/local/samba/lib/log.%m |
include = /usr/local/samba/lib/smb.conf.%m |
+
log level = 10 |
log file = /usr/local/samba/lib/log.%m |
include = /usr/local/samba/lib/smb.conf.%m |
and create a file /usr/local/samba/lib/smb.conf. where
machinemachine is the name of the client you wish to debug. In that file put any
-smb.conf commands you want; for example, log level may be useful. This also allows
+smb.conf commands you want; for example, log level may be useful. This also allows
you to experiment with different security systems, protocol levels, and so on, on just one machine.
-The smb.conf entry log level is synonymous with the parameter debuglevel that has been used in older versions of Samba and is being retained for backward
+The smb.conf entry log level is synonymous with the parameter debuglevel that has been used in older versions of Samba and is being retained for backward
compatibility of smb.conf files.
-As the log level value is increased, you will record a significantly greater level of
+As the log level value is increased, you will record a significantly greater level of
debugging information. For most debugging operations, you may not need a setting higher than
3. Nearly all bugs can be tracked at a setting of 10, but be
prepared for a large volume of log data.
-
+ + + + Samba-3.x permits debugging (logging) of specific functional components without unnecessarily cluttering the log files with detailed logs for all operations. An example configuration to achieve this is shown in:
-
log level = 0 tdb:3 passdb:5 auth:4 vfs:2 |
max log size = 0 |
log file = /var/log/samba/%U.%m.log |
+
log level = 0 tdb:3 passdb:5 auth:4 vfs:2 |
max log size = 0 |
log file = /var/log/samba/%U.%m.log |
This will cause the level of detail to be expanded to the debug class (log level) passed to
each functional area per the value shown above. The first value passed to the log level
of 0 means turn off all unnecessary debugging except the debug classes set for
the functional areas as specified. The table shown in Debuggable Functions
may be used to attain very precise analysis of each SMB operation Samba is conducting.
-
If you get the message “INTERNAL ERROR” in your log files, it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless @@ -91,35 +91,35 @@ You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed.
-
+
You may also find that a core file appeared in a corefiles
subdirectory of the directory where you keep your Samba log
files. This file is the most useful tool for tracking down the bug. To
use it, you do this:
-
-
+
+
$gdb smbd core
-
-
+
+
adding appropriate paths to smbd and core so gdb can find them. If you
do not have gdb, try dbx. Then within the debugger,
use the command where to give a stack trace of where the
problem occurred. Include this in your report.
- + If you know any assembly language, do a disass of the routine where the problem occurred (if it's in a library routine, then disassemble the routine that called it) and try to work out exactly where the problem is by looking at the surrounding code. Even if you do not know assembly, including this information in the bug report can be useful. -
+ + + Unfortunately, some UNIXes (in particular some recent Linux kernels) refuse to dump a core file if the task has changed UID (which smbd does often). To debug with this sort of system, you could try to attach @@ -145,12 +145,12 @@
root# gdb /usr/local/samba/sbin/smbd
- + then “attach `pid'” (of the spinning process), then type “bt” to get a backtrace to see where the smbd is in the call path. -
+
+
The best sort of bug report is one that includes a fix! If you send us
patches, please use diff -u format if your version of
diff supports it; otherwise, use diff -c4. Make sure
diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/cfgsmarts.html samba-3.0.20/docs/htmldocs/Samba3-HOWTO/cfgsmarts.html
--- samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/cfgsmarts.html 2005-08-07 11:25:14.000000000 -0500
+++ samba-3.0.20/docs/htmldocs/Samba3-HOWTO/cfgsmarts.html 2005-08-19 13:03:45.000000000 -0500
@@ -1,52 +1,52 @@
-
Table of Contents
Table of Contents
+ + Since the release of the first edition of this book there have been repeated requests to better document configuration techniques that may help a network administrator to get more out of Samba. Some users have asked -for documentation regarding the use of the include = file-name parameter. +for documentation regarding the use of the include = file-name parameter.
- - + + Commencing around mid-2004 there has been increasing interest in the ability to host multiple Samba servers on one machine. There has also been an interest in the hosting of multiple Samba server personalities on one server.
- - + + Feedback from technical reviewers made the inclusion of this chapter a necessity. So, here is an answer the questions that have to date not been adequately addressed. Additional user input is welcome as it will help this chapter to mature. What is presented here is just a small beginning.
- - - + + + There are a number of ways in which multiple servers can be hosted on a single Samba server. Multiple server hosting makes it possible to host multiple domain controllers on one machine. Each such machine is independent, and each can be stopped or started without affecting another.
- - - + + + Sometimes it is desirable to host multiple servers, each with its own security mode. For example, a single UNIX/Linux host may be a domain member server (DMS) as well as a generic anonymous print server. In this case, only domain member machines and domain users can access the DMS, but even guest users can access the generic print server. Another example of a situation where it may be beneficial to host a generic (anonymous) server is to host a CDROM server.
- - + + Some environments dictate the need to have separate servers, each with their own resources, each of which are accessible only by certain users or groups. This is one of the simple, but highly effective, ways that Samba can replace many physical Windows servers in one Samba installation. -
-
+
+
+
+
+
+
+
+
The use of multiple server hosting involves running multiple separate instances of Samba, each with it's own
configuration file. This method is complicated by the fact that each instance of nmbd, smbd and winbindd
must have write access to entirely separate TDB files. The ability to keep separate the TDB files used by
@@ -54,78 +54,78 @@
own default TDB directories, or by configuring these in the smb.conf file, in which case each instance of
nmbd, smbd and winbindd must be told to start up with its own smb.conf configuration file.
- - - - + + + + Each instance should operate on its own IP address (that independent IP address can be an IP Alias). Each instance of nmbd, smbd and winbindd should listen only on its own IP socket. This can be secured -using the socket address parameter. Each instance of the Samba server will have its +using the socket address parameter. Each instance of the Samba server will have its own SID also, this means that the servers are discrete and independent of each other.
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
The user of multiple server hosting is non-trivial, and requires careful configuration of each aspect of
process management and start up. The smb.conf parameters that must be carefully configured includes:
-private dir, pid directory,lock directory, interfaces, bind interfaces only, netbios name, workgroup, socket address.
+private dir, pid directory,lock directory, interfaces, bind interfaces only, netbios name, workgroup, socket address.
- - - + + + Those who elect to create multiple Samba servers should have the ability to read and follow the Samba source code, and to modify it as needed. This mode of deployment is considered beyond the scope of this book. However, if someone will contribute more comprehensive documentation we will gladly review it, and if it is suitable extend this section of this chapter. Until such documentation becomes available the hosting of multiple samba servers on a single host is considered not supported for Samba-3 by the Samba Team. -
+
+
+
Samba has the ability to host multiple virtual servers, each of which have their own personality. This is
achieved by configuring an smb.conf file that is common to all personalities hosted. Each server
-personality is hosted using its own netbios alias name, and each has its own distinct
-[global] section. Each server may have its own stanzas for services and meta-services.
+personality is hosted using its own netbios alias name, and each has its own distinct
+[global] section. Each server may have its own stanzas for services and meta-services.
- - - + + + When hosting multiple virtual servers, each with their own personality, each can be in a different workgroup. Only the primary server can be a domain member or a domain controller. The personality is defined by the -combination of the security mode it is operating in, the netbios aliases it has, and the workgroup that is defined for it. +combination of the security mode it is operating in, the netbios aliases it has, and the workgroup that is defined for it.
-
-
-
-
-
-
+
+
+
+
+
+
This configuration style can be used either with NetBIOS names, or using NetBIOS-less SMB over TCP services.
-If run using NetBIOS mode (the most common method) it is important that the parameter smb ports = 139 should be specified in the primary smb.conf file. Failure to do this will result
+If run using NetBIOS mode (the most common method) it is important that the parameter smb ports = 139 should be specified in the primary smb.conf file. Failure to do this will result
in Samba operating over TCP port 445 and problematic operation at best, and at worst only being able to obtain
the functionality that is specified in the primary smb.conf file. The use of NetBIOS over TCP/IP using only
-TCP port 139 means that the use of the %L macro is fully enabled. If the smb ports = 139 is not specified (the default is 445 139, or if
+TCP port 139 means that the use of the %L macro is fully enabled. If the smb ports = 139 is not specified (the default is 445 139, or if
the value of this parameter is set at 139 445 then the %L macro
is not serviceable.
-
-
-
-
+
+
+
+
It is possible to host multiple servers, each with their own personality, using port 445 (the NetBIOS-less SMB
port), in which case the %i macro can be used to provide separate server identities (by
-IP Address). Each can have its own security mode. It will be necessary to use the
-interfaces, bind interfaces only and IP aliases in addition to
-the netbios name parameters to create the virtual servers. This method is considerably
+IP Address). Each can have its own security mode. It will be necessary to use the
+interfaces, bind interfaces only and IP aliases in addition to
+the netbios name parameters to create the virtual servers. This method is considerably
more complex than that using NetBIOS names only using TCP port 139.
-
+
Consider an example environment that consists of a standalone, user-mode security Samba server and a read-only
Windows 95 file server that has to be replaced. Instead of replacing the Windows 95 machine with a new PC, it
is possible to add this server as a read-only anonymous file server that is hosted on the Samba server. Here
@@ -135,46 +135,46 @@
The CDROM server is called CDSERVER and its workgroup is ARTSDEPT. A
possible implementation is shown here:
-
-
-
-
+
+
+
+
The smb.conf file for the master server is shown in Elastic smb.conf File.
This file is placed in the /etc/samba directory. Only the nmbd and the smbd daemons
are needed. When started the server will appear in Windows Network Neighborhood as the machine
ELASTIC under the workgroup ROBINSNEST. It is helpful if the Windows
clients that must access this server are also in the workgroup ROBINSNEST as this will make
browsing much more reliable.
-
Example 33.1. Elastic smb.conf File
| # Global parameters |
[global] |
workgroup = ROBINSNEST |
netbios name = ELASTIC |
netbios aliases = CDSERVER |
smb ports = 139 |
printcap name = cups |
disable spoolss = Yes |
show add printer wizard = No |
printing = cups |
include = /etc/samba/smb-%L.conf |
[homes] |
comment = Home Directories |
valid users = %S |
read only = No |
browseable = No |
[office] |
comment = Data |
path = /data |
read only = No |
[printers] |
comment = All Printers |
path = /var/spool/samba |
create mask = 0600 |
guest ok = Yes |
printable = Yes |
use client driver = Yes |
browseable = No |
Example 33.1. Elastic smb.conf File
| # Global parameters |
[global] |
workgroup = ROBINSNEST |
netbios name = ELASTIC |
netbios aliases = CDSERVER |
smb ports = 139 |
printcap name = cups |
disable spoolss = Yes |
show add printer wizard = No |
printing = cups |
include = /etc/samba/smb-%L.conf |
[homes] |
comment = Home Directories |
valid users = %S |
read only = No |
browseable = No |
[office] |
comment = Data |
path = /data |
read only = No |
[printers] |
comment = All Printers |
path = /var/spool/samba |
create mask = 0600 |
guest ok = Yes |
printable = Yes |
use client driver = Yes |
browseable = No |
+
The configuration file for the CDROM server is listed in CDROM Server
smb-cdserver.conf file. This file is called smb-cdserver.conf and it should be
located in the /etc/samba directory. Machines that are in the workgroup
ARTSDEPT will be able to browse this server freely.
-
Example 33.2. CDROM Server smb-cdserver.conf file
| # Global parameters |
[global] |
workgroup = ARTSDEPT |
netbios name = CDSERVER |
map to guest = Bad User |
guest ok = Yes |
[carousel] |
comment = CDROM Share |
path = /export/cddata |
read only = Yes |
guest ok = Yes |
Example 33.2. CDROM Server smb-cdserver.conf file
| # Global parameters |
[global] |
workgroup = ARTSDEPT |
netbios name = CDSERVER |
map to guest = Bad User |
guest ok = Yes |
[carousel] |
comment = CDROM Share |
path = /export/cddata |
read only = Yes |
guest ok = Yes |
+
+
+
+
The two servers have different resources and are in separate workgroups. The server ELASTIC
can only be accessed by uses who have an appropriate account on the host server. All users will be able to
access the CDROM data that is stored in the /export/cddata directory. File system
permissions should set so that the others user has read-only access to the directory and its
contents. The files can be owned by root (any user other than the nobody account).
-
+
+
+
In this example, the requirement is for a primary domain controller for the domain called
MIDEARTH. The PDC will be called MERLIN. An extra machine called
SAURON is required. Each machine will have only its own shares. Both machines belong to the
same domain/workgroup.
-
-
-
+
+
+
The master smb.conf file is shown in the Master smb.conf File Global Section.
The two files that specify the share information for each server are shown in the
smb-merlin.conf File Share Section, and the smb-sauron.conf File Share
Section. All three files are locate in the /etc/samba directory.
-
Example 33.3. Master smb.conf File Global Section
| # Global parameters |
[global] |
workgroup = MIDEARTH |
netbios name = MERLIN |
netbios aliases = SAURON |
passdb backend = tdbsam |
smb ports = 139 |
syslog = 0 |
printcap name = CUPS |
show add printer wizard = No |
add user script = /usr/sbin/useradd -m '%u' |
delete user script = /usr/sbin/userdel -r '%u' |
add group script = /usr/sbin/groupadd '%g' |
delete group script = /usr/sbin/groupdel '%g' |
add user to group script = /usr/sbin/usermod -G '%g' '%u' |
add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u' |
logon script = scripts\login.bat |
logon path = |
logon drive = X: |
domain logons = Yes |
preferred master = Yes |
wins support = Yes |
printing = CUPS |
include = /etc/samba/smb-%L.conf |
Example 33.4. MERLIN smb-merlin.conf File Share Section
| # Global parameters |
[global] |
workgroup = MIDEARTH |
netbios name = MERLIN |
[homes] |
comment = Home Directories |
valid users = %S |
read only = No |
browseable = No |
[office] |
comment = Data |
path = /data |
read only = No |
[netlogon] |
comment = NETLOGON |
path = /var/lib/samba/netlogon |
read only = Yes |
browseable = No |
[printers] |
comment = All Printers |
path = /var/spool/samba |
printable = Yes |
use client driver = Yes |
browseable = No |
Example 33.3. Master smb.conf File Global Section
| # Global parameters |
[global] |
workgroup = MIDEARTH |
netbios name = MERLIN |
netbios aliases = SAURON |
passdb backend = tdbsam |
smb ports = 139 |
syslog = 0 |
printcap name = CUPS |
show add printer wizard = No |
add user script = /usr/sbin/useradd -m '%u' |
delete user script = /usr/sbin/userdel -r '%u' |
add group script = /usr/sbin/groupadd '%g' |
delete group script = /usr/sbin/groupdel '%g' |
add user to group script = /usr/sbin/usermod -G '%g' '%u' |
add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u' |
logon script = scripts\login.bat |
logon path = |
logon drive = X: |
domain logons = Yes |
preferred master = Yes |
wins support = Yes |
printing = CUPS |
include = /etc/samba/smb-%L.conf |
Example 33.4. MERLIN smb-merlin.conf File Share Section
| # Global parameters |
[global] |
workgroup = MIDEARTH |
netbios name = MERLIN |
[homes] |
comment = Home Directories |
valid users = %S |
read only = No |
browseable = No |
[office] |
comment = Data |
path = /data |
read only = No |
[netlogon] |
comment = NETLOGON |
path = /var/lib/samba/netlogon |
read only = Yes |
browseable = No |
[printers] |
comment = All Printers |
path = /var/spool/samba |
printable = Yes |
use client driver = Yes |
browseable = No |
Table of Contents
Table of Contents
+ One of the most difficult to answer questions in the information technology industry is, “What is support?”. That question irritates some folks, as much as common answers may annoy others.
- + The most aggravating situation pertaining to support is typified when, as a Linux user, a call is made to an Internet service provider who, instead of listening to the problem to find a solution, blandly replies: “Oh, Linux? We do not support Linux!”. It has happened to me, and similar situations happen @@ -15,50 +15,50 @@ at the right time, no matter the situation. Support is all that it takes to take away pain, disruption, inconvenience, loss of productivity, disorientation, uncertainty, and real or perceived risk.
- - - + + + One of the forces that has become a driving force for the adoption of open source software is the fact that many IT businesses have provided services that have perhaps failed to deliver what the customer expected, or that have been found wanting for other reasons.
- - + + In recognition of the need for needs satisfaction as the primary experience an information technology user or consumer expects, the information provided in this chapter may help someone to avoid an unpleasant experience in respect of problem resolution.
- - - + + + In the open source software arena there are two support options: free support and paid-for (commercial) support. -
+ + + + + Free support may be obtained from friends, colleagues, user groups, mailing lists, and interactive help facilities. An example of an interactive dacility is the Internet relay chat (IRC) channels that host user supported mutual assistance.
-
-
-
-
-
+
+
+
+
+
The Samba project maintains a mailing list that is commonly used to discuss solutions to Samba deployments.
Information regarding subscription to the Samba mailing list can be found on the Samba web site. The public mailing list that can be used to obtain
free, user contributed, support is called the samba list. The email address for this list
is at mail:samba@samba.org. Information regarding the Samba IRC channels may be found on
the Samba IRC web page.
- - - - + + + + As a general rule, it is considered poor net behavior to contact a Samba Team member directly for free support. Most active members of the Samba Team work exceptionally long hours to assist users who have demonstrated a qualified problem. Some team members may respond to direct email @@ -66,9 +66,9 @@ Team members actually provide professional paid-for Samba support and it is therefore wise to show appropriate discretion and reservation in all direct contact.
- - - + + + When you stumble across a Samba bug, often the quickest way to get it resolved is by posting a bug report. All such reports are mailed to the responsible code maintainer for action. The better the report, and the more serious it is, @@ -76,16 +76,16 @@ the reported bug it is likely to be rejected. It is up to you to provide sufficient information that will permit the problem to be reproduced.
- + We all recognize that sometimes free support does not provide the answer that is sought within the time-frame required. At other times the problem is elusive and you may lack the experience necessary to isolate the problem and thus to resolve it. This is a situation where is may be prudent to purchase paid-for support. -
There are six basic support oriented services that are most commonly sought by Samba sites:
Assistance with network design
Staff Training
Assistance with Samba network deployment and installation
Priority telephone or email Samba configuration assistance
Trouble-shooting and diagnostic assistance
Provision of quality assured ready-to-install Samba binary packages
- - + + Information regarding companies that provide professional Samba support can be obtained by performing a Google search, as well as by reference to the Samba Support web page. Companies who notify the Samba Team that they provide commercial support are given a free listing that is sorted by the country of origin. @@ -93,13 +93,13 @@ provider and to satisfy yourself that both the company and its staff are able to deliver what is required of them.
- + The policy within the Samba Team is to treat all commercial support providers equally and to show no preference. As a result, Samba Team members who provide commercial support are lumped in with everyone else. You are encouraged to obtain the services needed from a company in your local area. The open source movement is pro-community; so do what you can to help a local business to prosper.
- + Open source software support can be found in any quality, at any price and in any place you can to obtain it. Over 180 companies around the world provide Samba support, there is no excuse for suffering in the mistaken belief that Samba is unsupported software it is supported. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/ch-ldap-tls.html samba-3.0.20/docs/htmldocs/Samba3-HOWTO/ch-ldap-tls.html --- samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/ch-ldap-tls.html 2005-08-07 11:25:19.000000000 -0500 +++ samba-3.0.20/docs/htmldocs/Samba3-HOWTO/ch-ldap-tls.html 2005-08-19 13:03:50.000000000 -0500 @@ -1,40 +1,40 @@
Table of Contents
- - + + Up until now, we have discussed the straightforward configuration of OpenLDAP™, with some advanced features such as ACLs. This does not however, deal with the fact that the network transmissions are still in plain text. This is where Transport Layer Security (TLS) comes in.
- + OpenLDAP™ clients and servers are capable of using the Transport Layer Security (TLS) framework to provide integrity and confidentiality protections in accordance with RFC 2830; Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security.
- + TLS uses X.509 certificates. All servers are required to have valid certificates, whereas client certificates are optional. We will only be discussing server certificates.
Tip
-
-
-
+
+
+
The DN of a server certificate must use the CN attribute to name the server, and the CN must carry the
server's fully qualified domain name (FQDN). Additional alias names and wildcards may be present in the
subjectAltName certificate extension. More details on server certificate names are in RFC2830.
We will discuss this more in the next sections.
- + In order to create the relevant certificates, we need to become our own Certificate Authority (CA). - [8] This is necessary, so we can sign the server certificate. + [8] This is necessary, so we can sign the server certificate.
- - We will be using the OpenSSL [9] software for this, which is included with every great Linux® distribution. + + We will be using the OpenSSL [9] software for this, which is included with every great Linux® distribution.
- TLS is used for many types of servers, but the instructions[10] presented here, are tailored for OpenLDAP. + TLS is used for many types of servers, but the instructions[10] presented here, are tailored for OpenLDAP.
Note
The Common Name (CN), in the following example, MUST be
the fully qualified domain name (FQDN) of your ldap server.
@@ -51,7 +51,7 @@
root# cd myCA
- Now generate the CA:[11] + Now generate the CA:[11]
root# /usr/share/ssl/misc/CA.pl -newca
@@ -209,7 +209,7 @@
That's all there is to it. Now on to the section called “Testing”
- + This is the easy part. Restart the server:
@@ -220,7 +220,7 @@
Then, using ldapsearch, test an anonymous search with the
- -ZZ[12] option:
+ -ZZ[12] option:
root# ldapsearch -x -b "dc=ldap,dc=abmas,dc=biz" \
@@ -265,7 +265,7 @@
If you have any problems, please read the section called “Troubleshooting”
- + The most common error when configuring TLS, as I have already mentioned numerous times, is that the Common Name (CN) you entered in the section called “Generating the Server Certificate” is NOT the Fully Qualified Domain Name (FQDN) of your ldap server. @@ -275,13 +275,13 @@ files. They should be set with chmod 640, as per the section called “Installing the Certificates”.
For anything else, it's best to read through your ldap logfile or join the OpenLDAP mailing list. -
[8] We could however, get our generated server certificate signed by proper CAs, like Thawte and VeriSign, which +
[8] We could however, get our generated server certificate signed by proper CAs, like Thawte and VeriSign, which you pay for, or the free ones, via CAcert -
[9] The downside to +
[9] The downside to making our own CA, is that the certificate is not automatically recognized by clients, like the commercial - ones are.
[10] For information straight from the + ones are.
[10] For information straight from the horse's mouth, please visit http://www.openssl.org/docs/HOWTO/; the main OpenSSL - site.
[11] Your CA.pl or CA.sh might not be
+ site.
[11] Your CA.pl or CA.sh might not be
in the same location as mine is, you can find it by using the locate command, i.e.,
locate CA.pl. If the command complains about the database being too old, run
- updatedb as root to update it.
[12] See man ldapsearch
[12] See man ldapsearch
Table of Contents
- Features and Benefits
- Technical Introduction
- Simple Print Configuration
- Extended Printing Configuration
- Printing Developments Since Samba-2.2
- Installing Drivers into [print$]
- Client Driver Installation Procedure
- Other Gotchas
- The Imprints Toolset
- Adding Network Printers without User Interaction
- The addprinter Command
- Migration of Classical Printing to Samba
- Publishing Printer Information in Active Directory or LDAP
- Common Errors
Table of Contents
- Features and Benefits
- Technical Introduction
- Simple Print Configuration
- Extended Printing Configuration
- Printing Developments Since Samba-2.2
- Installing Drivers into [print$]
- Client Driver Installation Procedure
- Other Gotchas
- The Imprints Toolset
- Adding Network Printers without User Interaction
- The addprinter Command
- Migration of Classical Printing to Samba
- Publishing Printer Information in Active Directory or LDAP
- Common Errors
+ Printing is often a mission-critical service for the users. Samba can provide this service reliably and seamlessly for a client network consisting of Windows workstations.
- - - - - - - - - - - - - + + + + + + + + + + + + + A Samba print service may be run on a standalone or domain member server, side by side with file serving functions, or on a dedicated print server. It can be made as tightly or as loosely secured as needs dictate. Configurations may be simple or complex. Available authentication schemes are essentially the same as @@ -30,23 +30,23 @@ page and supplying the raw data for all sorts of statistical reports) is required, this function is best supported by the newer Common UNIX Printing System (CUPS) as the print subsystem underneath the Samba hood.
- - + + This chapter outlines the fundamentals of Samba printing as implemented by the more traditional UNIX BSD- and System V-style printing systems. Much of the information in this chapter applies also to CUPS. If you use CUPS, you may be tempted to jump to the next chapter, but you will certainly miss a few things if you do. For further information refer to CUPS Printing Support.
Note
- - - + + + Most of the following examples have been verified on Windows XP Professional clients. Where this document describes the responses to commands given, bear in mind that Windows 200x/XP clients are quite similar but may differ in minor details. Windows NT4 is somewhat different again. -
+
+
+
Samba's printing support always relies on the installed print subsystem of the UNIX OS it runs on. Samba is a
middleman. It takes print files from Windows (or other SMB) clients and passes them to the real
printing system for further processing; therefore, it needs to communicate with both sides: the Windows print
@@ -54,42 +54,42 @@
of which behave differently, as well as the various UNIX print subsystems, which themselves have different
features and are accessed differently.
- - + + This chapter deals with the traditional way of UNIX printing. The next chapter covers in great detail the more modern CUPS.
Important
- + CUPS users, be warned: do not just jump on to the next chapter. You might miss important information only found here!
- - - - + + + + It is apparent from postings on the Samba mailing list that print configuration is one of the most problematic aspects of Samba administration today. Many new Samba administrators have the impression that Samba performs some sort of print processing. Rest assured, Samba does not perform any type of print processing. It does not do any form of print filtering.
- - - - + + + + Samba obtains from its clients a data stream (print job) that it spools to a local spool area. When the entire print job has been received, Samba invokes a local UNIX/Linux print command and passes the spooled file to it. It is up to the local system printing subsystems to correctly process the print job and to submit it to the printer. -
+
Successful printing from a Windows client via a Samba print server to a UNIX printer involves six (potentially seven) stages:
Windows opens a connection to the printer share.
Samba must authenticate the user.
Windows sends a copy of the print file over the network into Samba's spooling area.
Windows closes the connection.
Samba invokes the print command to hand the file over to the UNIX print subsystem's spooling area.
The UNIX print subsystem processes the print job.
The print file may need to be explicitly deleted from the Samba spooling area. This item depends on your print spooler - configuration settings.
+
+
+
There are a number of configuration parameters to control Samba's printing behavior. Please refer to the man
page for smb.conf for an overview of these. As with other parameters, there are global-level (tagged with a
G in the listings) and service-level (S) parameters.
@@ -103,20 +103,20 @@
or service-level shares (provided they do not have a different
setting defined for the same parameter, thus overriding the
global default).
-
+
+
+
+
Simple Configuration with BSD Printing shows a simple printing configuration.
If you compare this with your own, you may find additional parameters that have been preconfigured by your OS
vendor. Following is a discussion and explanation of the parameters. This example does not use many
parameters. However, in many environments these are enough to provide a valid smb.conf file that enables
all clients to print.
-
Example 20.1. Simple Configuration with BSD Printing
[global] |
printing = bsd |
load printers = yes |
[printers] |
path = /var/spool/samba |
printable = yes |
public = yes |
writable = no |
Example 20.1. Simple Configuration with BSD Printing
[global] |
printing = bsd |
load printers = yes |
[printers] |
path = /var/spool/samba |
printable = yes |
public = yes |
writable = no |
+
+
+
This is only an example configuration. Samba assigns default values to all configuration parameters. The
defaults are conservative and sensible. When a parameter is specified in the smb.conf file, this overwrites
the default value. The testparm utility when run as root is capable of reporting all
@@ -124,26 +124,26 @@
misconfigured settings. The complete output is easily 360 lines and more, so you may want to pipe it through a
pager program.
-
-
-
+
+
+
The syntax for the configuration file is easy to grasp. You should know that is not very picky about its
syntax. As has been explained elsewhere in this book, Samba tolerates some spelling errors (such as
-browseable instead of browsable), and spelling is
+browseable instead of browsable), and spelling is
case-insensitive. It is permissible to use Yes/No or True/False
for Boolean settings. Lists of names may be separated by commas, spaces, or tabs.
-
+
+
+
+
+
+
+
+
+
+
+
To see all (or at least most) printing-related settings in Samba, including the implicitly used ones, try the
command outlined below. This command greps for all occurrences of lp,
print, spool, driver,
@@ -194,14 +194,14 @@
The testparm in Samba-3 behaves differently from that in 2.2.x: used without the
“-v” switch, it only shows you the settings actually written into! To see the complete
configuration used, add the “-v” parameter to testparm.
-
+ + + + Should you need to troubleshoot at any stage, please always come back to this point first and verify if testparm shows the parameters you expect. To give you a warning from personal experience, -try to just comment out the load printers parameter. If your 2.2.x system behaves like +try to just comment out the load printers parameter. If your 2.2.x system behaves like mine, you'll see this:
root#grep "load printers" /etc/samba/smb.conf @@ -211,8 +211,8 @@root#testparm -v /etc/samba/smb.conf | egrep "(load printers)" load printers = Yes
-
-
+
+
I assumed that commenting out of this setting should prevent Samba from
publishing my printers, but it still did. It took some time to figure out
the reason. But I am no longer fooled ... at least not by this.
@@ -226,8 +226,8 @@
root# testparm -s -v smb.conf.simpleprinting | egrep "(load printers)"
load printers = No
- -Only when the parameter is explicitly set to load printers = No would + +Only when the parameter is explicitly set to load printers = No would Samba conform with my intentions. So, my strong advice is:
Never rely on commented-out parameters.
Always set parameters explicitly as you intend them to behave.
Use testparm to uncover hidden @@ -237,8 +237,8 @@
root#cat /etc/samba/smb.conf-minimal[printers]- - + + This example should show that you can use testparm to test any Samba configuration file. Actually, we encourage you not to change your working system (unless you know exactly what you are doing). Don't rely on the assumption that changes will only take effect after you restart smbd! @@ -276,10 +276,10 @@
testparm issued two warnings:
We did not specify the
[printers]section as printable.We did not tell Samba which spool directory to use.
- - - - + + + + However, this was not fatal, and Samba will default to values that will work. Please, do not rely on this and do not use this example. This was included to encourage you to be careful to design and specify your setup to do precisely what you require. The outcome on your system may vary for some parameters given, since Samba may @@ -288,15 +288,15 @@ put the comment sign at the front). At first I regarded this as a bug in my Samba versions. But the man page clearly says:
Internal whitespace in a parameter value is retained verbatim.This means that a line consisting of, for example, -# This defines LPRng as the printing system printing = lprng+
# This defines LPRng as the printing system printing = lprngwill regard the whole of the string after the
=sign as the value you want to define. This is an invalid value that will be ignored, and a default value will be used in its place. -
+
+
+
+
Extended BSD Printing Configuration shows a more verbose configuration for
print-related settings in a BSD-style printing environment. What follows is a discussion and explanation of
the various parameters. We chose to use BSD-style printing here because it is still the most commonly used
@@ -304,68 +304,68 @@
separate chapter. The example explicitly names many parameters that do not need to be specified because they
are set by default. You could use a much leaner smb.conf file, or you can use testparm or
SWAT to optimize the smb.conf file to remove all parameters that are set at default.
-
Example 20.2. Extended BSD Printing Configuration
[global] |
printing = bsd |
load printers = yes |
show add printer wizard = yes |
printcap name = /etc/printcap |
printer admin = @ntadmin, root |
max print jobs = 100 |
lpq cache time = 20 |
use client driver = no |
[printers] |
comment = All Printers |
printable = yes |
path = /var/spool/samba |
browseable = no |
guest ok = yes |
public = yes |
read only = yes |
writable = no |
[my_printer_name] |
comment = Printer with Restricted Access |
path = /var/spool/samba_my_printer |
printer admin = kurt |
browseable = yes |
printable = yes |
writable = no |
hosts allow = 0.0.0.0 |
hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60 |
guest ok = no |
Example 20.2. Extended BSD Printing Configuration
[global] |
printing = bsd |
load printers = yes |
show add printer wizard = yes |
printcap name = /etc/printcap |
printer admin = @ntadmin, root |
max print jobs = 100 |
lpq cache time = 20 |
use client driver = no |
[printers] |
comment = All Printers |
printable = yes |
path = /var/spool/samba |
browseable = no |
guest ok = yes |
public = yes |
read only = yes |
writable = no |
[my_printer_name] |
comment = Printer with Restricted Access |
path = /var/spool/samba_my_printer |
printer admin = kurt |
browseable = yes |
printable = yes |
writable = no |
hosts allow = 0.0.0.0 |
hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60 |
guest ok = no |
+
+
+
This is an example configuration. You may not find all the settings that are in the configuration file that
was provided by the OS vendor. Samba configuration parameters, if not explicitly set, default to a sensible
value. To see all settings, as root use the testparm utility.
testparm gives warnings for misconfigured settings.
-
+
The following is a discussion of the settings from Extended BSD Printing Configuration Extended BSD Printing Configuration. -
+
+
+
+
The [global] section is one of four special sections (along with [homes], [printers], and [print$]). The
[global] contains all parameters that apply to the server as a whole. It is the place
for parameters that have only a global meaning. It may also contain service-level parameters that define
default settings for all other sections and shares. This way you can simplify the configuration and avoid
setting the same value repeatedly. (Within each individual section or share, you may, however, override these
globally set share settings and specify other values).
-
- printing = bsd
- printing = bsd
+ + + + + + + + + + + + Causes Samba to use default print commands applicable for the BSD (also known as RFC 1179 style or LPR/LPD) printing system. In general, the
printingparameter informs Samba about the print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, SYSV, HPUX, AIX, QNX, and PLP. Each of these - systems defaults to a different print command (and other queue control commands). + systems defaults to a different print command (and other queue control commands).Caution
- - - The printing parameter is normally a service-level parameter. Since it is included + + + The printing parameter is normally a service-level parameter. Since it is included here in the
[global]section, it will take effect for all printer shares that are not defined differently. Samba-3 no longer supports the SOFTQ printing system. -- load printers = yes
- load printers = yes
+ + + + Tells Samba to create automatically all available printer shares. Available printer shares are discovered by scanning the printcap file. All created printer shares are also loaded for browsing. If you use this parameter, you do not need to specify separate shares for each printer. Each automatically created printer share will clone the configuration options found in the
[printers]section. (Theload printers = nosetting will allow you to specify each UNIX printer you want to share separately, leaving out some you do not want to be publicly visible and available). -- show add printer wizard = yes
- show add printer wizard = yes
+ + + + + Setting is normally enabled by default (even if the parameter is not specified in
smb.conf). It causes the Add Printer Wizard icon to appear in the Printers folder of the Samba host's share listing (as shown in Network Neighborhood or by the net @@ -373,78 +373,78 @@ it out will not suffice). TheAdd Printer Wizardlets you upload a printer driver to the[print$]share and associate it with a printer (if the respective queue exists before the action), or exchange a printer's driver for any other previously uploaded driver. -- max print jobs = 100
- max print jobs = 100
+ Sets the upper limit to 100 print jobs being active on the Samba server at any one time. Should a client submit a job that exceeds this number, a "no more space available on server" type of error message will be returned by Samba to the client. A setting of zero (the default) means there is no limit at all. -
- printcap name = /etc/printcap
- printcap name = /etc/printcap
+ + + Tells Samba where to look for a list of available printer names. Where CUPS is used, make sure that a printcap file is written. This is controlled by the
Printcapdirective in thecupsd.conffile. -- printer admin = @ntadmin
- printer admin = @ntadmin
+ + + + Members of the ntadmin group should be able to add drivers and set printer properties (
ntadminis only an example name; it needs to be a valid UNIX group name); root is - implicitly always a printer admin. The@sign precedes group names + implicitly always a printer admin. The@sign precedes group names in the/etc/group. A printer admin can do anything to printers via the remote administration interfaces offered by MS-RPC (see Printing Developments Since - Samba-2.2). In larger installations, the printer admin parameter is normally a + Samba-2.2). In larger installations, the printer admin parameter is normally a per-share parameter. This permits different groups to administer each printer share. -- lpq cache time = 20
- lpq cache time = 20
+ + Controls the cache time for the results of the lpq command. It prevents the lpq command being called too often and reduces the load on a heavily used print server. -
- use client driver = no
- use client driver = no
+ If set to
yes, only takes effect for Windows NT/200x/XP clients (and not for Win 95/98/ME). Its default value isNo(orFalse). It must not be enabled on print shares (with ayesortruesetting) that have valid drivers installed on the Samba server. For more detailed explanations, see thesmb.confman page.
-
-
+
+
The printers section is the second special section. If a section with this name appears in the smb.conf,
users are able to connect to any printer specified in the Samba host's printcap file, because Samba on startup
then creates a printer share for every printer name it finds in the printcap file. You could regard this
section as a convenient shortcut to share all printers with minimal configuration. It is also a container for
settings that should apply as default to all printers. (For more details, see the smb.conf man page.)
Settings inside this container must be share-level parameters.
-
- comment = All printers
- The comment is shown next to the share if +
- comment = All printers
+ The comment is shown next to the share if a client queries the server, either via Network Neighborhood or with the net view command, to list available shares. -
- printable = yes
+
- printable = yes
The
[printers]service must be declared as printable. If you specify otherwise, smbd will refuse to load at startup. This parameter allows connected clients to open, write to, and submit spool files - into the directory specified with the path + into the directory specified with the path parameter for this service. It is used by Samba to differentiate printer shares from file shares. -- path = /var/spool/samba
+
- path = /var/spool/samba
Must point to a directory used by Samba to spool incoming print files. It must not be the same as the spool directory specified in the configuration of your UNIX print subsystem! The path typically points to a directory that is world writable, with the sticky bit set to it. -
- browseable = no
+
- browseable = no
Is always set to
noif - printable = yes. It makes + printable = yes. It makes the[printer]share itself invisible in the list of available shares in a net view command or in the Explorer browse list. (You will of course see the individual printers.) -- guest ok = yes
+
- guest ok = yes
If this parameter is set to
yes, no password is required to connect to the printer's service. Access will be granted with the privileges of the - guest account. On many systems the guest + guest account. On many systems the guest account will map to a user named "nobody." This user will usually be found in the UNIX passwd file with an empty password, but with no valid UNIX login. On some systems the guest account might not have the privilege to be able to print. Test this @@ -452,65 +452,65 @@ print command like:lpr -P printername /etc/motd-- public = yes
- Is a synonym for guest ok = yes. - Since we have guest ok = yes, it +
- public = yes
+ Is a synonym for guest ok = yes. + Since we have guest ok = yes, it really does not need to be here. (This leads to the interesting question, “What if I by accident have two contradictory settings for the same share?” The answer is that the last one encountered by Samba wins. testparm does not complain about different settings of the same parameter for the same share. You can test this by setting up multiple lines for the
guest accountparameter with different usernames, and then run testparm to see which one is actually used by Samba.) -- read only = yes
+
- read only = yes
Normally (for other types of shares) prevents users from creating or modifying files in the service's directory. However, in a printable service, it is always allowed to write to the directory (if user privileges allow the connection), but only via print spooling operations. Normal write operations are not permitted. -
- writable = no
+
+
If a [my_printer_name] section appears in the smb.conf file, which includes the
-parameter printable = yes Samba will configure it as a printer share.
+parameter printable = yes Samba will configure it as a printer share.
Windows 9x/Me clients may have problems with connecting or loading printer drivers if the share name has more
than eight characters. Do not name a printer share with a name that may conflict with an existing user or file
share name. On client connection requests, Samba always tries to find file shares with that name first. If it
finds one, it will connect to this and will not connect to a printer with the same name!
-
- comment = Printer with Restricted Access
+
- comment = Printer with Restricted Access
The comment says it all. -
- path = /var/spool/samba_my_printer
+
- path = /var/spool/samba_my_printer
Sets the spooling area for this printer to a directory other than the default. It is not necessary to set it differently, but the option is available. -
- printer admin = kurt
+
- printer admin = kurt
The printer admin definition is different for this explicitly defined printer share from the general
[printers]share. It is not a requirement; we did it to show that it is possible. -- browseable = yes
+
- browseable = yes
This makes the printer browseable so the clients may conveniently find it when browsing the Network Neighborhood. -
- printable = yes
+
- printable = yes
See Section 20.4.1.2. -
- writable = no
+
- writable = no
See Section 20.4.1.2. -
- hosts allow = 10.160.50.,10.160.51.
- Here we exercise a certain degree of access control by using the hosts allow - and hosts deny parameters. This is not by any means a safe bet. It is not a +
- hosts allow = 10.160.50.,10.160.51.
+ Here we exercise a certain degree of access control by using the hosts allow + and hosts deny parameters. This is not by any means a safe bet. It is not a way to secure your printers. This line accepts all clients from a certain subnet in a first evaluation of access control. -
- hosts deny = turbo_xp,10.160.50.23,10.160.51.60
+
- hosts deny = turbo_xp,10.160.50.23,10.160.51.60
All listed hosts are not allowed here (even if they belong to the allowed subnets). As you can see, you could name IP addresses as well as NetBIOS hostnames here. -
- guest ok = no
+
- guest ok = no
This printer is not open for the guest account. -
+
+
+
+
In each section defining a printer (or in the [printers] section),
a print command parameter may be defined. It sets a command to process the files
that have been placed into the Samba print spool directory for that printer. (That spool directory was,
-if you remember, set up with the path parameter). Typically,
+if you remember, set up with the path parameter). Typically,
this command will submit the spool file to the Samba host's print subsystem, using the suitable system
print command. But there is no requirement that this needs to be the case. For debugging or
some other reason, you may want to do something completely different than print the file. An example is a
@@ -518,39 +518,39 @@
to debug printing. If you craft your own print commands (or even develop print command shell scripts),
make sure you pay attention to the need to remove the files from the Samba spool directory. Otherwise,
your hard disk may soon suffer from shortage of free space.
-
+ You learned earlier that Samba, in most cases, uses its built-in settings for many parameters if it cannot -find an explicitly stated one in its configuration file. The same is true for the print command. The default print command varies depending on the printing parameter +find an explicitly stated one in its configuration file. The same is true for the print command. The default print command varies depending on the printing parameter setting. In the commands listed in Default Printing Settings , you will notice some parameters of the form %X where X is p, s, J, and so on. These letters stand for printer name, spool file, and job ID, respectively. They are explained in more detail in Default Printing Settings presents an overview of key printing options but excludes the special case of CUPS, is discussed in CUPS Printing Support. -
Table 20.1. Default Printing Settings
| Setting | Default Printing Commands |
|---|---|
| printing = bsd|aix|lprng|plp | print command is lpr -r -P%p %s |
| printing = sysv|hpux | print command is lp -c -P%p %s; rm %s |
| printing = qnx | print command is lp -r -P%p -s %s |
| printing = bsd|aix|lprng|plp | lpq command is lpq -P%p |
| printing = sysv|hpux | lpq command is lpstat -o%p |
| printing = qnx | lpq command is lpq -P%p |
| printing = bsd|aix|lprng|plp | lprm command is lprm -P%p %j |
| printing = sysv|hpux | lprm command is cancel %p-%j |
| printing = qnx | lprm command is cancel %p-%j |
| printing = bsd|aix|lprng|plp | lppause command is lp -i %p-%j -H hold |
| printing = sysv|hpux | lppause command (...is empty) |
| printing = qnx | lppause command (...is empty) |
| printing = bsd|aix|lprng|plp | lpresume command is lp -i %p-%j -H resume |
| printing = sysv|hpux | lpresume command (...is empty) |
| printing = qnx | lpresume command (...is empty) |
Table 20.1. Default Printing Settings
| Setting | Default Printing Commands |
|---|---|
| printing = bsd|aix|lprng|plp | print command is lpr -r -P%p %s |
| printing = sysv|hpux | print command is lp -c -P%p %s; rm %s |
| printing = qnx | print command is lp -r -P%p -s %s |
| printing = bsd|aix|lprng|plp | lpq command is lpq -P%p |
| printing = sysv|hpux | lpq command is lpstat -o%p |
| printing = qnx | lpq command is lpq -P%p |
| printing = bsd|aix|lprng|plp | lprm command is lprm -P%p %j |
| printing = sysv|hpux | lprm command is cancel %p-%j |
| printing = qnx | lprm command is cancel %p-%j |
| printing = bsd|aix|lprng|plp | lppause command is lp -i %p-%j -H hold |
| printing = sysv|hpux | lppause command (...is empty) |
| printing = qnx | lppause command (...is empty) |
| printing = bsd|aix|lprng|plp | lpresume command is lp -i %p-%j -H resume |
| printing = sysv|hpux | lpresume command (...is empty) |
| printing = qnx | lpresume command (...is empty) |
+
+
+
+
For printing = CUPS, if Samba is compiled against libcups, it uses the CUPS API to
-submit jobs. (It is a good idea also to set printcap = cups in case your
+submit jobs. (It is a good idea also to set printcap = cups in case your
cupsd.conf is set to write its autogenerated printcap file to an unusual place).
Otherwise, Samba maps to the System V printing commands with the -oraw option for printing; that is, it uses
lp -c -d%p -oraw; rm %s. With printing = cups, and if Samba is
compiled against libcups, any manually set print command will be ignored!
-
+ + +After a print job has finished spooling to a service, the print command will be used by Samba via a system() call to process the spool file. Usually the command specified will submit the spool file to the host's printing subsystem. But there is no requirement at all that this must be the case. The print subsystem may not remove the spool file on its own, so whatever command you specify, you should ensure that the spool file is deleted after it has been processed.
- - - - + + + + There is no difficulty with using your own customized print commands with the traditional printing systems. However, if you do not wish to roll your own, you should be well informed about the default built-in commands that Samba uses for each printing subsystem (see Default Printing @@ -560,44 +560,44 @@ appropriate value automatically. Print commands can handle all Samba macro substitutions. In regard to printing, the following ones do have special relevance:
%s, %fthe path to the spool file name.%pthe appropriate printer name.%Jthe job name as transmitted by the client.%cthe number of printed pages of the spooled job (if known).%zthe size of the spooled print job (in bytes).
-
+
The print command must contain at least one occurrence of %s or
%f. The %p is optional. If no printer name is supplied,
the %p will be silently removed from the print command. In this case, the job is
sent to the default printer.
-
-
+
+
If specified in the [global] section, the print command given will be
used for any printable service that does not have its own print command specified. If there is neither a
specified print command for a printable service nor a global print command, spool files will be created
but not processed! Most importantly, print files will not be removed, so they will consume disk space.
-
-
+
+
Printing may fail on some UNIX systems when using the nobody account. If this happens, create an
alternative guest account and give it the privilege to print. Set up this guest account in the
[global] section with the guest account parameter.
-
-
-
+
+
+
You can form quite complex print commands. You need to realize that print commands are just
passed to a UNIX shell. The shell is able to expand the included environment variables as
usual. (The syntax to include a UNIX environment variable $variable
in the Samba print command is %$variable.) To give you a working
-print command example, the following will log a print job
+print command example, the following will log a print job
to /tmp/print.log, print the file, then remove it. The semicolon (“;”
is the usual separator for commands in shell scripts:
-
print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s |
+
print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s |
You may have to vary your own command considerably from this example depending on how you normally print -files on your system. The default for the print command -parameter varies depending on the setting of the printing +files on your system. The default for the print command +parameter varies depending on the setting of the printing parameter. Another example is: -
print command = /usr/local/samba/bin/myprintscript %p %s |
+ + + Prior to Samba-2.2.x, print server support for Windows clients was limited to LanMan printing calls. This is the same protocol level as Windows 9x/Me PCs offer when they share printers. Beginning with the 2.2.0 release, Samba started to support the native Windows NT printing mechanisms. These @@ -606,67 +606,67 @@
The additional functionality provided by the new SPOOLSS support includes:
- + Support for downloading printer driver files to Windows 95/98/NT/2000 clients upon demand (Point'n'Print).
- + Uploading of printer drivers via the Windows NT Add Printer Wizard (APW) or the Imprints tool set.
- - - - - + + + + + Support for the native MS-RPC printing calls such as StartDocPrinter, EnumJobs(), and so on. (See the MSDN documentation for more information on the Win32 printing API).
- - + + Support for NT Access Control Lists (ACL) on printer objects.
- + Improved support for printer queue manipulation through the use of internal databases for spooled job information (implemented by various
*.tdbfiles).
- - + + A benefit of updating is that Samba-3 is able to publish its printers to Active Directory (or LDAP).
- + A fundamental difference exists between MS Windows NT print servers and Samba operation. Windows NT permits the installation of local printers that are not shared. This is an artifact of the fact that any Windows NT machine (server or client) may be used by a user as a workstation. Samba will publish all printers that are made available, either by default or by specific declaration via printer-specific shares.
- - - - - + + + + + Windows NT/200x/XP Professional clients do not have to use the standard SMB printer share; they can print directly to any printer on another Windows NT host using MS-RPC. This, of course, assumes that the client has the necessary privileges on the remote host that serves the printer resource. The default permissions assigned by Windows NT to a printer gives the print permissions to the well-known Everyone group. (The older clients of type Windows 9x/Me can only print to shared printers.) -
+ There is much confusion about what all this means. The question is often asked, “Is it or is it not necessary for printer drivers to be installed on a Samba host in order to support printing from Windows clients?” The answer to this is no, it is not necessary.
- - + + Windows NT/2000 clients can, of course, also run their APW to install drivers locally (which then connect to a Samba-served print queue). This is the same method used by Windows 9x/Me clients. (However, a bug existed in Samba 2.2.0 that made Windows NT/2000 clients require that the Samba server possess a valid driver for the printer. This was fixed in Samba 2.2.1).
-
-
+
+
But it is a new capability to install the printer drivers into the [print$]
share of the Samba server, and a big convenience, too. Then all clients
(including 95/98/ME) get the driver installed when they first connect to this printer share. The
@@ -682,16 +682,16 @@
Using cupsaddsmb (only works for the CUPS printing system, not for LPR/LPD, LPRng, and so on).
- - + + Samba does not use these uploaded drivers in any way to process spooled files. These drivers are utilized entirely by the clients who download and install them via the “Point'n'Print” mechanism supported by Samba. The clients use these drivers to generate print files in the format the printer (or the UNIX print system) requires. Print files received by Samba are handed over to the UNIX printing system, which is responsible for all further processing, as needed. -
+
+
Versions of Samba prior to 2.2 made it possible to use a share named [printer$]. This
name was taken from the same named service created by Windows 9x/Me clients when a printer was shared by them.
Windows 9x/Me printer servers always have a [printer$] service that provides
@@ -701,9 +701,9 @@
parameter named printer driver provided a means of defining the printer driver name to
be sent to the client.
-
-
-
+
+
+
These parameters, including the printer driver file parameter,
are now removed and cannot be used in installations of Samba-3. The share name
[print$] is now used for the location of downloadable printer
@@ -713,8 +713,8 @@
of its ACLs) to support printer driver downloads and uploads. This does not mean Windows
9x/Me clients are now thrown aside. They can use Samba's [print$]
share support just fine.
-
+
In order to support the uploading and downloading of printer driver files, you must first configure a
file share named [print$]. The public name of this share is hard coded
in the MS Windows clients. It cannot be renamed, since Windows clients are programmed to search for a
@@ -722,27 +722,27 @@
You should modify the server's file to add the global parameters and create the
[print$] file share (of course, some of the parameter values, such
-as path, are arbitrary and should be replaced with appropriate values for your
+as path, are arbitrary and should be replaced with appropriate values for your
site). See [print\$] Example.
-
Example 20.3. [print$] Example
[global] |
| # members of the ntadmin group should be able to add drivers and set |
| # printer properties. root is implicitly always a 'printer admin'. |
printer admin = @ntadmin |
| # ... |
[printers] |
| # ... |
[print$] |
comment = Printer Driver Download Area |
path = /etc/samba/drivers |
browseable = yes |
guest ok = yes |
read only = yes |
write list = @ntadmin, root |
+
Example 20.3. [print$] Example
[global] |
| # members of the ntadmin group should be able to add drivers and set |
| # printer properties. root is implicitly always a 'printer admin'. |
printer admin = @ntadmin |
| # ... |
[printers] |
| # ... |
[print$] |
comment = Printer Driver Download Area |
path = /etc/samba/drivers |
browseable = yes |
guest ok = yes |
read only = yes |
write list = @ntadmin, root |
Of course, you also need to ensure that the directory named by the -path parameter exists on the UNIX file system. -
+
+
+
+
+
The [print$] is a special section in smb.conf. It contains settings relevant to
potential printer driver download and is used by Windows clients for local print driver installation.
The following parameters are frequently needed in this share section:
-
- comment = Printer Driver Download Area
+
- comment = Printer Driver Download Area
The comment appears next to the share name if it is listed in a share list (usually Windows clients will not see it, but it will also appear up in a smbclient -L sambaserver output). -
- path = /etc/samba/printers
+
- path = /etc/samba/printers
The path to the location of the Windows driver file deposit from the UNIX point of view. -
- browseable = no
+
- browseable = no
Makes the
[print$]share invisible to clients from the . By excuting from a cmd shell:@@ -750,7 +750,7 @@
you can still mount it from any client. This can also be done from the from Windows Explorer. -
- guest ok = yes
+
- guest ok = yes
Gives read-only access to this share for all guest users. Access may be granted to download and install printer drivers on clients. The requirement for
guest ok = yesdepends on how your site is configured. If users will be guaranteed @@ -761,13 +761,13 @@ validated by the domain controller in order to log on to the Windows NT session), then guest access is not necessary. Of course, in a workgroup environment where you just want to print without worrying about silly accounts and security, then configure the share for - guest access. You should consider adding map to guest = Bad User + guest access. You should consider adding map to guest = Bad User in the[global]section as well. Make sure you understand what this parameter does before using it. -
- read only = yes
+
Because we do not want everybody to upload driver files (or even change driver settings), we tagged this share as not writable. -
+
The [print$] was made read-only by the previous
setting so we should create a write list entry also. UNIX
groups are denoted with a leading “@” character. Users listed here are allowed
@@ -775,12 +775,12 @@
update files on the share. Normally, you will want to name only administrative-level user
account in this setting. Check the file system permissions to make sure these accounts
can copy files to the share. If this is a non-root account, then the account should also
- be mentioned in the global printer admin
+ be mentioned in the global printer admin
parameter. See the smb.conf man page for more information on configuring file shares.
-
In order for a Windows NT print server to support the downloading of driver files by multiple client
architectures, you must create several subdirectories within the [print$]
-service (i.e., the UNIX directory named by the path
+service (i.e., the UNIX directory named by the path
parameter). These correspond to each of the supported client architectures. Samba follows this model as
well. Just like the name of the [print$] share itself, the subdirectories
must be exactly the names listed below (you may leave out the subdirectories of architectures you do
@@ -812,7 +812,7 @@
Neighborhood or My Network Places and browse for the Samba host. Once you
have located the server, navigate to its Printers and Faxes folder. You should see
an initial listing of printers that matches the printer shares defined on your Samba host.
-
Have you successfully created the [print$] share in smb.conf, and have you forced
Samba to reread its smb.conf file? Good. But you are not yet ready to use the new facility. The client
driver files need to be installed into this share. So far, it is still an empty share. Unfortunately, it is
@@ -828,7 +828,7 @@
from any Windows NT/200x/XP client workstation.
The latter option is probably the easier one (even if the process may seem a little bit weird at first). -
+
The printers initially listed in the Samba host's Printers folder accessed from a client's Explorer will have no real printer driver assigned to them. By default this driver name is set to a null string. This must be changed now. The local Add Printer Wizard (APW), run from @@ -854,13 +854,13 @@
Once the APW is started, the procedure is exactly the same as the one you are familiar with in Windows (we assume here that you are familiar with the printer driver installations procedure on Windows NT). Make sure -your connection is, in fact, set up as a user with printer admin +your connection is, in fact, set up as a user with printer admin privileges (if in doubt, use smbstatus to check for this). If you wish to install printer drivers for client operating systems other than Windows NT x86, you will need to use the Sharing tab of the printer properties dialog.
Assuming you have connected with an administrative (or root) account (as named by the -printer admin parameter), you will also be able to modify +printer admin parameter), you will also be able to modify other printer properties such as ACLs and default device settings using this dialog. For the default device settings, please consider the advice given further in Installing Print Drivers Using rpcclient. @@ -879,10 +879,10 @@ Run rpcclient a second time with the setdriver subcommand.
We provide detailed hints for each of these steps in the paragraphs that follow. -
+
+
+
To find out about the driver files, you have two options. You can check the contents of the driver
CDROM that came with your printer. Study the *.inf files located on the CD-ROM. This
may not be possible, since the *.inf file might be missing. Unfortunately, vendors have now started
@@ -890,14 +890,14 @@
archive format. Additionally, the files may be re-named during the installation process. This makes it
extremely difficult to identify the driver files required.
- + Then you have the second option. Install the driver locally on a Windows client and investigate which filenames and paths it uses after they are installed. (You need to repeat this procedure for every client platform you want to support. We show it here for the W32X86 platform only, a name used by Microsoft for all Windows NT/200x/XP clients.)
- + A good method to recognize the driver files is to print the test page from the driver's Properties dialog (General tab). Then look at the list of driver files named on the printout. You'll need to recognize what Windows (and Samba) are calling the @@ -905,9 +905,9 @@ Help File, and (optionally) Dependent Driver Files (this may vary slightly for Windows NT). You need to note all filenames for the next steps.
-
-
-
+
+
+
Another method to quickly test the driver filenames and related paths is provided by the
rpcclient utility. Run it with enumdrivers or with the
getdriver subcommand, each at the 3 info level. In the following example,
@@ -948,10 +948,10 @@
Monitorname: []
Defaultdatatype: []
- - - - + + + + You may notice that this driver has quite a large number of Dependent files (there are worse cases, however). Also, strangely, the Driver File is tagged here @@ -961,9 +961,9 @@ addition to those for W32X86 (i.e., the Windows NT 2000/XP clients) onto a Windows PC. This PC can also host the Windows 9x/Me drivers, even if it runs on Windows NT, 2000, or XP.
-
-
-
+
+
+
Since the [print$] share is usually accessible through the Network
Neighborhood, you can also use the UNC notation from Windows Explorer to poke at it. The Windows
9x/Me driver files will end up in subdirectory 0 of the WIN40
@@ -974,7 +974,7 @@
mode. Windows 2000 changed this. While it still can use the kernel mode drivers (if this is enabled by
the Admin), its native mode for printer drivers is user mode execution. This requires drivers designed
for this purpose. These types of drivers install into the “3” subdirectory.
-
Now we need to collect all the driver files we identified in our previous step. Where do we get them
from? Well, why not retrieve them from the very PC and the same [print$]
share that we investigated in our last step to identify the files? We can use smbclient
@@ -999,12 +999,12 @@
This ensures that all commands are executed in sequence on the remote Windows server before
smbclient exits again.
-
+
Remember to repeat the procedure for the WIN40 architecture should you need to
support Windows 9x/Me/XP clients. Remember too, the files for these architectures are in the
WIN40/0/ subdirectory. Once this is complete, we can run smbclient. .
.put to store the collected files on the Samba server's [print$] share.
-
We are now going to locate the driver files into the [print$] share. Remember, the
UNIX path to this share has been defined previously in your smb.conf file. You also have created
subdirectories for the different Windows client types you want to support. If, for example, your
@@ -1017,8 +1017,8 @@
For all Windows 95, 98, and Me clients, /etc/samba/drivers/WIN40/ but not
(yet) into the 0 subdirectory.
- - + + We again use smbclient to transfer the driver files across the network. We specify the same files and paths as were leaked to us by running getdriver against the original Windows install. However, now we are going to store the files into a @@ -1055,18 +1055,18 @@ putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF
-
-
-
+
+
+
Whew that was a lot of typing! Most drivers are a lot smaller many have only three generic
PostScript driver files plus one PPD. While we did retrieve the files from the 2
subdirectory of the W32X86 directory from the Windows box, we do not put them
(for now) in this same subdirectory of the Samba box. This relocation will automatically be done by the
adddriver command, which we will run shortly (and do not forget to also put the files
for the Windows 9x/Me architecture into the WIN40/ subdirectory should you need them).
-
+ + For now we verify that our files are there. This can be done with smbclient, too (but, of course, you can log in via SSH also and do this through a standard UNIX shell access):
@@ -1107,9 +1107,9 @@
PDFcreator2.PPD A 15746 Sun Apr 20 22:24:07 2003
40976 blocks of size 262144. 709 blocks available
-
-
-
+
+
+
Notice that there are already driver files present in the 2 subdirectory (probably from a
previous installation). Once the files for the new driver are there too, you are still a few steps away from
being able to use them on the clients. The only thing you could do now is retrieve them from a client just
@@ -1117,10 +1117,10 @@
install them per Point'n'Print. The reason is that Samba does not yet know that these files are something
special, namely printer driver files, and it does not know to which print queue(s) these
driver files belong.
-
+
+
+
Next, you must tell Samba about the special category of the files you just uploaded into the
[print$] share. This is done by the adddriver
command. It will prompt Samba to register the driver files into its internal TDB database files. The
@@ -1144,16 +1144,16 @@
Printer Driver dm9110 successfully installed.
-
-
-
+
+
+
After this step, the driver should be recognized by Samba on the print server. You need to be very
careful when typing the command. Don't exchange the order of the fields. Some changes would lead to
an NT_STATUS_UNSUCCESSFUL error message. These become obvious. Other
changes might install the driver files successfully but render the driver unworkable. So take care!
Hints about the syntax of the adddriver command are in the man page.
provides a more detailed description, should you need it.
-
One indication for Samba's recognition of the files as driver files is the successfully
installed message. Another one is the fact that our files have been moved by the
adddriver command into the 2 subdirectory. You can check this
@@ -1198,17 +1198,17 @@
Another verification is that the timestamp of the printing TDB files is now updated (and possibly their file size has increased). -
+ Now the driver should be registered with Samba. We can easily verify this and will do so in a moment. However, this driver is not yet associated with a particular printer. We may check the driver status of the files by at least three methods:
- - - - - + + + + + From any Windows client browse Network Neighborhood, find the Samba host, and open the Samba Printers and Faxes folder. Select any printer icon, right-click and select the printer . Click the Advanced @@ -1218,7 +1218,7 @@ see only its own architecture's list. If you do not have every driver installed for each platform, the list will differ if you look at it from Windows95/98/ME or Windows NT/2000/XP.)
- + From a Windows 200x/XP client (not Windows NT) browse Network Neighborhood, search for the Samba server, open the server's Printers folder, and right-click on the white background (with no printer highlighted). Select
+ You can name the driver as you like. If you repeat the adddriver step with the same files as before but with a different driver name, it will work the same:
@@ -1271,18 +1271,18 @@ Printer Driver mydrivername successfully installed.
-
-
-
+
+
+
You will be able to bind that driver to any print queue (however, you are responsible that
you associate drivers to queues that make sense with respect to target printers). You cannot run the
rpcclient adddriver command repeatedly. Each run consumes the
files you had put into the [print$] share by moving them into the
respective subdirectories, so you must execute an smbclient ... put command before
each rpcclient ... adddriver command.
-
+
+
Samba needs to know which printer owns which driver. Create a mapping of the driver to a printer, and
store this information in Samba's memory, the TDB files. The rpcclient setdriver command
achieves exactly this:
@@ -1309,18 +1309,18 @@
bug in 2.2.x prevented Samba from recognizing freshly installed printers. You had to restart Samba,
or at least send an HUP signal to all running smbd processes to work around this: kill -HUP
`pidof smbd`.
-
As Don Quixote said, “The proof of the pudding is in the eating.” The proof for our setup lies in the printing. So let's install the printer driver onto the client PCs. This is not as straightforward as it may seem. Read on. -
+
Especially important is the installation onto the first client PC (for each architectural platform separately). Once this is done correctly, all further clients are easy to set up and shouldn't need further attention. What follows is a description for the recommended first procedure. You now work from a client workstation. You should check that your connection is not unwittingly mapped to bad user nobody. In a DOS box type:
net use \\SAMBA-SERVER\print$ /user:root
-Replace root, if needed, by another valid printer admin user as given in +Replace root, if needed, by another valid printer admin user as given in the definition. Should you already be connected as a different user, you will get an error message. There is no easy way to get rid of that connection, because Windows does not seem to know a concept of logging off from a share connection (do not confuse this with logging off from the local workstation; that is @@ -1347,7 +1347,7 @@ -> -> Printers and Faxes).
-
+
Most likely you are tempted to try to print a test page. After all, you now can open the printer
properties, and on the tab there is a button offering to do just that. But
chances are that you get an error message saying "Unable to print Test Page." The
@@ -1359,18 +1359,18 @@
For a printer to be truly usable by a Windows NT/200x/XP client, it must possess:
- - - - - + + + + + If either of these is incomplete, the clients can produce less than optimal output at best. In the worst cases, unreadable garbage or nothing at all comes from the printer, or it produces a harvest of error messages when attempting to print. Samba stores the named values and all printing-related information in @@ -1384,7 +1384,7 @@ This can be achieved by accessing the drivers remotely from an NT (or 200x/XP) client, as discussed in the following paragraphs.
-Be aware that a valid device mode can only be initiated by a printer admin or root +Be aware that a valid device mode can only be initiated by a printer admin or root (the reason should be obvious). Device modes can be correctly set only by executing the printer driver program itself. Since Samba cannot execute this Win32 platform driver code, it sets this field initially to NULL (which is not a valid setting for clients to use). Fortunately, most drivers automatically generate the @@ -1396,7 +1396,7 @@ the server's printer. This executes enough of the printer driver program on the client for the desired effect to happen and feeds back the new device mode to our Samba server. You can use the native Windows NT/200x/XP printer properties page from a Window client for this: -
Procedure 20.2. Procedure to Initialize the Printer Driver Settings
+
Procedure 20.2. Procedure to Initialize the Printer Driver Settings
Browse the Network Neighborhood.
Find the Samba server. @@ -1426,13 +1426,13 @@ you can follow the analogous steps by accessing the local Printers folder, too, if you are a Samba printer admin user. From now on, printing should work as expected.
- + Samba includes a service-level parameter name
default devmodefor generating a default device mode for a printer. Some drivers function well with Samba's default set of properties. Others may crash the client's spooler service. So use this parameter with caution. It is always better to have the client generate a valid device mode for the printer and store it on the server for you. -
+ Every additional driver may be installed in the same way as just described. Browse Network Neighborhood, open the Printers folder on Samba server, right-click on Printer, and choose . Once this completes (should be @@ -1445,17 +1445,17 @@
rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolderor this command on Windows NT 4.0 workstations: - +
rundll32 shell32.dll,Control_RunDLL MAIN.CPL @2You can enter the commands either inside a DOS box window or in the field from the menu. -
After you installed the driver on the Samba server (in its
[print$]share), you should always make sure that your first client installation completes correctly. Make it a habit for yourself -to build the very first connection from a client as printer admin. This is to make +to build the very first connection from a client as printer admin. This is to make sure that:A first valid device mode is really initialized (see above Setting Device Modes on New Printers) for more explanation details). @@ -1467,7 +1467,7 @@ Letter when you are all using A4, right? You may want to set the printer for duplex as the default, and so on).
- + To connect as root to a Samba printer, try this command from a Windows 200x/XP DOS box command prompt:
C:\>runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n @@ -1476,18 +1476,18 @@You will be prompted for
root's Samba password; type it, wait a few seconds, click on , and proceed to set the job options that should be used as defaults -by all clients. Alternatively, instead of root you can name one other member of the printer admin from the setting. +by all clients. Alternatively, instead of root you can name one other member of the printer admin from the setting.Now all the other users downloading and installing the driver the same way (using
Point'n'Print) will have the same defaults set for them. If you miss this step, you'll get a lot of help desk calls from your users, but maybe you like to talk to people. -
Your driver is installed. It is now ready for Point'n'Print installation by the clients. You may have tried to download and use it on your first client machine, but wait. Let's make sure you are acquainted first with a few tips and tricks you may find useful. For example, suppose you did not set the defaults on the printer, as advised in the preceding paragraphs. Your users complain about various issues (such as, “We need to set the paper size for each job from Letter to A4 and it will not store it”). -
+
The last sentence might be viewed with mixed feelings by some users and Admins. They have struggled for hours and could not arrive at a point where their settings seemed to be saved. It is not their fault. The confusing thing is that in the multitabbed dialog that pops up when you right-click on the printer name and select @@ -1524,7 +1524,7 @@ Do you see any difference in the two settings dialogs? I do not either. However, only the last one, which you arrived at with steps C.1 through C.6 will permanently save any settings which will then become the defaults for new users. If you want all clients to have the same defaults, you need to conduct these steps as -administrator (printer admin) before a client downloads the driver (the clients can +administrator (printer admin) before a client downloads the driver (the clients can later set their own per-user defaults by following procedures A or B above). Windows 200x/XP allow per-user default settings and the ones the administrator gives them before they set up their own. The parents of the identical-looking dialogs have a slight difference in their window names; one is called @@ -1536,7 +1536,7 @@ there is now a different path to arrive at an identical-looking, but functionally different, dialog to set defaults for all users.
Tip
Try (on Windows 200x/XP) to run this command (as a user with the right privileges): - +
rundll32 printui.dll,PrintUIEntry /p /t3 /n\\SAMBA-SERVER\printersharename
@@ -1547,7 +1547,7 @@ To see the tab with the Printing Preferences button (the one that does not set systemwide defaults), you can start the commands from inside a DOS box or from -> . -
One issue that has arisen during the recent development phase of Samba is the need to support driver downloads for hundreds of printers. Using Windows NT APW for this task is somewhat awkward (to say the least). If you do not want to acquire RSS pains from the printer installation clicking orgy alone, you need @@ -1630,19 +1630,19 @@ “dm9110” printer with an empty string where the driver should have been listed (between the two commas in the description field). After the setdriver command succeeds, all is well. -
By default, Samba exhibits all printer shares defined in smb.conf in the Printers
folder. Also located in this folder is the Windows NT Add Printer Wizard icon. The APW will be shown only if:
The connected user is able to successfully execute an OpenPrinterEx(\\server) with - administrative privileges (i.e., root or printer admin). + administrative privileges (i.e., root or printer admin).
Tip
Try this from a Windows 200x/XP DOS box command prompt:
runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharenameClick on .
... contains the setting - show add printer wizard = yes (the + show add printer wizard = yes (the default).
The APW can do various things:
@@ -1653,28 +1653,28 @@ Exchange the currently used driver for an existing print queue with one that has been uploaded before.
Add an entirely new printer to the Samba host (only in conjunction with a working - add printer command. A corresponding - delete printer command for removing entries from the + add printer command. A corresponding + delete printer command for removing entries from the Printers folder may also be provided).
The last one (add a new printer) requires more effort than the previous ones. To use the APW to successfully
-add a printer to a Samba server, the add printer command must have a defined value.
+add a printer to a Samba server, the add printer command must have a defined value.
The program hook must successfully add the printer to the UNIX print system (i.e., to
/etc/printcap, /etc/cups/printers.conf or other appropriate files)
and to smb.conf if necessary.
When using the APW from a client, if the named printer share does not exist, smbd will execute the -add printer command and reparse to attempt to locate the new printer share. If the +add printer command and reparse to attempt to locate the new printer share. If the share is still not defined, an error of "Access Denied" is returned to the client. The -add printer command is executed under the context of the connected user, not -necessarily a root account. A map to guest = bad user may have connected +add printer command is executed under the context of the connected user, not +necessarily a root account. A map to guest = bad user may have connected you unwittingly under the wrong privilege. You should check it by using the smbstatus command. -
Once you are connected with the wrong credentials, there is no means to reverse the situation other than to close all Explorer windows, and perhaps reboot.
- + The net use \\SAMBA-SERVER\sharename /user:root gives you an error message: “Multiple connections to a server or a shared resource by the same user utilizing several user names are not allowed. Disconnect all previous connections to the server, @@ -1700,7 +1700,7 @@
C:\>net use * /deleteThis will also disconnect all mapped drives and will allow you create fresh connection as required. -
You need to be extremely careful when you take notes about the files belonging to a particular
driver. Don't confuse the files for driver version “0” (for Windows 9x/Me, going into
[print$]/WIN/0/), driver version 2 (kernel mode driver for Windows NT,
@@ -1831,11 +1831,11 @@
In my example were even more differences than shown here. Conclusion: you must be careful to select the
correct driver files for each driver version. Don't rely on the names alone, and don't interchange files
belonging to different driver versions.
-
+
+
+
+
Windows NT/2000 print servers associate a port with each printer. These normally take the form of
LPT1:, COM1:, FILE:, and so on. Samba must also
support the concept of ports associated with a printer. By default, only one printer port, named “Samba
@@ -1844,22 +1844,22 @@
they request this information; otherwise, they throw an error message at you. So Samba fakes the port
information to keep the Windows clients happy.
-
+
Samba does not support the concept of Printer Pooling internally either. Printer
pooling assigns a logical printer to multiple ports as a form of load balancing or failover.
If you require multiple ports to be defined for some reason or another (my users and my boss should not know -that they are working with Samba), configure the enumports command, +that they are working with Samba), configure the enumports command, which can be used to define an external program that generates a listing of ports on a system. -
So now the printing works, but there are still problems. Most jobs print well, some do not print at all. Some jobs have problems with fonts, which do not look good. Some jobs print fast and some are dead-slow. We cannot cover it all, but we want to encourage you to read the brief paragraph about “Avoiding the Wrong PostScript Driver Settings” in CUPS Printing Chapter, Avoiding Critical PostScript Driver Settings on the Client. -
+ The Imprints tool set provides a UNIX equivalent of the Windows NT APW. For complete information, please refer to the Imprints Web site as well as the documentation included with the Imprints source distribution. This section provides only a brief introduction @@ -1871,7 +1871,7 @@ mailing list. The toolset is still in usable form, but only for a series of older printer models where there are prepared packages to use. Packages for more up-to-date print devices are needed if Imprints should have a future. Information regarding the Imprints toolset can be obtained from the Imprints home page. -
+
Imprints is a collection of tools for supporting these goals:
Providing a central repository of information regarding Windows NT and 95/98 printer driver packages. @@ -1880,19 +1880,19 @@
Providing an installation client that will obtain printer drivers from a central Internet (or intranet) Imprints Server repository and install them on remote Samba and Windows NT4 print servers. -
The process of creating printer driver packages is beyond the scope of this document (refer to Imprints.txt, included with the Samba distribution for more information). In short, an Imprints driver package is a gzipped tarball containing the driver files, related INF files, and a control file needed by the installation client. -
The Imprints server is really a database server that may be queried via standard HTTP mechanisms. Each printer entry in the database has an associated URL for the actual downloading of the package. Each package is digitally signed via GnuPG, which can be used to verify that the package downloaded is actually the one referred in the Imprints database. It is strongly recommended that this security check not be disabled. -
More information regarding the Imprints installation client is available from the the documentation file
Imprints-Client-HOWTO.ps that is included with the Imprints source package. The Imprints
installation client comes in two forms:
@@ -1922,7 +1922,7 @@
The way of sidestepping this limitation is to require that all Imprints printer driver packages include both the Intel Windows NT and 95/98 printer drivers and that the NT driver is installed first. -
The following MS Knowledge Base article may be of some help if you need to handle Windows 2000 clients: How to Add Printers with No User Interaction in Windows 2000, (Microsoft KB 189105). It also applies to Windows XP Professional clients. The ideas sketched out in this section are inspired by this @@ -1981,7 +1981,7 @@ up to date. The few extra seconds at logon time will not really be noticeable. Printers can be centrally added, changed, and deleted at will on the server with no user intervention required from the clients (you just need to keep the logon scripts up to date). -
The addprinter command can be configured to be a shell script or program executed by Samba. It is triggered by running the APW from a client against the Samba print server. The APW asks the user to fill in several fields (such as printer name, driver to be used, comment, port monitor, @@ -1989,7 +1989,7 @@ way that it can create a new printer (through writing correct printcap entries on legacy systems or by executing the lpadmin command on more modern systems) and create the associated share, then the APW will in effect really create a new printer on Samba and the UNIX print subsystem! -
The basic NT-style printer driver management has not changed considerably in 3.0 over the 2.2.x releases (apart from many small improvements). Here migration should be quite easy, especially if you followed previous advice to stop using deprecated parameters in your setup. For migrations from an existing 2.0.x @@ -2019,11 +2019,11 @@ solution is to use the Windows NT APW to install the NT drivers and the 9x/Me drivers. This can be scripted using smbclient and rpcclient. See the Imprints installation client on the Imprints web site for example. See also the discussion of rpcclient usage in CUPS Printing. -
This topic has also been addressed in Remote and Local Management The Net Command. If you wish to volunteer your services to help document this further, please contact John H. Terpstra. -
Do not confuse the root password, which is valid for the UNIX system (and in most cases stored in the
form of a one-way hash in a file named /etc/shadow), with the password used to
authenticate against Samba. Samba does not know the UNIX password. Root access to Samba resources
@@ -2034,7 +2034,7 @@
New SMB password: secret
Retype new SMB password: secret
-
Do not use the existing UNIX print system spool directory for the Samba spool directory. It may seem
convenient and a savings of space, but it only leads to problems. The two must be separate. The UNIX/Linux
system print spool directory (e.g., /var/spool/cups) is typically owned by a
diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/ClientConfig.html samba-3.0.20/docs/htmldocs/Samba3-HOWTO/ClientConfig.html
--- samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/ClientConfig.html 2005-08-07 11:24:47.000000000 -0500
+++ samba-3.0.20/docs/htmldocs/Samba3-HOWTO/ClientConfig.html 2005-08-19 13:03:24.000000000 -0500
@@ -1,20 +1,20 @@
-
Table of Contents
Table of Contents
+ + + Occasionally network administrators report difficulty getting Microsoft Windows clients to interoperate correctly with Samba servers. It seems that some folks just cannot accept the fact that the right way to configure an MS Windows network client is precisely as one would do when using MS Windows NT4 or 200x servers. Yet there is repetitious need to provide detailed Windows client configuration instructions.
- - + + The purpose of this chapter is to graphically illustrate MS Windows client configuration for the most common critical aspects of such configuration. An experienced network administrator will not be interested in the details of this chapter. -
+ + This chapter discusses TCP/IP protocol configuration as well as network membership for the platforms that are in common use today. These are:
@@ -23,27 +23,27 @@ Windows 2000 Professional
Windows Millennium edition (Me) -
+ + The builder of a house must ensure that all construction takes place on a firm foundation. The same is true for the builder of a TCP/IP-based networking system. Fundamental network configuration problems will plague all network users until they are resolved.
- - + + MS Windows workstations and servers can be configured either with fixed IP addresses or via DHCP. The examples that follow demonstrate the use of DHCP and make only passing reference to those situations where fixed IP configuration settings can be effected.
- - + + It is possible to use shortcuts or abbreviated keystrokes to arrive at a particular configuration screen. The decision was made to base all examples in this chapter on use of the button. -
+ There are two paths to the Windows XP TCP/IP configuration panel. Choose the access method that you prefer:
Click . @@ -51,48 +51,48 @@ Alternately, click , and right-click then select .
- + The following procedure steps through the Windows XP Professional TCP/IP configuration process:
- - - + + + On some installations the interface will be called and on others it will be called . On our system it is called . Right-click on . See ???.
- - + + The Network Bridge Configuration, or Local Area Connection, panel is used to set TCP/IP protocol settings. In box, click on , then click on .
- - + + The default setting is DHCP-enabled operation (i.e., “Obtain an IP address automatically”). See ???.
- - - - + + + + Many network administrators will want to use DHCP to configure all client TCP/IP protocol stack settings. (For information on how to configure the ISC DHCP server for Windows client support see the DNS and DHCP Configuration Guide, DHCP Server.
- - - + + + If it is necessary to provide a fixed IP address, click on “Use the following IP address” and enter the IP Address, the subnet mask, and the default gateway address in the boxes provided.
- - - - + + + + Click the button to proceed with TCP/IP configuration. This opens a panel in which it is possible to create additional IP addresses for this interface. The technical name for the additional addresses is IP aliases, and additionally this @@ -100,28 +100,28 @@ necessary to create additional settings. See ??? to see the appearance of this panel.
- - - + + + Fixed settings may be required for DNS and WINS if these settings are not provided automatically via DHCP.
- - + + Click the tab to add DNS server settings. The example system uses manually configured DNS settings. When finished making changes, click the to commit the settings. See ???.
- - + + Click the tab to add manual WINS server entries. This step demonstrates an example system that uses manually configured WINS settings. When finished making changes, click to commit the settings. See ???.
-
+ + There are two paths to the Windows 2000 Professional TCP/IP configuration panel. Choose the access method that you prefer:
Click . @@ -129,33 +129,33 @@ Alternatively, click , then right-click , and select .
- + The following procedure steps through the Windows XP Professional TCP/IP configuration process:
Right-click on , then click . See ???.
- - + + The Local Area Connection Properties is used to set TCP/IP protocol settings. Click on in the box, then click the button.
- - + + The default setting is DHCP-enabled operation (i.e., “Obtain an IP address automatically”). See ???.
- - + + Many network administrators will want to use DHCP to configure all client TCP/IP protocol stack settings. (For information on how to configure the ISC DHCP server for Windows client support, see, ???.
- - + + If it is necessary to provide a fixed IP address, click on “Use the following IP address” and enter the IP Address, the subnet mask, and the default gateway address in the boxes provided. For this example we are assuming that all network clients will be configured using DHCP. @@ -164,50 +164,50 @@ Refer to ???.
- - - + + + Fixed settings may be required for DNS and WINS if these settings are not provided automatically via DHCP.
- - + + Click the tab to add DNS server settings. The example system uses manually configured DNS settings. When finished making changes, click to commit the settings. See ???.
- - + + Click the tab to add manual WINS server entries. This step demonstrates an example system that uses manually configured WINS settings. When finished making changes, click to commit the settings. See ???.
-
+ + + There are two paths to the Windows Millennium edition (Me) TCP/IP configuration panel. Choose the access method that you prefer:
Click .
- - + + Alternatively, click on , and right click on then select .
- + The following procedure steps through the Windows Me TCP/IP configuration process:
- + In the box labeled , click on , then click on the button. See ???.
- - - + + + Many network administrators will want to use DHCP to configure all client TCP/IP protocol stack settings. (For information on how to configure the ISC DHCP server for Windows client support see the DNS and DHCP Configuration Guide, @@ -215,41 +215,41 @@ (i.e., is enabled). See ???.
- - - + + + If it is necessary to provide a fixed IP address, click on and enter the IP Address and the subnet mask in the boxes provided. For this example we are assuming that all network clients will be configured using DHCP.
- - + + Fixed settings may be required for DNS and WINS if these settings are not provided automatically via DHCP.
- + If necessary, click the tab to add DNS server settings. Click the tab to add WINS server settings. The tab allows additional gateways (router addresses) to be added to the network interface settings. In most cases where DHCP is used, it will not be necessary to create these manual settings.
- - + + The following example uses manually configured WINS settings. See ???. When finished making changes, click to commit the settings.
- - + + This is an example of a system that uses manually configured WINS settings. One situation where this might apply is on a network that has a single DHCP server that provides settings for multiple Windows workgroups or domains. See ???.
-
+ + + + Microsoft Windows NT/200x/XP Professional platforms can participate in domain security. This section steps through the process for making a Windows 200x/XP Professional machine a member of a domain security environment. It should be noted that this process is identical @@ -259,18 +259,18 @@
Right-click , then select .
- + The opening panel is the same one that can be reached by clicking on the Control Panel. See ???.
- + Click the tab. This panel shows the , the , and the or .
- - + + Clicking the button will launch the configuration wizard. Do not use this with Samba-3. If you wish to change the computer name or join or leave the domain, click the button. See ???. @@ -280,38 +280,38 @@ We will join the domain called MIDEARTH. See ???.
- + Enter the name in the field below the domain radio button.
This panel shows that our example machine (TEMPTATION) is set to join the domain called MIDEARTH. See ???.
- - + + Now click the button. A dialog box should appear to allow you to provide the credentials (username and password) of a domain administrative account that has the rights to add machines to the domain.
- + Enter the name “root” and the root password from your Samba-3 server. See ???.
Click on .
- - + + The “Welcome to the MIDEARTH domain.” dialog box should appear. At this point the machine must be rebooted. Joining the domain is now complete. -
+ + + We follow the convention used by most in saying that Windows 9x/Me machines can participate in domain logons. The truth is that these platforms can use only the LanManager network logon protocols.
Right-click on the icon. @@ -320,44 +320,44 @@ See ???.
- - + + Make sure that the driver is installed as shown. Click on the entry in box. Then click the button.
- - + + The Client for Microsoft Networks Properties panel is the correct location to configure network logon settings. See ???.
- - + + Enter the Windows NT domain name, check the box, and click .
- - - + + + Click on the button. This is the location at which the workgroup (domain) name and the machine name (computer name) need to be set. See ???.
- - - - + + + + Now click the button. If you want to be able to assign share access permissions using domain user and group accounts, it is necessary to enable as shown in this panel. See ???.
-
+ + The most common errors that can afflict Windows networking systems include:
Incorrect IP address.
Incorrect or inconsistent netmasks.
Incorrect router address.
Incorrect DNS server address.
Incorrect WINS server address.
Use of a Network Scope setting watch out for this one!
- - + + The most common reasons for which a Windows NT/200x/XP Professional client cannot join the Samba controlled domain are: -
“root” account is not in password backend database.
Attempt to use a user account instead of the “root” account to join a machine to the domain.
Open connections from the workstation to the server.
Firewall or filter configurations in place on either the client or the Samba server.
“root” account is not in password backend database.
Attempt to use a user account instead of the “root” account to join a machine to the domain.
Open connections from the workstation to the server.
Firewall or filter configurations in place on either the client or the Samba server.
Table of Contents
+
Table of Contents
You can obtain the Samba source file from the Samba Web site. To obtain a development version, you can download Samba from Subversion or using rsync. -
+ Samba is developed in an open environment. Developers use a Subversion to “checkin” (also known as “commit”) new source code. Samba's various Subversion branches can @@ -12,13 +12,13 @@
This chapter is a modified version of the instructions found at the Samba Web site. -
The machine samba.org runs a publicly accessible Subversion repository for access to the source code of several packages, including Samba, rsync, distcc, ccache, and jitterbug. There are two main ways of accessing the Subversion server on this host. -
+ You can access the source code via your favorite WWW browser. This allows you to access the contents of individual files in the repository and also to look at the revision history and commit logs of individual files. You can also ask for a diff @@ -26,8 +26,8 @@
Use the URL http://svnweb.samba.org/. -
+ You can also access the source code via a normal Subversion client. This gives you much more control over what you can do with the repository and allows you to check out whole source trees and keep them up to date via normal Subversion commands. This is the preferred method of access if you are a developer and not just a @@ -37,7 +37,7 @@ sources from http://subversion.tigris.org/.
To gain access via anonymous Subversion, use the following steps. -
+
+
pserver.samba.org also exports unpacked copies of most parts of the Subversion tree
at the Samba pserver location and also
via anonymous rsync at the Samba rsync server location. I recommend using rsync rather
@@ -74,9 +74,9 @@
The disadvantage of the unpacked trees is that they do not support automatic
merging of local changes as Subversion does. rsync access is most convenient
for an initial install.
-
+
+
It is strongly recommended that you verify the PGP signature for any source file before
installing it. Even if you're not downloading from a mirror site, verifying PGP signatures
should be a standard reflex. Many people today use the GNU GPG tool set in place of PGP.
@@ -87,7 +87,7 @@
$ wget http://us1.samba.org/samba/ftp/samba-3.0.20.tar.asc
$ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc
- + The first file is the PGP signature for the Samba source file; the other is the Samba public PGP key itself. Import the public PGP key with:
@@ -105,9 +105,9 @@gpg: BAD signature from “Samba Distribution Verification Key”-
+
+
After the source tarball has been unpacked, the next step involves
configuration to match Samba to your operating system platform.
If your source directory does not contain the configure script,
@@ -120,7 +120,7 @@
root# ./autogen.sh
-
+
To build the binaries, run the program ./configure
in the source directory. This should automatically
configure Samba for your operating system. If you have unusual
@@ -135,7 +135,7 @@
root# ./configure
[... arguments ...]
- + Execute the following create the binaries:
root#make@@ -164,7 +164,7 @@
As you can see from this, building and installing Samba does not need to result in disaster! -
+
In order to compile Samba with ADS support, you need to have installed on your system:
@@ -187,13 +187,13 @@ If it does not, configure did not find your KRB5 libraries or your LDAP libraries. Look in
config.logto figure out why and fix it. -On Debian, you need to install the following packages:
+
On Debian, you need to install the following packages:
libkrb5-dev
krb5-user
-
On Red Hat Linux, this means you should have at least:
+
On Red Hat Linux, this means you should have at least:
krb5-workstation (for kinit)
krb5-libs (for linking with)
krb5-devel (because you are compiling from source)
in addition to the standard development environment.
If these files are not installed on your system, you should check the installation CDs to find which has them and install the files using your tool of choice. If in doubt - about what tool to use, refer to the Red Hat Linux documentation.
SuSE Linux installs Heimdal packages that may be required to allow you to build binary packages. You should verify that the development libraries have been installed on your system. @@ -204,7 +204,7 @@ the maximum capabilities that are available. You should consider using SuSE-provided packages where they are available.
-
+
You must choose to start smbd, winbindd and nmbd either as daemons or from
inetd. Don't try to do both! Either you can put
them in inetd.conf and have them started on demand by
@@ -216,7 +216,7 @@
The main advantage of starting smbd and nmbd using the recommended daemon method is that they will respond slightly more quickly to an initial connection request. -
Note
The following will be different if +
Note
The following will be different if you use NIS, NIS+, or LDAP to distribute services maps.
Look at your /etc/services.
What is defined at port 139/tcp? If nothing is defined,
then add a line like this:
netbios-ssn 139/tcp
Similarly for 137/udp, you should have an entry like:
netbios-ns 137/udp
@@ -225,12 +225,12 @@ netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd
-
+
The exact syntax of /etc/inetd.conf
varies between UNIXes. Look at the other entries in inetd.conf
for a guide.
- + Some distributions use xinetd instead of inetd. Consult the xinetd manual for configuration information.
Note
Some UNIXes already have entries like netbios_ns
@@ -238,9 +238,9 @@
You must edit /etc/services or
/etc/inetd.conf to make them consistent.
Note
-
+
On many systems you may need to use the
- interfaces option in smb.conf to specify
+ interfaces option in smb.conf to specify
the IP address and netmask of your interfaces. Run
ifconfig as root if you do
not know what the broadcast is for your net. nmbd tries
@@ -253,13 +253,13 @@
Restart inetd, perhaps just send it a HUP, like this: - +
root#killall -HUP inetd
-
+
+
To start the server as a daemon, you should create a script something
like this one, perhaps calling it startsmb.
@@ -278,7 +278,7 @@
If you use the SVR4-style init system, you may like to look at the
examples/svr4-startup script to make Samba fit
into that system.
-
Red Hat Linux has not always included all Samba components in the standard installation.
So versions of Red Hat Linux do not install the winbind utility, even though it is present
on the installation CDROM media. Check to see if the winbindd is present
@@ -311,7 +311,7 @@
root# chkconfig winbind on
Samba will be started automatically at every system reboot. -
Novell SUSE Linux products automatically install all essential Samba components in a default installation.
Configure your smb.conf file, then execute the following to start Samba:
diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/CUPS-printing.html samba-3.0.20/docs/htmldocs/Samba3-HOWTO/CUPS-printing.html --- samba-3.0.20rc2/docs/htmldocs/Samba3-HOWTO/CUPS-printing.html 2005-08-07 11:25:05.000000000 -0500 +++ samba-3.0.20/docs/htmldocs/Samba3-HOWTO/CUPS-printing.html 2005-08-19 13:03:40.000000000 -0500 @@ -1,8 +1,8 @@ -Chapter 21. CUPS Printing Support Table of Contents
- Introduction
- Basic CUPS Support Configuration
- Advanced Configuration
- Advanced Intelligent Printing with PostScript Driver Download
- GDI on Windows, PostScript on UNIX
- Windows Drivers, GDI, and EMF
- UNIX Printfile Conversion and GUI Basics
- PostScript and Ghostscript
- Ghostscript: The Software RIP for Non-PostScript Printers
- PostScript Printer Description (PPD) Specification
- Using Windows-Formatted Vendor PPDs
- CUPS Also Uses PPDs for Non-PostScript Printers
- The CUPS Filtering Architecture
- MIME Types and CUPS Filters
- MIME Type Conversion Rules
- Filtering Overview
- Prefilters
- pstops
- pstoraster
- imagetops and imagetoraster
- rasterto [printers specific]
- CUPS Backends
- The Role of
cupsomatic/foomatic- The Complete Picture
mime.convs- “Raw” Printing
- application/octet-stream Printing
- PostScript Printer Descriptions for Non-PostScript Printers
- cupsomatic/foomatic-rip Versus Native CUPS Printing
- Examples for Filtering Chains
- Sources of CUPS Drivers/PPDs
- Printing with Interface Scripts
- Network Printing (Purely Windows)
- Network Printing (Windows Clients and UNIX/Samba Print -Servers)
- Network PostScript RIP
- Windows Terminal Servers (WTS) as CUPS Clients
- Configuring CUPS for Driver Download
- cupsaddsmb: The Unknown Utility
- Prepare Your
smb.conffor cupsaddsmb- CUPS “PostScript Driver for Windows NT/200x/XP”
- Recognizing Different Driver Files
- Acquiring the Adobe Driver Files
- ESP Print Pro PostScript Driver for Windows NT/200x/XP
- Caveats to Be Considered
- Windows CUPS PostScript Driver Versus Adobe Driver
- Run cupsaddsmb (Quiet Mode)
- Run cupsaddsmb with Verbose Output
- Understanding cupsaddsmb
- How to Recognize If cupsaddsmb Completed Successfully
- cupsaddsmb with a Samba PDC
- cupsaddsmb Flowchart
- Installing the PostScript Driver on a Client
- Avoiding Critical PostScript Driver Settings on the Client
- Installing PostScript Driver Files Manually Using rpcclient
- The Printing
*.tdbFiles- CUPS Print Drivers from Linuxprinting.org
- Page Accounting with CUPS
- Additional Material
- Autodeletion or Preservation of CUPS Spool Files
- Printing from CUPS to Windows-Attached Printers
- More CUPS Filtering Chains
- Common Errors
- Windows 9x/Me Client Can't Install Driver
- “cupsaddsmb” Keeps Asking for Root Password in Never-ending Loop
- “cupsaddsmb” or “rpcclient addriver” Emit Error
- “cupsaddsmb” Errors
- Client Can't Connect to Samba Printer
- New Account Reconnection from Windows 200x/XP Troubles
- Avoid Being Connected to the Samba Server as the Wrong User
- Upgrading to CUPS Drivers from Adobe Drivers
- Can't Use “cupsaddsmb” on Samba Server, Which Is a PDC
- Deleted Windows 200x Printer Driver Is Still Shown
- Windows 200x/XP Local Security Policies
- Administrator Cannot Install Printers for All Local Users
- Print Change, Notify Functions on NT Clients
- Win XP-SP1
- Print Options for All Users Can't Be Set on Windows 200x/XP
- Most Common Blunders in Driver Settings on Windows Clients
- cupsaddsmb Does Not Work with Newly Installed Printer
- Permissions on
/var/spool/samba/Get Reset After Each Reboot- Print Queue Called “lp” Mishandles Print Jobs
- Location of Adobe PostScript Driver Files for “cupsaddsmb”
- Overview of the CUPS Printing Processes
Chapter 21. CUPS Printing Support Table of Contents
- Introduction
- Basic CUPS Support Configuration
- Advanced Configuration
- Advanced Intelligent Printing with PostScript Driver Download
- GDI on Windows, PostScript on UNIX
- Windows Drivers, GDI, and EMF
- UNIX Printfile Conversion and GUI Basics
- PostScript and Ghostscript
- Ghostscript: The Software RIP for Non-PostScript Printers
- PostScript Printer Description (PPD) Specification
- Using Windows-Formatted Vendor PPDs
- CUPS Also Uses PPDs for Non-PostScript Printers
- The CUPS Filtering Architecture
- MIME Types and CUPS Filters
- MIME Type Conversion Rules
- Filtering Overview
- Prefilters
- pstops
- pstoraster
- imagetops and imagetoraster
- rasterto [printers specific]
- CUPS Backends
- The Role of
cupsomatic/foomatic- The Complete Picture
mime.convs- “Raw” Printing
- application/octet-stream Printing
- PostScript Printer Descriptions for Non-PostScript Printers
- cupsomatic/foomatic-rip Versus Native CUPS Printing
- Examples for Filtering Chains
- Sources of CUPS Drivers/PPDs
- Printing with Interface Scripts
- Network Printing (Purely Windows)
- Network Printing (Windows Clients and UNIX/Samba Print +Servers)
- Network PostScript RIP
- Windows Terminal Servers (WTS) as CUPS Clients
- Configuring CUPS for Driver Download
- cupsaddsmb: The Unknown Utility
- Prepare Your
smb.conffor cupsaddsmb- CUPS “PostScript Driver for Windows NT/200x/XP”
- Recognizing Different Driver Files
- Acquiring the Adobe Driver Files
- ESP Print Pro PostScript Driver for Windows NT/200x/XP
- Caveats to Be Considered
- Windows CUPS PostScript Driver Versus Adobe Driver
- Run cupsaddsmb (Quiet Mode)
- Run cupsaddsmb with Verbose Output
- Understanding cupsaddsmb
- How to Recognize If cupsaddsmb Completed Successfully
- cupsaddsmb with a Samba PDC
- cupsaddsmb Flowchart
- Installing the PostScript Driver on a Client
- Avoiding Critical PostScript Driver Settings on the Client
- Installing PostScript Driver Files Manually Using rpcclient
- The Printing
*.tdbFiles- CUPS Print Drivers from Linuxprinting.org
- Page Accounting with CUPS
- Additional Material
- Autodeletion or Preservation of CUPS Spool Files
- Printing from CUPS to Windows-Attached Printers
- More CUPS Filtering Chains
- Common Errors
- Windows 9x/Me Client Can't Install Driver
- “cupsaddsmb” Keeps Asking for Root Password in Never-ending Loop
- “cupsaddsmb” or “rpcclient addriver” Emit Error
- “cupsaddsmb” Errors
- Client Can't Connect to Samba Printer
- New Account Reconnection from Windows 200x/XP Troubles
- Avoid Being Connected to the Samba Server as the Wrong User
- Upgrading to CUPS Drivers from Adobe Drivers
- Can't Use “cupsaddsmb” on Samba Server, Which Is a PDC
- Deleted Windows 200x Printer Driver Is Still Shown
- Windows 200x/XP Local Security Policies
- Administrator Cannot Install Printers for All Local Users
- Print Change, Notify Functions on NT Clients
- Win XP-SP1
- Print Options for All Users Can't Be Set on Windows 200x/XP
- Most Common Blunders in Driver Settings on Windows Clients
- cupsaddsmb Does Not Work with Newly Installed Printer
- Permissions on
/var/spool/samba/Get Reset After Each Reboot- Print Queue Called “lp” Mishandles Print Jobs
- Location of Adobe PostScript Driver Files for “cupsaddsmb”
- Overview of the CUPS Printing Processes
+ The Common UNIX Print System (CUPS) has become quite popular. All major Linux distributions now ship it as their default printing system. To many, it is still a mystical tool. Mostly, it just works. People tend to regard @@ -11,21 +11,21 @@ Classical Printing, which contains much information that is also relevant to CUPS.
- + CUPS sports quite a few unique and powerful features. While its basic functions may be grasped quite easily, they are also new. Because it is different from other, more traditional printing systems, it is best not to try to apply any prior knowledge about printing to this new system. Rather, try to understand CUPS from the beginning. This documentation will lead you to a complete understanding of CUPS. Let's start with the most basic things first. -
+ - - + + + + + + CUPS is more than just a print spooling system. It is a complete printer management system that complies with the new Internet Printing Protocol (IPP). IPP is an industry and Internet Engineering Task Force (IETF) standard for network printing. Many of its functions can be managed remotely (or locally) via a Web @@ -33,21 +33,21 @@ traditional command line and several more modern GUI interfaces (GUI interfaces developed by third parties, like KDE's overwhelming KDEPrint).
- - + + CUPS allows creation of raw printers (i.e., no print file format translation) as well as smart printers (i.e., CUPS does file format conversion as required for the printer). In many ways, this gives CUPS capabilities similar to the MS Windows print monitoring system. Of course, if you are a CUPS advocate, you would argue that CUPS is better! In any case, let us now explore how to configure CUPS for interfacing with MS Windows print clients via Samba. -
+ + + + + Printing with CUPS in the most basic
smb.confsetup in Samba-3.0 (as was true for 2.2.x) requires just two -parameters: printing = cups and printcap = cups. CUPS does not need a printcap file. However, the +parameters: printing = cups and printcap = cups. CUPS does not need a printcap file. However, thecupsd.confconfiguration file knows of two related directives that control how such a file will be automatically created and maintained by CUPS for the convenience of third-party applications (example:Printcap /etc/printcapandPrintcapFormat BSD). @@ -55,17 +55,17 @@ print. Make sure CUPS is set to generate and maintain a printcap file. For details, see man cupsd.conf and other CUPS-related documentation, like the wealth of documents regarding the CUPS server itself available from the CUPS web site. -+ Samba has a special relationship to CUPS. Samba can be compiled with CUPS library support. Most recent installations have this support enabled. By default, CUPS linking is compiled into smbd and other Samba binaries. Of course, you can use CUPS even if Samba is not linked against
libcups.sobut there are some differences in required or supported configuration.- - - When Samba is compiled and linked with
libcups, printcap = cups + + + When Samba is compiled and linked withlibcups, printcap = cups uses the CUPS API to list printers, submit jobs, query queues, and so on. Otherwise it maps to the System V commands with an additional -oraw option for printing. On a Linux system, you can use the ldd utility to find out if smbd has been linked with the @@ -79,30 +79,30 @@ [....]
- + The line
libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)shows there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups is set, then any otherwise manually set print command insmb.confis ignored. This is an important point to remember!Tip
Should it be necessary, for any reason, to set your own print commands, you can do this by setting - printing = sysv. However, you will lose all the benefits + printing = sysv. However, you will lose all the benefits of tight CUPS-Samba integration. When you do this, you must manually configure the printing system commands (most important: - print command; other commands are - lppause command, - lpresume command, - lpq command, - lprm command, - queuepause command and - queue resume command). -
To summarize, the Simplest Printing-Related
smb.conffile shows the simplest printing-related setup forsmb.confto enable basic CUPS support: -Example 21.1. Simplest Printing-Related smb.conf
[global]load printers = yesprinting = cupsprintcap name = cups[printers]comment = All Printerspath = /var/spool/sambabrowseable = nopublic = yesguest ok = yeswritable = noprintable = yesprinter admin = root, @ntadminsExample 21.1. Simplest Printing-Related smb.conf
[global]load printers = yesprinting = cupsprintcap name = cups[printers]comment = All Printerspath = /var/spool/sambabrowseable = nopublic = yesguest ok = yeswritable = noprintable = yesprinter admin = root, @ntadmins+ + + This is all you need for basic printing setup for CUPS. It will print all graphic, text, PDF, and PostScript files submitted from Windows clients. However, most of your Windows users would not know how to send these kinds of files to print without opening a GUI application. Windows clients tend to have local printer drivers @@ -112,25 +112,25 @@ hooked between the application's native format and the print data stream. If the backend printer is not a PostScript device, the print data stream is “binary,” sensible only for the target printer. Read on to learn what problem this may cause and how to avoid it. -
The Overriding Global CUPS Settings for One Printer example is a slightly more complex printing-related setup for
smb.conf. It enables general CUPS printing support for all printers, but defines one printer share, which is set up differently. -Example 21.2. Overriding Global CUPS Settings for One Printer
[global]printing = cupsprintcap name = cupsload printers = yes[printers]comment = All Printerspath = /var/spool/sambapublic = yesguest ok = yeswritable = noprintable = yesprinter admin = root, @ntadmins[special_printer]comment = A special printer with his own settingspath = /var/spool/samba-specialprinting = sysvprintcap = lpstatprint command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log ; rm %fpublic = noguest ok = nowritable = noprintable = yesprinter admin = kurthosts deny = 0.0.0.0hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60+
Example 21.2. Overriding Global CUPS Settings for One Printer
[global]printing = cupsprintcap name = cupsload printers = yes[printers]comment = All Printerspath = /var/spool/sambapublic = yesguest ok = yeswritable = noprintable = yesprinter admin = root, @ntadmins[special_printer]comment = A special printer with his own settingspath = /var/spool/samba-specialprinting = sysvprintcap = lpstatprint command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log ; rm %fpublic = noguest ok = nowritable = noprintable = yesprinter admin = kurthosts deny = 0.0.0.0hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60This special share is only for testing purposes. It does not write the print job to a file. It just logs the job parameters known to Samba into the
/tmp/smbprn.logfile and deletes the job-file. Moreover, the - printer admin of this share is “kurt” (not the “@ntadmins” group), + printer admin of this share is “kurt” (not the “@ntadmins” group), guest access is not allowed, the share isn't published to the Network Neighborhood (so you need to know it is there), and it allows access from only three hosts. To prevent CUPS from kicking in and taking over the print jobs for that share, we need to set - printing = sysv and printcap = lpstat. -Before we delve into all the configuration options, let us clarify a few points. Network printing needs to be organized and set up correctly. This frequently doesn't happen. Legacy systems or small business LAN environments often lack design and good housekeeping. -
+ + + Many small office or home networks, as well as badly organized larger environments, allow each client a direct access to available network printers. This is generally a bad idea. It often blocks one client's access to the printer when another client's job is printing. It might freeze the first client's application while it is @@ -138,9 +138,9 @@ pages mixed with each other. A better concept is the use of a print server: it routes all jobs through one central system, which responds immediately, takes jobs from multiple concurrent clients, and transfers them to the printer(s) in the correct order. -
+ + Most traditionally configured UNIX print servers acting on behalf of Samba's Windows clients represented a really simple setup. Their only task was to manage the “raw” spooling of all jobs handed to them by @@ -149,8 +149,8 @@ device. In this case, a native (vendor-supplied) Windows printer driver needs to be installed on each and every client for the target device.
- - + + It is possible to configure CUPS, Samba, and your Windows clients in the same traditional and simple way. When CUPS printers are configured for raw print-through mode operation, it is the responsibility of the @@ -164,15 +164,15 @@ This is achieved by installation of the printer as if it were physically attached to the Windows client. You then redirect output to a raw network print queue. This procedure may be followed to achieve this: -
Procedure 21.1. Configuration Steps for Raw CUPS Printing Support
Procedure 21.1. Configuration Steps for Raw CUPS Printing Support
+ Edit
/etc/cups/mime.typesto uncomment the line near the end of the file that has:#application/octet-...
Add a raw printer using the Web interface. Point your browser at @@ -181,10 +181,10 @@ Choose Raw. Choose queue name
Raw Queue.In the
smb.conffile[printers]section add - use client driver = Yes, + use client driver = Yes, and in the[global]section add - printing = CUPS, plus - printcap = CUPS. + printing = CUPS, plus + printcap = CUPS.Install the printer as if it is a local printer, that is, Printing to
LPT1:.@@ -193,14 +193,14 @@ you have configured above. Example:
\\server\raw_q. Here, the nameraw_qis the name you gave the print queue in the CUPS environment. -The printer drivers on the Windows clients may be installed in two functionally different ways:
Manually install the drivers locally on each client, one by one; this yields the old LanMan style printing and uses a
\\sambaserver\printersharetype of connection.- + Deposit and prepare the drivers (for later download) on the print server (Samba); this enables the clients to use “Point'n'Print” to get drivers semi-automatically installed the @@ -209,9 +209,9 @@ type printing calls.
The second method is recommended for use over the first.
- - - + + + If you use the first option (drivers are installed on the client side), there is one setting to take care of: CUPS needs to be told that it should allow “raw” printing of deliberate (binary) file @@ -223,10 +223,10 @@
application/octet-stream- - + + In
/etc/cups/mime.convs, have this line: - +application/octet-stream application/vnd.cups-raw 0 -@@ -237,8 +237,8 @@ Editing the
mime.convsand themime.typesfile does not enforce “raw” printing, it only allows it.Background. - - + + That CUPS is a more security-aware printing system than traditional ones does not by default allow a user to send deliberate (possibly binary) data to printing devices. This could be easily abused to launch a “Denial of Service” attack on your printer(s), causing at least the loss of a lot of paper and @@ -252,11 +252,11 @@ locally installed. If you are not interested in background information about more advanced CUPS/Samba printing, simply skip the remaining sections of this chapter. -
This section describes three familiar methods, plus one new one, by which printer drivers may be uploaded.
- + If you want to use the MS-RPC-type printing, you must upload the drivers onto the Samba server first (
[print$]share). For a discussion on how to deposit printer drivers on the @@ -265,27 +265,27 @@ chapter of this book. There you will find a description or reference to three methods of preparing the client drivers on the Samba server:- + These three methods apply to CUPS all the same. The cupsaddsmb utility is a new and more convenient way to load the Windows drivers into Samba and is provided if you use CUPS.
cupsaddsmb is discussed in much detail later in this chapter. But we first explore the CUPS filtering system and compare the Windows and UNIX printing architectures. -
+ We now know how to set up a “dump” print server, that is, a server that spools print jobs “raw”, leaving the print data untouched.
You might need to set up CUPS in a smarter way. The reasons could be manifold: -
Maybe your boss wants to get monthly statistics: Which +
Maybe your boss wants to get monthly statistics: Which printer did how many pages? What was the average data size of a job? What was the average print run per day? What are the typical hourly peaks in printing? Which department prints how much?
Maybe you are asked to set up a print quota system: @@ -301,28 +301,28 @@ Windows and UNIX printing, then a description of the CUPS filtering system, how it works, and how you can tweak it.
- - + + Network printing is one of the most complicated and error-prone day-to-day tasks any user or administrator may encounter. This is true for all OS platforms, and there are reasons it is so.
- - - - - + + + + + You can't expect to throw just any file format at a printer and have it get printed. A file format conversion must take place. The problem is that there is no common standard for print file formats across all manufacturers and printer types. While PostScript (trademark held by Adobe) and, to an extent, PCL (trademark held by Hewlett-Packard) have developed into semi-official “standards” by being the most widely used page description languages (PDLs), there are still many manufacturers who “roll their own” (their reasons may be unacceptable license fees for using printer-embedded PostScript interpreters, and so on). -
+ + + + In Windows OS, the format conversion job is done by the printer drivers. On MS Windows OS platforms all application programmers have at their disposal a built-in API, the graphical device interface (GDI), as part and parcel of the OS itself to base themselves on. This GDI core is used as one common unified ground for all @@ -333,21 +333,21 @@ the GDI, often produces a file format called Enhanced MetaFile (EMF). The EMF is processed by the printer driver and converted to the printer-specific file format.
Note
- - - + + + To the GDI foundation in MS Windows, Apple has chosen to put paper and screen output on a common foundation - for its (BSD-UNIX-based, did you know?) Mac OS X and Darwin operating - systems. + for its (BSD-UNIX-based, did you know?) Mac OS X and Darwin operating + systems. Apple's core graphic engine uses a PDF derivative for all display work.
The example in Windows Printing to a Local Printer illustrates local Windows printing. -
+ + + + In UNIX and Linux, there is no comparable layer built into the OS kernel(s) or the X (screen display) server. Every application is responsible for itself to create its print output. Fortunately, most use PostScript and that at least gives some common ground. Unfortunately, there are many different levels of quality for this @@ -361,16 +361,16 @@ unfavorable inheritance up to the present day by looking into the various “font” directories on your system; there are separate ones for fonts used for X display and fonts to be used on paper.
Background. - - - - - - - - - + + + + + + + + + The PostScript programming language is an “invention” by Adobe, but its specifications have been published extensively. Its strength lies in its powerful abilities to describe graphical objects (fonts, shapes, patterns, lines, curves, and dots), their attributes (color, linewidth), and the way to manipulate @@ -382,11 +382,11 @@ interpreted by a rasterizer. Rasterizers produce pixel images, which may be displayed on screen by a viewer program or on paper by a printer.
- - - - - + + + + + So UNIX is lacking a common ground for printing on paper and displaying on screen. Despite this unfavorable legacy for UNIX, basic printing is fairly easy if you have PostScript printers at your disposal. The reason is that these devices have a built-in PostScript language “interpreter,” also called a raster image @@ -395,31 +395,31 @@ commands into a bitmap picture as you see it on paper, in a resolution as done by your printer. This is no different than PostScript printing a file from a Windows origin.
Note
- - - + + + Traditional UNIX programs and printing systems while using PostScript are largely not PPD-aware. PPDs are “PostScript Printer Description” files. They enable you to specify and control all options a printer supports: duplexing, stapling, and punching. Therefore, UNIX users for a long time couldn't choose many of the supported device and job options, unlike Windows or Apple users. But now there is CUPS. as illustrated in Printing to a PostScript Printer.
- + However, there are other types of printers out there. These do not know how to print PostScript. They use their own PDL, often proprietary. To print to them is much more demanding. Since your UNIX applications mostly produce PostScript, and since these devices do not understand PostScript, you need to convert the print files to a format suitable for your printer on the host before you can send it away. -
+ Here is where Ghostscript kicks in. Ghostscript is the traditional (and quite powerful) PostScript interpreter used on UNIX platforms. It is a RIP in software, capable of doing a lot of file format conversions for a very broad spectrum of hardware devices as well as software file formats. Ghostscript technology and drivers are what enable PostScript printing to non-PostScript hardware. This is shown in Ghostscript as a RIP for Non-PostScript Printers.
Tip
- - - + + + Use the “gs -h” command to check for all built-in “devices” on your Ghostscript version. If you specify a parameter of
-sDEVICE=png256on your Ghostscript command line, you are asking Ghostscript to convert the input into a PNG file. Naming a “device” on the @@ -427,14 +427,14 @@ input. New Ghostscript versions are released at fairly regular intervals, now by artofcode LLC. They are initially put under the “AFPL” license, but re-released under the GNU GPL as soon as the next AFPL version appears. GNU Ghostscript is probably the version installed on most Samba systems. But it has some - deficiencies. Therefore, ESP Ghostscript was developed as an enhancement over GNU Ghostscript, + deficiencies. Therefore, ESP Ghostscript was developed as an enhancement over GNU Ghostscript, with lots of bug-fixes, additional devices, and improvements. It is jointly maintained by developers from CUPS, Gimp-Print, MandrakeSoft, SuSE, Red Hat, and Debian. It includes the “cups” device (essential to print to non-PS printers from CUPS). -+ + + While PostScript in essence is a PDL to represent the page layout in a device-independent way, real-world print jobs are always ending up being output on hardware with device-specific features. To take care of all the differences in hardware and to allow for innovations, Adobe has specified a syntax and file format for @@ -456,17 +456,17 @@ PostScript, PJL, JCL, or vendor-dependent commands) into the PostScript file created by the driver.
Warning
- - + + A PostScript file that was created to contain device-specific commands for achieving a certain print job output (e.g., duplexed, stapled, and punched) on a specific target machine may not print as expected, or may not be printable at all on other models; it also may not be fit for further processing by software (e.g., by a PDF distilling program). -
+ + + CUPS can handle all spec-compliant PPDs as supplied by the manufacturers for their PostScript models. Even if a vendor does not mention our favorite OS in his or her manuals and brochures, you can safely trust this: If you get the Windows NT version of the PPD, you can use it unchanged in CUPS and thus @@ -477,31 +477,31 @@ parsing and checking code enabled; in case of printing trouble, this online resource should be one of your first pit stops.
Warning
- - + + For real PostScript printers, do not use the Foomatic or cupsomatic PPDs from Linuxprinting.org. With these devices, the original vendor-provided PPDs are always the first choice.
Tip
- + If you are looking for an original vendor-provided PPD of a specific device, and you know that an NT4 box (or any other Windows box) on your LAN has the PostScript driver installed, just use smbclient //NT4-box/print\$ -U username to access the Windows directory where all printer driver files are stored. First look in the
W32X86/2subdirectory for the PPD you are seeking. -+ + + CUPS also uses specially crafted PPDs to handle non-PostScript printers. These PPDs are usually not available from the vendors (and no, you can't just take the PPD of a PostScript printer with the same model name and hope it works for the non-PostScript version too). To understand how these PPDs work for non-PS printers, we first need to dive deeply into the CUPS filtering and file format conversion architecture. Stay tuned. -
+ + The core of the CUPS filtering system is based on Ghostscript. In addition to Ghostscript, CUPS uses some other filters of its own. You (or your OS vendor) may have plugged in even more filters. CUPS handles all data file formats under the label of various MIME types. Every incoming print file is subjected to an initial @@ -512,82 +512,82 @@
If CUPS rasterizes a PostScript file natively to a bitmap, this is done in two stages:
-
-
+
+
Make sure your Ghostscript version has the “cups” device compiled in (check with gs -h |
grep cups). Otherwise you may encounter the dreaded Unable to convert file
0 in your CUPS error_log file. To have “cups” as a device in your Ghostscript,
you either need to patch GNU Ghostscript and recompile or use
-ESP Ghostscript. The superior alternative is ESP
+ESP Ghostscript. The superior alternative is ESP
Ghostscript. It supports not just CUPS, but 300 other devices (while GNU Ghostscript supports only about 180).
Because of this broad output device support, ESP Ghostscript is the first choice for non-CUPS spoolers, too.
It is now recommended by Linuxprinting.org for all spoolers.
- - + + CUPS printers may be set up to use external rendering paths. One of the most common is provided by the Foomatic/cupsomatic concept from Linuxprinting.org. This uses the classical Ghostscript approach, doing everything in one step. It does not use the “cups” device, but one of the many others. However, even for Foomatic/cupsomatic usage, best -results and broadest printer +results and broadest printer model support is provided by ESP Ghostscript (more about Foomatic/cupsomatic, particularly the new version called now foomatic-rip, follows). -
+
+
+
+
CUPS reads the file /etc/cups/mime.types (and all other files carrying a
*.types suffix in the same directory) upon startup. These files contain the MIME type
recognition rules that are applied when CUPS runs its autotyping routines. The rule syntax is explained in the
man page for mime.types and in the comments section of the
mime.types file itself. A simple rule reads like this:
-
+
application/pdf pdf string(0,%PDF)
-
-
+
+
This means if a filename has a .pdf suffix or if the magic string
%PDF is right at the beginning of the file itself (offset 0 from the start), then it is a
PDF file (application/pdf). Another rule is this:
application/postscript ai eps ps string(0,%!) string(0,<04>%!)
-
-
-
+
+
+
If the filename has one of the suffixes .ai, .eps,
.ps, or if the file itself starts with one of the strings %! or
<04>%!, it is a generic PostScript file
(application/postscript).
Warning
-
+
Don't confuse the other mime.types files your system might be using
with the one in the /etc/cups/ directory.
Note
-
-
-
+
+
+
There is an important difference between two similar MIME types in CUPS: one is
application/postscript, the other is
application/vnd.cups-postscript. While application/postscript is
@@ -598,32 +598,32 @@
(application/vnd.cups-postscript) is the responsibility of the CUPS
pstops filter. pstops uses information contained in the PPD to do the transformation.
- - - + - + - + + + CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI, and many image formats (GIF, PNG, TIFF, JPEG, Photo-CD, SUN-Raster, PNM, PBM, SGI-RGB, and more) and their associated MIME types with its filters. -
+
+
+
+
CUPS reads the file /etc/cups/mime.convs
(and all other files named with a *.convs
suffix in the same directory) upon startup. These files contain
@@ -634,44 +634,44 @@
application/pdf application/postscript 33 pdftops
-
+
This means that the pdftops filter will take
application/pdf as input and produce
application/postscript as output; the virtual
cost of this operation is 33 CUPS-$. The next filter is more
expensive, costing 66 CUPS-$:
-
+
application/vnd.hp-HPGL application/postscript 66 hpgltops
-
+
This is the hpgltops, which processes HP-GL
plotter files to PostScript.
-
+
application/octet-stream
Here are two more examples: - - - + + +
application/x-shell application/postscript 33 texttops text/plain application/postscript 33 texttops
-
+
The last two examples name the texttops filter to work on
text/plain as well as on application/x-shell. (Hint: This
differentiation is needed for the syntax highlighting feature of texttops).
-
+
There are many more combinations named in mime.convs. However, you are not limited to use
the ones predefined there. You can plug in any filter you like to the CUPS framework. It must meet, or must be
made to meet, some minimal requirements. If you find (or write) a cool conversion filter of some kind, make
sure it complies with what CUPS needs and put in the right lines in mime.types and
mime.convs; then it will work seamlessly inside CUPS.
-
+
The “CUPS requirements” for filters are simple. Take filenames or stdin as
input and write to stdout. They should take these arguments:
- printer
@@ -690,24 +690,24 @@ (optionally) The print request file (if missing, filters expected data fed through
stdin). In most cases, it is easy to write a simple wrapper script around existing filters to make them work with CUPS. -
+ + + As previously stated, PostScript is the central file format to any UNIX-based printing system. From PostScript, CUPS generates raster data to feed non-PostScript printers.
-
-
-
+
-
+
+
+
But what happens if you send one of the supported non-PS formats to print? Then CUPS runs
“prefilters” on these input formats to generate PostScript first. There are prefilters to create
PostScript from ASCII text, PDF, DVI, or HP-GL. The outcome of these filters is always of MIME type
@@ -717,14 +717,14 @@
MIME type application/vnd.cups-postscript (not application/postscript), meaning it has
the print options already embedded into the file. This is shown in Prefiltering in
CUPS to Form PostScript.
-
-
-
+
+
+
+
pstops is a filter that is used to convert application/postscript to
application/vnd.cups-postscript. As stated earlier, this filter inserts all
device-specific print options (commands to the printer to ask for the duplexing of output, or stapling and
@@ -740,10 +740,10 @@
so-called “number-up” function).
Counting the pages of the job to insert the accounting
information into the /var/log/cups/page_log.
-
+
+
pstoraster is at the core of the CUPS filtering system. It is responsible for the first
stage of the rasterization process. Its input is of MIME type application/vnd.cups-postscript; its output is
application/vnd.cups-raster. This output format is not yet meant to be printable. Its aim is to serve as a
@@ -751,10 +751,10 @@
generate device-specific printer data. This is shown in the PostScript to
Intermediate Raster Format diagram.
- - + + CUPS raster is a generic raster format with powerful features. It is able to include per-page information, color profiles, and more, to be used by the downstream raster drivers. Its MIME type is registered with IANA and its specification is, of course, completely open. It is designed to make it quite easy and inexpensive for @@ -764,10 +764,10 @@ raster drivers). This is illustrated in the CUPS-Raster Production Using Ghostscript illustration.
-
-
+
+
CUPS versions before version 1.1.15 shipped a binary (or source code) standalone filter, named
pstoraster. pstoraster, which was derived from GNU Ghostscript
5.50 and could be installed instead of and in addition to any GNU or AFPL Ghostscript package without
@@ -778,27 +778,27 @@
now a simple shell script calling gs with the -sDEVICE=cups parameter.
If your Ghostscript fails when this command is executed: gs -h |grep cups, you might not
be able to print, update your Ghostscript.
-
+
+
In the section about prefilters, we mentioned the prefilter
that generates PostScript from image formats. The imagetoraster
filter is used to convert directly from image to raster, without the
intermediate PostScript stage. It is used more often than the previously
mentioned prefilters. We summarize in a flowchart the image file
filtering in the Image Format to CUPS-Raster Format Conversion illustration.
-
-
+
+
+
CUPS ships with quite a variety of raster drivers for processing CUPS raster. On my system, I find in
/usr/lib/cups/filter/ the following: rastertoalps, rastertobj,
rastertoepson, rastertoescp, rastertopcl,
@@ -809,9 +809,9 @@
rastertoprinter) by third-party driver development projects (such as Gimp-Print)
wanting to cooperate as closely as possible with CUPS. See the Raster to
Printer-Specific Formats illustration.
-
+ + The last part of any CUPS filtering chain is a backend. Backends are special programs that send the print-ready file to the final device. There is a separate backend program for any transfer @@ -885,8 +885,8 @@ email back to the $USER asking him or her to always specify the correct printer name.)
- - + + Not all of the mentioned backends may be present on your system or usable (depending on your hardware configuration). One test for all available CUPS backends is provided by the lpinfo @@ -894,12 +894,12 @@ all available backends:
$lpinfo -v-
+
+
+
+
cupsomatic filters may be the most widely used on CUPS
installations. You must be clear that these were not
developed by the CUPS people. They are a third-party add-on to
@@ -923,9 +923,7 @@
autoconstructed from the selected PPD and command line options give to
the print job.
-
-
-
+
@@ -934,6 +932,8 @@
+
+
However, cupsomatic is now deprecated. Its PPDs (especially the first
generation of them, still in heavy use out there) are not meeting the
Adobe specifications. You might also suffer difficulties when you try
@@ -955,11 +955,11 @@
best thing is that the new foomatic-rip works seamlessly with all
legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR, and so on), providing
for them access to use PPDs for their printing.
-
If you want to see an overview of all the filters and how they relate to each other, the complete picture of the puzzle is at the end of this chapter. -
CUPS autoconstructs all possible filtering chain paths for any given MIME type and every printer installed. But how does it decide in favor of or against a specific alternative? (There may be cases @@ -969,8 +969,8 @@ assigned to this filter. Every possible filtering chain will sum up to a total “filter cost.” CUPS decides for the most “inexpensive” route.
Tip
-
-
+
+
Setting FilterLimit 1000 in
cupsd.conf will not allow more filters to
run concurrently than will consume a total of 1000 virtual filter
@@ -978,10 +978,10 @@
server by setting an appropriate “FilterLimit” value. A FilterLimit of
200 allows roughly one job at a time, while a FilterLimit of 1000 allows
approximately five jobs maximum at a time.
-
+ + You can tell CUPS to print (nearly) any file “raw”. “Raw” means it will not be filtered. CUPS will send the file to the printer “as is” without bothering if the printer is able to digest it. Users need to take care themselves that they send sensible data formats only. Raw printing can @@ -999,9 +999,9 @@ if it can't find a PPD associated with the queue. However, CUPS will only send known MIME types (as defined in its own mime.types file) and refuse others. -
+
+
Any MIME type with no rule in the /etc/cups/mime.types file is regarded as unknown
or application/octet-stream and will not be
sent. Because CUPS refuses to print unknown MIME types by default,
@@ -1014,11 +1014,11 @@
To enable the printing of application/octet-stream files, edit
these two files:
/etc/cups/mime.convs/etc/cups/mime.types
-
+
Both contain entries (at the end of the respective files) that must be uncommented to allow raw mode
operation for application/octet-stream. In /etc/cups/mime.types
make sure this line is present:
-
+
application/octet-stream
@@ -1029,7 +1029,7 @@
application/octet-stream application/vnd.cups-raw 0 -
-
+
This line tells CUPS to use the Null Filter
(denoted as “-”, doing nothing at all) on
application/octet-stream, and tag the result as
@@ -1040,10 +1040,10 @@
Editing the mime.convs and the mime.types file does not
enforce “raw” printing, it only allows it.
Background.
-
-
+
+
That CUPS is a more security-aware printing system than traditional ones
does not by default allow one to send deliberate (possibly binary)
data to printing devices. (This could be easily abused to launch a
@@ -1055,13 +1055,13 @@
/etc/cups/mime.types defines the “rules” of how CUPS
recognizes MIME types. The file /etc/cups/mime.convs decides which file
conversion filter(s) may be applied to which MIME types.
-
+ + + Originally PPDs were meant to be used for PostScript printers only. Here, they help to send device-specific commands and settings to the RIP, which processes the job file. CUPS has extended this @@ -1074,7 +1074,7 @@
PPDs for a non-PostScript printer have a few lines that are unique to CUPS. The most important one looks similar to this: - +
*cupsFilter: application/vnd.cups-raster 66 rastertoprinter
@@ -1092,14 +1092,14 @@ several hundred printer models. You may not be able to control different paper trays, or you may get larger margins than your specific model supports. See Table 21.1??? for summary information. -
Table 21.1. PPDs Shipped with CUPS
| PPD file | Printer type |
|---|---|
| deskjet.ppd | older HP inkjet printers and compatible |
| deskjet2.ppd | newer HP inkjet printers and compatible |
| dymo.ppd | label printers |
| epson9.ppd | Epson 24-pin impact printers and compatible |
| epson24.ppd | Epson 24-pin impact printers and compatible |
| okidata9.ppd | Okidata 9-pin impact printers and compatible |
| okidat24.ppd | Okidata 24-pin impact printers and compatible |
| stcolor.ppd | older Epson Stylus Color printers |
| stcolor2.ppd | newer Epson Stylus Color printers |
| stphoto.ppd | older Epson Stylus Photo printers |
| stphoto2.ppd | newer Epson Stylus Photo printers |
| laserjet.ppd | all PCL printers |
Table 21.1. PPDs Shipped with CUPS
| PPD file | Printer type |
|---|---|
| deskjet.ppd | older HP inkjet printers and compatible |
| deskjet2.ppd | newer HP inkjet printers and compatible |
| dymo.ppd | label printers |
| epson9.ppd | Epson 24-pin impact printers and compatible |
| epson24.ppd | Epson 24-pin impact printers and compatible |
| okidata9.ppd | Okidata 9-pin impact printers and compatible |
| okidat24.ppd | Okidata 24-pin impact printers and compatible |
| stcolor.ppd | older Epson Stylus Color printers |
| stcolor2.ppd | newer Epson Stylus Color printers |
| stphoto.ppd | older Epson Stylus Photo printers |
| stphoto2.ppd | newer Epson Stylus Photo printers |
| laserjet.ppd | all PCL printers |
+ + Native CUPS rasterization works in two steps:
- + First is the
pstorasterstep. It uses the special CUPS - + device from ESP Ghostscript 7.05.x as its tool.Second is the
rasterdriverstep. It uses various @@ -1114,7 +1114,7 @@ One other method is thecupsomatic/foomatic-ripway. Note thatcupsomaticis not made by the CUPS developers. It is an independent contribution to printing development, - made by people from Linuxprinting.org.[6] + made by people from Linuxprinting.org.[6]cupsomaticis no longer developed, maintained, or supported. It now been replaced byfoomatic-rip.foomatic-ripis a complete rewrite of the oldcupsomaticidea, but very much improved and generalized to @@ -1122,8 +1122,8 @@ advised, especially if you are upgrading to a recent version of CUPS, too.- - + + Like the old
cupsomaticmethod, thefoomatic-rip(new) method from Linuxprinting.org uses the traditional Ghostscript print file processing, doing everything in a single step. It therefore relies on all the other devices built into Ghostscript. The quality is as good (or bad) as @@ -1133,12 +1133,12 @@ Of course, you can use both methods side by side on one system (and even for one printer, if you set up different queues) and find out which works best for you.- - - + + +
cupsomatickidnaps the print file after theapplication/vnd.cups-postscriptstage and deviates it through the CUPS-external, systemwide Ghostscript installation. Therefore, the print file bypasses thepstoraster@@ -1147,14 +1147,14 @@ backend. cupsomatic/foomatic Processing Versus Native CUPS, illustrates the difference between native CUPS rendering and theFoomatic/cupsomaticmethod. -
Here are a few examples of commonly occurring filtering chains to illustrate the workings of CUPS.
- - - + + + Assume you want to print a PDF file to an HP JetDirect-connected PostScript printer, but you want to print pages 3-5, 7, and 11-13 only, and you want to print them “two-up” and “duplex”: @@ -1173,10 +1173,10 @@ backend, which transfers the job to the printers.
The resulting filter chain, therefore, is as shown in the PDF to socket chain illustration. -
+
+
Assume you want to print the same filter to an USB-connected Epson Stylus Photo Printer installed with the CUPS
stphoto2.ppd. The first few filtering stages are nearly the same:
@@ -1186,14 +1186,14 @@ The (complete) PDF file is sent to CUPS and autotyped as
application/pdf.- - + + The file must first pass the
pdftopsprefilter, which produces PostScript MIME typeapplication/postscript(a preview here would still show all pages of the original PDF).- - + + The file then passes the “pstops” filter that applies the command-line options: it selects the pages 2-5, 7, and 11-13, creates the imposed layout “two pages on one sheet,” and inserts the @@ -1205,7 +1205,7 @@ The file then passes the
pstorasterstage and becomes MIME typeapplication/cups-raster.- + Finally, the
rastertoepsonfilter does its work (as indicated in the printer's PPD), creating the printer-specific raster data and embedding any user-selected @@ -1215,11 +1215,11 @@
The resulting filter chain therefore is as shown in the PDF to USB Chain illustration. -
On the Internet you can now find many thousands of CUPS-PPD files (with their companion filters), in many national languages supporting more than 1,000 non-PostScript models. -
+
ESP PrintPro (commercial, non-free) is packaged with more than 3,000 PPDs, ready for successful use “out of the box” on Linux, Mac OS X, IBM-AIX, @@ -1247,9 +1247,9 @@ Foomatic/cupsomatic (LPGL, free) from Linuxprinting.org provide PPDs for practically every Ghostscript filter known to the world (including Omni, Gimp-Print, and HPIJS). -
+ + CUPS also supports the use of “interface scripts” as known from System V AT&T printing systems. These are often used for PCL printers, from applications that generate PCL print jobs. Interface @@ -1271,16 +1271,16 @@ use of interface scripts is found at http://playground.sun.com/printing/documentation/interface.html). -
Network printing covers a lot of ground. To understand what exactly goes on with Samba when it is printing on behalf of its Windows clients, let's first look at a “purely Windows” setup: Windows clients with a Windows NT print server. -
+
Windows clients printing to an NT-based print server have two options. They may: - - + +
Execute the driver locally and render the GDI output (EMF) into the printer-specific format on their own.
Send the GDI output (EMF) to the server, where the @@ -1289,7 +1289,7 @@ Both print paths are shown in the flowcharts in Print Driver Execution on the Client, and Print Driver Execution on the Server. -
In the first case, the print server must spool the file as raw, meaning it shouldn't touch the job file and try to convert it in any way. This is what a traditional UNIX-based print server can do too, and at a better performance and more reliably than an NT print server. This is what most Samba administrators probably are @@ -1297,12 +1297,12 @@ even if no driver(s) for UNIX is available. It is sufficient to have the Windows client drivers available and installed on the clients. This is illustrated in the Print Driver Execution on the Client diagram. -
+ + + + + The other path executes the printer driver on the server. The client transfers print files in EMF format to the server. The server uses the PostScript, PCL, ESC/P, or other driver to convert the EMF file into the printer-specific language. It is not possible for UNIX to do the same. Currently, there is no program or @@ -1310,14 +1310,14 @@ This is illustrated in the Print Driver Execution on the Server diagram.
However, something similar is possible with CUPS, so read on. -
Since UNIX print servers cannot execute the Win32 program code on their platform, the picture is somewhat different. However, this does not limit your options all that much. On the contrary, you may have a way here to implement printing features that are not possible otherwise. -
+
Here is a simple recipe showing how you can take advantage of CUPS's powerful features for the benefit of your Windows network printing clients: @@ -1329,16 +1329,16 @@
First, to enable CUPS-based printing through Samba, the following options should be set in your smb.conf
file [global] section:
-
printing = cups |
printcap = cups |
-When these parameters are specified, all manually set print directives (like print command or lppause command) in smb.conf (as well as in Samba itself) will be
+
printing = cups |
printcap = cups |
+When these parameters are specified, all manually set print directives (like print command or lppause command) in smb.conf (as well as in Samba itself) will be
ignored. Instead, Samba will directly interface with CUPS through its application program interface (API), as
long as Samba has been compiled with CUPS library (libcups) support. If Samba has not been compiled with CUPS
support, and if no other print commands are set up, then printing will use the System V
AT&T command set, with the -oraw option automatically passing through (if you want your own defined print
-commands to work with a Samba server that has CUPS support compiled in, simply use classicalprinting = sysv). This is illustrated in the Printing via
+commands to work with a Samba server that has CUPS support compiled in, simply use classicalprinting = sysv). This is illustrated in the Printing via
CUPS/Samba Server diagram.
-
-Samba must use its own spool directory (it is set by a line similar to path = /var/spool/samba, in the [printers] or [printername] section of smb.conf). Samba receives the job in its own spool space and passes it
+
+Samba must use its own spool directory (it is set by a line similar to path = /var/spool/samba, in the [printers] or [printername] section of smb.conf). Samba receives the job in its own spool space and passes it
into the spool directory of CUPS (the CUPS spool directory is set by the RequestRoot
directive in a line that defaults to RequestRoot /var/spool/cups). CUPS checks the
access rights of its spool directory and resets it to healthy values with every restart. We have seen quite a
@@ -1349,13 +1349,13 @@
configured). If Samba runs on the same host as CUPS, you only need to
allow “localhost” to print. If it runs on different machines, you
need to make sure the Samba host gets access to printing on CUPS.
-
This section discusses the use of CUPS filters on the server configuration where clients make use of a PostScript driver with CUPS-PPDs.
- - - + + + PPDs can control all print device options. They are usually provided by the manufacturer if you own a PostScript printer, that is. PPD files are always a component of PostScript printer drivers on MS Windows or Apple Mac OS systems. They are ASCII files containing user-selectable print options, mapped to appropriate @@ -1368,8 +1368,8 @@ lpoptions or see if you have lphelp on your system). There are also some different GUI front-ends on Linux/UNIX, which can present PPD options to users. PPD options are normally meant to be evaluated by the PostScript RIP on the real PostScript printer. -
+ CUPS does not limit itself to “real” PostScript printers in its use of PPDs. The CUPS developers have extended the scope of the PPD concept to also describe available device and driver options for non-PostScript printers through CUPS-PPDs. @@ -1381,8 +1381,8 @@ for the interpretation of the supplied PostScript. Thus CUPS lets all its printers appear as PostScript devices to its clients, because it can act as a PostScript RIP for those printers, processing the received PostScript code into a proper raster print format. -
+ CUPS-PPDs can also be used on Windows clients, on top of a “core” PostScript driver (now recommended is the CUPS PostScript Driver for Windows NT/200x/XP; you can also use the Adobe one, with limitations). This feature enables CUPS to do a few tricks no other spooler can do: @@ -1396,11 +1396,11 @@ Enable clients to consolidate on a single PostScript driver, even for many different target printers.
Using CUPS PPDs on Windows clients enables them to control all print job settings just as a UNIX client can do. -
This setup may be of special interest to people experiencing major problems in WTS environments. WTS often need a multitude of non-PostScript drivers installed to run their clients' variety of different printer models. This often imposes the price of much increased instability. -
Printer Drivers Running in “Kernel Mode” Cause Many
+
Windows NT printer drivers, which run in “kernel mode”, introduce a high risk for the stability
of the system if the driver is not really stable and well-tested. And there are a lot of bad drivers out
@@ -1412,14 +1412,14 @@
run in kernel mode. This might be because until now there have been only two different PostScript drivers: the
one from Adobe and the one from Microsoft. Both are well-tested and are as stable as you can imagine on
Windows. The CUPS driver is derived from the Microsoft one.
-
In an attempt to work around problems, site administrators have resorted to restricting the
allowed drivers installed on their WTS to one generic PCL and one PostScript driver. This, however, restricts
the the number of printer options available for clients to use. Often they can't get out more than simplex
prints from one standard paper tray, while their devices could do much better if driven by a different driver!
-
+
+
Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these
shortcomings. There are, depending on the version of Windows OS you use, up to three different PostScript
drivers now available: Adobe, Microsoft, and CUPS PostScript drivers. None of them is known to cause major
@@ -1428,14 +1428,14 @@
server acting as a PostScript RIP for its clients requires more CPU and RAM than when just acting as a
“raw spooling” device. Plus, this setup is not yet widely tested, although the first feedbacks
look very promising.
-
-
-
-
-
-
-
+
+
+
+
+
+
More recent printer drivers on W200x and XP no longer run in kernel mode (unlike Windows NT). However, both
operating systems can still use the NT drivers, running in kernel mode (you can roughly tell which is which as
the drivers in subdirectory “2” of “W32X86” are “old” ones). As was
@@ -1447,13 +1447,13 @@
allow them to publish the whole of the source code. However, they have released the “diff” under
the GPL, and if you are the owner of an “MS DDK for Windows NT,” you can check the driver
yourself.
-
As we have said before, all previously known methods to prepare client printer drivers on the Samba server for
download and Point'n'Print convenience of Windows workstations are working with CUPS, too. These methods were
described in Classical Printing. In reality, this is a pure Samba
business and relates only to the Samba-Windows client relationship.
-
+
The cupsaddsmb utility (shipped with all current CUPS versions) is an alternative
method to transfer printer drivers into the Samba [print$] share. Remember, this
share is where clients expect drivers deposited and set up for download and installation. It makes the sharing
@@ -1470,11 +1470,11 @@
However, currently only Windows NT, 2000, and XP are supported by the
CUPS drivers. You will also need to get the respective part of the Adobe driver
if you need to support Windows 95, 98, and Me clients.
-
Prior to running cupsaddsmb, you need the settings in
smb.conf as shown in the smb.conf for cupsaddsmb Usage.
-
Example 21.3. smb.conf for cupsaddsmb Usage
[global]load printers = yesprinting = cupsprintcap name = cups [printers]comment = All Printerspath = /var/spool/sambabrowseable = nopublic = yes# setting depends on your requirements guest ok = yeswritable = noprintable = yesprinter admin = root [print$]comment = Printer Driverspath = /etc/samba/driversbrowseable = yesguest ok = noread only = yeswrite list = root
Example 21.3. smb.conf for cupsaddsmb Usage
[global]load printers = yesprinting = cupsprintcap name = cups [printers]comment = All Printerspath = /var/spool/sambabrowseable = nopublic = yes# setting depends on your requirements guest ok = yeswritable = noprintable = yesprinter admin = root [print$]comment = Printer Driverspath = /etc/samba/driversbrowseable = yesguest ok = noread only = yeswrite list = root
+
CUPS users may get the exact same package from http://www.cups.org/software.html. It is a separate package
from the CUPS-based software files, tagged as CUPS 1.1.x Windows NT/200x/XP Printer Driver for Samba (tar.gz,
192k). The filename to download is cups-samba-1.1.x.tar.gz. Upon untar and unzipping, it
@@ -1487,8 +1487,8 @@
cups-samba.remove
cups-samba.ss
-
-
+
+
These have been packaged with the ESP meta-packager software EPM. The *.install and
*.remove files are simple shell scripts, which untar the *.ss (the
*.ss is nothing else but a tar archive, which can be untarred by “tar” too).
@@ -1520,32 +1520,32 @@
around this, copy/move the file (after running the ./cups-samba.install script) manually to
the correct place.
-
+
This new CUPS PostScript driver is currently binary only, but free of charge. No complete source code is
provided (yet). The reason is that it has been developed with the help of the Microsoft DDK and compiled with
Microsoft Visual Studio 6. Driver developers are not allowed to distribute the whole of the source code as
free software. However, CUPS developers released the “diff” in source code under the GPL, so
anybody with a license for Visual Studio and a DDK will be able to compile for himself or herself.
-
The CUPS drivers do not support the older Windows 95/98/Me, but only the Windows NT/2000/XP client.
Windows NT, 2000, and XP are supported by:
cups.hlp
cupsdrvr.dll
cupsui.dll
Adobe drivers are available for the older Windows 95/98/Me as well as
for Windows NT/2000/XP clients. The set of files is different from the
different platforms.
Windows 95, 98, and ME are supported by:
ADFONTS.MFM
ADOBEPS4.DRV
ADOBEPS4.HLP
DEFPRTR2.PPD
ICONLIB.DLL
PSMON.DLL
Windows NT, 2000, and XP are supported by:
ADOBEPS5.DLL
ADOBEPSU.DLL
ADOBEPSU.HLP
Note
-
+
If both the Adobe driver files and the CUPS driver files for the support of Windows NT/200x/XP are presently
installed on the server, the Adobe files will be ignored and the CUPS files will be used. If you prefer
for whatever reason to use Adobe-only drivers, move away the three CUPS driver files.
The Windows 9x/Me clients use the Adobe drivers in any case.
-
Acquiring the Adobe driver files seems to be unexpectedly difficult for many users. They are not available on
the Adobe Web site as single files, and the self-extracting and/or self-installing Windows-.exe is not easy to
locate either. You probably need to use the included native installer and run the installation process on one
client once. This will install the drivers (and one generic PostScript printer) locally on the client. When
they are installed, share the generic PostScript printer. After this, the client's [print$] share holds the Adobe files, which you can get with smbclient from the CUPS host.
-
+
Users of the ESP Print Pro software are able to install the ESP print drivers package as an alternative to the
Adobe PostScript drivers. To do so, retrieve the driver files from the normal download area of the ESP Print
Pro software at Easy Software web site.
@@ -1555,19 +1555,19 @@
the menu. Of course, you need to have prepared Samba beforehand to handle the driver files; that is, set up
the [print$] share, and so on. The ESP Print Pro package includes the CUPS driver
files as well as a (licensed) set of Adobe drivers for the Windows 95/98/Me client family.
-
+
+
+
+
Once you have run the install script (and possibly manually moved the cups.hlp file to
/usr/share/cups/drivers/), the driver is ready to be put into Samba's [print$] share (which often maps to /etc/samba/drivers/ and contains a
subdirectory tree with WIN40 and W32X86 branches). You do this by
running cupsaddsmb (see also man cupsaddsmb for CUPS since release
1.1.16).
Tip
-
-
+
+
You may need to put root into the smbpasswd file by running smbpasswd; this is especially
important if you should run this whole procedure for the first time and are not working in an environment
where everything is configured for single sign-on to a Windows Domain Controller.
@@ -1582,8 +1582,8 @@
in the /usr/share/cups/drivers/ directory. The new cupsaddsmb (from
1.1.16) will automatically prefer its own drivers if it finds both.
Note
-
-
+
+
Should your Windows clients have had the old ADOBE*.* files for the Adobe PostScript
driver installed, the download and installation of the new CUPS PostScript driver for Windows NT/200x/XP will
fail at first. You need to wipe the old driver from the clients first. It is not enough to
@@ -1597,43 +1597,43 @@
printers using this driver in the Printers folder first. You will need Administrator
privileges to do this.
Note
-
-
+
+
Once you have successfully downloaded the CUPS PostScript driver to a client, you can easily switch all
printers to this one by proceeding as described in Classical Printing
Support. Either change a driver for an existing printer by running the Printer
Properties dialog, or use rpcclient with the setdriver
subcommand.
-
Are you interested in a comparison between the CUPS and the Adobe PostScript drivers? For our purposes, these
are the most important items that weigh in favor of CUPS:
No hassle with the Adobe EULA.
No hassle with the question, “Where do I
get the ADOBE*.* driver files?”
-
+
The Adobe drivers (on request of the printer PPD associated with them) often put a PJL header in front of the
main PostScript part of the print file. Thus, the print file starts with <1B
>%-12345X or <escape>%-12345X instead of
%!PS. This leads to the CUPS daemon autotyping the incoming file as a print-ready file,
not initiating a pass through the pstops filter (to speak more technically, it is not
- regarded as the generic MIME-type
+ regarded as the generic MIME-type
application/postscript, but as the more special MIME type
-
+
application/cups.vnd-postscript), which therefore also leads to the page accounting in
/var/log/cups/page_log not receiving the exact number of pages; instead the dummy page
number of “1” is logged in a standard setup).
The Adobe driver has more options to misconfigure the
-
+
PostScript generated by it (like setting it inadvertently to
Optimize for Speed instead of
Optimize for Portability, which
could lead to CUPS being unable to process it).
The CUPS PostScript driver output sent by Windows
-
+
clients to the CUPS server is guaranteed to autotype
as the generic MIME type application/postscript,
thus passing through the CUPS pstops filter and logging the
correct number of pages in the page_log for
accounting and quota purposes.
-
+
The CUPS PostScript driver supports the sending of additional standard (IPP) print options by Windows
NT/200x/XP clients. Such additional print options are naming the CUPS standard banner
pages (or the custom ones, should they be installed at the time of driver download), using the CUPS
@@ -1646,36 +1646,36 @@
not disturb any other applications because they will regard it as a comment
and simply ignore it).
The CUPS PostScript driver will be the heart of the
fully fledged CUPS IPP client for Windows NT/200x/XP to be released soon
- (probably alongside the first beta release for CUPS 1.2).
Windows NT printer drivers, which run in “kernel mode”, introduce a high risk for the stability of the system if the driver is not really stable and well-tested. And there are a lot of bad drivers out @@ -1412,14 +1412,14 @@ run in kernel mode. This might be because until now there have been only two different PostScript drivers: the one from Adobe and the one from Microsoft. Both are well-tested and are as stable as you can imagine on Windows. The CUPS driver is derived from the Microsoft one. -
In an attempt to work around problems, site administrators have resorted to restricting the allowed drivers installed on their WTS to one generic PCL and one PostScript driver. This, however, restricts the the number of printer options available for clients to use. Often they can't get out more than simplex prints from one standard paper tray, while their devices could do much better if driven by a different driver! -
+ + Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these shortcomings. There are, depending on the version of Windows OS you use, up to three different PostScript drivers now available: Adobe, Microsoft, and CUPS PostScript drivers. None of them is known to cause major @@ -1428,14 +1428,14 @@ server acting as a PostScript RIP for its clients requires more CPU and RAM than when just acting as a “raw spooling” device. Plus, this setup is not yet widely tested, although the first feedbacks look very promising. -
- - - - - - + + + + + + More recent printer drivers on W200x and XP no longer run in kernel mode (unlike Windows NT). However, both operating systems can still use the NT drivers, running in kernel mode (you can roughly tell which is which as the drivers in subdirectory “2” of “W32X86” are “old” ones). As was @@ -1447,13 +1447,13 @@ allow them to publish the whole of the source code. However, they have released the “diff” under the GPL, and if you are the owner of an “MS DDK for Windows NT,” you can check the driver yourself. -
As we have said before, all previously known methods to prepare client printer drivers on the Samba server for download and Point'n'Print convenience of Windows workstations are working with CUPS, too. These methods were described in Classical Printing. In reality, this is a pure Samba business and relates only to the Samba-Windows client relationship. -
+
The cupsaddsmb utility (shipped with all current CUPS versions) is an alternative
method to transfer printer drivers into the Samba [print$] share. Remember, this
share is where clients expect drivers deposited and set up for download and installation. It makes the sharing
@@ -1470,11 +1470,11 @@
However, currently only Windows NT, 2000, and XP are supported by the
CUPS drivers. You will also need to get the respective part of the Adobe driver
if you need to support Windows 95, 98, and Me clients.
-
Prior to running cupsaddsmb, you need the settings in
smb.conf as shown in the smb.conf for cupsaddsmb Usage.
-
Example 21.3. smb.conf for cupsaddsmb Usage
[global] |
load printers = yes |
printing = cups |
printcap name = cups |
[printers] |
comment = All Printers |
path = /var/spool/samba |
browseable = no |
public = yes |
| # setting depends on your requirements |
guest ok = yes |
writable = no |
printable = yes |
printer admin = root |
[print$] |
comment = Printer Drivers |
path = /etc/samba/drivers |
browseable = yes |
guest ok = no |
read only = yes |
write list = root |
Example 21.3. smb.conf for cupsaddsmb Usage
[global] |
load printers = yes |
printing = cups |
printcap name = cups |
[printers] |
comment = All Printers |
path = /var/spool/samba |
browseable = no |
public = yes |
| # setting depends on your requirements |
guest ok = yes |
writable = no |
printable = yes |
printer admin = root |
[print$] |
comment = Printer Drivers |
path = /etc/samba/drivers |
browseable = yes |
guest ok = no |
read only = yes |
write list = root |
+
CUPS users may get the exact same package from http://www.cups.org/software.html. It is a separate package
from the CUPS-based software files, tagged as CUPS 1.1.x Windows NT/200x/XP Printer Driver for Samba (tar.gz,
192k). The filename to download is cups-samba-1.1.x.tar.gz. Upon untar and unzipping, it
@@ -1487,8 +1487,8 @@
cups-samba.remove
cups-samba.ss
-
-
+
+
These have been packaged with the ESP meta-packager software EPM. The *.install and
*.remove files are simple shell scripts, which untar the *.ss (the
*.ss is nothing else but a tar archive, which can be untarred by “tar” too).
@@ -1520,32 +1520,32 @@
around this, copy/move the file (after running the ./cups-samba.install script) manually to
the correct place.
- + This new CUPS PostScript driver is currently binary only, but free of charge. No complete source code is provided (yet). The reason is that it has been developed with the help of the Microsoft DDK and compiled with Microsoft Visual Studio 6. Driver developers are not allowed to distribute the whole of the source code as free software. However, CUPS developers released the “diff” in source code under the GPL, so anybody with a license for Visual Studio and a DDK will be able to compile for himself or herself. -
The CUPS drivers do not support the older Windows 95/98/Me, but only the Windows NT/2000/XP client.
Windows NT, 2000, and XP are supported by:
cups.hlp
cupsdrvr.dll
cupsui.dll
Adobe drivers are available for the older Windows 95/98/Me as well as for Windows NT/2000/XP clients. The set of files is different from the different platforms.
Windows 95, 98, and ME are supported by:
ADFONTS.MFM
ADOBEPS4.DRV
ADOBEPS4.HLP
DEFPRTR2.PPD
ICONLIB.DLL
PSMON.DLL
Windows NT, 2000, and XP are supported by:
ADOBEPS5.DLL
ADOBEPSU.DLL
ADOBEPSU.HLP
Note
- + If both the Adobe driver files and the CUPS driver files for the support of Windows NT/200x/XP are presently installed on the server, the Adobe files will be ignored and the CUPS files will be used. If you prefer for whatever reason to use Adobe-only drivers, move away the three CUPS driver files. The Windows 9x/Me clients use the Adobe drivers in any case. -
Acquiring the Adobe driver files seems to be unexpectedly difficult for many users. They are not available on
the Adobe Web site as single files, and the self-extracting and/or self-installing Windows-.exe is not easy to
locate either. You probably need to use the included native installer and run the installation process on one
client once. This will install the drivers (and one generic PostScript printer) locally on the client. When
they are installed, share the generic PostScript printer. After this, the client's [print$] share holds the Adobe files, which you can get with smbclient from the CUPS host.
-
+
Users of the ESP Print Pro software are able to install the ESP print drivers package as an alternative to the
Adobe PostScript drivers. To do so, retrieve the driver files from the normal download area of the ESP Print
Pro software at Easy Software web site.
@@ -1555,19 +1555,19 @@
the menu. Of course, you need to have prepared Samba beforehand to handle the driver files; that is, set up
the [print$] share, and so on. The ESP Print Pro package includes the CUPS driver
files as well as a (licensed) set of Adobe drivers for the Windows 95/98/Me client family.
-
+
+
+
+
Once you have run the install script (and possibly manually moved the cups.hlp file to
/usr/share/cups/drivers/), the driver is ready to be put into Samba's [print$] share (which often maps to /etc/samba/drivers/ and contains a
subdirectory tree with WIN40 and W32X86 branches). You do this by
running cupsaddsmb (see also man cupsaddsmb for CUPS since release
1.1.16).
Tip
-
-
+
+
You may need to put root into the smbpasswd file by running smbpasswd; this is especially
important if you should run this whole procedure for the first time and are not working in an environment
where everything is configured for single sign-on to a Windows Domain Controller.
@@ -1582,8 +1582,8 @@
in the /usr/share/cups/drivers/ directory. The new cupsaddsmb (from
1.1.16) will automatically prefer its own drivers if it finds both.
Note
-
-
+
+
Should your Windows clients have had the old ADOBE*.* files for the Adobe PostScript
driver installed, the download and installation of the new CUPS PostScript driver for Windows NT/200x/XP will
fail at first. You need to wipe the old driver from the clients first. It is not enough to
@@ -1597,43 +1597,43 @@
printers using this driver in the Printers folder first. You will need Administrator
privileges to do this.
Note
- - + + Once you have successfully downloaded the CUPS PostScript driver to a client, you can easily switch all printers to this one by proceeding as described in Classical Printing Support. Either change a driver for an existing printer by running the Printer Properties dialog, or use rpcclient with the setdriver subcommand. -
Are you interested in a comparison between the CUPS and the Adobe PostScript drivers? For our purposes, these are the most important items that weigh in favor of CUPS:
No hassle with the Adobe EULA.
No hassle with the question, “Where do I get the ADOBE*.* driver files?”
- + The Adobe drivers (on request of the printer PPD associated with them) often put a PJL header in front of the main PostScript part of the print file. Thus, the print file starts with
<1B >%-12345Xor<escape>%-12345Xinstead of%!PS. This leads to the CUPS daemon autotyping the incoming file as a print-ready file, not initiating a pass through thepstopsfilter (to speak more technically, it is not - regarded as the generic MIME-type + regarded as the generic MIME-typeapplication/postscript, but as the more special MIME type - +application/cups.vnd-postscript), which therefore also leads to the page accounting in/var/log/cups/page_lognot receiving the exact number of pages; instead the dummy page number of “1” is logged in a standard setup).The Adobe driver has more options to misconfigure the - + PostScript generated by it (like setting it inadvertently to Optimize for Speed instead of Optimize for Portability, which could lead to CUPS being unable to process it).
The CUPS PostScript driver output sent by Windows - + clients to the CUPS server is guaranteed to autotype as the generic MIME type
application/postscript, thus passing through the CUPSpstopsfilter and logging the correct number of pages in thepage_logfor accounting and quota purposes.- + The CUPS PostScript driver supports the sending of additional standard (IPP) print options by Windows NT/200x/XP clients. Such additional print options are naming the CUPS standard banner pages (or the custom ones, should they be installed at the time of driver download), using the CUPS @@ -1646,36 +1646,36 @@ not disturb any other applications because they will regard it as a comment and simply ignore it).
The CUPS PostScript driver will be the heart of the fully fledged CUPS IPP client for Windows NT/200x/XP to be released soon - (probably alongside the first beta release for CUPS 1.2).
+
+
The cupsaddsmb command copies the needed files into your [print$]
share. Additionally, the PPD associated with this printer is copied from /etc/cups/ppd/
to [print$]. There the files wait for convenient Windows client installations via
Point'n'Print. Before we can run the command successfully, we need to be sure that we can authenticate toward
-Samba. If you have a small network, you are probably using user-level security (security = user).
+Samba. If you have a small network, you are probably using user-level security (security = user).
Here is an example of a successfully run cupsaddsmb command: - - + +
root#cupsaddsmb -U root infotec_IS2027Password for root required to access localhost via Samba:['secret']
-
+
To share all printers and drivers, use the
-a parameter instead of a printer name. Since
cupsaddsmb “exports” the printer drivers to Samba, it should be
obvious that it only works for queues with a CUPS driver associated.
-
+
Probably you want to see what's going on. Use the
-v parameter to get a more verbose output. The
output below was edited for better readability: all “\” at the end of
a line indicate that I inserted an artificial line break plus some
indentation here:
-
-
+
+
root#cupsaddsmb -U root -v infotec_2105Password for root required to access localhost via GANDALF: @@ -1744,17 +1744,17 @@ Also, if you look further, you may discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in the output. This will occur when the directories WIN40 and W32X86 already existed in the[print$]driver download share (from a previous driver installation). These are harmless warning messages. -
+ What has happened? What did cupsaddsmb do? There are five stages of the procedure:
- + Call the CUPS server via IPP and request the driver files and the PPD file for the named printer.
Store the files temporarily in the local TEMPDIR (as defined in
cupsd.conf).Connect via smbclient to the Samba server's
[print$]share and put the files into the share's WIN40 (for Windows 9x/Me) and W32X86 (for Windows NT/200x/XP) subdirectories.- + Connect via rpcclient to the Samba server and execute the adddriver command with the correct parameters.
- + Connect via rpcclient to the Samba server a second time and execute the setdriver command.
Note
You can run the cupsaddsmb utility with parameters to specify one remote host as Samba host and a second remote host as CUPS host. Especially if you want to get a deeper understanding, it is a good idea @@ -1763,7 +1763,7 @@
root#cupsaddsmb -H sambaserver -h cupsserver -v printer
-
You must always check if the utility completed successfully in all fields. You need at minimum these three messages among the output: @@ -1785,16 +1785,16 @@ SetPrinter call failed! result was WERR_ACCESS_DENIED
-it means that you might have set use client driver = yes for this printer.
+it means that you might have set use client driver = yes for this printer.
Setting it to “no” will solve the problem. Refer to the smb.conf man page for explanation of
the use client driver.
Note
It is impossible to see any diagnostic output if you do not run cupsaddsmb in verbose mode. Therefore, we strongly recommend against use of the default quiet mode. It will hide any problems from you that might occur. -
+
+
Can't get the standard cupsaddsmb command to run on a Samba PDC? Are you asked for the
password credential again and again, and the command just will not take off at all? Try one of these
variations:
@@ -1804,20 +1804,20 @@
root# cupsaddsmb -H SAURON -U MIDEARTH\\root -h cups-server -v printername
(Note the two backslashes: the first one is required to “escape” the second one). -
+ + The cupsaddsmb Flowchart shows a chart about the procedures, command flows, and data flows of the cupaddsmb command. Note again: cupsaddsmb is not intended to, and does not work with, raw print queues! -
+ + After cupsaddsmb is completed, your driver is prepared for the clients to use. Here are the steps you must perform to download and install it via Point'n'Print. From a Windows client, browse to the CUPS/Samba server:
@@ -1827,9 +1827,9 @@
you want to test it and send your first job from an application like Winword, the new printer appears in a
\\SambaServer\PrinterName entry in the drop-down list of available printers.
- - - + + + cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher and with Samba version 2.2.4, or later. If it does not work, or if the automatic printer driver download to the clients does not succeed, you can still manually install the CUPS printer PPD on top of the Adobe PostScript driver on @@ -1858,34 +1858,34 @@ Sometimes you can choose PostScript Language Level: in case of problems try 2 instead of 3 (the latest ESP Ghostscript package handles Level 3 PostScript very well; Adobe).
- Say Yes to PostScript Error Handler (Adobe).
Of course, you can run all the commands that are embedded into the cupsaddsmb convenience utility yourself, one by one, and upload and prepare the driver files for future client downloads.
-
-
-
-
-
+
+
+
+
+
We are going to do this now. First, read the man page on rpcclient to get a first idea.
Look at all the printing-related subcommands: enumprinters, enumdrivers,
enumports, adddriver, and setdriver are among the
most interesting ones. rpcclient implements an important part of the MS-RPC protocol.
You can use it to query (and command) a Windows NT (or 200x/XP) PC, too. MS-RPC is used by Windows clients,
among other things, to benefit from the Point'n'Print features. Samba can now mimic this as well.
-
+
First let's check the rpcclient man page. Here are two relevant passages:
-
-
-
+
+
+
adddriver <arch> <config> Execute an AddPrinterDriver() RPC
to install the printer driver information on the server. The driver files should already exist in the
directory returned by getdriverdir. Possible values for arch are the
@@ -1908,18 +1908,18 @@
NT print server, the print monitor for a driver must already be installed before adding the driver or else the
RPC will fail.
- - + + setdriver <printername> <drivername> Execute a SetPrinter() command to update the printer driver associated with an installed printer. The printer driver must already be correctly installed on the print server.
- - + + See also the enumprinters and enumdrivers commands to obtain a list of installed printers and drivers. -
+ The exact format isn't made too clear by the man page, since you have to deal with some parameters containing spaces. Here is a better description for it. We have line-broken the command and indicated the breaks with “\”. Usually you would type the command in one line without the line @@ -1943,9 +1943,9 @@ listening to the traffic caused by Windows computers on the wire. We may as well turn to a Windows box now and access it from a UNIX workstation. We will query it with rpcclient to see what it tells us and try to understand the man page more clearly. -
+
+
We could run rpcclient with a getdriver or a
getprinter subcommand (in level 3 verbosity) against it. Just sit down at a UNIX or Linux
workstation with the Samba utilities installed, then type the following command:
@@ -1953,7 +1953,7 @@
root# rpcclient -U'user%secret' NT-SERVER -c 'getdriver printername 3'
From the result it should become clear which is which. Here is an example from my installation: - +
root#rpcclient -U'Danka%xxxx' W200xSERVER \ -c'getdriver "DANKA InfoStream Virtual Printer" 3'@@ -1984,15 +1984,15 @@ would go into the last fieldListOfFiles,Comma-separated. For the CUPS PostScript drivers, we do not need any (nor would we for the Adobe PostScript driver); therefore, the field will get a “NULL” entry. -
+ + + From the man page (and from the quoted output of cupsaddsmb above) it becomes clear that you need to have certain conditions in order to make the manual uploading and initializing of the driver files succeed. The two rpcclient subcommands (adddriver and setdriver) need to encounter the following preconditions to complete successfully: -
You are connected as printer admin or root (this is +
You are connected as printer admin or root (this is not the “Printer Operators” group in NT, but the printer admin group as defined in the
[global]section ofsmb.conf).Copy all required driver files to
\\SAMBA\print$\w32x86and @@ -2004,19 +2004,19 @@ the[print$]share and create subdirectories.The printer you are going to set up for the Windows clients needs to be installed in CUPS already.
- - + + The CUPS printer must be known to Samba; otherwise the setdriver subcommand fails with an NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by Samba, you may use the enumprinters subcommand to rpcclient. A long-standing bug prevented a proper update of the printer list until every smbd process had received a SIGHUP or was restarted. Remember this in case you've created the CUPS printer just recently and encounter problems: try restarting Samba. -
We are going to install a printer driver now by manually executing all required commands. Because this may seem a rather complicated process at first, we go through the procedure step by step, explaining every single action item as it comes up. -
Procedure 21.2. Manual Driver Installation
Install the printer on CUPS.
+
Procedure 21.2. Manual Driver Installation
Install the printer on CUPS.
root#lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E \ -P canonIR85.ppd@@ -2025,7 +2025,7 @@ (a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root for this step.
(Optional.) Check if the printer is recognized by Samba.
root#rpcclient -Uroot%xxxx -c 'enumprinters' localhost \ | grep -C2 mysmbtstprn@@ -2045,8 +2045,8 @@ of the following steps. Alternatively, you can authenticate as one of the users from the “write list” as defined insmb.conffor[print$].(Optional.) Check if Samba knows a driver for the printer.
root#rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2'\ localhost | grep driver@@ -2102,7 +2102,7 @@ The driver files now are in the W32X86 architecture “root” of[print$].Tell Samba that these are driver files (adddriver).
root#rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \ "mydrivername:cupsdrvr.dll:mysmbtstprn.PPD: \ @@ -2133,7 +2133,7 @@ Notice how step 6 also moved the driver files to the appropriate subdirectory. Compare this with the situation after step 5.(Optional.) Verify if Samba now recognizes the driver.
root#rpcclient -Uroot%xxxx -c 'enumdrivers 3' \ localhost | grep -B2 -A5 mydrivername@@ -2149,7 +2149,7 @@ Remember, this command greps for the name you chose for the driver in step 6. This command must succeed before you can proceed.<title>Tell Samba which printer should use these driver files (setdriver).</title>
root#rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' \ localhost@@ -2160,9 +2160,9 @@ succeed. The only preconditions are that enumdrivers must find the driver and enumprinters must find the printer.(Optional) Verify if Samba has recognized this association.
root#rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \ | grep driver@@ -2202,13 +2202,13 @@ comment:[mysmbtstprn]- + Compare these results with the ones from steps 2 and 3. Every one of these commands show the driver is installed. Even the enumprinters command now lists the driver on the “description” line.
(Optional.) Tickle the driver into a correct device mode.
- + You certainly know how to install the driver on the client. In case you are not particularly familiar with Windows, here is a short recipe: Browse the Network Neighborhood, go to the Samba server, and look @@ -2231,12 +2231,12 @@ Change any printer setting once (like changing portrait to landscape), click on , and change the setting back.
Install the printer on a client (Point'n'Print).
C:\>rundll32 printui.dll,PrintUIEntry /in /n "\\sambaserver\mysmbtstprn"If it does not work, it could be a permissions problem with the
[print$]share. -(Optional) Print a test page.
+
(Optional) Print a test page.
C:\>rundll32 printui.dll,PrintUIEntry /p /n "\\sambaserver\mysmbtstprn"Then hit [TAB] five times, [ENTER] twice, [TAB] once, and [ENTER] again, and march to the printer. @@ -2246,8 +2246,8 @@ why not just throw it away!
(Obligatory.) Enjoy. Jump. Celebrate your success.
root#echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd-
+ The setdriver command will fail if in Samba's mind the queue is not already there. A successful installation displys the promising message that the:
@@ -2258,20 +2258,20 @@result was NT_STATUS_UNSUCCESSFUL- - + + It is not good enough that you can see the queue in CUPS, using the lpstat -p ir85wm command. A bug in most recent versions of Samba prevents the proper update of the queue list. The recognition of newly installed CUPS printers fails unless you restart Samba or send a HUP to all smbd processes. To verify if this is the reason why Samba does not execute the setdriver command successfully, check if Samba “sees” the printer: - +
root#rpcclient transmeta -N -U'root%xxxx' -c 'enumprinters 0'|grep ir85wmprintername:[ir85wm]An alternate command could be this: - +
root#rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm'cmd = getprinter ir85wm @@ -2281,28 +2281,28 @@ comment:[CUPS PostScript-Treiber for Windows NT/200x/XP]By the way, you can use these commands, plus a few more, of course, to install drivers on remote Windows NT print servers too! -
+
+
+
+
+
+
+
+
+
+
+
+
+
Some mystery is associated with the series of files with a tdb suffix appearing in every Samba installation.
They are connections.tdb, printing.tdb,
share_info.tdb, ntdrivers.tdb, unexpected.tdb,
brlock.tdb, locking.tdb, ntforms.tdb,
messages.tdb , ntprinters.tdb, sessionid.tdb,
and secrets.tdb. What is their purpose?
-
+
A Windows NT (print) server keeps track of all information needed to serve its duty toward its clients by
storing entries in the Windows registry. Client queries are answered by reading from the registry,
Administrator or user configuration settings that are saved by writing into the registry. Samba and UNIX
@@ -2311,7 +2311,7 @@
/var/lib/samba/ or /var/lock/samba/. The printing-related files are
ntprinters.tdb, printing.tdb,ntforms.tdb, and
ntdrivers.tdb.
-
*.tdb files are not human readable. They are written in a binary format. “Why not
ASCII?”, you may ask. “After all, ASCII configuration files are a good and proven tradition on
UNIX.” The reason for this design decision by the Samba Team is mainly performance. Samba needs to be
@@ -2320,16 +2320,16 @@
*.tdb file at the same time. The file format of Samba's
*.tdb files allows for this provision. Many smbd processes may write to the same
*.tdb file at the same time. This wouldn't be possible with pure ASCII files.
-
It is very important that all *.tdb files remain consistent over all write and read
accesses. However, it may happen that these files do get corrupted. (A kill -9
`pidof smbd' while a write access is in progress could do the damage, as could a power interruption,
etc.). In cases of trouble, a deletion of the old printing-related *.tdb files may be the
only option. After that, you need to re-create all print-related setups unless you have made a backup of the
*.tdb files in time.
-
+
+
Samba ships with a little utility that helps the root user of your system to backup your
*.tdb files. If you run it with no argument, it prints a usage message:
@@ -2356,10 +2356,10 @@ -rw------- 1 root root 40960 May 2 03:44 printing.tdb -rw------- 1 root root 40960 May 2 03:44 printing.tdb.bak -
+ CUPS ships with good support for HP LaserJet-type printers. You can install the generic driver as follows: - +
root#lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
@@ -2375,9 +2375,9 @@ the tireless work of Till Kamppeter from Mandrakesoft, who is also the principal author of the foomatic-rip utility.
Note
- - - + + + The former cupsomatic concept is now being replaced by the new successor, a much more powerful foomatic-rip. cupsomatic is no longer maintained. Here is the new URL to the Foomatic-3.0 @@ -2386,9 +2386,9 @@ cupsomatic. The new-style PPDs are 100% compliant with the Adobe PPD specification. They are also intended to be used by Samba and the cupsaddsmb utility, to provide the driver files for the Windows clients! -
+ + Nowadays, most Linux distributions rely on the utilities from the Linuxprinting.org to create their printing-related software (which, by the way, works on all UNIXes and on Mac OS X and Darwin, too). The utilities from this sire have a very end-user-friendly interface that allows for an easy update of drivers and PPDs for all supported models, @@ -2399,8 +2399,8 @@ Linuxprinting.org keeps all the important facts about printer drivers, supported models, and which options are available for the various driver/printer combinations in its Foomatic database. Currently there are 245 drivers in the database. Many drivers support various models, and many models may be driven by different drivers its your choice! -
+ At present, there are 690 devices dubbed as working perfectly: 181 are mostly perfect, 96 are partially perfect, and 46 are paperweights. Keeping in mind that most of these are non-PostScript models (PostScript printers are automatically supported by CUPS to perfection by using their @@ -2408,7 +2408,7 @@ if it does not also scan and copy and fax under GNU/Linux then this is a truly astonishing achievement! Three years ago the number was not more than 500, and Linux or UNIX printing at the time wasn't anywhere near the quality it is today. -
A few years ago Grant Taylor started it all. The roots of today's Linuxprinting.org are in the first Linux Printing HOWTO that he authored. As a side-project to this document, which served many Linux users and admins to guide their first steps in this @@ -2417,8 +2417,8 @@ Postgres database with information about the hardware and driver zoo that made up Linux printing of the time. This database became the core component of today's Foomatic collection of tools and data. In the meantime, it has moved to an XML representation of the data. -
+ “Why the funny name?” you ask. When it really took off, around spring 2000, CUPS was far less popular than today, and most systems used LPD, LPRng, or even PDQ to print. CUPS shipped with a few generic drivers (good for a few hundred different printer models). These didn't support many device-specific options. @@ -2436,10 +2436,10 @@ to CUPS users (because often the traditional Ghostscript way of printing was the only one available).
It gave all the advanced CUPS options (Web interface, GUI driver configurations) to users wanting (or needing) to use - Ghostscript filters.
+ + + CUPS worked through a quickly hacked-up filter script named cupsomatic. cupsomatic ran the printfile through Ghostscript, constructing automatically the rather complicated command line needed. It just needed to be copied into the CUPS system to make it work. To configure the way cupsomatic controls the @@ -2460,8 +2460,8 @@ behind the “*omatic” scripts. Foomatic, up to versions 2.0.x, required (ugly) Perl data structures attached to Linuxprinting.org PPDs for CUPS. It had a different “*omatic” script for every spooler, as well as different printer configuration files. -
+ This has all changed in Foomatic versions 2.9 (beta) and released as “stable” 3.0. It has now achieved the convergence of all *omatic scripts and is called the foomatic-rip. This single script is the unification of the previously different spooler-specific *omatic scripts. @@ -2470,18 +2470,18 @@ have the power of PPDs at their disposal. Users only need to plug foomatic-rip into their system. For users there is improved media type and source support paper sizes and trays are easier to configure.
+ - - + Also, the new generation of Linuxprinting.org PPDs no longer contains Perl data structures. If you are a distro maintainer and have used the previous version of Foomatic, you may want to give the new one a spin, but remember to generate a new-version set of PPDs via the new foomatic-db-engine!. Individual users just need to generate a single new PPD specific to their model by following the steps outlined in the Foomatic tutorial or in this chapter. This new development is truly amazing.
- - - + + + foomatic-rip is a very clever wrapper around the need to run Ghostscript with a different syntax, options, device selections, and/or filters for each different printer or spooler. At the same time, it can read the PPD associated with a print queue and modify the print job according to the user selections. Together with this @@ -2489,8 +2489,8 @@ Foomatic concept may surprise users. It will support custom paper sizes for many printers and will support printing on media drawn from different paper trays within the same job (in both cases, even where there is no support for this from Windows-based vendor printer drivers). -
+ Most driver development itself does not happen within Linuxprinting.org. Drivers are written by independent maintainers. Linuxprinting.org just pools all the information and stores it in its database. In addition, it also provides the Foomatic glue to integrate the many drivers into any modern (or legacy) printing system @@ -2498,25 +2498,25 @@
Speaking of the different driver development groups, most of the work is currently done in three projects:
- + Omni a free software project by IBM that tries to convert its printer driver knowledge from good-ol' OS/2 times into a modern, modular, universal driver architecture for Linux/UNIX (still beta). This currently supports 437 models.
- + HPIJS a free software project by HP to provide the support for its own range of models (very mature, printing in most cases is perfect and provides true photo quality). This currently supports 369 models.
- + Gimp-Print a free software effort, started by Michael Sweet (also lead developer for CUPS), now directed by Robert Krawitz, which has achieved an amazing level of photo print quality (many Epson users swear that its quality is better than the vendor drivers provided by Epson for the Microsoft - platforms). This currently supports 522 models.
Linuxprinting.org today is the one-stop shop to download printer drivers. Look for printer information and tutorials or solve printing problems in its popular forums. This @@ -2525,9 +2525,9 @@ Mac OS X forum has turned out to be one of the most frequented forums after only a few weeks.
- - - + + + Linuxprinting.org and the Foomatic driver wrappers around Ghostscript are now a standard tool-chain for printing on all the important distros. Most of them also have CUPS underneath. While in recent years most printer data had been added by Kamppeter, many additional contributions came from engineers with SuSE, Red @@ -2536,16 +2536,16 @@
Note
Till Kamppeter from Mandrakesoft is doing an excellent job in his spare time to maintain Linuxprinting.org and Foomatic. So if you use it often, please send him a note showing your appreciation. -
+ + + + + + + + + The Foomatic database is an amazing piece of ingenuity in itself. Not only does it keep the printer and driver information, but it is organized in a way that it can generate PPD files on the fly from its internal XML-based datasets. While these PPDs are modeled to the Adobe specification of PPDs, the @@ -2560,7 +2560,7 @@ This usage of PPDs to describe the options of non-PostScript printers was the invention of the CUPS developers. The rest is easy. GUI tools (like KDE's marvelous kprinter or the GNOME gtklp xpp and the CUPS Web interface) read the PPD as well and use this information to present the available settings to the user as an intuitive menu selection. -
Here are the steps to install a foomatic-rip-driven LaserJet 4 Plus-compatible printer in CUPS (note that recent distributions of SuSE, UnitedLinux and Mandrake may ship with a complete package of Foomatic-PPDs plus the @@ -2653,8 +2653,8 @@ fit for your printer model's consumption.
Ghostscript must (depending on the driver/model) contain support for a certain device representing the selected driver for your model (as shown by gs -h).
foomatic-rip needs a new version of PPDs (PPD versions - produced for cupsomatic do not work with foomatic-rip).
