diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/manpages.html samba-3.0.10/docs/htmldocs/manpages.html --- samba-3.0.9/docs/htmldocs/manpages.html 2004-11-15 10:14:50.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/manpages.html 2004-12-15 10:23:08.000000000 -0600 @@ -1 +1,55 @@ -

+

editreg(1)

A utility for printing and editing NT4 registry files + +

findsmb(1)

list info about machines that respond to SMB + name queries on a subnet +

lmhosts(5)

The Samba NetBIOS hosts file +

log2pcap(1)

Extract network traces from Samba log files +

mount.cifs(8)

mount using the Common Internet File System (CIFS) +

net(8)

Tool for administration of Samba and remote + CIFS servers. + +

nmbd(8)

NetBIOS name server to provide NetBIOS + over IP naming services to clients +

nmblookup(1)

NetBIOS over TCP/IP client used to lookup NetBIOS + names +

ntlm_auth(1)

tool to allow external access to Winbind's NTLM authentication function +

pam_winbind(8)

PAM module for Winbind +

pdbedit(8)

manage the SAM database (Database of Samba Users) +

profiles(1)

A utility to report and change SIDs in registry files + +

rpcclient(1)

tool for executing client side + MS-RPC functions +

samba(7)

A Windows SMB/CIFS fileserver for UNIX +

smb.conf(5)

The configuration file for the Samba suite +

smbcacls(1)

Set or get ACLs on an NT file or directory names +

smbclient(1)

ftp-like client to access SMB/CIFS resources + on servers +

smbcontrol(1)

send messages to smbd, nmbd or winbindd processes +

smbcquotas(1)

Set or get QUOTAs of NTFS 5 shares +

smbd(8)

server to provide SMB/CIFS services to clients +

smbget(1)

wget-like utility for download files over SMB +

smbgetrc(5)

configuration file for smbget +

smbmnt(8)

helper utility for mounting SMB filesystems +

smbmount(8)

mount an smbfs filesystem +

smbpasswd(5)

The Samba encrypted password file +

smbpasswd(8)

change a user's SMB password +

smbsh(1)

Allows access to remote SMB shares + using UNIX commands +

smbspool(8)

send a print file to an SMB printer +

smbstatus(1)

report on current Samba connections +

smbtar(1)

shell script for backing up SMB/CIFS shares + directly to UNIX tape drives +

smbtree(1)

A text based smb network browser + +

smbumount(8)

smbfs umount for normal users +

swat(8)

Samba Web Administration Tool +

tdbbackup(8)

tool for backing up and for validating the integrity of samba .tdb files +

tdbdump(8)

tool for printing the contents of a TDB file +

testparm(1)

check an smb.conf configuration file for + internal correctness +

testprns(1)

check printer name for validity with smbd +

vfstest(1)

tool for testing samba VFS modules +

wbinfo(1)

Query information from winbind daemon +

winbindd(8)

Name Service Switch daemon for resolving names + from NT servers +

diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/net.8.html samba-3.0.10/docs/htmldocs/net.8.html --- samba-3.0.9/docs/htmldocs/net.8.html 2004-11-15 10:13:36.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/net.8.html 2004-12-15 10:21:45.000000000 -0600 @@ -111,18 +111,18 @@ omitted, the SID of the domain the local server is in.

SETLOCALSID S-1-5-21-x-y-z

Sets domain sid for the local server to the specified SID.

GROUPMAP

Manage the mappings between Windows group SIDs and UNIX groups. Parameters take the for "parameter=value". Common options include:

GROUPMAP ADD

Add a new group mapping entry

net groupmap add {rid=int|sid=string} unixgroup=string [type={domain|local|builtin}] [ntgroup=string] [comment=string]

GROUPMAP DELETE

Delete a group mapping entry

net groupmap delete {ntgroup=string|sid=SID}

GROUPMAP MODIFY

Update en existing group entry

net groupmap modify {ntgroup=string|sid=SID} [unixgroup=string] [comment=string] [type={domain|local}

GROUPMAP LIST

List existing group mapping entries

net groupmap list [verbose] [ntgroup=string] [sid=SID]

MAXRID

Prints out the highest RID currently in use on the local + or 'builtin'

  • comment - Freeform text description of the group

  • GROUPMAP ADD

    Add a new group mapping entry

    net groupmap add {rid=int|sid=string} unixgroup=string [type={domain|local}] [ntgroup=string] [comment=string]

    GROUPMAP DELETE

    Delete a group mapping entry. If more then one group name matches, the first entry found is deleted.

    net groupmap delete {ntgroup=string|sid=SID}

    GROUPMAP MODIFY

    Update en existing group entry

    net groupmap modify {ntgroup=string|sid=SID} [unixgroup=string] [comment=string] [type={domain|local}]

    GROUPMAP LIST

    List existing group mapping entries

    net groupmap list [verbose] [ntgroup=string] [sid=SID]

    MAXRID

    Prints out the highest RID currently in use on the local server (by the active 'passdb backend'). -

    RPC INFO

    Print information about the domain of the remote server, +

    RPC INFO

    Print information about the domain of the remote server, such as domain name, domain sid and number of users and groups. -

    [RPC|ADS] TESTJOIN

    Check whether participation in a domain is still valid.

    [RPC|ADS] CHANGETRUSTPW

    Force change of domain trust password.

    RPC TRUSTDOM

    RPC TRUSTDOM ADD DOMAIN

    Add a interdomain trust account for +

    [RPC|ADS] TESTJOIN

    Check whether participation in a domain is still valid.

    [RPC|ADS] CHANGETRUSTPW

    Force change of domain trust password.

    RPC TRUSTDOM

    RPC TRUSTDOM ADD DOMAIN

    Add a interdomain trust account for DOMAIN to the remote server. -

    RPC TRUSTDOM DEL DOMAIM

    Remove interdomain trust account for +

    RPC TRUSTDOM DEL DOMAIM

    Remove interdomain trust account for DOMAIN from the remote server. -

    Note

    Currently NOT implemented.

    RPC TRUSTDOM ESTABLISH DOMAIN

    +

    Note

    Currently NOT implemented.

    RPC TRUSTDOM ESTABLISH DOMAIN

    Establish a trust relationship to a trusting domain. Interdomain account must already be created on the remote PDC. -

    RPC TRUSTDOM REVOKE DOMAIN

    Abandon relationship to trusted domain

    RPC TRUSTDOM LIST

    List all current interdomain trust relationships.

    RPC ABORTSHUTDOWN

    Abort the shutdown of a remote server.

    SHUTDOWN [-t timeout] [-r] [-f] [-C message]

    Shut down the remote server.

    -r

    +

    RPC TRUSTDOM REVOKE DOMAIN

    Abandon relationship to trusted domain

    RPC TRUSTDOM LIST

    List all current interdomain trust relationships.

    RPC ABORTSHUTDOWN

    Abort the shutdown of a remote server.

    SHUTDOWN [-t timeout] [-r] [-f] [-C message]

    Shut down the remote server.

    -r

    Reboot after shutdown.

    -f

    Force shutting down all applications. @@ -130,22 +130,22 @@ Timeout before system will be shut down. An interactive user of the system can use this time to cancel the shutdown.

    -C message

    Display the specified message on the screen to -announce the shutdown.

    SAMDUMP

    Print out sam database of remote server. You need -to run this on either a BDC.

    VAMPIRE

    Export users, aliases and groups from remote server to +announce the shutdown.

    SAMDUMP

    Print out sam database of remote server. You need +to run this on either a BDC.

    VAMPIRE

    Export users, aliases and groups from remote server to local server. Can only be run an a BDC. -

    GETSID

    Fetch domain SID and store it in the local secrets.tdb.

    ADS LEAVE

    Make the remote host leave the domain it is part of.

    ADS STATUS

    Print out status of machine account of the local machine in ADS. +

    GETSID

    Fetch domain SID and store it in the local secrets.tdb.

    ADS LEAVE

    Make the remote host leave the domain it is part of.

    ADS STATUS

    Print out status of machine account of the local machine in ADS. Prints out quite some debug info. Aimed at developers, regular -users should use NET ADS TESTJOIN.

    ADS PRINTER

    ADS PRINTER INFO [PRINTER] [SERVER]

    +users should use NET ADS TESTJOIN.

    ADS PRINTER

    ADS PRINTER INFO [PRINTER] [SERVER]

    Lookup info for PRINTER on SERVER. The printer name defaults to "*", the -server name defaults to the local host.

    ADS PRINTER PUBLISH PRINTER

    Publish specified printer using ADS.

    ADS PRINTER REMOVE PRINTER

    Remove specified printer from ADS directory.

    ADS SEARCH EXPRESSION ATTRIBUTES...

    Perform a raw LDAP search on a ADS server and dump the results. The +server name defaults to the local host.

    ADS PRINTER PUBLISH PRINTER

    Publish specified printer using ADS.

    ADS PRINTER REMOVE PRINTER

    Remove specified printer from ADS directory.

    ADS SEARCH EXPRESSION ATTRIBUTES...

    Perform a raw LDAP search on a ADS server and dump the results. The expression is a standard LDAP search expression, and the attributes are a list of LDAP fields to show in the results.

    Example: net ads search '(objectCategory=group)' sAMAccountName -

    ADS DN DN (attributes)

    +

    ADS DN DN (attributes)

    Perform a raw LDAP search on a ADS server and dump the results. The DN standard LDAP DN, and the attributes are a list of LDAP fields to show in the result. -

    Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName

    WORKGROUP

    Print out workgroup name for specified kerberos realm.

    HELP [COMMAND]

    Gives usage information for the specified command.

    VERSION

    This man page is complete for version 3.0 of the Samba - suite.

    AUTHOR

    The original Samba software and related utilities +

    Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName

    WORKGROUP

    Print out workgroup name for specified kerberos realm.

    HELP [COMMAND]

    Gives usage information for the specified command.

    VERSION

    This man page is complete for version 3.0 of the Samba + suite.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The net manpage was written by Jelmer Vernooij.

    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/pam_winbind.8.html samba-3.0.10/docs/htmldocs/pam_winbind.8.html --- samba-3.0.9/docs/htmldocs/pam_winbind.8.html 1969-12-31 18:00:00.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/pam_winbind.8.html 2004-12-15 10:21:54.000000000 -0600 @@ -0,0 +1,7 @@ +pam_winbind

    Name

    pam_winbind — PAM module for Winbind

    DESCRIPTION

    This tool is part of the samba(7) suite.

    pam_winbind is a PAM module that can authenticate users against the local domain + by talking to the Winbind daemon.

    OPTIONS

    + pam_winbind does not support any additional options. +

    SEE ALSO

    winbind(8)

    VERSION

    This man page is correct for version 3.0 of Samba.

    AUTHOR

    The original Samba software and related utilities + were created by Andrew Tridgell. Samba is now developed + by the Samba Team as an Open Source project similar + to the way the Linux kernel is developed.

    This manpage was written by Jelmer Vernooij.

    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/architecture.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/architecture.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/architecture.html 2004-11-15 10:15:06.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/architecture.html 2004-12-15 10:23:22.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 4. Samba Architecture

    Chapter 4. Samba Architecture

    Dan Shearer

    November 1997

    Table of Contents

    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design

    Introduction

    +Chapter 4. Samba Architecture

    Chapter 4. Samba Architecture

    Dan Shearer

    November 1997

    Introduction

    This document gives a general overview of how Samba works internally. The Samba Team has tried to come up with a model which is the best possible compromise between elegance, portability, security @@ -78,7 +78,7 @@ nasty to program cleanly due to the enormous amount of shared data (in complex structures) between the processes. We can't rely on each platform having a shared memory system. -

    nbmd Design

    +

    nbmd Design

    Originally Andrew used recursion to simulate a multi-threaded environment, which use the stack enormously and made for really confusing debugging sessions. Luke Leighton rewrote it to use a diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/debug.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/debug.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/debug.html 2004-11-15 10:15:07.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/debug.html 2004-12-15 10:23:22.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 5. The samba DEBUG system

    Chapter 5. The samba DEBUG system

    Chris Hertel

    July 1998

    New Output Syntax

    +Chapter 5. The samba DEBUG system

    Chapter 5. The samba DEBUG system

    Chris Hertel

    July 1998

    New Output Syntax

    The syntax of a debugging log file is represented as:

       >debugfile< :== { >debugmsg< }
    @@ -51,7 +51,7 @@
     Note that in the above example the function names are not listed on
     the header line. That's because the example above was generated on an
     SGI Indy, and the SGI compiler doesn't support the __FUNCTION__ macro.
    -

    The DEBUG() Macro

    +

    The DEBUG() Macro

    Use of the DEBUG() macro is unchanged. DEBUG() takes two parameters. The first is the message level, the second is the body of a function call to the Debug1() function. @@ -151,7 +151,7 @@

  • Processing that is only relevant to debug output can be contained within the DEBUGLVL() block. -

  • New Functions

    dbgtext()

    +

    New Functions

    dbgtext()

    This function prints debug message text to the debug file (and possibly to syslog) via the format buffer. The function uses a variable argument list just like printf() or Debug1(). The @@ -160,7 +160,7 @@ If you use DEBUGLVL() you will probably print the body of the message using dbgtext(). -

    dbghdr()

    +

    dbghdr()

    This is the function that writes a debug message header. Headers are not processed via the format buffer. Also note that if the format buffer is not empty, a call to dbghdr() will not @@ -168,7 +168,7 @@

    It is not likely that this function will be called directly. It is used by DEBUG() and DEBUGADD(). -

    format_debug_text()

    +

    format_debug_text()

    This is a static function in debug.c. It stores the output text for the body of the message in a buffer until it encounters a newline. When the newline character is found, the buffer is diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/index.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/index.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/index.html 2004-11-15 10:15:09.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/index.html 2004-12-15 10:23:25.000000000 -0600 @@ -26,7 +26,7 @@ This documentation is distributed under the GNU General Public License (GPL) version 2. A copy of the license is included with the Samba source distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt -


    Table of Contents

    Attribution
    I. The protocol
    1. Definition of NetBIOS Protocol and Name Resolution Modes
    NETBIOS
    BROADCAST NetBIOS
    NBNS NetBIOS
    2. NetBIOS in a Unix World
    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity
    3. NT Domain RPC's
    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS
    II. Samba Basics
    4. Samba Architecture
    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design
    5. The samba DEBUG system
    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()
    6. Samba Internals
    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table
    7. Coding Suggestions
    8. Contributing code
    9. Modules
    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in
    III. Samba Subsystems
    10. RPC Pluggable Modules
    About
    General Overview
    11. VFS Modules
    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions
    12. The registry subsystem
    Planned backends
    Data structures
    External interface
    Utility functions
    Writing backends
    Memory allocation
    13. The smb.conf file
    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c
    14. Samba WINS Internals
    WINS Failover
    15. LanMan and NT Password Encryption
    Introduction
    How does it work?
    The smbpasswd file
    IV. Debugging and tracing
    16. Tracing samba system calls
    17. Finding useful information on windows
    Netlogon debugging output
    18. Samba Printing Internals
    Abstract
    +


    Table of Contents

    Attribution
    I. The protocol
    1. Definition of NetBIOS Protocol and Name Resolution Modes
    NETBIOS
    BROADCAST NetBIOS
    NBNS NetBIOS
    2. NetBIOS in a Unix World
    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity
    3. NT Domain RPC's
    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS
    II. Samba Basics
    4. Samba Architecture
    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design
    5. The samba DEBUG system
    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()
    6. Samba Internals
    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table
    7. Coding Suggestions
    8. Contributing code
    9. Modules
    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in
    III. Samba Subsystems
    10. RPC Pluggable Modules
    About
    General Overview
    11. VFS Modules
    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions
    12. The registry subsystem
    Planned backends
    Data structures
    External interface
    Utility functions
    Writing backends
    Memory allocation
    13. The smb.conf file
    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c
    14. Samba WINS Internals
    WINS Failover
    15. LanMan and NT Password Encryption
    Introduction
    How does it work?
    The smbpasswd file
    IV. Debugging and tracing
    16. Tracing samba system calls
    17. Finding useful information on windows
    Netlogon debugging output
    18. Samba Printing Internals
    Abstract
    Printing Interface to Various Back ends
    Print Queue TDB's diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/internals.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/internals.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/internals.html 2004-11-15 10:15:07.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/internals.html 2004-12-15 10:23:23.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 6. Samba Internals

    Chapter 6. Samba Internals

    8 May 1996

    Character Handling

    +Chapter 6. Samba Internals

    Chapter 6. Samba Internals

    8 May 1996

    Character Handling

    This section describes character set handling in Samba, as implemented in Samba 3.0 and above

    @@ -75,16 +75,16 @@ are used extensively in the Samba code.

    CVAL(buf,pos)

    returns the byte at offset pos within buffer buf as an unsigned character. -

    PVAL(buf,pos)

    returns the value of CVAL(buf,pos) cast to type unsigned integer.

    SCVAL(buf,pos,val)

    sets the byte at offset pos within buffer buf to value val.

    SVAL(buf,pos)

    +

    PVAL(buf,pos)

    returns the value of CVAL(buf,pos) cast to type unsigned integer.

    SCVAL(buf,pos,val)

    sets the byte at offset pos within buffer buf to value val.

    SVAL(buf,pos)

    returns the value of the unsigned short (16 bit) little-endian integer at offset pos within buffer buf. An integer of this type is sometimes refered to as "USHORT". -

    IVAL(buf,pos)

    returns the value of the unsigned 32 bit little-endian integer at offset +

    IVAL(buf,pos)

    returns the value of the unsigned 32 bit little-endian integer at offset pos within buffer buf.

    SVALS(buf,pos)

    returns the value of the signed short (16 bit) little-endian integer at offset pos within buffer buf.

    IVALS(buf,pos)

    returns the value of the signed 32 bit little-endian integer at offset pos within buffer buf.

    SSVAL(buf,pos,val)

    sets the unsigned short (16 bit) little-endian integer at offset pos within buffer buf to value val.

    SIVAL(buf,pos,val)

    sets the unsigned 32 bit little-endian integer at offset pos within buffer -buf to the value val.

    SSVALS(buf,pos,val)

    sets the short (16 bit) signed little-endian integer at offset pos within +buf to the value val.

    SSVALS(buf,pos,val)

    sets the short (16 bit) signed little-endian integer at offset pos within buffer buf to the value val.

    SIVALS(buf,pos,val)

    sets the signed 32 bit little-endian integer at offset pos withing buffer buf to the value val.

    RSVAL(buf,pos)

    returns the value of the unsigned short (16 bit) big-endian integer at offset pos within buffer buf.

    RIVAL(buf,pos)

    returns the value of the unsigned 32 bit big-endian integer at offset @@ -149,7 +149,7 @@

    The code in client.c always calls call_api() with no data. It is unclear when a non-zero length data buffer would be sent. -

    Return value

    +

    Return value

    The returned parameters (pointed to by rparam), in their order of appearance are:

    1. An unsigned 16 bit integer which contains the API function's return code. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/modules.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/modules.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/modules.html 2004-11-15 10:15:07.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/modules.html 2004-12-15 10:23:23.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 9. Modules

      Chapter 9. Modules

      Jelmer Vernooij

      Samba Team

      19 March 2003

      Advantages

      +Chapter 9. Modules

      Chapter 9. Modules

      Jelmer Vernooij

      Samba Team

      19 March 2003

      Advantages

      The new modules system has the following advantages:

      Transparent loading of static and shared modules (no need for a subsystem to know about modules)
      Simple selection between shared and static modules at configure time
      "preload modules" option for increasing performance for stable modules
      No nasty #define stuff anymore
      All backends are available as plugin now (including pdb_ldap and pdb_tdb)

      Loading modules

      @@ -11,7 +11,7 @@

      This function will be called by the initialisation function of the module to register itself. -

      Static modules

      +

      Static modules

      The modules system compiles a list of initialisation functions for the static modules of each subsystem. This is a define. For example, it is here currently (from include/config.h): @@ -21,7 +21,7 @@

      These functions should be called before the subsystem is used. That should be done when the subsystem is initialised or first used. -

      Shared modules

      +

      Shared modules

      If a subsystem needs a certain backend, it should check if it has already been registered. If the backend hasn't been registered already, the subsystem should call smb_probe_module(char *subsystem, char *backend). @@ -31,7 +31,7 @@ absolute path specified in 'backend'.

      After smb_probe_module() has been executed, the subsystem should check again if the module has been registered. -

      Writing modules

      +

      Writing modules

      Each module has an initialisation function. For modules that are included with samba this name is 'subsystem_backend_init'. For external modules (that will never be built-in, but only available as a module) this name is always 'init_module'. (In the case of modules included with samba, the configure system will add a #define subsystem_backend_init() init_module()). The prototype for these functions is: diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/netbios.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/netbios.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/netbios.html 2004-11-15 10:15:02.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/netbios.html 2004-12-15 10:23:20.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 1. Definition of NetBIOS Protocol and Name Resolution Modes

      Chapter 1. Definition of NetBIOS Protocol and Name Resolution Modes

      Luke Leighton

      12 June 1997

      NETBIOS

      +Chapter 1. Definition of NetBIOS Protocol and Name Resolution Modes

      Chapter 1. Definition of NetBIOS Protocol and Name Resolution Modes

      Luke Leighton

      12 June 1997

      NETBIOS

      NetBIOS runs over the following tranports: TCP/IP; NetBEUI and IPX/SPX. Samba only uses NetBIOS over TCP/IP. For details on the TCP/IP NetBIOS Session Service NetBIOS Datagram Service, and NetBIOS Names, see @@ -39,7 +39,7 @@ UNIQUE NetBIOS name on a network.

      There are two kinds of NetBIOS Name resolution: Broadcast and Point-to-Point. -

      BROADCAST NetBIOS

      +

      BROADCAST NetBIOS

      Clients can claim names, and therefore offer services on successfully claimed names, on their broadcast-isolated subnet. One way to get NetBIOS services (such as browsing: see ftp.microsoft.com/drg/developr/CIFS/browdiff.txt; and @@ -51,7 +51,7 @@ broadcast traffic. [If you have IPX/SPX on your LAN or WAN, you will find that this is already happening: a packet analyzer will show, roughly every twelve minutes, great swathes of broadcast traffic!]. -

      NBNS NetBIOS

      +

      NBNS NetBIOS

      rfc1001.txt describes, amongst other things, the implementation and use of, a 'NetBIOS Name Service'. NT/AS offers 'Windows Internet Name Service' which is fully rfc1001/2 compliant, but has had to take specific action diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/ntdomain.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/ntdomain.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/ntdomain.html 2004-11-15 10:15:06.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/ntdomain.html 2004-12-15 10:23:22.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 3. NT Domain RPC's

      Chapter 3. NT Domain RPC's

      Luke Leighton

      Duncan Stansfield

      01 November 97(version 0.0.24)

    2. the cryptographic side of the NetrServerPasswordSet command, which would allow the workstation to change its password. This password is used to generate the long-term session key. [It is possible to reject this -command, and keep the default workstation password].

    Sources

    cket Traces from Netmonitor (Service Pack 1 and above)
    ul Ashton and Luke Leighton's other "NT Domain" doc.
    FS documentation - cifs6.txt
    FS documentation - cifsrap2.txt

    Credits

    Paul Ashton: loads of work with Net Monitor; understanding the NT authentication system; reference implementation of the NT domain support on which this document is originally based.
    Duncan Stansfield: low-level analysis of MSRPC Pipes.
    Linus Nordberg: producing c-code from Paul's crypto spec.
    Windows Sourcer development team

    Notes and Structures

    Notes

    1. +command, and keep the default workstation password].

    Sources

    cket Traces from Netmonitor (Service Pack 1 and above)
    ul Ashton and Luke Leighton's other "NT Domain" doc.
    FS documentation - cifs6.txt
    FS documentation - cifsrap2.txt

    Credits

    Paul Ashton: loads of work with Net Monitor; understanding the NT authentication system; reference implementation of the NT domain support on which this document is originally based.
    Duncan Stansfield: low-level analysis of MSRPC Pipes.
    Linus Nordberg: producing c-code from Paul's crypto spec.
    Windows Sourcer development team

    Notes and Structures

    Notes

    1. In the SMB Transact pipes, some "Structures", described here, appear to be 4-byte aligned with the SMB header, at their start. Exactly which "Structures" need aligning is not precisely known or documented. @@ -72,15 +72,15 @@ the pointer is also non-zero. immediately following the pointer is the count again, followed by an array of container sub-structures. the count appears a third time after the last sub-structure. -

    Enumerations

    MSRPC Header type

    command number in the msrpc packet header

    MSRPC_Request:

    0x00

    MSRPC_Response:

    0x02

    MSRPC_Bind:

    0x0B

    MSRPC_BindAck:

    0x0C

    MSRPC Packet info

    The meaning of these flags is undocumented

    FirstFrag:

    0x01

    LastFrag:

    0x02

    NotaFrag:

    0x04

    RecRespond:

    0x08

    NoMultiplex:

    0x10

    NotForIdemp:

    0x20

    NotforBcast:

    0x40

    NoUuid:

    0x80

    Structures

    VOID *

    sizeof VOID* is 32 bits.

    char

    sizeof char is 8 bits.

    UTIME

    UTIME is 32 bits, indicating time in seconds since 01jan1970. documented in cifs6.txt (section 3.5 page, page 30).

    NTTIME

    NTTIME is 64 bits. documented in cifs6.txt (section 3.5 page, page 30).

    DOM_SID (domain SID structure)

    UINT32

    num of sub-authorities in domain SID

    UINT8

    SID revision number

    UINT8

    num of sub-authorities in domain SID

    UINT8[6]

    6 bytes for domain SID - Identifier Authority.

    UINT16[n_subauths]

    domain SID sub-authorities

    Note: the domain SID is documented elsewhere. -

    STR (string)

    STR (string) is a char[] : a null-terminated string of ascii characters.

    UNIHDR (unicode string header)

    UINT16

    length of unicode string

    UINT16

    max length of unicode string

    UINT32

    4 - undocumented.

    UNIHDR2 (unicode string header plus buffer pointer)

    UNIHDR

    unicode string header

    VOID*

    undocumented buffer pointer

    UNISTR (unicode string)

    UINT16[]

    null-terminated string of unicode characters.

    NAME (length-indicated unicode string)

    UINT32

    length of unicode string

    UINT16[]

    null-terminated string of unicode characters.

    UNISTR2 (aligned unicode string)

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    max length of unicode string

    UINT32

    0 - undocumented

    UINT32

    length of unicode string

    UINT16[]

    string of uncode characters

    OBJ_ATTR (object attributes)

    UINT32

    0x18 - length (in bytes) including the length field.

    VOID*

    0 - root directory (pointer)

    VOID*

    0 - object name (pointer)

    UINT32

    0 - attributes (undocumented)

    VOID*

    0 - security descriptior (pointer)

    UINT32

    0 - security quality of service

    POL_HND (LSA policy handle)

    char[20]

    policy handle

    DOM_SID2 (domain SID structure, SIDS stored in unicode)

    UINT32

    5 - SID type

    UINT32

    0 - undocumented

    UNIHDR2

    domain SID unicode string header

    UNISTR

    domain SID unicode string

    Note: there is a conflict between the unicode string header and the unicode string itself as to which to use to indicate string length. this will need to be resolved.

    Note: the SID type indicates, for example, an alias; a well-known group etc. this is documented somewhere.

    DOM_RID (domain RID structure)

    UINT32

    5 - well-known SID. 1 - user SID (see ShowACLs)

    UINT32

    5 - undocumented

    UINT32

    domain RID

    UINT32

    0 - domain index out of above reference domains

    LOG_INFO (server, account, client structure)

    Note: logon server name starts with two '\' characters and is upper case.

    Note: account name is the logon client name from the LSA Request Challenge, with a $ on the end of it, in upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    account name unicode string

    UINT16

    sec_chan - security channel type

    UNISTR2

    logon client machine unicode string

    CLNT_SRV (server, client names structure)

    Note: logon server name starts with two '\' characters and is upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon client machine unicode string

    CREDS (credentials + time stamp)

    char[8]

    credentials

    UTIME

    time stamp

    CLNT_INFO2 (server, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will beused in subsequent credential checks. the presumed intention is to - maintain an authenticated request/response trail.

    CLNT_SRV

    client and server names

    UINT8[]

    ???? padding, for 4-byte alignment with SMB header.

    VOID*

    pointer to client credentials.

    CREDS

    client-calculated credentials + client time

    CLNT_INFO (server, account, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will be used in subsequent credential checks. the presumed intention is to maintain an authenticated request/response trail.

    LOG_INFO

    logon account info

    CREDS

    client-calculated credentials + client time

    ID_INFO_1 (id info structure, auth level 1)

    VOID*

    ptr_id_info_1

    UNIHDR

    domain name unicode header

    UINT32

    param control

    UINT64

    logon ID

    UNIHDR

    user name unicode header

    UNIHDR

    workgroup name unicode header

    char[16]

    arc4 LM OWF Password

    char[16]

    arc4 NT OWF Password

    UNISTR2

    domain name unicode string

    UNISTR2

    user name unicode string

    UNISTR2

    workstation name unicode string

    SAM_INFO (sam logon/logoff id info structure)

    Note: presumably, the return credentials is supposedly for the server to verify that the credential chain hasn't been compromised.

    CLNT_INFO2

    client identification/authentication info

    VOID*

    pointer to return credentials.

    CRED

    return credentials - ignored.

    UINT16

    logon level

    UINT16

    switch value

    +

    Enumerations

    MSRPC Header type

    command number in the msrpc packet header

    MSRPC_Request:

    0x00

    MSRPC_Response:

    0x02

    MSRPC_Bind:

    0x0B

    MSRPC_BindAck:

    0x0C

    MSRPC Packet info

    The meaning of these flags is undocumented

    FirstFrag:

    0x01

    LastFrag:

    0x02

    NotaFrag:

    0x04

    RecRespond:

    0x08

    NoMultiplex:

    0x10

    NotForIdemp:

    0x20

    NotforBcast:

    0x40

    NoUuid:

    0x80

    Structures

    VOID *

    sizeof VOID* is 32 bits.

    char

    sizeof char is 8 bits.

    UTIME

    UTIME is 32 bits, indicating time in seconds since 01jan1970. documented in cifs6.txt (section 3.5 page, page 30).

    NTTIME

    NTTIME is 64 bits. documented in cifs6.txt (section 3.5 page, page 30).

    DOM_SID (domain SID structure)

    UINT32

    num of sub-authorities in domain SID

    UINT8

    SID revision number

    UINT8

    num of sub-authorities in domain SID

    UINT8[6]

    6 bytes for domain SID - Identifier Authority.

    UINT16[n_subauths]

    domain SID sub-authorities

    Note: the domain SID is documented elsewhere. +

    STR (string)

    STR (string) is a char[] : a null-terminated string of ascii characters.

    UNIHDR (unicode string header)

    UINT16

    length of unicode string

    UINT16

    max length of unicode string

    UINT32

    4 - undocumented.

    UNIHDR2 (unicode string header plus buffer pointer)

    UNIHDR

    unicode string header

    VOID*

    undocumented buffer pointer

    UNISTR (unicode string)

    UINT16[]

    null-terminated string of unicode characters.

    NAME (length-indicated unicode string)

    UINT32

    length of unicode string

    UINT16[]

    null-terminated string of unicode characters.

    UNISTR2 (aligned unicode string)

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    max length of unicode string

    UINT32

    0 - undocumented

    UINT32

    length of unicode string

    UINT16[]

    string of uncode characters

    OBJ_ATTR (object attributes)

    UINT32

    0x18 - length (in bytes) including the length field.

    VOID*

    0 - root directory (pointer)

    VOID*

    0 - object name (pointer)

    UINT32

    0 - attributes (undocumented)

    VOID*

    0 - security descriptior (pointer)

    UINT32

    0 - security quality of service

    POL_HND (LSA policy handle)

    char[20]

    policy handle

    DOM_SID2 (domain SID structure, SIDS stored in unicode)

    UINT32

    5 - SID type

    UINT32

    0 - undocumented

    UNIHDR2

    domain SID unicode string header

    UNISTR

    domain SID unicode string

    Note: there is a conflict between the unicode string header and the unicode string itself as to which to use to indicate string length. this will need to be resolved.

    Note: the SID type indicates, for example, an alias; a well-known group etc. this is documented somewhere.

    DOM_RID (domain RID structure)

    UINT32

    5 - well-known SID. 1 - user SID (see ShowACLs)

    UINT32

    5 - undocumented

    UINT32

    domain RID

    UINT32

    0 - domain index out of above reference domains

    LOG_INFO (server, account, client structure)

    Note: logon server name starts with two '\' characters and is upper case.

    Note: account name is the logon client name from the LSA Request Challenge, with a $ on the end of it, in upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    account name unicode string

    UINT16

    sec_chan - security channel type

    UNISTR2

    logon client machine unicode string

    CLNT_SRV (server, client names structure)

    Note: logon server name starts with two '\' characters and is upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon client machine unicode string

    CREDS (credentials + time stamp)

    char[8]

    credentials

    UTIME

    time stamp

    CLNT_INFO2 (server, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will beused in subsequent credential checks. the presumed intention is to + maintain an authenticated request/response trail.

    CLNT_SRV

    client and server names

    UINT8[]

    ???? padding, for 4-byte alignment with SMB header.

    VOID*

    pointer to client credentials.

    CREDS

    client-calculated credentials + client time

    CLNT_INFO (server, account, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will be used in subsequent credential checks. the presumed intention is to maintain an authenticated request/response trail.

    LOG_INFO

    logon account info

    CREDS

    client-calculated credentials + client time

    ID_INFO_1 (id info structure, auth level 1)

    VOID*

    ptr_id_info_1

    UNIHDR

    domain name unicode header

    UINT32

    param control

    UINT64

    logon ID

    UNIHDR

    user name unicode header

    UNIHDR

    workgroup name unicode header

    char[16]

    arc4 LM OWF Password

    char[16]

    arc4 NT OWF Password

    UNISTR2

    domain name unicode string

    UNISTR2

    user name unicode string

    UNISTR2

    workstation name unicode string

    SAM_INFO (sam logon/logoff id info structure)

    Note: presumably, the return credentials is supposedly for the server to verify that the credential chain hasn't been compromised.

    CLNT_INFO2

    client identification/authentication info

    VOID*

    pointer to return credentials.

    CRED

    return credentials - ignored.

    UINT16

    logon level

    UINT16

    switch value

             switch (switch_value)
             case 1:
             {
                 ID_INFO_1     id_info_1;
             }
    -

    GID (group id info)

    UINT32

    group id

    UINT32

    user attributes (only used by NT 3.1 and 3.51)

    DOM_REF (domain reference info)

    VOID*

    undocumented buffer pointer.

    UINT32

    num referenced domains?

    VOID*

    undocumented domain name buffer pointer.

    UINT32

    32 - max number of entries

    UINT32

    4 - num referenced domains?

    UNIHDR2

    domain name unicode string header

    UNIHDR2[num_ref_doms-1]

    referenced domain unicode string headers

    UNISTR

    domain name unicode string

    DOM_SID[num_ref_doms]

    referenced domain SIDs

    DOM_INFO (domain info, levels 3 and 5 are the same))

    UINT8[]

    ??? padding to get 4-byte alignment with start of SMB header

    UINT16

    domain name string length * 2

    UINT16

    domain name string length * 2

    VOID*

    undocumented domain name string buffer pointer

    VOID*

    undocumented domain SID string buffer pointer

    UNISTR2

    domain name (unicode string)

    DOM_SID

    domain SID

    USER_INFO (user logon info)

    Note: it would be nice to know what the 16 byte user session key is for.

    NTTIME

    logon time

    NTTIME

    logoff time

    NTTIME

    kickoff time

    NTTIME

    password last set time

    NTTIME

    password can change time

    NTTIME

    password must change time

    UNIHDR

    username unicode string header

    UNIHDR

    user's full name unicode string header

    UNIHDR

    logon script unicode string header

    UNIHDR

    profile path unicode string header

    UNIHDR

    home directory unicode string header

    UNIHDR

    home directory drive unicode string header

    UINT16

    logon count

    UINT16

    bad password count

    UINT32

    User ID

    UINT32

    Group ID

    UINT32

    num groups

    VOID*

    undocumented buffer pointer to groups.

    UINT32

    user flags

    char[16]

    user session key

    UNIHDR

    logon server unicode string header

    UNIHDR

    logon domain unicode string header

    VOID*

    undocumented logon domain id pointer

    char[40]

    40 undocumented padding bytes. future expansion?

    UINT32

    0 - num_other_sids?

    VOID*

    NULL - undocumented pointer to other domain SIDs.

    UNISTR2

    username unicode string

    UNISTR2

    user's full name unicode string

    UNISTR2

    logon script unicode string

    UNISTR2

    profile path unicode string

    UNISTR2

    home directory unicode string

    UNISTR2

    home directory drive unicode string

    UINT32

    num groups

    GID[num_groups]

    group info

    UNISTR2

    logon server unicode string

    UNISTR2

    logon domain unicode string

    DOM_SID

    domain SID

    DOM_SID[num_sids]

    other domain SIDs?

    SH_INFO_1_PTR (pointers to level 1 share info strings)

    Note: see cifsrap2.txt section5, page 10.

    0 for shi1_type indicates a Disk.
    1 for shi1_type indicates a Print Queue.
    2 for shi1_type indicates a Device.
    3 for shi1_type indicates an IPC pipe.
    0x8000 0000 (top bit set in shi1_type) indicates a hidden share.
    VOID*

    shi1_netname - pointer to net name

    UINT32

    shi1_type - type of share. 0 - undocumented.

    VOID*

    shi1_remark - pointer to comment.

    SH_INFO_1_STR (level 1 share info strings)

    UNISTR2

    shi1_netname - unicode string of net name

    UNISTR2

    shi1_remark - unicode string of comment.

    SHARE_INFO_1_CTR

    share container with 0 entries:

    UINT32

    0 - EntriesRead

    UINT32

    0 - Buffer

    share container with > 0 entries:

    UINT32

    EntriesRead

    UINT32

    non-zero - Buffer

    UINT32

    EntriesRead

    SH_INFO_1_PTR[EntriesRead]

    share entry pointers

    SH_INFO_1_STR[EntriesRead]

    share entry strings

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    UINT32

    EntriesRead

    UINT32

    0 - padding

    SERVER_INFO_101

    Note: see cifs6.txt section 6.4 - the fields described therein will be of assistance here. for example, the type listed below is the same as fServerType, which is described in 6.4.1.

    SV_TYPE_WORKSTATION

    0x00000001 All workstations

    SV_TYPE_SERVER

    0x00000002 All servers

    SV_TYPE_SQLSERVER

    0x00000004 Any server running with SQL server

    SV_TYPE_DOMAIN_CTRL

    0x00000008 Primary domain controller

    SV_TYPE_DOMAIN_BAKCTRL

    0x00000010 Backup domain controller

    SV_TYPE_TIME_SOURCE

    0x00000020 Server running the timesource service

    SV_TYPE_AFP

    0x00000040 Apple File Protocol servers

    SV_TYPE_NOVELL

    0x00000080 Novell servers

    SV_TYPE_DOMAIN_MEMBER

    0x00000100 Domain Member

    SV_TYPE_PRINTQ_SERVER

    0x00000200 Server sharing print queue

    SV_TYPE_DIALIN_SERVER

    0x00000400 Server running dialin service.

    SV_TYPE_XENIX_SERVER

    0x00000800 Xenix server

    SV_TYPE_NT

    0x00001000 NT server

    SV_TYPE_WFW

    0x00002000 Server running Windows for

    SV_TYPE_SERVER_NT

    0x00008000 Windows NT non DC server

    SV_TYPE_POTENTIAL_BROWSER

    0x00010000 Server that can run the browser service

    SV_TYPE_BACKUP_BROWSER

    0x00020000 Backup browser server

    SV_TYPE_MASTER_BROWSER

    0x00040000 Master browser server

    SV_TYPE_DOMAIN_MASTER

    0x00080000 Domain Master Browser server

    SV_TYPE_LOCAL_LIST_ONLY

    0x40000000 Enumerate only entries marked "local"

    SV_TYPE_DOMAIN_ENUM

    0x80000000 Enumerate Domains. The pszServer and pszDomain parameters must be NULL.

    UINT32

    500 - platform_id

    VOID*

    pointer to name

    UINT32

    5 - major version

    UINT32

    4 - minor version

    UINT32

    type (SV_TYPE_... bit field)

    VOID*

    pointer to comment

    UNISTR2

    sv101_name - unicode string of server name

    UNISTR2

    sv_101_comment - unicode string of server comment.

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    MSRPC over Transact Named Pipe

    For details on the SMB Transact Named Pipe, see cifs6.txt

    MSRPC Pipes

    +

    GID (group id info)

    UINT32

    group id

    UINT32

    user attributes (only used by NT 3.1 and 3.51)

    DOM_REF (domain reference info)

    VOID*

    undocumented buffer pointer.

    UINT32

    num referenced domains?

    VOID*

    undocumented domain name buffer pointer.

    UINT32

    32 - max number of entries

    UINT32

    4 - num referenced domains?

    UNIHDR2

    domain name unicode string header

    UNIHDR2[num_ref_doms-1]

    referenced domain unicode string headers

    UNISTR

    domain name unicode string

    DOM_SID[num_ref_doms]

    referenced domain SIDs

    DOM_INFO (domain info, levels 3 and 5 are the same))

    UINT8[]

    ??? padding to get 4-byte alignment with start of SMB header

    UINT16

    domain name string length * 2

    UINT16

    domain name string length * 2

    VOID*

    undocumented domain name string buffer pointer

    VOID*

    undocumented domain SID string buffer pointer

    UNISTR2

    domain name (unicode string)

    DOM_SID

    domain SID

    USER_INFO (user logon info)

    Note: it would be nice to know what the 16 byte user session key is for.

    NTTIME

    logon time

    NTTIME

    logoff time

    NTTIME

    kickoff time

    NTTIME

    password last set time

    NTTIME

    password can change time

    NTTIME

    password must change time

    UNIHDR

    username unicode string header

    UNIHDR

    user's full name unicode string header

    UNIHDR

    logon script unicode string header

    UNIHDR

    profile path unicode string header

    UNIHDR

    home directory unicode string header

    UNIHDR

    home directory drive unicode string header

    UINT16

    logon count

    UINT16

    bad password count

    UINT32

    User ID

    UINT32

    Group ID

    UINT32

    num groups

    VOID*

    undocumented buffer pointer to groups.

    UINT32

    user flags

    char[16]

    user session key

    UNIHDR

    logon server unicode string header

    UNIHDR

    logon domain unicode string header

    VOID*

    undocumented logon domain id pointer

    char[40]

    40 undocumented padding bytes. future expansion?

    UINT32

    0 - num_other_sids?

    VOID*

    NULL - undocumented pointer to other domain SIDs.

    UNISTR2

    username unicode string

    UNISTR2

    user's full name unicode string

    UNISTR2

    logon script unicode string

    UNISTR2

    profile path unicode string

    UNISTR2

    home directory unicode string

    UNISTR2

    home directory drive unicode string

    UINT32

    num groups

    GID[num_groups]

    group info

    UNISTR2

    logon server unicode string

    UNISTR2

    logon domain unicode string

    DOM_SID

    domain SID

    DOM_SID[num_sids]

    other domain SIDs?

    SH_INFO_1_PTR (pointers to level 1 share info strings)

    Note: see cifsrap2.txt section5, page 10.

    0 for shi1_type indicates a Disk.
    1 for shi1_type indicates a Print Queue.
    2 for shi1_type indicates a Device.
    3 for shi1_type indicates an IPC pipe.
    0x8000 0000 (top bit set in shi1_type) indicates a hidden share.
    VOID*

    shi1_netname - pointer to net name

    UINT32

    shi1_type - type of share. 0 - undocumented.

    VOID*

    shi1_remark - pointer to comment.

    SH_INFO_1_STR (level 1 share info strings)

    UNISTR2

    shi1_netname - unicode string of net name

    UNISTR2

    shi1_remark - unicode string of comment.

    SHARE_INFO_1_CTR

    share container with 0 entries:

    UINT32

    0 - EntriesRead

    UINT32

    0 - Buffer

    share container with > 0 entries:

    UINT32

    EntriesRead

    UINT32

    non-zero - Buffer

    UINT32

    EntriesRead

    SH_INFO_1_PTR[EntriesRead]

    share entry pointers

    SH_INFO_1_STR[EntriesRead]

    share entry strings

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    UINT32

    EntriesRead

    UINT32

    0 - padding

    SERVER_INFO_101

    Note: see cifs6.txt section 6.4 - the fields described therein will be of assistance here. for example, the type listed below is the same as fServerType, which is described in 6.4.1.

    SV_TYPE_WORKSTATION

    0x00000001 All workstations

    SV_TYPE_SERVER

    0x00000002 All servers

    SV_TYPE_SQLSERVER

    0x00000004 Any server running with SQL server

    SV_TYPE_DOMAIN_CTRL

    0x00000008 Primary domain controller

    SV_TYPE_DOMAIN_BAKCTRL

    0x00000010 Backup domain controller

    SV_TYPE_TIME_SOURCE

    0x00000020 Server running the timesource service

    SV_TYPE_AFP

    0x00000040 Apple File Protocol servers

    SV_TYPE_NOVELL

    0x00000080 Novell servers

    SV_TYPE_DOMAIN_MEMBER

    0x00000100 Domain Member

    SV_TYPE_PRINTQ_SERVER

    0x00000200 Server sharing print queue

    SV_TYPE_DIALIN_SERVER

    0x00000400 Server running dialin service.

    SV_TYPE_XENIX_SERVER

    0x00000800 Xenix server

    SV_TYPE_NT

    0x00001000 NT server

    SV_TYPE_WFW

    0x00002000 Server running Windows for

    SV_TYPE_SERVER_NT

    0x00008000 Windows NT non DC server

    SV_TYPE_POTENTIAL_BROWSER

    0x00010000 Server that can run the browser service

    SV_TYPE_BACKUP_BROWSER

    0x00020000 Backup browser server

    SV_TYPE_MASTER_BROWSER

    0x00040000 Master browser server

    SV_TYPE_DOMAIN_MASTER

    0x00080000 Domain Master Browser server

    SV_TYPE_LOCAL_LIST_ONLY

    0x40000000 Enumerate only entries marked "local"

    SV_TYPE_DOMAIN_ENUM

    0x80000000 Enumerate Domains. The pszServer and pszDomain parameters must be NULL.

    UINT32

    500 - platform_id

    VOID*

    pointer to name

    UINT32

    5 - major version

    UINT32

    4 - minor version

    UINT32

    type (SV_TYPE_... bit field)

    VOID*

    pointer to comment

    UNISTR2

    sv101_name - unicode string of server name

    UNISTR2

    sv_101_comment - unicode string of server comment.

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    MSRPC over Transact Named Pipe

    For details on the SMB Transact Named Pipe, see cifs6.txt

    MSRPC Pipes

    The MSRPC is conducted over an SMB Transact Pipe with a name of \PIPE\. You must first obtain a 16 bit file handle, by sending a SMBopenX with the pipe name \PIPE\srvsvc for @@ -121,11 +121,11 @@ initial SMBopenX request: RPC API command 0x26 params: "\\PIPE\\lsarpc" 0x65 0x63; 0x72 0x70; 0x44 0x65; "\\PIPE\\srvsvc" 0x73 0x76; 0x4E 0x00; 0x5C 0x43; -

    Header

    [section to be rewritten, following receipt of work by Duncan Stansfield]

    Interesting note: if you set packed data representation to 0x0100 0000 -then all 4-byte and 2-byte word ordering is turned around!

    The start of each of the NTLSA and NETLOGON named pipes begins with:

    offset: 00

    Variable type: UINT8

    Variable data: 5 - RPC major version

    offset: 01

    Variable type: UINT8

    Variable data: 0 - RPC minor version

    offset: 02

    Variable type: UINT8

    Variable data: 2 - RPC response packet

    offset: 03

    Variable type: UINT8

    Variable data: 3 - (FirstFrag bit-wise or with LastFrag)

    offset: 04

    Variable type: UINT32

    Variable data: 0x1000 0000 - packed data representation

    offset: 08

    Variable type: UINT16

    Variable data: fragment length - data size (bytes) inc header and tail.

    offset: 0A

    Variable type: UINT16

    Variable data: 0 - authentication length

    offset: 0C

    Variable type: UINT32

    Variable data: call identifier. matches 12th UINT32 of incoming RPC data.

    offset: 10

    Variable type: UINT32

    Variable data: allocation hint - data size (bytes) minus header and tail.

    offset: 14

    Variable type: UINT16

    Variable data: 0 - presentation context identifier

    offset: 16

    Variable type: UINT8

    Variable data: 0 - cancel count

    offset: 17

    Variable type: UINT8

    Variable data: in replies: 0 - reserved; in requests: opnum - see #defines.

    offset: 18

    Variable type: ......

    Variable data: start of data (goes on for allocation_hint bytes)

    RPC_Packet for request, response, bind and bind acknowledgement

    UINT8 versionmaj

    reply same as request (0x05)

    UINT8 versionmin

    reply same as request (0x00)

    UINT8 type

    one of the MSRPC_Type enums

    UINT8 flags

    reply same as request (0x00 for Bind, 0x03 for Request)

    UINT32 representation

    reply same as request (0x00000010)

    UINT16 fraglength

    the length of the data section of the SMB trans packet

    UINT16 authlength

    UINT32 callid

    call identifier. (e.g. 0x00149594)

    * stub USE TvPacket

    the remainder of the packet depending on the "type"

    Interface identification

    the interfaces are numbered. as yet I haven't seen more than one interface used on the same pipe name srvsvc

    +

    Header

    [section to be rewritten, following receipt of work by Duncan Stansfield]

    Interesting note: if you set packed data representation to 0x0100 0000 +then all 4-byte and 2-byte word ordering is turned around!

    The start of each of the NTLSA and NETLOGON named pipes begins with:

    offset: 00

    Variable type: UINT8

    Variable data: 5 - RPC major version

    offset: 01

    Variable type: UINT8

    Variable data: 0 - RPC minor version

    offset: 02

    Variable type: UINT8

    Variable data: 2 - RPC response packet

    offset: 03

    Variable type: UINT8

    Variable data: 3 - (FirstFrag bit-wise or with LastFrag)

    offset: 04

    Variable type: UINT32

    Variable data: 0x1000 0000 - packed data representation

    offset: 08

    Variable type: UINT16

    Variable data: fragment length - data size (bytes) inc header and tail.

    offset: 0A

    Variable type: UINT16

    Variable data: 0 - authentication length

    offset: 0C

    Variable type: UINT32

    Variable data: call identifier. matches 12th UINT32 of incoming RPC data.

    offset: 10

    Variable type: UINT32

    Variable data: allocation hint - data size (bytes) minus header and tail.

    offset: 14

    Variable type: UINT16

    Variable data: 0 - presentation context identifier

    offset: 16

    Variable type: UINT8

    Variable data: 0 - cancel count

    offset: 17

    Variable type: UINT8

    Variable data: in replies: 0 - reserved; in requests: opnum - see #defines.

    offset: 18

    Variable type: ......

    Variable data: start of data (goes on for allocation_hint bytes)

    RPC_Packet for request, response, bind and bind acknowledgement

    UINT8 versionmaj

    reply same as request (0x05)

    UINT8 versionmin

    reply same as request (0x00)

    UINT8 type

    one of the MSRPC_Type enums

    UINT8 flags

    reply same as request (0x00 for Bind, 0x03 for Request)

    UINT32 representation

    reply same as request (0x00000010)

    UINT16 fraglength

    the length of the data section of the SMB trans packet

    UINT16 authlength

    UINT32 callid

    call identifier. (e.g. 0x00149594)

    * stub USE TvPacket

    the remainder of the packet depending on the "type"

    Interface identification

    the interfaces are numbered. as yet I haven't seen more than one interface used on the same pipe name srvsvc

     abstract (0x4B324FC8, 0x01D31670, 0x475A7812, 0x88E16EBF, 0x00000003)
     transfer (0x8A885D04, 0x11C91CEB, 0x0008E89F, 0x6048102B, 0x00000002)
    -

    RPC_Iface RW

    UINT8 byte[16]

    16 bytes of number

    UINT32 version

    the interface number

    RPC_ReqBind RW

    the remainder of the packet after the header if "type" was Bind in the response header, "type" should be BindAck

    UINT16 maxtsize

    maximum transmission fragment size (0x1630)

    UINT16 maxrsize

    max receive fragment size (0x1630)

    UINT32 assocgid

    associated group id (0x0)

    UINT32 numelements

    the number of elements (0x1)

    UINT16 contextid

    presentation context identifier (0x0)

    UINT8 numsyntaxes

    the number of syntaxes (has always been 1?)(0x1)

    UINT8[]

    4-byte alignment padding, against SMB header

    * abstractint USE RPC_Iface

    num and vers. of interface client is using

    * transferint USE RPC_Iface

    num and vers. of interface to use for replies

    RPC_Address RW

    UINT16 length

    length of the string including null terminator

    * port USE string

    the string above in single byte, null terminated form

    RPC_ResBind RW

    the response to place after the header in the reply packet

    UINT16 maxtsize

    same as request

    UINT16 maxrsize

    same as request

    UINT32 assocgid

    zero

    * secondaddr USE RPC_Address

    the address string, as described earlier

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT8 numresults

    the number of results (0x01)

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT16 result

    result (0x00 = accept)

    UINT16 reason

    reason (0x00 = no reason specified)

    * transfersyntax USE RPC_Iface

    the transfer syntax from the request

    RPC_ReqNorm RW

    the remainder of the packet after the header for every other other request

    UINT32 allochint

    the size of the stub data in bytes

    UINT16 prescontext

    presentation context identifier (0x0)

    UINT16 opnum

    operation number (0x15)

    * stub USE TvPacket

    a packet dependent on the pipe name (probably the interface) and the op number)

    RPC_ResNorm RW

    UINT32 allochint

    # size of the stub data in bytes

    UINT16 prescontext

    # presentation context identifier (same as request)

    UINT8 cancelcount

    # cancel count? (0x0)

    UINT8 reserved

    # 0 - one byte padding

    * stub USE TvPacket

    # the remainder of the reply

    Tail

    The end of each of the NTLSA and NETLOGON named pipes ends with:

    ......

    end of data

    UINT32

    return code

    RPC Bind / Bind Ack

    +

    RPC_Iface RW

    UINT8 byte[16]

    16 bytes of number

    UINT32 version

    the interface number

    RPC_ReqBind RW

    the remainder of the packet after the header if "type" was Bind in the response header, "type" should be BindAck

    UINT16 maxtsize

    maximum transmission fragment size (0x1630)

    UINT16 maxrsize

    max receive fragment size (0x1630)

    UINT32 assocgid

    associated group id (0x0)

    UINT32 numelements

    the number of elements (0x1)

    UINT16 contextid

    presentation context identifier (0x0)

    UINT8 numsyntaxes

    the number of syntaxes (has always been 1?)(0x1)

    UINT8[]

    4-byte alignment padding, against SMB header

    * abstractint USE RPC_Iface

    num and vers. of interface client is using

    * transferint USE RPC_Iface

    num and vers. of interface to use for replies

    RPC_Address RW

    UINT16 length

    length of the string including null terminator

    * port USE string

    the string above in single byte, null terminated form

    RPC_ResBind RW

    the response to place after the header in the reply packet

    UINT16 maxtsize

    same as request

    UINT16 maxrsize

    same as request

    UINT32 assocgid

    zero

    * secondaddr USE RPC_Address

    the address string, as described earlier

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT8 numresults

    the number of results (0x01)

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT16 result

    result (0x00 = accept)

    UINT16 reason

    reason (0x00 = no reason specified)

    * transfersyntax USE RPC_Iface

    the transfer syntax from the request

    RPC_ReqNorm RW

    the remainder of the packet after the header for every other other request

    UINT32 allochint

    the size of the stub data in bytes

    UINT16 prescontext

    presentation context identifier (0x0)

    UINT16 opnum

    operation number (0x15)

    * stub USE TvPacket

    a packet dependent on the pipe name (probably the interface) and the op number)

    RPC_ResNorm RW

    UINT32 allochint

    # size of the stub data in bytes

    UINT16 prescontext

    # presentation context identifier (same as request)

    UINT8 cancelcount

    # cancel count? (0x0)

    UINT8 reserved

    # 0 - one byte padding

    * stub USE TvPacket

    # the remainder of the reply

    Tail

    The end of each of the NTLSA and NETLOGON named pipes ends with:

    ......

    end of data

    UINT32

    return code

    RPC Bind / Bind Ack

    RPC Binds are the process of associating an RPC pipe (e.g \PIPE\lsarpc) with a "transfer syntax" (see RPC_Iface structure). The purpose for doing this is unknown. @@ -133,7 +133,7 @@ returned by the SMBopenX Transact response.

    Note: The RPC_ResBind members maxtsize, maxrsize and assocgid are the same in the response as the same members in the RPC_ReqBind. The RPC_ResBind member transfersyntax is the same in the response as the

    Note: The RPC_ResBind response member secondaddr contains the name of what is presumed to be the service behind the RPC pipe. The - mapping identified so far is:

    initial SMBopenX request:

    RPC_ResBind response:

    "\\PIPE\\srvsvc"

    "\\PIPE\\ntsvcs"

    "\\PIPE\\samr"

    "\\PIPE\\lsass"

    "\\PIPE\\lsarpc"

    "\\PIPE\\lsass"

    "\\PIPE\\wkssvc"

    "\\PIPE\\wksvcs"

    "\\PIPE\\NETLOGON"

    "\\PIPE\\NETLOGON"

    Note: The RPC_Packet fraglength member in both the Bind Request and Bind Acknowledgment must contain the length of the entire RPC data, including the RPC_Packet header.

    Request:

    RPC_Packet
    RPC_ReqBind

    Response:

    RPC_Packet
    RPC_ResBind

    NTLSA Transact Named Pipe

    The sequence of actions taken on this pipe are:

    Establish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    Open an RPC Pipe with the name "\\PIPE\\lsarpc". Store the file handle.
    Using the file handle, send a Set Named Pipe Handle state to 0x4300.
    Send an LSA Open Policy request. Store the Policy Handle.
    Using the Policy Handle, send LSA Query Info Policy requests, etc.
    Using the Policy Handle, send an LSA Close.
    Close the IPC$ share.

    Defines for this pipe, identifying the query are:

    LSA Open Policy:

    0x2c

    LSA Query Info Policy:

    0x07

    LSA Enumerate Trusted Domains:

    0x0d

    LSA Open Secret:

    0xff

    LSA Lookup SIDs:

    0xfe

    LSA Lookup Names:

    0xfd

    LSA Close:

    0x00

    LSA Open Policy

    Note: The policy handle can be anything you like.

    Request

    VOID*

    buffer pointer

    UNISTR2

    server name - unicode string starting with two '\'s

    OBJ_ATTR

    object attributes

    UINT32

    1 - desired access

    Response

    POL_HND

    LSA policy handle

    return

    0 - indicates success

    LSA Query Info Policy

    Note: The info class in response must be the same as that in the request.

    Request

    POL_HND

    LSA policy handle

    UINT16

    info class (also a policy handle?)

    Response

    VOID*

    undocumented buffer pointer

    UINT16

    info class (same as info class in request).

    +	mapping identified so far is:

    initial SMBopenX request:

    RPC_ResBind response:

    "\\PIPE\\srvsvc"

    "\\PIPE\\ntsvcs"

    "\\PIPE\\samr"

    "\\PIPE\\lsass"

    "\\PIPE\\lsarpc"

    "\\PIPE\\lsass"

    "\\PIPE\\wkssvc"

    "\\PIPE\\wksvcs"

    "\\PIPE\\NETLOGON"

    "\\PIPE\\NETLOGON"

    Note: The RPC_Packet fraglength member in both the Bind Request and Bind Acknowledgment must contain the length of the entire RPC data, including the RPC_Packet header.

    Request:

    RPC_Packet
    RPC_ReqBind

    Response:

    RPC_Packet
    RPC_ResBind

    NTLSA Transact Named Pipe

    The sequence of actions taken on this pipe are:

    Establish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    Open an RPC Pipe with the name "\\PIPE\\lsarpc". Store the file handle.
    Using the file handle, send a Set Named Pipe Handle state to 0x4300.
    Send an LSA Open Policy request. Store the Policy Handle.
    Using the Policy Handle, send LSA Query Info Policy requests, etc.
    Using the Policy Handle, send an LSA Close.
    Close the IPC$ share.

    Defines for this pipe, identifying the query are:

    LSA Open Policy:

    0x2c

    LSA Query Info Policy:

    0x07

    LSA Enumerate Trusted Domains:

    0x0d

    LSA Open Secret:

    0xff

    LSA Lookup SIDs:

    0xfe

    LSA Lookup Names:

    0xfd

    LSA Close:

    0x00

    LSA Open Policy

    Note: The policy handle can be anything you like.

    Request

    VOID*

    buffer pointer

    UNISTR2

    server name - unicode string starting with two '\'s

    OBJ_ATTR

    object attributes

    UINT32

    1 - desired access

    Response

    POL_HND

    LSA policy handle

    return

    0 - indicates success

    LSA Query Info Policy

    Note: The info class in response must be the same as that in the request.

    Request

    POL_HND

    LSA policy handle

    UINT16

    info class (also a policy handle?)

    Response

    VOID*

    undocumented buffer pointer

    UINT16

    info class (same as info class in request).

     switch (info class)
     case 3:
     case 5:
    @@ -142,11 +142,11 @@
     }
     
     return    0 - indicates success
    -

    LSA Enumerate Trusted Domains

    Request

    no extra data

    Response

    UINT32

    0 - enumeration context

    UINT32

    0 - entries read

    UINT32

    0 - trust information

    return

    0x8000 001a - "no trusted domains" success code

    LSA Open Secret

    Request

    no extra data

    Response

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    return 0x0C00 0034 - "no such secret" success code

    LSA Close

    Request

    POL_HND

    policy handle to be closed

    Response

    POL_HND

    0s - closed policy handle (all zeros)

    return 0 - indicates success

    LSA Lookup SIDS

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    VOID*[num_entries] undocumented domain SID pointers to be looked up. -

    DOM_SID[num_entries] domain SIDs to be looked up.

    char[16]

    completely undocumented 16 bytes.

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_SID2[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    LSA Lookup Names

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    NAME[num_entries]

    names to be looked up.

    char[]

    undocumented bytes - falsely translated SID structure?

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_RID[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    NETLOGON rpc Transact Named Pipe

    The sequence of actions taken on this pipe are:

    tablish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    en an RPC Pipe with the name "\\PIPE\\NETLOGON". Store the file handle.
    ing the file handle, send a Set Named Pipe Handle state to 0x4300.
    eate Client Challenge. Send LSA Request Challenge. Store Server Challenge.
    lculate Session Key. Send an LSA Auth 2 Challenge. Store Auth2 Challenge.
    lc/Verify Client Creds. Send LSA Srv PW Set. Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logon . Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logoff. Calc/Verify Server Creds.
    ose the IPC$ share.

    Defines for this pipe, identifying the query are

    LSA Request Challenge:

    0x04

    LSA Server Password Set:

    0x06

    LSA SAM Logon:

    0x02

    LSA SAM Logoff:

    0x03

    LSA Auth 2:

    0x0f

    LSA Logon Control:

    0x0e

    LSA Request Challenge

    Note: logon server name starts with two '\' characters and is upper case.

    Note: logon client is the machine, not the user.

    Note: the initial LanManager password hash, against which the challenge is issued, is the machine name itself (lower case). there will becalls issued (LSA Server Password Set) which will change this, later. refusing these calls allows you to always deal with the same password (i.e the LM# of the machine name in lower case).

    Request

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    logon client unicode string

    char[8]

    client challenge

    Response

    char[8]

    server challenge

    return 0 - indicates success

    LSA Authenticate 2

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: neg_flags in the response is the same as that in the request.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    LOG_INFO

    client identification info

    char[8]

    client-calculated credentials

    UINT8[]

    padding to 4-byte align with start of SMB header.

    UINT32

    neg_flags - negotiated flags (usual value is 0x0000 01ff)

    Response

    char[8]

    server credentials.

    UINT32

    neg_flags - same as neg_flags in request.

    return 0 - indicates success. failure value unknown.

    LSA Server Password Set

    Note: the new password is suspected to be a DES encryption using the old password to generate the key.

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: the server credentials are constructed from the client-calculated credentials and the client time + 1 second.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    CLNT_INFO

    client identification/authentication info

    char[]

    new password - undocumented.

    Response

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success; 0xC000 006a indicates failure

    LSA SAM Logon

    +

    LSA Enumerate Trusted Domains

    Request

    no extra data

    Response

    UINT32

    0 - enumeration context

    UINT32

    0 - entries read

    UINT32

    0 - trust information

    return

    0x8000 001a - "no trusted domains" success code

    LSA Open Secret

    Request

    no extra data

    Response

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    return 0x0C00 0034 - "no such secret" success code

    LSA Close

    Request

    POL_HND

    policy handle to be closed

    Response

    POL_HND

    0s - closed policy handle (all zeros)

    return 0 - indicates success

    LSA Lookup SIDS

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    VOID*[num_entries] undocumented domain SID pointers to be looked up. +

    DOM_SID[num_entries] domain SIDs to be looked up.

    char[16]

    completely undocumented 16 bytes.

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_SID2[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    LSA Lookup Names

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    NAME[num_entries]

    names to be looked up.

    char[]

    undocumented bytes - falsely translated SID structure?

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_RID[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    NETLOGON rpc Transact Named Pipe

    The sequence of actions taken on this pipe are:

    tablish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    en an RPC Pipe with the name "\\PIPE\\NETLOGON". Store the file handle.
    ing the file handle, send a Set Named Pipe Handle state to 0x4300.
    eate Client Challenge. Send LSA Request Challenge. Store Server Challenge.
    lculate Session Key. Send an LSA Auth 2 Challenge. Store Auth2 Challenge.
    lc/Verify Client Creds. Send LSA Srv PW Set. Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logon . Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logoff. Calc/Verify Server Creds.
    ose the IPC$ share.

    Defines for this pipe, identifying the query are

    LSA Request Challenge:

    0x04

    LSA Server Password Set:

    0x06

    LSA SAM Logon:

    0x02

    LSA SAM Logoff:

    0x03

    LSA Auth 2:

    0x0f

    LSA Logon Control:

    0x0e

    LSA Request Challenge

    Note: logon server name starts with two '\' characters and is upper case.

    Note: logon client is the machine, not the user.

    Note: the initial LanManager password hash, against which the challenge is issued, is the machine name itself (lower case). there will becalls issued (LSA Server Password Set) which will change this, later. refusing these calls allows you to always deal with the same password (i.e the LM# of the machine name in lower case).

    Request

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    logon client unicode string

    char[8]

    client challenge

    Response

    char[8]

    server challenge

    return 0 - indicates success

    LSA Authenticate 2

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: neg_flags in the response is the same as that in the request.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    LOG_INFO

    client identification info

    char[8]

    client-calculated credentials

    UINT8[]

    padding to 4-byte align with start of SMB header.

    UINT32

    neg_flags - negotiated flags (usual value is 0x0000 01ff)

    Response

    char[8]

    server credentials.

    UINT32

    neg_flags - same as neg_flags in request.

    return 0 - indicates success. failure value unknown.

    LSA Server Password Set

    Note: the new password is suspected to be a DES encryption using the old password to generate the key.

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: the server credentials are constructed from the client-calculated credentials and the client time + 1 second.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    CLNT_INFO

    client identification/authentication info

    char[]

    new password - undocumented.

    Response

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success; 0xC000 006a indicates failure

    LSA SAM Logon

    Note: valid_user is True iff the username and password hash are valid for the requested domain. -

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    +

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

     if (valid_user)
     {
     	UINT16      3 - switch value indicating USER_INFO structure.
    @@ -166,16 +166,16 @@
     
         return    0xC000 0064 - NT_STATUS_NO_SUCH_USER.
     }
    -

    LSA SAM Logoff

    +

    LSA SAM Logoff

    Note: presumably, the SAM_INFO structure is validated, and a (currently undocumented) error code returned if the Logoff is invalid. -

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success. undocumented failure indication.

    \\MAILSLOT\NET\NTLOGON

    +

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success. undocumented failure indication.

    \\MAILSLOT\NET\NTLOGON

    Note: mailslots will contain a response mailslot, to which the response should be sent. the target NetBIOS name is REQUEST_NAME<20>, where REQUEST_NAME is the name of the machine that sent the request. -

    Query for PDC

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Request

    UINT16

    0x0007 - Query for PDC

    STR

    machine name

    STR

    response mailslot

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x000A - Respose to Query for PDC

    STR

    machine name (in uppercase)

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UNISTR

    domain name

    UINT32

    NTversion (same as received in request)

    UINT16

    LMNTtoken (same as received in request)

    UINT16

    LM20token (same as received in request)

    SAM Logon

    Note: machine name in response is preceded by two '\' characters.

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Note: user name in the response is presumably the same as that in the request.

    Request

    UINT16

    0x0012 - SAM Logon

    UINT16

    request count

    UNISTR

    machine name

    UNISTR

    user name

    STR

    response mailslot

    UINT32

    alloweable account

    UINT32

    domain SID size

    char[sid_size]

    domain SID, of sid_size bytes.

    UINT8[]

    ???? padding to 4? 2? -byte align with start of mailslot.

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x0013 - Response to SAM Logon

    UNISTR

    machine name

    UNISTR

    user name - workstation trust account

    UNISTR

    domain name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    SRVSVC Transact Named Pipe

    Defines for this pipe, identifying the query are:

    Net Share Enum

    0x0f

    Net Server Get Info

    0x15

    Net Share Enum

    Note: share level and switch value in the response are presumably the same as those in the request.

    Note: cifsrap2.txt (section 5) may be of limited assistance here.

    Request

    VOID*

    pointer (to server name?)

    UNISTR2

    server name

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info with 0 entries

    UINT32

    preferred maximum length (0xffff ffff)

    Response

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info (only added if share info ptr is non-zero)

    return 0 - indicates success

    Net Server Get Info

    Note: level is the same value as in the request.

    Request

    UNISTR2

    server name

    UINT32

    switch level

    Response

    UINT32

    switch level

    VOID*

    pointer to SERVER_INFO_101

    SERVER_INFO_101

    server info (only added if server info ptr is non-zero)

    return 0 - indicates success

    Cryptographic side of NT Domain Authentication

    Definitions

    Add(A1,A2)

    Intel byte ordered addition of corresponding 4 byte words in arrays A1 and A2

    E(K,D)

    DES ECB encryption of 8 byte data D using 7 byte key K

    lmowf()

    Lan man hash

    ntowf()

    NT hash

    PW

    md4(machine_password) == md4(lsadump $machine.acc) == +

    Query for PDC

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Request

    UINT16

    0x0007 - Query for PDC

    STR

    machine name

    STR

    response mailslot

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x000A - Respose to Query for PDC

    STR

    machine name (in uppercase)

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UNISTR

    domain name

    UINT32

    NTversion (same as received in request)

    UINT16

    LMNTtoken (same as received in request)

    UINT16

    LM20token (same as received in request)

    SAM Logon

    Note: machine name in response is preceded by two '\' characters.

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Note: user name in the response is presumably the same as that in the request.

    Request

    UINT16

    0x0012 - SAM Logon

    UINT16

    request count

    UNISTR

    machine name

    UNISTR

    user name

    STR

    response mailslot

    UINT32

    alloweable account

    UINT32

    domain SID size

    char[sid_size]

    domain SID, of sid_size bytes.

    UINT8[]

    ???? padding to 4? 2? -byte align with start of mailslot.

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x0013 - Response to SAM Logon

    UNISTR

    machine name

    UNISTR

    user name - workstation trust account

    UNISTR

    domain name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    SRVSVC Transact Named Pipe

    Defines for this pipe, identifying the query are:

    Net Share Enum

    0x0f

    Net Server Get Info

    0x15

    Net Share Enum

    Note: share level and switch value in the response are presumably the same as those in the request.

    Note: cifsrap2.txt (section 5) may be of limited assistance here.

    Request

    VOID*

    pointer (to server name?)

    UNISTR2

    server name

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info with 0 entries

    UINT32

    preferred maximum length (0xffff ffff)

    Response

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info (only added if share info ptr is non-zero)

    return 0 - indicates success

    Net Server Get Info

    Note: level is the same value as in the request.

    Request

    UNISTR2

    server name

    UINT32

    switch level

    Response

    UINT32

    switch level

    VOID*

    pointer to SERVER_INFO_101

    SERVER_INFO_101

    server info (only added if server info ptr is non-zero)

    return 0 - indicates success

    Cryptographic side of NT Domain Authentication

    Definitions

    Add(A1,A2)

    Intel byte ordered addition of corresponding 4 byte words in arrays A1 and A2

    E(K,D)

    DES ECB encryption of 8 byte data D using 7 byte key K

    lmowf()

    Lan man hash

    ntowf()

    NT hash

    PW

    md4(machine_password) == md4(lsadump $machine.acc) == pwdump(machine$) (initially) == md4(lmowf(unicode(machine))) -

    ARC4(K,Lk,D,Ld)

    ARC4 encryption of data D of length Ld with key K of length Lk

    v[m..n(,l)]

    subset of v from bytes m to n, optionally padded with zeroes to length l

    Cred(K,D)

    E(K[7..7,7],E(K[0..6],D)) computes a credential

    Time()

    4 byte current time

    Cc,Cs

    8 byte client and server challenges Rc,Rs: 8 byte client and server credentials

    Protocol

    +

    ARC4(K,Lk,D,Ld)

    ARC4 encryption of data D of length Ld with key K of length Lk

    v[m..n(,l)]

    subset of v from bytes m to n, optionally padded with zeroes to length l

    Cred(K,D)

    E(K[7..7,7],E(K[0..6],D)) computes a credential

    Time()

    4 byte current time

    Cc,Cs

    8 byte client and server challenges Rc,Rs: 8 byte client and server credentials

    Protocol

     C->S ReqChal,Cc
     S->C Cs
     
    @@ -211,7 +211,7 @@
     S->C Cred(Ks,Cred(Ks,Rc+Tc+1)),userinfo(logon script,UID,SIDs,etc)
     C: assert(Rs == Cred(Ks,Cred(Rc+Tc+1))
     C: Rc = Cred(Ks,Rc+Tc+1)
    -

    Comments

    +

    Comments

    On first joining the domain the session key could be computed by anyone listening in on the network as the machine password has a well known value. Until the machine is rebooted it will use this session @@ -232,15 +232,15 @@ The password OWFs should NOT be sent over the network reversibly encrypted. They should be sent using ARC4(Ks,md4(owf)) with the server computing the same function using the owf values in the SAM. -

    SIDs and RIDs

    +

    SIDs and RIDs

    SIDs and RIDs are well documented elsewhere.

    A SID is an NT Security ID (see DOM_SID structure). They are of the form:

    revision-NN-SubAuth1-SubAuth2-SubAuth3...
    revision-0xNNNNNNNNNNNN-SubAuth1-SubAuth2-SubAuth3...

    currently, the SID revision is 1. The Sub-Authorities are known as Relative IDs (RIDs). -

    Well-known SIDs

    Universal well-known SIDs

    Null SID

    S-1-0-0

    World

    S-1-1-0

    Local

    S-1-2-0

    Creator Owner ID

    S-1-3-0

    Creator Group ID

    S-1-3-1

    Creator Owner Server ID

    S-1-3-2

    Creator Group Server ID

    S-1-3-3

    (Non-unique IDs)

    S-1-4

    NT well-known SIDs

    NT Authority

    S-1-5

    Dialup

    S-1-5-1

    Network

    S-1-5-2

    Batch

    S-1-5-3

    Interactive

    S-1-5-4

    Service

    S-1-5-6

    AnonymousLogon(aka null logon session)

    S-1-5-7

    Proxy

    S-1-5-8

    ServerLogon(aka domain controller account)

    S-1-5-8

    (Logon IDs)

    S-1-5-5-X-Y

    (NT non-unique IDs)

    S-1-5-0x15-...

    (Built-in domain)

    s-1-5-0x20

    Well-known RIDS

    +

    Well-known SIDs

    Universal well-known SIDs

    Null SID

    S-1-0-0

    World

    S-1-1-0

    Local

    S-1-2-0

    Creator Owner ID

    S-1-3-0

    Creator Group ID

    S-1-3-1

    Creator Owner Server ID

    S-1-3-2

    Creator Group Server ID

    S-1-3-3

    (Non-unique IDs)

    S-1-4

    NT well-known SIDs

    NT Authority

    S-1-5

    Dialup

    S-1-5-1

    Network

    S-1-5-2

    Batch

    S-1-5-3

    Interactive

    S-1-5-4

    Service

    S-1-5-6

    AnonymousLogon(aka null logon session)

    S-1-5-7

    Proxy

    S-1-5-8

    ServerLogon(aka domain controller account)

    S-1-5-8

    (Logon IDs)

    S-1-5-5-X-Y

    (NT non-unique IDs)

    S-1-5-0x15-...

    (Built-in domain)

    s-1-5-0x20

    Well-known RIDS

    A RID is a sub-authority value, as part of either a SID, or in the case of Group RIDs, part of the DOM_GID structure, in the USER_INFO_1 structure, in the LSA SAM Logon response. -

    Well-known RID users

    Groupname: DOMAIN_USER_RID_ADMIN

    ????: 0x0000

    RID: 01F4

    Groupname: DOMAIN_USER_RID_GUEST

    ????: 0x0000

    RID: 01F5

    Well-known RID groups

    Groupname: DOMAIN_GROUP_RID_ADMINS

    ????: 0x0000

    RID: 0200

    Groupname: DOMAIN_GROUP_RID_USERS

    ????: 0x0000

    RID: 0201

    Groupname: DOMAIN_GROUP_RID_GUESTS

    ????: 0x0000

    RID: 0202

    Well-known RID aliases

    Groupname: DOMAIN_ALIAS_RID_ADMINS

    ????: 0x0000

    RID: 0220

    Groupname: DOMAIN_ALIAS_RID_USERS

    ????: 0x0000

    RID: 0221

    Groupname: DOMAIN_ALIAS_RID_GUESTS

    ????: 0x0000

    RID: 0222

    Groupname: DOMAIN_ALIAS_RID_POWER_USERS

    ????: 0x0000

    RID: 0223

    Groupname: DOMAIN_ALIAS_RID_ACCOUNT_OPS

    ????: 0x0000

    RID: 0224

    Groupname: DOMAIN_ALIAS_RID_SYSTEM_OPS

    ????: 0x0000

    RID: 0225

    Groupname: DOMAIN_ALIAS_RID_PRINT_OPS

    ????: 0x0000

    RID: 0226

    Groupname: DOMAIN_ALIAS_RID_BACKUP_OPS

    ????: 0x0000

    RID: 0227

    Groupname: DOMAIN_ALIAS_RID_REPLICATOR

    ????: 0x0000

    RID: 0228

    +

    Well-known RID users

    Groupname: DOMAIN_USER_RID_ADMIN

    ????: 0x0000

    RID: 01F4

    Groupname: DOMAIN_USER_RID_GUEST

    ????: 0x0000

    RID: 01F5

    Well-known RID groups

    Groupname: DOMAIN_GROUP_RID_ADMINS

    ????: 0x0000

    RID: 0200

    Groupname: DOMAIN_GROUP_RID_USERS

    ????: 0x0000

    RID: 0201

    Groupname: DOMAIN_GROUP_RID_GUESTS

    ????: 0x0000

    RID: 0202

    Well-known RID aliases

    Groupname: DOMAIN_ALIAS_RID_ADMINS

    ????: 0x0000

    RID: 0220

    Groupname: DOMAIN_ALIAS_RID_USERS

    ????: 0x0000

    RID: 0221

    Groupname: DOMAIN_ALIAS_RID_GUESTS

    ????: 0x0000

    RID: 0222

    Groupname: DOMAIN_ALIAS_RID_POWER_USERS

    ????: 0x0000

    RID: 0223

    Groupname: DOMAIN_ALIAS_RID_ACCOUNT_OPS

    ????: 0x0000

    RID: 0224

    Groupname: DOMAIN_ALIAS_RID_SYSTEM_OPS

    ????: 0x0000

    RID: 0225

    Groupname: DOMAIN_ALIAS_RID_PRINT_OPS

    ????: 0x0000

    RID: 0226

    Groupname: DOMAIN_ALIAS_RID_BACKUP_OPS

    ????: 0x0000

    RID: 0227

    Groupname: DOMAIN_ALIAS_RID_REPLICATOR

    ????: 0x0000

    RID: 0228

    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/parsing.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/parsing.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/parsing.html 2004-11-15 10:15:08.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/parsing.html 2004-12-15 10:23:24.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 13. The smb.conf file

    Chapter 13. The smb.conf file

    Chris Hertel

    November 1997

    Table of Contents

    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c

    Lexical Analysis

    +Chapter 13. The smb.conf file

    Chapter 13. The smb.conf file

    Chris Hertel

    November 1997

    Lexical Analysis

    Basically, the file is processed on a line by line basis. There are four types of lines that are recognized by the lexical analyzer (params.c): @@ -25,7 +25,7 @@ These are the only tokens passed to the parameter loader (loadparm.c). Parameter names and values are divided from one another by an equal sign: '='. -

    Handling of Whitespace

    +

    Handling of Whitespace

    Whitespace is defined as all characters recognized by the isspace() function (see ctype(3C)) except for the newline character ('\n') The newline is excluded because it identifies the end of the line. @@ -40,7 +40,7 @@ are removed.

  • Leading and trailing whitespace is removed from names and values. -

  • Handling of Line Continuation

    +

    Handling of Line Continuation

    Long section header and parameter lines may be extended across multiple lines by use of the backslash character ('\\'). Line continuation is ignored for blank and comment lines. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/printing.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/printing.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/printing.html 2004-11-15 10:15:09.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/printing.html 2004-12-15 10:23:25.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 18. Samba Printing Internals

    Chapter 18. Samba Printing Internals

    Gerald Carter

    October 2002

    Abstract

    The purpose of this document is to provide some insight into Samba's printing functionality and also to describe the semantics of certain features of Windows client printing. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/pt01.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/pt01.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/pt01.html 2004-11-15 10:15:06.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/pt01.html 2004-12-15 10:23:22.000000000 -0600 @@ -1 +1 @@ -Part I. The protocol

    +Part I. The protocol diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/pt02.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/pt02.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/pt02.html 2004-11-15 10:15:07.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/pt02.html 2004-12-15 10:23:23.000000000 -0600 @@ -1 +1 @@ -Part II. Samba Basics +Part II. Samba Basics diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/pt03.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/pt03.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/pt03.html 2004-11-15 10:15:09.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/pt03.html 2004-12-15 10:23:24.000000000 -0600 @@ -1 +1 @@ -Part III. Samba Subsystems +Part III. Samba Subsystems diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/pt04.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/pt04.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/pt04.html 2004-11-15 10:15:09.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/pt04.html 2004-12-15 10:23:25.000000000 -0600 @@ -1,4 +1,4 @@ -Part IV. Debugging and tracing

    Introduction

    With the development of LanManager and Windows NT compatible password encryption for Samba, it is now able to validate user connections in exactly the same way as a LanManager or Windows NT server.

    This document describes how the SMB password encryption algorithm works and what issues there are in choosing whether you want to use it. You should read it carefully, especially - the part about security and the "PROS and CONS" section.

    How does it work?

    LanManager encryption is somewhat similar to UNIX + the part about security and the "PROS and CONS" section.

    How does it work?

    LanManager encryption is somewhat similar to UNIX password encryption. The server uses a file containing a hashed value of a user's password. This is created by taking the user's plaintext password, capitalising it, and either diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/unix-smb.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/unix-smb.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/unix-smb.html 2004-11-15 10:15:02.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/unix-smb.html 2004-12-15 10:23:20.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 2. NetBIOS in a Unix World

    Chapter 2. NetBIOS in a Unix World

    Andrew Tridgell

    April 1995

    Introduction

    +Chapter 2. NetBIOS in a Unix World

    Chapter 2. NetBIOS in a Unix World

    Andrew Tridgell

    April 1995

    Introduction

    This is a short document that describes some of the issues that confront a SMB implementation on unix, and how Samba copes with them. They may help people who are looking at unix<->PC @@ -6,7 +6,7 @@

    It was written to help out a person who was writing a paper on unix to PC connectivity. -

    Usernames

    +

    Usernames

    The SMB protocol has only a loose username concept. Early SMB protocols (such as CORE and COREPLUS) have no username concept at all. Even in later protocols clients often attempt operations @@ -43,7 +43,7 @@ service%user syntax, the saving of session setup usernames for later validation and the derivation of the username from the service name (either directly or via the user= option). -

    File Ownership

    +

    File Ownership

    The commonly used SMB protocols have no way of saying "you can't do that because you don't own the file". They have, in fact, no concept of file ownership at all. @@ -61,7 +61,7 @@ There are several possible solutions to this problem, including username mapping, and forcing a specific username for particular shares. -

    Passwords

    +

    Passwords

    Many SMB clients uppercase passwords before sending them. I have no idea why they do this. Interestingly WfWg uppercases the password only if the server is running a protocol greater than COREPLUS, so @@ -83,7 +83,7 @@ smbpasswd file containing these password hashes is only readable by the root user. See the documentation ENCRYPTION.txt for more details. -

    Locking

    +

    Locking

    Since samba 2.2, samba supports other types of locking as well. This section is outdated.

    @@ -114,7 +114,7 @@ the same file, at which time the client will say if it is willing to give up its lock. Unix has no simple way of implementing opportunistic locking, and currently Samba has no support for it. -

    Deny Modes

    +

    Deny Modes

    When a SMB client opens a file it asks for a particular "deny mode" to be placed on the file. These modes (DENY_NONE, DENY_READ, DENY_WRITE, DENY_ALL, DENY_FCB and DENY_DOS) specify what actions should be @@ -128,7 +128,7 @@ is clumsy and consumes processing and file resources, the shared memory implementation is vastly prefered and is turned on by default for those systems that support it. -

    Trapdoor UIDs

    +

    Trapdoor UIDs

    A SMB session can run with several uids on the one socket. This happens when a user connects to two shares with different usernames. To cope with this the unix server needs to switch uids @@ -138,7 +138,7 @@

    Note that you can also get the "trapdoor uid" message for other reasons. Please see the FAQ for details. -

    Port numbers

    +

    Port numbers

    There is a convention that clients on sockets use high "unprivilaged" port numbers (>1000) and connect to servers on low "privilaged" port numbers. This is enforced in Unix as non-root users can't open a @@ -161,7 +161,7 @@ back, but it goes to port 137 which the unix user can't listen on. Interestingly WinNT3.1 got this right - it sends node status responses back to the source port in the request. -

    Protocol Complexity

    +

    Protocol Complexity

    There are many "protocol levels" in the SMB protocol. It seems that each time new functionality was added to a Microsoft operating system, they added the equivalent functions in a new protocol level of the SMB diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/vfs.html samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/vfs.html --- samba-3.0.9/docs/htmldocs/Samba-Developers-Guide/vfs.html 2004-11-15 10:15:08.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Developers-Guide/vfs.html 2004-12-15 10:23:23.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 11. VFS Modules

    Chapter 11. VFS Modules

    Alexander Bokovoy

    Stefan Metzmacher

    27 May 2003

    The Samba (Posix) VFS layer

    The general interface

    +Chapter 11. VFS Modules

    Chapter 11. VFS Modules

    Alexander Bokovoy

    Stefan Metzmacher

    27 May 2003

    The Samba (Posix) VFS layer

    The general interface

    Each VFS operation has a vfs_op_type, a function pointer and a handle pointer in the struct vfs_ops and tree macros to make it easier to call the operations. (Take a look at include/vfs.h and include/vfs_macros.h.) @@ -94,7 +94,7 @@ (tofd), (fsp), (fromfd), (header), (offset), (count))) ... -

    Possible VFS operation layers

    +

    Possible VFS operation layers

    These values are used by the VFS subsystem when building the conn->vfs and conn->vfs_opaque structs for a connection with multiple VFS modules. Internally, Samba differentiates only opaque and transparent layers at this process. @@ -123,7 +123,7 @@ SMB_VFS_LAYER_SCANNER /* - Checks data and possibly initiates additional */ /* file activity like logging to files _inside_ samba VFS */ } vfs_op_layer; -

    The Interaction between the Samba VFS subsystem and the modules

    Initialization and registration

    +

    The Interaction between the Samba VFS subsystem and the modules

    Initialization and registration

    As each Samba module a VFS module should have a

    NTSTATUS vfs_example_init(void);

    function if it's staticly linked to samba or

    NTSTATUS init_module(void);

    function if it's a shared module. @@ -163,7 +163,7 @@ { return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "example", example_op_tuples); } -

    How the Modules handle per connection data

    Each VFS function has as first parameter a pointer to the modules vfs_handle_struct. +

    How the Modules handle per connection data

    Each VFS function has as first parameter a pointer to the modules vfs_handle_struct.

     typedef struct vfs_handle_struct {
     	struct vfs_handle_struct  *next, *prev;
    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/2000users.html samba-3.0.10/docs/htmldocs/Samba-Guide/2000users.html
    --- samba-3.0.9/docs/htmldocs/Samba-Guide/2000users.html	2004-11-15 10:15:37.000000000 -0600
    +++ samba-3.0.10/docs/htmldocs/Samba-Guide/2000users.html	2004-12-15 10:23:48.000000000 -0600
    @@ -1,4 +1,4 @@
    -Chapter 7. A Distributed 2000 User Network

    Chapter 7. A Distributed 2000 User Network

    There is something indeed mystical about things that are +Chapter 7. A Distributed 2000 User Network

    Chapter 7. A Distributed 2000 User Network

    There is something indeed mystical about things that are big. Large networks exhibit a certain magnetism and exude a sense of importance that obscures reality. You and I know that it is no more difficult to secure a large network than it is a small one. We all @@ -22,7 +22,7 @@ implementing a DNS or a DHCP server are under control. Even the basics of Samba are largely under control. So in this section you focus on the specifics of implementing LDAP changes, Samba changes, and approach and - design of the solution and its deployment.

    Introduction

    + design of the solution and its deployment.

    Introduction

    Abmas is a miracle company. Most businesses would have collapsed under the weight of rapid expansion that this company has experienced. Samba is flexible, so there is no need to reinstall the whole operating @@ -30,16 +30,16 @@ you can keep an old server running right up to the moment of cut-over and then do a near-live conversion. There is no need to reinstall a Samba server just to change the way your network should function. -

    +

    Network growth is common to all organizations. In this exercise, your preoccupation is with the mechanics of implementing Samba and LDAP so that network users on each network segment can work - without impediment.

    Assignment Tasks

    + without impediment.

    Assignment Tasks

    Starting with the configuration files for the server called MASSIVE in Chapter 6, you now deal with the issues that are particular to large distributed networks. Your task is simple identify the challenges, consider the - alternatives, and then design and implement a solution.

    + alternatives, and then design and implement a solution.

    Remember, you have users based in London (UK), Los Angeles, Washington DC, and three buildings in New York. A significant portion of your workforce have notebook computers and roam all over the @@ -53,12 +53,12 @@ and Help desk in New York, plus one floater for Washington DC.

    You have outsourced all desktop deployment and management to DirectPointe,Inc. Your concern is server maintenance and third-level - support. Build a plan and show what must be done.

    Dissection and Discussion

    + support. Build a plan and show what must be done.

    Dissection and Discussion

    In the previous chapter, you implemented an LDAP server that provided the passdb backend for the Samba servers. You explored ways to accelerate Windows desktop profile handling and you took control of network performance. -

    +

    The implementation of an LDAP-based passdb backend (known as ldapsam in Samba parlance), or some form of database that can be distributed, is essential to permit the deployment of Samba @@ -69,34 +69,34 @@ using a tool such as rsync, but smbpasswd suffers the drawback that it does not support the range of account facilities demanded by modern network - managers.

    + managers.

    The new tdbsam facility supports functionality that is similar to an ldapsam, but the lack of distributed infrastructure sorely limits the scope for its deployment. This does raise the following questions: "Why can't I just use an XML based backend, or for that matter, why not use an SQL based backend?" "Is support for these tools broken?" No. Answers to these - questions require a bit of background.

    + questions require a bit of background.

    What is a directory? A directory is a collection of information regarding objects that can be accessed to rapidly find information that is relevant in a particular and consistent manner. A directory differs from a database in that it is generally more often searched (read) than updated. As a consequence, the information is organized to facilitate read access rather than to - support transaction processing.

    + support transaction processing.

    The Lightweight Directory Access Protocol (LDAP) differs considerably from a traditional database. It has a simple search facility that uniquely makes a highly preferred mechanism for managing user identities. LDAP provides a scalable mechanism for distributing the data repository and for keeping all copies (slaves) in sync with - the master repository.

    + the master repository.

    Samba is a flexible and powerful file and print sharing technology. It can use many external authentication sources and can be part of a total authentication and identity management infrastructure. The two most important external sources for large sites are Microsoft Active Directory and LDAP. Sites that specifically wish to avoid the proprietary implications of Microsoft Active Directory - naturally gravitate toward OpenLDAP.

    + naturally gravitate toward OpenLDAP.

    In Chapter 6, you had to deal with a locally routed network. All deployment concerns focused around making users happy, and that simply means taking control over all network practices and @@ -107,10 +107,10 @@ between offices. You must take into account the way users need to access information globally. And you must make the network robust enough so that it can sustain partial breakdown without causing loss of - productivity.

    Technical Issues

    There are at least three areas that need to be addressed as you + productivity.

    Technical Issues

    There are at least three areas that need to be addressed as you approach the challenge of designing a network solution for the newly - expanded business. These are:

    • - User needs such as mobility and data access

    • The nature of Windows networking protocols

    • Identity management infrastructure needs

    Let's look at each in turn.

    User Needs

    The new company has three divisions. Staff for each division + expanded business. These are:

    • + User needs such as mobility and data access

    • The nature of Windows networking protocols

    • Identity management infrastructure needs

    Let's look at each in turn.

    User Needs

    The new company has three divisions. Staff for each division are spread across the company. Some staff are office-bound and some are mobile users. Mobile users travel globally. Some spend considerable periods working in other offices. Everyone wants to be @@ -118,7 +118,7 @@ even dial-up connectivity is poor, while in other regions political encumbrances severely curtail user needs. Parts of the global Internet infrastructure remain shielded-off for reasons outside - the scope of this discussion.

    + the scope of this discussion.

    Decisions must be made regarding where data is to be stored, how it will be replicated (if at all), and what the network bandwidth implications are. For example, one decision that can be made is @@ -128,7 +128,7 @@ synchronization tool could be rsync, run via a cron job. Mobile users may use off-line file storage under Windows XP Professional. This way, they can synchronize all files that have - changed since each logon to the network.

    + changed since each logon to the network.

    No matter which way you look at this, the bandwidth requirements for acceptable performance are substantial even if only 10 percent of staff are global data users. A company with 3500 employees @@ -139,10 +139,10 @@ mobile users. At that time, the average roaming profile took 480 Kbytes, while today the minimum Windows XP Professional roaming profile involves a transfer of over 750 Kbytes from the profile - server to/from the client.

    + server to/from the client.

    Obviously then, user needs and wide-area practicalities dictate the economic and technical aspects of your network - design as well as for standard operating procedures.

    The Nature of Windows Networking Protocols

    + design as well as for standard operating procedures.

    The Nature of Windows Networking Protocols

    Network logons that include roaming profile handling requires from 140 Kbytes to 2 Mbytes. The inclusion of support for a minimal set of common desktop applications can push the size of a complete @@ -150,7 +150,7 @@ as location of user profiles is concerned. Additionally, it is a significant factor in determining the nature and style of mandatory profiles that may be enforced as part of a total service level - assurance program that might be implemented.

    + assurance program that might be implemented.

    One way to reduce the network bandwidth impact of user logon traffic is through folder redirection. In Chapter 6, you implemented this in the new Windows XP Professional standard @@ -158,21 +158,21 @@ Documents are redirected to a network drive, they should also be excluded from synchronization to/from the server on logon/out. Redirected folders are analogous to network drive - connections.

    + connections.

    Of course, network applications should only be run off local application servers. As a general rule, even with 2 Mbit/sec network bandwidth, it would not make sense at all for someone who is working out of the London office to run applications off a - server that is located in New York.

    + server that is located in New York.

    When network bandwidth becomes a precious commodity (that is most of the time), there is a significant demand to understand network processes and to mould the limits of acceptability around the constraints of affordability.

    When a Windows NT4/200x/XP Professional client user logs onto - the network, several important things must happen.

    • + the network, several important things must happen.

      • The client obtains an IP address via DHCP. (DHCP is - necessary so that users can roam between offices.)

      • + necessary so that users can roam between offices.)

      • The client must register itself with the WINS and/or DNS - server.

      • + server.

      • The client must locate the closest Domain Controller.

      • The client must log onto a Domain Controller and obtain as part of that process the location of the user's profile, load it, connect to redirected folders, and establish all network @@ -187,11 +187,11 @@ DHCP and WINS.

        As soon as the Windows workstation starts up, it obtains an IP address. This is immediately followed by registration of its name both by broadcast and Unicast registration that is directed - at the WINS server.

        + at the WINS server.

        Given that the client is already a Domain Member, it then sends a directed (Unicast) request to the WINS server seeking the list of IP addresses for domain controllers (NetBIOS name type 0x1C). The - WINS server replies with the information requested.

        + WINS server replies with the information requested.

        The client sends two netlogon mailslot broadcast requests to the local network and to each of the IP addresses returned by the WINS server. Whichever answers this request first appears to @@ -199,7 +199,7 @@ process the network logon. The mailslot messages use UDP broadcast to the local network and UDP Unicast directed at each machine that was listed in the WINS server response to a request for the list of - Domain Controllers.

        + Domain Controllers.

        The logon process begins with negotiation of the SMB/CIFS protocols that are to be used; this is followed by an exchange of information that ultimately includes the client sending the @@ -208,7 +208,7 @@ connection, but that is a good point to halt for now. The priority here must center around identification of network infrastructure needs. A secondary fact we need to know is, what happens when - local Domain Controllers fail or break?

        + local Domain Controllers fail or break?

        Under most circumstances, the nearest Domain Controller responds to the netlogon mailslot broadcast. The exception to this norm occurs when the nearest Domain Controller is too busy or is out @@ -216,19 +216,19 @@ important that every network segment should have at least two Domain Controllers. Since there can be only one Primary Domain Controller (PDC), all additional Domain Controllers are by definition - Backup Domain Controllers (BDCs).

        + Backup Domain Controllers (BDCs).

        The provision of sufficient servers that are BDCs is an important design factor. The second important design factor involves how each of the BDCs obtains user authentication data. That is the subject of the next section as it involves key - decisions regarding Identity Management facilities.

      Identity Management Needs

      + decisions regarding Identity Management facilities.

      Identity Management Needs

      Network managers recognize that in large organizations users generally need to be given resource access based on needs, while being excluded from other resources for reasons of privacy. It is, therefore, essential that all users identify themselves at the point of network access. The network logon is the principal means by which user credentials are validated and filtered, and appropriate - rights and privileges are allocated.

      + rights and privileges are allocated.

      Unfortunately, network resources tend to have their own Identity Management facilities, the quality and manageability of which varies from quite poor to exceptionally good. Corporations that use a mixture @@ -238,7 +238,7 @@ was originally called Yellow Pages, and was renamed when a telephone company objected to the use of its trademark. What was once called Yellow Pages is today known - as Network Information System (NIS).

      + as Network Information System (NIS).

      NIS gained a strong following throughout the UNIX/VMS space in a short period of time and retained that appeal and use for over a decade. Security concerns as well as inherent limitations @@ -247,17 +247,17 @@ adopted. Sun updated this to a more secure implementation called NIS+, but even it has fallen victim to changing demands as the demand for directory services that can be coupled with other - information systems is catching on.

      + information systems is catching on.

      Nevertheless, both NIS and NIS+ continue to hold ground in business areas where UNIX still has major sway. Examples of organizations that remain firmly attached to the use of NIS and NIS+ includes large government departments, education institutions, as well as large corporations that have a scientific or engineering - focus.

      + focus.

      Today's networking world needs a scalable, distributed Identity Management infrastructure, commonly called a directory. The most popular technologies today are Microsoft Active Directory service - and a number of LDAP implementations.

      + and a number of LDAP implementations.

      The problem of managing multiple directories has become a focal point over the past decade. This has created a large market for meta-directory products and services that allow organizations that @@ -265,19 +265,19 @@ centers to provision information from one directory into another. The attendant benefit to end users is the promise of having to remember and deal with fewer login identities and - passwords.

      + passwords.

      The challenge of every large network is to find the optimum balance of internal systems and facilities for Identity Management resources. How well the solution is chosen and implemented has potentially significant impact on network bandwidth - and systems response needs.

      + and systems response needs.

      In Chapter 6, you implemented a single LDAP server for the entire network. This may work for smaller networks, but almost certainly fails to meet the needs of large and complex networks. The following section documents how one may implement a single master LDAP server, with multiple slave servers.

      What is the best method for implementing master/slave LDAP servers within the context of a distributed 2000 user network is a - question that remains to be answered.

      + question that remains to be answered.

      One possibility that has great appeal is to create one single large distributed domain. The practical implications of this design (see ???) demands the placement of @@ -286,7 +286,7 @@ over the wide-area links, except as a totally unavoidable measure. Network design must balance the risk of loss of user productivity against the cost of network management and - maintenance.

      + maintenance.

      The network design in ??? takes the approach that management of networks that are too remote to be capable of being managed effectively from New York ought @@ -296,15 +296,15 @@ and can be independently managed and controlled. One of the key drawbacks of this design is that it flies in the face of the ability for network users to roam globally without some compromise - in how they may access global resources.

      + in how they may access global resources.

      Desk-bound users need not be negatively affected by this design, since the use of interdomain trusts can be used to satisfy - the need for global data sharing.

      + the need for global data sharing.

      When Samba-3 is configured to use an LDAP backend, it stores the domain account information in a directory entry. This account entry contains the domain SID. An unintended but exploitable side effect is that this makes it possible to operate with more than one PDC on a - distributed network.

      + distributed network.

      How might this peculiar feature be exploited? The answer is simple. It is imperative that each network segment should have its own WINS server. Major servers on remote network segments can be @@ -314,7 +314,7 @@ as if it is an independent domain, while all sharing the same domain SID. Since all domain account information can be stored in a single LDAP backend, users have unfettered ability to - roam.

      + roam.

      This concept has not been exhaustively validated, though we can see no reason why this should not work. The important facets are: The name of the domain must be identical in all @@ -325,7 +325,7 @@ primary name. A single master LDAP server can be based in New York, with multiple LDAP slave servers located on every network segment. Finally, the BDCs should each use fail-over LDAP servers - that are in fact slave LDAP servers on the local segments.

      + that are in fact slave LDAP servers on the local segments.

      With a single master LDAP server, all network updates are effected on a single server. In the event that this should become excessively fragile or network bandwidth limiting, one could @@ -337,25 +337,25 @@ referential traffic. It should be noted that all directory administrators must of necessity follow the same standard procedures for managing the directory, as retroactive correction of - inconsistent directory information can be exceedingly difficult.

      Figure 7.1. Network Topology 2000 User Complex Design A

      Network Topology 2000 User Complex Design A

      Figure 7.2. Network Topology 2000 User Complex Design B

      Network Topology 2000 User Complex Design B

    Political Issues

    As organizations grow, the number of points of control increase + inconsistent directory information can be exceedingly difficult.

    Figure 7.1. Network Topology 2000 User Complex Design A

    Network Topology 2000 User Complex Design A

    Figure 7.2. Network Topology 2000 User Complex Design B

    Network Topology 2000 User Complex Design B

    Political Issues

    As organizations grow, the number of points of control increase also. In a large distributed organization, it is important that the Identity Management system must be capable of being updated from many locations, and it is equally important that changes made should become capable of being used in a reasonable period, typically minutes rather than days (the old limitation of highly manual - systems).

    Implementation

    + systems).

    Implementation

    Samba-3 has the ability to use multiple password (authentication and identity resolution) backends. The diagram in ??? demonstrates how Samba uses winbind, LDAP, and NIS, the traditional system password database. The diagram only documents the mechanisms for authentication and identity resolution (obtaining a UNIX UID/GID) using the specific systems shown. -

    Figure 7.3. Samba and Authentication Backend Search Pathways

    Samba and Authentication Backend Search Pathways

    +

    Figure 7.3. Samba and Authentication Backend Search Pathways

    Samba and Authentication Backend Search Pathways

    Samba is capable of using the smbpasswd, tdbsam, xmlsam, and mysqlsam authentication databases. The SMB passwords can, of course, also be stored in an LDAP ldapsam backend. LDAP is the preferred passdb backend for distributed network - operations.

    + operations.

    Additionally, it is possible to use multiple passdb backends concurrently as well as have multiple LDAP backends. As a result, one can specify a fail-over LDAP backend. The syntax for specifying a @@ -367,8 +367,8 @@

    This configuration tells Samba to use a single LDAP server as shown in ???. -

    Figure 7.4. Samba Configuration to Use a Single LDAP Server

    Samba Configuration to Use a Single LDAP Server

    - +

    Figure 7.4. Samba Configuration to Use a Single LDAP Server

    Samba Configuration to Use a Single LDAP Server

    + The addition of a fail-over LDAP server can simply be done by adding a second entry for the fail-over server to the single ldapsam entry as shown here (note the particular @@ -381,7 +381,7 @@

    This configuration tells Samba to use a master LDAP server, with fail-over to a slave server if necessary, as shown in ???. -

    Figure 7.5. Samba Configuration to Use a Dual (Fail-over) LDAP Server

    Samba Configuration to Use a Dual (Fail-over) LDAP Server

    +

    Figure 7.5. Samba Configuration to Use a Dual (Fail-over) LDAP Server

    Samba Configuration to Use a Dual (Fail-over) LDAP Server

    Some folks have tried to implement this without the use of double quotes as shown above. This is the type of entry they had created: @@ -391,18 +391,18 @@ ldapsam:ldap://slave.abmas.biz ...

    - + The effect of this style of entry is that Samba lists the users that are in both LDAP databases. If both contain the same information, it results in each record being shown twice. This is, of course, not the solution desired for a fail-over implementation. The net effect of this configuration is shown in ??? -

    Figure 7.6. Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!

    Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!

    +

    Figure 7.6. Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!

    Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!

    If, however, each LDAP database contains unique information, this may well be an advantageous way to effectively integrate multiple LDAP databases into one seemingly contiguous directory. Only the first database will be updated. An example of this configuration is shown in ???. -

    Figure 7.7. Samba Configuration to Use Two LDAP Databases - The result is additive.

    Samba Configuration to Use Two LDAP Databases - The result is additive.

    Note

    +

    Figure 7.7. Samba Configuration to Use Two LDAP Databases - The result is additive.

    Samba Configuration to Use Two LDAP Databases - The result is additive.

    Note

    When the use of ldapsam is specified twice, as shown here, it is imperative that the two LDAP directories must be disjoint. If the entries are for a master LDAP server as well as its own slave server, updates to the LDAP @@ -411,7 +411,7 @@

    It is assumed that the network you are working with follows in a pattern similar to what has been covered in Chapter 6. The following steps permit the operation of a Master/Slave OpenLDAP arrangement.

    1. - + Log onto the master LDAP server as root. You are about to change the configuration of the LDAP server, so it makes sense to temporarily halt it. Stop OpenLDAP from running on @@ -423,10 +423,31 @@

       root#  service ldap stop
       

      -

    2. +

    3. Edit the /etc/openldap/slapd.conf file so it matches the content of ???. -

    4. +

    5. + Create a file called admin-accts.ldif with the following contents: +

      +dn: cn=updateuser,dc=abmas,dc=biz
      +objectClass: person
      +cn: updateuser
      +sn: updateuser
      +userpaddword: not24get
      +
      +dn: cn=sambaadmin,dc=abmas,dc=biz
      +objectClass: person
      +cn: sambaadmin
      +sn: sambaadmin
      +userpaddword: buttercup
      +

      +

    6. + Add an account called “updateuser” to the master LDAP server + as shown here: +

      +root#  slapadd -v -l admin-accts.ldif
      +

      +

    7. Change directory to a suitable place to dump the contents of the LDAP server. The dump file (and LDIF file) is used to preload the Slave LDAP server database. You can dump the database by executing: @@ -434,7 +455,7 @@ root# slapcat -v -l LDAP-transfer-LDIF.txt

      Each record is written to the file. -

    8. +

    9. Copy the file LDAP-transfer-LDIF.txt to the intended slave LDAP server. A good location could be in the directory /etc/openldap/preload. @@ -484,7 +505,7 @@ root# service ldap start root# chkconfig ldap on

      - +

    10. Go back to the master LDAP server. Execute the following to start LDAP as well as slurpd, the synchronization daemon, as shown here: @@ -494,9 +515,9 @@ root# rcslurpd start root# chkconfig slurpd on

      - + On Red Hat Linux, check the equivalent command to start slurpd. -

    11. +

    12. On the master ldap server you may now add an account to validate that replication is working. Assuming the configuration shown in Chapter 6, execute:

      @@ -595,7 +616,6 @@
       
       updatedn    cn=updateuser,dc=abmas,dc=biz
       updateref   ldap://massive.abmas.biz
      -replogfile  /var/lib/ldap/replogfile
       
       directory   /var/lib/ldap
       
      @@ -612,299 +632,299 @@
       index sambaPrimaryGroupSID  eq
       index sambaDomainName       eq
       index default               sub
      -

    Example 7.3. Primary Domain Controller smb.conf File Part A

    # Global parameters
    [global]
    +

    Example 7.3. Primary Domain Controller smb.conf File Part A

    # Global parameters
    [global]
    - unix charset = LOCALE
    + unix charset = LOCALE
    - workgroup = MEGANET2
    + workgroup = MEGANET2
    - passdb backend = ldapsam:ldap://massive.abmas.biz
    + passdb backend = ldapsam:ldap://massive.abmas.biz
    - username map = /etc/samba/smbusers
    + username map = /etc/samba/smbusers
    - log level = 1
    + log level = 1
    - syslog = 0
    + syslog = 0
    - log file = /var/log/samba/%m
    + log file = /var/log/samba/%m
    - max log size = 0
    + max log size = 0
    - smb ports = 139 445
    + smb ports = 139 445
    - name resolve order = wins bcast hosts
    + name resolve order = wins bcast hosts
    - time server = Yes
    + time server = Yes
    - printcap name = CUPS
    + printcap name = CUPS
    - add user script = /var/lib/samba/sbin/smbldap-useradd.pl -m '%u'
    + add user script = /var/lib/samba/sbin/smbldap-useradd.pl -m '%u'
    - delete user script = /var/lib/samba/sbin/smbldap-userdel.pl '%u'
    + delete user script = /var/lib/samba/sbin/smbldap-userdel.pl '%u'
    - add group script = /var/lib/samba/sbin/smbldap-groupadd.pl -p '%g'
    + add group script = /var/lib/samba/sbin/smbldap-groupadd.pl -p '%g'
    - delete group script = /var/lib/samba/sbin/smbldap-groupdel.pl '%g'
    + delete group script = /var/lib/samba/sbin/smbldap-groupdel.pl '%g'
    - add user to group script = /var/lib/samba/sbin/
    smbldap-groupmod.pl -m '%g' '%u'
    + add user to group script = /var/lib/samba/sbin/
    smbldap-groupmod.pl -m '%g' '%u'
    - delete user from group script = /var/lib/samba/sbin/
    smbldap-groupmod.pl -x '%g' '%u'
    + delete user from group script = /var/lib/samba/sbin/
    smbldap-groupmod.pl -x '%g' '%u'
    - set primary group script = /var/lib/samba/sbin/
    smbldap-usermod.pl -g '%g' '%u'
    + set primary group script = /var/lib/samba/sbin/
    smbldap-usermod.pl -g '%g' '%u'
    - add machine script = /var/lib/samba/sbin/
    smbldap-useradd.pl -w '%u'
    + add machine script = /var/lib/samba/sbin/
    smbldap-useradd.pl -w '%u'
    - shutdown script = /var/lib/samba/scripts/shutdown.sh
    + shutdown script = /var/lib/samba/scripts/shutdown.sh
    - abort shutdown script = /sbin/shutdown -c
    + abort shutdown script = /sbin/shutdown -c
    - logon script = scripts\logon.bat
    + logon script = scripts\logon.bat
    - logon path = \\%L\profiles\%U
    + logon path = \\%L\profiles\%U
    - logon drive = X:
    + logon drive = X:
    - domain logons = Yes
    + domain logons = Yes
    - domain master = Yes
    + domain master = Yes
    - wins support = Yes
    + wins support = Yes
    - ldap suffix = dc=abmas,dc=biz
    + ldap suffix = dc=abmas,dc=biz
    - ldap machine suffix = ou=People
    + ldap machine suffix = ou=People
    - ldap user suffix = ou=People
    + ldap user suffix = ou=People
    - ldap group suffix = ou=Groups
    + ldap group suffix = ou=Groups
    - ldap idmap suffix = ou=Idmap
    + ldap idmap suffix = ou=Idmap
    - ldap admin dn = cn=Manager,dc=abmas,dc=biz
    + ldap admin dn = cn=Manager,dc=abmas,dc=biz
    - idmap backend = ldap://massive.abmas.biz
    + idmap backend = ldap://massive.abmas.biz
    - idmap uid = 10000-20000
    + idmap uid = 10000-20000
    - idmap gid = 10000-20000
    + idmap gid = 10000-20000
    - printer admin = root
    + printer admin = root
    - printing = cups

    Example 7.4. Primary Domain Controller smb.conf File Part B

    [IPC$]
    + printing = cups

    Example 7.4. Primary Domain Controller smb.conf File Part B

    [IPC$]
    - path = /tmp
    [accounts]
    + path = /tmp
    [accounts]
    - comment = Accounting Files
    + comment = Accounting Files
    - path = /data/accounts
    + path = /data/accounts
    - read only = No
    [service]
    + read only = No
    [service]
    - comment = Financial Services Files
    + comment = Financial Services Files
    - path = /data/service
    + path = /data/service
    - read only = No
    [pidata]
    + read only = No
    [pidata]
    - comment = Property Insurance Files
    + comment = Property Insurance Files
    - path = /data/pidata
    + path = /data/pidata
    - read only = No
    [homes]
    + read only = No
    [homes]
    - comment = Home Directories
    + comment = Home Directories
    - valid users = %S
    + valid users = %S
    - read only = No
    + read only = No
    - browseable = No
    [printers]
    + browseable = No
    [printers]
    - comment = SMB Print Spool
    + comment = SMB Print Spool
    - path = /var/spool/samba
    + path = /var/spool/samba
    - guest ok = Yes
    + guest ok = Yes
    - printable = Yes
    + printable = Yes
    - browseable = No

    Example 7.5. Primary Domain Controller smb.conf File Part C

    [apps]
    + browseable = No

    Example 7.5. Primary Domain Controller smb.conf File Part C

    [apps]
    - comment = Application Files
    + comment = Application Files
    - path = /apps
    + path = /apps
    - admin users = bjones
    + admin users = bjones
    - read only = No
    [netlogon]
    + read only = No
    [netlogon]
    - comment = Network Logon Service
    + comment = Network Logon Service
    - path = /var/lib/samba/netlogon
    + path = /var/lib/samba/netlogon
    - admin users = root, Administrator
    + admin users = root, Administrator
    - guest ok = Yes
    + guest ok = Yes
    - locking = No
    [profiles]
    + locking = No
    [profiles]
    - comment = Profile Share
    + comment = Profile Share
    - path = /var/lib/samba/profiles
    + path = /var/lib/samba/profiles
    - read only = No
    + read only = No
    - profile acls = Yes
    [profdata]
    + profile acls = Yes
    [profdata]
    - comment = Profile Data Share
    + comment = Profile Data Share
    - path = /var/lib/samba/profdata
    + path = /var/lib/samba/profdata
    - read only = No
    + read only = No
    - profile acls = Yes
    [print$]
    + profile acls = Yes
    [print$]
    - comment = Printer Drivers
    + comment = Printer Drivers
    - path = /var/lib/samba/drivers
    + path = /var/lib/samba/drivers
    - write list = root
    + write list = root
    - admin users = root, Administrator

    Example 7.6. Backup Domain Controller smb.conf File Part A

    # # Global parameters
    [global]
    + admin users = root, Administrator

    Example 7.6. Backup Domain Controller smb.conf File Part A

    # # Global parameters
    [global]
    - unix charset = LOCALE
    + unix charset = LOCALE
    - workgroup = MEGANET2
    + workgroup = MEGANET2
    - netbios name = BLDG1
    + netbios name = BLDG1
    - passdb backend = ldapsam:ldap://lapdc.abmas.biz
    + passdb backend = ldapsam:ldap://lapdc.abmas.biz
    - username map = /etc/samba/smbusers
    + username map = /etc/samba/smbusers
    - log level = 1
    + log level = 1
    - syslog = 0
    + syslog = 0
    - log file = /var/log/samba/%m
    + log file = /var/log/samba/%m
    - max log size = 50
    + max log size = 50
    - smb ports = 139 445
    + smb ports = 139 445
    - name resolve order = wins bcast hosts
    + name resolve order = wins bcast hosts
    - printcap name = CUPS
    + printcap name = CUPS
    - show add printer wizard = No
    + show add printer wizard = No
    - logon script = scripts\logon.bat
    + logon script = scripts\logon.bat
    - logon path = \\%L\profiles\%U
    + logon path = \\%L\profiles\%U
    - logon drive = X:
    + logon drive = X:
    - domain logons = Yes
    + domain logons = Yes
    - os level = 63
    + os level = 63
    - domain master = No
    + domain master = No
    - wins server = 192.168.2.1
    + wins server = 192.168.2.1
    - ldap suffix = dc=abmas,dc=biz
    + ldap suffix = dc=abmas,dc=biz
    - ldap machine suffix = ou=People
    + ldap machine suffix = ou=People
    - ldap user suffix = ou=People
    + ldap user suffix = ou=People
    - ldap group suffix = ou=Groups
    + ldap group suffix = ou=Groups
    - ldap idmap suffix = ou=Idmap
    + ldap idmap suffix = ou=Idmap
    - ldap admin dn = cn=Manager,dc=abmas,dc=biz
    + ldap admin dn = cn=Manager,dc=abmas,dc=biz
    - utmp = Yes
    + utmp = Yes
    - idmap backend = ldap://massive.abmas.biz
    + idmap backend = ldap://massive.abmas.biz
    - idmap uid = 10000-20000
    + idmap uid = 10000-20000
    - idmap gid = 10000-20000
    + idmap gid = 10000-20000
    - printing = cups
    [accounts]
    + printing = cups
    [accounts]
    - comment = Accounting Files
    + comment = Accounting Files
    - path = /data/accounts
    + path = /data/accounts
    - read only = No
    [service]
    + read only = No
    [service]
    - comment = Financial Services Files
    + comment = Financial Services Files
    - path = /data/service
    + path = /data/service
    - read only = No

    Example 7.7. Backup Domain Controller smb.conf File Part B

    [pidata]
    + read only = No

    Example 7.7. Backup Domain Controller smb.conf File Part B

    [pidata]
    - comment = Property Insurance Files
    + comment = Property Insurance Files
    - path = /data/pidata
    + path = /data/pidata
    - read only = No
    [homes]
    + read only = No
    [homes]
    - comment = Home Directories
    + comment = Home Directories
    - valid users = %S
    + valid users = %S
    - read only = No
    + read only = No
    - browseable = No
    [printers]
    + browseable = No
    [printers]
    - comment = SMB Print Spool
    + comment = SMB Print Spool
    - path = /var/spool/samba
    + path = /var/spool/samba
    - guest ok = Yes
    + guest ok = Yes
    - printable = Yes
    + printable = Yes
    - browseable = No
    [apps]
    + browseable = No
    [apps]
    - comment = Application Files
    + comment = Application Files
    - path = /apps
    + path = /apps
    - admin users = bjones
    + admin users = bjones
    - read only = No
    [netlogon]
    + read only = No
    [netlogon]
    - comment = Network Logon Service
    + comment = Network Logon Service
    - path = /var/lib/samba/netlogon
    + path = /var/lib/samba/netlogon
    - guest ok = Yes
    + guest ok = Yes
    - locking = No
    [profiles]
    + locking = No
    [profiles]
    - comment = Profile Share
    + comment = Profile Share
    - path = /var/lib/samba/profiles
    + path = /var/lib/samba/profiles
    - read only = No
    + read only = No
    - profile acls = Yes
    [profdata]
    + profile acls = Yes
    [profdata]
    - comment = Profile Data Share
    + comment = Profile Data Share
    - path = /var/lib/samba/profdata
    + path = /var/lib/samba/profdata
    - read only = No
    + read only = No
    - profile acls = Yes

    Key Points Learned

    -

    • + profile acls = Yes

    Key Points Learned

    +

    • Where Samba-3 is used as a Domain Controller, the use of LDAP is an essential component necessary to permit the use of BDCs. -

    • +

    • Replication of the LDAP master server to create a network of BDCs is an important mechanism for limiting wide-area network traffic.

    • @@ -916,40 +936,40 @@ Roaming profiles must be contained to the local network segment. Any departure from this may clog wide-area arteries and slow legitimate network traffic to a crawl. -

    Questions and Answers

    +

    Questions and Answers

    There is much rumor and misinformation regarding the use of MS Windows networking protocols. These questions are just a few of those frequently asked. -

    DHCPnetworkbandwidth +

    DHCPnetworkbandwidth Is it true that DHCP uses lots of wide-area network bandwidth? -
    background communicationLDAPmaster/slavebackground communication +
    background communicationLDAPmaster/slavebackground communication How much background communication takes place between a Master LDAP server and its slave LDAP servers? -
    +
    LDAP has a database. Is LDAP not just a fancy database front end? -
    OpenLDAP +
    OpenLDAP Can Active Directory obtain account information from an OpenLDAP server? -
    +
    What are the parts of a roaming profile? How large is each part? -
    +
    Can the My Documents folder be stored on a network drive? -
    wide-areanetworkbandwidthWINS +
    wide-areanetworkbandwidthWINS How much wide-area network bandwidth does WINS consume? -
    +
    How many BDCs should I have? What is the right number of Windows clients per server? -
    NIS serverLDAP +
    NIS serverLDAP I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to run an NIS server? -
    +
    Can I use NIS in place of LDAP? -

    +

    Is it true that DHCP uses lots of wide-area network bandwidth? -

    +

    It is a smart practice to localize DHCP servers on each network segment. As a rule, there should be two DHCP servers per network segment. This means that if one server fails, there is always another to service user needs. DHCP requests use only UDP broadcast protocols. It is possible to run a DHCP Relay Agent on network routers. This makes it possible to run fewer DHCP servers. -

    +

    A DHCP network address request and confirmation usually results in about six UDP packets. The packets are from 60 to 568 bytes in length. Let us consider a site that has 300 DHCP clients and that uses a 24-hour IP address lease. This means that all clients renew @@ -966,21 +986,21 @@ x 512 (bytes/packet) = 0.9 Mbytes/day.

    From this can be seen that the traffic impact would be minimal. -

    +

    Even when DHCP is configured to do DNS update (Dynamic DNS) over a wide-area link, the impact of the update is no more than the DHCP IP address renewal traffic and, thus, still insignificant for most practical purposes. -

    +

    How much background communication takes place between a Master LDAP server and its slave LDAP servers? -

    +

    The process that controls the replication of data from the Master LDAP server to the Slave LDAP servers is called slurpd. The slurpd remains nascent (quiet) until an update must be propagated. The propagation traffic per LDAP salve to update (add/modify/delete) two user accounts requires less than 10Kbytes traffic. -

    +

    LDAP has a database. Is LDAP not just a fancy database front end? -

    +

    LDAP does store its data in a database of sorts. In fact the LDAP backend is an application-specific data storage system. This type of database is indexed so that records can be rapidly located, but the database is not generic and can be used only in particular pre-programmed ways. General external @@ -989,41 +1009,41 @@ orientation and typically allows external programs to perform ad-hoc queries, even across data tables. An LDAP front end is a purpose-built tool that has a search orientation that is designed around specific simple queries. The term database is heavily overloaded and, thus, much misunderstood. -

    +

    Can Active Directory obtain account information from an OpenLDAP server? -

    +

    No, at least not directly. It is possible to provision Active Directory from/to an OpenLDAP database through use of a meta-directory server. Microsoft MMS (now called MIIS) can interface to OpenLDAP using standard LDAP queries/updates. -

    +

    What are the parts of a roaming profile? How large is each part? -

    +

    A roaming profile consists of:

    • Desktop folders such as: Desktop, My Documents, My Pictures, My Music, Internet Files, Cookies, Application Data, Local Settings, and more. See ???. -

      +

      Each of these can be anywhere from a few bytes to gigabytes in capacity. Fortunately, all such folders can be redirected to network drive resources. See ??? for more information regarding folder redirection.

    • A static or re-writable portion that is typically only a few files (2-5 Kbytes of information). -

    • +

    • The registry load file that modifies the HKEY_LOCAL_USER hive. This is the NTUSER.DAT file. It can be from 0.4-1.5 MBytes. -

    +

    Microsoft Outlook PST files may be stored in the Local Settings\Application Data folder. It can be up to 2 Gbytes in size per PST file. -

    +

    Can the My Documents folder be stored on a network drive? -

    +

    Yes. More correctly, such folders can be redirected to network shares. No specific network drive connection is required. Registry settings permit this to be redirected directly to a UNC (Universal Naming Convention) resource, though it is possible to specify a network drive letter instead of a UNC name. See ???. -

    +

    How much wide-area network bandwidth does WINS consume? -

    +

    MS Windows clients cache information obtained from WINS lookups in a local NetBIOS name cache. This keeps WINS lookups to a minimum. On a network with 3500 MS Windows clients and a central WINS server, the total bandwidth demand measured at the WINS server, averaged over an eight-hour working day, @@ -1035,7 +1055,7 @@

    In conclusion, the total load afforded through WINS traffic is again marginal to total operational usage as it should be. -

    +

    How many BDCs should I have? What is the right number of Windows clients per server?

    It is recommended to have at least one BDC per network segment, including the segment served @@ -1049,16 +1069,16 @@

    As unsatisfactory as the answer might sound, it all depends on network and server load characteristics. -

    +

    I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to run an NIS server?

    The correct answer to both questions is yes. But do understand that an LDAP server has a configurable schema that can store far more information for many more purposes than just NIS. -

    +

    Can I use NIS in place of LDAP? -

    +

    No. The NIS database does not have provision to store Microsoft encrypted passwords and does not deal with the types of data necessary for interoperability with Microsoft Windows networking. The use of LDAP with Samba requires the use of a number of schemas, one of which is the NIS schema, but also diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/appendix.html samba-3.0.10/docs/htmldocs/Samba-Guide/appendix.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/appendix.html 2004-11-15 10:15:41.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/appendix.html 2004-12-15 10:23:52.000000000 -0600 @@ -1,10 +1,10 @@ -Appendix A. Appendix: A Collection of Useful Tid-bits

    Appendix A. Appendix: A Collection of Useful Tid-bits

    +Appendix A. Appendix: A Collection of Useful Tid-bits

    Appendix A. Appendix: A Collection of Useful Tid-bits

    Information presented here is considered to be either basic or well-known material that is informative yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that the process for joining a Windows client to a Samba-controlled Windows Domain may somehow involve steps different from doing so with Windows NT4 or a Windows ADS Domain. Be assured that the steps are identical, as shown in the example given below. -

    Joining a Domain: Windows 200x/XP Professional

    +

    Joining a Domain: Windows 200x/XP Professional

    Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security. This section steps through the process for making a Windows 200x/XP Professional machine a member of a Domain Security environment. It should be noted that this process is identical @@ -46,27 +46,27 @@

    The “Welcome to the MIDEARTH domain” dialog box should appear. At this point, the machine must be rebooted. Joining the domain is now complete. -

    +

    The screen capture shown in ??? has a button labeled More.... This button opens a panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members of Microsoft Active Directory. Active Directory is heavily oriented around the DNS name space. -

    +

    Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server to find the services (like which machines are Domain Controllers or which machines have the Netlogon service running). -

    +

    The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix, this does not affect Domain Membership, but it can break network browsing and the ability to resolve your computer name to a valid IP address.

    The Primary DNS suffix parameter principally affects MS Windows clients that are members of an Active Directory domain. Where the client is a member of a Samba Domain, it is preferable to leave this field blank. -

    +

    According to Microsoft documentation, “If this computer belongs to a group with Group Policy enabled on Primary DNS suffice of this computer, the string specified in the Group Policy is used as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is used only if Group Policy is disabled or unspecified.” -

    Samba System File Location

    +

    Samba System File Location

    One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is in the /usr/local/samba directory. This is a perfectly reasonable location, particularly given all the other @@ -74,7 +74,7 @@

    Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team default. -

    +

    Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy System (FHS), have elected to locate the configuration files under the /etc/samba directory, common binary files (those used by users) in the /usr/bin directory, and the administrative files (daemons) in the @@ -83,13 +83,13 @@ /usr/share/swat. There are additional support files for smbd in the /usr/lib/samba directory tree. The files located there include the dynamically loadable modules for the passdb backend as well as for the VFS modules. -

    +

    Samba creates run-time control files and generates log files. The run-time control files (tdb and dat files) are stored in the /var/lib/samba directory. Log files are created in /var/log/samba.

    When Samba is built and installed using the default Samba Team process, all files are located under the /usr/local/samba directory tree. This makes it simple to find the files that Samba owns. -

    +

    One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location of all files called smbd. Here is an example:

    @@ -122,7 +122,7 @@
     	

    Many people have been caught by installation of Samba using the default Samba Team process when it was already installed by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by - executing: + executing:

     root#  rpm -qa | grep samba
     samba3-pdb-3.0.2-1
    @@ -134,9 +134,9 @@
     samba3-doc-3.0.2-1
     samba3-client-3.0.2-1
     samba3-cifsmount-3.0.2-1
    -	

    +

    The package names, of course, vary according to how the vendor, or the binary package builder, prepared them. -

    Starting Samba

    +

    Starting Samba

    Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services. An example of a service is the Apache Web server for which the daemon is called httpd. In the case of Samba, there are three daemons, two of which are needed as a minimum. @@ -177,19 +177,19 @@ fi exit 0

    nmbd

    - - + + This daemon handles all name registration and resolution requests. It is the primary vehicle involved in network browsing. It handles all UDP-based protocols. The nmbd daemon should be the first command started as part of the Samba startup process.

    smbd

    - - + + This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also manages local authentication. It should be started immediately following the startup of nmbd.

    winbindd

    - - + + This daemon should be started when Samba is a member of a Windows NT4 or ADS Domain. IT is also needed when Samba has trust relationships with another Domain. The winbindd daemon will check the smb.conf file for the presence of the idmap uid and idmap gid @@ -243,22 +243,22 @@ echo "Usage: smb {start|stop|restart|status}" exit 1 esac -

    +

    SUSE Linux implements individual control over each Samba daemon. A samba control script that can be conveniently executed from the command line is shown in ???. This can be located in the directory /sbin in a file called samba. This type of control script should be owned by user root and group root, and set so that only root can execute it. -

    +

    A sample startup script for a Red Hat Linux system is shown in ???. This file could be located in the directory /etc/rc.d and can be called samba. A similar startup script is required to control winbind. If you want to find more information regarding startup scripts please refer to the packaging section of the Samba source code distribution tarball. The packaging files for each platform include a startup control file. -

    DNS Configuration Files

    +

    DNS Configuration Files

    The following files are common to all DNS server configurations. Rather than repeat them multiple times, they are presented here for general reference. -

    The Forward Zone File for the Loopback Adaptor

    +

    The Forward Zone File for the Loopback Adaptor

    The forward zone file for the loopback address never changes. An example file is shown in ???. All traffic destined for an IP address that is hosted on a physical interface on the machine itself is routed to the loopback adaptor. This is @@ -275,7 +275,7 @@ IN NS @ IN A 127.0.0.1 -

    The Reverse Zone File for the Loopback Adaptor

    +

    The Reverse Zone File for the Loopback Adaptor

    The reverse zone file for the loopback address as shown in ??? is necessary so that references to the address 127.0.0.1 can be resolved to the correct name of the interface. @@ -335,15 +335,15 @@ . 3600000 NS M.ROOT-SERVERS.NET. M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 ; End of File -

    DNS Root Server Hint File

    +

    DNS Root Server Hint File

    The content of the root hints file as shown in ??? changes slowly over time. Periodically this file should be updated from the source shown. Because of its size this file is located at the end of this appendix. -

    Alternative LDAP Database Initialization

    +

    Alternative LDAP Database Initialization

    The following procedure may be used as an alternative means of configuring the initial LDAP database. Many administrators prefer to have greater control over how system files get configured. -

    Initialization of the LDAP Database

    +

    Initialization of the LDAP Database

    The first step to get the LDAP server ready for action is to create the LDIF file from which the LDAP database will be preloaded. This is necessary to create the containers into which the user, group, and so on, accounts is written. It is also necessary to @@ -529,7 +529,7 @@ # Here We Go ... # -cat >>EOF +cat <<EOF How do you wish to refer to your organization? @@ -700,7 +700,7 @@ displayName: Domain Users description: Domain Users structuralObjectClass: posixGroup -

    The LDAP Account Manager

    +

    The LDAP Account Manager

    The LDAP Account Manager (LAM) is an application suite that has been written in PHP. LAM can be used with any Web server that has PHP4 support. It connects to the LDAP server either using unencrypted connections or via SSL. LAM can be used to manage @@ -711,16 +711,16 @@ home page and from its mirror sites. LAM has been released under the GNU GPL version 2. The current version of LAM is 0.4.3. Release of version 0.5 is expected some time early in 2004. -

    +

    Requirements:

    • A web server that will work with PHP4.

    • PHP4 (available from the PHP home page.)

    • OpenLDAP 2.0 or later.

    • A Web browser that supports CSS.

    • Perl.

    • The gettext package.

    • mcrypt + mhash (optional since version 0.4.3).

    • It is also a good idea to install SSL support.

    LAM is a useful tool that provides a simple Web-based device that can be used to - manage the contents of the LDAP directory to: + manage the contents of the LDAP directory to:

    • Display user/group/host and Domain entries.

    • Manages entries (Add/Delete/Edit).

    • Filter and sort entries.

    • Set LAM administrator accounts.

    • Store and use multiple operating profiles.

    • Edit organizational units (OUs).

    • Upload accounts from a file.

    • Is compatible with Samba-2.2.x and Samba-3.

    When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba user, group, and windows domain member machine accounts. -

    +

    The default password is “lam.” It is highly recommended that you use only an SSL connection to your Web server for all remote operations involving LAM. If you want secure connections, you must configure your Apache Web server to permit connections @@ -739,7 +739,7 @@ Copy the extracted files to the document root directory of your Web server. For example, on SuSE Linux Enterprise Server 8, copy to the /srv/web/htdocs directory. -

  • +

  • Set file permissions using the following commands:

     root#  chown -R wwwrun.www /srv/www/htdocs/lam
    @@ -748,14 +748,14 @@
     root#  chmod 755 /srv/www/htdocs/lam/config
     root#  chmod 755 /srv/www/htdocs/lam/lib/*pl
     

    -

  • +

  • Using your favorite editor create the following config.cfg LAM configuration file:

     root#  cd /srv/www/htdocs/lam/config
     root#  cp config.cfg_sample config.cfg
     root#  vi config.cfg
    -	    

    +

    An example file is shown in ???. This is the minimum configuration that must be completed. The LAM profile file can be created using a convenient wizard that is part of the LAM @@ -769,18 +769,18 @@ lam.conf_sample file to a file called lam.conf then, using your favorite editor, change the settings to match local site needs. -

  • +

    An example of a working file is shown here in ???. This file has been stripped of comments to keep the size small. The comments and help information provided in the profile file that the wizard creates is very useful and will help many administrators to avoid pitfalls. Your configuration file obviously reflects the configuration options that are preferred at your site. -

    +

    It is important that your LDAP server is running at the time that LAM is being configured. This permits you to validate correct operation. An example of the LAM login screen is provided in ???. -

    Figure A.6. The LDAP Account Manager Login Screen

    The LDAP Account Manager Login Screen

    +

    Figure A.6. The LDAP Account Manager Login Screen

    The LDAP Account Manager Login Screen

    The LAM configuration editor has a number of options that must be managed correctly. An example of use of the LAM configuration editor is shown in ???. It is important that you correctly set the minimum and maximum UID/GID values that are @@ -789,12 +789,12 @@ The best work-around is to temporarily set the minimum values to zero (0) to permit the initial settings to be made. Do not forget to reset these to sensible values before using LAM to add additional users and groups. -

    Figure A.7. The LDAP Account Manager Configuration Screen

    The LDAP Account Manager Configuration Screen

    +

    Figure A.7. The LDAP Account Manager Configuration Screen

    The LDAP Account Manager Configuration Screen

    LAM has some nice, but unusual features. For example, one unexpected feature in most application screens permits the generation of a PDF file that lists configuration information. This is a well thought out facility. This option has been edited out of the following screen shots to conserve space. -

    +

    When you log onto LAM the opening screen drops you right into the user manager as shown in ???. This is a logical action as it permits the most-needed facility to be used immediately. The editing of an existing user, as with the addition of a new user, @@ -807,7 +807,7 @@ for user accounts, group accounts may be rapidly dealt with. ??? shown a sub-screen from the group editor that permits users to be assigned secondary group memberships. -

    Figure A.9. The LDAP Account Manager Group Edit Screen

    The LDAP Account Manager Group Edit Screen

    Figure A.10. The LDAP Account Manager Group Membership Edit Screen

    The LDAP Account Manager Group Membership Edit Screen

    +

    Figure A.9. The LDAP Account Manager Group Edit Screen

    The LDAP Account Manager Group Edit Screen

    Figure A.10. The LDAP Account Manager Group Membership Edit Screen

    The LDAP Account Manager Group Membership Edit Screen

    The final screen presented here is one that you should not normally need to use. Host accounts will be automatically managed using the smbldap-tools scripts. This means that the screen ??? will, in most cases, not be used. @@ -848,7 +848,7 @@ samba3: yes cachetimeout: 5 pwdhash: SSHA -

    Effect of Setting File and Directory SUID/SGID Permissions Explained

    +

    Effect of Setting File and Directory SUID/SGID Permissions Explained

    The setting of the SUID/SGID bits on the file or directory permissions flag has particular consequences. If the file is executable and the SUID bit is set, it executes with the privilege of (with the UID of) the owner of the file. For example, if you are logged onto a system as @@ -918,34 +918,34 @@ total 1 drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt

    -

    Shared Data Integrity

    +

    Shared Data Integrity

    The integrity of shared data is often viewed as a particularly emotional issue, especially where there are concurrent problems with multi-user data access. Contrary to the assertions of some who have experienced problems in either area, the cause has nothing to do with the phases of the moons of Jupiter.

    The solution to concurrent multi-user data access problems must consider three separate areas - from which the problem may stem: -

    • application level locking controls.

    • client side locking controls.

    • server side locking controls.

    + from which the problem may stem: +

    • application level locking controls.

    • client side locking controls.

    • server side locking controls.

    Many database applications use some form of application-level access control. An example of one well-known application that uses application-level locking is Microsoft Access. Detailed guidance is provided given that this is the most common application for which problems have been reported. -

    +

    Common applications that are affected by client- and server-side locking controls include MS Excel and Act!. Important locking guidance is provided here. -

    Microsoft Access

    +

    Microsoft Access

    The best advice that can be given is to carefully read the Microsoft knowledge base articles that cover this area. Examples of relevant documents includes: -

    • http://support.microsoft.com/default.aspx?scid=kb;en-us;208778

    • http://support.microsoft.com/default.aspx?scid=kb;en-us;299373

    +

    • http://support.microsoft.com/default.aspx?scid=kb;en-us;208778

    • http://support.microsoft.com/default.aspx?scid=kb;en-us;299373

    Make sure that your MS Access database file is configured for multi-user access (not set for exclusive open). Open MS Access on each client workstation then set the following: (Menu bar) Tools+Options+[tab] General. Set network path to Default database folder: \\server\share\folder.

    You can configure MS Access file sharing behavior as follows: click [tab] Advanced. - Set: -

    • Default open mode: Shared

    • Default Record Locking: Edited Record

    • Open databases using record_level locking

    + Set: +

    • Default open mode: Shared

    • Default Record Locking: Edited Record

    • Open databases using record_level locking

    You must now commit the changes so that they will take effect. To do so, click ApplyOk. At this point, you should exit MS Access, restart it and then validate that these settings have not changed. -

    Act! Database Sharing

    +

    Act! Database Sharing

    Where the server sharing the ACT! database(s) is running Samba, Windows NT, 200x or XP, you must disable opportunistic locking on the server and all workstations. Failure to do so results in data corruption. This information is available from the Act! Web site @@ -953,7 +953,7 @@ 1998223162925 as well as from article 200110485036. -

    +

    These documents clearly state that opportunistic locking must be disabled on both the server (Samba in the case we are interested in here), as well as on every workstation from which the centrally shared Act! database will be accessed. Act! provides @@ -961,18 +961,18 @@ registry settings that may otherwise interfere with the operation of Act! Registered Act! users may download this utility from the Act! Web site. -

    Opportunistic Locking Controls

    +

    Opportunistic Locking Controls

    Third-party Windows applications may not be compatible with the use of opportunistic file - and record locking. For applications that are known not to be compatible,[14] oplock + and record locking. For applications that are known not to be compatible,[14] oplock support may need to be disabled both on the Samba server and on the Windows workstations. -

    +

    Oplocks enable a Windows client to cache parts of a file that are being edited. Another windows client may then request to open the file with the ability to write to it. The server will then ask the original workstation that had the file open with a write lock to release it's lock. Before doing so, that workstation must flush the file from cache memory to the disk or network drive. -

    +

    Disabling of Oplocks usage may require server and client changes. Oplocks may be disabled by file, by file pattern, on the share, or on the samba server. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/Big500users.html samba-3.0.10/docs/htmldocs/Samba-Guide/Big500users.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/Big500users.html 2004-11-15 10:15:35.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/Big500users.html 2004-12-15 10:23:44.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 5. The 500-User Office

    Chapter 5. The 500-User Office

    +Chapter 5. The 500-User Office

    Chapter 5. The 500-User Office

    The Samba-3 networking you explored in the previous chapter covers the finer points of configuration of peripheral services such as DHCP and DNS, and WINS. You experienced implementation of a simple configuration of the services that are important adjuncts @@ -16,7 +16,7 @@ involving no print job processing intelligence. In this chapter, you maintain that same approach to printing, but in the following chapter, there is an opportunity to make printing more complex for the administrator while making it easier for the user. -

    +

    The previous chapter demonstrates operation of a DHCP server and a DNS server, as well as a central WINS server. You validated the operation of these services and saw an effective implementation of a Samba Domain Controller using the @@ -38,7 +38,7 @@ improve network management and control while reducing human resource overheads. You should take the opportunity to innovate and expand on the methods presented here and explore them to the fullest. -

    Introduction

    +

    Introduction

    Business continues to go well for Abmas. Mr. Meany is driving your success and the network continues to grow thanks to the hard work Christine has done. You recently hired Stanley Soroka as Manager of Information Systems. Christine recommended Stan @@ -63,7 +63,7 @@ and to allow Stan and Christine to fully stage the new network and test it before it is rolled out. Your strategy is to complete the new network so that it is ready for operation when the old office moves into the new premises. -

    Assignment Tasks

    +

    Assignment Tasks

    The acquired business had 280 network users. The old Abmas building housed 220 network users in unbelievably cramped conditions. The network that initially served 130 users now handles 220 users quite well. @@ -104,7 +104,7 @@ DirectPointe Inc. receives from you a new standard desktop configuration every four months. They automatically roll that out to each desktop system. You must keep DirectPointe informed of all changes. -

    +

    The new network has a single Samba Domain Controller (PDC) located in the Network Operation Center (NOC). Buildings 1 and 2 each have a local server for local application servicing. It is a Domain Member. The new system @@ -112,8 +112,8 @@

    Printing is based on raw pass-through facilities as it has been used so far. All printer drivers are installed on the desktop and notebook computers. -

    Dissection and Discussion

    - +

    Dissection and Discussion

    + The example you are building in this chapter is an example of a network design that works, but this does not make it a design that is recommended. As a general rule, there should be at least one Backup Domain Controller per 50 Windows network clients. The principle behind @@ -124,23 +124,23 @@ responsiveness. This network will have 500 clients serviced by one central Domain Controller. This is not a good omen for user satisfaction. You, of course, address this very soon (see next chapter). -

    Technical Issues

    +

    Technical Issues

    Stan has talked you into a horrible compromise, but it is addressed. Just make certain that the performance of this network is well validated before going live.

    Design decisions made in this design include:

    • - - - + + + A single Primary Domain Controller (PDC) is being implemented. This limitation is based on the choice not to use LDAP. Many network administrators fear using LDAP based on the perceived complexity of implementation and management of an LDAP-based backend for all user identity management as well as to store network access credentials.

    • - - + + Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the only choice that makes sense with 500 users is to use the tdbsam passwd backend. This type of backend is not receptive to replication to Backup Domain Controllers. @@ -154,7 +154,7 @@ for a simple mode of operation, but has to be balanced with network performance and integrity of operations considerations.

    • - + A single central WINS server is being used. The PDC is also the WINS server. Any attempt to operate a routed network without a WINS server while using NetBIOS over TCP/IP protocols does not work unless on each client the name resolution @@ -165,12 +165,12 @@ At this time the Samba WINS database is not capable of being replicated. That is why a single WINS server is being implemented. This should work without a problem.

    • - + Backup Domain Controllers make use of winbindd to provide access to Domain security credentials for file system access and object storage.

    • - - + + Configuration of Windows XP Professional clients is achieved using DHCP. Each subnet has its own DHCP server. Backup DHCP serving is provided by one alternate DHCP server. This necessitates enabling of the DHCP Relay agent on @@ -186,24 +186,24 @@ The network address and sub-netmask chosen provide 1022 usable IP addresses in each subnet. If in the future more addresses are required, it would make sense to add further subnets rather than change addressing. -

    Political Issues

    +

    Political Issues

    This case gets close to the real world. You and I know the right way to implement Domain Control. Politically, we have to navigate a mine field. In this case, the need is to get the PDC rolled out in compliance with expectations and also to be ready to save the day by having the real solution ready before it is needed. That real solution is presented in the next chapter. -

    Implementation

    +

    Implementation

    The following configuration process begins following installation of Red Hat Linux 9.0 on the three servers shown in the network topology diagram in ???. You have selected hardware that is appropriate to the task. -

    Figure 5.1. Network Topology 500 User Network Using tdbsam passdb backend.

    Network Topology 500 User Network Using tdbsam passdb backend.

    Installation of DHCP, DNS, and Samba Control Files

    +

    Figure 5.1. Network Topology 500 User Network Using tdbsam passdb backend.

    Network Topology 500 User Network Using tdbsam passdb backend.

    Installation of DHCP, DNS, and Samba Control Files

    Carefully install the configuration files into the correct locations as shown in ???. You should validate that the full file path is correct as shown.

    The abbreviation shown in this table as {VLN} means the directory location beginning with /var/lib/named. -

    Table 5.1. Domain: MEGANET, File Locations for Servers

    File InformationServer Name
    SourceTarget LocationMASSIVEBLDG1BLDG2
    ???/etc/samba/smb.confYesNoNo
    ???/etc/samba/dc-common.confYesNoNo
    ???/etc/samba/common.confYesYesYes
    ???/etc/samba/smb.confNoYesNo
    ???/etc/samba/smb.confNoNoYes
    ???/etc/samba/dommem.confNoYesYes
    ???/etc/dhcpd.confYesNoNo
    ???/etc/dhcpd.confNoYesNo
    ???/etc/dhcpd.confNoNoYes
    ???/etc/named.conf (part A)YesNoNo
    ???/etc/named.conf (part B)YesNoNo
    ???/etc/named.conf (part C)YesNoNo
    ???{VLN}/master/abmas.biz.hostsYesNoNo
    ???{VLN}/master/abmas.us.hostsYesNoNo
    ???/etc/named.conf (part A)NoYesYes
    ???/etc/named.conf (part B)NoYesYes
    ???{VLN}/localhost.zoneYesYesYes
    ???{VLN}/127.0.0.zoneYesYesYes
    ???{VLN}/root.hintYesYesYes

    Server Preparation All Servers

    +

    Table 5.1. Domain: MEGANET, File Locations for Servers

    File InformationServer Name
    SourceTarget LocationMASSIVEBLDG1BLDG2
    ???/etc/samba/smb.confYesNoNo
    ???/etc/samba/dc-common.confYesNoNo
    ???/etc/samba/common.confYesYesYes
    ???/etc/samba/smb.confNoYesNo
    ???/etc/samba/smb.confNoNoYes
    ???/etc/samba/dommem.confNoYesYes
    ???/etc/dhcpd.confYesNoNo
    ???/etc/dhcpd.confNoYesNo
    ???/etc/dhcpd.confNoNoYes
    ???/etc/named.conf (part A)YesNoNo
    ???/etc/named.conf (part B)YesNoNo
    ???/etc/named.conf (part C)YesNoNo
    ???{VLN}/master/abmas.biz.hostsYesNoNo
    ???{VLN}/master/abmas.us.hostsYesNoNo
    ???/etc/named.conf (part A)NoYesYes
    ???/etc/named.conf (part B)NoYesYes
    ???{VLN}/localhost.zoneYesYesYes
    ???{VLN}/127.0.0.zoneYesYesYes
    ???{VLN}/root.hintYesYesYes

    Server Preparation All Servers

    The following steps apply to all servers. Follow each step carefully.

    1. Using the UNIX/Linux system tools, set the name of the server as shown in the network @@ -219,7 +219,7 @@ root# hostname -f

    2. - + Edit your /etc/hosts file to include the primary names and addresses of all network interfaces that are on the host server. This is necessary so that during startup the system is able to resolve all its own names to the IP address prior to @@ -227,7 +227,7 @@ CUPS print server is started before the DNS server (named), you should also include an entry for the printers in the /etc/hosts file.

    3. - + All DNS name resolution should be handled locally. To ensure that the server is configured correctly to handle this, edit /etc/resolv.conf so it has the following content: @@ -238,7 +238,7 @@ This instructs the name resolver function (when configured correctly) to ask the DNS server that is running locally to resolve names to addresses.

    4. - + Add the root user to the password backend as follows:

       root#  smbpasswd -a root
      @@ -251,7 +251,7 @@
       			deleted. If for any reason the account is deleted, you may not be able to recreate this account
       			without considerable trouble.
       			

    5. - + Create the username map file to permit the root account to be called Administrator from the Windows network environment. To do this, create the file /etc/samba/smbusers with the following contents: @@ -289,16 +289,16 @@ Follow the instructions in the printer manufacturer's manuals to permit printing to port 9100. Use any other port the manufacturer specifies for direct mode, raw printing. This allows the CUPS spooler to print using raw mode protocols. - - + +

    6. - + Only on the server to which the printer is attached configure the CUPS Print Queues as follows:

       root#  lpadmin -p printque -v socket://printer-name.abmas.biz:9100 -E
       

      - + This step creates the necessary print queue to use no assigned print filter. This is ideal for raw printing, i.e., printing without use of filters. The name printque is the name you have assigned for @@ -318,15 +318,15 @@ root# /usr/bin/accept printque

    7. - - - + + + Edit the file /etc/cups/mime.convs to uncomment the line:

       application/octet-stream     application/vnd.cups-raw      0     -
       

    8. - + Edit the file /etc/cups/mime.types to uncomment the line:

       application/octet-stream
      @@ -349,12 +349,12 @@
       	processes to auto-map Windows client drives to an application server that is nearest to the client. This
       	is considerably more difficult when a single PDC is used on a routed network. It can be done, but not
       	as elegantly as you see in the next chapter.
      -	

    Server Specific Preparation

    +

    Server Specific Preparation

    There are some steps that apply to particular server functionality only. Each step is critical to correct server operation. -

    Configuration for Server: MASSIVE

    1. - - +

      Configuration for Server: MASSIVE

      1. + + The host server acts as a router between the two internal network segments as well as for all Internet access. This necessitates that IP forwarding must be enabled. This can be achieved by adding to the /etc/rc.d/boot.local an entry as follows: @@ -382,7 +382,7 @@ startup files as follows: (SUSE) /etc/rc.d/boot.local, (Red Hat) /etc/rc.d/init.d/rc.local.

      2. - + The final step that must be completed is to edit the /etc/nsswitch.conf file. This file controls the operation of the various resolver libraries that are part of the Linux Glibc libraries. Edit this file so that it contains the following entries: @@ -390,24 +390,24 @@ hosts: files dns wins

      3. - + Create and map Windows Domain Groups to UNIX groups. A sample script is provided in ???. Create a file containing this script. You called yours /etc/samba/initGrps.sh. Set this file so it can be executed and then execute the script. An example of the execution of this script as well as its validation are shown in Chapter 4, Section 4.3.2, Step 5.

      4. - - - + + + For each user who needs to be given a Windows Domain account, make an entry in the /etc/passwd file, as well as in the Samba password backend. Use the system tool of your choice to create the UNIX system account and use the Samba smbpasswd to create a Domain user account.

        - - - + + + There are a number of tools for user management under UNIX. Commonly known ones include: useradd, adduser. In addition to these, there is a plethora of custom tools. With the tool of your choice, create a home directory for each user. @@ -420,7 +420,7 @@ file is /data. Format the file system as required and mount the formatted file system partition using appropriate system tools.

      5. - + Create the top-level file storage directories for data and applications as follows:

         root#  mkdir -p /data/{accounts,finsvcs,pidata}
        @@ -498,7 +498,7 @@
         			??? until after the operation of the server has been
         			validated following the same methods as outlined in ???.
         			

      Configuration Specific to Domain Member Servers: BLDG1, BLDG2

      1. - + The final step that must be completed is to edit the /etc/nsswitch.conf file. This file controls the operation of the various resolver libraries that are part of the Linux Glibc libraries. Edit this file so that it contains the following entries: @@ -510,13 +510,13 @@

      2. Follow the steps outlined in ??? to start all services. Do not start Samba at this time. Samba is controlled by the process called smb. -

      3. +

      4. At this time, you must now attempt to join the Domain Member servers to the Domain. The following instructions should be executed to effect this:

         root#  net rpc join 
         

        -

      5. +

      6. You now start the Samba services by executing:

         root#  service smb start
        @@ -525,183 +525,183 @@
                                 Your server is ready for validation testing. Do not proceed with the steps in
                                 ??? until after the operation of the server has been
                                 validated following the same methods as outlined in ???.
        -                        

    Example 5.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf

    # Global parameters
    [global]
    +

    Example 5.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf

    # Global parameters
    [global]
    - workgroup = MEGANET
    + workgroup = MEGANET
    - netbios name = MASSIVE
    + netbios name = MASSIVE
    - interfaces = eth1, lo
    + interfaces = eth1, lo
    - bind interfaces only = Yes
    + bind interfaces only = Yes
    - passdb backend = tdbsam
    + passdb backend = tdbsam
    - add user script = /usr/sbin/useradd -m '%u'
    + add user script = /usr/sbin/useradd -m '%u'
    - delete user script = /usr/sbin/userdel -r '%u'
    + delete user script = /usr/sbin/userdel -r '%u'
    - add group script = /usr/sbin/groupadd '%g'
    + add group script = /usr/sbin/groupadd '%g'
    - delete group script = /usr/sbin/groupdel '%g'
    + delete group script = /usr/sbin/groupdel '%g'
    - add user to group script = /usr/sbin/usermod -G '%g' '%u'
    + add user to group script = /usr/sbin/usermod -G '%g' '%u'
    - add machine script = /usr/sbin/useradd -s /bin/false -d /dev/null '%u'
    + add machine script = /usr/sbin/useradd -s /bin/false -d /dev/null '%u'
    - preferred master = Yes
    + preferred master = Yes
    - wins support = Yes
    + wins support = Yes
    - include = /etc/samba/dc-common.conf
    [IPC$]
    + include = /etc/samba/dc-common.conf
    [IPC$]
    - path = /tmp
    + path = /tmp
    - hosts allow = 172.16.0.0/16, 127.0.0.1
    + hosts allow = 172.16.0.0/16, 127.0.0.1
    - hosts deny = 0.0.0.0/0
    [accounts]
    + hosts deny = 0.0.0.0/0
    [accounts]
    - comment = Accounting Files
    + comment = Accounting Files
    - path = /data/accounts
    + path = /data/accounts
    - read only = No
    [service]
    + read only = No
    [service]
    - comment = Financial Services Files
    + comment = Financial Services Files
    - path = /data/service
    + path = /data/service
    - read only = No
    [pidata]
    + read only = No
    [pidata]
    - comment = Property Insurance Files
    + comment = Property Insurance Files
    - path = /data/pidata
    + path = /data/pidata
    - read only = No

    Example 5.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf

    # Global parameters
    [global]
    + read only = No

    Example 5.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf

    # Global parameters
    [global]
    - shutdown script = /var/lib/samba/scripts/shutdown.sh
    + shutdown script = /var/lib/samba/scripts/shutdown.sh
    - abort shutdown script = /sbin/shutdown -c
    + abort shutdown script = /sbin/shutdown -c
    - logon script = scripts\logon.bat
    + logon script = scripts\logon.bat
    - logon path = \%L\profiles\%U
    + logon path = \%L\profiles\%U
    - logon drive = X:
    + logon drive = X:
    - logon home = \%L\%U
    + logon home = \%L\%U
    - domain logons = Yes
    + domain logons = Yes
    - preferred master = Yes
    + preferred master = Yes
    - include = /etc/samba/common.conf
    [homes]
    + include = /etc/samba/common.conf
    [homes]
    - comment = Home Directories
    + comment = Home Directories
    - valid users = %S
    + valid users = %S
    - read only = No
    + read only = No
    - browseable = No
    [netlogon]
    + browseable = No
    [netlogon]
    - comment = Network Logon Service
    + comment = Network Logon Service
    - path = /var/lib/samba/netlogon
    + path = /var/lib/samba/netlogon
    - guest ok = Yes
    + guest ok = Yes
    - locking = No
    [profiles]
    + locking = No
    [profiles]
    - comment = Profile Share
    + comment = Profile Share
    - path = /var/lib/samba/profiles
    + path = /var/lib/samba/profiles
    - read only = No
    + read only = No
    - profile acls = Yes

    Example 5.3. Common Samba Configuration File: /etc/samba/common.conf

    [global]
    + profile acls = Yes

    Example 5.3. Common Samba Configuration File: /etc/samba/common.conf

    [global]
    - username map = /etc/samba/smbusers
    + username map = /etc/samba/smbusers
    - log level = 1
    + log level = 1
    - syslog = 0
    + syslog = 0
    - log file = /var/log/samba/%m
    + log file = /var/log/samba/%m
    - max log size = 50
    + max log size = 50
    - smb ports = 139 445
    + smb ports = 139 445
    - name resolve order = wins bcast hosts
    + name resolve order = wins bcast hosts
    - time server = Yes
    + time server = Yes
    - printcap name = CUPS
    + printcap name = CUPS
    - show add printer wizard = No
    + show add printer wizard = No
    - shutdown script = /var/lib/samba/scripts/shutdown.sh
    + shutdown script = /var/lib/samba/scripts/shutdown.sh
    - abort shutdown script = /sbin/shutdown -c
    + abort shutdown script = /sbin/shutdown -c
    - utmp = Yes
    + utmp = Yes
    - map acl inherit = Yes
    + map acl inherit = Yes
    - printing = cups
    + printing = cups
    - veto files = /*.eml/*.nws/*.{*}/
    + veto files = /*.eml/*.nws/*.{*}/
    - veto oplock files = /*.doc/*.xls/*.mdb/
    + veto oplock files = /*.doc/*.xls/*.mdb/
    - include =
    # Share and Service Definitions are common to all servers
    [printers]
    + include =
    # Share and Service Definitions are common to all servers
    [printers]
    - comment = SMB Print Spool
    + comment = SMB Print Spool
    - path = /var/spool/samba
    + path = /var/spool/samba
    - guest ok = Yes
    + guest ok = Yes
    - printable = Yes
    + printable = Yes
    - use client driver = Yes
    + use client driver = Yes
    - default devmode = Yes
    + default devmode = Yes
    - browseable = No
    [apps]
    + browseable = No
    [apps]
    - comment = Application Files
    + comment = Application Files
    - path = /apps
    + path = /apps
    - admin users = bjordan
    + admin users = bjordan
    - read only = No

    Example 5.4. Server: BLDG1 (Member), File: smb.conf

    # Global parameters
    [global]
    + read only = No

    Example 5.4. Server: BLDG1 (Member), File: smb.conf

    # Global parameters
    [global]
    - workgroup = MEGANET
    + workgroup = MEGANET
    - netbios name = BLDG1
    + netbios name = BLDG1
    - include = /etc/samba/dom-mem.conf

    Example 5.5. Server: BLDG2 (Member), File: smb.conf

    # Global parameters
    [global]
    + include = /etc/samba/dom-mem.conf

    Example 5.5. Server: BLDG2 (Member), File: smb.conf

    # Global parameters
    [global]
    - workgroup = MEGANET
    + workgroup = MEGANET
    - netbios name = BLDG2
    + netbios name = BLDG2
    - include = /etc/samba/dom-mem.conf

    Example 5.6. Common Domain Member Include File: dom-mem.conf

    # Global parameters
    [global]
    + include = /etc/samba/dom-mem.conf

    Example 5.6. Common Domain Member Include File: dom-mem.conf

    # Global parameters
    [global]
    - shutdown script = /var/lib/samba/scripts/shutdown.sh
    + shutdown script = /var/lib/samba/scripts/shutdown.sh
    - abort shutdown script = /sbin/shutdown -c
    + abort shutdown script = /sbin/shutdown -c
    - preferred master = Yes
    + preferred master = Yes
    - wins server = 172.16.0.1
    + wins server = 172.16.0.1
    - idmap uid = 15000-20000
    + idmap uid = 15000-20000
    - idmap gid = 15000-20000
    + idmap gid = 15000-20000
    include = /etc/samba/common.conf

    Example 5.7. Server: MASSIVE, File: dhcpd.conf

     # Abmas Accounting Inc. - Chapter 5/MASSIVE
    @@ -1053,7 +1053,7 @@
     net groupmap add ntgroup="Financial Services"  unixgroup=finsrvcs type=d
     net groupmap add ntgroup="Insurance Group"     unixgroup=piops type=d
     

    Process Startup Configuration

    - + There are two essential steps to process startup configuration. A process must be configured so that it is automatically restarted each time the server is rebooted. This step involves use of the chkconfig tool that @@ -1062,7 +1062,7 @@ directories. Links are created so that when the system run-level is changed, the necessary start or kill script is run.

    - + In the event that a service is provided not as a daemon but via the inter-networking super daemon (inetd or xinetd), then the chkconfig tool makes the necessary entries in the /etc/xinetd.d directory @@ -1073,7 +1073,7 @@

    1. Use the standard system tool to configure each service to restart automatically at every system reboot. For example: - +

       root#  chkconfig dhpc on
       root#  chkconfig named on
      @@ -1082,9 +1082,9 @@
       root#  chkconfig swat on
       

    2. - - - + + + Now start each service to permit the system to be validated. Execute each of the following in the sequence shown: @@ -1101,8 +1101,8 @@

      1. Install MS Windows XP Professional. During installation, configure the client to use DHCP for TCP/IP protocol configuration. - - + + DHCP configures all Windows clients to use the WINS Server address that has been defined for the local subnet.

      2. @@ -1190,7 +1190,7 @@ user, of course.

      3. Instruct all users to log onto the workstation using their assigned user name and password. -

    Key Points Learned

    +

    Key Points Learned

    The network you have just deployed has been a valuable exercise in forced constraint. You have deployed a network that works well, although you may soon start to see performance problems, at which time the modifications demonstrated in the following @@ -1206,33 +1206,33 @@ to resources on the Domain Member servers

  • The introduction of roaming profiles -

  • Questions and Answers

    -

    Questions and Answers

    +

    The example smb.conf files in this chapter make use of the include facility. How may I get to see what the actual working smb.conf settings are? -
    +
    Why does the include file common.conf have an empty include statement? -
    +
    I accept that the simplest configuration necessary to do the job is the best. The use of tdbsam passdb backend is much simpler than having to manage an LDAP-based ldapsam passdb backend. I tried using rsync to replicate the passdb.tdb, and it seems to work fine! So what is the problem? -
    +
    You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? -
    +
    How does the Windows client find the PDC? -
    +
    Why did you enable IP forwarding (routing) only on the server called MASSIVE? -
    +
    You did nothing special to implement roaming profiles. Why? -
    +
    On the Domain Member computers, you configured winbind in the /etc/nsswitch.conf file. You did not configure any PAM settings. Is this an omission? -
    +
    You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this? -
    +
    The Domain Controller has an auto-shutdown script. Isn't that dangerous? -

    +

    The example smb.conf files in this chapter make use of the include facility. How may I get to see what the actual working smb.conf settings are?

    @@ -1240,7 +1240,7 @@

     root#  testparm -s | less
     

    -

    +

    Why does the include file common.conf have an empty include statement?

    The use of the empty include statement nullifies further includes. For example, let's say you @@ -1253,7 +1253,7 @@ If the include parameter was not in the common.conf file, the final smb.conf file leaves the include in place, even though the file it points to has already been included. This is a bug that will be fixed at a future date. -

    +

    I accept that the simplest configuration necessary to do the job is the best. The use of tdbsam passdb backend is much simpler than having to manage an LDAP-based ldapsam passdb backend. I tried using rsync to replicate the passdb.tdb, and it seems to work fine! @@ -1263,7 +1263,7 @@ contents between the PDC and BDCs. The most notable symptom is that workstations may not be able to log onto the network following a reboot and may have to re-join the Domain to recover network access capability. -

    +

    You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash?

    No. It is possible to have as many DHCP servers on a network segment as makes sense. A DHCP server @@ -1272,26 +1272,26 @@

    The only exception to this rule is when the client makes a directed request from a specific DHCP server for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash. -

    +

    How does the Windows client find the PDC?

    The Windows client obtains the WINS server address from the DHCP lease information. It also obtains from the DHCP lease information the parameter that causes it to use directed UDP (UDP Unicast) to register itself with the WINS server and to obtain enumeration of vital network information to enable it to operate successfully. -

    +

    Why did you enable IP forwarding (routing) only on the server called MASSIVE?

    The server called MASSIVE is acting as a router to the Internet. No other server (BLDG1 or BLDG2) has any need for IP forwarding since they are attached only to their own network. Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network segments to the router that is its gateway to them. -

    +

    You did nothing special to implement roaming profiles. Why?

    Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional clients is to use roaming profiles. -

    +

    On the Domain Member computers, you configured winbind in the /etc/nsswitch.conf file. You did not configure any PAM settings. Is this an omission?

    @@ -1300,7 +1300,7 @@ Member servers using Windows networking user names and passwords, it is necessary to configure PAM to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name service switcher (NSS). -

    +

    You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this?

    Oh, I did not think you would notice that. It is there so that it can be used. This is more fully discussed @@ -1309,7 +1309,7 @@ of smb.conf include files because SWAT optimizes them out into an aggregated file but leaves in place a broken reference to the top layer include file. SWAT was not designed to handle this functionality gracefully. -

    +

    The Domain Controller has an auto-shutdown script. Isn't that dangerous?

    Well done, you spotted that! I guess it is dangerous. It is good to know that you can do this, though. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/DomApps.html samba-3.0.10/docs/htmldocs/Samba-Guide/DomApps.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/DomApps.html 2004-11-15 10:15:40.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/DomApps.html 2004-12-15 10:23:50.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 11. Integrating Additional Services

    Chapter 11. Integrating Additional Services

    +Chapter 11. Integrating Additional Services

    Chapter 11. Integrating Additional Services

    You've come a long way now. You have pretty much mastered Samba-3 for most uses it can be put to. Up until now, you have cast Samba-3 in the leading role and where authentication was required, you have used one or another of @@ -9,7 +9,7 @@ implementing Samba and Samba-supported services in a domain controlled by the latest Windows authentication technologies. Let's get started this is leading edge. -

    Introduction

    +

    Introduction

    Abmas has continued its miraculous growth; indeed, nothing seems to be able to stop its diversification into multiple (and seemingly unrelated) fields. Its latest acquisition is Abmas Snack Foods, a big player in the snack-food @@ -25,13 +25,13 @@ You have decided to set the ball rolling by introducing Samba-3 into the network gradually, taking over key services and easing the way to a full migration and, therefore, integration into Abmas's existing business later. -

    Assignment Tasks

    +

    Assignment Tasks

    You've promised the skeptical Abmas Snack Foods management team that you can show them how Samba can ease itself and other Open Source technologies into their existing infrastructure and deliver sound business advantages. Cost cutting is high on their agenda (a major promise of the acquisition). You have chosen Web proxying and caching as your proving ground. -

    +

    Abmas Snack Foods has several thousand users housed at their Head Office and multiple regional offices, plants, and warehouses. A high proportion of the business's work is done online, so Internet access for most of these @@ -40,7 +40,7 @@ team. The bandwidth requirements were horrific (comparable to a small ISP), and the team soon discovered proxying and caching. In fact, they became one of the earliest commercial users of Microsoft ISA. -

    +

    The team is not happy with ISA. Because it never lived up to its marketing promises, it under-performed and had reliability problems. You have pounced on the opportunity to show what Open Source can do. The one thing they do like, however, is ISA's @@ -51,7 +51,7 @@

    This is a hands-on exercise. You build software applications so that you obtain the functionality Abmas needs. -

    Dissection and Discussion

    +

    Dissection and Discussion

    The key requirements in this business example are straightforward. You are not required to do anything new, just to replicate an existing system, not lose any existing features, and improve performance. The key points are: @@ -61,7 +61,7 @@ Distributed system to accommodate load and geographical distribution of users

  • Seamless and transparent interoperability with the existing Active Directory domain -

  • Technical Issues

    +

    Technical Issues

    Functionally, the user's Internet Explorer requests a browsing session with the Squid proxy, for which it offers its AD authentication token. Squid hands off the authentication request to the Samba-3 authentication helper application @@ -82,21 +82,21 @@ Configuring, compiling, and then installing the supporting Samba-3 components

  • Tying it all together -

  • Political Issues

    +

    Political Issues

    You are a stranger in a strange land and all eyes are upon you. Some would even like to see you fail. For you to gain the trust of your newly acquired IT people, it is essential that your solution does everything the old one did, but does it better in every way. Only then will the entrenched positions consider taking up your new way of doing things on a wider scale. -

    Implementation

    +

    Implementation

    First, your system needs to be prepared and in a known good state to proceed. This consists of making sure that everything the system depends on is present and that everything that could interfere or conflict with the system is removed. You will be configuring the Squid and Samba-3 packages and updating them if necessary. If conflicting packages of these programs are installed, they must be removed. -

    +

    The following packages should be available on your Red Hat Linux system: -

    • +

      • krb5-libs

      • krb5-devel @@ -106,13 +106,13 @@ krb5-server

      • pam_krb5 -

      +

    In the case of SUSE Linux, these packages are called:

    • heimdal-lib

    • heimdal-devel -

    • +

    • heimdal

    • pam_krb5 @@ -120,18 +120,18 @@ If the required packages are not present on your system, you must install them from the vendor's installation media. Follow the administrative guide for your Linux system to ensure that the packages are correctly updated. -

      Note

      +

      Note

      If the requirement is for interoperation with MS Windows Server 2003, it will be necessary to ensure that you are using MIT Kerberos version 1.3.1 or later. Red Hat Linux 9 ships with MIT Kerberos 1.2.7 and thus requires updating. -

      +

      Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version. -

      Removal of Pre-existing Conflicting RPMs

      +

      Removal of Pre-existing Conflicting RPMs

      If Samba and/or Squid rpms are installed, they should be updated. You can build both from source. -

      +

      Locating the packages to be uninstalled can be achieved by running:

       root#  rpm -qa | grep -i samba
      @@ -141,14 +141,14 @@
       

       root#  rpm -e samba-common
       

      -

      Kerberos Configuration

      +

      Kerberos Configuration

      The systems Kerberos installation must be configured to communicate with your primary Active Directory server (ADS KDC).

      Strictly speaking, MIT Kerberos version 1.3.1 currently gives the best results, although the current default Red Hat MIT version 1.2.7 gives acceptable results unless you are using Windows 2003 servers. -

      +

      Officially, neither MIT (1.3.1) nor Heimdal (0.6) Kerberos needs an /etc/krb5.conf file in order to work correctly. All ADS domains automatically create SRV records in the DNS zone Kerberos.REALM.NAME for each KDC in the realm. Since both @@ -156,11 +156,11 @@ automatically find the KDCs. In addition, krb5.conf only allows specifying a single KDC, even there if there is more than one. Using the DNS lookup allows the KRB5 libraries to use whichever KDCs are available. -

      1. +

        1. If you find the need to manually configure the krb5.conf, you should edit it to have the contents shown in ???. The final fully qualified path for this file should be /etc/krb5.conf. -

        2. +

        3. The following gotchas often catch people out. Kerberos is case sensitive. Your realm must be in UPPERCASE, or you will get an error: “Cannot find KDC for requested realm while getting initial credentials”. Kerberos is picky about time synchronization. The time @@ -175,7 +175,7 @@ /etc/hosts entry mapping the IP address of your KDC to its NetBIOS name. If Kerberos cannot do this reverse lookup, you will get a local error when you try to join the realm. -

        4. +

        5. You are now ready to test your installation by issuing the command:

           root#  kinit [USERNAME@REALM]
          @@ -195,21 +195,21 @@
           	LONDON.ABMAS.BIZ = {
           	kdc = w2k3s.london.abmas.biz
           	}
          -

        +

      The command:

       root#  klist -e 
       

      shows the Kerberos tickets cached by the system: -

      Samba Configuration

      +

      Samba Configuration

      Samba must be configured to correctly use Active Directory. Samba-3 must be used, as this has the necessary components to interface with Active Directory. -

      1. +

        1. Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team FTP site. The official Samba Team RPMs for Red Hat Fedora Linux contain the ntlm_auth tool needed, and are linked against MIT KRB5 version 1.3.1 and, therefore, are ready for use. -

          +

          The necessary, validated RPM packages for SUSE Linux may be obtained from the SerNet FTP site that is located in Germany. All SerNet RPMs are validated, have the necessary @@ -218,7 +218,7 @@

        2. Using your favorite editor, change the /etc/samba/smb.conf file so it has contents similar to the example shown in ???. -

        3. +

        4. Next you need to create a computer account in the Active Directory. This sets up the trust relationship needed for other clients to authenticate to the Samba server with an Active Directory Kerberos ticket. @@ -227,7 +227,7 @@

           root#  net ads join -U administrator%vulcon
           

          -

        5. +

        6. Your new Samba binaries must be started in the standard manner as is applicable to the platform you are running on. Alternately, start your Active Directory enabled Samba with the following commands: @@ -236,7 +236,7 @@ root# nmbd -D root# winbindd -B

          -

        7. +

        8. We now need to test that Samba is communicating with the Active Directory domain; most specifically, we want to see whether winbind is enumerating users and groups. Issue the following commands: @@ -268,7 +268,7 @@ LONDON+DnsUpdateProxy

          This enumerates all the groups in your Active Directory tree. -

        9. +

        10. Squid uses the ntlm_auth helper build with Samba-3. You may test ntlm_auth with the command:

          @@ -279,7 +279,7 @@
           

           root#  NT_STATUS_OK: Success (0x0)
           

          -

        11. +

        12. The ntlm_auth helper, when run from a command line as the user “root”, authenticates against your Active Directory domain (with the aid of winbind). It manages this by reading from the winbind privileged pipe. @@ -297,61 +297,61 @@ root# chgrp squid /var/lib/samba/winbindd_privileged root# chmod 750 /var/lib/samba/winbindd_privileged

          -

      NSS Configuration

      +

    NSS Configuration

    For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication.

    • Edit your /etc/nsswitch.conf file so it has the parameters shown in ???. -

    Example 11.2. Samba Configuration File: /etc/samba/smb.conf

    [global]
    +

    Example 11.2. Samba Configuration File: /etc/samba/smb.conf

    [global]
    - workgroup = LONDON
    + workgroup = LONDON
    - netbios name = W2K3S
    + netbios name = W2K3S
    - realm = LONDON.ABMAS.BIZ
    + realm = LONDON.ABMAS.BIZ
    - security = ads
    + security = ads
    - encrypt passwords = yes
    + encrypt passwords = yes
    - password server = w2k3s.london.abmas.biz
    # separate domain and username with '/', like DOMAIN/username
    + password server = w2k3s.london.abmas.biz
    # separate domain and username with '/', like DOMAIN/username
    - winbind separator = /
    # use UIDs from 10000 to 20000 for domain users
    + winbind separator = /
    # use UIDs from 10000 to 20000 for domain users
    - idmap uid = 10000-20000
    + idmap uid = 10000-20000
    - idmap gid = 10000-20000
    # allow enumeration of winbind users and groups
    + idmap gid = 10000-20000
    # allow enumeration of winbind users and groups
    - winbind enum users = yes
    + winbind enum users = yes
    - winbind enum groups = yes
    + winbind enum groups = yes
    winbind user default domain = yes

    Example 11.3. NSS Configuration File Extract File: /etc/nsswitch.conf

     passwd: files winbind
     shadow: files
     group: files winbind
    -

    Squid Configuration

    +

    Squid Configuration

    Squid must be configured correctly to interact with the Samba-3 components that handle Active Directory authentication. -

    Configuration

    1. +

    Configuration

    1. If your Linux distribution is SUSE Linux 9, the version of Squid supplied is already enabled to use the winbind helper agent. You can, therefore, omit the steps that would build the Squid binary programs. -

    2. +

    3. Squid, by default, runs as the user nobody. You need to add a system user squid and a system group squid if they are not set up already (if the default Red Hat squid rpms were installed, they will be). Set up a squid user in /etc/passwd and a squid group in /etc/group if these aren't there already. -

    4. +

    5. You now need to change the permissions on Squid's var directory. Enter the following command:

       root#  chown -R squid /var/cache/squid
       

      -

    6. +

    7. Squid must also have control over its logging. Enter the following commands:

       root#  chown -R chown squid:squid /var/log/squid
      @@ -364,10 +364,10 @@
       root#  chown -R chown squid:squid /var/cache/squid
       root#  chmod 770 /var/cache/squid
       

      -

    8. +

    9. The /etc/squid/squid.conf file must be edited to include the lines from ??? and ???. -

    10. +

    11. You must create Squid's cache directories before it may be run. Enter the following command:

       root#  squid -z
      @@ -394,14 +394,14 @@
       	auth_param basic credentialsttl 2 hours
       	acl AuthorizedUsers proxy_auth REQUIRED
       	http_access allow all AuthorizedUsers
      -

    Key Points Learned

    +

    Key Points Learned

    Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft Windows clients use, even when accessing traditional services such as Web browsers. Depending on whom you discuss this with, this is either good or bad. No matter how you might evaluate this, the use of NTLMSSP as the authentication protocol for Web proxy access has some advantages over the cookie-based authentication regime used by all competing browsers. It is Samba's implementation of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter. -

    Questions and Answers

    +

    Questions and Answers

    The development of the ntlm_auth module was first discussed in many Open Source circles in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of ntlm_auth during one of the late developer meetings that took place. Since that time, the @@ -420,44 +420,44 @@ You would be well advised to recognize the fact that all cache-intensive proxying solutions demand a lot of memory. Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk. -

    +

    What does Samba have to do with Web proxy serving? -
    +
    What other services does Samba provide? -
    +
    Does use of Samba (ntlm_auth) improve the performance of Squid? -

    +

    What does Samba have to do with Web proxy serving? -

    +

    To provide transparent interoperability between Windows clients and the network services that are used from them, Samba has had to develop tools and facilities that deliver that. The benefit of Open Source software is that it can readily be reused. The current ntlm_auth module is basically a wrapper around authentication code from the core of the Samba project. -

    +

    The ntlm_auth module supports basic plain-text authentication and NTLMSSP protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without the user being interrupted via his/her Windows logon credentials. This facility is available with MS Windows explorer and is one of the key benefits claimed for Microsoft Internet Information Server. There are a few open source initiatives to provide support for these protocols in the Apache Web server also. -

    +

    The short answer is that by adding a wrapper around key authentication components of Samba, other projects (like Squid) can benefit from the labors expended in meeting user interoperability needs. -

    +

    What other services does Samba provide? -

    +

    Samba-3 is a file and print server. The core components that provide this functionality are smbd, nmbd, and the Identity resolver daemon, winbindd. -

    +

    Samba-3 is an SMB/CIFS client. The core component that provides this is called smbclient. -

    +

    Samba-3 includes a number of helper tools, plug-in modules, utilities, and test/validation facilities. Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux servers and client. It includes Winbind agents that make it possible to authenticate UNIX/Linux access attempts as well as logins to an SMB/CIFS authentication server backend. Samba-3 includes name service switcher modules to permit Identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial server products). -

    +

    Does use of Samba (ntlm_auth) improve the performance of Squid?

    Not really. Samba's ntlm_auth module handles only authentication. It requires that diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/go01.html samba-3.0.10/docs/htmldocs/Samba-Guide/go01.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/go01.html 2004-11-15 10:15:42.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/go01.html 2004-12-15 10:23:52.000000000 -0600 @@ -1,4 +1,4 @@ -Glossary

    Glossary

    Access Control List

    +Glossary

    Glossary

    Access Control List

    A detailed list of permissions granted to users or groups with respect to file and network resource access.

    Active Directory Service

    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/HA.html samba-3.0.10/docs/htmldocs/Samba-Guide/HA.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/HA.html 2004-11-15 10:15:40.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/HA.html 2004-12-15 10:23:51.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 12. Performance, Reliability, and Availability

    Chapter 12. Performance, Reliability, and Availability

    +Chapter 12. Performance, Reliability, and Availability

    Chapter 12. Performance, Reliability, and Availability

    Well, you have reached the chapter before the Appendix. It is customary to attempt to wrap up the theme and contents of a book in what is generally regarded as the chapter that should draw conclusions. This book is a suspense thriller and since @@ -7,7 +7,7 @@ regarding some of the things everyone can do to deliver a reliable Samba-3 network.

     

    In a world so full of noise, how can the sparrow be heard? -

     
    --Anonymous 

    Introduction

    +

     
    --Anonymous 

    Introduction

    The sparrow is a small bird whose sounds are drowned out by the noise of the busy world it lives in. Likewise, the simple steps that can be taken to improve the reliability and availability of a Samba network are often drowned out by the volume @@ -15,17 +15,17 @@ suggest that clustering is not important, because clearly it is. This chapter does not devote itself to discussion of clustering because each clustering methodology uses its own custom tools and methods. Only passing comments are offered concerning these methods. -

    +

    A search for “samba cluster” produced 71,600 hits. And a search for “highly available samba” and “highly available windows” produced an amazing number of references. It is clear from the resources on the Internet that Windows file and print services availability, reliability, and scalability are of vital interest to corporate network users. -

    +

    So without further background, you can review a checklist of simple steps that can be taken to ensure acceptable network performance while keeping costs of ownership well under control. -

    Dissection and Discussion

    +

    Dissection and Discussion

    If it is your purpose to get the best mileage out of your Samba servers, there is one rule that must be obeyed. If you want the best, keep your implementation as simple as possible. You may well be forced to introduce some complexities, but you should do so only as a last resort. @@ -33,7 +33,7 @@ Simple solutions are likely to be easier to get right than are complex ones. They certainly make life easier for your successor. Simple implementations can be more readily audited than can complex ones. -

    +

    Problems reported by users fall into three categories: configurations that do not work, those that have broken behavior, and poor performance. The term broken behavior means that the function of a partciluar Samba component appears to work sometimes, but not at @@ -41,7 +41,7 @@ broken behavior known to many Windows networking users occurs when the list of Windows machines in MS Explorer changes, sometimes listing machines that are running and at other times not listing them even though the machines are in use on the network. -

    +

    A significant number of reports concern problems with the smbfs file system driver that is part of the Linux kernel, not part of Samba. Users continue to interpret that smbfs is part of Samba, simply because Samba includes the front-end tools @@ -50,24 +50,24 @@ facilities to core drivers that are supplied as part of the Linux kernel. These tools share a common infrastructure with some Samba components, but they are not maintained as part of Samba and are really foreign to it. -

    +

    The new project, cifsfs, is destined to replace smbfs. It, too, is not part of Samba, even though one of the Samba Team members is a prime mover in this project.

    The following table lists typical causes of: -

    • Not Working (NW)

    • Broken Behavior (BB)

    • Poor Performance (PP)

    Table 12.1. Effect of Common Problems

    Problem

    NW

    BB

    PP

    File Locking

    -

    X

    -

    Hardware Problems

    X

    X

    X

    Incorrect Authentication

    X

    X

    -

    Incorrect Configuration

    X

    X

    X

    LDAP Problems

    X

    X

    -

    Name Resolution

    X

    X

    X

    Printing Problems

    X

    X

    -

    Slow File Transfer

    -

    -

    X

    Winbind Problems

    X

    X

    -

    +

    • Not Working (NW)

    • Broken Behavior (BB)

    • Poor Performance (PP)

    Table 12.1. Effect of Common Problems

    Problem

    NW

    BB

    PP

    File Locking

    -

    X

    -

    Hardware Problems

    X

    X

    X

    Incorrect Authentication

    X

    X

    -

    Incorrect Configuration

    X

    X

    X

    LDAP Problems

    X

    X

    -

    Name Resolution

    X

    X

    X

    Printing Problems

    X

    X

    -

    Slow File Transfer

    -

    -

    X

    Winbind Problems

    X

    X

    -

    It is obvious to all that the first requirement (as a matter of network hygiene) is to eliminate problems that affect basic network operation. This book has provided sufficient working examples to help you to avoid all these problems. -

    Guidelines for Reliable Samba Operation

    +

    Guidelines for Reliable Samba Operation

    Your objective is to provide a network that works correctly, can grow at all times, is resilient at times of extreme demand, and can scale to meet future needs. The following subject areas provide pointers that can help you today. -

    Name Resolution

    +

    Name Resolution

    There are three basic current problem areas: bad hostnames, routed networks, and network collisions. These are covered in the discussion below. -

    Bad Hostnames

    +

    Bad Hostnames

    When configured as a DHCP client, a number of Linux distributions set the system hostname to localhost. If the parameter netbios name is not specified to something other than localhost, the Samba server appears @@ -78,11 +78,11 @@ set up a NetBIOS over TCP/IP connection to it. This cannot work, because that IP address is the local Windows machine itself. Hostnames must be valid for Windows networking to function correctly. -

    +

    A few sites have tried to name Windows clients and Samba servers with a name that begins with the digits 1-9. This does not work either because it may result in the client or server attempting to use that name as an IP address. -

    +

    A Samba server called FRED, in a NetBIOS Domain called COLLISION in a network environment that is part of the fully qualified Internet domain name space known as parrots.com, results in DNS name lookups for: fred.parrots.com @@ -90,31 +90,31 @@ (workgroup) collision.parrots.com since this results in DNS lookup attempts to resolve: fred.parrots.com.parrots.com, which most likely fails given that you probably do not have this in your DNS name space. -

    Note

    +

    Note

    An Active Directory realm called collision.parrots.com is perfectly okay, although it too must be capable of being resolved via DNS, something that functions correctly if Windows 200x ADS has been properly installed and configured. -

    Routed Networks

    +

    Routed Networks

    NetBIOS networks (Windows networking with NetBIOS over TCP/IP enabled) makes extensive use of UDP-based broadcast traffic. You saw that during the exercises in Chapter 1. -

    +

    UDP broadcast traffic is not forwarded by routers. This means that NetBIOS broadcast-based networking cannot function across routed networks (i.e., multi-subnet networks) unless special provisions are made: -

    • +

      • Either install on every Windows client an LMHOSTS file (located in the directory C:\windows\system32\drivers\etc). It is also necessary to add to the Samba server smb.conf file the parameters: remote announce and remote browse sync. For more information, refer to the on-line manual page for the smb.conf file. -

      • +

      • Or configure Samba as a WINS server, and configure all network clients to use that WINS server in their TCP/IP configuration. -

      Note

      +

    Note

    The use of DNS is not an acceptable substitute for WINS. DNS does not store specific information regarding NetBIOS networking particulars that does get stored in the WINS name resolution database, and that Windows clients require and depend on. -

    Network Collisions

    +

    Network Collisions

    Excessive network activity causes NetBIOS network time-outs. Time-outs may result in blue screen of death (BSOD) experiences. High collision rates may be caused by excessive UDP broadcast activity, by defective networking hardware, or through excessive network @@ -122,7 +122,7 @@

    The use of WINS is highly recommended to reduce network broadcast traffic, as outlined in Chapter 1. -

    +

    Under no circumstances should the facility be supported by many routers, known as NetBIOS forwarding, unless you know exactly what you are doing. Inappropriate use of this facility can result in UDP broadcast storms. In one case in 1999, a university network became @@ -130,10 +130,10 @@ testing of a Samba server. The maximum throughput on a 100-Base-T (100 MBit/sec) network was less than 15 KBytes/sec. After the NetBIOS forwarding was turned off, file transfer performance immediately returned to 11 MBytes/sec. -

    Samba Configuration

    +

    Samba Configuration

    As a general rule, the contents of the smb.conf file should be kept as simple as possible. No parameter should be specified unless you know it is essential to operation. -

    +

    Many UNIX administrators like to fully document the settings in the smb.conf file. This is a bad idea because it adds content to the file. The smb.conf file is re-read by every smbd process every time the file time stamp changes (or, on systems where this does not work, every 20 seconds or so). @@ -141,7 +141,7 @@ As the size of the smb.conf file grows the risk of introduction of parsing errors increases also. It is recommended to keep a fully documented smb.conf file on hand, and then to operate Samba only with an optimized file. -

    +

    The preferred way to maintain a documented file is to call it something like smb.conf.master. You can generate the optimized file by executing:

    @@ -167,7 +167,7 @@
     Server role: ROLE_DOMAIN_PDC
     Press enter to see a dump of your service definitions
     

    - + You now, of course, press the enter key to complete the command, or else abort it by pressing Ctrl-C. The important thing to note is the noted Server role, as well as warning messages. Noted configuration conflicts must be remedied before proceeding. For example, the following error message represents a @@ -176,18 +176,18 @@ ERROR: both 'wins support = true' and 'wins server = <server list>' cannot be set in the smb.conf file. nmbd will abort with this setting.

    -

    +

    There are two parameters that can cause severe network performance degradation, socket options and socket address. The socket options parameter was often necessary when Samba was used with the Linux 2.2.x kernels. Later kernels are largely self-tuning and seldom benefit from this parameter being set. Do not use either parameter unless it has been proven necessary to use them. -

    +

    Another smb.conf parameter that may cause severe network performance degradation is the strict sync parameter. Do not use this at all. There is no good reason to use this with any modern Windows client. The strict sync is often used together with the sync always parameter. This, too, can severely degrade network performance, so do not set it or if you must, do so with caution. -

    +

    Finally, many network administrators deliberately disable opportunistic locking support. While this does not degrade Samba performance, it significantly degrades Windows client performance because this disables local file caching on Windows clients and forces every file read and written to @@ -195,19 +195,19 @@ support, do so on the share on which it is required only. That way, all other shares can provide oplock support for operations that are tolerant of it. See ??? for more information. -

    Use and Location of BDCs

    +

    Use and Location of BDCs

    On a network segment where there is a PDC and a BDC, the BDC carries the bulk of the network logon processing. If the BDC is a heavily loaded server, the PDC carries a greater proportion of authentication and logon processing. When a sole BDC on a routed network segment gets heavily loaded, it is possible that network logon requests and authentication requests may be directed to a BDC on a distant network segment. This significantly hinders wide-area network operations and is undesirable. -

    +

    As a general guide, instead of adding Domain Member servers to a network, you would be better advised to add BDCs until there are fewer than 30 Windows clients per BDC. Beyond that ratio, you should add Domain Member servers. This practice ensures that there is always sufficient Domain Controllers to handle logon requests and authentication traffic. -

    Use One Consistent Version of MS Windows Client

    +

    Use One Consistent Version of MS Windows Client

    Every network client has its own peculiarities. From a management perspective, it is easier to deal with one version of MS Windows that is maintained to a consistent update level, than it is to deal with a mixture of clients. @@ -215,37 +215,37 @@ On a number of occasions, particular Microsoft service pack updates of a Windows server or client have necessitated special handling from the Samba server end. If you want to remain sane, keep you client workstation configurations consistent. -

    For Scalability, Use SAN Based Storage on Samba Servers

    +

    For Scalability, Use SAN Based Storage on Samba Servers

    Many SAN-based storage systems permit more than one server to share a common data store. Use of a shared SAN data store means that you do not need to use time- and resource-hungry data synchronization techniques. -

    +

    The use of a collection of relatively low-cost front-end Samba servers that are coupled to a shared backend SAN data store permits load distribution while containing costs below that of installing and managing a complex clustering facility. -

    Distribute Network Load with MSDFS

    +

    Distribute Network Load with MSDFS

    Microsoft DFS (distributed file system) technology has been implemented in Samba. MSDFS permits data to be accessed from a single share and yet to actually be distributed across multiple actual servers. Refer to TOSHARG, Chapter 16, for information regarding implementation of an MSDFS installation. -

    +

    The combination of multiple back end servers together with a front-end server and use of MSDFS can achieve almost the same as you would obtain with a clustered Samba server. -

    Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth

    +

    Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth

    Consider using rsync to replicate data across the wide-area network during times of low utilization. Users can then access the replicated data store rather than needing to do so across the wide-area network. This works best for read-only data, but with careful planning can be implemented so that modified files get replicated back to the point of origin. Be careful with your implementation if you choose to permit modification and return replication of the modified file; otherwise, you may inadvertently overwrite important data. -

    Hardware Problems

    +

    Hardware Problems

    Networking hardware prices have fallen sharply over the past five years. A surprising number of Samba networking problems over this time have been traced to defective network interface cards (NICs) or defective hubs, switches, and cables. -

    +

    Not surprising is the fact that network administrators do not like to be shown to have made a bad decision. Money saved in buying low-cost hardware may result in high costs incurred in corrective action. -

    +

    Defective NICs, hubs, and switches may appear as intermittent network access problems, intermittent or persistent data corruption, slow network throughput, low performance, or even as blue-screen-of-death (BSOD) problems with MS Windows clients. In one case, a company updated several workstations with newer, faster @@ -253,14 +253,14 @@ an older PC that was unaffected so long as the new machines were kept shut down.

    Defective hardware problems may take patience and persistence before the real cause can be discovered. -

    +

    Networking hardware defects can significantly impact perceived Samba performance, but defective RAID controllers as well as SCSI and IDE hard disk controllers have also been known to impair Samba server operations. One business came to this realization only after replacing a Samba installation with MS Windows Server 2000 running on the same hardware. The root of the problem completely eluded the network administrator until the entire server was replaced. While you may well think that this would never happen to you, experience shows that given the right (unfortunate) circumstances, this can happen to anyone. -

    Key Points Learned

    +

    Key Points Learned

    This chapter has touched in broad sweeps on a number of simple steps that can be taken to ensure that your Samba network is resilient, scalable, and reliable, and that it performs well. @@ -268,7 +268,7 @@ Always keep in mind that someone is responsible to maintain and manage your design. In the long term, that may not be you. Spare a thought for your successor and give him or her an even break. -

    +

    Last, but not least, you should not only keep the network design simple, but it should be well documented. This book may serve as your pattern for documenting every aspect of your design, its implementation, and particularly the objects and assumptions diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/happy.html samba-3.0.10/docs/htmldocs/Samba-Guide/happy.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/happy.html 2004-11-15 10:15:36.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/happy.html 2004-12-15 10:23:46.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 6. Making Users Happy

    Chapter 6. Making Users Happy

    +Chapter 6. Making Users Happy

    Chapter 6. Making Users Happy

    It has been said, “A day that is without troubles is not fulfilling. Rather, give me a day of troubles well handled so that I can be content with my achievements.

    @@ -7,12 +7,12 @@ create problems for some network users. The following lists some of the problems that may occur:

    Users experiencing difficulty logging onto the network

    - + When a Windows client logs onto the network, many data packets are exchanged between the client and the server that is providing the network logon services. Each request between the client and the server must complete within a specific time limit. This is one of the primary factors that govern the installation of - + multiple domain controllers (usually called secondary or backup controllers). As a rough rule, there should be one such backup controller for every 30 to 150 clients. The actual limits are determined by network operational @@ -28,26 +28,26 @@ and a common rule is not to exceed 30 machines (Windows workstations plus Domain Member servers) per Domain Controller.

    Slow logons and log-offs

    - + Slow logons and log-offs may be caused by many factors that include: -

    • +

      • Excessive delays in the resolution of a NetBIOS name to its IP address. This may be observed when an overloaded domain controller is also the WINS server. Another cause may be the failure to use a WINS server (this assumes that there is a single network segment). -

      • +

      • Network traffic collisions due to overloading of the network segment one short-term workaround to this may be to replace network HUBs with Ether-switches. -

      • +

      • Defective networking hardware. Over the past few years, we have seen on the Samba mailing list a significant increase in the number of problems that were traced to a defective network interface controller, a defective HUB or Etherswitch, or defective cabling. In most cases, it was the erratic nature of the problem that ultimately pointed to the cause of the problem. -

      • +

      • Excessively large roaming profiles. This type of problem is typically the result of poor user eduction, as well as poor network management. It can be avoided by users not storing huge quantities of email in @@ -56,7 +56,7 @@ on the part of network management.

      - <listitem>

      + <listitem>

      You should verify that the Windows XP WebClient service is not running. The use of the WebClient service has been implicated in many Windows networking related problems. @@ -65,22 +65,22 @@

    Loss of access to network drives and printer resources

    Loss of access to network resources during client operation may be caused by a number of factors including: -

    • +

      • Network overload (typically indicated by a high network collision rate)

      • Server overload -

      • +

      • Timeout causing the client to close a connection that is in use, but has been latent (no traffic) for some time (5 minutes or more) -

      • +

      • Defective networking hardware -

      +

    No matter what the cause, a sudden operational loss of access to network resources can result in BSOD (blue screen of death) situations that necessitate rebooting of the client workstation. In the case of a mild problem, retrying to access the network drive of printer may restore operations, but in any case this is a serious problem as it may lead to the next problem, data corruption. -

    Potential data corruption

    +

    Potential data corruption

    Data corruption is one of the most serious problems. It leads to uncertainty, anger, and frustration, and generally precipitates immediate corrective demands. Management response to this type of problem may be rational, as well as highly irrational. There have been @@ -94,7 +94,7 @@ anticipate and to combat network performance issues. You can work through complex and thorny methods to improve the reliability of your network environment, but be warned that all such steps demand the price of complexity. -

    Introduction

    +

    Introduction

    Mr. Bob Jordan just opened an email from Christine that reads:

    Bob, @@ -122,7 +122,7 @@ the well being of Abmas. Please acknowledge this advice with consent to proceed as required to regain control of our vital IT operations.

     
    --Christine 

    -

    +

    Every compromise has consequences. Having a large routed (i.e., multi-segment) network with only a single domain controller is a poor design that has obvious operational effects that may frustrate users. Here is Bob's reply: @@ -133,37 +133,37 @@ Please let Stan know what the estimated cost will be so I can approve the expense. Do not wait for approval; I appreciate the urgency.

     
    --Bob 

    -

    Assignment Tasks

    +

    Assignment Tasks

    The priority of assigned tasks in this chapter is: -

    1. +

      1. Implement Backup Domain Controllers (BDCs) in each building. This involves a change from use of a tdbsam backend that was used in the previous chapter, to use an LDAP-based backend.

        You can implement a single central LDAP server for this purpose. -

      2. +

      3. Rectify the problem of excessive logon times. This involves redirection of folders to network shares as well as modification of all user desktops to exclude the redirected folders from being loaded at login time. You can also create a new default profile that can be used for all new users. -

      +

    You configure a new MS Windows XP Professional Workstation disk image that you roll out to all desktop users. The instructions you have created are followed on a staging machine from which all changes can be carefully tested before inflicting them on your network users. -

    +

    This is the last network example in which specific mention of printing is made. The example again makes use of the CUPS printing system. -

    Dissection and Discussion

    +

    Dissection and Discussion

    The implementation of Samba BDCs necessitates the installation and configuration of LDAP. For this site, you use OpenLDAP, the open source software LDAP server platform. Commercial LDAP servers in current use with Samba-3 include: -

    • Novell eDirectory. +

      • Novell eDirectory. eDirectory is being successfully used by some sites. Information on how to use eDirectory can be - obtained from the Samba mailing lists or from Novell.

      • IBM + obtained from the Samba mailing lists or from Novell.

      • IBM Tivoli Directory Server, can be used to provide the Samba LDAP backend. Example schema files are provided in the Samba - source code tarball under the directory ~samba/example/LDAP.

      • Sun + source code tarball under the directory ~samba/example/LDAP.

      • Sun ONE Identity Server. This product suite provides an LDAP server that can be used for Samba. Example schema files are provided in the Samba source code tarball under the directory @@ -173,13 +173,13 @@ offerings, it requires that you manually edit the server configuration files and manually initialize the LDAP directory database. OpenLDAP itself has only command line tools to help you to get OpenLDAP and Samba-3 running as required, albeit with some learning curve challenges. -

        +

        For most sites, the deployment of Microsoft Active Directory from the shrink-wrapped installation is quite adequate. If you are migrating from Microsoft Active Directory, be warned that OpenLDAP does not include GUI-based directory management tools. Even a simple task such as adding users to the OpenLDAP database requires an understanding of what you are doing, why you are doing it, and the tools that you must use. -

        +

        When installed and configured, an OpenLDAP Identity Management backend for Samba functions well. High availability operation may be obtained through directory replication/synchronization and master/slave server configurations. OpenLDAP is a mature platform to host the organizational @@ -188,7 +188,7 @@ of management tools is well rewarded by performance and flexibility, and the freedom to manage directory contents with greater ability to back up, restore, and modify the directory than is generally possible with Microsoft Active Directory. -

        +

        A comparison of OpenLDAP with Microsoft Active Directory does not do justice to either. OpenLDAP is an LDAP directory tool-set. Microsoft Active Directory Server is an implementation of an LDAP server that is largely pre-configured for a specific task orientation. It comes with a set of administrative tools that is entirely customized @@ -199,7 +199,7 @@ MS ADAM that provides more-generic LDAP services, yet it does not have the vanilla-like services of OpenLDAP. -

        +

        You may wish to consider outsourcing the development of your OpenLDAP directory to an expert, particularly if you find the challenge of learning about LDAP directories, schemas, configuration, and management tools, and the creation of shell and Perl scripts a bit @@ -229,26 +229,26 @@ OpenLDAP Web Site. Many people have found the book LDAP System Administration, written by Jerry Carter, quite useful. -

        +

        Mary's problems are due to two factors. First, the absence of a domain controller on the local network is the main cause of the errors that result in blue screen crashes. Second, Mary has a large profile that must be loaded over the wide-area network connection. This addition of BDCs on each network segment significantly improves overall network performance for most users, but this is not enough. You must gain control over user desktops, and this must be done in a way that wins their support and does not cause further loss of staff morale. The following procedures solve this problem. -

        +

        There is also an opportunity to implement smart printing features. You add this to the Samba configuration so that future printer changes can be managed without need to change desktop configurations.

        You add the ability to automatically download new printer drivers, even if they are not installed in the default desktop profile. Only one example of printing configuration is given. It is assumed that you can extrapolate the principles and use this to install all printers that may be needed. -

        Technical Issues

        +

        Technical Issues

        The solution provided is a minimal approach to getting OpenLDAP running as an identity management directory server for UNIX system accounts as well as for Samba. From the OpenLDAP perspective, UNIX system accounts are stored Posix schema extensions. Samba provides its own schema to permit storage of account attributes Samba needs. Samba-3 can use the LDAP backend to store: -

        • Windows Networking User Accounts

        • Windows NT Group Accounts

        • Mapping Information between UNIX Groups and Windows NT Groups

        • ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)

        +

        • Windows Networking User Accounts

        • Windows NT Group Accounts

        • Mapping Information between UNIX Groups and Windows NT Groups

        • ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)

        The use of LDAP with Samba-3 makes it necessary to store UNIX accounts as well as Windows Networking accounts in the LDAP backend. This implies the need to use the PADL LDAP tools. The resolution @@ -257,11 +257,11 @@ or from the LDAP backend. This requires the use of the PADL nss_ldap toolset that integrates with the name service switcher (NSS). The same requirements exist for resolution of the UNIX username to the UID. The relationships are demonstrated in ???. -

        Figure 6.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts

        The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts

        +

        Figure 6.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts

        The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts

        You configure OpenLDAP so that it is operational. Before deploying the OpenLDAP, you really ought to learn how to configure secure communications over LDAP so that sites security is not at risk. This is not covered in the following guidance. -

        +

        When OpenLDAP has been made operative, you configure the Primary Domain Controller (PDC) called MASSIVE. You initialize the Samba secrets.tdb @@ -270,21 +270,21 @@ hints are, of course, provided. You can also find on the enclosed CD-ROM, in the Chap06 directory, a few tools that help to manage user and group configuration. -

        +

        In order to effect folder redirection and to add robustness to the implementation, create a network Default Profile. All network users workstations are configured to use the new profile. Roaming profiles will automatically be deleted from the workstation when the user logs off. -

        +

        The profile is configured so that users cannot change the appearance of their desktop. This is known as a mandatory profile. You make certain that users are able to use their computers efficiently. -

        +

        A network logon script is used to deliver flexible but consistent network drive connections. -

        Roaming Profile Background

        +

        Roaming Profile Background

        As XP roaming profiles grow, so does the amount of time it takes to log in and out. -

        +

        An XP Roaming Profile consists of the HKEY_CURRENT_USER hive file NTUSER.DAT and a number of folders (My Documents, Application Data, Desktop, Start Menu, Templates, NetHood, Favorites, and so on). When a user logs onto the @@ -306,15 +306,15 @@ Java plug-in's cache (the .jpi_cache directory in the profile), as well as training the user to not place large files on the Desktop and to use his mapped home directory for saving documents instead of the My Documents folder. -

        +

        Using a folder other than My Documents is a nuisance for some users since many applications use it by default. -

        +

        The secret to rapid loading of roaming profiles is to prevent unnecessary data from being copied back and forth, without losing any functionality. This is not difficult; it can be done by making changes to the Local Group Policy on each client as well as changing some paths in each user's NTUSER.DAT hive. -

        +

        Every user profile has their own NTUSER.DAT file. This means you need to edit every user's profile, unless a better method can be followed. Fortunately, with the right preparations, this is not difficult. @@ -322,7 +322,7 @@ user's profile. Then just create a Network Default Profile. Of course, it is necessary to copy all files from redirected folders to the network share to which they are redirected. -

        The Local Group Policy

        +

        The Local Group Policy

        Without an Active Directory PDC, you cannot take full advantage of Group Policy Objects. However, you can still make changes to the Local Group Policy by using the Group Policy editor (gpedit.msc). @@ -336,13 +336,13 @@ Simply add the folders you do not wish to be copied back and forth to this semi-colon separated list. Note that this change must be made on all clients that are using roaming profiles. -

        Profile Changes

        +

        Profile Changes

        There are two changes that should be done to each user's profile. Move each of the directories that you have excluded from being copied back and forth out of the usual profile path. Modify each user's NTUSER.DAT file to point to the new paths that are shared over the network, instead of the default path (C:\Documents and Settings\%USERNAME%). -

        +

        The above modifies existing user profiles. So that newly created profiles have these settings, you will need to modify the NTUSER.DAT in the C:\Documents and Settings\Default User folder on each @@ -350,7 +350,7 @@ NTUSER.DAT to a Linux box and using regedt32. The basic method is described under ???. -

        Using a Network Default User Profile

        +

        Using a Network Default User Profile

        If you are using Samba as your PDC, you should create a file-share called NETLOGON and within that create a directory called Default User, which is a copy of the desired default user @@ -359,7 +359,7 @@ the first login from a new account pulls its configuration from it. See also: the Real Men Don't Click Web site. -

        Installation of Printer Driver Auto-Download

        +

        Installation of Printer Driver Auto-Download

        The subject of printing is quite topical. Printing problems run second place to name resolution issues today. So far in this book, you have experienced only what is generally known as “dumb” printing. Dumb printing is the arrangement where all drivers @@ -367,7 +367,7 @@ or intelligent processing. Dumb printing is easily understood. It usually works without many problems, but it has its limitations also. Dumb printing is better known as Raw Print Through printing. -

        +

        Samba permits the configuration of Smart printing using the Microsoft Windows point-and-click (also called drag-and-drop) printing. What this provides is essentially the ability to print to any printer. If the local client does not yet have a @@ -380,7 +380,7 @@ printing that automatically senses the file format of data submitted for printing and then invokes a suitable print filter to convert the incoming data stream into a format suited to the printer to which the job is dispatched. -

        +

        The CUPS printing subsystem is capable of intelligent printing. It has the capacity to detect the data format and apply a print filter. This means that it is feasible to install on all Windows clients a single printer driver for use with all printers that are routed @@ -397,12 +397,12 @@ This book is about Samba-3, so you can confine the printing style to just the smart style of installation. Those interested in further information regarding intelligent printing should review documentation on the Easy Software Products Web site. -

        Political Issues

        +

        Political Issues

        MS Windows network users are generally very sensitive to limits that may be imposed when confronted with locked-down workstation configurations. The challenge you face must be promoted as a choice between reliable and fast network operation, and a constant flux of problems that result in user irritation. -

        Installation Check-List

        +

        Installation Check-List

        You are starting a complex project. Even though you have gone through the installation of a complex network in chapter 5, this network is a bigger challenge because of the large number of complex applications that must be configured before the first few steps @@ -410,10 +410,10 @@ frequently review the steps ahead while making at least a mental note of what has already been completed. The following task list may help you to keep track of the task items that are covered: -

        • Samba-3 PDC Server Configuration

          1. DHCP and DNS Servers

          2. OpenLDAP Server

          3. PAM and NSS Client Tools

          4. Samba-3 PDC

          5. Idealx SMB-LDAP Scripts

          6. LDAP Initialization

          7. Create User and Group Accounts

          8. Printers

          9. Share Point Directory Roots

          10. Profile Directories

        • Samba-3 BDC Server Configuration

          1. DHCP and DNS Servers

          2. PAM and NSS Client Tools

          3. Printers

          4. Share Point Directory Roots

          5. Profiles Directories

        • Samba-3 BDC Server Configuration

        • Windows XP Client Configuration

          1. Default Profile Folder Redirection

          2. MS Outlook PST File Relocation

          3. Delete Roaming Profile on Logout

          4. Upload Printer Drivers to Samba Servers

          5. Install Software

          6. Creation of Roll-out Images

        Samba Server Implementation

        +

        • Samba-3 PDC Server Configuration

          1. DHCP and DNS Servers

          2. OpenLDAP Server

          3. PAM and NSS Client Tools

          4. Samba-3 PDC

          5. Idealx SMB-LDAP Scripts

          6. LDAP Initialization

          7. Create User and Group Accounts

          8. Printers

          9. Share Point Directory Roots

          10. Profile Directories

        • Samba-3 BDC Server Configuration

          1. DHCP and DNS Servers

          2. PAM and NSS Client Tools

          3. Printers

          4. Share Point Directory Roots

          5. Profiles Directories

        • Samba-3 BDC Server Configuration

        • Windows XP Client Configuration

          1. Default Profile Folder Redirection

          2. MS Outlook PST File Relocation

          3. Delete Roaming Profile on Logout

          4. Upload Printer Drivers to Samba Servers

          5. Install Software

          6. Creation of Roll-out Images

      Samba Server Implementation

      The network design shown in ??? is not comprehensive. It is assumed that you will install additional file servers, and possibly additional BDCs. -

      Figure 6.2. Network Topology 500 User Network Using ldapsam passdb backend.

      Network Topology 500 User Network Using ldapsam passdb backend.

      +

      Figure 6.2. Network Topology 500 User Network Using ldapsam passdb backend.

      Network Topology 500 User Network Using ldapsam passdb backend.

      All configuration files and locations are shown for SUSE Linux 9.0. The file locations for Red Hat Linux are similar. You may need to adjust the locations for your particular Linux system distribution/implementation. @@ -424,16 +424,16 @@ in that chapter. If you are starting with newly installed Linux servers, you must complete the steps shown in ??? before commencing at ???: -

      OpenLDAP Server Configuration

      +

      OpenLDAP Server Configuration

      Confirm that the packages shown in ??? are installed on your system.

      Table 6.1. Required OpenLDAP Linux Packages

      SUSE Linux 8.xSUSE Linux 9Red Hat Linux 9
      nss_ldapnss_ldapnss_ldap
      pam_ldappam_ldappam_ldap
      openldap2openldap2openldap
      openldap2-clientopenldap2-client 
       openldap2-back-perl 
       openldap2-back-monitor 
       openldap2-back-ldap 
       openldap2-back-meta 

      Samba-3 and OpenLDAP will have a degree of inter-dependence that is unavoidable. The method for boot-strapping the LDAP and Samba-3 configuration is relatively straight forward. If you follow these guidelines, the resulting system should work fine. -

      1. +

        1. Install the file shown in ??? in the directory /etc/openldap. -

        2. +

        3. Remove all files from the directory /var/lib/ldap, making certain that the directory exists with permissions:

          @@ -473,7 +473,7 @@
           index sambaPrimaryGroupSID  eq
           index sambaDomainName       eq
           index default               sub
          -

      PAM and NSS Client Configuration

      +

      PAM and NSS Client Configuration

      The steps that follow involve configuration of LDAP, Name Service Switch (NSS) LDAP-based resolution of users and groups. Also, so that LDAP-based accounts can log onto the system, the steps ahead configure the Pluggable Authentication Modules (PAM) to permit LDAP-based authentication. @@ -481,12 +481,12 @@ Since you have chosen to put UNIX user and group accounts into the LDAP database, it is likely that you may want to use them for UNIX system (Linux) local machine logons. This necessitates correct configuration of the Pluggable Authentication - Modules + Modules (PAM). The pam_ldap open source package provides the PAM modules that most people would use. On SUSE Linux systems, the pam_unix2.so module also has the ability to redirect authentication requests through LDAP. -

      +

      You have chosen to configure these services by directly editing the system files but, of course, you know that this configuration can be done using system tools provided by the Linux system vendor. SUSE Linux has a facility in YaST (the system admin tool) through yast->system->ldap-client that permits @@ -523,7 +523,7 @@ nss_base_passwd ou=People,dc=abmas,dc=biz?one nss_base_shadow ou=People,dc=abmas,dc=biz?one nss_base_group ou=Groups,dc=abmas,dc=biz?one -

      1. +

      1. Execute the following command to find where the nss_ldap module expects to find its control file:

        @@ -535,7 +535,7 @@
         		??? into the path that was obtained from the step above.
         		On the servers called BLDG1 and BLDG2, install the file shown in
         		??? into the path that was obtained from the step above.
        -		

      2. +

      3. Edit the NSS control file (/etc/nsswitch.conf) so that the lines that control user and group resolution will obtain information from the normal system files as well as from ldap as follows: @@ -549,7 +549,7 @@ added, you can validate resolution of the LDAP resolver process. The inclusion of WINS-based hostname resolution is deliberate so that all MS Windows client hostnames can be resolved to their IP addresses, whether or not they are DHCP clients. -

      4. +

      5. For PAM LDAP configuration on this SUSE Linux 9.0 system, the simplest solution is to edit the following files in the /etc/pam.d directory: login, password, samba, sshd. @@ -572,7 +572,7 @@ session required pam_unix2.so none use_ldap # debug or trace session required pam_limits.so

        -

        +

        On other Linux systems that do not have an LDAP-enabled pam_unix2.so module, you must edit these files by adding the pam_ldap.so modules as shown here:

        @@ -595,7 +595,7 @@
         		demonstrates the use of the pam_ldap.so module. You can use either
         		implementation, but if the pam_unix2.so on your system supports
         		LDAP, you probably want to use it, rather than add an additional module.
        -		

    Samba-3 PDC Configuration

    +

    Samba-3 PDC Configuration

    Verify that the Samba-3.0.2 (or later) packages are installed on each SUSE Linux server before following the steps below. If Samba-3.0.2 (or later) is not installed, you have the choice to either build your own or to obtain the packages from a dependable source. @@ -607,7 +607,7 @@ and ??? into the /etc/samba/ directory. The three files should be added together to form the smb.conf file. -

  • +

  • Verify the contents of the smb.conf file that is generated by Samba as it collates all the included files. You do this by executing:

    @@ -637,7 +637,7 @@
     root#  rm /var/lib/samba/*dat
     root#  rm /var/log/samba/*
     

    -

  • +

  • Samba-3 communicates with the LDAP server. The password that it uses to authenticate to the LDAP server must be stored in the secrets.tdb file. Execute the following to create the new secrets.tdb files @@ -649,7 +649,7 @@

     Setting stored password for "cn=Manager,dc=abmas,dc=biz" in secrets.tdb
     

    -

  • +

  • Samba-3 generates a Windows Security Identifier only when smbd has been started. For this reason, you start Samba. After a few seconds delay, execute: @@ -676,10 +676,10 @@

  • When a positive Domain SID has been reported, stop Samba.

  • - - - - + + + + Configure the NFS server for your Linux system. So you can complete the steps that follow, enter into the /etc/exports the following entry:

    @@ -697,91 +697,91 @@
     		

  • Your Samba-3 PDC is now ready to communicate with the LDAP password backend. Let's get on with configuration of the LDAP server. -

    Example 6.4. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A

    # Global parameters
    [global]
    +

    Example 6.4. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A

    # Global parameters
    [global]
    - unix charset = LOCALE
    + unix charset = LOCALE
    - workgroup = MEGANET2
    + workgroup = MEGANET2
    - netbios name = MASSIVE
    + netbios name = MASSIVE
    - interfaces = eth1, lo
    + interfaces = eth1, lo
    - bind interfaces only = Yes
    + bind interfaces only = Yes
    - passdb backend = ldapsam:ldap://massive.abmas.biz
    + passdb backend = ldapsam:ldap://massive.abmas.biz
    - username map = /etc/samba/smbusers
    + username map = /etc/samba/smbusers
    - log level = 1
    + log level = 1
    - syslog = 0
    + syslog = 0
    - log file = /var/log/samba/%m
    + log file = /var/log/samba/%m
    - max log size = 50
    + max log size = 50
    - smb ports = 139 445
    + smb ports = 139 445
    - name resolve order = wins bcast hosts
    + name resolve order = wins bcast hosts
    - time server = Yes
    + time server = Yes
    - printcap name = CUPS
    + printcap name = CUPS
    - show add printer wizard = No
    + show add printer wizard = No
    - add user script = /var/lib/samba/sbin/smbldap-useradd.pl -a -m '%u'
    + add user script = /var/lib/samba/sbin/smbldap-useradd.pl -a -m '%u'
    - delete user script = /var/lib/samba/sbin/smbldap-userdel.pl '%u'
    + delete user script = /var/lib/samba/sbin/smbldap-userdel.pl '%u'
    - add group script = /var/lib/samba/sbin/smbldap-groupadd.pl -p '%g'
    + add group script = /var/lib/samba/sbin/smbldap-groupadd.pl -p '%g'
    - delete group script = /var/lib/samba/sbin/smbldap-groupdel.pl '%g'
    + delete group script = /var/lib/samba/sbin/smbldap-groupdel.pl '%g'
    - add user to group script = /var/lib/samba/sbin/
    smbldap-groupmod.pl -m '%u' '%g'
    + add user to group script = /var/lib/samba/sbin/
    smbldap-groupmod.pl -m '%u' '%g'
    - delete user from group script = /var/lib/samba/sbin/
    smbldap-groupmod.pl -x '%u' '%g'
    + delete user from group script = /var/lib/samba/sbin/
    smbldap-groupmod.pl -x '%u' '%g'
    - set primary group script = /var/lib/samba/sbin/
    smbldap-usermod.pl -g '%g' '%u'
    + set primary group script = /var/lib/samba/sbin/
    smbldap-usermod.pl -g '%g' '%u'
    - add machine script = /var/lib/samba/sbin/
    smbldap-useradd.pl -w '%u'
    + add machine script = /var/lib/samba/sbin/
    smbldap-useradd.pl -w '%u'
    - logon script = scripts\logon.bat
    + logon script = scripts\logon.bat
    - logon path = \\%L\profiles\%U
    + logon path = \\%L\profiles\%U
    - logon drive = X:
    + logon drive = X:
    - domain logons = Yes
    + domain logons = Yes
    - preferred master = Yes
    + preferred master = Yes
    - wins support = Yes
    + wins support = Yes
    - ldap suffix = dc=abmas,dc=biz
    + ldap suffix = dc=abmas,dc=biz
    - ldap machine suffix = ou=People
    + ldap machine suffix = ou=People
    - ldap user suffix = ou=People
    + ldap user suffix = ou=People
    - ldap group suffix = ou=Groups

    Example 6.5. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B

    + ldap group suffix = ou=Groups

    Example 6.5. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B

    - ldap idmap suffix = ou=Idmap
    + ldap idmap suffix = ou=Idmap
    - ldap admin dn = cn=Manager,dc=abmas,dc=biz
    + ldap admin dn = cn=Manager,dc=abmas,dc=biz
    - idmap backend = ldap:ldap://massive.abmas.biz
    + idmap backend = ldap:ldap://massive.abmas.biz
    - idmap uid = 10000-20000
    + idmap uid = 10000-20000
    - idmap gid = 10000-20000
    + idmap gid = 10000-20000
    - map acl inherit = Yes
    + map acl inherit = Yes
    - printing = cups
    + printing = cups
    - printer admin = Administrator, chrisr

    Install and Configure Idealx SMB-LDAP Scripts

    + printer admin = Administrator, chrisr

    Install and Configure Idealx SMB-LDAP Scripts

    The Idealx scripts, or equivalent, are necessary to permit Samba-3 to manage accounts on the LDAP server. You have chosen the Idealx scripts since they are part of the Samba-3 package distribution. On your SUSE Linux system, you find these scripts in the @@ -817,7 +817,7 @@ root# cd /usr/share/doc/packages/samba3/Examples/LDAP/smbldap-tools root# cp *.pl *.pm /var/lib/samba/sbin

    -

  • +

  • You must compile the mkntpasswd tool and then install it into the /var/lib/samba/sbin directory, as shown here:

    @@ -929,7 +929,7 @@
     root#  chmod 555 /var/lib/samba/sbin/mkntpwd
     

    The smbldap-tools scripts are now ready for use. -

  • LDAP Initialization and Creation of User and Group Accounts

    +

    LDAP Initialization and Creation of User and Group Accounts

    The LDAP database must be populated with well-known Windows Domain user accounts and Domain Group accounts before Samba can be used. The following procedures step you through the process.

    @@ -941,7 +941,7 @@ does not need to ask LDAP.

    Addition of an account to the LDAP backend can be done in a number of ways: -

    +

    If you always have a user account in the /etc/passwd on every server or in a NIS(+) backend, it is not necessary to add Posix accounts for them in LDAP. In this case, you can add Windows Domain user accounts using the @@ -953,15 +953,15 @@ In the example system you are installing in this exercise, you are making use of the Idealx smbldap-tools scripts. A copy of these tools, pre-configured for this system, is included on the enclosed CD-ROM under Chap06/Tools. -

    +

    If you wish to have more control over how the LDAP database is initialized or want not to use the Idealx smbldap-tools, you should refer to ???. -

    +

    The following steps initialize the LDAP database, and then you can add user and group accounts that Samba can use. You use the smbldap-populate.pl to seed the LDAP database. You then manually add the accounts shown in ???. The list of users does not cover all 500 network users; it provides examples only. -

    Note

    +

    Note

    In the following examples, as the LDAP database is initialized, we do create a container for Computer (machine) accounts. In the Samba-3 smb.conf files, specific use is made of the People container, not the Computers container, for domain member accounts. This is not a @@ -1011,7 +1011,7 @@ Shutting down ldap-server done Starting ldap-server done

    -

  • +

  • So that we can use a global IDMAP repository the LDAP directory must have a container object for IDMAP data. There are several ways you can check that your LDAP database is able to receive IDMAP information. One of the simplest is to execute: @@ -1020,7 +1020,7 @@ dn: ou=Idmap,dc=abmas,dc=biz ou: idmap

    - + If the execution of this command does not return IDMAP entries, you need to create an LDIF template file (see ???). You can add the required entries using the following command: @@ -1029,7 +1029,7 @@ -w not24get < /etc/openldap/idmap.LDIF

    Samba automatically populates this LDAP directory container when it needs to. -

  • +

  • It looks like all has gone well, as expected. Let's confirm that this is the case by running a few tests. First we check the contents of the database directly by running slapcat as follows (the output has been cut down): @@ -1066,7 +1066,7 @@ modifyTimestamp: 20031217234206Z

    This looks good so far. -

  • +

  • The next step is to prove that the LDAP server is running and responds to a search request. Execute the following as shown (output has been cut to save space):

    @@ -1110,7 +1110,7 @@
     # numEntries: 19
     

    Good. It is all working just fine. -

  • +

  • You must now make certain that the NSS resolver can interrogate LDAP also. Execute the following commands:

    @@ -1122,10 +1122,10 @@
     Domain Users:x:513:
     Domain Guests:x:514:
     Domain Computers:x:553:
    -

    +

    This demonstrates that the nss_ldap library is functioning as it should. -

  • +

  • Our database is now ready for the addition of network users. For each user for whom an account must be created, execute the following:

    @@ -1140,7 +1140,7 @@
     Retype new SMB password: XXXXXXXX
     

    Where username is the login ID for each user. -

  • +

  • Now verify that the UNIX (Posix) accounts can be resolved via NSS by executing the following:

    @@ -1157,7 +1157,7 @@
     uid=1002(chrisr) gid=513(Domain Users) groups=513(Domain Users)
     

    This confirms that the UNIX (Posix) user accounts can be resolved from LDAP. -

  • +

  • In the above listing, you can see that the user Administrator has been given UID=998. This means that operations conducted from a Windows client using tools such as the Domain User Manager fails under UNIX because the @@ -1180,7 +1180,7 @@ drwx------ 7 stans Domain Users 568 Dec 17 01:43 stans/

    This is precisely what we want to see. -

  • +

  • The final validation step involves making certain that Samba-3 can obtain the user accounts from the LDAP ldapsam passwd backend. Execute the following command as shown:

    @@ -1207,7 +1207,7 @@
     Password must change: Mon, 18 Jan 2038 20:14:07 GMT
     

    This looks good. Of course, you fully expected that it would all work, didn't you? -

  • +

  • Now you add the group accounts that are used on the Abmas network. Execute the following exactly as shown:

    @@ -1217,7 +1217,7 @@
     

    The addition of groups does not involve keyboard interaction, so the lack of console output is of no concern. -

  • +

  • You really do want to confirm that UNIX group resolution from LDAP is functioning as it should. Let's do this as shown here:

    @@ -1233,7 +1233,7 @@
     

    The well-known special accounts (Domain Admins, Domain Users, Domain Guests), as well as our own site-specific group accounts, are correctly listed. This is looking good. -

  • +

  • The final step we need to validate is that Samba can see all the Windows Domain Groups and that they are correctly mapped to the respective UNIX group account. To do this, just execute the following command: @@ -1282,7 +1282,7 @@

     root#  rcwinbind restart
     

    -

  • +

  • You may now check Samba-3 operation as follows:

     root#  smbclient -L massive -U%
    @@ -1327,7 +1327,7 @@
     		Well done. All is working fine.
     		

  • The server MASSIVE is now configured, and it is time to move onto the next task. -

    Printer Configuration

    +

    Printer Configuration

    The configuration for Samba-3 to enable CUPS raw-print-through printing has already been taken care of in the smb.conf file. The only preparation needed for smart @@ -1345,16 +1345,16 @@ Follow the instructions in the printer manufacturers' manuals to permit printing to port 9100. Use any other port the manufacturer specifies for direct mode, raw printing. This allows the CUPS spooler to print using raw mode protocols. - - -

  • - + + +

  • + Only on the server to which the printer is attached, configure the CUPS Print Queues as follows:

     root#  lpadmin -p printque -v socket://printer-name.abmas.biz:9100 -E
     

    - + This step creates the necessary print queue to use no assigned print filter. This is ideal for raw printing, i.e., printing without use of filters. The name printque is the name you have assigned for @@ -1374,15 +1374,15 @@ root# /usr/bin/accept printque

  • - - - + + + Edit the file /etc/cups/mime.convs to uncomment the line:

     application/octet-stream     application/vnd.cups-raw      0     -
     

  • - + Edit the file /etc/cups/mime.types to uncomment the line:

     application/octet-stream
    @@ -1444,7 +1444,7 @@
     bldg1$:x:1006:553:bldg1$:/dev/null:/bin/false
     

    This is the correct output. If the accounts that have UIDs above 512 are not shown, there is a problem. -

  • +

  • The next step in the verification process involves testing the operation of UNIX group resolution via the NSS LDAP resolver. Execute these commands:

    @@ -1474,7 +1474,7 @@
     		This is also the correct and desired output, because it demonstrates that the LDAP client
     		is able to communicate correctly with the LDAP server
     	    (MASSIVE).
    -		

  • +

  • You must now set the LDAP administrative password into the Samba-3 secrets.tdb file by executing this command: @@ -1507,7 +1507,7 @@

    This indicates that the Domain security account for the BDC has been correctly created.

  • - + Verify that user and group account resolution works via Samba-3 tools as follows:

     root#  pdbedit -L
    @@ -1590,219 +1590,219 @@
     		should be added together to form the smb.conf file.
     		

  • Follow carefully the steps shown in ???, starting at step 2. -

  • Example 6.6. LDAP Based smb.conf File, Server: BLDG1

    # Global parameters
    [global]
    +

    Example 6.6. LDAP Based smb.conf File, Server: BLDG1

    # Global parameters
    [global]
    - unix charset = LOCALE
    + unix charset = LOCALE
    - workgroup = MEGANET2
    + workgroup = MEGANET2
    - netbios name = BLDG1
    + netbios name = BLDG1
    - passdb backend = ldapsam:ldap://massive.abmas.biz
    + passdb backend = ldapsam:ldap://massive.abmas.biz
    - username map = /etc/samba/smbusers
    + username map = /etc/samba/smbusers
    - log level = 1
    + log level = 1
    - syslog = 0
    + syslog = 0
    - log file = /var/log/samba/%m
    + log file = /var/log/samba/%m
    - max log size = 50
    + max log size = 50
    - smb ports = 139 445
    + smb ports = 139 445
    - name resolve order = wins bcast hosts
    + name resolve order = wins bcast hosts
    - printcap name = CUPS
    + printcap name = CUPS
    - show add printer wizard = No
    + show add printer wizard = No
    - logon script = scripts\logon.bat
    + logon script = scripts\logon.bat
    - logon path = \\%L\profiles\%U
    + logon path = \\%L\profiles\%U
    - logon drive = X:
    + logon drive = X:
    - domain logons = Yes
    + domain logons = Yes
    - domain master = No
    + domain master = No
    - wins server = 172.16.0.1
    + wins server = 172.16.0.1
    - ldap suffix = dc=abmas,dc=biz
    + ldap suffix = dc=abmas,dc=biz
    - ldap machine suffix = ou=People
    + ldap machine suffix = ou=People
    - ldap user suffix = ou=People
    + ldap user suffix = ou=People
    - ldap group suffix = ou=Groups
    + ldap group suffix = ou=Groups
    - ldap idmap suffix = ou=Idmap
    + ldap idmap suffix = ou=Idmap
    - ldap admin dn = cn=Manager,dc=abmas,dc=biz
    + ldap admin dn = cn=Manager,dc=abmas,dc=biz
    - idmap backend = ldap:ldap://massive.abmas.biz
    + idmap backend = ldap:ldap://massive.abmas.biz
    - idmap uid = 10000-20000
    + idmap uid = 10000-20000
    - idmap gid = 10000-20000
    + idmap gid = 10000-20000
    - printing = cups
    + printing = cups
    - printer admin = Administrator, chrisr

    Example 6.7. LDAP Based smb.conf File, Server: BLDG2

    # Global parameters
    [global]
    + printer admin = Administrator, chrisr

    Example 6.7. LDAP Based smb.conf File, Server: BLDG2

    # Global parameters
    [global]
    - unix charset = LOCALE
    + unix charset = LOCALE
    - workgroup = MEGANET2
    + workgroup = MEGANET2
    - netbios name = BLDG2
    + netbios name = BLDG2
    - passdb backend = ldapsam:ldap://massive.abmas.biz
    + passdb backend = ldapsam:ldap://massive.abmas.biz
    - username map = /etc/samba/smbusers
    + username map = /etc/samba/smbusers
    - log level = 1
    + log level = 1
    - syslog = 0
    + syslog = 0
    - log file = /var/log/samba/%m
    + log file = /var/log/samba/%m
    - max log size = 50
    + max log size = 50
    - smb ports = 139 445
    + smb ports = 139 445
    - name resolve order = wins bcast hosts
    + name resolve order = wins bcast hosts
    - printcap name = CUPS
    + printcap name = CUPS
    - show add printer wizard = No
    + show add printer wizard = No
    - logon script = scripts\logon.bat
    + logon script = scripts\logon.bat
    - logon path = \\%L\profiles\%U
    + logon path = \\%L\profiles\%U
    - logon drive = X:
    + logon drive = X:
    - domain logons = Yes
    + domain logons = Yes
    - domain master = No
    + domain master = No
    - wins server = 172.16.0.1
    + wins server = 172.16.0.1
    - ldap suffix = dc=abmas,dc=biz
    + ldap suffix = dc=abmas,dc=biz
    - ldap machine suffix = ou=People
    + ldap machine suffix = ou=People
    - ldap user suffix = ou=People
    + ldap user suffix = ou=People
    - ldap group suffix = ou=Groups
    + ldap group suffix = ou=Groups
    - ldap idmap suffix = ou=Idmap
    + ldap idmap suffix = ou=Idmap
    - ldap admin dn = cn=Manager,dc=abmas,dc=biz
    + ldap admin dn = cn=Manager,dc=abmas,dc=biz
    - idmap backend = ldap://massive.abmas.biz
    + idmap backend = ldap://massive.abmas.biz
    - idmap uid = 10000-20000
    + idmap uid = 10000-20000
    - idmap gid = 10000-20000
    + idmap gid = 10000-20000
    - printing = cups
    + printing = cups
    - printer admin = Administrator, chrisr

    Example 6.8. LDAP Based smb.conf File, Shares Section Part A

    [accounts]
    + printer admin = Administrator, chrisr

    Example 6.8. LDAP Based smb.conf File, Shares Section Part A

    [accounts]
    - comment = Accounting Files
    + comment = Accounting Files
    - path = /data/accounts
    + path = /data/accounts
    - read only = No
    [service]
    + read only = No
    [service]
    - comment = Financial Services Files
    + comment = Financial Services Files
    - path = /data/service
    + path = /data/service
    - read only = No
    [pidata]
    + read only = No
    [pidata]
    - comment = Property Insurance Files
    + comment = Property Insurance Files
    - path = /data/pidata
    + path = /data/pidata
    - read only = No
    [homes]
    + read only = No
    [homes]
    - comment = Home Directories
    + comment = Home Directories
    - valid users = %S
    + valid users = %S
    - read only = No
    + read only = No
    - browseable = No
    [printers]
    + browseable = No
    [printers]
    - comment = SMB Print Spool
    + comment = SMB Print Spool
    - path = /var/spool/samba
    + path = /var/spool/samba
    - guest ok = Yes
    + guest ok = Yes
    - printable = Yes
    + printable = Yes
    - browseable = No

    Example 6.9. LDAP Based smb.conf File, Shares Section Part B

    [apps]
    + browseable = No

    Example 6.9. LDAP Based smb.conf File, Shares Section Part B

    [apps]
    - comment = Application Files
    + comment = Application Files
    - path = /apps
    + path = /apps
    - admin users = bjordan
    + admin users = bjordan
    - read only = No
    [netlogon]
    + read only = No
    [netlogon]
    - comment = Network Logon Service
    + comment = Network Logon Service
    - path = /var/lib/samba/netlogon
    + path = /var/lib/samba/netlogon
    - guest ok = Yes
    + guest ok = Yes
    - locking = No
    [profiles]
    + locking = No
    [profiles]
    - comment = Profile Share
    + comment = Profile Share
    - path = /var/lib/samba/profiles
    + path = /var/lib/samba/profiles
    - read only = No
    + read only = No
    - profile acls = Yes
    [profdata]
    + profile acls = Yes
    [profdata]
    - comment = Profile Data Share
    + comment = Profile Data Share
    - path = /var/lib/samba/profdata
    + path = /var/lib/samba/profdata
    - read only = No
    + read only = No
    - profile acls = Yes
    [print$]
    + profile acls = Yes
    [print$]
    - comment = Printer Drivers
    + comment = Printer Drivers
    - path = /var/lib/samba/drivers
    + path = /var/lib/samba/drivers
    - browseable = yes
    + browseable = yes
    - guest ok = no
    + guest ok = no
    - read only = yes
    + read only = yes
    write list = Administrator, chrisr

    Example 6.10. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF

     dn: ou=Idmap,dc=abmas,dc=biz
     objectClass: organizationalUnit
     ou: idmap
     structuralObjectClass: organizationalUnit
    -

    Miscellaneous Server Preparation Tasks

    +

    Miscellaneous Server Preparation Tasks

    My father would say, “Dinner is not over until the dishes have been done.” The makings of a great network environment take a lot of effort and attention to detail. So far you have completed most of the complex (and to many administrators, the interesting part of server configuration) steps, but remember to tie it all together. Here are a few more steps that must be completed so that your network runs like a well-rehearsed orchestra. -

    Configuring Directory Share Point Roots

    +

    Configuring Directory Share Point Roots

    In your smb.conf file, you have specified Windows shares. Each has a path parameter. Even though it is obvious to all, one of the common Samba networking problems is @@ -1821,7 +1821,7 @@ root# chmod -R ug+rwxs,o-rwx /data root# chmod -R ug+rwx,o+rx-w /apps

    -

    Configuring Profile Directories

    +

    Configuring Profile Directories

    You made a conscious decision to do everything it would take to improve network client performance. One of your decisions was to implement folder redirection. This means that Windows user desktop profiles are now made up of two components a dynamically loaded part and a set of file @@ -1845,7 +1845,7 @@ root# chown -R username.Domain\ Users username root# chmod -R 750 username

    -

    +

    You have three options insofar as the dynamically loaded portion of the roaming profile is concerned:

    • You may permit the user to obtain a default profile.

    • You can create a mandatory profile.

    • You can create a group profile (which is almost always a mandatory profile).

    @@ -1854,7 +1854,7 @@ NTUSER.DAT to NTUSER.MAN, i.e., just by changing the filename extension. -

    +

    The location of the profile that a user can obtain is set in the users' account in the LDAP passdb backend. You can manage this using the Idealx smbldap-tools or using the Windows NT4 Domain User Manager. @@ -1867,7 +1867,7 @@ /var/lib/samba/profiles/username root# chmod 700 /var/lib/samba/profiles/username

    -

    Preparation of Logon Scripts

    +

    Preparation of Logon Scripts

    The use of a logon script with Windows XP Professional is an option that every site should consider. Unless you have locked down the desktop so the user cannot change anything, there is risk that a vital network drive setting may be broken or that printer connections may be lost. Logon scripts @@ -1895,7 +1895,7 @@ You should research the options for logon script implementation by referring to TOSHARG, Chapter 21, Section 21.4. A quick Web search will bring up a host of options. One of the most popular logon facilities in use today is called KiXtart. -

    Windows Client Configuration

    +

    Windows Client Configuration

    In the next few sections, you can configure a new Windows XP Professional disk image on a staging machine. You will configure all software, printer settings, profile and policy handling, and desktop default profile settings on this system. When it is complete, you copy the contents of the @@ -1907,7 +1907,7 @@ How to Create a Base Profile for All Users. -

    Configuration of Default Profile with Folder Redirection

    +

    Configuration of Default Profile with Folder Redirection

    Log onto the Windows XP Professional workstation as the local Administrator. It is necessary to expose folders that are generally hidden to provide access to the Default User @@ -1918,12 +1918,12 @@ Select Show hidden files and folders, and click OK. Exit Windows Explorer. -

  • +

  • Launch the Registry Editor. Click Start->Run. Key in regedt32, and click OK.

  • -

    Procedure 6.10. Redirect Folders in Default System User Profile

    1. +

      Procedure 6.10. Redirect Folders in Default System User Profile

      1. Give focus to HKEY_LOCAL_MACHINE hive entry in the left panel. Click File->Load Hive...->[Panel] Documents and Settings->[Panel] Default User->NTUSER->Open. In the dialog box that opens, enter the key name Default @@ -1936,27 +1936,27 @@

        The contents of the right panel reveals the contents as shown in ???. -

      2. +

      3. You edit hive keys. Acceptable values to replace the %USERPROFILE% variable includes:

        • A drive letter such as: U:

        • A direct network path such as: \\MASSIVE\profdata

        • A network redirection (UNC name) that contains a macro such as:

          \\%LOGONSERVER%\profdata\

        -

      4. +

      5. Set the registry keys as shown in ???. Your implementation makes the assumption that users have statically located machines. Notebook computers (mobile users) need to be accommodated using local profiles. This is not an uncommon assumption.

      6. Click back to the root of the loaded hive Default. Click File->Unload Hive...->Yes. -

      7. +

      8. Click File->Exit. This exits the Registry Editor.

      9. Now follow the procedure given in ???. Make sure that each folder you have redirected is in the exclusion list.

      10. - You are now ready to copy[11] + You are now ready to copy[11] the Default User profile to the Samba Domain Controllers. Launch Microsoft Windows Explorer, and use it to copy the full contents of the directory Default User @@ -1970,7 +1970,7 @@ Deselect Show hidden files and folders, and click OK. Exit Windows Explorer. -

      Figure 6.3. Windows XP Professional User Shared Folders

      Windows XP Professional User Shared Folders

      Table 6.3. Default Profile Redirections

      Registry KeyRedirected Value
      Cache%LOGONSERVER%\profdata\%USERNAME%\InternetFiles
      Cookies%LOGONSERVER%\profdata\%USERNAME%\Cookies
      History%LOGONSERVER%\profdata\%USERNAME%\History
      Local AppData%LOGONSERVER%\profdata\%USERNAME%\AppData
      Local Settings%LOGONSERVER%\profdata\%USERNAME%\LocalSettings
      My Pictures%LOGONSERVER%\profdata\%USERNAME%\MyPictures
      Personal%LOGONSERVER%\profdata\%USERNAME%\MyDocuments
      Recent%LOGONSERVER%\profdata\%USERNAME%\Recent

    Configuration of MS Outlook to Relocate PST File

    +

    Figure 6.3. Windows XP Professional User Shared Folders

    Windows XP Professional User Shared Folders

    Table 6.3. Default Profile Redirections

    Registry KeyRedirected Value
    Cache%LOGONSERVER%\profdata\%USERNAME%\InternetFiles
    Cookies%LOGONSERVER%\profdata\%USERNAME%\Cookies
    History%LOGONSERVER%\profdata\%USERNAME%\History
    Local AppData%LOGONSERVER%\profdata\%USERNAME%\AppData
    Local Settings%LOGONSERVER%\profdata\%USERNAME%\LocalSettings
    My Pictures%LOGONSERVER%\profdata\%USERNAME%\MyPictures
    Personal%LOGONSERVER%\profdata\%USERNAME%\MyDocuments
    Recent%LOGONSERVER%\profdata\%USERNAME%\Recent

    Configuration of MS Outlook to Relocate PST File

    Microsoft Outlook can store a Personal Storage file, generally known as a PST file. It is the nature of email storage that this file grows, at times quite rapidly. So that users' email is available to them at every workstation they may log onto, @@ -1983,9 +1983,9 @@ Tools->Options->Maintenance->Store Folder->Change.

    Follow the on-screen prompts to relocate the PST file to the desired location. -

    Configure Delete Cached Profiles on Logout

    +

    Configure Delete Cached Profiles on Logout

    To configure the Windows XP Professional client to auto-delete roaming profiles on logout: -

    +

    Click Start->Run. In the dialog box, enter: MMC and click OK. @@ -1993,7 +1993,7 @@ Follow these steps to set the default behavior of the staging machine so that all roaming profiles are deleted as network users log out of the system. Click File->Add/Remove Snap-in->Add->Group Policy->Add->Finish->Close->OK. -

    +

    The Microsoft Management Console now shows the Group Policy utility that enables you to set the policies needed. In the left panel, click Local Computer Policy->Administrative Templates->System->User Profiles. In the right panel, set the properties shown here by double-clicking on each @@ -2001,7 +2001,7 @@

    • Do not check for user ownership of Roaming Profile Folders = Enabled

    • Delete cached copies of roaming profiles = Enabled

    Close the Microsoft Management Console. The settings take immediate effect and persist onto all image copies made of this system to deploy the new standard desktop system. -

    Uploading Printer Drivers to Samba Servers

    +

    Uploading Printer Drivers to Samba Servers

    Users want to be able to use network printers. You have a vested interest in making it easy for them to print. You have chosen to install the printer drivers onto the Samba servers and to enable point-and-click (drag-and-drop) printing. This process results in @@ -2031,7 +2031,7 @@ MASSIVE is displayed. Click the Advanced tab. Note that the box labelled Driver is empty. Click the New Driver button that is next to the Driver box. This launches the quote“Add Printer Wizard”. -

  • +

  • The “Add Printer Driver Wizard on MASSIVE” panel is now presented. Click Next to continue. From the left panel, select the Printer Manufacturer. In your case, you are adding a driver for a printer manufactured by @@ -2040,12 +2040,12 @@ progress bar appears and instructs you as each file is being uploaded and that it is being directed at the network server \\massive\ps01-color.

  • - - - - - - + + + + + + The driver upload completes in anywhere from a few seconds to a few minutes. When it completes, you are returned to the Advanced tab in the Properties panel. You can set the Location (under the General tab), and Security settings (under @@ -2054,7 +2054,7 @@ directory”. When this box is checked the printer will be published in Active Directory (Applicable to Active Directory use only.)

  • - + Click OK. It will take a minute or so to upload the settings to the server. You are now returned to the Printers and Faxes on Massive monitor. Right-click on the printer, click Properties->Device Settings. Now change the settings to suit @@ -2066,7 +2066,7 @@ just to initialize the Samba printers database entry for this printer. If you need to revert a setting, Click Apply again.

  • - + Verify that all printer settings are at the desired configuration. When you are satisfied that they are, click the General tab. Now click the Print Test Page button. A test page should print. Verify that it has printed correctly. Then click OK @@ -2076,7 +2076,7 @@ You must repeat this process for all network printers (i.e., for every printer, on each server). When you have finished uploading drivers to all printers, close all applications. The next task is to install software your users require to do their work. -

  • Software Installation

    +

    Software Installation

    Your network has both fixed desktop workstations as well as notebook computers. As a general rule, it is a good idea to not tamper with the operating system that is provided by the notebook computer manufacturer. Notebooks require special handling that is beyond the scope of this chapter. @@ -2091,7 +2091,7 @@ When you believe that the overall configuration is complete, be sure to create a shared group profile and migrate that to the Samba server for later re-use when creating custom mandatory profiles, just in case a user may have specific needs you had not anticipated. -

    Roll-out Image Creation

    +

    Roll-out Image Creation

    The final steps before preparing the distribution Norton Ghost image file you might follow are:

    Un-join the domain Each workstation requires a unique name and must be independently @@ -2100,7 +2100,7 @@ Defragment the hard disk While not obvious to the uninitiated, defragmentation results in better performance and often significantly reduces the size of the compressed disk image. That also means it will take less time to deploy the image onto 500 workstations. -

    Key Points Learned

    +

    Key Points Learned

    This chapter has introduced many new concepts. Is it a sad fact that the example presented deliberately avoided any consideration of security. Security does not just happen; you must design it into your total network. Security begins with a systems design and implementation that anticipates hostile behavior from @@ -2108,7 +2108,7 @@ they accept them as challenges. For that reason, if not simply from a desire to establish safe networking practices, you must not deploy the design presented in this book in an environment where there is risk of compromise. -

    +

    As a minimum, the LDAP server must be protected by way of Access Control Lists (ACLs) and it must be configured to use secure protocols for all communications over the network. Of course, secure networking does not result just from systems design and implementation but involves constant user education @@ -2134,37 +2134,37 @@ Control over roaming profiles, with particular focus on folder redirection to network drives.

  • Use of the CUPS printing system together with Samba-based printer driver auto-download. -

  • Questions and Answers

    +

    Questions and Answers

    Well, here we are at the end of this chapter and we have only ten questions to help you to remember so much. There are bound to be some sticky issues here. -

    +

    Why did you not cover secure practices? Isn't it rather irresponsible to instruct network administrators to implement insecure solutions? -
    +
    You have focused much on SUSE Linux and little on the market leader, Red Hat. Do you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant to the Linux I might be using? -
    +
    You did not use SWAT to configure Samba. Is there something wrong with it? -
    +
    You have exposed a well-used password not24get. Is that not irresponsible? -
    +
    The Idealx smbldap-tools create many domain group accounts that are not used. Is that a good thing? -
    +
    Can I use LDAP just for Samba accounts and not for UNIX system accounts? -
    +
    Why are the Windows Domain RID portions not the same as the UNIX UID? -
    +
    Printer configuration examples all show printing to the HP port 9100. Does this mean that I must have HP printers for these solutions to work? -
    +
    Is folder redirection dangerous? I've heard that you can lose your data that way. -
    +
    Is it really necessary to set a local Group Policy to exclude the redirected folders from the roaming profile? -

    +

    Why did you not cover secure practices? Isn't it rather irresponsible to instruct network administrators to implement insecure solutions?

    @@ -2183,7 +2183,7 @@ This book makes little mention of backup techniques. Does that mean that I am recommending that you should implement a network without provision for data recovery and for disaster management? Back to our focus: The deployment of Samba has been clearly demonstrated. -

    +

    You have focused much on SUSE Linux and little on the market leader, Red Hat. Do you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant to the Linux I might be using? @@ -2210,7 +2210,7 @@ of open source software. I favor neither and respect both. I like particular features of both products (companies also). No bias in presentation is intended. Oh, before I forget, I particularly like Debian Linux; that is my favorite playground. -

    +

    You did not use SWAT to configure Samba. Is there something wrong with it?

    That is a good question. As it is, the smb.conf file configurations are presented @@ -2221,14 +2221,14 @@ There are people in the Linux and open source community who feel that SWAT is dangerous and insecure. Many will not touch it with a barge-pole. By not introducing SWAT, I hope to have brought their interests on board. SWAT is well covered is TOSHARG. -

    +

    You have exposed a well-used password not24get. Is that not irresponsible?

    Well, I had to use a password of some sort. At least this one has been consistently used throughout. I guess you can figure out that in a real deployment it would make sense to use a more secure and original password. -

    +

    The Idealx smbldap-tools create many domain group accounts that are not used. Is that a good thing?

    @@ -2236,7 +2236,7 @@ Let's give Idealx some credit for the contribution they have made. I appreciate their work and, besides, it does no harm to create accounts that are not now used as at some time Samba may well use them. -

    +

    Can I use LDAP just for Samba accounts and not for UNIX system accounts?

    Yes, you can do that for user accounts only. Samba requires there to be a Posix (UNIX) @@ -2244,7 +2244,7 @@ the system password account, how do you plan to keep all domain controller system password files in sync? I think that having everything in LDAP makes a lot of sense for the UNIX admin who is still learning the craft and is migrating from MS Windows. -

    +

    Why are the Windows Domain RID portions not the same as the UNIX UID?

    Samba uses a well-known public algorithm for assigning RIDs from UIDs and GIDs. @@ -2253,7 +2253,7 @@ assignment used the calculation: RID = UID x 2 + 1000. Of course, Samba does permit you to override that to some extent. See the smb.conf man page entry for algorithmic rid base. -

    +

    Printer configuration examples all show printing to the HP port 9100. Does this mean that I must have HP printers for these solutions to work?

    @@ -2263,7 +2263,7 @@ Inkjet printer. Use the appropriate device URI (Universal Resource Interface) argument to the lpadmin -v option that is right for your printer. -

    +

    Is folder redirection dangerous? I've heard that you can lose your data that way.

    The only loss of data I know of that involved folder redirection was caused by @@ -2273,13 +2273,13 @@ he declined to move the data because he thought it was still in the local profile folder. That was not the case, so by declining to move the data back, he wiped out the data. You cannot hold the tool responsible for that. Caveat emptor still applies. -

    +

    Is it really necessary to set a local Group Policy to exclude the redirected folders from the roaming profile?

    Yes. If you do not do this, the data will still be copied from the network folder (share) to the local cached copy of the profile. -



    [11] +



    [11] There is an alternate method by which a Default User profile can be added to the NETLOGON share. This facility in the Windows System tool permits profiles to be exported. The export target may be a particular user or diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/index.html samba-3.0.10/docs/htmldocs/Samba-Guide/index.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/index.html 2004-11-15 10:15:57.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/index.html 2004-12-15 10:24:04.000000000 -0600 @@ -1,4 +1,4 @@ -Samba-3 by Example

    Samba-3 by Example

    Practical Exercises in Successful Samba Deployment

    John H. Terpstra

    Samba Team

    October 23, 2004


    Table of Contents

    About the Cover Artwork
    Acknowledgments
    Foreword
    By Dan Kusnetzky, IDC
    By Andrew Tridgell, Samba Team
    Preface
    Why Is This Book Necessary?
    Prerequisites
    Approach
    Summary of Topics
    Conventions Used
    1. Networking Primer
    Requirements and Notes
    Introduction
    Assignment Tasks
    Exercises
    Single Machine Broadcast Activity
    Second Machine Startup Broadcast Interaction
    Simple Windows Client Connection Characteristics
    Windows 200x/XP Client Interaction with Samba-3
    Conclusions to Exercises
    Dissection and Discussion
    Technical Issues
    Questions and Answers
    2. No Frills Samba Servers
    Introduction
    Assignment Tasks
    Drafting Office
    Charity Administration Office
    Accounting Office
    Questions and Answers
    3. Small Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Validation
    Notebook Computers: A Special Case
    Key Points Learned
    Questions and Answers
    4. Secure Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Basic System Configuration
    Samba Configuration
    Configuration of DHCP and DNS Servers
    Printer Configuration
    Process Startup Configuration
    Validation
    Application Share Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    5. The 500-User Office
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Installation of DHCP, DNS, and Samba Control Files
    Server Preparation All Servers
    Server Specific Preparation
    Process Startup Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    6. Making Users Happy
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Installation Check-List
    Samba Server Implementation
    OpenLDAP Server Configuration
    PAM and NSS Client Configuration
    Samba-3 PDC Configuration
    Install and Configure Idealx SMB-LDAP Scripts
    LDAP Initialization and Creation of User and Group Accounts
    Printer Configuration
    Samba-3 BDC Configuration
    Miscellaneous Server Preparation Tasks
    Configuring Directory Share Point Roots
    Configuring Profile Directories
    Preparation of Logon Scripts
    Windows Client Configuration
    Configuration of Default Profile with Folder Redirection
    Configuration of MS Outlook to Relocate PST File
    Configure Delete Cached Profiles on Logout
    Uploading Printer Drivers to Samba Servers
    Software Installation
    Roll-out Image Creation
    Key Points Learned
    Questions and Answers
    7. A Distributed 2000 User Network
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Key Points Learned
    Questions and Answers
    8. Migrating NT4 Domain to Samba-3
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    NT4 Migration Using LDAP Backend
    NT4 Migration Using tdbsam Backend
    Key Points Learned
    Questions and Answers
    9. Adding UNIX/LINUX Servers and Clients
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Samba Domain with Samba Domain Member Server Using LDAP
    NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Active Directory Domain with Samba Domain Member Server
    UNIX/Linux Client Domain Member
    Key Points Learned
    Questions and Answers
    10. Active Directory, Kerberos, and Security
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Implementation
    Share Access Controls
    Share Definition Controls
    Share Point Directory and File Permissions
    Managing Windows 200x ACLs
    Key Points Learned
    Questions and Answers
    11. Integrating Additional Services
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Removal of Pre-existing Conflicting RPMs
    Key Points Learned
    Questions and Answers
    12. Performance, Reliability, and Availability
    Introduction
    Dissection and Discussion
    Guidelines for Reliable Samba Operation
    Name Resolution
    Samba Configuration
    Use and Location of BDCs
    Use One Consistent Version of MS Windows Client
    For Scalability, Use SAN Based Storage on Samba Servers
    Distribute Network Load with MSDFS
    Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    Hardware Problems
    Key Points Learned
    A. Appendix: A Collection of Useful Tid-bits
    Joining a Domain: Windows 200x/XP Professional
    Samba System File Location
    Starting Samba
    DNS Configuration Files
    The Forward Zone File for the Loopback Adaptor
    The Reverse Zone File for the Loopback Adaptor
    DNS Root Server Hint File
    Alternative LDAP Database Initialization
    Initialization of the LDAP Database
    The LDAP Account Manager
    Effect of Setting File and Directory SUID/SGID Permissions Explained
    Shared Data Integrity
    Microsoft Access
    Act! Database Sharing
    Opportunistic Locking Controls
    B. GNU General Public License
    Preamble
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
    Section 0
    Section 1
    Section 2
    Section 3 +Samba-3 by Example

    Samba-3 by Example

    Practical Exercises in Successful Samba Deployment

    John H. Terpstra

    Samba Team

    October 23, 2004


    Table of Contents

    About the Cover Artwork
    Acknowledgments
    Foreword
    By Dan Kusnetzky, IDC
    By Andrew Tridgell, Samba Team
    Preface
    Why Is This Book Necessary?
    Prerequisites
    Approach
    Summary of Topics
    Conventions Used
    1. Networking Primer
    Requirements and Notes
    Introduction
    Assignment Tasks
    Exercises
    Single Machine Broadcast Activity
    Second Machine Startup Broadcast Interaction
    Simple Windows Client Connection Characteristics
    Windows 200x/XP Client Interaction with Samba-3
    Conclusions to Exercises
    Dissection and Discussion
    Technical Issues
    Questions and Answers
    2. No Frills Samba Servers
    Introduction
    Assignment Tasks
    Drafting Office
    Charity Administration Office
    Accounting Office
    Questions and Answers
    3. Small Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Validation
    Notebook Computers: A Special Case
    Key Points Learned
    Questions and Answers
    4. Secure Office Networking
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Basic System Configuration
    Samba Configuration
    Configuration of DHCP and DNS Servers
    Printer Configuration
    Process Startup Configuration
    Validation
    Application Share Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    5. The 500-User Office
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Installation of DHCP, DNS, and Samba Control Files
    Server Preparation All Servers
    Server Specific Preparation
    Process Startup Configuration
    Windows Client Configuration
    Key Points Learned
    Questions and Answers
    6. Making Users Happy
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Installation Check-List
    Samba Server Implementation
    OpenLDAP Server Configuration
    PAM and NSS Client Configuration
    Samba-3 PDC Configuration
    Install and Configure Idealx SMB-LDAP Scripts
    LDAP Initialization and Creation of User and Group Accounts
    Printer Configuration
    Samba-3 BDC Configuration
    Miscellaneous Server Preparation Tasks
    Configuring Directory Share Point Roots
    Configuring Profile Directories
    Preparation of Logon Scripts
    Windows Client Configuration
    Configuration of Default Profile with Folder Redirection
    Configuration of MS Outlook to Relocate PST File
    Configure Delete Cached Profiles on Logout
    Uploading Printer Drivers to Samba Servers
    Software Installation
    Roll-out Image Creation
    Key Points Learned
    Questions and Answers
    7. A Distributed 2000 User Network
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Key Points Learned
    Questions and Answers
    8. Migrating NT4 Domain to Samba-3
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    NT4 Migration Using LDAP Backend
    NT4 Migration Using tdbsam Backend
    Key Points Learned
    Questions and Answers
    9. Adding UNIX/LINUX Servers and Clients
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Samba Domain with Samba Domain Member Server Using LDAP
    NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Active Directory Domain with Samba Domain Member Server
    UNIX/Linux Client Domain Member
    Key Points Learned
    Questions and Answers
    10. Active Directory, Kerberos, and Security
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Implementation
    Share Access Controls
    Share Definition Controls
    Share Point Directory and File Permissions
    Managing Windows 200x ACLs
    Key Points Learned
    Questions and Answers
    11. Integrating Additional Services
    Introduction
    Assignment Tasks
    Dissection and Discussion
    Technical Issues
    Political Issues
    Implementation
    Removal of Pre-existing Conflicting RPMs
    Key Points Learned
    Questions and Answers
    12. Performance, Reliability, and Availability
    Introduction
    Dissection and Discussion
    Guidelines for Reliable Samba Operation
    Name Resolution
    Samba Configuration
    Use and Location of BDCs
    Use One Consistent Version of MS Windows Client
    For Scalability, Use SAN Based Storage on Samba Servers
    Distribute Network Load with MSDFS
    Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    Hardware Problems
    Key Points Learned
    A. Appendix: A Collection of Useful Tid-bits
    Joining a Domain: Windows 200x/XP Professional
    Samba System File Location
    Starting Samba
    DNS Configuration Files
    The Forward Zone File for the Loopback Adaptor
    The Reverse Zone File for the Loopback Adaptor
    DNS Root Server Hint File
    Alternative LDAP Database Initialization
    Initialization of the LDAP Database
    The LDAP Account Manager
    Effect of Setting File and Directory SUID/SGID Permissions Explained
    Shared Data Integrity
    Microsoft Access
    Act! Database Sharing
    Opportunistic Locking Controls
    B. GNU General Public License
    Preamble
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
    Section 0
    Section 1
    Section 2
    Section 3
    Section 4
    Section 5
    Section 6 @@ -9,4 +9,4 @@
    NO WARRANTY Section 11
    Section 12
    How to Apply These Terms to Your New Programs -
    Glossary
    Index

    List of Figures

    1.1. Windows Me Broadcasts The First 10 Minutes
    1.2. Windows Me Later Broadcast Sample
    1.3. Typical Windows 9x/Me Host Announcement
    1.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request
    1.5. Typical Windows 9x/Me User SessionSetUp AndX Request
    1.6. Typical Windows XP NULL Session Setup AndX Request
    1.7. Typical Windows XP User Session Setup AndX Request
    2.1. Charity Administration Office Network
    2.2. Accounting Office Network Topology
    3.1. Abmas Accounting 52 User Network Topology
    4.1. Abmas Network Topology 130 Users
    5.1. Network Topology 500 User Network Using tdbsam passdb backend.
    6.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts
    6.2. Network Topology 500 User Network Using ldapsam passdb backend.
    6.3. Windows XP Professional User Shared Folders
    7.1. Network Topology 2000 User Complex Design A
    7.2. Network Topology 2000 User Complex Design B
    7.3. Samba and Authentication Backend Search Pathways
    7.4. Samba Configuration to Use a Single LDAP Server
    7.5. Samba Configuration to Use a Dual (Fail-over) LDAP Server
    7.6. Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!
    7.7. Samba Configuration to Use Two LDAP Databases - The result is additive.
    8.1. Schematic Explaining the net rpc vampire Process
    8.2. View of Accounts in NT4 Domain User Manager
    9.1. Open Magazine Samba Survey
    9.2. Samba Domain: Samba Member Server
    9.3. Active Directory Domain: Samba Member Server
    A.1. The General Panel.
    A.2. The Computer Name Panel.
    A.3. The Computer Name Changes Panel.
    A.4. The Computer Name Changes Panel Domain MIDEARTH.
    A.5. Computer Name Changes User name and Password Panel.
    A.6. The LDAP Account Manager Login Screen
    A.7. The LDAP Account Manager Configuration Screen
    A.8. The LDAP Account Manager User Edit Screen
    A.9. The LDAP Account Manager Group Edit Screen
    A.10. The LDAP Account Manager Group Membership Edit Screen
    A.11. The LDAP Account Manager Host Edit Screen

    List of Examples

    2.1. Drafting Office smb.conf File
    2.2. Charity Administration Office smb.conf File
    2.3. Windows Me Registry Edit File: Disable Password Caching
    2.4. Accounting Office Network smb.conf File
    3.1. Script to Map Windows NT Groups to UNIX Groups
    3.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf
    3.3. Accounting Office Network smb.conf File [globals] Section
    3.4. Accounting Office Network smb.conf File Services and Shares Section
    4.1. Estimation of Memory Requirements
    4.2. Estimation of Disk Storage Requirements
    4.3. NAT Firewall Configuration Script
    4.4. 130 User Network with tdbsam [globals] Section
    4.5. 130 User Network with tdbsam Services Section Part A
    4.6. 130 User Network with tdbsam Services Section Part B
    4.7. Script to Map Windows NT Groups to UNIX Groups
    4.8. DHCP Server Configuration File /etc/dhcpd.conf
    4.9. DNS Master Configuration File /etc/named.conf Master Section
    4.10. DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section
    4.11. DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section
    4.12. DNS 192.168.1 Reverse Zone File
    4.13. DNS 192.168.2 Reverse Zone File
    4.14. DNS Abmas.biz Forward Zone File
    4.15. DNS Abmas.us Forward Zone File
    5.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf
    5.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf
    5.3. Common Samba Configuration File: /etc/samba/common.conf
    5.4. Server: BLDG1 (Member), File: smb.conf
    5.5. Server: BLDG2 (Member), File: smb.conf
    5.6. Common Domain Member Include File: dom-mem.conf
    5.7. Server: MASSIVE, File: dhcpd.conf
    5.8. Server: BLDG1, File: dhcpd.conf
    5.9. Server: BLDG2, File: dhcpd.conf
    5.10. Server: MASSIVE, File: named.conf, Part: A
    5.11. Server: MASSIVE, File: named.conf, Part: B
    5.12. Server: MASSIVE, File: named.conf, Part: C
    5.13. Forward Zone File: abmas.biz.hosts
    5.14. Forward Zone File: abmas.biz.hosts
    5.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A
    5.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B
    5.17. Initialize Groups Script, File: /etc/samba/initGrps.sh
    6.1. LDAP Master Configuration File /etc/openldap/slapd.conf
    6.2. Configuration File for NSS LDAP Support /etc/ldap.conf
    6.3. Configuration File for NSS LDAP Clients Support /etc/ldap.conf
    6.4. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A
    6.5. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B
    6.6. LDAP Based smb.conf File, Server: BLDG1
    6.7. LDAP Based smb.conf File, Server: BLDG2
    6.8. LDAP Based smb.conf File, Shares Section Part A
    6.9. LDAP Based smb.conf File, Shares Section Part B
    6.10. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF
    7.1. LDAP Master Server Configuration File /etc/openldap/slapd.conf
    7.2. LDAP Slave Configuration File /etc/openldap/slapd.conf
    7.3. Primary Domain Controller smb.conf File Part A
    7.4. Primary Domain Controller smb.conf File Part B
    7.5. Primary Domain Controller smb.conf File Part C
    7.6. Backup Domain Controller smb.conf File Part A
    7.7. Backup Domain Controller smb.conf File Part B
    8.1. LDAP Preload LDIF file preload.LDIF
    9.1. Samba Domain Member in Samba Domain Control Context smb.conf File
    9.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF
    9.3. Configuration File for NSS LDAP Support /etc/ldap.conf
    9.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf
    9.5. Samba Domain Member Server smb.conf File for NT4 Domain
    9.6. Name Service Switch Control File: /etc/nsswitch.conf
    9.7. Samba Domain Member smb.conf File for Active Directory Membership
    9.8. SUSE: PAM login Module Using Winbind
    9.9. SUSE: PAM xdm Module Using Winbind
    9.10. Red Hat 9: PAM System Authentication File: /etc/pam.d/system-auth Module Using Winbind
    11.1. Kerberos Configuration File: /etc/krb5.conf
    11.2. Samba Configuration File: /etc/samba/smb.conf
    11.3. NSS Configuration File Extract File: /etc/nsswitch.conf
    11.4. Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]
    11.5. Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]
    A.1. A Useful Samba Control Script for SuSE Linux
    A.2.
    A.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone
    A.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone
    A.5. DNS Root Name Server Hint File: /var/lib/named/root.hint
    A.6. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part A
    A.7. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part B
    A.8. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part C
    A.9. LDIF Pattern File Used to Pre-configure LDAP Part A
    A.10. LDIF Pattern File Used to Pre-configure LDAP Part B
    A.11. Example LAM Configuration File config.cfg
    A.12. LAM Profile Control File lam.conf

    boo

    boo

    boo

    +
    Glossary
    Index

    List of Figures

    1.1. Windows Me Broadcasts The First 10 Minutes
    1.2. Windows Me Later Broadcast Sample
    1.3. Typical Windows 9x/Me Host Announcement
    1.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request
    1.5. Typical Windows 9x/Me User SessionSetUp AndX Request
    1.6. Typical Windows XP NULL Session Setup AndX Request
    1.7. Typical Windows XP User Session Setup AndX Request
    2.1. Charity Administration Office Network
    2.2. Accounting Office Network Topology
    3.1. Abmas Accounting 52 User Network Topology
    4.1. Abmas Network Topology 130 Users
    5.1. Network Topology 500 User Network Using tdbsam passdb backend.
    6.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts
    6.2. Network Topology 500 User Network Using ldapsam passdb backend.
    6.3. Windows XP Professional User Shared Folders
    7.1. Network Topology 2000 User Complex Design A
    7.2. Network Topology 2000 User Complex Design B
    7.3. Samba and Authentication Backend Search Pathways
    7.4. Samba Configuration to Use a Single LDAP Server
    7.5. Samba Configuration to Use a Dual (Fail-over) LDAP Server
    7.6. Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!
    7.7. Samba Configuration to Use Two LDAP Databases - The result is additive.
    8.1. Schematic Explaining the net rpc vampire Process
    8.2. View of Accounts in NT4 Domain User Manager
    9.1. Open Magazine Samba Survey
    9.2. Samba Domain: Samba Member Server
    9.3. Active Directory Domain: Samba Member Server
    A.1. The General Panel.
    A.2. The Computer Name Panel.
    A.3. The Computer Name Changes Panel.
    A.4. The Computer Name Changes Panel Domain MIDEARTH.
    A.5. Computer Name Changes User name and Password Panel.
    A.6. The LDAP Account Manager Login Screen
    A.7. The LDAP Account Manager Configuration Screen
    A.8. The LDAP Account Manager User Edit Screen
    A.9. The LDAP Account Manager Group Edit Screen
    A.10. The LDAP Account Manager Group Membership Edit Screen
    A.11. The LDAP Account Manager Host Edit Screen

    List of Examples

    2.1. Drafting Office smb.conf File
    2.2. Charity Administration Office smb.conf File
    2.3. Windows Me Registry Edit File: Disable Password Caching
    2.4. Accounting Office Network smb.conf File
    3.1. Script to Map Windows NT Groups to UNIX Groups
    3.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf
    3.3. Accounting Office Network smb.conf File [globals] Section
    3.4. Accounting Office Network smb.conf File Services and Shares Section
    4.1. Estimation of Memory Requirements
    4.2. Estimation of Disk Storage Requirements
    4.3. NAT Firewall Configuration Script
    4.4. 130 User Network with tdbsam [globals] Section
    4.5. 130 User Network with tdbsam Services Section Part A
    4.6. 130 User Network with tdbsam Services Section Part B
    4.7. Script to Map Windows NT Groups to UNIX Groups
    4.8. DHCP Server Configuration File /etc/dhcpd.conf
    4.9. DNS Master Configuration File /etc/named.conf Master Section
    4.10. DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section
    4.11. DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section
    4.12. DNS 192.168.1 Reverse Zone File
    4.13. DNS 192.168.2 Reverse Zone File
    4.14. DNS Abmas.biz Forward Zone File
    4.15. DNS Abmas.us Forward Zone File
    5.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf
    5.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf
    5.3. Common Samba Configuration File: /etc/samba/common.conf
    5.4. Server: BLDG1 (Member), File: smb.conf
    5.5. Server: BLDG2 (Member), File: smb.conf
    5.6. Common Domain Member Include File: dom-mem.conf
    5.7. Server: MASSIVE, File: dhcpd.conf
    5.8. Server: BLDG1, File: dhcpd.conf
    5.9. Server: BLDG2, File: dhcpd.conf
    5.10. Server: MASSIVE, File: named.conf, Part: A
    5.11. Server: MASSIVE, File: named.conf, Part: B
    5.12. Server: MASSIVE, File: named.conf, Part: C
    5.13. Forward Zone File: abmas.biz.hosts
    5.14. Forward Zone File: abmas.biz.hosts
    5.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A
    5.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B
    5.17. Initialize Groups Script, File: /etc/samba/initGrps.sh
    6.1. LDAP Master Configuration File /etc/openldap/slapd.conf
    6.2. Configuration File for NSS LDAP Support /etc/ldap.conf
    6.3. Configuration File for NSS LDAP Clients Support /etc/ldap.conf
    6.4. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A
    6.5. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B
    6.6. LDAP Based smb.conf File, Server: BLDG1
    6.7. LDAP Based smb.conf File, Server: BLDG2
    6.8. LDAP Based smb.conf File, Shares Section Part A
    6.9. LDAP Based smb.conf File, Shares Section Part B
    6.10. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF
    7.1. LDAP Master Server Configuration File /etc/openldap/slapd.conf
    7.2. LDAP Slave Configuration File /etc/openldap/slapd.conf
    7.3. Primary Domain Controller smb.conf File Part A
    7.4. Primary Domain Controller smb.conf File Part B
    7.5. Primary Domain Controller smb.conf File Part C
    7.6. Backup Domain Controller smb.conf File Part A
    7.7. Backup Domain Controller smb.conf File Part B
    8.1. LDAP Preload LDIF file preload.LDIF
    9.1. Samba Domain Member in Samba Domain Control Context smb.conf File
    9.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF
    9.3. Configuration File for NSS LDAP Support /etc/ldap.conf
    9.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf
    9.5. Samba Domain Member Server smb.conf File for NT4 Domain
    9.6. Name Service Switch Control File: /etc/nsswitch.conf
    9.7. Samba Domain Member smb.conf File for Active Directory Membership
    9.8. SUSE: PAM login Module Using Winbind
    9.9. SUSE: PAM xdm Module Using Winbind
    9.10. Red Hat 9: PAM System Authentication File: /etc/pam.d/system-auth Module Using Winbind
    11.1. Kerberos Configuration File: /etc/krb5.conf
    11.2. Samba Configuration File: /etc/samba/smb.conf
    11.3. NSS Configuration File Extract File: /etc/nsswitch.conf
    11.4. Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]
    11.5. Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]
    A.1. A Useful Samba Control Script for SuSE Linux
    A.2.
    A.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone
    A.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone
    A.5. DNS Root Name Server Hint File: /var/lib/named/root.hint
    A.6. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part A
    A.7. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part B
    A.8. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part C
    A.9. LDIF Pattern File Used to Pre-configure LDAP Part A
    A.10. LDIF Pattern File Used to Pre-configure LDAP Part B
    A.11. Example LAM Configuration File config.cfg
    A.12. LAM Profile Control File lam.conf

    boo

    boo

    boo

    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/ix01.html samba-3.0.10/docs/htmldocs/Samba-Guide/ix01.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/ix01.html 2004-11-15 10:15:57.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/ix01.html 2004-12-15 10:24:04.000000000 -0600 @@ -1,5 +1,5 @@ -Index

    Index

    Symbols

    %LOGONSERVER%, Configuration of Default Profile with Folder Redirection
    %USERNAME%, Roaming Profile Background, Profile Changes
    %USERPROFILE%, Configuration of Default Profile with Folder Redirection
    /etc/cups/mime.convs, Implementation, Implementation
    /etc/cups/mime.types, Implementation, Implementation
    /etc/dhcpd.conf, Implementation, Validation, Configuration of DHCP and DNS Servers, Validation
    /etc/exports, Samba-3 PDC Configuration
    /etc/group, Technical Issues, Questions and Answers, Samba Domain with Samba Domain Member Server Using LDAP, Removal of Pre-existing Conflicting RPMs
    /etc/hosts, Implementation, Implementation, Basic System Configuration, Validation, Server Preparation All Servers, Questions and Answers, Kerberos Configuration, Bad Hostnames
    /etc/krb5.conf, Kerberos Configuration
    /etc/ldap.conf, PAM and NSS Client Configuration
    /etc/mime.convs, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    /etc/mime.types, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    /etc/named.conf, Configuration of DHCP and DNS Servers
    /etc/nsswitch.conf, Implementation, Configuration of DHCP and DNS Servers, Validation, Configuration for Server: MASSIVE, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, PAM and NSS Client Configuration, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers
    /etc/openldap/slapd.conf, OpenLDAP Server Configuration, Implementation
    /etc/passwd, Findings and Comments, Implementation, Samba Configuration, Configuration for Server: MASSIVE, LDAP Initialization and Creation of User and Group Accounts, Technical Issues, Questions and Answers, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers, Share Point Directory and File Permissions, Removal of Pre-existing Conflicting RPMs
    /etc/rc.d/boot.local, Basic System Configuration, Configuration for Server: MASSIVE
    /etc/rc.d/rc.local, Implementation
    /etc/resolv.conf, Configuration of DHCP and DNS Servers, Server Preparation All Servers
    /etc/samba, Samba System File Location
    /etc/samba/secrets.tdb, Active Directory Domain with Samba Domain Member Server
    /etc/samba/smbusers, Server Preparation All Servers
    /etc/squid/squid.conf, Removal of Pre-existing Conflicting RPMs
    /etc/xinetd.d, Process Startup Configuration, Process Startup Configuration
    /lib/libnss_ldap.so.2, PAM and NSS Client Configuration
    /proc/sys/net/ipv4/ip_forward, Implementation, Basic System Configuration
    /usr/bin, Samba System File Location
    /usr/lib/samba, Samba System File Location
    /usr/local, Samba System File Location
    /usr/local/samba, Samba System File Location
    /usr/sbin, Samba System File Location
    /usr/share, Samba System File Location
    /usr/share/samba/swat, Samba System File Location
    /usr/share/swat, Samba System File Location
    /var/lib/ldap, OpenLDAP Server Configuration
    /var/lib/samba, Samba System File Location
    /var/log/samba, Samba System File Location

    A

    abmas-netfw.sh, Basic System Configuration
    abort shutdown script, Samba Configuration, Implementation, Implementation
    accept, Printer Configuration
    accepts liability, Dissection and Discussion
    access, Technical Issues, Check-point Controls
    access control, Kerberos Exposed, Using the MMC Computer Management Interface
    Access Control Lists (see ACLs)
    access control settings, Share Access Controls
    access controls, Technical Issues, Share Definition Controls
    accessible, Share Point Directory and File Permissions
    account, Share Access Controls
    ADS Domain, Technical Issues
    account credentials, Findings and Comments
    account information, Questions and Answers
    account names, Questions and Answers
    account policies, The LDAP Account Manager
    accountable, Introduction, Dissection and Discussion
    accounts
    authoritative, Technical Issues
    Domain, Introduction, Questions and Answers
    group, Introduction, Questions and Answers, Introduction
    machine, Introduction, Questions and Answers
    manage, The LDAP Account Manager
    user, Introduction, Questions and Answers, Introduction
    ACL, Questions and Answers, Check-point Controls
    ACLs, Key Points Learned, Share Access Controls, Share Definition Controls
    acquisitions, Introduction
    Act!, Shared Data Integrity
    ACT! database, Act! Database Sharing
    Act!Diag, Act! Database Sharing
    Active Directory, Dissection and Discussion, The Local Group Policy, Dissection and Discussion, Assignment Tasks, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Key Points Learned, Questions and Answers, Integrating Additional Services, Assignment Tasks, Technical Issues, Samba Configuration, Joining a Domain: Windows 200x/XP Professional
    authentication, Squid Configuration
    domain, Samba Configuration
    join, Active Directory Domain with Samba Domain Member Server
    management tools, Technical Issues
    realm, Bad Hostnames
    Replacement, Technical Issues
    server, Active Directory Domain with Samba Domain Member Server, Kerberos Configuration
    Server, Technical Issues
    tree, Samba Configuration
    AD printer publishing, Uploading Printer Drivers to Samba Servers
    ADAM, Dissection and Discussion
    add group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    add machine script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    Add Printer Wizard
    APW, Uploading Printer Drivers to Samba Servers
    add user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    add user to group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    adduser, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    admin users, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    administrative installation, Application Share Configuration
    administrative rights, Check-point Controls
    administrator, Implementation, Samba Configuration, Server Preparation All Servers
    ADS, Technical Issues, Kerberos Configuration, Bad Hostnames
    server, Technical Issues
    ADS Domain, Technical Issues
    affordability, The Nature of Windows Networking Protocols
    alarm, Introduction
    algorithm, Technical Issues
    alternative, Dissection and Discussion
    analysis, Technical Issues
    anonymous connection, Validation, Validation
    Apache Web server, Questions and Answers
    appliance mode, Technical Issues
    application server, Technical Issues, Application Share Configuration
    application servers, The Nature of Windows Networking Protocols
    application/octet-stream, Implementation, Implementation, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    APW, Uploading Printer Drivers to Samba Servers
    arp, Validation
    assessment, Introduction
    assumptions, Key Points Learned
    authconfig, PAM and NSS Client Configuration
    authenticate, Samba Configuration
    authenticated, Assignment Tasks
    authenticated connection, Validation, Validation
    authentication, The Nature of Windows Networking Protocols, Questions and Answers, Integrating Additional Services, Technical Issues, NSS Configuration, Questions and Answers
    plain-text, Questions and Answers
    authentication process, Implementation
    authentication protocols, Key Points Learned
    authoritative, Technical Issues
    authorized location, Kerberos Exposed
    auto-generated SID, Questions and Answers
    automatically allocate, Technical Issues
    availability, Performance, Reliability, and Availability

    B

    backends, Integrating Additional Services
    background communication, Questions and Answers
    Backup, Introduction
    Backup Domain Controller (see BDC)
    bandwidth, Assignment Tasks
    requirements, User Needs
    bandwidth calculations, Hardware Requirements
    BDC, Technical Issues, Assignment Tasks, Dissection and Discussion, Samba Server Implementation, Samba-3 PDC Configuration, The Nature of Windows Networking Protocols, Key Points Learned, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Technical Issues, Questions and Answers, Use and Location of BDCs
    benefit, Questions and Answers, Dissection and Discussion
    best practices, Introduction
    bias, Questions and Answers
    binary database, Implementation
    bind interfaces only, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
    broadcast, Questions and Answers, Routed Networks
    directed, The Nature of Windows Networking Protocols
    mailslot, The Nature of Windows Networking Protocols
    broadcast messages, Implementation
    broadcast storms, Network Collisions
    broken, Dissection and Discussion
    broken behavior, Dissection and Discussion
    browse, Technical Issues
    browse master, Findings
    Browse Master, Questions and Answers
    browseable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    Browser Election Service, Questions and Answers
    browsing, Assignment Tasks, Technical Issues, Technical Issues
    budgetted, Introduction
    bug fixes, Introduction

    C

    cache, Opportunistic Locking Controls
    cache directories, Removal of Pre-existing Conflicting RPMs
    caching, Samba Configuration
    case-sensitive, Kerberos Configuration
    centralized storage, Questions and Answers
    check samba - daemons, Validation, Validation
    check-point, Share Definition Controls
    Check-point Controls, Check-point Controls
    check-point controls, Check-point Controls
    chgrp, Samba Configuration
    chkconfig, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration, Implementation
    chmod, Samba Configuration
    choice, Dissection and Discussion, Technical Issues
    chown, Removal of Pre-existing Conflicting RPMs
    CIFS, Findings
    cifsfs, Dissection and Discussion
    clean database, Questions and Answers
    Clock skew, Kerberos Configuration
    cluster, Introduction
    clustering, Introduction, For Scalability, Use SAN Based Storage on Samba Servers
    collision rates, Network Collisions
    comment, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    commercial, Dissection and Discussion
    commercial software, Dissection and Discussion
    Common Internet File System (see CIFS)
    comparison
    Active Directory & OpenLDAP, Dissection and Discussion
    compat, Samba Domain with Samba Domain Member Server Using LDAP
    compatible, Technical Issues
    complexities, Dissection and Discussion
    compromise, Introduction, Introduction, Technical Issues
    computer account, Samba Configuration
    Computer Management, Share Access Controls, Questions and Answers
    condemns, Technical Issues
    conferences, Technical Issues
    connection, Share Access Controls
    connectivity, Questions and Answers
    consequential risk, Technical Issues
    consultant, Drafting Office, Introduction, Dissection and Discussion
    consumer, Dissection and Discussion, Technical Issues
    contiguous directory, Implementation
    copy, Questions and Answers
    corrective action, Hardware Problems
    cost, Dissection and Discussion
    credential, Share Definition Controls
    credentials, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Technical Issues
    crippled, Dissection and Discussion
    criticism, Active Directory, Kerberos, and Security, Introduction
    Critics, Technical Issues
    Cryptographic, Technical Issues
    CUPS, Dissection and Discussion, Technical Issues, Implementation, Key Points Learned, Implementation, Printer Configuration, Server Preparation All Servers, Assignment Tasks, Installation of Printer Driver Auto-Download, Printer Configuration
    queue, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    cupsd, Basic System Configuration

    D

    daemon, Validation, Basic System Configuration, Technical Issues, Questions and Answers, Starting Samba
    daemon control, Process Startup Configuration
    data
    corruption, Making Users Happy
    integrity, Questions and Answers
    data corruption, Hardware Problems, Act! Database Sharing
    data integrity, Hardware Problems, Shared Data Integrity
    data storage, Implementation
    database, Dissection and Discussion, Questions and Answers
    database applications, Shared Data Integrity
    DCE, Kerberos Exposed
    DDNS (see dynamic - DNS)
    default devmode, Samba Configuration, Implementation
    default installation, Samba System File Location
    default password, The LDAP Account Manager
    default profile, Assignment Tasks, Technical Issues
    Default User, Profile Changes, Configuration of Default Profile with Folder Redirection
    defective
    cables, Hardware Problems
    hubs, Hardware Problems
    switches, Hardware Problems
    defects, Technical Issues
    defensible standards, Technical Issues
    defragmentation, Windows Client Configuration
    delete group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    delete user from group script, Samba-3 PDC Configuration, Implementation
    delete user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    delimiter, Check-point Controls
    dependability, Technical Issues
    desired security setting, Setting Posix ACLs in UNIX/Linux
    development, Technical Issues
    DHCP, Technical Issues, Implementation, Key Points Learned, Windows Client Configuration, Windows Client Configuration, The Nature of Windows Networking Protocols, Questions and Answers
    client, Bad Hostnames
    relay, Technical Issues
    Relay Agent, Questions and Answers
    request, Questions and Answers
    requests, Technical Issues
    servers, Questions and Answers
    traffic, Questions and Answers
    dhcp client validation, Validation, Validation
    DHCP Server, Implementation
    DHCP server, Technical Issues
    diffusion, Technical Issues
    digital rights, Technical Issues
    digital sign'n'seal, Technical Issues
    digits, Bad Hostnames
    diligence, Technical Issues
    directory, Dissection and Discussion, Political Issues
    Computers container, LDAP Initialization and Creation of User and Group Accounts
    management, Dissection and Discussion
    People container, LDAP Initialization and Creation of User and Group Accounts
    replication, Dissection and Discussion
    schema, Dissection and Discussion
    server, Technical Issues
    synchronization, Dissection and Discussion
    directory tree, Setting Posix ACLs in UNIX/Linux
    disable, Introduction
    disable spoolss, Implementation, Implementation
    disaster recovery, Introduction
    disk image, Assignment Tasks
    disruptive, Dissection and Discussion
    distributed, Identity Management Needs, Implementation, Questions and Answers, Distribute Network Load with MSDFS
    distributed domain, Identity Management Needs
    DMB, Questions and Answers
    DNS, Technical Issues, Implementation, Technical Issues, The Nature of Windows Networking Protocols, Bad Hostnames, Routed Networks, Joining a Domain: Windows 200x/XP Professional
    configuration, Questions and Answers
    Dynamic, Questions and Answers
    dynamic, Joining a Domain: Windows 200x/XP Professional
    lookup, Questions and Answers, Kerberos Configuration
    name lookup, Bad Hostnames
    SRV records, Kerberos Configuration
    suffix, Joining a Domain: Windows 200x/XP Professional
    DNS server, Implementation, Configuration of DHCP and DNS Servers
    document the settings, Samba Configuration
    documentation, Dissection and Discussion, Technical Issues
    documented, Samba Configuration
    Domain, Technical Issues, Questions and Answers
    group, Questions and Answers
    groups, Technical Issues
    user, Questions and Answers
    domain
    Active Directory, Technical Issues
    joining, Appendix: A Collection of Useful Tid-bits
    trusted, Questions and Answers
    Domain accounts, Technical Issues
    Domain Administrator, Share Access Controls
    Domain Controller, Key Points Learned, The Nature of Windows Networking Protocols, Technical Issues, Implementation, Use and Location of BDCs
    closest, The Nature of Windows Networking Protocols
    Domain Controllers, Technical Issues, Questions and Answers
    Domain Groups
    well-known, Initialization of the LDAP Database
    Domain join, Samba Domain with Samba Domain Member Server Using LDAP
    domain logons, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation
    Domain logons, Questions and Answers
    domain master, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend
    Domain Master Browser (see DMB)
    Domain Member, Use and Location of BDCs
    authoritative
    local accounts, Technical Issues
    client, Implementation
    desktop, Introduction
    server, Introduction, Technical Issues, Implementation, Active Directory Domain with Samba Domain Member Server
    servers, Technical Issues, Questions and Answers, Check-point Controls
    workstations, Implementation
    Domain Member server, Technical Issues, Questions and Answers
    Domain Member servers, Questions and Answers
    domain members, Questions and Answers
    domain name space, Identity Management Needs
    domain replication, Questions and Answers
    Domain SID, Technical Issues, NT4 Migration Using LDAP Backend, Questions and Answers
    domain tree, Identity Management Needs
    Domain User Manager, Configuring Profile Directories
    Domain users, Technical Issues
    dos2unix, Samba Configuration
    drive mapping, Technical Issues
    dumb printing, Installation of Printer Driver Auto-Download
    dump, Technical Issues, Questions and Answers
    duplicate accounts, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    dynamic DNS, Technical Issues

    F

    fail, The Nature of Windows Networking Protocols
    fail-over, Identity Management Needs, Implementation
    failed join, Active Directory Domain with Samba Domain Member Server
    failure, Questions and Answers, Samba Configuration
    familiar, Technical Issues
    fatal problem, Samba Configuration
    fear, Technical Issues
    fears, Technical Issues
    FHS, Samba System File Location
    file and print server, Questions and Answers
    file and print service, Dissection and Discussion
    file cacheing, Opportunistic Locking Controls
    file caching, Samba Configuration
    File Hierarchy System (see FHS)
    file locations, Samba System File Location
    file permissions, The LDAP Account Manager
    file server
    read-only, Dissection and Discussion
    file servers, Samba Server Implementation
    file system, Technical Issues
    access control, Samba Configuration
    Ext3, Implementation
    permissions, Samba Configuration, Configuration for Server: MASSIVE
    file system security, Questions and Answers
    filter, Share Access Controls
    financial responsibility, Introduction
    firewall, Technical Issues, Basic System Configuration, Introduction
    fix, Dissection and Discussion
    flaws, Introduction
    flexibility, Technical Issues
    flush
    cache memory, Opportunistic Locking Controls
    folder redirection, Technical Issues, Configuration of Default Profile with Folder Redirection, Questions and Answers
    force group, Implementation, Override Controls, Questions and Answers
    force user, Dissection and Discussion, Implementation, Override Controls, Questions and Answers
    forced settings, Override Controls
    foreign, Samba Domain with Samba Domain Member Server Using LDAP
    foreign SID, Samba Domain with Samba Domain Member Server Using LDAP
    forwarded, Routed Networks
    foundation members, Technical Issues
    Free Standards Grou (see FSG)
    front-end, Dissection and Discussion
    server, Distribute Network Load with MSDFS
    FSG, Samba System File Location
    FTP
    proxy, Questions and Answers
    full control, Share Access Controls, Using MS Windows Explorer (File Manager)
    fully qualified, Check-point Controls

    G

    getent, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    getfacl, Setting Posix ACLs in UNIX/Linux
    getgrgid(), Questions and Answers
    getgrnam, Technical Issues
    getpwnam, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
    getpwnam(), Questions and Answers
    GID, Implementation, Questions and Answers, Questions and Answers
    Goettingen, Questions and Answers
    government, Identity Management Needs
    GPL, Comments Regarding Software Terms of Use
    group account, Implementation, OpenLDAP Server Configuration
    group management, Implementation
    group membership, Implementation, Samba Configuration, Samba Domain with Samba Domain Member Server Using LDAP, Share Point Directory and File Permissions
    group names, Questions and Answers
    group policies, Introduction
    Group Policy, Joining a Domain: Windows 200x/XP Professional
    Group Policy editor, The Local Group Policy
    Group Policy Objects, The Local Group Policy
    groupadd, Implementation, Implementation, Questions and Answers
    groupdel, Questions and Answers
    groupmod, Questions and Answers
    GSS-API, Windows 200x/XP Client Interaction with Samba-3
    guest account, Findings and Comments, Dissection and Discussion, Technical Issues, Questions and Answers
    guest ok, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server

    I

    Idealx
    smbldap-tools, Install and Configure Idealx SMB-LDAP Scripts, LDAP Initialization and Creation of User and Group Accounts
    identifiers, Technical Issues
    identity, Questions and Answers, Kerberos Exposed
    management, Technical Issues
    identity management, Technical Issues, Dissection and Discussion, Political Issues
    Identity Management, Dissection and Discussion, The Nature of Windows Networking Protocols, Identity Management Needs
    Identity management, UNIX/Linux Client Domain Member
    Identity resolution, Samba Domain with Samba Domain Member Server Using LDAP, Active Directory Domain with Samba Domain Member Server, UNIX/Linux Client Domain Member, Questions and Answers
    Identity resolver, Questions and Answers
    IDMAP, Samba Domain with Samba Domain Member Server Using LDAP
    idmap backend, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
    IDMAP backend, Questions and Answers
    idmap gid, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
    idmap uid, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
    import, Technical Issues
    include, Implementation
    income, Dissection and Discussion
    independent expert, Introduction
    inetd, Process Startup Configuration
    inheritance, Setting Posix ACLs in UNIX/Linux
    initGrps.sh, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    initial credentials, Kerberos Configuration
    inoperative, Dissection and Discussion
    installation, Dissection and Discussion
    integrate, Technical Issues
    integrity, Introduction, Kerberos Exposed
    inter-operability, Dissection and Discussion, Technical Issues, Key Points Learned, Questions and Answers
    interdomain trusts, Identity Management Needs
    interfaces, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
    intermittent, Hardware Problems
    Internet Explorer, Technical Issues
    Internet Information Server, Questions and Answers
    IP forwarding, Implementation, Basic System Configuration, Configuration for Server: MASSIVE
    IPC$, Findings and Comments, Implementation
    iptables, Technical Issues
    isolated, Introduction
    Italian, Questions and Answers

    L

    LAM, The LDAP Account Manager
    configuration editor, The LDAP Account Manager
    configuration file, The LDAP Account Manager
    login screen, The LDAP Account Manager
    opening screen, The LDAP Account Manager
    profile, The LDAP Account Manager
    wizard, The LDAP Account Manager
    LDAP, Technical Issues, Assignment Tasks, Dissection and Discussion, Technical Issues, PAM and NSS Client Configuration, Introduction, Dissection and Discussion, Identity Management Needs, Implementation, Key Points Learned, Questions and Answers, Assignment Tasks, Technical Issues, Questions and Answers, Technical Issues, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Technical Issues
    backend, Identity Management Needs
    database, LDAP Initialization and Creation of User and Group Accounts, Identity Management Needs, Questions and Answers, Alternative LDAP Database Initialization
    directory, Identity Management Needs
    fail-over, Implementation
    initial configuration, Alternative LDAP Database Initialization
    master, Identity Management Needs
    master/slave
    background communication, Questions and Answers
    preload, Implementation
    secure, Technical Issues
    server, Questions and Answers
    slave, Identity Management Needs
    updates, Identity Management Needs
    ldap, Samba Domain with Samba Domain Member Server Using LDAP
    LDAP Account Manager (see LAM)
    ldap admin dn, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    LDAP backend, Technical Issues
    LDAP database, Questions and Answers
    ldap group suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    ldap idmap suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    LDAP Interchange Format (see LDIF)
    ldap machine suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    LDAP server, Identity Management Needs
    ldap ssl, Active Directory Domain with Samba Domain Member Server
    ldap suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    ldap user suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    LDAP-transfer-LDIF.txt, Implementation
    ldap.conf, Samba Domain with Samba Domain Member Server Using LDAP
    ldapadd, LDAP Initialization and Creation of User and Group Accounts, Samba Domain with Samba Domain Member Server Using LDAP
    ldapsam, LDAP Initialization and Creation of User and Group Accounts, Dissection and Discussion, Assignment Tasks, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Integrating Additional Services
    ldapsam backend, Samba Domain with Samba Domain Member Server Using LDAP
    ldapsearch, LDAP Initialization and Creation of User and Group Accounts
    LDIF, Technical Issues, Implementation, Initialization of the LDAP Database
    leadership, Technical Issues
    Lightweight Directory Access Protocol (see LDAP)
    limit, Questions and Answers
    Linux desktop, Introduction
    Linux Standards Base (see LSB)
    LMB, Findings, Questions and Answers
    LMHOSTS, Routed Networks
    load distribution, For Scalability, Use SAN Based Storage on Samba Servers
    local accounts, Technical Issues
    Local Group Policy, Roaming Profile Background
    local groups, Questions and Answers
    Local Master Announcement, Findings
    Local Master Browser (see LMB)
    local users, Questions and Answers
    localhost, Basic System Configuration, Bad Hostnames
    locking, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation
    Application level, Shared Data Integrity
    Client side, Shared Data Integrity
    Server side, Shared Data Integrity
    log file, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    log level, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    logging, Removal of Pre-existing Conflicting RPMs
    login, Technical Issues
    logon credentials, Questions and Answers
    logon drive, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation
    logon home, Samba Configuration, Implementation
    logon hours, Technical Issues, Key Points Learned
    logon machines, Technical Issues
    logon path, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation
    logon process, Implementation
    logon scrip, Samba Configuration, Technical Issues
    logon script, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Preparation of Logon Scripts, Implementation, Technical Issues
    logon server, The Nature of Windows Networking Protocols
    logon services, Implementation
    logon time, Assignment Tasks
    logon traffic, The Nature of Windows Networking Protocols
    loopback, Validation
    low performance, Hardware Problems
    lower-case, Technical Issues
    lpadmin, Implementation, Implementation, Implementation, Printer Configuration, Printer Configuration
    LSB, Samba System File Location

    M

    machine accounts, Questions and Answers
    machine secret password, Technical Issues
    managed, Technical Issues
    management, Political Issues, Questions and Answers
    group, Technical Issues
    User, Technical Issues
    mandatory profile, Technical Issues, Configuring Profile Directories
    map acl inherit, Samba Configuration, Implementation, Samba-3 PDC Configuration
    mapped drives, Questions and Answers
    mapping, Technical Issues, Kerberos Configuration
    consistent, Samba Domain with Samba Domain Member Server Using LDAP
    master, Dissection and Discussion
    material, Appendix: A Collection of Useful Tid-bits
    max log size, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    memory requirements, Hardware Requirements
    merge, Technical Issues, Questions and Answers
    merged, Technical Issues
    meta-directory, Questions and Answers
    meta-service, Questions and Answers
    Microsoft Access, Shared Data Integrity
    Microsoft Excel, Shared Data Integrity
    Microsoft ISA, Assignment Tasks
    Microsoft Management Console (see MMC)
    Microsoft Office, Application Share Configuration, Share Point Directory and File Permissions
    Microsoft Outlook
    PST files, Questions and Answers
    migrate, Technical Issues
    migration, Implementation, Implementation, Assignment Tasks, Introduction, Questions and Answers
    objectives, Dissection and Discussion
    Migration speed, Questions and Answers
    mime type, Implementation, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    mime types, Implementation
    missing RPC's, Technical Issues
    MIT, Implementation, Kerberos Configuration
    MIT Kerberos, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
    MIT KRB5, Samba Configuration
    mixed mode, Active Directory Domain with Samba Domain Member Server
    mixed-mode, Questions and Answers
    mkntpasswd, Install and Configure Idealx SMB-LDAP Scripts
    MMC, Configure Delete Cached Profiles on Logout, Technical Issues, Questions and Answers
    mobile computing, Dissection and Discussion
    mobility, Technical Issues
    modularization, Technical Issues
    modules, Questions and Answers
    MS Access
    validate, Microsoft Access
    MS Outlook
    PST file, Making Users Happy
    MS Windows Server 2003, Implementation
    MS Word, Share Point Directory and File Permissions
    MSDFS, Distribute Network Load with MSDFS
    multi-subnet, Routed Networks
    multi-user
    access, Microsoft Access
    data access, Shared Data Integrity
    multiple directories, Identity Management Needs
    multiple domain controllers, Making Users Happy
    multiple group mappings, Questions and Answers
    My Documents, Roaming Profile Background
    My Network Places, Implementation
    mysqlsam, Implementation

    N

    name resolution, Assignment Tasks, Configuration of DHCP and DNS Servers, Questions and Answers
    Defective, Active Directory Domain with Samba Domain Member Server
    name resolve order, Questions and Answers, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Name Service Switch, Implementation
    name service switch (see NSS)
    named, Basic System Configuration, Validation, Server Preparation All Servers
    NAT, Technical Issues
    native, Questions and Answers
    net
    ads
    info, Active Directory Domain with Samba Domain Member Server
    join, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Samba Configuration
    status, Active Directory Domain with Samba Domain Member Server
    getlocalsid, Samba-3 PDC Configuration
    group, NT4 Migration Using tdbsam Backend
    groupmap
    add, Samba Configuration
    list, Samba Configuration, LDAP Initialization and Creation of User and Group Accounts
    modify, Samba Configuration
    rpc
    getsid, NT4 Migration Using LDAP Backend
    join, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers
    vampire, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend
    NetBIOS, Questions and Answers, The Nature of Windows Networking Protocols, Questions and Answers, Bad Hostnames, Routed Networks
    name cache, Questions and Answers
    name resolution
    delays, Making Users Happy
    Node Type, Questions and Answers
    netbios forwarding, Network Collisions
    netbios name, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, NSS Configuration, Bad Hostnames
    NetBIOS name, Kerberos Configuration
    aliases, Identity Management Needs
    NETLOGON, Using a Network Default User Profile, Windows Client Configuration
    netlogon, The Nature of Windows Networking Protocols
    Netlogon, Joining a Domain: Windows 200x/XP Professional
    netmask, Implementation
    Netware, Small Office Networking
    network
    administrators, Technical Issues
    analyzer, Assignment Tasks
    bandwidth, Identity Management Needs, Questions and Answers
    broadcast, Introduction
    captures, Requirements and Notes
    collisions, Network Collisions
    load, Network Collisions
    logon, Making Users Happy
    logon scripts, Dissection and Discussion
    management, Introduction
    multi-segment, Introduction
    overload, Making Users Happy
    performance, Samba Configuration
    routed, Dissection and Discussion
    secure, Introduction
    segment, Dissection and Discussion
    services, Questions and Answers
    sniffer, Requirements and Notes
    tiemouts, Network Collisions
    timeout, Making Users Happy
    trace, Assignment Tasks
    traffic
    observation, Technical Issues
    wide-area, Dissection and Discussion, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Network Address Translation (see NAT)
    network administrators, Technical Issues
    network attached storage (see NAS)
    Network Default Profile, Roaming Profile Background
    network hardware
    defective, Making Users Happy
    network hygiene, Dissection and Discussion
    network Identities, Questions and Answers
    network load factors, Dissection and Discussion
    Network Neighborhood, Validation, Technical Issues
    network segment, Use and Location of BDCs
    network segments, Hardware Requirements
    network share, Assignment Tasks
    networking hardware
    defective, Making Users Happy
    networking protocols, Technical Issues
    next generation, Technical Issues
    NFS server, Samba-3 PDC Configuration
    NICs, Hardware Problems
    NIS, LDAP Initialization and Creation of User and Group Accounts, Identity Management Needs, Questions and Answers, Technical Issues, Political Issues, Questions and Answers
    nis, Samba Domain with Samba Domain Member Server Using LDAP
    NIS schema, Questions and Answers
    NIS server, Questions and Answers
    NIS+, Identity Management Needs
    nisplus, Samba Domain with Samba Domain Member Server Using LDAP
    nmap, Validation
    nmbd, Validation, Validation, Samba Configuration, Starting Samba
    nobody, Findings and Comments, Removal of Pre-existing Conflicting RPMs
    NSS, Technical Issues, PAM and NSS Client Configuration, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, UNIX/Linux Client Domain Member, Questions and Answers, NSS Configuration (see Name Service Switch)
    nss_ldap, Technical Issues, OpenLDAP Server Configuration, PAM and NSS Client Configuration, LDAP Initialization and Creation of User and Group Accounts, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
    nt acl support, Dissection and Discussion, Implementation
    NT4 registry, Dissection and Discussion
    NTLM, Technical Issues
    NTLM authentication daemon, Technical Issues
    NTLMSSP, Windows 200x/XP Client Interaction with Samba-3, Key Points Learned, Questions and Answers
    NTLMSSP_AUTH, Windows 200x/XP Client Interaction with Samba-3
    ntlm_auth, Samba Configuration, Questions and Answers
    NTP, Kerberos Configuration
    NTUSER.DAT, Roaming Profile Background, Profile Changes, Using a Network Default User Profile, Questions and Answers
    NULL connection, Validation
    NULL session, Findings and Comments
    NULL-Session, Discussion

    P

    package, Implementation
    package names, Samba System File Location
    PADL, Technical Issues
    PADL LDAP tools, Technical Issues
    PADL Software, Samba Domain with Samba Domain Member Server Using LDAP
    PAM, PAM and NSS Client Configuration, UNIX/Linux Client Domain Member
    pam password change, Samba Configuration
    pam_ldap, OpenLDAP Server Configuration
    pam_ldap.so, PAM and NSS Client Configuration
    pam_unix2.so, PAM and NSS Client Configuration
    use_ldap, PAM and NSS Client Configuration
    passdb backend, Implementation, Samba Configuration, The 500-User Office, Implementation, Dissection and Discussion, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Dissection and Discussion, Implementation, Assignment Tasks, Questions and Answers, Technical Issues, Questions and Answers
    passdb.tdb, Technical Issues
    passwd, Implementation, Implementation, Samba Configuration
    passwd chat, Implementation, Samba Configuration
    password
    backend, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    password caching, Implementation
    password change, Key Points Learned
    password length, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
    password server, NSS Configuration
    path, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    pdbedit, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, NT4 Migration Using tdbsam Backend, Questions and Answers
    PDC, Assignment Tasks, Technical Issues, Technical Issues, The Local Group Policy, The Nature of Windows Networking Protocols, Technical Issues, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Technical Issues, Questions and Answers, Use and Location of BDCs
    PDF, The LDAP Account Manager
    performance, Dissection and Discussion, Questions and Answers, Performance, Reliability, and Availability, Introduction, Network Collisions
    performance degradation, Override Controls, Samba Configuration
    Perl, The LDAP Account Manager
    permission, Share Point Directory and File Permissions
    permissions, Implementation, Technical Issues, Share Access Controls, Check-point Controls, Share Point Directory and File Permissions, Removal of Pre-existing Conflicting RPMs
    excessive, Technical Issues
    group, Share Point Directory and File Permissions
    user, Share Point Directory and File Permissions
    Permissions, Using the MMC Computer Management Interface
    permits, Technical Issues
    permitted group, Using the MMC Computer Management Interface
    PHP, The LDAP Account Manager
    PHP4, The LDAP Account Manager
    pile-driver, Share Definition Controls
    ping, Validation, NT4 Migration Using LDAP Backend
    pitfalls, The LDAP Account Manager
    plain-text, Questions and Answers
    Pluggable Authentication Modules (see PAM)
    policy, Questions and Answers, Introduction
    poor performance, Dissection and Discussion
    Posix, Dissection and Discussion, Technical Issues, Technical Issues, Questions and Answers, Questions and Answers, The LDAP Account Manager
    Posix accounts, LDAP Initialization and Creation of User and Group Accounts, Technical Issues
    Posix ACLs, Managing Windows 200x ACLs
    PosixAccount, LDAP Initialization and Creation of User and Group Accounts
    Postscript, Installation of Printer Driver Auto-Download
    powers, Share Definition Controls
    practices, Introduction
    preferred master, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
    preload.LDIF, NT4 Migration Using LDAP Backend
    presence and leadership, Technical Issues
    price paid, Dissection and Discussion
    primary group, Samba Domain with Samba Domain Member Server Using LDAP, Share Point Directory and File Permissions
    principals, Kerberos Exposed
    print filter, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    print queue, Charity Administration Office, Dissection and Discussion
    print spooler, Charity Administration Office
    Print Test Page, Uploading Printer Drivers to Samba Servers
    printable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    printcap name, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    printer admin, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    printer - validation, Validation, Validation
    printers
    Advanced, Uploading Printer Drivers to Samba Servers
    Default Settings, Uploading Printer Drivers to Samba Servers
    General, Uploading Printer Drivers to Samba Servers
    Properties, Uploading Printer Drivers to Samba Servers
    Security, Uploading Printer Drivers to Samba Servers
    Sharing, Uploading Printer Drivers to Samba Servers
    printing, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    drag-and-drop, Installation of Printer Driver Auto-Download, Uploading Printer Drivers to Samba Servers
    dumb, Installation of Printer Driver Auto-Download
    point-n-click, Installation of Printer Driver Auto-Download
    raw, Dissection and Discussion
    privacy, Identity Management Needs
    Privilege Attribute Certificates (see PAC)
    privilege controls, Share Point Directory and File Permissions
    privileged pipe, Samba Configuration
    privileges, Identity Management Needs, Technical Issues, Share Definition Controls
    product defects, Dissection and Discussion
    profile
    default, Assignment Tasks
    mandatory, The Nature of Windows Networking Protocols
    roaming, Making Users Happy
    profile acls, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation
    profile path, Technical Issues
    profile share, Implementation
    profiles share, Dissection and Discussion
    programmer, Dissection and Discussion
    project maintainers, Technical Issues
    Properties, Using the MMC Computer Management Interface
    proprietary, Technical Issues
    protected, Technical Issues
    protection, Technical Issues
    protocol
    negotiation, The Nature of Windows Networking Protocols
    protocol analysis, Requirements and Notes
    protocols, Technical Issues
    proxy, Assignment Tasks, Technical Issues
    public specifications, Technical Issues

    R

    RAID, Hardware Requirements
    RAID controllers, Hardware Problems
    Raw Print Through, Installation of Printer Driver Auto-Download
    raw printing, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    rcldap, Implementation
    read only, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    realm, Active Directory Domain with Samba Domain Member Server, Kerberos Configuration, NSS Configuration
    recognize, Technical Issues
    record locking, Microsoft Access
    recursively, Setting Posix ACLs in UNIX/Linux
    Red Hat Fedora Linux, Samba Configuration
    Red Hat Linux, Drafting Office, Dissection and Discussion, Accounting Office, Samba Server Implementation, PAM and NSS Client Configuration, Implementation, Active Directory Domain with Samba Domain Member Server, Implementation, Samba Configuration
    redirected folders, Roaming Profile Background, The Nature of Windows Networking Protocols
    refereed standards, Technical Issues
    regedit, Implementation
    regedt32, Profile Changes, Configuration of Default Profile with Folder Redirection
    registry, Questions and Answers
    keys
    SAM, Dissection and Discussion
    SECURITY, Dissection and Discussion
    registry change, Questions and Answers
    Registry Editor, Configuration of Default Profile with Folder Redirection
    registry hacks, Questions and Answers
    registry keys, Configuration of Default Profile with Folder Redirection
    reimburse, Dissection and Discussion
    rejected, Share Access Controls
    rejoin, Questions and Answers
    reliability, Performance, Reliability, and Availability
    remote announce, Routed Networks
    remote browse sync, Routed Networks
    remote procedure call (see RPC)
    replicate, Questions and Answers, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    replicated, Dissection and Discussion
    resilient, Guidelines for Reliable Samba Operation
    resolve, Technical Issues, Bad Hostnames
    responsibility, Dissection and Discussion
    responsible, Technical Issues
    restricted export, Kerberos Exposed
    Restrictive security, Active Directory Domain with Samba Domain Member Server
    reverse DNS, Kerberos Configuration
    risk, Technical Issues, Questions and Answers, Questions and Answers, Introduction
    road-map, Technical Issues
    published, Technical Issues
    roaming profile, Technical Issues, Roaming Profile Background, Configuring Profile Directories, User Needs, Questions and Answers
    roaming profiles, Technical Issues, Implementation, Roaming Profile Background
    routed network, Use and Location of BDCs
    router, Implementation
    routers, Questions and Answers, Routed Networks
    RPC, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
    RPM
    install, Implementation
    rpm, Removal of Pre-existing Conflicting RPMs, Samba System File Location
    RPMs, Samba Configuration
    rpms, Removal of Pre-existing Conflicting RPMs
    rsync, Samba-3 PDC Configuration, Questions and Answers, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    run-time control files, Samba System File Location

    S

    safe-guards, Technical Issues
    SAM, Dissection and Discussion
    samba, Removal of Pre-existing Conflicting RPMs
    starting samba, Implementation
    Samba, Samba Configuration
    Samba accounts, Technical Issues
    samba cluster, Introduction
    samba control script, Starting Samba
    Samba Domain, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Samba Domain server, Using the MMC Computer Management Interface
    Samba RPM Packages, Samba-3 PDC Configuration
    Samba Tea, Samba Configuration
    SambaSamAccount, LDAP Initialization and Creation of User and Group Accounts
    SambaXP conference, Questions and Answers
    SAN, For Scalability, Use SAN Based Storage on Samba Servers
    scalability, Introduction
    scalable, Identity Management Needs
    schannel, Technical Issues, Key Points Learned, Questions and Answers
    schema, Questions and Answers
    scripts, The LDAP Account Manager
    secondary group, Samba Domain with Samba Domain Member Server Using LDAP
    secret, Kerberos Exposed
    secrets.tdb, Technical Issues, Samba-3 PDC Configuration, NT4 Migration Using LDAP Backend
    secure, Introduction
    secure account password, Questions and Answers
    secure connections, The LDAP Account Manager
    secure networking, Technical Issues
    secure networking protocols, Technical Issues
    security, Implementation, Implementation, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Technical Issues, Share Point Directory and File Permissions, Questions and Answers, NSS Configuration
    share mode, Dissection and Discussion
    user mode, Dissection and Discussion
    Security, Technical Issues, Using the MMC Computer Management Interface
    Security Account Manager (see SAM)
    security controls, Technical Issues
    security descriptors, Dissection and Discussion
    security fixes, Technical Issues
    security updates, Technical Issues
    SerNet, Active Directory Domain with Samba Domain Member Server, Samba Configuration
    server string, Active Directory Domain with Samba Domain Member Server
    service, Implementation
    smb
    start, Configuration Specific to Domain Member Servers: BLDG1, BLDG2
    Service Packs, Application Share Configuration
    services, Key Points Learned
    session setup, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
    Session Setup, Simple Windows Client Connection Characteristics
    set primary group script, Samba-3 PDC Configuration, Implementation
    setfacl, Setting Posix ACLs in UNIX/Linux
    severely degrade, Samba Configuration
    SGID, Dissection and Discussion, Share Point Directory and File Permissions, Effect of Setting File and Directory SUID/SGID Permissions Explained
    shadow-utils, Questions and Answers
    share, Questions and Answers
    Share Access Controls, Share Access Controls
    share ACLs, Questions and Answers
    share definition, Technical Issues
    Share Definition
    Controls, Share Definition Controls
    share definition controls, Share Definition Controls, Check-point Controls, Share Point Directory and File Permissions, Questions and Answers
    share level access controls, Questions and Answers
    share level ACL, Questions and Answers
    Share Permissions, Share Access Controls
    shared resource, Technical Issues, Setting Posix ACLs in UNIX/Linux
    shares, Technical Issues
    show add printer wizard, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation
    shutdown script, Samba Configuration, Implementation, Implementation
    SID, Windows Client Configuration, Identity Management Needs, Questions and Answers, Technical Issues, Initialization of the LDAP Database
    side effects, Managing Windows 200x ACLs
    Sign'n'seal, Key Points Learned, Questions and Answers
    silent return, Active Directory Domain with Samba Domain Member Server
    simple, Dissection and Discussion
    Single Sign-On (see SOS)
    slapadd, NT4 Migration Using LDAP Backend
    slapcat, LDAP Initialization and Creation of User and Group Accounts, Samba Domain with Samba Domain Member Server Using LDAP
    slave, Dissection and Discussion
    slow logon, Making Users Happy
    slow network, Hardware Problems
    slurpd, Implementation, Questions and Answers
    smart printing, Dissection and Discussion
    SMB passwords, Implementation
    smb ports, Samba Configuration, Questions and Answers, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    SMB/CIFS, Questions and Answers
    smbclient, Validation, Validation, LDAP Initialization and Creation of User and Group Accounts, NT4 Migration Using LDAP Backend, Questions and Answers
    smbd, Validation, Implementation, Validation, Validation, Samba-3 PDC Configuration, Technical Issues, Active Directory Domain with Samba Domain Member Server, Samba Configuration, Questions and Answers, Starting Samba
    location of files, Samba System File Location
    smbfs, Dissection and Discussion
    smbldap-groupadd.pl, LDAP Initialization and Creation of User and Group Accounts
    smbldap-passwd.pl, LDAP Initialization and Creation of User and Group Accounts
    smbldap-populate.pl, LDAP Initialization and Creation of User and Group Accounts
    smbldap-tools, The LDAP Account Manager
    smbldap-useradd.pl, LDAP Initialization and Creation of User and Group Accounts, Implementation
    smbldap-usermod.pl, LDAP Initialization and Creation of User and Group Accounts
    smbmnt, Dissection and Discussion
    smbmount, Dissection and Discussion
    smbpasswd, Implementation, Technical Issues, Implementation, Technical Issues, Samba Configuration, Server Preparation All Servers, Configuration for Server: MASSIVE, Samba-3 PDC Configuration, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, Dissection and Discussion, Implementation, Technical Issues, Questions and Answers, Questions and Answers, Integrating Additional Services
    smbumnt, Dissection and Discussion
    smbumount, Dissection and Discussion
    snap-shot, Dissection and Discussion
    socket address, Samba Configuration
    socket options, Samba Configuration
    software, Dissection and Discussion
    solve, Dissection and Discussion
    source code, Dissection and Discussion
    SPNEGO, Windows 200x/XP Client Interaction with Samba-3
    SQL, Dissection and Discussion, Questions and Answers
    Squid, Technical Issues, Implementation, Removal of Pre-existing Conflicting RPMs, Samba Configuration, Squid Configuration
    squid, Removal of Pre-existing Conflicting RPMs, Samba Configuration
    Squid proxy, Technical Issues
    SRVTOOLS.EXE, Implementation, Configuring Profile Directories, Questions and Answers, Questions and Answers
    SSL, The LDAP Account Manager
    starting - CUPS, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration
    starting dhcpd, Implementation, Process Startup Configuration, Process Startup Configuration
    starting samba, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration
    nmbd, Starting Samba
    smbd, Starting Samba
    winbindd, Starting Samba
    startup script, Starting Samba
    sticky bit, Implementation
    storage capacity, Hardware Requirements
    strategic, Technical Issues
    strategy, Questions and Answers
    straw-man, Active Directory, Kerberos, and Security
    strict sync, Samba Configuration
    strong cryptography, Kerberos Exposed
    SUID, Dissection and Discussion, Questions and Answers, Effect of Setting File and Directory SUID/SGID Permissions Explained
    Sun ONE Identity Server, Dissection and Discussion
    super daemon, Process Startup Configuration
    support, Dissection and Discussion
    survey, Adding UNIX/LINUX Servers and Clients
    SUSE Enterprise Linux Server, Charity Administration Office, Basic System Configuration, Implementation
    SUSE Linux, Dissection and Discussion, Samba Server Implementation, PAM and NSS Client Configuration, Implementation, Active Directory Domain with Samba Domain Member Server, Implementation, Removal of Pre-existing Conflicting RPMs
    SWAT, Samba System File Location
    sync always, Samba Configuration
    synchronization, Kerberos Configuration, For Scalability, Use SAN Based Storage on Samba Servers
    synchronize, User Needs
    synchronized, Questions and Answers
    syslog, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    system level logins, Questions and Answers
    system security, Technical Issues

    T

    tattooing, Questions and Answers
    TCP/IP, Questions and Answers
    tdbdump, NT4 Migration Using LDAP Backend, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    tdbsam, Technical Issues, Implementation, The 500-User Office, Assignment Tasks, Dissection and Discussion, Implementation, Technical Issues, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers
    template primary group, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    template shell, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    testparm, Validation, Validation, Samba-3 PDC Configuration, Active Directory Domain with Samba Domain Member Server, Samba Configuration
    ticket, Samba Configuration
    time server, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    Tivoli Directory Server, Dissection and Discussion
    token, Technical Issues
    tool, Questions and Answers, Dissection and Discussion
    track record, Dissection and Discussion
    traffic collisions, Making Users Happy
    transaction processing, Dissection and Discussion
    transactional, Questions and Answers
    transfer, Questions and Answers
    translate, Managing Windows 200x ACLs
    traverse, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Tree Connect, Simple Windows Client Connection Characteristics
    trusted computing, Introduction
    Trusted Domains, Technical Issues
    trusted domains, Questions and Answers
    trusted third-party, Kerberos Exposed
    trusting, Kerberos Exposed
    turn-around time, Technical Issues

    U

    UDP
    broadcast, Routed Networks
    UID, Dissection and Discussion, Technical Issues, Implementation, Questions and Answers, Questions and Answers
    un-join, Questions and Answers
    unauthorized activities, Kerberos Exposed
    UNC name, Questions and Answers
    unencrypted, The LDAP Account Manager
    Unicast, The Nature of Windows Networking Protocols
    Universal Naming Convention (see UNC name)
    UNIX
    groups, Technical Issues, Implementation
    UNIX account, Questions and Answers
    UNIX accounts, Technical Issues
    unix charset, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    unix password sync, Samba Configuration
    UNIX/Linux server, Technical Issues
    unix2dos, Samba Configuration
    unknown, Technical Issues
    updates, Introduction, Technical Issues
    uppercase, Technical Issues
    use client driver, Implementation, Implementation, Implementation, Samba Configuration, Implementation
    user
    management, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    user account, OpenLDAP Server Configuration
    User and Group Controls, Technical Issues
    user credentials, Identity Management Needs, UNIX/Linux Client Domain Member
    user errors, Questions and Answers
    user identities, Implementation
    user logins, Questions and Answers
    user management, Implementation
    User Mode, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3, Implementation
    useradd, Implementation, Implementation, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    username map, Implementation, Samba Configuration, Server Preparation All Servers, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    utilities, Questions and Answers
    utmp, Samba Configuration, Implementation, Implementation

    W

    wbinfo, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Samba Configuration
    weakness, Technical Issues
    web
    caching, Assignment Tasks
    proxying, Assignment Tasks
    Web
    proxy, Questions and Answers
    access, Key Points Learned
    Web browsers, Key Points Learned
    WebClient, Making Users Happy
    wide-area, User Needs, Identity Management Needs, Key Points Learned, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    wide-area network, Use and Location of BDCs, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    winbind, Implementation, Dissection and Discussion, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers, Introduction, Technical Issues, Technical Issues, Samba Configuration, NSS Configuration
    Winbind, Questions and Answers, Technical Issues, Key Points Learned
    winbind enable local accounts, Technical Issues, Questions and Answers
    winbind enum groups, NSS Configuration
    winbind enum users, NSS Configuration
    winbind separator, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
    winbind trusted domains only, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, Questions and Answers
    winbind use default domain, Check-point Controls
    winbind user default domain, NSS Configuration
    winbindd, Validation, Validation, Technical Issues, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, Questions and Answers, Samba Configuration, Questions and Answers, Starting Samba
    winbindd_cache.tdb, Technical Issues
    winbindd_idmap.tdb, Technical Issues
    Windows 2000 ACLs, Managing Windows 200x ACLs
    Windows 2003 Serve, Introduction
    Windows 200x ACLs, Questions and Answers
    Windows accounts, Technical Issues
    Windows ACLs, Setting Posix ACLs in UNIX/Linux
    Windows ADS Domain, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Windows clients, Questions and Answers
    Windows Explorer, Validation
    Windows explorer, Questions and Answers
    Windows security identifier (see SID)
    Windows Servers, Introduction
    Windows Services for UNIX (see SUS)
    Windows XP, Assignment Tasks
    WINS, Questions and Answers, Implementation, Technical Issues, Implementation, Windows Client Configuration, Technical Issues, Windows Client Configuration, The Nature of Windows Networking Protocols, Identity Management Needs, Questions and Answers
    lookup, Questions and Answers
    name resolution, Routed Networks
    server, Making Users Happy, Routed Networks
    WINS server, The 500-User Office, Questions and Answers
    wins server, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    WINS serving, Implementation
    wins support, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    wins.dat, Identity Management Needs
    Word, Share Point Directory and File Permissions
    workgroup, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
    Workgroup Announcement, Findings
    workstation, Implementation
    wrapper, Questions and Answers
    write list, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    write lock, Opportunistic Locking Controls

    Y

    YaST, PAM and NSS Client Configuration
    Yellow Pages, Identity Management Needs
    yellow pages (see NIS)
    +Index

    Index

    Symbols

    %LOGONSERVER%, Configuration of Default Profile with Folder Redirection
    %USERNAME%, Roaming Profile Background, Profile Changes
    %USERPROFILE%, Configuration of Default Profile with Folder Redirection
    /etc/cups/mime.convs, Implementation, Implementation
    /etc/cups/mime.types, Implementation, Implementation
    /etc/dhcpd.conf, Implementation, Validation, Configuration of DHCP and DNS Servers, Validation
    /etc/exports, Samba-3 PDC Configuration
    /etc/group, Technical Issues, Questions and Answers, Samba Domain with Samba Domain Member Server Using LDAP, Removal of Pre-existing Conflicting RPMs
    /etc/hosts, Implementation, Implementation, Basic System Configuration, Validation, Server Preparation All Servers, Questions and Answers, Kerberos Configuration, Bad Hostnames
    /etc/krb5.conf, Kerberos Configuration
    /etc/ldap.conf, PAM and NSS Client Configuration
    /etc/mime.convs, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    /etc/mime.types, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    /etc/named.conf, Configuration of DHCP and DNS Servers
    /etc/nsswitch.conf, Implementation, Configuration of DHCP and DNS Servers, Validation, Configuration for Server: MASSIVE, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, PAM and NSS Client Configuration, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers
    /etc/openldap/slapd.conf, OpenLDAP Server Configuration, Implementation
    /etc/passwd, Findings and Comments, Implementation, Samba Configuration, Configuration for Server: MASSIVE, LDAP Initialization and Creation of User and Group Accounts, Technical Issues, Questions and Answers, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers, Share Point Directory and File Permissions, Removal of Pre-existing Conflicting RPMs
    /etc/rc.d/boot.local, Basic System Configuration, Configuration for Server: MASSIVE
    /etc/rc.d/rc.local, Implementation
    /etc/resolv.conf, Configuration of DHCP and DNS Servers, Server Preparation All Servers
    /etc/samba, Samba System File Location
    /etc/samba/secrets.tdb, Active Directory Domain with Samba Domain Member Server
    /etc/samba/smbusers, Server Preparation All Servers
    /etc/squid/squid.conf, Removal of Pre-existing Conflicting RPMs
    /etc/xinetd.d, Process Startup Configuration, Process Startup Configuration
    /lib/libnss_ldap.so.2, PAM and NSS Client Configuration
    /proc/sys/net/ipv4/ip_forward, Implementation, Basic System Configuration
    /usr/bin, Samba System File Location
    /usr/lib/samba, Samba System File Location
    /usr/local, Samba System File Location
    /usr/local/samba, Samba System File Location
    /usr/sbin, Samba System File Location
    /usr/share, Samba System File Location
    /usr/share/samba/swat, Samba System File Location
    /usr/share/swat, Samba System File Location
    /var/lib/ldap, OpenLDAP Server Configuration
    /var/lib/samba, Samba System File Location
    /var/log/samba, Samba System File Location

    A

    abmas-netfw.sh, Basic System Configuration
    abort shutdown script, Samba Configuration, Implementation, Implementation
    accept, Printer Configuration
    accepts liability, Dissection and Discussion
    access, Technical Issues, Check-point Controls
    access control, Kerberos Exposed, Using the MMC Computer Management Interface
    Access Control Lists (see ACLs)
    access control settings, Share Access Controls
    access controls, Technical Issues, Share Definition Controls
    accessible, Share Point Directory and File Permissions
    account, Share Access Controls
    ADS Domain, Technical Issues
    account credentials, Findings and Comments
    account information, Questions and Answers
    account names, Questions and Answers
    account policies, The LDAP Account Manager
    accountable, Introduction, Dissection and Discussion
    accounts
    authoritative, Technical Issues
    Domain, Introduction, Questions and Answers
    group, Introduction, Questions and Answers, Introduction
    machine, Introduction, Questions and Answers
    manage, The LDAP Account Manager
    user, Introduction, Questions and Answers, Introduction
    ACL, Questions and Answers, Check-point Controls
    ACLs, Key Points Learned, Share Access Controls, Share Definition Controls
    acquisitions, Introduction
    Act!, Shared Data Integrity
    ACT! database, Act! Database Sharing
    Act!Diag, Act! Database Sharing
    Active Directory, Dissection and Discussion, The Local Group Policy, Dissection and Discussion, Assignment Tasks, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Key Points Learned, Questions and Answers, Integrating Additional Services, Assignment Tasks, Technical Issues, Samba Configuration, Joining a Domain: Windows 200x/XP Professional
    authentication, Squid Configuration
    domain, Samba Configuration
    join, Active Directory Domain with Samba Domain Member Server
    management tools, Technical Issues
    realm, Bad Hostnames
    Replacement, Technical Issues
    server, Active Directory Domain with Samba Domain Member Server, Kerberos Configuration
    Server, Technical Issues
    tree, Samba Configuration
    AD printer publishing, Uploading Printer Drivers to Samba Servers
    ADAM, Dissection and Discussion
    add group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    add machine script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    Add Printer Wizard
    APW, Uploading Printer Drivers to Samba Servers
    add user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    add user to group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    adduser, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    admin users, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    administrative installation, Application Share Configuration
    administrative rights, Check-point Controls
    administrator, Implementation, Samba Configuration, Server Preparation All Servers
    ADS, Technical Issues, Kerberos Configuration, Bad Hostnames
    server, Technical Issues
    ADS Domain, Technical Issues
    affordability, The Nature of Windows Networking Protocols
    alarm, Introduction
    algorithm, Technical Issues
    alternative, Dissection and Discussion
    analysis, Technical Issues
    anonymous connection, Validation, Validation
    Apache Web server, Questions and Answers
    appliance mode, Technical Issues
    application server, Technical Issues, Application Share Configuration
    application servers, The Nature of Windows Networking Protocols
    application/octet-stream, Implementation, Implementation, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    APW, Uploading Printer Drivers to Samba Servers
    arp, Validation
    assessment, Introduction
    assumptions, Key Points Learned
    authconfig, PAM and NSS Client Configuration
    authenticate, Samba Configuration
    authenticated, Assignment Tasks
    authenticated connection, Validation, Validation
    authentication, The Nature of Windows Networking Protocols, Questions and Answers, Integrating Additional Services, Technical Issues, NSS Configuration, Questions and Answers
    plain-text, Questions and Answers
    authentication process, Implementation
    authentication protocols, Key Points Learned
    authoritative, Technical Issues
    authorized location, Kerberos Exposed
    auto-generated SID, Questions and Answers
    automatically allocate, Technical Issues
    availability, Performance, Reliability, and Availability

    B

    backends, Integrating Additional Services
    background communication, Questions and Answers
    Backup, Introduction
    Backup Domain Controller (see BDC)
    bandwidth, Assignment Tasks
    requirements, User Needs
    bandwidth calculations, Hardware Requirements
    BDC, Technical Issues, Assignment Tasks, Dissection and Discussion, Samba Server Implementation, Samba-3 PDC Configuration, The Nature of Windows Networking Protocols, Key Points Learned, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Technical Issues, Questions and Answers, Use and Location of BDCs
    benefit, Questions and Answers, Dissection and Discussion
    best practices, Introduction
    bias, Questions and Answers
    binary database, Implementation
    bind interfaces only, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
    broadcast, Questions and Answers, Routed Networks
    directed, The Nature of Windows Networking Protocols
    mailslot, The Nature of Windows Networking Protocols
    broadcast messages, Implementation
    broadcast storms, Network Collisions
    broken, Dissection and Discussion
    broken behavior, Dissection and Discussion
    browse, Technical Issues
    browse master, Findings
    Browse Master, Questions and Answers
    browseable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    Browser Election Service, Questions and Answers
    browsing, Assignment Tasks, Technical Issues, Technical Issues
    budgetted, Introduction
    bug fixes, Introduction

    C

    cache, Opportunistic Locking Controls
    cache directories, Removal of Pre-existing Conflicting RPMs
    caching, Samba Configuration
    case-sensitive, Kerberos Configuration
    centralized storage, Questions and Answers
    check samba + daemons, Validation, Validation
    check-point, Share Definition Controls
    Check-point Controls, Check-point Controls
    check-point controls, Check-point Controls
    chgrp, Samba Configuration
    chkconfig, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration, Implementation
    chmod, Samba Configuration
    choice, Dissection and Discussion, Technical Issues
    chown, Removal of Pre-existing Conflicting RPMs
    CIFS, Findings
    cifsfs, Dissection and Discussion
    clean database, Questions and Answers
    Clock skew, Kerberos Configuration
    cluster, Introduction
    clustering, Introduction, For Scalability, Use SAN Based Storage on Samba Servers
    collision rates, Network Collisions
    comment, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    commercial, Dissection and Discussion
    commercial software, Dissection and Discussion
    Common Internet File System (see CIFS)
    comparison
    Active Directory & OpenLDAP, Dissection and Discussion
    compat, Samba Domain with Samba Domain Member Server Using LDAP
    compatible, Technical Issues
    complexities, Dissection and Discussion
    compromise, Introduction, Introduction, Technical Issues
    computer account, Samba Configuration
    Computer Management, Share Access Controls, Questions and Answers
    condemns, Technical Issues
    conferences, Technical Issues
    connection, Share Access Controls
    connectivity, Questions and Answers
    consequential risk, Technical Issues
    consultant, Drafting Office, Introduction, Dissection and Discussion
    consumer, Dissection and Discussion, Technical Issues
    contiguous directory, Implementation
    copy, Questions and Answers
    corrective action, Hardware Problems
    cost, Dissection and Discussion
    credential, Share Definition Controls
    credentials, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Technical Issues
    crippled, Dissection and Discussion
    criticism, Active Directory, Kerberos, and Security, Introduction
    Critics, Technical Issues
    Cryptographic, Technical Issues
    CUPS, Dissection and Discussion, Technical Issues, Implementation, Key Points Learned, Implementation, Printer Configuration, Server Preparation All Servers, Assignment Tasks, Installation of Printer Driver Auto-Download, Printer Configuration
    queue, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    cupsd, Basic System Configuration

    D

    daemon, Validation, Basic System Configuration, Technical Issues, Questions and Answers, Starting Samba
    daemon control, Process Startup Configuration
    data
    corruption, Making Users Happy
    integrity, Questions and Answers
    data corruption, Hardware Problems, Act! Database Sharing
    data integrity, Hardware Problems, Shared Data Integrity
    data storage, Implementation
    database, Dissection and Discussion, Questions and Answers
    database applications, Shared Data Integrity
    DCE, Kerberos Exposed
    DDNS (see dynamic + DNS)
    default devmode, Samba Configuration, Implementation
    default installation, Samba System File Location
    default password, The LDAP Account Manager
    default profile, Assignment Tasks, Technical Issues
    Default User, Profile Changes, Configuration of Default Profile with Folder Redirection
    defective
    cables, Hardware Problems
    hubs, Hardware Problems
    switches, Hardware Problems
    defects, Technical Issues
    defensible standards, Technical Issues
    defragmentation, Windows Client Configuration
    delete group script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    delete user from group script, Samba-3 PDC Configuration, Implementation
    delete user script, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    delimiter, Check-point Controls
    dependability, Technical Issues
    desired security setting, Setting Posix ACLs in UNIX/Linux
    development, Technical Issues
    DHCP, Technical Issues, Implementation, Key Points Learned, Windows Client Configuration, Windows Client Configuration, The Nature of Windows Networking Protocols, Questions and Answers
    client, Bad Hostnames
    relay, Technical Issues
    Relay Agent, Questions and Answers
    request, Questions and Answers
    requests, Technical Issues
    servers, Questions and Answers
    traffic, Questions and Answers
    dhcp client validation, Validation, Validation
    DHCP Server, Implementation
    DHCP server, Technical Issues
    diffusion, Technical Issues
    digital rights, Technical Issues
    digital sign'n'seal, Technical Issues
    digits, Bad Hostnames
    diligence, Technical Issues
    directory, Dissection and Discussion, Political Issues
    Computers container, LDAP Initialization and Creation of User and Group Accounts
    management, Dissection and Discussion
    People container, LDAP Initialization and Creation of User and Group Accounts
    replication, Dissection and Discussion
    schema, Dissection and Discussion
    server, Technical Issues
    synchronization, Dissection and Discussion
    directory tree, Setting Posix ACLs in UNIX/Linux
    disable, Introduction
    disable spoolss, Implementation, Implementation
    disaster recovery, Introduction
    disk image, Assignment Tasks
    disruptive, Dissection and Discussion
    distributed, Identity Management Needs, Implementation, Questions and Answers, Distribute Network Load with MSDFS
    distributed domain, Identity Management Needs
    DMB, Questions and Answers
    DNS, Technical Issues, Implementation, Technical Issues, The Nature of Windows Networking Protocols, Bad Hostnames, Routed Networks, Joining a Domain: Windows 200x/XP Professional
    configuration, Questions and Answers
    Dynamic, Questions and Answers
    dynamic, Joining a Domain: Windows 200x/XP Professional
    lookup, Questions and Answers, Kerberos Configuration
    name lookup, Bad Hostnames
    SRV records, Kerberos Configuration
    suffix, Joining a Domain: Windows 200x/XP Professional
    DNS server, Implementation, Configuration of DHCP and DNS Servers
    document the settings, Samba Configuration
    documentation, Dissection and Discussion, Technical Issues
    documented, Samba Configuration
    Domain, Technical Issues, Questions and Answers
    group, Questions and Answers
    groups, Technical Issues
    user, Questions and Answers
    domain
    Active Directory, Technical Issues
    joining, Appendix: A Collection of Useful Tid-bits
    trusted, Questions and Answers
    Domain accounts, Technical Issues
    Domain Administrator, Share Access Controls
    Domain Controller, Key Points Learned, The Nature of Windows Networking Protocols, Technical Issues, Implementation, Use and Location of BDCs
    closest, The Nature of Windows Networking Protocols
    Domain Controllers, Technical Issues, Questions and Answers
    Domain Groups
    well-known, Initialization of the LDAP Database
    Domain join, Samba Domain with Samba Domain Member Server Using LDAP
    domain logons, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation
    Domain logons, Questions and Answers
    domain master, Samba-3 BDC Configuration, Implementation, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend
    Domain Master Browser (see DMB)
    Domain Member, Use and Location of BDCs
    authoritative
    local accounts, Technical Issues
    client, Implementation
    desktop, Introduction
    server, Introduction, Technical Issues, Implementation, Active Directory Domain with Samba Domain Member Server
    servers, Technical Issues, Questions and Answers, Check-point Controls
    workstations, Implementation
    Domain Member server, Technical Issues, Questions and Answers
    Domain Member servers, Questions and Answers
    domain members, Questions and Answers
    domain name space, Identity Management Needs
    domain replication, Questions and Answers
    Domain SID, Technical Issues, NT4 Migration Using LDAP Backend, Questions and Answers
    domain tree, Identity Management Needs
    Domain User Manager, Configuring Profile Directories
    Domain users, Technical Issues
    dos2unix, Samba Configuration
    drive mapping, Technical Issues
    dumb printing, Installation of Printer Driver Auto-Download
    dump, Technical Issues, Questions and Answers
    duplicate accounts, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    dynamic DNS, Technical Issues

    F

    fail, The Nature of Windows Networking Protocols
    fail-over, Identity Management Needs, Implementation
    failed join, Active Directory Domain with Samba Domain Member Server
    failure, Questions and Answers, Samba Configuration
    familiar, Technical Issues
    fatal problem, Samba Configuration
    fear, Technical Issues
    fears, Technical Issues
    FHS, Samba System File Location
    file and print server, Questions and Answers
    file and print service, Dissection and Discussion
    file cacheing, Opportunistic Locking Controls
    file caching, Samba Configuration
    File Hierarchy System (see FHS)
    file locations, Samba System File Location
    file permissions, The LDAP Account Manager
    file server
    read-only, Dissection and Discussion
    file servers, Samba Server Implementation
    file system, Technical Issues
    access control, Samba Configuration
    Ext3, Implementation
    permissions, Samba Configuration, Configuration for Server: MASSIVE
    file system security, Questions and Answers
    filter, Share Access Controls
    financial responsibility, Introduction
    firewall, Technical Issues, Basic System Configuration, Introduction
    fix, Dissection and Discussion
    flaws, Introduction
    flexibility, Technical Issues
    flush
    cache memory, Opportunistic Locking Controls
    folder redirection, Technical Issues, Configuration of Default Profile with Folder Redirection, Questions and Answers
    force group, Implementation, Override Controls, Questions and Answers
    force user, Dissection and Discussion, Implementation, Override Controls, Questions and Answers
    forced settings, Override Controls
    foreign, Samba Domain with Samba Domain Member Server Using LDAP
    foreign SID, Samba Domain with Samba Domain Member Server Using LDAP
    forwarded, Routed Networks
    foundation members, Technical Issues
    Free Standards Grou (see FSG)
    front-end, Dissection and Discussion
    server, Distribute Network Load with MSDFS
    FSG, Samba System File Location
    FTP
    proxy, Questions and Answers
    full control, Share Access Controls, Using MS Windows Explorer (File Manager)
    fully qualified, Check-point Controls

    G

    getent, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    getfacl, Setting Posix ACLs in UNIX/Linux
    getgrgid(), Questions and Answers
    getgrnam, Technical Issues
    getpwnam, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
    getpwnam(), Questions and Answers
    GID, Implementation, Questions and Answers, Questions and Answers
    Goettingen, Questions and Answers
    government, Identity Management Needs
    GPL, Comments Regarding Software Terms of Use
    group account, Implementation, OpenLDAP Server Configuration
    group management, Implementation
    group membership, Implementation, Samba Configuration, Samba Domain with Samba Domain Member Server Using LDAP, Share Point Directory and File Permissions
    group names, Questions and Answers
    group policies, Introduction
    Group Policy, Joining a Domain: Windows 200x/XP Professional
    Group Policy editor, The Local Group Policy
    Group Policy Objects, The Local Group Policy
    groupadd, Implementation, Implementation, Questions and Answers
    groupdel, Questions and Answers
    groupmod, Questions and Answers
    GSS-API, Windows 200x/XP Client Interaction with Samba-3
    guest account, Findings and Comments, Dissection and Discussion, Technical Issues, Questions and Answers
    guest ok, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server

    I

    Idealx
    smbldap-tools, Install and Configure Idealx SMB-LDAP Scripts, LDAP Initialization and Creation of User and Group Accounts
    identifiers, Technical Issues
    identity, Questions and Answers, Kerberos Exposed
    management, Technical Issues
    identity management, Technical Issues, Dissection and Discussion, Political Issues
    Identity Management, Dissection and Discussion, The Nature of Windows Networking Protocols, Identity Management Needs
    Identity management, UNIX/Linux Client Domain Member
    Identity resolution, Samba Domain with Samba Domain Member Server Using LDAP, Active Directory Domain with Samba Domain Member Server, UNIX/Linux Client Domain Member, Questions and Answers
    Identity resolver, Questions and Answers
    IDMAP, Samba Domain with Samba Domain Member Server Using LDAP
    idmap backend, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
    IDMAP backend, Questions and Answers
    idmap gid, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
    idmap uid, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
    import, Technical Issues
    include, Implementation
    income, Dissection and Discussion
    independent expert, Introduction
    inetd, Process Startup Configuration
    inheritance, Setting Posix ACLs in UNIX/Linux
    initGrps.sh, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    initial credentials, Kerberos Configuration
    inoperative, Dissection and Discussion
    installation, Dissection and Discussion
    integrate, Technical Issues
    integrity, Introduction, Kerberos Exposed
    inter-operability, Dissection and Discussion, Technical Issues, Key Points Learned, Questions and Answers
    interdomain trusts, Identity Management Needs
    interfaces, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
    intermittent, Hardware Problems
    Internet Explorer, Technical Issues
    Internet Information Server, Questions and Answers
    IP forwarding, Implementation, Basic System Configuration, Configuration for Server: MASSIVE
    IPC$, Findings and Comments, Implementation
    iptables, Technical Issues
    isolated, Introduction
    Italian, Questions and Answers

    L

    LAM, The LDAP Account Manager
    configuration editor, The LDAP Account Manager
    configuration file, The LDAP Account Manager
    login screen, The LDAP Account Manager
    opening screen, The LDAP Account Manager
    profile, The LDAP Account Manager
    wizard, The LDAP Account Manager
    LDAP, Technical Issues, Assignment Tasks, Dissection and Discussion, Technical Issues, PAM and NSS Client Configuration, Introduction, Dissection and Discussion, Identity Management Needs, Implementation, Key Points Learned, Questions and Answers, Assignment Tasks, Technical Issues, Questions and Answers, Technical Issues, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Technical Issues
    backend, Identity Management Needs
    database, LDAP Initialization and Creation of User and Group Accounts, Identity Management Needs, Questions and Answers, Alternative LDAP Database Initialization
    directory, Identity Management Needs
    fail-over, Implementation
    initial configuration, Alternative LDAP Database Initialization
    master, Identity Management Needs
    master/slave
    background communication, Questions and Answers
    preload, Implementation
    secure, Technical Issues
    server, Questions and Answers
    slave, Identity Management Needs
    updates, Identity Management Needs
    ldap, Samba Domain with Samba Domain Member Server Using LDAP
    LDAP Account Manager (see LAM)
    ldap admin dn, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    LDAP backend, Technical Issues
    LDAP database, Questions and Answers
    ldap group suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    ldap idmap suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    LDAP Interchange Format (see LDIF)
    ldap machine suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    LDAP server, Identity Management Needs
    ldap ssl, Active Directory Domain with Samba Domain Member Server
    ldap suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    ldap user suffix, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP
    LDAP-transfer-LDIF.txt, Implementation
    ldap.conf, Samba Domain with Samba Domain Member Server Using LDAP
    ldapadd, LDAP Initialization and Creation of User and Group Accounts, Samba Domain with Samba Domain Member Server Using LDAP
    ldapsam, LDAP Initialization and Creation of User and Group Accounts, Dissection and Discussion, Assignment Tasks, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Integrating Additional Services
    ldapsam backend, Samba Domain with Samba Domain Member Server Using LDAP
    ldapsearch, LDAP Initialization and Creation of User and Group Accounts
    LDIF, Technical Issues, Implementation, Initialization of the LDAP Database
    leadership, Technical Issues
    Lightweight Directory Access Protocol (see LDAP)
    limit, Questions and Answers
    Linux desktop, Introduction
    Linux Standards Base (see LSB)
    LMB, Findings, Questions and Answers
    LMHOSTS, Routed Networks
    load distribution, For Scalability, Use SAN Based Storage on Samba Servers
    local accounts, Technical Issues
    Local Group Policy, Roaming Profile Background
    local groups, Questions and Answers
    Local Master Announcement, Findings
    Local Master Browser (see LMB)
    local users, Questions and Answers
    localhost, Basic System Configuration, Bad Hostnames
    locking, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation
    Application level, Shared Data Integrity
    Client side, Shared Data Integrity
    Server side, Shared Data Integrity
    log file, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    log level, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    logging, Removal of Pre-existing Conflicting RPMs
    login, Technical Issues
    logon credentials, Questions and Answers
    logon drive, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation
    logon home, Samba Configuration, Implementation
    logon hours, Technical Issues, Key Points Learned
    logon machines, Technical Issues
    logon path, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation
    logon process, Implementation
    logon scrip, Samba Configuration, Technical Issues
    logon script, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Preparation of Logon Scripts, Implementation, Technical Issues
    logon server, The Nature of Windows Networking Protocols
    logon services, Implementation
    logon time, Assignment Tasks
    logon traffic, The Nature of Windows Networking Protocols
    loopback, Validation
    low performance, Hardware Problems
    lower-case, Technical Issues
    lpadmin, Implementation, Implementation, Implementation, Printer Configuration, Printer Configuration
    LSB, Samba System File Location

    M

    machine accounts, Questions and Answers
    machine secret password, Technical Issues
    managed, Technical Issues
    management, Political Issues, Questions and Answers
    group, Technical Issues
    User, Technical Issues
    mandatory profile, Technical Issues, Configuring Profile Directories
    map acl inherit, Samba Configuration, Implementation, Samba-3 PDC Configuration
    mapped drives, Questions and Answers
    mapping, Technical Issues, Kerberos Configuration
    consistent, Samba Domain with Samba Domain Member Server Using LDAP
    master, Dissection and Discussion
    material, Appendix: A Collection of Useful Tid-bits
    max log size, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    memory requirements, Hardware Requirements
    merge, Technical Issues, Questions and Answers
    merged, Technical Issues
    meta-directory, Questions and Answers
    meta-service, Questions and Answers
    Microsoft Access, Shared Data Integrity
    Microsoft Excel, Shared Data Integrity
    Microsoft ISA, Assignment Tasks
    Microsoft Management Console (see MMC)
    Microsoft Office, Application Share Configuration, Share Point Directory and File Permissions
    Microsoft Outlook
    PST files, Questions and Answers
    migrate, Technical Issues
    migration, Implementation, Implementation, Assignment Tasks, Introduction, Questions and Answers
    objectives, Dissection and Discussion
    Migration speed, Questions and Answers
    mime type, Implementation, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    mime types, Implementation
    missing RPC's, Technical Issues
    MIT, Implementation, Kerberos Configuration
    MIT Kerberos, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
    MIT KRB5, Samba Configuration
    mixed mode, Active Directory Domain with Samba Domain Member Server
    mixed-mode, Questions and Answers
    mkntpasswd, Install and Configure Idealx SMB-LDAP Scripts
    MMC, Configure Delete Cached Profiles on Logout, Technical Issues, Questions and Answers
    mobile computing, Dissection and Discussion
    mobility, Technical Issues
    modularization, Technical Issues
    modules, Questions and Answers
    MS Access
    validate, Microsoft Access
    MS Outlook
    PST file, Making Users Happy
    MS Windows Server 2003, Implementation
    MS Word, Share Point Directory and File Permissions
    MSDFS, Distribute Network Load with MSDFS
    multi-subnet, Routed Networks
    multi-user
    access, Microsoft Access
    data access, Shared Data Integrity
    multiple directories, Identity Management Needs
    multiple domain controllers, Making Users Happy
    multiple group mappings, Questions and Answers
    My Documents, Roaming Profile Background
    My Network Places, Implementation
    mysqlsam, Implementation

    N

    name resolution, Assignment Tasks, Configuration of DHCP and DNS Servers, Questions and Answers
    Defective, Active Directory Domain with Samba Domain Member Server
    name resolve order, Questions and Answers, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Name Service Switch, Implementation
    name service switch (see NSS)
    named, Basic System Configuration, Validation, Server Preparation All Servers
    NAT, Technical Issues
    native, Questions and Answers
    net
    ads
    info, Active Directory Domain with Samba Domain Member Server
    join, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Samba Configuration
    status, Active Directory Domain with Samba Domain Member Server
    getlocalsid, Samba-3 PDC Configuration
    group, NT4 Migration Using tdbsam Backend
    groupmap
    add, Samba Configuration
    list, Samba Configuration, LDAP Initialization and Creation of User and Group Accounts
    modify, Samba Configuration
    rpc
    getsid, NT4 Migration Using LDAP Backend
    join, Configuration Specific to Domain Member Servers: BLDG1, BLDG2, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers
    vampire, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend
    NetBIOS, Questions and Answers, The Nature of Windows Networking Protocols, Questions and Answers, Bad Hostnames, Routed Networks
    name cache, Questions and Answers
    name resolution
    delays, Making Users Happy
    Node Type, Questions and Answers
    netbios forwarding, Network Collisions
    netbios name, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, NSS Configuration, Bad Hostnames
    NetBIOS name, Kerberos Configuration
    aliases, Identity Management Needs
    NETLOGON, Using a Network Default User Profile, Windows Client Configuration
    netlogon, The Nature of Windows Networking Protocols
    Netlogon, Joining a Domain: Windows 200x/XP Professional
    netmask, Implementation
    Netware, Small Office Networking
    network
    administrators, Technical Issues
    analyzer, Assignment Tasks
    bandwidth, Identity Management Needs, Questions and Answers
    broadcast, Introduction
    captures, Requirements and Notes
    collisions, Network Collisions
    load, Network Collisions
    logon, Making Users Happy
    logon scripts, Dissection and Discussion
    management, Introduction
    multi-segment, Introduction
    overload, Making Users Happy
    performance, Samba Configuration
    routed, Dissection and Discussion
    secure, Introduction
    segment, Dissection and Discussion
    services, Questions and Answers
    sniffer, Requirements and Notes
    tiemouts, Network Collisions
    timeout, Making Users Happy
    trace, Assignment Tasks
    traffic
    observation, Technical Issues
    wide-area, Dissection and Discussion, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Network Address Translation (see NAT)
    network administrators, Technical Issues
    network attached storage (see NAS)
    Network Default Profile, Roaming Profile Background
    network hardware
    defective, Making Users Happy
    network hygiene, Dissection and Discussion
    network Identities, Questions and Answers
    network load factors, Dissection and Discussion
    Network Neighborhood, Validation, Technical Issues
    network segment, Use and Location of BDCs
    network segments, Hardware Requirements
    network share, Assignment Tasks
    networking hardware
    defective, Making Users Happy
    networking protocols, Technical Issues
    next generation, Technical Issues
    NFS server, Samba-3 PDC Configuration
    NICs, Hardware Problems
    NIS, LDAP Initialization and Creation of User and Group Accounts, Identity Management Needs, Questions and Answers, Technical Issues, Political Issues, Questions and Answers
    nis, Samba Domain with Samba Domain Member Server Using LDAP
    NIS schema, Questions and Answers
    NIS server, Questions and Answers
    NIS+, Identity Management Needs
    nisplus, Samba Domain with Samba Domain Member Server Using LDAP
    nmap, Validation
    nmbd, Validation, Validation, Samba Configuration, Starting Samba
    nobody, Findings and Comments, Removal of Pre-existing Conflicting RPMs
    NSS, Technical Issues, PAM and NSS Client Configuration, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, UNIX/Linux Client Domain Member, Questions and Answers, NSS Configuration (see Name Service Switch)
    nss_ldap, Technical Issues, OpenLDAP Server Configuration, PAM and NSS Client Configuration, LDAP Initialization and Creation of User and Group Accounts, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP
    nt acl support, Dissection and Discussion, Implementation
    NT4 registry, Dissection and Discussion
    NTLM, Technical Issues
    NTLM authentication daemon, Technical Issues
    NTLMSSP, Windows 200x/XP Client Interaction with Samba-3, Key Points Learned, Questions and Answers
    NTLMSSP_AUTH, Windows 200x/XP Client Interaction with Samba-3
    ntlm_auth, Samba Configuration, Questions and Answers
    NTP, Kerberos Configuration
    NTUSER.DAT, Roaming Profile Background, Profile Changes, Using a Network Default User Profile, Questions and Answers
    NULL connection, Validation
    NULL session, Findings and Comments
    NULL-Session, Discussion

    P

    package, Implementation
    package names, Samba System File Location
    PADL, Technical Issues
    PADL LDAP tools, Technical Issues
    PADL Software, Samba Domain with Samba Domain Member Server Using LDAP
    PAM, PAM and NSS Client Configuration, UNIX/Linux Client Domain Member
    pam password change, Samba Configuration
    pam_ldap, OpenLDAP Server Configuration
    pam_ldap.so, PAM and NSS Client Configuration
    pam_unix2.so, PAM and NSS Client Configuration
    use_ldap, PAM and NSS Client Configuration
    passdb backend, Implementation, Samba Configuration, The 500-User Office, Implementation, Dissection and Discussion, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Dissection and Discussion, Implementation, Assignment Tasks, Questions and Answers, Technical Issues, Questions and Answers
    passdb.tdb, Technical Issues
    passwd, Implementation, Implementation, Samba Configuration
    passwd chat, Implementation, Samba Configuration
    password
    backend, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    password caching, Implementation
    password change, Key Points Learned
    password length, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
    password server, NSS Configuration
    path, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    pdbedit, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, NT4 Migration Using tdbsam Backend, Questions and Answers
    PDC, Assignment Tasks, Technical Issues, Technical Issues, The Local Group Policy, The Nature of Windows Networking Protocols, Technical Issues, NT4 Migration Using LDAP Backend, NT4 Migration Using tdbsam Backend, Technical Issues, Questions and Answers, Use and Location of BDCs
    PDF, The LDAP Account Manager
    performance, Dissection and Discussion, Questions and Answers, Performance, Reliability, and Availability, Introduction, Network Collisions
    performance degradation, Override Controls, Samba Configuration
    Perl, The LDAP Account Manager
    permission, Share Point Directory and File Permissions
    permissions, Implementation, Technical Issues, Share Access Controls, Check-point Controls, Share Point Directory and File Permissions, Removal of Pre-existing Conflicting RPMs
    excessive, Technical Issues
    group, Share Point Directory and File Permissions
    user, Share Point Directory and File Permissions
    Permissions, Using the MMC Computer Management Interface
    permits, Technical Issues
    permitted group, Using the MMC Computer Management Interface
    PHP, The LDAP Account Manager
    PHP4, The LDAP Account Manager
    pile-driver, Share Definition Controls
    ping, Validation, NT4 Migration Using LDAP Backend
    pitfalls, The LDAP Account Manager
    plain-text, Questions and Answers
    Pluggable Authentication Modules (see PAM)
    policy, Questions and Answers, Introduction
    poor performance, Dissection and Discussion
    Posix, Dissection and Discussion, Technical Issues, Technical Issues, Questions and Answers, Questions and Answers, The LDAP Account Manager
    Posix accounts, LDAP Initialization and Creation of User and Group Accounts, Technical Issues
    Posix ACLs, Managing Windows 200x ACLs
    PosixAccount, LDAP Initialization and Creation of User and Group Accounts
    Postscript, Installation of Printer Driver Auto-Download
    powers, Share Definition Controls
    practices, Introduction
    preferred master, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration
    preload.LDIF, NT4 Migration Using LDAP Backend
    presence and leadership, Technical Issues
    price paid, Dissection and Discussion
    primary group, Samba Domain with Samba Domain Member Server Using LDAP, Share Point Directory and File Permissions
    principals, Kerberos Exposed
    print filter, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    print queue, Charity Administration Office, Dissection and Discussion
    print spooler, Charity Administration Office
    Print Test Page, Uploading Printer Drivers to Samba Servers
    printable, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    printcap name, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    printer admin, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    printer + validation, Validation, Validation
    printers
    Advanced, Uploading Printer Drivers to Samba Servers
    Default Settings, Uploading Printer Drivers to Samba Servers
    General, Uploading Printer Drivers to Samba Servers
    Properties, Uploading Printer Drivers to Samba Servers
    Security, Uploading Printer Drivers to Samba Servers
    Sharing, Uploading Printer Drivers to Samba Servers
    printing, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    drag-and-drop, Installation of Printer Driver Auto-Download, Uploading Printer Drivers to Samba Servers
    dumb, Installation of Printer Driver Auto-Download
    point-n-click, Installation of Printer Driver Auto-Download
    raw, Dissection and Discussion
    privacy, Identity Management Needs
    Privilege Attribute Certificates (see PAC)
    privilege controls, Share Point Directory and File Permissions
    privileged pipe, Samba Configuration
    privileges, Identity Management Needs, Technical Issues, Share Definition Controls
    product defects, Dissection and Discussion
    profile
    default, Assignment Tasks
    mandatory, The Nature of Windows Networking Protocols
    roaming, Making Users Happy
    profile acls, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation
    profile path, Technical Issues
    profile share, Implementation
    profiles share, Dissection and Discussion
    programmer, Dissection and Discussion
    project maintainers, Technical Issues
    Properties, Using the MMC Computer Management Interface
    proprietary, Technical Issues
    protected, Technical Issues
    protection, Technical Issues
    protocol
    negotiation, The Nature of Windows Networking Protocols
    protocol analysis, Requirements and Notes
    protocols, Technical Issues
    proxy, Assignment Tasks, Technical Issues
    public specifications, Technical Issues

    R

    RAID, Hardware Requirements
    RAID controllers, Hardware Problems
    Raw Print Through, Installation of Printer Driver Auto-Download
    raw printing, Implementation, Printer Configuration, Server Preparation All Servers, Printer Configuration
    rcldap, Implementation
    read only, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    realm, Active Directory Domain with Samba Domain Member Server, Kerberos Configuration, NSS Configuration
    recognize, Technical Issues
    record locking, Microsoft Access
    recursively, Setting Posix ACLs in UNIX/Linux
    Red Hat Fedora Linux, Samba Configuration
    Red Hat Linux, Drafting Office, Dissection and Discussion, Accounting Office, Samba Server Implementation, PAM and NSS Client Configuration, Implementation, Active Directory Domain with Samba Domain Member Server, Implementation, Samba Configuration
    redirected folders, Roaming Profile Background, The Nature of Windows Networking Protocols
    refereed standards, Technical Issues
    regedit, Implementation
    regedt32, Profile Changes, Configuration of Default Profile with Folder Redirection
    registry, Questions and Answers
    keys
    SAM, Dissection and Discussion
    SECURITY, Dissection and Discussion
    registry change, Questions and Answers
    Registry Editor, Configuration of Default Profile with Folder Redirection
    registry hacks, Questions and Answers
    registry keys, Configuration of Default Profile with Folder Redirection
    reimburse, Dissection and Discussion
    rejected, Share Access Controls
    rejoin, Questions and Answers
    reliability, Performance, Reliability, and Availability
    remote announce, Routed Networks
    remote browse sync, Routed Networks
    remote procedure call (see RPC)
    replicate, Questions and Answers, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    replicated, Dissection and Discussion
    resilient, Guidelines for Reliable Samba Operation
    resolve, Technical Issues, Bad Hostnames
    responsibility, Dissection and Discussion
    responsible, Technical Issues
    restricted export, Kerberos Exposed
    Restrictive security, Active Directory Domain with Samba Domain Member Server
    reverse DNS, Kerberos Configuration
    risk, Technical Issues, Questions and Answers, Questions and Answers, Introduction
    road-map, Technical Issues
    published, Technical Issues
    roaming profile, Technical Issues, Roaming Profile Background, Configuring Profile Directories, User Needs, Questions and Answers
    roaming profiles, Technical Issues, Implementation, Roaming Profile Background
    routed network, Use and Location of BDCs
    router, Implementation
    routers, Questions and Answers, Routed Networks
    RPC, Active Directory Domain with Samba Domain Member Server, Kerberos Exposed
    RPM
    install, Implementation
    rpm, Removal of Pre-existing Conflicting RPMs, Samba System File Location
    RPMs, Samba Configuration
    rpms, Removal of Pre-existing Conflicting RPMs
    rsync, Samba-3 PDC Configuration, Questions and Answers, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    run-time control files, Samba System File Location

    S

    safe-guards, Technical Issues
    SAM, Dissection and Discussion
    samba, Removal of Pre-existing Conflicting RPMs
    starting samba, Implementation
    Samba, Samba Configuration
    Samba accounts, Technical Issues
    samba cluster, Introduction
    samba control script, Starting Samba
    Samba Domain, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Samba Domain server, Using the MMC Computer Management Interface
    Samba RPM Packages, Samba-3 PDC Configuration
    Samba Tea, Samba Configuration
    SambaSamAccount, LDAP Initialization and Creation of User and Group Accounts
    SambaXP conference, Questions and Answers
    SAN, For Scalability, Use SAN Based Storage on Samba Servers
    scalability, Introduction
    scalable, Identity Management Needs
    schannel, Technical Issues, Key Points Learned, Questions and Answers
    schema, Questions and Answers
    scripts, The LDAP Account Manager
    secondary group, Samba Domain with Samba Domain Member Server Using LDAP
    secret, Kerberos Exposed
    secrets.tdb, Technical Issues, Samba-3 PDC Configuration, NT4 Migration Using LDAP Backend
    secure, Introduction
    secure account password, Questions and Answers
    secure connections, The LDAP Account Manager
    secure networking, Technical Issues
    secure networking protocols, Technical Issues
    security, Implementation, Implementation, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Questions and Answers, Introduction, Technical Issues, Share Point Directory and File Permissions, Questions and Answers, NSS Configuration
    share mode, Dissection and Discussion
    user mode, Dissection and Discussion
    Security, Technical Issues, Using the MMC Computer Management Interface
    Security Account Manager (see SAM)
    security controls, Technical Issues
    security descriptors, Dissection and Discussion
    security fixes, Technical Issues
    security updates, Technical Issues
    SerNet, Active Directory Domain with Samba Domain Member Server, Samba Configuration
    server string, Active Directory Domain with Samba Domain Member Server
    service, Implementation
    smb
    start, Configuration Specific to Domain Member Servers: BLDG1, BLDG2
    Service Packs, Application Share Configuration
    services, Key Points Learned
    session setup, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3
    Session Setup, Simple Windows Client Connection Characteristics
    set primary group script, Samba-3 PDC Configuration, Implementation
    setfacl, Setting Posix ACLs in UNIX/Linux
    severely degrade, Samba Configuration
    SGID, Dissection and Discussion, Share Point Directory and File Permissions, Effect of Setting File and Directory SUID/SGID Permissions Explained
    shadow-utils, Questions and Answers
    share, Questions and Answers
    Share Access Controls, Share Access Controls
    share ACLs, Questions and Answers
    share definition, Technical Issues
    Share Definition
    Controls, Share Definition Controls
    share definition controls, Share Definition Controls, Check-point Controls, Share Point Directory and File Permissions, Questions and Answers
    share level access controls, Questions and Answers
    share level ACL, Questions and Answers
    Share Permissions, Share Access Controls
    shared resource, Technical Issues, Setting Posix ACLs in UNIX/Linux
    shares, Technical Issues
    show add printer wizard, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation
    shutdown script, Samba Configuration, Implementation, Implementation
    SID, Windows Client Configuration, Identity Management Needs, Questions and Answers, Technical Issues, Initialization of the LDAP Database
    side effects, Managing Windows 200x ACLs
    Sign'n'seal, Key Points Learned, Questions and Answers
    silent return, Active Directory Domain with Samba Domain Member Server
    simple, Dissection and Discussion
    Single Sign-On (see SOS)
    slapadd, NT4 Migration Using LDAP Backend
    slapcat, LDAP Initialization and Creation of User and Group Accounts, Samba Domain with Samba Domain Member Server Using LDAP
    slave, Dissection and Discussion
    slow logon, Making Users Happy
    slow network, Hardware Problems
    slurpd, Implementation, Questions and Answers
    smart printing, Dissection and Discussion
    SMB passwords, Implementation
    smb ports, Samba Configuration, Questions and Answers, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    SMB/CIFS, Questions and Answers
    smbclient, Validation, Validation, LDAP Initialization and Creation of User and Group Accounts, NT4 Migration Using LDAP Backend, Questions and Answers
    smbd, Validation, Implementation, Validation, Validation, Samba-3 PDC Configuration, Technical Issues, Active Directory Domain with Samba Domain Member Server, Samba Configuration, Questions and Answers, Starting Samba
    location of files, Samba System File Location
    smbfs, Dissection and Discussion
    smbldap-groupadd.pl, LDAP Initialization and Creation of User and Group Accounts
    smbldap-passwd.pl, LDAP Initialization and Creation of User and Group Accounts
    smbldap-populate.pl, LDAP Initialization and Creation of User and Group Accounts
    smbldap-tools, The LDAP Account Manager
    smbldap-useradd.pl, LDAP Initialization and Creation of User and Group Accounts, Implementation
    smbldap-usermod.pl, LDAP Initialization and Creation of User and Group Accounts
    smbmnt, Dissection and Discussion
    smbmount, Dissection and Discussion
    smbpasswd, Implementation, Technical Issues, Implementation, Technical Issues, Samba Configuration, Server Preparation All Servers, Configuration for Server: MASSIVE, Samba-3 PDC Configuration, LDAP Initialization and Creation of User and Group Accounts, Samba-3 BDC Configuration, Dissection and Discussion, Implementation, Technical Issues, Questions and Answers, Questions and Answers, Integrating Additional Services
    smbumnt, Dissection and Discussion
    smbumount, Dissection and Discussion
    snap-shot, Dissection and Discussion
    socket address, Samba Configuration
    socket options, Samba Configuration
    software, Dissection and Discussion
    solve, Dissection and Discussion
    source code, Dissection and Discussion
    SPNEGO, Windows 200x/XP Client Interaction with Samba-3
    SQL, Dissection and Discussion, Questions and Answers
    Squid, Technical Issues, Implementation, Removal of Pre-existing Conflicting RPMs, Samba Configuration, Squid Configuration
    squid, Removal of Pre-existing Conflicting RPMs, Samba Configuration
    Squid proxy, Technical Issues
    SRVTOOLS.EXE, Implementation, Configuring Profile Directories, Questions and Answers, Questions and Answers
    SSL, The LDAP Account Manager
    starting + CUPS, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration
    starting dhcpd, Implementation, Process Startup Configuration, Process Startup Configuration
    starting samba, Implementation, Implementation, Implementation, Implementation, Process Startup Configuration, Process Startup Configuration
    nmbd, Starting Samba
    smbd, Starting Samba
    winbindd, Starting Samba
    startup script, Starting Samba
    sticky bit, Implementation
    storage capacity, Hardware Requirements
    strategic, Technical Issues
    strategy, Questions and Answers
    straw-man, Active Directory, Kerberos, and Security
    strict sync, Samba Configuration
    strong cryptography, Kerberos Exposed
    SUID, Dissection and Discussion, Questions and Answers, Effect of Setting File and Directory SUID/SGID Permissions Explained
    Sun ONE Identity Server, Dissection and Discussion
    super daemon, Process Startup Configuration
    support, Dissection and Discussion
    survey, Adding UNIX/LINUX Servers and Clients
    SUSE Enterprise Linux Server, Charity Administration Office, Basic System Configuration, Implementation
    SUSE Linux, Dissection and Discussion, Samba Server Implementation, PAM and NSS Client Configuration, Implementation, Active Directory Domain with Samba Domain Member Server, Implementation, Removal of Pre-existing Conflicting RPMs
    SWAT, Samba System File Location
    sync always, Samba Configuration
    synchronization, Kerberos Configuration, For Scalability, Use SAN Based Storage on Samba Servers
    synchronize, User Needs
    synchronized, Questions and Answers
    syslog, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    system level logins, Questions and Answers
    system security, Technical Issues

    T

    tattooing, Questions and Answers
    TCP/IP, Questions and Answers
    tdbdump, NT4 Migration Using LDAP Backend, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    tdbsam, Technical Issues, Implementation, The 500-User Office, Assignment Tasks, Dissection and Discussion, Implementation, Technical Issues, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers
    template primary group, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    template shell, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    testparm, Validation, Validation, Samba-3 PDC Configuration, Active Directory Domain with Samba Domain Member Server, Samba Configuration
    ticket, Samba Configuration
    time server, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    Tivoli Directory Server, Dissection and Discussion
    token, Technical Issues
    tool, Questions and Answers, Dissection and Discussion
    track record, Dissection and Discussion
    traffic collisions, Making Users Happy
    transaction processing, Dissection and Discussion
    transactional, Questions and Answers
    transfer, Questions and Answers
    translate, Managing Windows 200x ACLs
    traverse, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Tree Connect, Simple Windows Client Connection Characteristics
    trusted computing, Introduction
    Trusted Domains, Technical Issues
    trusted domains, Questions and Answers
    trusted third-party, Kerberos Exposed
    trusting, Kerberos Exposed
    turn-around time, Technical Issues

    U

    UDP
    broadcast, Routed Networks
    UID, Dissection and Discussion, Technical Issues, Implementation, Questions and Answers, Questions and Answers
    un-join, Questions and Answers
    unauthorized activities, Kerberos Exposed
    UNC name, Questions and Answers
    unencrypted, The LDAP Account Manager
    Unicast, The Nature of Windows Networking Protocols
    Universal Naming Convention (see UNC name)
    UNIX
    groups, Technical Issues, Implementation
    UNIX account, Questions and Answers
    UNIX accounts, Technical Issues
    unix charset, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    unix password sync, Samba Configuration
    UNIX/Linux server, Technical Issues
    unix2dos, Samba Configuration
    unknown, Technical Issues
    updates, Introduction, Technical Issues
    uppercase, Technical Issues
    use client driver, Implementation, Implementation, Implementation, Samba Configuration, Implementation
    user
    management, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    user account, OpenLDAP Server Configuration
    User and Group Controls, Technical Issues
    user credentials, Identity Management Needs, UNIX/Linux Client Domain Member
    user errors, Questions and Answers
    user identities, Implementation
    user logins, Questions and Answers
    user management, Implementation
    User Mode, Simple Windows Client Connection Characteristics, Windows 200x/XP Client Interaction with Samba-3, Implementation
    useradd, Implementation, Implementation, Implementation, Samba Configuration, Configuration for Server: MASSIVE
    username map, Implementation, Samba Configuration, Server Preparation All Servers, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    utilities, Questions and Answers
    utmp, Samba Configuration, Implementation, Implementation

    W

    wbinfo, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, Samba Configuration
    weakness, Technical Issues
    web
    caching, Assignment Tasks
    proxying, Assignment Tasks
    Web
    proxy, Questions and Answers
    access, Key Points Learned
    Web browsers, Key Points Learned
    WebClient, Making Users Happy
    wide-area, User Needs, Identity Management Needs, Key Points Learned, Questions and Answers, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    wide-area network, Use and Location of BDCs, Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth
    winbind, Implementation, Dissection and Discussion, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Questions and Answers, Introduction, Technical Issues, Technical Issues, Samba Configuration, NSS Configuration
    Winbind, Questions and Answers, Technical Issues, Key Points Learned
    winbind enable local accounts, Technical Issues, Questions and Answers
    winbind enum groups, NSS Configuration
    winbind enum users, NSS Configuration
    winbind separator, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
    winbind trusted domains only, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, Questions and Answers
    winbind use default domain, Check-point Controls
    winbind user default domain, NSS Configuration
    winbindd, Validation, Validation, Technical Issues, Technical Issues, Samba Domain with Samba Domain Member Server Using LDAP, Questions and Answers, Samba Configuration, Questions and Answers, Starting Samba
    winbindd_cache.tdb, Technical Issues
    winbindd_idmap.tdb, Technical Issues
    Windows 2000 ACLs, Managing Windows 200x ACLs
    Windows 2003 Serve, Introduction
    Windows 200x ACLs, Questions and Answers
    Windows accounts, Technical Issues
    Windows ACLs, Setting Posix ACLs in UNIX/Linux
    Windows ADS Domain, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    Windows clients, Questions and Answers
    Windows Explorer, Validation
    Windows explorer, Questions and Answers
    Windows security identifier (see SID)
    Windows Servers, Introduction
    Windows Services for UNIX (see SUS)
    Windows XP, Assignment Tasks
    WINS, Questions and Answers, Implementation, Technical Issues, Implementation, Windows Client Configuration, Technical Issues, Windows Client Configuration, The Nature of Windows Networking Protocols, Identity Management Needs, Questions and Answers
    lookup, Questions and Answers
    name resolution, Routed Networks
    server, Making Users Happy, Routed Networks
    WINS server, The 500-User Office, Questions and Answers
    wins server, Implementation, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind
    WINS serving, Implementation
    wins support, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Implementation
    wins.dat, Identity Management Needs
    Word, Share Point Directory and File Permissions
    workgroup, Implementation, Implementation, Implementation, Implementation, Samba Configuration, Implementation, Samba-3 PDC Configuration, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server, NSS Configuration
    Workgroup Announcement, Findings
    workstation, Implementation
    wrapper, Questions and Answers
    write list, Samba-3 BDC Configuration, Implementation, Samba Domain with Samba Domain Member Server Using LDAP, NT4/Samba Domain with Samba Domain Member Server Using Winbind, Active Directory Domain with Samba Domain Member Server
    write lock, Opportunistic Locking Controls

    Y

    YaST, PAM and NSS Client Configuration
    Yellow Pages, Identity Management Needs
    yellow pages (see NIS)
    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/kerberos.html samba-3.0.10/docs/htmldocs/Samba-Guide/kerberos.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/kerberos.html 2004-11-15 10:15:39.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/kerberos.html 2004-12-15 10:23:50.000000000 -0600 @@ -1,10 +1,10 @@ -Chapter 10. Active Directory, Kerberos, and Security

    Chapter 10. Active Directory, Kerberos, and Security

    +Chapter 10. Active Directory, Kerberos, and Security

    Chapter 10. Active Directory, Kerberos, and Security

    By this point in the book, you have been exposed to many Samba-3 features and capabilities. More importantly, if you have implemented the examples given, you are well on your way to becoming a Samba-3 networking guru who knows a lot about Microsoft Windows. If you have taken the time to practice, you likely have thought of improvements and scenarios with which you can experiment. You are rather well plugged in to the many flexible ways Samba can be used. -

    +

    This is a book about Samba-3. Understandably, its intent is to present it in a positive light. The casual observer might conclude that this book is one-eyed about Samba. It is what would you expect? This chapter exposes some criticisms that have been raised concerning @@ -13,13 +13,13 @@ Some criticism always comes from deep inside ranks that one would expect to be supportive of a particular decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of criticism develops with respect to Abmas. -

    +

    This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled out of thin air. They were drawn from comments made by Samba users and from criticism during discussions with Windows network administrators. The tone of the objections reflects as closely as possible that of the original. The case presented is a straw-man example that is designed to permit each objection to be answered as it might occur in real life. -

    Introduction

    +

    Introduction

    Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took note of the spectacular projection of Abmas onto the global business stage. Abmas is building an interesting portfolio of companies that includes accounting services, financial advice, investment @@ -28,42 +28,42 @@ interesting business growth and development plan. Abmas Video Rentals has been recently acquired. During the time that the acquisition was closing, the Video Rentals business upgraded their Windows NT4-based network to Windows 2003 Server and Active Directory. -

    +

    Bob Jordan has been accepting of the fact that Abmas Video Rentals will use Microsoft Active Directory. The IT team led by Stan Soroka is committed to Samba-3 and to maintaining a uniform technology platform. Stan Soroka's team voiced their disapproval over the decision to permit this business to continue to operate with a solution that is viewed by Christine and her group as “an island of broken technologies.” This comment was made by one of Christine's staff as they were installing a new Samba-3 server at the new business. -

    +

    Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer should make such a comment. He felt that he had to prepare in case he might be criticized for his decision to use Active Directory. He decided he would defend his decision by hiring the services - of an outside security systems consultant to report[12] on his unit's operations + of an outside security systems consultant to report[12] on his unit's operations and to investigate the role of Samba at his site. Here are key extracts from this hypothetical report: -

    +

    ... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site, has been examined. We find no evidence to support a notion that vulnerabilities exist at your site. ... we took additional steps to validate the integrity of the installation and operation of Active Directory and are pleased that your staff are following sound practices.

    ... -

    +

    User and Group accounts, and respective privileges, have been well thought out. File system shares are appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and effective off-site storage practices are considered to exceed industry norms. -

    +

    Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain a secure network. -

    +

    The recently installed Linux file and application server uses a tool called winbind that is indiscriminate about security. All user accounts in Active Directory can be used to access data stored on the Linux system. We are alarmed that secure information is accessible to staff who should not even be aware that it exists. We share the concerns of your network management staff who have gone to great lengths to set fine-grained controls that limit information access to those who need access. It seems incongruous to us that Samba winbind should be permitted to be used as it voids this fine work. -

    +

    Graham Judd [head of network administration] has locked down the security of all systems and is following the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network is isolated from the outside world, the [product name removed] firewall is under current contract @@ -72,7 +72,7 @@ detail and for following Microsoft recommended best practices.

    ... -

    +

    In respect of the use of Samba, we offer the following comments: Samba is in use in nearly half of all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft ... what worries us regarding Samba is the need to disable essential Windows security features such as @@ -80,14 +80,14 @@ mixed mode so that Samba clients and servers can authenticate all of it. Additionally, we are concerned that Samba is not at the full capabilites of Microsoft Windows NT4 server. Microsoft has moved well beyond that with trusted computing initiatives that the Samba developers do not participate in. -

    +

    One wonders about the integrity of an open source program that is developed by a team of hackers who cannot be held accountable for the flaws in their code. The sheer number of updates and bug fixes they have released should ring alarm bells in any business. -

    +

    Another factor that should be considered is that buying Microsoft products and services helps to provide employment in the IT industry. Samba and Open Source software place those jobs at risk. -

    +

    This is also a challenge to rise above the trouble spot. Bob calls Stan's team together for a simple discussion, but it gets further out of hand. When he returns to his office, he finds the following email in his in-box: @@ -100,23 +100,23 @@ I also wish to advise that two of the recent recruits want to implement Kerberos authentication across all systems. I concur with the desire to improve security. One of the new guys who is championing the move to Kerberos was responsible for the comment that caused the embarrassment. -

    +

    I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP, plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent, I would like to hire the services of a well-known Samba consultant to set the record straight. -

    +

    I intend to use this report to answer the criticism raised and would like to establish a policy that we will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered out of the budget of the division that wishes to go its own way. I propose that dissenters will still remain responsible to meet the budgeted contribution to IT operations as a whole. I believe we should not coerce use of any centrally proposed standards, but make all non-compliance the financial responsibility of the out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone. -

     
    --Stan 

    Assignment Tasks

    +

     
    --Stan 

    Assignment Tasks

    Bob agreed with Stan's recommendations and has hired your services to help defuse the powder keg. Your task is to answer each of the issues raised with a tractable answer. You must be able to support your claims, keep emotions to a side, and answer technically. -

    Dissection and Discussion

    +

    Dissection and Discussion

    Samba-3 is a tool. No one pounding your door to use Samba. That is a choice that you are free to make or reject. It is likely that your decision to use Samba can benefit your company more than anyone else. The Samba Team obviously believes that the Samba software is a worthy choice. @@ -124,18 +124,18 @@ someone to help manage your Samba installation, you can create income and employment. Alternately, money saved by not spending in the IT area can be spent elsewhere in the business. All money saved or spent creates employment. -

    +

    In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted purely to provide file and print service interoperability on platforms that otherwise cannot provide access to data and to printers for Microsoft Windows clients. Samba is used by some businesses to effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an alternative to the use of a Microsoft file and print serving platforms with no consideration of costs. -

    +

    It would be foolish to adopt a technology that might put any data or users at risk. Security affects everyone. The Samba Team are fully cognizant of the responsibility they have to their users. The Samba documentation clearly reveals the fact that full responsibility is accepted to fix anything that is broken. -

    +

    There is a mistaken perception in the IT industry that commercial software providers are fully accountable for the defects in products. Open Source software comes with no warranty, so it is often assumed that its use confers a higher degree of risk. Everyone should read commercial software @@ -143,34 +143,34 @@ extent of liability that is accepted. Doing so soon dispels the popular notion that commercial software vendors are willingly accountable for product defects. In many cases, the commercial vendor accepts liability only to reimburse the price paid for the software. -

    +

    The real issues that a consumer (like you) needs answered is what is the way of escape from technical problems and how long will it take? The average problem turnaround time in the Open Source community is approximately 48 hours. What does the EULA offer? What is the track record in the commercial software industry? What happens when your commercial vendor decides to cease providing support? -

    +

    Open Source software at least puts you in possession of the source code. This means that when all else fails, you can hire a programmer to solve/fix the problem. -

    Technical Issues

    +

    Technical Issues

    Each issue is now discussed and, where appropriate, example implementation steps are provided. -

    Winbind and Security

    +

    Winbind and Security

    Windows network administrators may be dismayed to find that winbind exposes all Domain users so that they may use their Domain account credentials to log onto a UNIX/Linux system. The fact that all users in the Domain can see the UNIX/Linux server in their Network Neighborhood and can browse the shares on the server seems to excite them further. -

    +

    winbind provides for the UNIX/Linux Domain Member server or client, the same as one would obtain by adding a Microsoft Windows server or client to the Domain. The real objection is the fact that Samba is not MS Windows and, therefore, requires handling a little differently from the familiar Windows systems. One must recognize fear of the unknown. -

    +

    Windows network administrators need to recognize that winbind does not, and cannot, override account controls set using the Active Directory management tools. The control is the same. Have no fear. -

    +

    Where Samba and the ADS Domain account information obtained through the use of winbind permits access, by browsing or by the drive mapping to a share, to data that should be better protected. This can only happen when security @@ -178,14 +178,14 @@ on:

    • Shares themselves (i.e., the logical share itself)

    • The share definition in smb.conf

    • The shared directories and files using UNIX permissions

    • Using Windows 2000 ACLs if the file system is Posix enabled

    Examples of each are given in ???. -

    User and Group Controls

    +

    User and Group Controls

    User and group management facilities as known in the Windows ADS environment may be used to provide equivalent access control constraints or to provide equivalent permissions and privileges on Samba servers. Samba offers greater flexibility in the use of user and group controls because it has additional layers of control compared to Windows 200x/XP. For example, access controls on a Samba server may be set within the share definition in a manner for which Windows has no equivalent. -

    +

    In any serious analysis of system security, it is important to examine the safeguards that remain when all other protective measures fail. An administrator may inadvertently set excessive permissions on the file system of a shared resource, or he may set excessive @@ -193,35 +193,35 @@ the data would indeed be laid bare to abuse. Yet, within a Samba share definition, it is possible to guard against that by enforcing controls on the share definition itself. You see a practical example of this a little later in this chapter. -

    +

    The report that is critical of Samba really ought to have exercised greater due diligence, as the real weakness is on the side of a Microsoft Windows environment. -

    Security Overall

    +

    Security Overall

    Samba has been designed in such a manner that weaknesses inherent in the design of Microsoft Windows networking ought not to expose the underlying UNIX/Linux file system in any way. All software has potential defects, and Samba is no exception. What matters more is how defects that are discovered get dealt with. -

    +

    The Samba Team totally agrees with the necessity to observe and fully implement every security facility to provide a level of protection and security that is necessary and that the end user (or network administrator) needs. Never would the Samba Team recommend a compromise to system security, nor would deliberate defoliation of security be publicly condoned; yet this is the practice by many Windows network administrators just to make happy users who have no notion of consequential risk. -

    +

    The report condemns Samba for releasing updates and security fixes, yet Microsoft on-line updates need to be applied almost weekly. The answer to the criticism made lies in the fact that Samba development is continuing, documentation is improving, user needs are being increasingly met or exceeded, and security updates are issued with a short turnaround time. -

    +

    The release of Samba-4 is expected around late 2004 to early 2005 and involves a near complete rewrite to permit extensive modularization and to prepare Samba for new functionality planned for addition during the next generation series. The Samba Team is responsible and can be depended upon; the history to date would suggest a high degree of dependability as well as on charter development consistent with published road-map projections. -

    +

    Not well published is the fact that Microsoft was a foundation member of the Common Internet File System (CIFS) initiative, together with the participation of the network attached storage (NAS) industry. Unfortunately, for the past few years, @@ -230,7 +230,7 @@ space. The Samba Team has maintained consistent presence and leadership at all CIFS conferences and at the interoperability laboratories run concurrently with them. -

    Cryptographic Controls (schannel, sign'n'seal)

    +

    Cryptographic Controls (schannel, sign'n'seal)

    The report correctly mentions the fact that Samba did not support the most recent schannel and digital sign'n'seal features of Microsoft Windows NT/200x/XPPro products. This is one of the key features @@ -238,7 +238,7 @@ seldom a reflection of current practice, and in many respects reports are like a pathology report they reflect accurately (at best) status at a snap-shot in time. Meanwhile, the world moves on. -

    +

    It should be pointed out that had clear public specifications for the protocols been published, it would have been much easier to implement this and would have taken less time to do. The sole mechanism used to find an algorithm that is compatible @@ -246,7 +246,7 @@ and trial-and-error implementation of potential techniques. The real value of public and defensible standards is obvious to all, and would have enabled more secure networking for everyone. -

    +

    Critics of Samba often ignore fundamental problems that may plague (or may have plagued) the users of Microsoft's products also. Those who are first to criticize Samba for not rushing into release of digital sign'n'seal support @@ -254,10 +254,10 @@ acknowledged and for which a fix was provided. In fact, Tangent Systems - appears even today[13] to not be sure that the problem has been resolved. + appears even today[13] to not be sure that the problem has been resolved. So it is evident that some delay in release of new functionality may have fortuitous consequences. -

    +

    One final comment is warranted. If companies want more secure networking protocols, the most effective method by which this can be achieved is by users seeking and working together to help define open and publicly refereed standards. The @@ -273,7 +273,7 @@ of them that uses RPCs that are not supported by any of these component technologies and yet by which they are made to interoperate in ways that the components do not support. -

    +

    In order to make the popular request for Samba to be an Active Directory Server a reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls that are not presently supported. The Samba Team has not been able to gain critical @@ -281,31 +281,31 @@ challenge of developing and integrating the necessary technologies. Therefore, if the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality into the Samba project, this dream request can not become a reality. -

    +

    At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the Samba development roadmap. If it is not on the published roadmap, it cannot be delivered anytime soon. Ergo, ADS server support is not a current goal for Samba development. The Samba Team is most committed to permitting Samba to be a full ADS Domain member that is increasingly capable of being managed using Microsoft Windows MMC tools. -

    Kerberos Exposed

    +

    Kerberos Exposed

    Kerberos is a network authentication protocol that provides secure authentication for client-server applications by using secret-key cryptography. Firewalls are an insufficient barrier mechanism in todays networking world as at best they only restrict incoming network traffic but can not prevent network traffic that comes from authorized locations from performing unauthorized activities. -

    +

    Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses strong cryptography so that a client can prove its identity to a server (and vice versa) across an insecure network connection. After a client and server has used Kerberos to prove their identity, they can also encrypt all of their communications to assure privacy and data integrity as they go about their business. -

    +

    Kerberos is a trusted third-party service. That means that there is a third party (the kerberos server) that is trusted by all the entities on the network (users and services, usually called principals). All principals share a secret password (or key) with the kerberos server and this enables principals to verify that the messages from the kerberos server are authentic. Thus trusting the kerberos server, users and services can authenticate each other. -

    +

    Kerberos was until recently a technology that was restricted from being exported from the United States. For many years that hindered global adoption of more secure networking technologies both within the USA as well as outside it. A free an unencumbered implementation of MIT Kerberos has been produced in Europe @@ -313,7 +313,7 @@ In recent times the USA government has removed sanctions affecting the global distribution of MIT Kerberos. It is likely that there will be a significant surge forward in the development of Kerberos enabled applications and in the general deployment and use of Kerberos across the spectrum of the information technology industry. -

    +

    A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation of it. For example, a 2002 new report by IDG states: @@ -322,14 +322,14 @@ great lengths to disclose interfaces and protocols that allow third-party software products to interact with Windows. But a lawyer with the states suing Microsoft pointed out that when it comes to the company's use of the Kerberos authentication specification, not everyone agrees. -

    +

    Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version 5 specification that Windows clients use for proprietary purposes and still achieve interoperability with the Microsoft OS. Microsoft takes advantage of unspecified fields in the Kerberos specification for storing Windows-specific authorization data, Short wrote. The designers of Kerberos left these fields undefined so that software developers could add their own authorization information, he said. -

    +

    It so happens that Microsoft Windows clients depend on and expect the contents of the unspecified fields in the Kerberos 5 communications data stream for their Windows interoperability, in particular when Samba is being expected to emulate a Windows Server 200x Domain Controller. But the interoperability @@ -340,7 +340,7 @@

    Microsoft makes the following comment in a reference in a technet article: -

    +

    The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos tickets to convey Privilege Attribute Certificates (PACs) that define user identity and group membership. @@ -350,10 +350,10 @@ Windows NT access control information.

    Implementation

    The following procedures outline the implementation of the security measures discussed so far. -

    Share Access Controls

    +

    Share Access Controls

    Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as Windows XP Pro) attempts to make a connection to the Samba server. -

    Procedure 10.1. Create/Edit/Delete Share ACLs

    1. +

      Procedure 10.1. Create/Edit/Delete Share ACLs

      1. From a Windows 200x/XP Professional workstation, log onto the Domain using the Domain Administrator account (on Samba Domains, this is usually the account called root).

      2. @@ -362,16 +362,16 @@

      3. In the left panel, [Right mouse menu item] Computer Management (Local)->Connect to another computer ...->Browse...->Advanced->Find Now. In the lower panel, click on the name of the server you wish to - administer. Click OK->OK->OK. + administer. Click OK->OK->OK. In the left panel, the entry Computer Management (Local) should now reflect the change made. For example, if the server you are administering is called FRODO, the Computer Management entry should now say: Computer Management (FRODO).

      4. In the left panel, click Computer Management (FRODO)->[+] Shared Folders->Shares. -

      5. +

      6. In the right panel, double-click on the share on which you wish to set/edit ACLs. This will bring up the Properties panel. Click the Share Permissions tab. -

      7. +

      8. You may now edit/add/remove access control settings. Be very careful. Many problems have been created by people who decided that Everyone should be rejected but one particular group should have full control. This is a catch-22 situation because members of that particular group also @@ -380,20 +380,20 @@

      9. When you are done with editing, close all panels by clicking through the OK buttons. -

    Share Definition Controls

    +

    Share Definition Controls

    Share-definition-based access controls can be used like a check-point or like a pile-driver. Just as a check-point can be used to require someone who wants to get through to meet certain requirements, so it is possible to require the user (or group the user belongs to) to meet specified credential-related objectives. It can be likened to a pile-driver by overriding default controls, in that having met the credential-related objectives, the user can be granted powers and privileges that would not normally be available under default settings. -

    +

    It must be emphasized that the controls here discussed can act as a filter, or give rights of passage, that act as a super-structure over normal directory and file access controls. However, share level ACLs act at a higher level than to share definition controls because the user must filter through the share level controls to get to the share definition controls. The proper hierarchy of controls implemented by Samba and Windows networking consists of: -

    1. Share Level ACLs

    2. Share Definition Controls

    3. Directory and File Permissions

    4. Directory and File Posix ACLs

    Check-point Controls

    +

    1. Share Level ACLs

    2. Share Definition Controls

    3. Directory and File Permissions

    4. Directory and File Posix ACLs

    Check-point Controls

    Consider the following extract from a smb.conf file defining the share called Apps:

     [Apps]
    @@ -404,19 +404,19 @@
     

    This definition permits only those who are members of the group called Employees to access the share. -

    Note

    +

    Note

    On Domain Member servers and clients, even when the winbind use default domain has been specified, the use of Domain accounts in security controls requires fully qualified Domain specification, - for example, valid users = @"MEGANET\Northern Engineers". + for example, valid users = @"MEGANET\Northern Engineers". Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a delimiter. -

    +

    If there is an ACL on the share itself to permit read/write access for all Employees as well as read/write for the group Doctors, both groups are permitted through to the share. However, at the moment an attempt is made to set up a connection to the share, a member of the group Doctors, who is not also a member of the group Employees, would immediately fail to validate. -

    +

    Consider another example. In this case, you want to permit all members of the group Employees to access the Apps share, except the user patrickj. This can be easily achieved by setting a share level ACL permitting only Employees to access the share, @@ -429,7 +429,7 @@ read only = Yes invalid users = patrickj

    - + Let us assume that you want to permit the user gbshaw, to manage any file in the UNIX/Linux file system directory /data/apps, but you do not want to grant any write permissions beyond that directory tree. Here is one way this can be done: @@ -441,7 +441,7 @@ invalid users = patrickj admin users = gbshaw

    - + Now we have a set of controls that permits only Employees who are also members of the group Doctors, excluding the user patrickj, to have read-only privilege, but the user gbshaw is granted administrative rights. @@ -463,11 +463,11 @@ admin users = gbshaw write list = peters

    - + This is a particularly complex example at this point, but it begins to demonstrate the possibilities. You should refer to the on-line manual page for the smb.conf file for more information regarding the check-point controls that Samba implements. -

    Override Controls

    +

    Override Controls

    Override controls implemented by Samba permit actions like the adoption of a different identity during file system operations, the forced overwriting of normal file and directory permissions, and so on. You should refer to the on-line manual page for the smb.conf file for more information regarding @@ -485,14 +485,14 @@ force user = billc force group = Mentors

    - + That is all there is to it. Well, it is almost that simple. The downside of this method is that users are logged onto the Windows client as themselves, and then immediately before accessing the file, Samba makes system calls to change the effective user and group to the forced settings specified, completes the file transaction, and then reverts to the actually logged on identity. This imposes significant overhead on Samba. The alternative way that effectively the same result can be achieved (but with lower system CPU overheads) is described next. -

    +

    The use of the force user, or the force group, may also have a severe impact on system (and in particular Windows client) performance. If opportunistic locking is enabled on the share (the default), it causes an oplock break to be @@ -502,7 +502,7 @@ waiting for the file system transaction (read or write) to complete. The result can be a profound apparent performance degradation as the client continually attempts to reconnect to overcome the effect of the lost oplock break, or time-out. -

    Share Point Directory and File Permissions

    +

    Share Point Directory and File Permissions

    Samba has been designed and implemented so that it respects as far as is feasible the security and user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing with respect to file system access that violates file system permission settings, unless it is @@ -510,7 +510,7 @@ UNIX file system controls, this chapter does not document simple information that can be obtained from a basic UNIX training guide. Instead, one common example of a typical problem is used to demonstrate the most effective solution referred to in the immediately preceding paragraph. -

    +

    One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence:

    1. @@ -530,7 +530,7 @@ There have been many postings over the years that report the same basic problem. Frequently Samba users want to know when this “bug” will be fixed. The fact is, this is not a bug in Samba at all. Here is the real sequence of what happens in the case mentioned above. -

      +

      When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned by the user who creates the file (billc) and has the permissions that follow that user's default settings within the operating system (UNIX/Linux). When MS Word has finished writing @@ -556,18 +556,18 @@ browseable = Yes read only = No

      -

    2. +

    3. Set consistent user and group permissions recursively down the directory tree as shown here:

       root#  chown -R janetp.users /usr/data/finance
       

      -

    4. +

    5. Set the files and directory permissions to be read/write for owner and group, and not accessible to others (everyone) using the following command:

       root#  chmod ug+rwx,o-rwx /usr/data/finance
       

      -

    6. +

    7. Set the SGID (super-group) bit on all directories from the top down. This means all files can be created with the permissions of the group set on the directory. It means all users who are members of the group finance can read and write all files in @@ -577,11 +577,11 @@ root# find /usr/data/finance -type d -exec chmod ug+s {}\;

      -

    8. +

    9. Make sure all users that must have read/write access to the directory have finance group membership as their primary group, for example, the group they belong to in /etc/passwd. -

    Managing Windows 200x ACLs

    +

    Managing Windows 200x ACLs

    Samba must translate Windows 2000 ACLs to UNIX Posix ACLs. This has some interesting side effects because of the fact that there is not a 1:1 equivalence between them. The as-close-as-possible ACLs match means that some transactions are not possible from MS Windows clients. One of these is to reset the ownership @@ -589,7 +589,7 @@

    There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation, either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface. -

    Using the MMC Computer Management Interface

    1. +

      Using the MMC Computer Management Interface

      1. From a Windows 200x/XP Professional workstation, log onto the Domain using the Domain Administrator account (on Samba Domains, this is usually the account called root).

      2. @@ -604,14 +604,14 @@ the Computer Management entry should now say: Computer Management (FRODO).

      3. In the left panel, click Computer Management (FRODO)->[+] Shared Folders->Shares. -

      4. +

      5. In the right panel, double-click on the share on which you wish to set/edit ACLs. This brings up the Properties panel. Click the Security tab. It is best to edit ACLs using the Advanced editing features. Click the Advanced button. This opens a panel that has four tabs. Only the functionality under the Permissions tab can be utilized with respect to a Samba Domain server. -

      6. +

      7. You may now edit/add/remove access control settings. Be very careful. Many problems have been created by people who decided that Everyone should be rejected but one particular group should have full control. This is a catch-22 situation because members of that particular group also @@ -620,7 +620,7 @@

      8. When you are done with editing, close all panels by clicking through the OK buttons until the last panel closes. -

      Using MS Windows Explorer (File Manager)

      +

    Using MS Windows Explorer (File Manager)

    The following alternative method may be used from a Windows workstation. In this example we work with a Domain called MEGANET, a server called MASSIVE, and a share called Apps. The underlying UNIX/Linux share point for this share is @@ -628,7 +628,7 @@

    1. Click Start->[right-click] My Computer->Explore->[left panel] [+] My Network Places->[+] Entire Network->[+] Microsoft Windows Network->[+] Meganet->[+] Massive->[right-click] Apps->Properties->Security->Advanced. This opens a panel that has four tabs. Only the functionality under the Permissions tab can be utilized in respect to a Samba Domain server. -

    2. +

    3. You may now edit/add/remove access control settings. Be very careful. Many problems have been created by people who decided that Everyone should be rejected but one particular group should have full control. This is a catch-22 situation because members of that particular group also @@ -637,7 +637,7 @@

    4. When you are done with editing, close all panels by clicking through the OK buttons until the last panel closes. -

    Setting Posix ACLs in UNIX/Linux

    +

    Setting Posix ACLs in UNIX/Linux

    Yet another alternative method for setting desired security settings on the shared resource files and directories can be achieved by logging into UNIX/Linux and setting Posix ACLs directly using command-line tools. Here is an example session on the same resource as in the immediately preceding example on a SUSE 9 @@ -660,7 +660,7 @@ group::rwx other::r-x

    -

  • +

  • You want to add permission for AppsMgrs to enable them to manage the applications (apps) share. It is important to set the ACL recursively so that the AppsMgrs have this capability throughout the directory tree that is @@ -683,26 +683,26 @@ other::r-x

    This confirms that the change of Posix ACL permissions has been effective. -

  • +

  • It is highly recommend that you should read the on-line manual page for the setfacl and getfacl commands. This provides information regarding how to set/read the default ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent of setting inheritance properties. -

  • Key Points Learned

    +

    Key Points Learned

    The mish-mash of issues were thrown together into one chapter because it seemed like a good idea. Looking back, this chapter could be broken into two, but it's too late now. It has been done. The highlights covered are: -

    • +

      • Winbind honors and does not override account controls set in Active Directory. This means that password change, logon hours, and so on, are (or soon will be) enforced by Samba Winbind. At this time, an out-of-hours login is denied and password change is enforced. At this time, if logon hours expire, the user is not forcibly logged off. That may be implemented at some later date. -

      • +

      • Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential problems acknowledged by Microsoft as having been fixed, but reported by some as still possibly an open issue. -

      • +

      • The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft Active Directory. The possibility to do this is not planned in the current Samba-3 roadmap. Samba-3 does aim to provide further improvements in interoperability so that @@ -711,83 +711,83 @@ This chapter reviewed mechanisms by which Samba servers may be kept secure. Each of the four key methodologies was reviewed with specific reference to example deployment techniques. -

    Questions and Answers

    -

    Questions and Answers

    +

    Sign'n'sealregistry hacks Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2? -
    +
    Does Samba-3 support Active Directory? -
    mixed-mode +
    mixed-mode When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was necessary with Samba-2? -
    share level access controls +
    share level access controls Is it safe to set share level access controls in Samba? -
    share ACLs +
    share ACLs Is it mandatory to set share ACLs to get a secure Samba-3 server? -
    valid users +
    valid users The valid users did not work on the [homes]. Has this functionality been restored yet? -
    force userforce groupbias +
    force userforce groupbias Is the bias against use of the force user and force group really warranted? -
    +
    The example given for file and directory access control forces all files to be owned by one particular user. I do not like that. Is there any way I can see who created the file? -
    Computer Management +
    Computer Management In the book, The Official Samba-3 HOWTO and Reference Guide, you recommended use of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? -
    valid usersActive DirectoryDomain Member server +
    valid usersActive DirectoryDomain Member server I tried to set valid users = @Engineers, but it does not work. My Samba server is an Active Directory Domain Member server. Has this been fixed now? -

    +

    Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2? -

    +

    No. Samba-3 fully supports Sign'n'seal as well as schannel operation. The registry change should not be applied when Samba-3 is used as a Domain Controller. -

    +

    Does Samba-3 support Active Directory? -

    +

    Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not provide Active Directory services. It cannot be used to replace a Microsoft Active Directory server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit, and it can function as an Active Directory Domain Member server. -

    +

    When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was necessary with Samba-2? -

    +

    No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation, as Samba-3 can join a native Windows 2003 Server ADS Domain. -

    +

    Is it safe to set share level access controls in Samba?

    Yes. Share level access controls have been supported since early versions of Samba-2. This is very mature technology. Not enough sites make use of this powerful capability, neither on Windows server or with Samba servers. -

    +

    Is it mandatory to set share ACLs to get a secure Samba-3 server? -

    +

    No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides means of securing shares through share definition controls in the smb.conf file. The additional support for share level ACLs is like frosting on the cake. It adds to security, but is not essential to it. -

    +

    The valid users did not work on the [homes]. Has this functionality been restored yet? -

    +

    Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard on the [homes] meta-service. The correct way to specify this is: - valid users = %S. -

    + valid users = %S. +

    Is the bias against use of the force user and force group really warranted? -

    +

    There is no bias. There is a determination to recommend the right tool for the task at hand. After all, it is better than putting users through performance problems, isn't it? -

    +

    The example given for file and directory access control forces all files to be owned by one particular user. I do not like that. Is there any way I can see who created the file? -

    +

    Sure. You do not have to set the SUID bit on the directory. Simply execute the following command to permit file ownership to be retained by the user who created it:

    @@ -795,17 +795,17 @@
     

    Note that this required no more than removing the u argument so that the SUID bit is not set for the owner. -

    +

    In the book, “The Official Samba-3 HOWTO and Reference Guide”, you recommended use of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? -

    +

    Either tool can be used with equal effect. There is no benefit of one over the other, except that the MMC utility is present on all Windows 200x/XP systems and does not require additional software to be downloaded and installed. Note that if you want to manage user and group accounts in your Samba controlled Domain, the only tool that permits that is the NT4 Domain User Manager which is provided as part of the SRVTOOLS.EXE utility. -

    +

    I tried to set valid users = @Engineers, but it does not work. My Samba server is an Active Directory Domain Member server. Has this been fixed now?

    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/migration.html samba-3.0.10/docs/htmldocs/Samba-Guide/migration.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/migration.html 2004-11-15 10:15:37.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/migration.html 2004-12-15 10:23:48.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 8. Migrating NT4 Domain to Samba-3

    Chapter 8. Migrating NT4 Domain to Samba-3

    +Chapter 8. Migrating NT4 Domain to Samba-3

    Chapter 8. Migrating NT4 Domain to Samba-3

    Ever since Microsoft announced that they are discontinuing support for Windows NT4, Samba users started to ask for detailed instructions for how to migrate from NT4 to Samba-3. This chapter provides background information that should @@ -6,18 +6,18 @@

    One wonders how many NT4 systems will be left in service by the time you read this book though. -

    Introduction

    +

    Introduction

    Network administrators who want to migrate off a Windows NT4 environment know one thing with certainty. They feel that NT4 has been abandoned and they want to update. The desire to get off NT4 and to not adopt Windows 200x and Active Directory is driven by a mixture of concerns over complexity, cost, fear of failure, and much more. -

    +

    The migration from NT4 to Samba-3 can involve a number of factors, including: migration of data to another server, migration of network environment controls such as group policies, and finally migration of the users, groups, and machine accounts. -

    +

    It should be pointed out now that it is possible to migrate some systems from Windows NT4 Domain environments to a Samba-3 Domain Environment. This is certainly not possible in every case. It is possible to just migrate the Domain accounts @@ -25,7 +25,7 @@ an exception than the rule. Most systems require some tweaking and adjusting following migration before an environment that is acceptable for immediate use is obtained. -

    Assignment Tasks

    +

    Assignment Tasks

    You are about to migrate an MS Windows NT4 Domain accounts database to a Samba-3 server. The Samba-3 server is using a passdb backend based on LDAP. The @@ -34,24 +34,24 @@

    Your objective is to document the process of migrating user and group accounts from several NT4 Domains into a single Samba-3 LDAP backend database. -

    Dissection and Discussion

    +

    Dissection and Discussion

    The migration process takes a snap-shot of information that is stored in the Windows NT4 registry based accounts database. That information resides in the Security Account Manager (SAM) portion of the NT4 Registry under keys called SAM and SECURITY. -

    Warning

    +

    Warning

    The Windows NT4 registry keys called SAM and SECURITY are protected so that you cannot view the contents. If you change the security setting to reveal the contents under these hive keys, your Windows NT4 Domain is crippled. Do not do this unless you are willing to render your domain controller inoperative. -

    +

    Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, that may not be a good idea from an administration perspective. Since you are going through a certain amount of disruptive activity anyhow, why not take this as an opportunity to review the structure of the network, how Windows clients are controlled and how they interact with the network environment. -

    +

    MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed have done little to keep the NT4 server environment up-to-date with more recent Windows releases, particularly Windows XP Professional. The migration provides opportunity to revise and update @@ -62,19 +62,19 @@ as a good time to update desktop systems also. In all, the extra effort should constitute no real disruption to users, rather with due diligence and care should make their network experience a much happier one. -

    Technical Issues

    +

    Technical Issues

    Migration of an NT4 Domain user and group database to Samba-3 involves a certain strategic element. Many sites have asked for instructions regarding merging of multiple different NT4 Domains into one Samba-3 LDAP database. It would appear that this is viewed as a significant added value compared with the alternative of migration to Windows Server 200x and Active Directory. The diagram in ??? illustrates the effect of migration from a Windows NT4 Domain to a Samba Domain. -

    Figure 8.1. Schematic Explaining the net rpc vampire Process

    Schematic Explaining the net rpc vampire Process

    +

    Figure 8.1. Schematic Explaining the net rpc vampire Process

    Schematic Explaining the net rpc vampire Process

    In any case, the migration process involves the following steps:

    • Prepare the target Samba-3 server. This involves configuring Samba-3 for migration to either a tdbsam or an ldapsam backend. -

    • +

    • Clean up the source NT4 PDC. Delete all accounts that need not be migrated. Delete all files that should not be migrated. Where possible, change NT Group names so there are no spaces or uppercase characters. This is important if @@ -82,27 +82,27 @@ names.

    • Step through the migration process. -

    • +

    • Remove the NT4 PDC from the network.

    • Upgrade the Samba-3 server from a BDC to a PDC, and validate all account information. -

    +

    If you are wanting to merge multiple NT4 Domain account databases into one Samba Domain, you must now dump the contents of the first migration and edit it as appropriate. Now clean out (remove) the tdbsam backend file (passdb.tdb), or the LDAP database files. You must start each migration with a new database into which you merge your NT4 domains. -

    +

    At this point, you are ready to perform the second migration following the same steps as for the first. In other words, dump the database, edit it, and then you may merge the dump for the first and second migrations. -

    +

    You must be careful. If you choose to migrate to an LDAP backend, your dump file now contains the full account information, including the Domain SID. The Domain SID for each of the two NT4 Domains will be different. You must choose one, and change the Domain portion of the account SIDs so that all are the same. -

    +

    If you choose to use a tdbsam (passdb.tdb) backend file, your best choice is to use pdbedit to export the contents of the tdbsam file into an smbpasswd data file. This automatically strips out all Domain specific information, @@ -112,7 +112,7 @@ file must have an account in /etc/passwd. The resulting smbpasswd file may be exported/imported into either a tdbsam (passdb.tdb), or else into an LDAP backend. -

    Figure 8.2. View of Accounts in NT4 Domain User Manager

    View of Accounts in NT4 Domain User Manager

    Political Issues

    +

    Figure 8.2. View of Accounts in NT4 Domain User Manager

    View of Accounts in NT4 Domain User Manager

    Political Issues

    The merging of multiple Windows NT4 style Domains into a single LDAP-backend-based Samba-3 Domain may be seen by those who had power over them as a loss of prestige or a loss of power. The imposition of a single Domain may even be seen as a threat. So in migrating and @@ -122,12 +122,12 @@ The best advice that can be given to those who set out to merge NT4 Domains into one single Samba-3 Domain is to promote (sell) the action as one that reduces costs and delivers greater network interoperability and manageability. -

    Implementation

    +

    Implementation

    You can present here the steps and example output for two NT4 to Samba-3 Domain migrations. The first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the scripts you specify in the smb.conf file for the add user script collection of parameters are used to effect the addition of accounts into the passdb backend. -

    NT4 Migration Using LDAP Backend

    +

    NT4 Migration Using LDAP Backend

    In this instance, you migrate an NT4 PDC to an LDAP backend. The accounts you are about to migrate are shown in ???. In this example you make use of the smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend. @@ -156,13 +156,13 @@ called MASSIVE. The Domain name MEGANET must match that of the NT4 Domain from which you are about to migrate. Do not execute any Samba executables. -

  • +

  • Edit the smb.conf file to temporarily change the parameter - domain master = No so + domain master = No so the Samba server functions as a BDC for the purpose of migration. -

  • +

  • Create a file called preload.LDIF as shown in ???. -

  • +

  • Preload the LDAP database so it is ready to receive the information from the NT4 PDC. This pre-loads the LDAP directory with the top-level information, as well as the top level containers for user, group, computer, and domain account data. Execute the @@ -179,7 +179,7 @@

  • Start the LDAP server. -

  • +

  • Verify that the NT4 PDC can be reached:

     root#  ping nt4s
    @@ -193,7 +193,7 @@
     rtt min/avg/max/mdev = 0.518/3.773/10.223/4.560 ms
     

    It can. Great. -

  • +

  • Validate that the resources on the NT4 PDC can be listed:

     root#  smbclient -L nt4s -UAdministrator%not24get
    @@ -213,7 +213,7 @@
             MEGANET              NT4S
     

    This looks good. -

  • +

  • At this point, it is necessary to fetch the Domain SID from the NT4 PDC and apply that to the Samba-3 BDC (soon to be PDC):

    @@ -222,7 +222,7 @@
                                   Domain MEGANET in secrets.tdb
     

    Done. -

  • +

  • At this point, you can validate that the information is correct in the secrets.tdb file, as shown here:

    @@ -239,14 +239,14 @@
     }
     

    This has returned the information expected. -

  • +

  • We are ready to join the NT4 Domain as a BDC by executing the following:

     root#  net rpc join -S NT4S -W MEGANET -U Administrator%not24get
     Joined domain MEGANET.
     

    Done. -

  • +

  • The Samba-3 BDC is now ready to receive the NT4 PDC accounts database, as shown here:

     root#  net rpc vampire -S NT4S
    @@ -276,9 +276,9 @@
     Fetching BUILTIN database
     SAM_DELTA_DOMAIN_INFO not handled
     

    -

  • +

  • Edit the smb.conf file to reset the parameter - domain master = Yes so that + domain master = Yes so that the Samba server functions as a PDC for the purpose of migration.

  • Example 8.1. LDAP Preload LDIF file preload.LDIF

     dn: dc=abmas,dc=biz
    @@ -317,7 +317,7 @@
     objectClass: organizationalUnit
     ou: Domains
     structuralObjectClass: organizationalUnit
    -

    NT4 Migration Using tdbsam Backend

    +

    NT4 Migration Using tdbsam Backend

    In this example, you have chosen to change the Domain name of the NT4 server from DRUGPREP to MEGANET prior to the use of the vampire (migration) tool. This migration process makes use of Linux system tools @@ -328,19 +328,19 @@

    1. Prepare a Samba-3 server precisely per the instructions shown in Chapter 5. Set the workgroup name to MEGANET. -

    2. +

    3. Edit the smb.conf file to temporarily change the parameter - domain master = No so + domain master = No so the Samba server functions as a BDC for the purpose of migration.

    4. Start Samba as you have done previously. -

    5. +

    6. Join the NT4 Domain as a BDC, as shown here:

       root#  net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get
       Joined domain MEGANET.
       

      -

    7. +

    8. You may vampire the accounts from the NT4 PDC by executing the command, as shown here:

       root#  net rpc vampire -S oldnt4pdc -U Administrator%not24get
      @@ -380,7 +380,7 @@
       Creating unix group: 'Server Operators'
       Creating unix group: 'Users'
       

      -

    9. +

    10. At this point, we can validate our migration. Let's look at the accounts in the form as they would be seen in a smbpasswd file. This achieves that:

      @@ -412,7 +412,7 @@
       maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C:
            CF271B744F7A55AFDA277FF88D80C527:[UX         ]:LCT-3E8B4270:
       

      -

    11. +

    12. An expanded view of a user account entry shows more of what was obtained from the NT4 PDC:

      @@ -438,7 +438,7 @@
       Password can change:  0
       Password must change: Mon, 18 Jan 2038 20:14:07 GMT
       

      -

    13. +

    14. And this command lists the long names of the groups that have been imported (vampired) from the NT4 PDC:

      @@ -455,11 +455,11 @@
       Users                 Ordinary users
       

      Everything looks well and in order. -

    15. +

    16. Edit the smb.conf file to reset the parameter - domain master = Yes so + domain master = Yes so the Samba server functions as a PDC for the purpose of migration. -

    Key Points Learned

    +

    Key Points Learned

    Migration of an NT4 PDC database to a Samba-3 PDC is possible.

    • An LDAP backend is a suitable vehicle for NT4 migrations. @@ -471,52 +471,52 @@

    • The net Samba-3 Domain most likely requires some administration and updating before going live. -

    Questions and Answers

    -

    Questions and Answers

    +

    clean database Why must I start each migration with a clean database? -
    Domain SID +
    Domain SID Is it possible to set my Domain SID to anything I like? -
    /etc/passwd/etc/grouptdbsampassdb backendaccountsuseraccountsgroupaccountsDomain +
    /etc/passwd/etc/grouptdbsampassdb backendaccountsuseraccountsgroupaccountsDomain When using a tdbsam passdb backend, why must I have all Domain user and group accounts in /etc/passwd and /etc/group? -
    validateconnectivitymigration +
    validateconnectivitymigration Why did you validate connectivity before attempting migration? -
    +
    How would you merge 10 tdbsam-based domains into an LDAP database? -
    machine accountsaccountsmachine +
    machine accountsaccountsmachine I want to change my Domain name after I migrate all accounts from an NT4 Domain to a Samba-3 Domain. Does it make any sense to migrate the machine accounts in that case? -
    multiple group mappings +
    multiple group mappings After merging multiple NT4 Domains into a Samba-3 Domain, I lost all multiple group mappings. Why? -
    +
    How can I reset group membership after loading the account information into the LDAP database? -
    group names +
    group names What are the limits or constraints that apply to group names? -
    vampire +
    vampire My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 LDAP backend system using the vampire process? -

    +

    Why must I start each migration with a clean database? -

    +

    This is a recommendation that permits the data from each NT4 Domain to be kept separate until you are ready to merge them. Also, if you do not do this, you may find errors due to users or groups from multiple Domains having the same name, but different SIDs. It is better to permit each migration to complete without undue errors and then to handle the merging of vampired data under proper supervision. -

    +

    Is it possible to set my Domain SID to anything I like? -

    +

    Yes, so long as the SID you create has the same structure as an auto-generated SID. The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where the XXXXXXXXXX can be any number with from 6 to 10 digits. On the other hand, why would you really want to create your own SID? I cannot think of a good reason. You may want to set the SID to one that is already in use somewhere on your network, but that is a little different from straight out creating your own Domain SID. -

    +

    When using a tdbsam passdb backend, why must I have all Domain user and group accounts in /etc/passwd and /etc/group? -

    +

    Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba does not fabricate the UNIX IDs from thin air, but rather requires them to be located in a suitable place. @@ -531,15 +531,15 @@ migration to the LDAP database, the accounts may be removed from the UNIX database files. In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in LDAP, require UIDs/GIDs. -

    +

    Why did you validate connectivity before attempting migration?

    Access validation before attempting to migrate NT4 Domain accounts helps to pin-point potential problems that may otherwise affect or impede account migration. I am always mindful of the 4P's of migration Planning Prevents Poor Performance. -

    +

    How would you merge 10 tdbsam-based domains into an LDAP database? -

    +

    If you have 10 tdbsam Samba Domains, there is considerable risk that there are a number of accounts that have the same UNIX identifier (UID/GID). This means that you almost certainly have to edit a lot of data. It would be easiest to dump each database in smbpasswd @@ -549,17 +549,17 @@ tdbsam and then to LDAP. The final choice is yours. Just remember to verify all accounts that you have migrated before handing over access to a user. After all, too many users with a bad migration experience may threaten your career. -

    +

    I want to change my Domain name after I migrate all accounts from an NT4 Domain to a Samba-3 Domain. Does it make any sense to migrate the machine accounts in that case? -

    +

    I would recommend not. The machine accounts should still work, but there are registry entries on each Windows NT4 and upward client that have a tattoo of the old domain name. If you un-join the domain and then rejoin the newly renamed Samba-3 Domain, you can be certain to avoid this tattooing effect. -

    +

    After merging multiple NT4 Domains into a Samba-3 Domain, I lost all multiple group mappings. Why? -

    +

    Samba-3 currently does not implement multiple group membership internally. If you use the Windows NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group membership is stored in the Posix groups area. If you use either tdbsam or smbpasswd backend, @@ -568,14 +568,14 @@ file to which you migrated the NT4 Domain data, do not forget to edit the UNIX /etc/passwd and /etc/group information also. That is where the multiple group information is most closely at your fingertips. -

    +

    How can I reset group membership after loading the account information into the LDAP database? -

    +

    You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The installation file is called SRVTOOLS.EXE. -

    +

    What are the limits or constraints that apply to group names? -

    +

    A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows groups can contain upper- and lower-case characters, as well as spaces. @@ -587,7 +587,7 @@ of the Posix standards, and likewise do not permit upper-case or space characters in group or user account names. You have to experiment with your system to find what its peculiarities are. -

    +

    My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 LDAP backend system using the vampire process?

    @@ -596,7 +596,7 @@ you would not be able to migrate 323,000 accounts because this number can not fit into a 16-bit unsigned integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. Please check this carefully before you attempt to effect a migration using the vampire process. -

    +

    Migration speed depends much on the processor speed, the network speed, disk I/O capability, and LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory, that was mirroring LDAP to a second identical system over 1 gigabit ethernet, I was able to migrate around 180 user accounts diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/pr03.html samba-3.0.10/docs/htmldocs/Samba-Guide/pr03.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/pr03.html 2004-11-15 10:15:30.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/pr03.html 2004-12-15 10:23:39.000000000 -0600 @@ -1,4 +1,4 @@ -Foreword

    Foreword

    By Dan Kusnetzky, IDC

     

    +Foreword

    Foreword

    By Dan Kusnetzky, IDC

     

    IDC's software research group has been conducting research on the market for software, including operating environments, for over twenty years. In 1994, the system software research team started to field questions from its subscribers on Linux. We had very @@ -48,7 +48,7 @@ to the network administrators' library!

     
    -- Dan Kusnetzky, Vice President System Software Research, International Data Corporation - 

    By Andrew Tridgell, Samba Team

     

    +

     

    By Andrew Tridgell, Samba Team

     

    I've always been the sort of computer user that learns best by example. Seeing a complete example matching a real-world use of a piece of software gives me an understanding of that software far diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/preface.html samba-3.0.10/docs/htmldocs/Samba-Guide/preface.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/preface.html 2004-11-15 10:15:30.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/preface.html 2004-12-15 10:23:39.000000000 -0600 @@ -1,4 +1,4 @@ -Preface

    Preface

    +Preface

    Preface

    Network administrators live busy lives. We face distractions and pressures that drive us to seek proven, working case scenarios that can be easily implemented. Often this approach lands us in trouble. There is a @@ -33,7 +33,7 @@ detailed information regarding secure operation and configuration of peripheral services and applications such as OpenLDAP, DNS and DHCP, the need for which can be met from other resources that are dedicated to the subject. -

    Why Is This Book Necessary?

    +

    Why Is This Book Necessary?

    This book is the result of observations and feedback. The feedback from the Samba-HOWTO-Collection has been positive and complimentary. There have been requests for far more worked examples, a @@ -53,7 +53,7 @@ All example case configuration files, scripts, and other tools are provided on the CD-ROM. This book is descriptive, provides detailed diagrams, and makes deployment of Samba-3 a breeze. -

    Prerequisites

    +

    Prerequisites

    This book is not a tutorial on UNIX or Linux administration. UNIX and Linux training is best obtained from books dedicated to the subject. This book assumes that you have at least the basic skill necessary to use these operating @@ -66,7 +66,7 @@ find yourself at times intimidated by assumptions made. In this situation, you may need to refer to administrative guides or manuals for your operating system platform to find what is the best method to achieve what the text of this book describes. -

    Approach

    +

    Approach

    The first chapter deals with some rather thorny network analysis issues. Do not be put off by this. The information you glean, even without a detailed understanding of network protocol analysis, can help you understand how Windows networking functions. @@ -94,7 +94,7 @@

    Each chapter has a set of questions and answers to help you to to understand and digest key attributes of the solutions presented. -

    Summary of Topics

    +

    Summary of Topics

    Our first assignment is to understand how Microsoft Windows products function in the network environment. That is where we start. Let's take just a few moments to get a bird's eye view of this book. Remember that @@ -258,7 +258,7 @@ services to make your network fly and much more. This chapter contains a good deal of “Did I tell you about this...?” type of hints to help keep your name on the top performers list. -

    Conventions Used

    +

    Conventions Used

    The following notation conventions are used throughout this book:

    • TOSHARG is used as an abbreviation for the book, “The Official Samba-3 diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/primer.html samba-3.0.10/docs/htmldocs/Samba-Guide/primer.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/primer.html 2004-11-15 10:15:31.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/primer.html 2004-12-15 10:23:40.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 1. Networking Primer

      Chapter 1. Networking Primer

      +Chapter 1. Networking Primer

      Chapter 1. Networking Primer

      You are about to use the equivalent of a microscope to look at the information that runs through the veins of a Windows network. We do more to observe the information than to interrogate it. When you are done with this chapter, you should have a good understanding @@ -8,7 +8,7 @@

      Samba can be configured with a minimum of complexity. Simplicity should be mastered before you get too deeply into complexities. Let's get moving, we have work to do. -

      Requirements and Notes

      +

      Requirements and Notes

      Successful completion of this chapter requires two Microsoft Windows 9x/Me Workstations, as well as two Microsoft Windows XP Professional Workstations, each equipped with an Ethernet card connected using a hub. Also required is one additional server (either Windows @@ -16,7 +16,7 @@ sniffer and analysis application (ethereal is a good choice). All work should be undertaken on a quiet network where there is no other traffic. It is best to use a dedicated hub with only the machines under test connected at the time of the exercises. -

      +

      Ethereal has become the network protocol analyzer of choice for many network administrators. You may find more information regarding this tool from the Ethereal Web site. Ethereal installation @@ -36,11 +36,11 @@ filter. Ethernet switches may filter out traffic that is not directed at the machine that is used to monitor traffic; this would not allow you to complete the projects.

      - + Do not worry too much if you do not have access to all this equipment; network captures from the exercises are provided on the enclosed CD-ROM. This makes it possible to dive directly into the analytical part of the exercises if you so desire. -

      +

      Please do not be alarmed at the use of a high-powered analysis tool (ethereal) in this first chapter. We expose you only to a minimum of detail necessary to complete the exercises in this chapter. If you choose to use any other network sniffer and protocol @@ -54,11 +54,11 @@

      ??? also provides useful information that may help you to avoid significantly time-consuming networking problems. -

      Introduction

      +

      Introduction

      The purpose of this chapter is to create familiarity with key aspects of Microsoft Windows network computing. If you want a solid technical grounding, do not gloss over these exercises. The points covered are recurrent issues on the Samba mailing lists. -

      +

      You can see from these exercises that Windows networking involves quite a lot of network broadcast traffic. You can look into the contents of some packets, but only to see some particular information that the Windows client sends to a server in the course of @@ -74,18 +74,18 @@ Recommended preparatory reading: The Official Samba-3 HOWTO and Reference Guide (TOSHARG) Chapter 9, “Network Browsing,” and Chapter 3, “Server Types and Security Modes.” -

      Assignment Tasks

      +

      Assignment Tasks

      You are about to witness how Microsoft Windows computer networking functions. The exercises step through identification of how a client machine establishes a connection to a remote Windows server. You observe how Windows machines find each other (i.e., how browsing works), and how the two key types of user identification (share mode security and user mode security) are affected. -

      +

      The networking protocols used by MS Windows networking when working with Samba use TCP/IP as the transport protocol. The protocols that are specific to Windows networking are encapsulated in TCP/IP. The network analyzer we use (ethereal) is able to show you the contents of the TCP/IP packets (or messages). -

      Procedure 1.1. Chapter 1 Tasks

      1. +

        Procedure 1.1. Chapter 1 Tasks

        1. Examine network traces to witness SMB broadcasts, host announcements, and name resolution processes.

        2. @@ -95,8 +95,8 @@

        3. Review traces of network logons for a Windows 9x/Me client as well as a Domain logon for a Windows XP Professional client. -

      Exercises

      - +

    Exercises

    + You are embarking on a course of discovery. The first part of the exercise requires two MS Windows 9x/Me systems. We called one machine WINEPRESSME and the other MILGATE98. Each needs an IP address; we used 10.1.1.10 @@ -111,7 +111,7 @@

    • Windows 98 name: MILGATE98.

    • Windows Me name: WINEPRESSME.

    • Windows XP Professional name: LightrayXP.

    • Samba-3.0.2 running on a SUSE Enterprise Linux 8.0 machine.

    Choose a workgroup name (MIDEARTH) for each exercise.

    - + The network captures provided on the CD-ROM at the back of this book were captured using ethereal version 0.9.10. A later version suffices without problems, but an earlier version may not expose all the information needed. Each capture file has been decoded and listed as a trace file. A summary of all @@ -119,7 +119,7 @@ perform the time-consuming equipment configuration and test work. This is a good time to point out the value that can be derived from this book really does warrant your taking sufficient time to practice each exercise with care and attention to detail. -

    Single Machine Broadcast Activity

    +

    Single Machine Broadcast Activity

    In this section, we start a single Windows 9x/Me machine, then monitor network activity for 30 minutes.

    1. Start the machine from which network activity will be monitored (using ethereal). @@ -138,21 +138,21 @@

    2. Analyze the capture. Identify each discrete message type that was captured. Note what transport protocol was used. Identify the timing between messages of identical types. -

    Findings

    +

    Findings

    The summary of the first 10 minutes of the packet capture should look like ???. A screenshot of a later stage of the same capture is shown in ???. -

    Figure 1.1. Windows Me Broadcasts The First 10 Minutes

    Windows Me Broadcasts The First 10 Minutes

    Figure 1.2. Windows Me Later Broadcast Sample

    Windows Me Later Broadcast Sample

    +

    Figure 1.1. Windows Me Broadcasts The First 10 Minutes

    Windows Me Broadcasts The First 10 Minutes

    Figure 1.2. Windows Me Later Broadcast Sample

    Windows Me Later Broadcast Sample

    Broadcast messages observed are shown in ???. Actual observations vary a little, but not by much. Early in the startup process, the Windows Me machine broadcasts its name for two reasons; first to ensure that its name would not result in a name clash, and second to establish its presence with the Local Master Browser (LMB). -

    Table 1.1. Windows Me Startup Broadcast Capture Statistics

    MessageTypeNumNotes
    WINEPRESSME<00>Reg84 lots of 2, 0.6 sec apart.
    WINEPRESSME<03>Reg84 lots of 2, 0.6 sec apart.
    WINEPRESSME<20>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<00>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<1d>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<1e>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<1b>Qry84300 sec apart at stable operation.
    __MSBROWSE__Reg8Registered after winning election to Browse Master.
    JHT<03>Reg84 x 2. This is the name of the user that logged onto Windows.
    Host Announcement WINEPRESSMEAnn2Observed at 10 sec.
    Domain/Workgroup Announcement MIDEARTHAnn18300 sec apart at stable operation.
    Local Master Announcement WINEPRESSMEAnn18300 sec apart at stable operation.
    Get Backup List RequestQry126 x 2 early in startup, 0.5 sec apart.
    Browser Election RequestAnn105 x 2 early in startup.
    Request Announcement WINEPRESSMEAnn4Early in startup.

    +

    Table 1.1. Windows Me Startup Broadcast Capture Statistics

    MessageTypeNumNotes
    WINEPRESSME<00>Reg84 lots of 2, 0.6 sec apart.
    WINEPRESSME<03>Reg84 lots of 2, 0.6 sec apart.
    WINEPRESSME<20>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<00>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<1d>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<1e>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<1b>Qry84300 sec apart at stable operation.
    __MSBROWSE__Reg8Registered after winning election to Browse Master.
    JHT<03>Reg84 x 2. This is the name of the user that logged onto Windows.
    Host Announcement WINEPRESSMEAnn2Observed at 10 sec.
    Domain/Workgroup Announcement MIDEARTHAnn18300 sec apart at stable operation.
    Local Master Announcement WINEPRESSMEAnn18300 sec apart at stable operation.
    Get Backup List RequestQry126 x 2 early in startup, 0.5 sec apart.
    Browser Election RequestAnn105 x 2 early in startup.
    Request Announcement WINEPRESSMEAnn4Early in startup.

    From the packet trace, it should be noted that no messages were propagated over TCP/IP; all employed UDP/IP. When steady state operation has been achieved, there is a cycle of various announcements, re-election of a browse master, and name queries. These create the symphony of announcements by which network browsing is made possible. -

    +

    For detailed information regarding the precise behavior of the CIFS/SMB protocols, the reader is referred to the book “Implementing CIFS: The Common Internet File System,” by Christopher Hertel, Publisher: Prentice Hall PTR, ISBN: 013047116X. @@ -176,7 +176,7 @@

  • Analyze the capture trace, taking note of the transport protocols used, the types of messages observed, and what interaction took place between the two machines. Leave both machines running for the next task. -

  • Findings

    +

    Findings

    ??? summarizes capture statistics observed. As in the previous case, all announcements used UDP/IP broadcasts. Also, as was observed with the last example, the second Windows 9x/Me machine broadcasts its name on startup to ensure that there exists no name clash @@ -184,14 +184,14 @@ to explore the inner details of the precise mechanism of how this functions should refer to the book “Implementing CIFS: The Common Internet File System,” referred to previously.

    Table 1.2. Second Machine (Windows 98) Capture Statistics

    MessageTypeNumNotes
    MILGATE98<00>Reg84 lots of 2, 0.6 sec apart.
    MILGATE98<03>Reg84 lots of 2, 0.6 sec apart.
    MILGATE98<20>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<00>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<1d>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<1e>Reg84 lots of 2, 0.75 sec apart.
    MIDEARTH<1b>Qry18900 sec apart at stable operation.
    JHT<03>Reg2This is the name of the user that logged onto Windows.
    Host Announcement MILGATE98Ann14Every 120 sec.
    Domain/Workgroup Announcement MIDEARTHAnn6900 sec apart at stable operation.
    Local Master Announcement WINEPRESSMEAnn6Insufficient detail to determine frequency.

    - - - + + + Observation of the contents of Host Announcements, Domain/Workgroup Announcements, and Local Master Announcements is instructive. These messages convey a significant level of detail regarding the nature of each machine that is on the network. An example dissection of a Host Announcement is given in ???. -

    Figure 1.3. Typical Windows 9x/Me Host Announcement

    Typical Windows 9x/Me Host Announcement

    Simple Windows Client Connection Characteristics

    +

    Figure 1.3. Typical Windows 9x/Me Host Announcement

    Typical Windows 9x/Me Host Announcement

    Simple Windows Client Connection Characteristics

    The purpose of this exercise is to discover how Microsoft Windows clients create (establish) connections with remote servers. The methodology involves analysis of a key aspect of how Windows clients access remote servers: the session setup protocol. @@ -216,11 +216,11 @@ When the share called Stuff is being displayed, stop the capture. Save the captured data in case it is needed for later analysis.

  • - + From the top of the packets captured, scan down to locate the first packet that has interpreted as Session Setup AndX, User: anonymous; Tree Connect AndX, Path: \\MILGATE98\IPC$. -

  • +

  • In the dissection (analysis) panel, expand the SMB, Session Setup AndX Request, and Tree Connect AndX Request. Examine both operations. Identify the name of the user Account and what password was used. The Account name should be empty. @@ -230,52 +230,52 @@ decoded of the type Session Setup AndX. Locate the last such packet that was targeted at the \\MILGATE98\IPC$ service.

  • - - + + Dissect this packet as per the one above. This packet should have a password length of 24 (characters) and should have a password field, the contents of which is a long hexadecimal number. Observe the name in the Account field. This is a User Mode session setup packet. -

  • Findings and Comments

    - - The IPC$ share serves a vital purpose[1] +

    Findings and Comments

    + + The IPC$ share serves a vital purpose[1] in SMB/CIFS based networking. A Windows client connects to this resource to obtain the list of resources that are available on the server. The server responds with the shares and print queues that are available. In most but not all cases, the connection is made with a NULL username and a NULL password.

    - + The two packets examined are material evidence with respect to how Windows clients may interoperate with Samba. Samba requires every connection setup to be authenticated using valid UNIX account credentials (UID/GID). This means that even a NULL session setup can be established only by automatically mapping it to a valid UNIX account.

    - - + + Samba has a special name for the NULL, or empty, user account. - It calls that the guest account. The + It calls that the guest account. The default value of this parameter is nobody; however, this can be changed to map the function of the guest account to any other UNIX identity. Some UNIX administrators prefer to map this account to the system default anonymous FTP account. A sample NULL Session Setup AndX packet dissection is shown in ???. -

    Figure 1.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request

    Typical Windows 9x/Me NULL SessionSetUp AndX Request

    - - - +

    Figure 1.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request

    Typical Windows 9x/Me NULL SessionSetUp AndX Request

    + + + When a UNIX/Linux system does not have a nobody user account (/etc/passwd), the operation of the NULL account cannot validate and thus connections that utilize the guest account fail. This breaks all ability to browse the Samba server and is a common problem reported on the Samba mailing list. A sample User Mode Session Setup AndX is shown in ???. -

    Figure 1.5. Typical Windows 9x/Me User SessionSetUp AndX Request

    Typical Windows 9x/Me User SessionSetUp AndX Request

    - +

    Figure 1.5. Typical Windows 9x/Me User SessionSetUp AndX Request

    Typical Windows 9x/Me User SessionSetUp AndX Request

    + The User Mode connection packet contains the account name and the domain name. The password is provided in Microsoft encrypted form, and its length is shown as 24 characters. This is the length of Microsoft encrypted passwords. -

    Windows 200x/XP Client Interaction with Samba-3

    +

    Windows 200x/XP Client Interaction with Samba-3

    By now you may be asking, “Why did you choose to work with Windows 9x/Me?

    First, we want to demonstrate the simple case. This book is not intended to be a detailed treatise @@ -319,14 +319,14 @@ If desired, the Windows XP Professional client and the Domain Controller are no longer needed for exercises in this chapter.

  • - - + + From the top of the packets captured, scan down to locate the first packet that has interpreted as Session Setup AndX Request, NTLMSSP_AUTH.

  • - - - + + + In the dissection (analysis) panel, expand the SMB, Session Setup AndX Request. Expand the packet decode information, beginning at the Security Blob: entry. Expand the GSS-API -> SPNEGO -> netTokenTarg -> responseToken -> NTLMSSP @@ -338,7 +338,7 @@ decoded of the type Session Setup AndX Request. Click the last such packet that has been decoded as Session Setup AndX Request, NTLMSSP_AUTH.

  • - + In the dissection (analysis) panel, expand the SMB, Session Setup AndX Request. Expand the packet decode information, beginning at the Security Blob: entry. Expand the GSS-API -> SPNEGO -> netTokenTarg -> responseToken -> NTLMSSP @@ -349,18 +349,18 @@ The value of these two parameters is the Microsoft encrypted password hashes, respectively, the LanMan password and then the NT (case-preserving) password hash.

  • - - + + The passwords are 24 characters long hexadecimal numbers. This packet confirms that this is a User Mode session setup packet. -

  • Figure 1.6. Typical Windows XP NULL Session Setup AndX Request

    Typical Windows XP NULL Session Setup AndX Request

    Figure 1.7. Typical Windows XP User Session Setup AndX Request

    Typical Windows XP User Session Setup AndX Request

    Discussion

    +

    Figure 1.6. Typical Windows XP NULL Session Setup AndX Request

    Typical Windows XP NULL Session Setup AndX Request

    Figure 1.7. Typical Windows XP User Session Setup AndX Request

    Typical Windows XP User Session Setup AndX Request

    Discussion

    This exercise demonstrates that, while the specific protocol for the Session Setup AndX is handled in a more sophisticated manner by recent MS Windows clients, the underlying rules or principles remain the same. Thus it is demonstrated that MS Windows XP Professional clients still use a NULL-Session connection to query and locate resources on an advanced network technology server (one using Windows NT4/200x or Samba). It also demonstrates that an authenticated connection must be made before resources can be used. -

    Conclusions to Exercises

    +

    Conclusions to Exercises

    In summary, the following points have been established in this chapter:

    • When NetBIOS over TCP/IP protocols are enabled, MS Windows networking employs broadcast @@ -380,7 +380,7 @@ file or in an LDAP database. Samba-3 permits that use of multiple different passdb backend databases, in concurrent deploy. Refer to TOSHARG, Chapter 10, “Account Information Databases.

    Dissection and Discussion

    - + The exercises demonstrate the use of the guest account, the way that MS Windows clients and servers resolve computer names to a TCP/IP address, and how connections between a client and a server are established. @@ -388,8 +388,8 @@ Those wishing background information regarding NetBIOS name types should refer to the Microsoft Knowledge Base Article Q102878. -

    Technical Issues

    - +

    Technical Issues

    + Network browsing involves SMB broadcast announcements, SMB enumeration requests, connections to the IPC$ share, share enumerations, and SMB connection setup processes. The use of anonymous connections to a Samba server involve the use of @@ -397,44 +397,44 @@

    Questions and Answers

    The questions and answers given in this section are designed to highlight important aspects of Microsoft Windows networking. -

    +

    What is the significance of the MIDEARTH<1b> type query? -
    +
    What is the significance of the MIDEARTH<1d> type name registration? -
    +
    What is the role and significance of the <01><02>__MSBROWSE__<02><01> name registration? -
    +
    What is the significance of the MIDEARTH<1e> type name registration? -
    +
    guest account What is the significance of the guest account in smb.conf? -
    +
    Is it possible to reduce network broadcast activity with Samba-3? -
    +
    Can I just use plain-text passwords with Samba? -
    +
    What parameter in the smb.conf file is used to enable the use of encrypted passwords? -
    +
    Is it necessary to specify encrypt passwordsencrypt passwords = Yes when Samba-3 is configured as a Domain Member? -
    +
    Is it necessary to specify a guest account when Samba-3 is configured as a Domain Member server? -

    +

    What is the significance of the MIDEARTH<1b> type query?

    - - + + This is a broadcast announcement by which the Windows machine is attempting to locate a Domain Master Browser (DMB) in the event that it might exist on the network. Refer to TOSHARG Chapter 9, Section 9.7, “Technical Overview of Browsing” for details regarding the function of the DMB and its role in network browsing. -

    +

    What is the significance of the MIDEARTH<1d> type name registration?

    - - + + This name registration records the machine IP addresses of the Local Master Browsers (LMBs). Network clients can query this name type to obtain a list of browser servers from the Master Browser. @@ -452,25 +452,25 @@ The IP address of the DMB (if one exists)

  • The IP address of the LMB on the local segment -

  • +

    What is the role and significance of the <01><02>__MSBROWSE__<02><01> name registration?

    - + This name is registered by the Browse Master to broadcast and receive domain announcements. Its scope is limited to the local network segment, or subnet. By querying this name type, Master Browsers on networks that have multiple domains can find the names of Master Browsers for each domain. -

    +

    What is the significance of the MIDEARTH<1e> type name registration?

    - + This name is registered by all Browse Masters in a domain or workgroup. The registration name type is known as the Browser Election Service. Master Browsers register themselves with this name type so that Domain Master Browsers can locate them to perform cross-subnet browse list updates. This name type is also used to initiate elections for Master Browsers. -

    - +

    + What is the significance of the guest account in smb.conf?

    This parameter specifies the default UNIX account to which MS Windows networking @@ -482,29 +482,29 @@ It should be noted that the guest account is essential to Samba operation. Either the operating system must have an account called nobody or there must be an entry in the smb.conf file with a valid UNIX account. For example, - guest account = ftp. -

    + guest account = ftp. +

    Is it possible to reduce network broadcast activity with Samba-3?

    - - + + Yes, there are two ways to do this. The first involves use of WINS (See TOSHARG, Chapter 9, Section 9.5, “WINS The Windows Inter-networking Name Server”), the alternate method involves disabling the use of NetBIOS over TCP/IP. This second method requires a correctly configured DNS server (see TOSHARG, Chapter 9, Section 9.3, “Discussion”).

    - - - + + + The use of WINS reduces network broadcast traffic. The reduction is greatest when all network clients are configured to operate in Hybrid Mode. This can be effected through use of DHCP to set the NetBIOS node type to type 8 for all network clients. Additionally, it is - beneficial to configure Samba to use name resolve order = wins host + beneficial to configure Samba to use name resolve order = wins host bcast.

    Note

    Use of SMB without NetBIOS is possible only on Windows 200x/XP Professional clients and servers, as well as with Samba-3. -

    +

    Can I just use plain-text passwords with Samba?

    Yes, you can configure Samba to use plain-text passwords, though this does create a few problems. @@ -527,22 +527,22 @@ a UNIX system account for that user. On systems that run winbindd to access the Samba PDC/BDC to provide Windows user and group accounts, the idmap uid, idmap gid ranges set in the smb.conf file provide the local UID/GIDs needed for local identity management purposes. -

    +

    What parameter in the smb.conf file is used to enable the use of encrypted passwords?

    The parameter in the smb.conf file that controls this behavior is known as encrypt passwords. The default setting for this in Samba-3 is Yes (Enabled). -

    - Is it necessary to specify encrypt passwords = Yes +

    + Is it necessary to specify encrypt passwords = Yes when Samba-3 is configured as a Domain Member?

    No. This is the default behavior. -

    +

    Is it necessary to specify a guest account when Samba-3 is configured as a Domain Member server?

    Yes. This is a local function on the server. The default setting is to use the UNIX account nobody. If this account does not exist on the UNIX server, then it is - necessary to provide a guest account = an_account, + necessary to provide a guest account = an_account, where an_account is a valid local UNIX user account.



    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/secure.html samba-3.0.10/docs/htmldocs/Samba-Guide/secure.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/secure.html 2004-11-15 10:15:34.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/secure.html 2004-12-15 10:23:43.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 4. Secure Office Networking

    Chapter 4. Secure Office Networking

    +Chapter 4. Secure Office Networking

    Chapter 4. Secure Office Networking

    Congratulations, your Samba networking skills are developing nicely. You started out with three simple networks in Chapter 2, and then in Chapter 3 you designed and built a network that provides a high degree of flexibility, integrity, and dependability. It @@ -11,7 +11,7 @@ so caution is advised for anyone who tries to use Samba-2.2.x with the guidance here given. To avoid confusion, this book is all about Samba-3. Let's get the exercises in this chapter under way. -

    Introduction

    +

    Introduction

    You have made Mr. Meany a very happy man. Recently he paid you a fat bonus for work well done. It is one year since the last network upgrade. You have been quite busy. Two months ago Mr. Meany gave approval to hire Christine Roberson who has taken over @@ -40,7 +40,7 @@ Occasionally she wants to work with you on a challenging problem. When you told her about your move, she almost resigned, although she was reassured that a new manager would be hired to run Information Technology and she would be responsible only for operations. -

    Assignment Tasks

    +

    Assignment Tasks

    You promised the staff Internet services including web browsing, electronic mail, virus protection, and a company Web site. Christine is keen to help turn the vision into reality. Let's see how close you can get to the promises made. @@ -87,13 +87,13 @@ of users had to share a PC while waiting for new machines to arrive. This presented some problems with desktop computers and software installation into the new users' desktop profile. -

    Dissection and Discussion

    +

    Dissection and Discussion

    Many of the conclusions you draw here are obvious. Some requirements are not very clear or may simply be your means of drawing the most out of Samba-3. Much can be done more simply than you will demonstrate here, but keep in mind that the network must scale to at least 500 users. This means that some functionality will be over-designed for the current 130 user environment. -

    Technical Issues

    +

    Technical Issues

    In this exercise we are using a 24-bit subnet mask for the two local networks. This, of course, limits our network to a maximum of 253 usable IP addresses. The network address range chosen is one of the ranges assigned by RFC1918 for private networks. @@ -101,14 +101,14 @@ addresses, it would be a good idea to switch to a network address specified in RFC1918 in the 172.16.0.0/16 range. This is done in the following chapters.

    - - + + The high growth rates projected are a good reason to use the tdbsam passdb backend. The use of smbpasswd for the backend may result in performance problems. The tdbsam passdb backend offers features that are not available with the older flat ASCII-based smbpasswd database.

    - + The proposed network design uses a single server to act as an Internet services host for electronic mail, Web serving, remote administrative access vis SSH, as well as for Samba-based file and print services. This design is often chosen by sites that feel @@ -121,10 +121,10 @@ Samba will be configured to specifically not operate on the ethernet interface that is directly connected to the Internet.

    - - - - + + + + You know that your ISP is providing full firewall services, but you cannot rely on that. Always assume that human error will occur, so be prepared by using Linux firewall facilities based on iptables to effect Network Address Translation (NAT). Block all @@ -134,7 +134,7 @@ The configuration of Web serving, Web proxy services, electronic mail, and the details of generic anti-virus handling are beyond the scope of this book and therefore are not covered, except insofar as this affects Samba-3. -

    +

    Notebook computers are configured to use a network login when in the office and a local account to login while away from the office. Users store all work done in transit (away from the office) by using a local share for work files. Standard procedures @@ -143,25 +143,25 @@ to not carry on any company notebook computer any files that are not absolutely required. This is a preventative measure to protect client information as well as business private records. -

    +

    All applications are served from the central server from a share called apps. Microsoft Office XP Professional and OpenOffice 1.1.0 will be installed using a network (or administrative) installation. Accounting and financial management software can also be run only from the central application server. Notebook users are provided with locally installed applications on a need-to-have basis only.

    - + The introduction of roaming profiles support means that users can move between desktop computer systems without constraint while retaining full access to their data. The desktop travels with them as they move.

    - + The DNS server implementation must now address both internal needs as well as external needs. You forward DNS lookups to your ISP provided server as well as the abmas.us external secondary DNS server.

    - - + + Compared with the DHCP server configuration in ???, the configuration used in this example has to deal with the presence of an Internet connection. The scope set for it ensures that no DHCP services will be offered on the external connection. All printers are @@ -184,7 +184,7 @@ a problem given that Christine is to install and configure one single workstation and then clone that configuration, using Norton Ghost, to all workstations. Each machine is identical, so this should pose no problem. -

    Hardware Requirements

    +

    Hardware Requirements

    This server runs a considerable number of services. From similarly configured Linux installations the approximate calculated memory requirements will be as that shown in ???. @@ -211,7 +211,7 @@ An initial configuration with only 1 GByte memory would lead to early performance complaints as the system load builds up. Given the low cost of memory, it would not make sense to compromise in this area. -

    +

    Aggregate Input/Output loads should be considered for sizing network configuration as well as disk subsystems. For network bandwidth calculations, one would typically use an estimate of 0.1 MBytes/sec per user. This would suggest that 100-Base-T (approx. 10 MBytes/sec) @@ -219,7 +219,7 @@ idea to begin with 1 Gigabit ethernet cards for the two internal networks, each attached to a 1 Gigabit Etherswitch that provides connectivity to an expandable array of 100-Base-T switched ports. -

    +

    Considering the choice of 1 Gigabit ethernet interfaces for the two local network segments, the aggregate network I/O capacity will be 2100 MBit/sec (about 230 MBytes/sec), an I/O demand that would require a fast disk storage I/O capability. Peak disk throughput is @@ -251,10 +251,10 @@ Add 50% buffer 303 GBytes Recommended Storage: 908 GBytes

    - + The preferred storage capacity should be approximately 1 TeraByte. Use of RAID level 5 with two hot spare drives would require an 8 drive by 200 GByte capacity per drive array. -

    Political Issues

    +

    Political Issues

    Your industry is coming under increasing accountability pressures. Increased paranoia is necessary so you can demonstrate that you have acted with due diligence. You must not trust your Internet connection. @@ -262,12 +262,12 @@ Apart from permitting more efficient management of business applications through use of an application server, your primary reason for the decision to implement this is that it gives you greater control over software licensing. -

    +

    You are well aware that the current configuration results in some performance issues as the size of the desktop profile grows. Given that users use Microsoft Outlook Express, you know that the storage implications of the .PST file is something that needs to be addressed later on. -

    Implementation

    +

    Implementation

    ??? demonstrates the overall design of the network that you will implement.

    The information presented here assumes that you are already familiar with many basic steps. @@ -282,53 +282,53 @@ The NetBIOS name of the Samba server is set to DIAMOND.

  • The Domain name is set to PROMISES. -

  • +

  • Ethernet interface eth0 is attached to the Internet connection and is externally exposed. This interface is explicitly not available for Samba to use. Samba listens on this interface for broadcast messages, but does not broadcast any information on eth0, nor does it accept any connections from it. This is achieved by way of the interfaces parameter and the bind interfaces only entry. -

  • +

  • The passdb backend parameter specifies the creation and use of the tdbsam password backend. This is a binary database that has excellent scalability for a large number of user account entries. -

  • - WINS serving is enabled by the wins support = Yes, - and name resolution is set to use it by means of the name resolve order = wins bcast hosts entry. -

  • +

  • + WINS serving is enabled by the wins support = Yes, + and name resolution is set to use it by means of the name resolve order = wins bcast hosts entry. +

  • The Samba server is configured for use by Windows clients as a time server. -

  • +

  • Samba is configured to directly interface with CUPS via the direct internal interface that is provided by CUPS libraries. This is achieved with the - printing = CUPS as well as the - printcap name = CUPS entries. -

  • + printing = CUPS as well as the + printcap name = CUPS entries. +

  • External interface scripts are provided to enable Samba to interface smoothly to essential operating system functions for user and group management. This is important to enable workstations to join the Domain, and is also important so that you can use the Windows NT4 Domain User Manager, as well as the Domain Server Manager. These tools are provided as part of the SRVTOOLS.EXE toolkit that can be downloaded from the Microsoft FTP site. -

  • +

  • The smb.conf file specifies that the Samba server will operate in (default) - security = user mode[5] (User Mode). -

  • + security = user mode[5] (User Mode). +

  • Domain logon services as well as a Domain logon script are specified. The logon script will be used to add robustness to the overall network configuration. -

  • - Roaming profiles are enabled through the specification of the parameter, logon path = \\%L\profiles\%U. The value of this parameter translates the +

  • + Roaming profiles are enabled through the specification of the parameter, logon path = \\%L\profiles\%U. The value of this parameter translates the %L to the name by which the Samba server is called by the client (for this configuration, it translates to the name DIAMOND), and the %U will translate to the name of the user within the context of the connection made to the profile share. It is the administrator's responsibility to ensure there is a directory in the root of the profile share for each user. This directory must be owned by the user also. An exception to this requirement is when a profile is created for group use. -

  • +

  • Precautionary veto is effected for particular Windows file names that have been targeted by virus-related activity. Additionally, Microsoft Office files are vetoed from opportunistic locking controls. This should help to prevent lock contention related file access problems. -

  • +

  • Explicit controls are effected to restrict access to the IPC$ share to local networks only. The IPC$ share plays an important role in network browsing and in establishment of network connections. @@ -355,11 +355,11 @@ Windows Client Configuration

  • The following sections cover each step in logical and defined detail. -

    Basic System Configuration

    +

    Basic System Configuration

    The preparation in this section assumes that your SUSE Enterprise Linux Server 8.0 system has been freshly installed. It prepares basic files so that the system is ready for comprehensive operation in line with the network diagram shown in ???. -

    1. +

      1. Using the UNIX/Linux system tools, name the server server.abmas.us. Verify that your hostname is correctly set by running:

        @@ -372,7 +372,7 @@
         server.abmas.us
         

      2. - + Edit your /etc/hosts file to include the primary names and addresses of all network interfaces that are on the host server. This is necessary so that during startup the system can resolve all its own names to the IP address prior to @@ -393,12 +393,12 @@ 192.168.2.20 qmsf.abmas.biz qmsf 192.168.2.30 hplj6f.abmas.biz hplj6f

        - + The printer entries are not necessary if named is started prior to startup of cupsd, the CUPS daemon.

      3. - - + + The host server is acting as a router between the two internal network segments as well as for all Internet access. This necessitates that IP forwarding must be enabled. This can be achieved by adding to the /etc/rc.d/boot.local an entry as follows: @@ -407,8 +407,8 @@

        To ensure that your kernel is capable of IP forwarding during configuration, you may wish to execute that command manually also. This setting permits the Linux system to - act as a router.[6] -

      4. + act as a router.[6] +

      5. Installation of a basic firewall and network address translation facility is necessary. The following script can be installed in the /usr/local/sbin directory. It is executed from the /etc/rc.d/boot.local startup @@ -486,11 +486,11 @@ # /usr/local/sbin/abmas-natfw.sh

        -

      +

    The server is now ready for Samba configuration. During the validation step, you remove the entry for the Samba server diamond from the /etc/hosts file. This is done after you are satisfied that DNS-based name resolution is functioning correctly. -

    Samba Configuration

    +

    Samba Configuration

    When you have completed this section, the Samba server is ready for testing and validation; however, testing and validation have to wait until DHCP, DNS, and Printing (CUPS) services have been configured. @@ -509,153 +509,153 @@ and ???. Concatenate (join) all three files to make a single smb.conf file. The final, fully qualified path for this file should be /etc/samba/smb.conf. -

    Example 4.4. 130 User Network with tdbsam [globals] Section

    # Global parameters
    [global]
    +

    Example 4.4. 130 User Network with tdbsam [globals] Section

    # Global parameters
    [global]
    - workgroup = PROMISES
    + workgroup = PROMISES
    - netbios name = DIAMOND
    + netbios name = DIAMOND
    - interfaces = eth1, eth2, lo
    + interfaces = eth1, eth2, lo
    - bind interfaces only = Yes
    + bind interfaces only = Yes
    - passdb backend = tdbsam
    + passdb backend = tdbsam
    - pam password change = Yes
    + pam password change = Yes
    - passwd chat = *New*Password* %n\n *Re-enter*new*password*
    %n\n *Password*changed*
    + passwd chat = *New*Password* %n\n *Re-enter*new*password*
    %n\n *Password*changed*
    - username map = /etc/samba/smbusers
    + username map = /etc/samba/smbusers
    - unix password sync = Yes
    + unix password sync = Yes
    - log level = 1
    + log level = 1
    - syslog = 0
    + syslog = 0
    - log file = /var/log/samba/%m
    + log file = /var/log/samba/%m
    - max log size = 50
    + max log size = 50
    - smb ports = 139 445
    + smb ports = 139 445
    - name resolve order = wins bcast hosts
    + name resolve order = wins bcast hosts
    - time server = Yes
    + time server = Yes
    - printcap name = CUPS
    + printcap name = CUPS
    - show add printer wizard = No
    + show add printer wizard = No
    - add user script = /usr/sbin/useradd -m '%u'
    + add user script = /usr/sbin/useradd -m '%u'
    - delete user script = /usr/sbin/userdel -r '%u'
    + delete user script = /usr/sbin/userdel -r '%u'
    - add group script = /usr/sbin/groupadd '%g'
    + add group script = /usr/sbin/groupadd '%g'
    - delete group script = /usr/sbin/groupdel '%g'
    + delete group script = /usr/sbin/groupdel '%g'
    - add user to group script = /usr/sbin/usermod -G '%g' '%u'
    + add user to group script = /usr/sbin/usermod -G '%g' '%u'
    - add machine script = /usr/sbin/useradd
    -s /bin/false -d /tmp '%u'
    + add machine script = /usr/sbin/useradd
    -s /bin/false -d /tmp '%u'
    - shutdown script = /var/lib/samba/scripts/shutdown.sh
    + shutdown script = /var/lib/samba/scripts/shutdown.sh
    - abort shutdown script = /sbin/shutdown -c
    + abort shutdown script = /sbin/shutdown -c
    - logon script = scripts\logon.bat
    + logon script = scripts\logon.bat
    - logon path = \\%L\profiles\%U
    + logon path = \\%L\profiles\%U
    - logon drive = X:
    + logon drive = X:
    - logon home = \\%L\%U
    + logon home = \\%L\%U
    - domain logons = Yes
    + domain logons = Yes
    - preferred master = Yes
    + preferred master = Yes
    - wins support = Yes
    + wins support = Yes
    - utmp = Yes
    + utmp = Yes
    - map acl inherit = Yes
    + map acl inherit = Yes
    - printing = cups
    + printing = cups
    - veto files = /*.eml/*.nws/*.{*}/
    + veto files = /*.eml/*.nws/*.{*}/
    veto oplock files = /*.doc/*.xls/*.mdb/

    -

    Example 4.5. 130 User Network with tdbsam Services Section Part A

    [IPC$]
    +

    Example 4.5. 130 User Network with tdbsam Services Section Part A

    [IPC$]
    - path = /tmp
    + path = /tmp
    - hosts allow = 192.168.1.0/24, 192.168.2.0/24, 127.0.0.1
    + hosts allow = 192.168.1.0/24, 192.168.2.0/24, 127.0.0.1
    - hosts deny = 0.0.0.0/0
    [homes]
    + hosts deny = 0.0.0.0/0
    [homes]
    - comment = Home Directories
    + comment = Home Directories
    - valid users = %S
    + valid users = %S
    - read only = No
    + read only = No
    - browseable = No
    [printers]
    + browseable = No
    [printers]
    - comment = SMB Print Spool
    + comment = SMB Print Spool
    - path = /var/spool/samba
    + path = /var/spool/samba
    - guest ok = Yes
    + guest ok = Yes
    - printable = Yes
    + printable = Yes
    - use client driver = Yes
    + use client driver = Yes
    - default devmode = Yes
    + default devmode = Yes
    - browseable = No
    [netlogon]
    + browseable = No
    [netlogon]
    - comment = Network Logon Service
    + comment = Network Logon Service
    - path = /var/lib/samba/netlogon
    + path = /var/lib/samba/netlogon
    - guest ok = Yes
    + guest ok = Yes
    locking = No

    -

    Example 4.6. 130 User Network with tdbsam Services Section Part B

    [profiles]
    +

    Example 4.6. 130 User Network with tdbsam Services Section Part B

    [profiles]
    - comment = Profile Share
    + comment = Profile Share
    - path = /var/lib/samba/profiles
    + path = /var/lib/samba/profiles
    - read only = No
    + read only = No
    - profile acls = Yes
    [accounts]
    + profile acls = Yes
    [accounts]
    - comment = Accounting Files
    + comment = Accounting Files
    - path = /data/accounts
    + path = /data/accounts
    - read only = No
    [service]
    + read only = No
    [service]
    - comment = Financial Services Files
    + comment = Financial Services Files
    - path = /data/service
    + path = /data/service
    - read only = No
    [apps]
    + read only = No
    [apps]
    - comment = Application Files
    + comment = Application Files
    - path = /apps
    + path = /apps
    - read only = Yes
    + read only = Yes
    admin users = bjordan

  • - + Add the root user to the password backend as follows:

     root#  smbpasswd -a root
    @@ -668,7 +668,7 @@
     		deleted. If for any reason the account is deleted, you may not be able to recreate this account
     		without considerable trouble.
     		

  • - + Create the username map file to permit the root account to be called Administrator from the Windows network environment. To do this, create the file /etc/samba/smbusers with the following contents: @@ -695,13 +695,13 @@ ####

  • - + Create and map Windows Domain Groups to UNIX groups. A sample script is provided in ???. Create a file containing this script. We called ours /etc/samba/initGrps.sh. Set this file so it can be executed, and then execute the script. Sample output should be as follows: -

    Example 4.7. Script to Map Windows NT Groups to UNIX Groups

    +

    Example 4.7. Script to Map Windows NT Groups to UNIX Groups

     #!/bin/bash
     #
     # initGrps.sh
    @@ -753,13 +753,13 @@
     Users (S-1-5-32-545) -> -1
     

  • - - - - - - - + + + + + + + There is one preparatory step without which you will not have a working Samba network environment. You must add an account for each network user. For each user who needs to be given a Windows Domain account, make an entry in the @@ -783,7 +783,7 @@ Added user username.

    You do of course use a valid user login ID in place of username. -

  • +

  • Using the preferred tool for your UNIX system, add each user to the UNIX groups created previously as necessary. File system access control will be based on UNIX group membership.

  • @@ -792,7 +792,7 @@ file is /data. Format the file system as required, and mount the formatted file system partition using appropriate system tools.

  • - + Create the top-level file storage directories for data and applications as follows:

     root#  mkdir -p /data/{accounts,finsvcs}
    @@ -830,7 +830,7 @@
     root#  chown 'username'.users /var/lib/samba/profiles/'username'
     root#  chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username'
     

    -

  • +

  • Create a logon script. It is important that each line is correctly terminated with a carriage return and line-feed combination (i.e., DOS encoding). The following procedure works if the right tools (unix2dos and dos2unix) are installed. @@ -851,7 +851,7 @@ foundational to Internet access as well as to trouble-free operation of local networking. When you have completed this section, the server should be ready for solid duty operation.

    1. - + Create a file called /etc/dhcpd.conf with the contents as shown in ???. @@ -902,7 +902,7 @@ }

  • - + Create a file called /etc/named.conf that has the combined contents of the ???, ???, and ??? files that are concatenated (merged) in this @@ -910,9 +910,9 @@

  • Create the files shown in their directories as follows: -

    Table 4.2. DNS (named) Resource Files

    ReferenceFile Location
    ???/var/lib/named/localhost.zone
    ???/var/lib/named/127.0.0.zone
    ???/var/lib/named/root.hint
    ???/var/lib/named/master/abmas.biz.hosts
    ???/var/lib/named/abmas.us.hosts
    ???/var/lib/named/192.168.1.0.rev
    ???/var/lib/named/192.168.2.0.rev

    +

    Table 4.2. DNS (named) Resource Files

    ReferenceFile Location
    ???/var/lib/named/localhost.zone
    ???/var/lib/named/127.0.0.zone
    ???/var/lib/named/root.hint
    ???/var/lib/named/master/abmas.biz.hosts
    ???/var/lib/named/abmas.us.hosts
    ???/var/lib/named/192.168.1.0.rev
    ???/var/lib/named/192.168.2.0.rev

    -

    Example 4.9. DNS Master Configuration File /etc/named.conf Master Section

    +

    Example 4.9. DNS Master Configuration File /etc/named.conf Master Section

     ###
     # Abmas Biz DNS Control File
     ###
    @@ -1097,7 +1097,7 @@
     

  • - + All DNS name resolution should be handled locally. To ensure that the server is configured correctly to handle this, edit /etc/resolv.conf to have the following content: @@ -1106,13 +1106,13 @@ nameserver 127.0.0.1 nameserver 123.45.54.23

    - + This instructs the name resolver function (when configured correctly) to ask the DNS server that is running locally to resolve names to addresses. In the event that the local name server is not available, ask the name server provided by the ISP. The latter, of course, does not resolve purely local names to IP addresses.

  • - + The final step is to edit the /etc/nsswitch.conf file. This file controls the operation of the various resolver libraries that are part of the Linux Glibc libraries. Edit this file so that it contains the following entries: @@ -1132,10 +1132,10 @@ Use any other port the manufacturer specifies for direct mode, raw printing and adjust the port as necessary in the following example commands. This allows the CUPS spooler to print using raw mode protocols. - - + +

  • - + Configure the CUPS Print Queues as follows:

     root#  lpadmin -p qmsa -v socket://qmsa.abmas.biz:9100 -E
    @@ -1143,9 +1143,9 @@
     root#  lpadmin -p qmsf -v socket://qmsf.abmas.biz:9100 -E
     root#  lpadmin -p hplj6f -v socket://hplj6f.abmas.biz:9100 -E
     

    - + This has created the necessary print queues with no assigned print filter. -

  • +

  • Print queues may not be enabled at creation. Use lpc stat to check the status of the print queues and if necessary make certain that the queues you have just created are enabled by executing the following: @@ -1155,7 +1155,7 @@ root# /usr/bin/enable qmsf root# /usr/bin/enable hplj6f

    -

  • +

  • Even though your print queues may be enabled, it is still possible that they are not accepting print jobs. A print queue services incoming printing requests only when configured to do so. Ensure that your print queues are @@ -1167,15 +1167,15 @@ root# /usr/bin/accept hplj6f

  • - - - + + + Edit the file /etc/cups/mime.convs to uncomment the line:

     application/octet-stream     application/vnd.cups-raw      0     -
     

  • - + Edit the file /etc/cups/mime.types to uncomment the line:

     application/octet-stream
    @@ -1185,7 +1185,7 @@
     		

  • The UNIX system print queues have been configured and are ready for validation testing.

    Process Startup Configuration

    - + There are two essential steps to process startup configuration. First, the process must be configured so that it automatically restarts each time the server is rebooted. This step involves use of the chkconfig tool that @@ -1194,7 +1194,7 @@ directories. Links are created so that when the system run-level is changed, the necessary start or kill script is run.

    - + In the event that a service is not run as a daemon, but via the inter-networking super daemon (inetd or xinetd), then the chkconfig tool makes the necessary entries in the /etc/xinetd.d directory @@ -1205,7 +1205,7 @@

    1. Use the standard system tool to configure each service to restart automatically at every system reboot. For example: - +

       root#  chkconfig dhpc on
       root#  chkconfig named on
      @@ -1213,9 +1213,9 @@
       root#  chkconfig smb on
       

    2. - - - + + + Now start each service to permit the system to be validated. Execute each of the following in the sequence shown: @@ -1225,7 +1225,7 @@ root# /etc/rc.d/init.d/cups restart root# /etc/rc.d/init.d/smb restart

      -

    Validation

    +

    Validation

    Complex networking problems are most often caused by simple things that are poorly or incorrectly configured. The validation process adopted here should be followed carefully; it is the result of the experience gained from years of making and correcting the most common mistakes. Shortcuts often lead to basic errors. You should @@ -1236,7 +1236,7 @@ Later in this book you learn how to make users happier. For now, it is enough to learn to validate. Let's get on with it.

    1. - + One of the most important facets of Samba configuration is to ensure that name resolution functions correctly. You can test name resolution with a few simple tests. The most basic name resolution is provided from the @@ -1262,7 +1262,7 @@ This proves that name resolution via the /etc/hosts file is working.

    2. - + So far, your installation is going particularly well. In this step we validate DNS server and name resolution operation. Using your favorite UNIX system editor, change the /etc/nsswitch.conf file so that the @@ -1271,7 +1271,7 @@ hosts: dns

    3. - + Before you test DNS operation, it is a good idea to verify that the DNS server is running by executing the following:

      @@ -1285,7 +1285,7 @@
        2552 pts/2    S      0:00 grep named
       

      This means that we are ready to check DNS operation. Do so by executing: - +

       root#  ping diamond
       PING sleeth1.abmas.biz (192.168.1.1) 56(84) bytes of data.
      @@ -1301,12 +1301,12 @@
       root#  host -f diamond.abmas.biz
       sleeth1.abmas.biz has address 192.168.1.1
       

      - + You may now remove the entry called diamond from the /etc/hosts file. It does not hurt to leave it there, but its removal reduces the number of administrative steps for this name.

    4. - + WINS is a great way to resolve NetBIOS names to their IP address. You can test the operation of WINS by starting nmbd (manually, or by way of the Samba startup method shown in ???). You must edit @@ -1322,7 +1322,7 @@ 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.094 ms 64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.479 ms

      - + Now that you can relax with the knowledge that all three major forms of name resolution to IP address resolution are working, edit the /etc/nsswitch.conf again. This time you add all three forms of name resolution to this file. @@ -1343,7 +1343,7 @@ This shows that the server is running. The proof of whether or not it is working comes when you try to add the first DHCP client to the network.

    5. - + This is a good point at which to start validating Samba operation. You are content that name resolution is working for basic TCP/IP needs. Let's move on. If your smb.conf file has bogus options or parameters, this may cause Samba @@ -1414,10 +1414,10 @@

      Clear away all errors before proceeding.

    6. - - - - + + + + Check that the Samba server is running:

       root#  ps ax | grep mbd
      @@ -1430,10 +1430,10 @@
       14295 ?        S     0:00 /usr/sbin/winbindd -B
       

      The winbindd daemon is running in split mode (normal), so there are also - two instances[7] of it. + two instances[7] of it.

    7. - - + + Check that an anonymous connection can be made to the Samba server:

       root#  smbclient -L localhost -U%
      @@ -1465,9 +1465,9 @@
       			The -U% argument means "send a NULL username and
       			a NULL password."
       			

    8. - - - + + + Verify that each printer has the IP address assigned in the DHCP server configuration file. The easiest way to do this is to ping the printer name. Immediately after the ping response has been received, execute arp -a to find the MAC address of the printer @@ -1482,12 +1482,12 @@ root# arp -a hplj6a (192.168.1.30) at 00:03:47:CB:81:E0 [ether] on eth0

      - + The MAC address 00:03:47:CB:81:E0 matches that specified for the IP address from which the printer has responded and with the entry for it in the /etc/dhcpd.conf file. Repeat this for each printer configured.

    9. - + Make an authenticated connection to the server using the smbclient tool:

       root#  smbclient //diamond/accounts -U gholmes
      @@ -1506,7 +1506,7 @@
       smb: \> q
       

    10. - + Your new server is connected to an Internet accessible connection. Before you start your firewall, you should run a port scanner against your system. You should repeat that after the firewall has been started. This helps you understand what extent the @@ -1580,7 +1580,7 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds

      -

    Application Share Configuration

    +

    Application Share Configuration

    The use of an application server is a key mechanism by which desktop administration overheads can be reduced. Check the application manual for your software to identify how best to create an administrative installation. @@ -1600,7 +1600,7 @@ Install software to run off a central application server with data files stored on a central network share. This type of installation often prevents storage of work files on the local workstation. -

    +

    A common application deployed in this environment is an office suite. Enterprise editions of Microsoft Office XP Professional can be administratively installed by launching the installation from a command shell. The command that achieves this is: @@ -1616,7 +1616,7 @@ or a full local installation. A full local installation takes over 100 MB of disk space. A network workstation (minimum) installation requires typically 10-15 MB of local disk space. In the later case, when the applications are used, they load over the network. -

    +

    Microsoft Office Service Packs can be unpacked to update an administrative share. This makes it possible to update MS Office XP Professional for all users from a single installation of the service pack and generally circumvents the need to run updates on each network @@ -1624,7 +1624,7 @@

    The default location for MS Office XP Professional data files can be set through registry editing or by way of configuration options inside each Office XP Professional application. -

    +

    OpenOffice.Org OpenOffice Version 1.1.0 is capable of being installed locally. It can also be installed to run off a network share. The latter is a most desirable solution for office-bound network users and for administrative staff alike. It permits quick and easy updates @@ -1637,7 +1637,7 @@ prompted on screen for the target installation location. This is the administrative share point. The full administrative OpenOffice share takes approximately 150 MB of disk space. -

    Comments Regarding Software Terms of Use

    +

    Comments Regarding Software Terms of Use

    Many single-user products can be installed into an administrative share, but personal versions of products such as Microsoft Office XP Professional do not permit this. Many people do not like terms of use typical with commercial products, so a few comments @@ -1660,7 +1660,7 @@ under the GNU General Public License is restricted to particular terms and conditions also. Whatever the licensing terms may be, if you do not approve of the terms of use, please do not use the software. -

    +

    Samba is provided under the terms of the GNU GPL Version 2, a copy of which is provided with the source code.

    Windows Client Configuration

    @@ -1673,8 +1673,8 @@

    1. Install MS Windows XP Professional. During installation, configure the client to use DHCP for TCP/IP protocol configuration. - - + + DHCP configures all Windows clients to use the WINS Server address that has been defined for the local subnet.

    2. @@ -1730,7 +1730,7 @@ Repeat the printer installation steps above for both HP LaserJet 6 printers as well as for both QMS Magicolor laser printers.

    -

  • +

  • When you are satisfied that the staging systems are complete, use the appropriate procedure to remove the client from the domain. Reboot the system and then log on as the local administrator and clean out all temporary files stored on the system. Before shutting down, use the disk @@ -1738,7 +1738,7 @@

  • Boot the workstation using the Norton (Symantec) Ghosting diskette (or CD-ROM) and image the machine to a network share on the server. -

  • +

  • You may now replicate the image to the target machines using the appropriate Norton Ghost procedure. Make sure to use the procedure that ensures each machine has a unique Windows security identifier (SID). When the installation of the disk image has completed, boot the PC. @@ -1749,7 +1749,7 @@ user, of course.

  • Instruct all users to log onto the workstation using their assigned user name and password. -

  • Key Points Learned

    +

    Key Points Learned

    How do you feel, Bob? You have built a capable network, a truly ambitious project. Just as well, you have Christine to help you. Future network updates can be handled by your staff. You must be a satisfied manager. Let's review the achievements. @@ -1772,28 +1772,28 @@ You introduced an application server, as well as the concept of cloning a Windows client in order to effect improved standardization of desktops and to reduce the costs of network management. -

    Questions and Answers

    -

    Questions and Answers

    +

    What is the maximum number of account entries that the tdbsam passdb backend can handle? -
    +
    Would Samba operate any better if the OS Level is set to a value higher than 35? -
    +
    Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? -
    +
    Why has a path been specified in the IPC$ share? -
    +
    Why does the smb.conf file in this exercise include an entry for smb portssmb ports? -
    +
    What is the difference between a print queue and a printer? -
    +
    Can all MS Windows application software be installed onto an application server share? -
    +
    Why use dynamic DNS (DDNS)? -
    +
    Why would you use WINS as well as DNS-based name resolution? -
    +
    What are the major benefits of using an application server? -

    +

    What is the maximum number of account entries that the tdbsam passdb backend can handle?

    The tdb data structure and support system can handle more entries than the number of accounts @@ -1815,27 +1815,27 @@ in the tdbsam backend to 250. This is the point at which most networks tend to want backup domain controllers (BDCs). Samba-3 does not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The limitation of 250 users per tdbsam is predicated only on the need for replication - not on the limits[8] of the tdbsam backend itself. -

    + not on the limits[8] of the tdbsam backend itself. +

    Would Samba operate any better if the OS Level is set to a value higher than 35?

    No. MS Windows workstations and servers do not use a value higher than 33. Setting this to a value of 35 already assures Samba of precedence over MS Windows products in browser elections. There is no gain to be had from setting this higher. -

    +

    Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups?

    At this time, Samba has the capacity to use only Domain Groups mappings. It is possible that at a later date Samba may make use of Windows Local Groups, as well as of the Active Directory special Groups. Proper operation requires Domain Groups to be mapped to valid UNIX groups. -

    +

    Why has a path been specified in the IPC$ share?

    This is done so that in the event that a software bug may permit a client connection to the IPC$ share to obtain access to the file system, it does so at a location that presents least risk. Under normal operation this type of paranoid step should not be necessary. The use of this parameter should not be necessary. -

    - Why does the smb.conf file in this exercise include an entry for smb ports? +

    + Why does the smb.conf file in this exercise include an entry for smb ports?

    The default order by which Samba-3 attempts to communicate with MS Windows clients is via port 445 (the TCP port used by Windows clients when NetBIOS-less SMB over TCP/IP is in use). TCP port 139 is the primary port used for NetBIOS @@ -1843,7 +1843,7 @@ specifying the use of port 139 before port 445, the intent is to reduce unsuccessful service connection attempts. The result of this is improved network performance. Where Samba-3 is installed as an Active Directory Domain member, the default behavior is highly beneficial and should not be changed. -

    +

    What is the difference between a print queue and a printer?

    A printer is a physical device that is connected either directly to the network or to a computer @@ -1857,7 +1857,7 @@ print requests. When the data stream has been fully received the input stream is closed, the job is then submitted to a sequential print queue where the job is stored until the printer is ready to receive the job. -

    +

    Can all MS Windows application software be installed onto an application server share?

    Much older Windows software is not compatible with installation to and execution off @@ -1865,13 +1865,13 @@ be installed to an application server. Retail consumer versions of Microsoft Office XP Professional do not permit installation to an application server share and can be installed and used only to/from a local workstation hard disk. -

    +

    Why use dynamic DNS (DDNS)?

    When DDNS records are updated directly from the DHCP server, it is possible for network clients that are not NetBIOS enabled, and thus cannot use WINS, to locate Windows clients via DNS. -

    +

    Why would you use WINS as well as DNS-based name resolution?

    WINS is to NetBIOS names as DNS is to fully qualified domain names (FQDN). The FQDN is @@ -1879,7 +1879,7 @@ means top level domain. A FQDN is a long hand but easy to remember expression that may be up to 1024 characters in length and that represents an IP address. A NetBIOS name is always 16 characters long. The 16th character - is a name type indicator. A specific name type is registered[9] for each + is a name type indicator. A specific name type is registered[9] for each type of service that is provided by the Windows server or client and that may be registered where a WINS server is in use.

    @@ -1894,15 +1894,15 @@ which it has control.

    Windows 200x Active Directory requires the registration in the DNS zone for the domain it - controls of service locator[10] records + controls of service locator[10] records that Windows clients and servers will use to locate Kerberos and LDAP services. ADS also requires the registration of special records that are called global catalog (GC) entries and site entries by which domain controllers and other essential ADS servers may be located. -

    +

    What are the major benefits of using an application server?

    The use of an application server can significantly reduce application update maintenance. By providing a centralized application share, software updates need be applied to only one location for all major applications used. This results in faster update roll-outs and significantly better application usage control. -



    [5] TOSHARGTOSHARG
    [7] TOSHARGsmbdsmbd
    [9] TOSHARG
    +



    [5] TOSHARGTOSHARG
    [7] TOSHARGsmbdsmbd
    [9] TOSHARG
    diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/simple.html samba-3.0.10/docs/htmldocs/Samba-Guide/simple.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/simple.html 2004-11-15 10:15:32.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/simple.html 2004-12-15 10:23:41.000000000 -0600 @@ -1,10 +1,10 @@ -Chapter 2. No Frills Samba Servers

    Chapter 2. No Frills Samba Servers

    +Chapter 2. No Frills Samba Servers

    Chapter 2. No Frills Samba Servers

    Congratulations, you managed to get past the opening chapter. To some, this is where the interesting exercises begin. This is the start of the real journey toward the Samba deployment of a lifetime. -

    Introduction

    +

    Introduction

    This chapter lays the groundwork for understanding the basics of Samba operation. Instead of a bland technical discussion, each principle is demonstrated by way of a - real-world scenario for which a working solution[2] is fully described. + real-world scenario for which a working solution[2] is fully described.

    The practical exercises take you on a journey through a drafting office, a charity administration office, and an accounting office. You may choose to apply any or all of these to your own environment. @@ -14,7 +14,7 @@ find much improved solutions compared with those presented here. By the time you complete this book, you should aim to be a Samba expert, so do attempt to find better solutions and try them as you work your way through the examples. -

    Assignment Tasks

    +

    Assignment Tasks

    Each case presented highlights different aspects of Windows networking for which a simple Samba-based solution can be provided. Each has subtly different requirements taken from real-world cases. Each is briefly reviewed to cover points of highlight. In each example, instructions are based @@ -25,7 +25,7 @@

    • A drafting office

    • A charity administration office

    • An accounting office

    Let's get started. -

    Drafting Office

    +

    Drafting Office

    Our fictitious company is called Abmas Design Inc. This is a three-person computer-aided design (CAD) business that often has more work than can be handled. The business owner hires contract draftspeople from wherever he can. They bring their own @@ -35,13 +35,13 @@ plans that are stored on a central server one day per month. She knows how to upload plans from each machine. The files available from the server must remain read-only. Anyone should be able to access the plans at any time and without barriers or difficulty. -

    +

    Mr. Bob Jordan has asked you to install the new server as economically as possible. The central server has a Pentium-IV 1.6GHz CPU, 768MB RAM, a 20GB IDE boot drive, a 160GB IDE second disk to store plans, and a 100-base-T Ethernet card. You have already installed Red Hat Linux 9.0 and have upgraded Samba to version 3.0.2 using the RPM package that is provided from the Samba FTP sites. -

    +

    The four permanent drafting machines (Microsoft Windows workstations) have attached printers and plotters that are shared on a peer-to-peer basis by any/all network users. The intent is to continue to share printers in this manner. The three permanent staff work together with @@ -50,14 +50,14 @@ area is copied to the central server and the files are removed from the main weekly storage machine. The office works best with this arrangement and does not want to change anything. Old habits are too ingrained. -

    Dissection and Discussion

    +

    Dissection and Discussion

    The requirements for this server installation demand simplicity. An anonymous read-only file server adequately meets all needs. The network consultant determines how to upload all files from the weekly storage area to the server. This installation should focus only on critical aspects of the installation.

    It is not necessary to have specific users on the server. The site has a method for storing - all design files (plans). Each plan is stored in a directory that is named YYYYWW[3], where + all design files (plans). Each plan is stored in a directory that is named YYYYWW[3], where YYYY is the year, and WW is the week of the year. This arrangement allows work to be stored by week of year to preserve the filing technique the site is familiar with. There is another customer directory that is alphabetically listed. At the top level are 26 @@ -67,7 +67,7 @@ plans to be located both by customer name, as well as by the date the work was performed, without demanding the disk space that would be needed if a duplicate file copy were to be stored. The share containing the plans is called Plans. -

    Implementation

    +

    Implementation

    It is assumed that the server is fully installed and ready for installation and configuration of Samba 3.0.2 and any support files needed. All TCP/IP addresses have been hard coded. In our case the IP address of the Samba server is @@ -76,7 +76,7 @@

    Procedure 2.1. Samba Server Configuration

    1. Download the Samba-3 RPM packages for Red Hat Linux 9.0 from the Samba FTP servers. -

    2. +

    3. Install the RPM package as using either the Red Hat Linux preferred GUI tool or using the rpm, as follows:

      @@ -91,7 +91,7 @@
       

      The 755 permissions on this directory (mount point) permit the owner to read, write and execute, and the group and everyone else to read and execute only. -

      +

      Use Red Hat Linux system tools (refer to Red Hat instructions for instructions) to format the 160GB hard drive with a suitable file system. An Ext3 file system is suitable. Configure this drive to automatically mount using the /plans @@ -100,24 +100,24 @@ Install the smb.conf file shown in ??? in the /etc/samba directory. -

      Example 2.1. Drafting Office smb.conf File

      # Global Parameters
      [global]
      +

      Example 2.1. Drafting Office smb.conf File

      # Global Parameters
      [global]
      - workgroup = MIDEARTH
      + workgroup = MIDEARTH
      - security = SHARE
      [Plans]
      + security = SHARE
      [Plans]
      - path = /plans
      + path = /plans
      - read only = Yes
      + read only = Yes
      guest ok = Yes

      -

    4. +

    5. Verify that the /etc/hosts file contains the following entry:

       192.168.1.1	server
       

      -

    6. - +

    7. + Use the standard system tool to start Samba and to configure it to restart automatically at every system reboot. For example:

      @@ -128,23 +128,23 @@
       			Make certain that all clients are set to the same network address range as
       			has been used for the Samba server. For example, one client might have an IP
       			address 192.168.1.10.
      -			

    8. +

    9. Ensure that the netmask used on the Windows clients matches that used for the Samba server. All clients must have the same netmask. For example, 255.255.255.0. -

    10. +

    11. Set the workgroup name on all clients to MIDEARTH.

    12. Verify on each client that the machine called SERVER is visible in the Network Neighborhood, that it is possible to connect to it and see the share Plans, and that it is possible to open that share to reveal its contents. -

    13. Validation

      +

      Validation

      The first priority in validating the new Samba configuration should be to check that Samba answers on the loop-back interface. Then it is time to check that Samba answers its own name correctly. Last, check that a client can connect to the Samba server. -

      1. +

        1. To check the ability to access the smbd daemon services, execute the following:

          @@ -163,7 +163,7 @@
                   ---------          --------
                   MIDEARTH           SERVER 
           

          - + This indicates that Samba is able to respond on the loopback interface to a NULL connection. The -U% means send an empty username and an empty password. This command should be repeated after @@ -177,11 +177,11 @@ The output should be identical to the previous response. Samba has been configured to ignore all usernames given; instead it uses the guest account for all connections. -

        2. +

        3. From the Windows 9x/Me client, launch Windows Explorer, [Desktop: right-click] Network Neighborhood+Explore->[Left Panel] [+] Entire Network->[Left Panel] [+] Server->[Left Panel] [+] Plans. In the right panel you should see the files and directories (folders) that are in the Plans share. -

      Charity Administration Office

      +

      Charity Administration Office

      The fictitious charity organization is called Abmas Vision NL. This is an office that has five networked computers. Staff are all volunteers with frequent staff changes. Ms. Amy May, the director of operations, wants a no-hassle network. Anyone should be able to @@ -192,7 +192,7 @@ SERVER, a share named FTMFILES, and a printer queue named PRINTQ that uses preprinted stationery, thus demanding a dedicated printer. This printer does not need to be mapped to a local printer on the workstations. -

      +

      Printer handling in Samba results in a significant level of confusion. Samba presents to the MS Windows client only a print queue. The Samba smbd process passes a print job sent to it from the Windows client to the native UNIX printing system. The native @@ -205,7 +205,7 @@ This organization has a policy forbidding use of privately owned computers on site as a measure to prevent leakage of confidential information. Only the five PCs owned by Abmas Vision NL are used on this network. -

      +

      The central server was donated by a local computer store. It is a dual processor Pentium-III server, has 1GB RAM, a 3-Ware IDE RAID Controller that has 4 x 200GB IDE hard drives, and a 100-base-T network card. The office has 100-base-T permanent network connections that go to @@ -216,8 +216,8 @@ office and letter printing. Your recommendation to allow only the Linux server to print directly to the printers was accepted. You have supplied SUSE Enterprise Linux Server version 8.0 and have upgraded Samba to version 3.0.2. -

      Dissection and Discussion

      - +

      Dissection and Discussion

      + This installation demands simplicity. Frequent turn-over of volunteer staff would indicate that a network environment that requires users to logon might be problematic. It is suggested that the best solution for this office would be one where the user can log onto any PC with any username @@ -229,9 +229,9 @@ made to write access control lists (Posix type) to any file or directory. This prevents an inadvertent ACL from overriding actual file permissions.

      - - - + + + This organization is a prime candidate for Share Mode security. The force user allows all files to be owned by the same user and group. In addition to this, it would not hurt to set SUID and set SGID shared directories. This means that all new files that are created, no matter @@ -239,15 +239,15 @@ For further information regarding the significance of the SUID/SGID settings, see ???.

      - - + + All client workstations print to a print queue on the server. This ensures that print jobs continue to print in the event that a user may shut down the workstation immediately after sending a job to the printer. Today, both Red Hat Linux and SUSE Linux use CUPS-based printing. Older Linux systems offered a choice to use either the LPRng printing system, or CUPS. It appears, however, that CUPS has now become the leading UNIX printing technology.

      - + The print queues are set up as Raw devices, which means that CUPS will not do intelligent print processing, and vendor supplied drivers be installed locally on the Windows clients. @@ -267,18 +267,18 @@ printer. In this example, therefore, the resource that is referred to as PRINTQ really is just a print queue. The name of the print queue is held to be representative of the device to which the print spooler delivers print jobs. -

      Implementation

      +

      Implementation

      It is assumed that the server is fully installed and ready for configuration of Samba 3.0.2 and for necessary support files. All TCP/IP addresses should be hard coded. In our case, the IP address of the Samba server is 192.168.1.1 and the netmask is 255.255.255.0. The host name of the server used was server. The office network is built as shown in ???. -

      Figure 2.1. Charity Administration Office Network

      Charity Administration Office Network

      Procedure 2.4. Samba Server Configuration

      1. +

        Figure 2.1. Charity Administration Office Network

        Charity Administration Office Network

        Procedure 2.4. Samba Server Configuration

        1. Create a group account for office file storage as follows:

           root#  groupadd office
           

          -

        2. +

        3. Create a user account for office file storage as follows:

           root#  useradd -m abmas 
          @@ -294,7 +294,7 @@
           				drives as a single RAID level 5 drive, with one drive set aside as the hot spare.
           				(Refer to the 3-Ware RAID Controller Manual for the manufacturers' preferred procedure.)
           				The resulting drive has a capacity of approximately 500GB of usable space.
          -				

        4. +

        5. Create a mount point for the file system that can be used to store all data files. Create a directory called /data as follows:

          @@ -342,7 +342,7 @@
           				Install the smb.conf file shown in ??? in the
           				/etc/samba directory.
           				

        6. - + We must ensure that the smbd can resolve the name of the Samba server to its IP address. Verify that the /etc/hosts file contains the following entry: @@ -353,7 +353,7 @@ Configure the printers with the IP address as shown in ???. Follow the instructions in the manufacturers' manual to permit printing to port 9100, so that the CUPS spooler can print using raw mode protocols. -

        7. +

        8. Configure the CUPS Print Queues as follows:

           root#  lpadmin -p PRINTQ -v socket://192.168.1.20:9100 -E
          @@ -361,82 +361,82 @@
           

          This creates the necessary print queues with no assigned print filter.

        9. - + Edit the file /etc/cups/mime.convs to uncomment the line:

           application/octet-stream     application/vnd.cups-raw      0     -
           

          -

        10. +

        11. Edit the file /etc/cups/mime.types to uncomment the line:

           application/octet-stream
           

        12. - + Use the standard system tool to start Samba and CUPS to configure them to restart automatically at every system reboot. For example:

          - - + +

           root#  chkconfig smb on
           root#  chkconfig cups on
           root#  /etc/rc.d/init.d/smb restart
           root#  /etc/rc.d/init.d/cups restart
           

          -

        Example 2.2. Charity Administration Office smb.conf File

        # Global Parameters
        [global]
        +

        Example 2.2. Charity Administration Office smb.conf File

        # Global Parameters
        [global]
        - workgroup = MIDEARTH
        + workgroup = MIDEARTH
        - security = SHARE
        + security = SHARE
        - printing = CUPS
        + printing = CUPS
        - printcap name = CUPS
        + printcap name = CUPS
        - disable spoolss = Yes
        + disable spoolss = Yes
        - show add printer wizard = No
        + show add printer wizard = No
        - wins support = yes
        [FTMFILES]
        + wins support = yes
        [FTMFILES]
        - comment = Funds Tracking & Management Files
        + comment = Funds Tracking & Management Files
        - path = /data/ftmfiles
        + path = /data/ftmfiles
        - read only = No
        + read only = No
        - force user = abmas
        + force user = abmas
        - force group = office
        + force group = office
        - guest ok = Yes
        + guest ok = Yes
        - nt acl support = No
        [office]
        + nt acl support = No
        [office]
        - comment = General Office Files
        + comment = General Office Files
        - path = /data/officefiles
        + path = /data/officefiles
        - read only = No
        + read only = No
        - force user = abmas
        + force user = abmas
        - force group = office
        + force group = office
        - guest ok = Yes
        + guest ok = Yes
        - nt acl support = No
        [printers]
        + nt acl support = No
        [printers]
        - comment = Print Temporary Spool Configuration
        + comment = Print Temporary Spool Configuration
        - path = /var/spool/samba
        + path = /var/spool/samba
        - printable = Yes
        + printable = Yes
        - guest ok = Yes
        + guest ok = Yes
        - use client driver = Yes
        + use client driver = Yes
        browseable = No

        Procedure 2.5. Windows Client Configuration

        1. Configure clients to the network settings shown in ???. @@ -445,23 +445,23 @@ for the Samba server. All clients must have the same netmask. For example, 255.255.255.0.

        2. - + On all Windows clients, set the WINS Server address to 192.168.1.1, the IP address of the server.

        3. Set the workgroup name on all clients to MIDEARTH. -

        4. +

        5. Install the “Client for Microsoft Networks.” Ensure that the only option enabled in its properties is the option “Logon and restore network connections.

        6. Click OK when you are prompted to reboot the system. Reboot the system, then logon using any user name and password you choose. -

        7. +

        8. Verify on each client that the machine called SERVER is visible in My Network Places, that it is possible to connect to it and see the share office, and that it is possible to open that share to reveal its contents. -

        9. +

        10. Disable password caching on all Windows 9x/Me machines using the registry change file shown in ???. Be sure to remove all files that have the PWL extension that are in the C:\WINDOWS @@ -546,7 +546,7 @@ for production use.

        -

        Validation

        +

        Validation

        Use the same validation process as was followed in ???.

        Accounting Office

        The office of Abmas Accounting Inc. is a 40-year-old family-run business. There are nine permanent @@ -564,7 +564,7 @@ in a separate share on the server. Users logon to their Windows workstation with their username and enter an assigned password; they do not need to enter a password when accessing their files on the server. -

        +

        The new server will run Red Hat Linux 9.0. You should install Samba-3.0.2 and copy all files off the old system to the new one. The existing Windows NT4 server has a parallel port HP LaserJet 4 printer that is shared by all. The printer driver is installed on each @@ -574,8 +574,8 @@ You have tried to educate Mr. Meany and found that he has no interest to understand networking. He believes that Windows for Workgroups 3.11 was “the best server Microsoft ever sold ” and that Windows NT and 2000 are “too fang-dangled complex!” -

        Dissection and Discussion

        - +

        Dissection and Discussion

        + The requirements of this network installation are not unusual. The staff are not interested in the details of networking. Passwords are never changed. In this example solution, we demonstrate the use of User Mode security in a simple context. Directories should be set SGID to ensure that members @@ -595,7 +595,7 @@ share name is given in ???. The overall network topology is shown in ???. All machines have been configured as indicated prior to the start of Samba configuration. The following prescriptive steps may now commence. -

        Figure 2.2. Accounting Office Network Topology

        Accounting Office Network Topology

        Table 2.1. Accounting Office Network Information

        UserLogin-IDPasswordShare NameDirectoryWkst
        Alan Meanyalanalm1961alan/dataPC1
        James Meanyjamesjimm1962james/data/jamesPC2
        Jeannie Meanyjeanniejema1965jeannie/data/jeanniePC3
        Suzy Millicentsuzysuzy1967suzy/data/suzyPC4
        Ursula Jenningujenujen1974ursula/data/ursulaPC5
        Peter Panpeterpete1984peter/data/peterPC6
        Dale Rolanddaledale1986dale/data/dalePC7
        Bertrand E Paolettiericeric1993eric/data/ericPC8
        Russell Lewisrussruss2001russell/data/russellPC9

        Procedure 2.9. Migration from Windows NT4 Workstation System to Samba-3

        1. +

          Figure 2.2. Accounting Office Network Topology

          Accounting Office Network Topology

          Table 2.1. Accounting Office Network Information

          UserLogin-IDPasswordShare NameDirectoryWkst
          Alan Meanyalanalm1961alan/dataPC1
          James Meanyjamesjimm1962james/data/jamesPC2
          Jeannie Meanyjeanniejema1965jeannie/data/jeanniePC3
          Suzy Millicentsuzysuzy1967suzy/data/suzyPC4
          Ursula Jenningujenujen1974ursula/data/ursulaPC5
          Peter Panpeterpete1984peter/data/peterPC6
          Dale Rolanddaledale1986dale/data/dalePC7
          Bertrand E Paolettiericeric1993eric/data/ericPC8
          Russell Lewisrussruss2001russell/data/russellPC9

          Procedure 2.9. Migration from Windows NT4 Workstation System to Samba-3

          1. Rename the old server from CASHPOOL to STABLE by logging onto the console as the Administrator. Restart the machine following system prompts. @@ -605,15 +605,15 @@

          2. Install the latest Samba-3 binary Red Hat Linux RPM that is available from the Samba FTP site. -

          3. +

          4. Add a group account for the office to use. Execute the following:

             root#  groupadd accts
             

          5. - Install the smb.conf file shown[4] + Install the smb.conf file shown[4] in ???. -

          6. +

          7. For each user who uses this system (see ???), execute the following:

            @@ -627,7 +627,7 @@
             Retype new SMB password: XXXXXXXXX
             Added user "LoginID"
             

            -

          8. +

          9. Create the directory structure for the file shares by executing the following:

             root#  mkdir -p /data
            @@ -641,30 +641,30 @@
             root#  chmod -R ug+rwxs,o-r+x /data
             

            The data storage structure is now prepared for use. -

          10. +

          11. Configure the CUPS Print Queues as follows:

             root#  lpadmin -p hplj -v parallel:/dev/lp0 -E
             

            This creates the necessary print queues with no assigned print filter.

          12. - + Edit the file /etc/cups/mime.convs to uncomment the line:

             application/octet-stream     application/vnd.cups-raw      0     -
             

            -

          13. +

          14. Edit the file /etc/cups/mime.types to uncomment the line:

             application/octet-stream
             

          15. - + Use the standard system tool to start Samba and CUPS to configure them to restart automatically at every system reboot. For example:

            - - + +

             root#  chkconfig smb on
             root#  chkconfig cups on
            @@ -711,78 +711,78 @@
             			The migration of all data should now be complete. It is time to validate the installation.
             			For this, you should make sure all applications, including printing, work before asking the
             			customer to test drive the new network.
            -			

          Example 2.4. Accounting Office Network smb.conf File

          # Global parameters
          [global]
          +

          Example 2.4. Accounting Office Network smb.conf File

          # Global parameters
          [global]
          - workgroup = BILLMORE
          + workgroup = BILLMORE
          - printing = CUPS
          + printing = CUPS
          - printcap name = CUPS
          + printcap name = CUPS
          - disable spoolss = Yes
          + disable spoolss = Yes
          - show add printer wizard = No
          [files]
          + show add printer wizard = No
          [files]
          - comment = Work area files
          + comment = Work area files
          - path = /data/%U
          + path = /data/%U
          - valid users = %S
          + valid users = %S
          - read only = No
          [master]
          + read only = No
          [master]
          - comment = Master work area files
          + comment = Master work area files
          - path = /data
          + path = /data
          - valid users = alan
          + valid users = alan
          - read only = No
          [printers]
          + read only = No
          [printers]
          - comment = Print Temporary Spool Configuration
          + comment = Print Temporary Spool Configuration
          - path = /var/spool/samba
          + path = /var/spool/samba
          - printable = Yes
          + printable = Yes
          - guest ok = Yes
          + guest ok = Yes
          - use client driver = Yes
          + use client driver = Yes
          - browseable = No

          Questions and Answers

          + browseable = No

        Questions and Answers

        The following questions and answers draw from the examples in this chapter. Many design decisions are impacted by the configurations chosen. The intent is to expose some of the hidden implications. -

        +

        What makes an anonymous Samba server more simple than an non-anonymous Samba server? -
        +
        How is the operation of the parameter force user different from setting the root directory of the share SUID? -
        +
        When would you use both the per share parameter force user as well as setting the share root directory SUID? -
        +
        What is better about CUPS printing than LPRng printing? -
        +
        When should Windows client IP addresses be hard coded? -
        +
        Under what circumstances would it be best to use a DHCP server? -
        +
        What is the purpose of setting the parameter guest ok on a share? -
        +
        When would you set the global parameter disable spoolss? -
        +
        Why would you disable password caching on Windows 9x/Me clients? -
        +
        The example of Abmas Accounting Inc. uses User Mode security. How does this provide anonymous access? -

        +

        What makes an anonymous Samba server more simple than an non-anonymous Samba server?

        In the anonymous server, the only account used is the guest account. In a non-anonymous configuration, it is necessary to add real user accounts to both the UNIX system and to the Samba configuration. Non-anonymous servers require additional administration. -

        +

        How is the operation of the parameter force user different from setting the root directory of the share SUID?

        @@ -796,14 +796,14 @@

        The parameter force user has potential security implications that go beyond the actual share root directory. Be careful and wary of using this parameter. -

        +

        When would you use both the per share parameter force user as well as setting the share root directory SUID?

        You would use both parameters when it is necessary to guarantee that all share handling operations are conducted as the forced user, while all file and directory creation are done as the SUID directory owner. -

        +

        What is better about CUPS printing than LPRng printing?

        CUPS is a print spooling system that has integrated remote management facilities, provides completely @@ -821,7 +821,7 @@

        Which is better is a matter of personal taste. It depends on what you want to do and how you want to do it and manage it. Most modern Linux systems ship with CUPS as the default print management system. -

        +

        When should Windows client IP addresses be hard coded?

        When there are few MS Windows clients, little client change, no mobile users, and users are not @@ -830,7 +830,7 @@ user ability to access network configuration controls, fixed configuration eliminates the need for a DHCP server. This reduces maintenance overheads and eliminates a possible point of network failure. -

        +

        Under what circumstances would it be best to use a DHCP server?

        In network configurations where there are mobile users, or where Windows client PCs move around @@ -846,12 +846,12 @@ Another benefit of modern DHCP servers is the ability of the DHCP server to register dynamically assigned IP addresses with the DNS server. The benefits of Dynamic DNS (DDNS) are considerable in a large Windows network environment. -

        +

        What is the purpose of setting the parameter guest ok on a share?

        If this parameter is yes for a service, then no password is required to connect to the service. Privileges are those of the guest account. -

        +

        When would you set the global parameter disable spoolss?

        Setting this parameter to Yes disables Samba's support for the SPOOLSS set of @@ -874,14 +874,14 @@ the case), the OpenPrinterEx() call fails. The result is that the client now displays an "Access Denied; Unable to connect" message in the printer queue window (even though jobs may be printed successfully). This parameter MUST not be enabled on a print share that has valid print driver installed on the Samba server. -

        +

        Why would you disable password caching on Windows 9x/Me clients?

        Windows 9x/Me workstations that are set at default (password caching enabled) store the username and password in files located in the Windows master directory. Such files can be scavenged (read off a client machine) and decrypted, thus revealing the user's access credentials for all systems the user may have accessed. It is most insecure to allow any Windows 9x/Me client to operate with password caching enabled. -

        +

        The example of Abmas Accounting Inc. uses User Mode security. How does this provide anonymous access?

        The example used does not provide anonymous access. Since the clients are all Windows 2000 Professional, @@ -889,4 +889,4 @@ a remote server using currently logged in user credentials. By ensuring that the user's login ID and password is the same as those set on the Samba server, access is transparent and does not require separate user authentication. -



        [4] smbpasswdpassdb backendsmb.conf
        +



        [4] smbpasswdpassdb backendsmb.conf
        diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/small.html samba-3.0.10/docs/htmldocs/Samba-Guide/small.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/small.html 2004-11-15 10:15:32.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/small.html 2004-12-15 10:23:42.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 3. Small Office Networking

        Chapter 3. Small Office Networking

        +Chapter 3. Small Office Networking

        Chapter 3. Small Office Networking

        So far, this book has focused on the basics of simple yet effective network solutions. Network administrators who take pride in their work (that's most of us, right?) take care to deliver what our users want, @@ -6,7 +6,7 @@ increase costs of network ownership. A professional network manager avoids the temptation to put too much pizazz into the way that the network operates. Some creativity is helpful, but do keep it under control. -

        +

        Five years ago there were two companies from which a lesson can be learned. In one case the network administrator spent three months building a new network to replace an old Netware server. What he delivered had all the @@ -35,7 +35,7 @@ and got it. He often told me, “Always keep a few new tricks up your sleeves for when you need them.” Was he smart? You decide. Let's get on with our next exercise. -

        Introduction

        +

        Introduction

        Abmas Accounting Inc. has grown. Mr. Meany likes you and says he knew you were the right person for the job. That's why he asked you to install the new server. The past few months have been hard work. You advised Mr. Meany @@ -47,8 +47,8 @@ You have found damaged and unusable software on some of the workstations that came with the acquired business and found some machines that are in need of both hardware and software maintenance. -

        Assignment Tasks

        - +

        Assignment Tasks

        + Mr. Meany has decided to retire in 12 months. He wants you to help him make the business run better. Many of the new staff want notebook computers. They visit customer business premises with the need to use local network @@ -80,14 +80,14 @@ Mr. Meany also asked if it would be possible for one of the staff to manage user accounts from the Windows desktop. That person will be responsible for basic operations. -

        Dissection and Discussion

        +

        Dissection and Discussion

        What are the key requirements in this business example? A quick review indicates a need for:

        • Scalability from 52 to over 100 users in 12 months

        • Mobile computing capability - +

        • Improved reliability and usability

        • @@ -96,12 +96,12 @@ In this instance the installed Linux system is assumed to be a Red Hat Linux 9.0 server (as in ???). -

          Technical Issues

          - - - - - +

          Technical Issues

          + + + + + It is time to implement a domain security environment. You will use the smbpasswd (default) backend. You should implement a DHCP server. There is no need to run DNS at this time, but the system will use WINS. The Domain name will be @@ -122,7 +122,7 @@ Later on, when the Internet connection is implemented, you will add DNS as well as other enhancements. It is important that you plan accordingly.

          - + You have split the network into two separate areas. Each has its own ether-switch. There are 20 users on the accounting network and 32 users on the financial services network. The server has two network interfaces, one serving each network. The @@ -137,8 +137,8 @@ Given that DNS will not be used, you will configure WINS name resolution for UNIX hostname name resolution.

          - - + + It is necessary to map Windows Domain Groups to UNIX groups as a minimum. It is advisable to also map Windows Local Groups to UNIX groups. Additionally, the two key staff groups in the firm are Accounting Staff and Financial Services Staff. @@ -153,10 +153,10 @@ Group that has either a space or upper-case characters in it will fail. See TOSHARG, Section 11.3.1, Example 11.1, for more information.

          - + Vendor-supplied printer drivers will be installed on each client. The CUPS print spooler on the UNIX host will be operated in raw mode. -

          Political Issues

          +

          Political Issues

          Mr. Meany is an old-school manager. He sets the rules and wants to see compliance. He is willing to spend money on things he believes are of value. You need more time to convince him of real priorities. @@ -164,29 +164,29 @@ Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be supplied with anti-virus software? Above all, demonstrate good purchase value and remember to make your users happy. -

          Implementation

          +

        Implementation

        In this example, the assumption is made that this server is being configured from a clean start. The alternate approach could be to demonstrate the migration of the system that is documented in ??? to meet the new requirements. The decision to treat this case, as with future examples, as a new installation is based on the premise that you can determine the migration steps from the information provided in the separate chapter on this subject. Additionally, a fresh installation makes the example easier to follow. -

        +

        Each user will be given a home directory on the UNIX system, which will be available as a private share. Two additional shares will be created, one for the Accounting Department and the other for the Financial Services Department. Network users will be given access to these shares by way of group membership.

        - + UNIX group membership is the primary mechanism by which Windows Domain users will be granted rights and privileges within the Windows environment. -

        +

        The user alanm will be made the owner of all files. This will be preserved by setting the sticky bit (set UID/GID) on the top-level directories. -

        Figure 3.1. Abmas Accounting 52 User Network Topology

        Abmas Accounting 52 User Network Topology
        1. +

          Figure 3.1. Abmas Accounting 52 User Network Topology

          Abmas Accounting 52 User Network Topology
          1. Using UNIX/Linux system tools, name the server sleeth.

          2. - + Place an entry for the machine sleeth in the /etc/hosts. The printers are network attached, so it is desirable that there should be entries for the network printers also. An example /etc/hosts file is shown here: @@ -201,7 +201,7 @@ Install the Samba-3 binary RPM from the Samba-Team FTP site.

          3. Install the ISC DHCP server using the UNIX/Linux system tools available to you. -

          4. +

          5. Given that Samba will be operating over two network interfaces and clients on each side may want to be able to reach clients on the other side, it is imperative that IP forwarding shall be enabled. Use the system tool of your choice to enable IP forwarding. In the @@ -215,7 +215,7 @@ Install the smb.conf file as shown in ??? and ???. Combine these two examples to form a single /etc/samba/smb.conf file. -

          6. +

          7. Add the user root to the Samba password backend:

             root#  smbpasswd -a root
            @@ -223,13 +223,13 @@
             Retype new SMB password: XXXXXXX
             root# 
             

            - + This is the Windows Domain Administrator password. Never delete this account from the password backend after Windows Domain Groups have been initialized. If you delete this account, your system is crippled. You cannot restore this account and your Samba server is no longer capable of being administered.

          8. - + Create the username map file to permit the root account to be called Administrator from the Windows network environment. To do this, create the file /etc/samba/smbusers with the following contents: @@ -256,13 +256,13 @@ ####

          9. - + Create and map Windows Domain Groups to UNIX groups. A sample script is provided in ???. Create a file containing this script. We called ours /etc/samba/initGrps.sh. Set this file so it can be executed, and then execute the script. Sample output should be as follows: -

            Example 3.1. Script to Map Windows NT Groups to UNIX Groups

            +

            Example 3.1. Script to Map Windows NT Groups to UNIX Groups

             #!/bin/bash
             #
             # initGrps.sh
            @@ -312,17 +312,17 @@
             Users (S-1-5-32-545) -> -1
             

          10. - - - + + + For each user who needs to be given a Windows Domain account, make an entry in the /etc/passwd file as well as in the Samba password backend. Use the system tool of your choice to create the UNIX system accounts and use the Samba smbpasswd program to create the Domain user accounts.

            - - - + + + There are a number of tools for user management under UNIX. Commonly known ones include: useradd, adduser. In addition to these, there are a plethora of custom tools. With the tool of your choice, create a home directory for each user. @@ -351,36 +351,36 @@ Configure the printers with the IP addresses as shown in ???. Follow the instructions in the manufacturers' manuals to permit printing to port 9100. This allows the CUPS spooler to print using raw mode protocols. - - + +

          11. - + Configure the CUPS Print Queues as follows:

             root#  lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E
             root#  lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E
             root#  lpadmin -p qms -v socket://192.168.2.10:9100 -E
             

            - + This creates the necessary print queues with no assigned print filter.

          12. - - - + + + Edit the file /etc/cups/mime.convs to uncomment the line:

             application/octet-stream     application/vnd.cups-raw      0     -
             

          13. - + Edit the file /etc/cups/mime.types to uncomment the line:

             application/octet-stream
             

            -

          14. +

          15. Using your favorite system editor, create an /etc/dhcpd.conf with the contents as shown in ???. -

            Example 3.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf

            +

            Example 3.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf

             default-lease-time 86400;
             max-lease-time 172800;
             default-lease-time 86400;
            @@ -428,10 +428,10 @@
             		Use the standard system tool to start Samba and CUPS and configure them to start
             		automatically at every system reboot. For example:
             		

            - - - - + + + +

             root#  chkconfig dhpc on
             root#  chkconfig smb on
            @@ -441,11 +441,11 @@
             root#  /etc/rc.d/init.d/cups restart
             

          16. - - - - - + + + + + Configure the Name Service Switch (NSS) to handle WINS based name resolution. Since this system does not use a DNS server, it is safe to remove this option from the NSS configuration. Edit the /etc/nsswitch.conf file so that @@ -453,94 +453,94 @@

             hosts:	files wins
             

            -

          Example 3.3. Accounting Office Network smb.conf File [globals] Section

          # Global parameters
          [global]
          +

          Example 3.3. Accounting Office Network smb.conf File [globals] Section

          # Global parameters
          [global]
          - workgroup = BILLMORE
          + workgroup = BILLMORE
          - passwd chat = *New*Password* \
          %n\n*Re-enter*new*password* %n\n *Password*changed*
          + passwd chat = *New*Password* \
          %n\n*Re-enter*new*password* %n\n *Password*changed*
          - username map = /etc/samba/smbusers
          + username map = /etc/samba/smbusers
          - syslog = 0
          + syslog = 0
          - name resolve order = wins bcast hosts
          + name resolve order = wins bcast hosts
          - printcap name = CUPS
          + printcap name = CUPS
          - show add printer wizard = No
          + show add printer wizard = No
          - add user script = /usr/sbin/useradd -m '%u'
          + add user script = /usr/sbin/useradd -m '%u'
          - delete user script = /usr/sbin/userdel -r '%u'
          + delete user script = /usr/sbin/userdel -r '%u'
          - add group script = /usr/sbin/groupadd '%g'
          + add group script = /usr/sbin/groupadd '%g'
          - delete group script = /usr/sbin/groupdel '%g'
          + delete group script = /usr/sbin/groupdel '%g'
          - add user to group script = /usr/sbin/usermod -G '%g' '%u'
          + add user to group script = /usr/sbin/usermod -G '%g' '%u'
          - add machine script = /usr/sbin/useradd \
          -s /bin/false -d /dev/null '%u'
          + add machine script = /usr/sbin/useradd \
          -s /bin/false -d /dev/null '%u'
          - logon script = scripts\login.bat
          + logon script = scripts\login.bat
          - logon path =
          + logon path =
          - logon drive = X:
          + logon drive = X:
          - domain logons = Yes
          + domain logons = Yes
          - preferred master = Yes
          + preferred master = Yes
          - wins support = Yes
          + wins support = Yes
          - printing = CUPS

          Example 3.4. Accounting Office Network smb.conf File Services and Shares Section

          [homes]
          + printing = CUPS

          Example 3.4. Accounting Office Network smb.conf File Services and Shares Section

          [homes]
          - comment = Home Directories
          + comment = Home Directories
          - valid users = %S
          + valid users = %S
          - read only = No
          + read only = No
          - browseable = No
          [printers]
          + browseable = No
          [printers]
          - comment = SMB Print Spool
          + comment = SMB Print Spool
          - path = /var/spool/samba
          + path = /var/spool/samba
          - printable = Yes
          + printable = Yes
          - guest ok = Yes
          + guest ok = Yes
          - use client driver = Yes
          + use client driver = Yes
          - browseable = No
          [netlogon]
          + browseable = No
          [netlogon]
          - comment = Network Logon Service
          + comment = Network Logon Service
          - path = /data/%U
          + path = /data/%U
          - valid users = %S
          + valid users = %S
          - read only = No
          [accounts]
          + read only = No
          [accounts]
          - comment = Accounting Files
          + comment = Accounting Files
          - path = /data/accounts
          + path = /data/accounts
          - valid users = %G
          + valid users = %G
          - read only = No
          [finsvcs]
          + read only = No
          [finsvcs]
          - comment = Financial Service Files
          + comment = Financial Service Files
          - path = /data/finsvcs
          + path = /data/finsvcs
          - valid users = %G
          + valid users = %G
          - read only = No

          Validation

          + read only = No

          Validation

          Does everything function as it ought? That is the key question at this point. Here are some simple steps to validate your Samba server configuration. -

          1. +

            1. If your smb.conf file has bogus options or parameters, this may cause Samba to refuse to start. The first step should always be to validate the contents of this file by running: @@ -588,7 +588,7 @@

              Clear away all errors before proceeding and start or restart samba as necessary.

            2. - + Check that the Samba server is running:

               root#  ps ax | grep mbd
              @@ -604,7 +604,7 @@
               			two instances of it. For more information regarding winbindd, see TOSHARG, Chapter 20, 
               			Section 20.3. The single instance of smbd is normal.
               			

            3. - + Check that an anonymous connection can be made to the Samba server:

               root#  smbclient -L localhost -U%
              @@ -633,8 +633,8 @@
               			The -U% argument means, send a "NULL username and
               			a NULL password."
               			

            4. - - + + Verify that the printers have the IP addresses assigned in the DHCP server configuration file. The easiest way to do this is to ping the printer name. Immediately after the ping response has been received, execute arp -a to find the MAC address of the printer @@ -653,7 +653,7 @@ IP address from which the printer has responded and with the entry for it in the /etc/dhcpd.conf file.

            5. - + Make an authenticated connection to the server using the smbclient tool:

               root#  smbclient //sleeth/accounts -U alanm
              @@ -673,8 +673,8 @@
               			

          Procedure 3.3. Windows XP Professional Client Configuration

          1. Configure clients to the network settings shown in ???. All clients use DHCP for TCP/IP protocol stack configuration. - - + + DHCP configures all Windows clients to use the WINS Server address 192.168.1.1.

          2. Join the Windows Domain called BILLMORE. Use the Domain Administrator @@ -718,7 +718,7 @@ Repeat the printer installation steps above for the HP LaserJet 6 printer as well as for the QMS Magicolor XXXX laser printer.

          -

        Notebook Computers: A Special Case

        +

        Notebook Computers: A Special Case

        As a network administrator, you already know how to create local machine accounts for Windows 200x/XP Professional systems. This is the preferred solution to provide continuity of work for notebook users so that absence from the office network environment does not become a barrier to productivity. @@ -728,21 +728,21 @@ transparently access network resources as if logged onto the domain itself. There are some trade-offs that mean that as the network is more tightly secured it becomes necessary to modify Windows client configuration somewhat. -

        Key Points Learned

        +

        Key Points Learned

        In this network design and implementation exercise, you have created a Windows NT4 style Domain Controller using Samba-3.0.2. As a result of following these guidelines meant that you experienced and implemented several important aspects of Windows networking. In the next chapter of this book, you build on the experience gained. These are the highlights from this chapter:

        • - + You implemented a DHCP Server and Microsoft Windows clients were able to obtain all necessary network configuration settings from this server.

        • - + You created a Windows Domain Controller. You were able to use the network logon service and successfully joined Windows 200x/XP Professional clients to the Domain.

        • - + You created raw print queues in the CUPS printing system. You maintained a simple printing system so that all users can share centrally managed printers. You installed native printer drivers on the Windows clients. @@ -751,33 +751,33 @@

        • You offered Mobile notebook users a solution that allows them to continue to work while away from the office and not connected to the corporate network. -

        Questions and Answers

        +

        Questions and Answers

        Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that may help. -

        +

        What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? -
        +
        Are there any DHCP server configuration parameters in the /etc/dhcpd.conf that should be noted in particular? -
        +
        Is it possible to create a Windows Domain account that is specifically called Administrator? -
        +
        Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0? -
        +
        One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him root access. How can we do this? -
        +
        Why must I map Windows Domain Groups to UNIX groups? -
        +
        I deleted my root account and now I cannot add it back! What can I do? -
        +
        When I run net groupmap list, it reports a group called Administrators as well as Domain Admins. What is the difference between them? -
        +
        What is the effect of changing the name of a Samba server, or of changing the Domain name? -
        +
        How can I manage user accounts from my Windows XP Professional workstation? -

        +

        What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?

        First and foremost, portability. It means that notebook users can move between @@ -786,7 +786,7 @@ either using DHCP assigned addressing or when using dial-up networking, settings such as default routes and DNS server addresses that apply only to the Abmas office environment do not interfere with remote operations. This is an extremely important feature of DHCP. -

        +

        Are there any DHCP server configuration parameters in the /etc/dhcpd.conf that should be noted in particular?

        @@ -795,14 +795,14 @@ with the WINS server, and then instructs the client to first query the WINS server when a NetBIOS machine name needs to be resolved to an IP Address. This means that this configuration results in far lower UDP broadcast traffic than would be the case if WINS was not used. -

        +

        Is it possible to create a Windows Domain account that is specifically called Administrator?

        You can surely create a Windows Domain Account called Administrator. It is also possible to map that account so that it has the effective UNIX UID of 0. This way it isn't necessary to use the username map facility to map this account to the UNIX account called root. -

        +

        Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0?

        The Windows Domain Administrator account is the most privileged account that @@ -812,7 +812,7 @@ Administrator to manage accounts, as well as permissions, privileges, and security settings within the Domain and on the Samba server, equivalent rights must be assigned. This is achieved with the root UID equal to 0. -

        +

        One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him root access. How can we do this?

        @@ -821,13 +821,13 @@ (or equivalent on wheel on some UNIX systems) that has a GID of 0. This must be the primary GID of the account of the user who is a member of the Windows Domain Admins account. -

        +

        Why must I map Windows Domain Groups to UNIX groups?

        Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are: Domain Guests, Domain Users, Domain Admins. -

        +

        I deleted my root account and now I cannot add it back! What can I do?

        This is a nasty problem. Fortunately, here is a solution. @@ -839,7 +839,7 @@ Use the smbpasswd to add the root account.

      2. Restore the group_mapping.tdb file. -

      3. +

        When I run net groupmap list, it reports a group called Administrators as well as Domain Admins. What is the difference between them?

        @@ -847,7 +847,7 @@ present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This may change at some later date. These accounts are provided only so that security objects are correctly shown. -

        +

        What is the effect of changing the name of a Samba server, or of changing the Domain name?

        In the event that you elect to change the name of the Samba server, on restarting smbd, @@ -859,7 +859,7 @@ SID before the change is made. You can back up the SID from use of the net getlocalsid (Samba-3), or by way of the smbpasswd (Samba-2.2.x). To change the SID, you use the same tool. Be sure to check the man page for this command for detailed instructions regarding the steps involved. -

        +

        How can I manage user accounts from my Windows XP Professional workstation?

        Samba-3 implements a Windows NT4 style security domain architecture. This type of Domain cannot diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-Guide/unixclients.html samba-3.0.10/docs/htmldocs/Samba-Guide/unixclients.html --- samba-3.0.9/docs/htmldocs/Samba-Guide/unixclients.html 2004-11-15 10:15:38.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-Guide/unixclients.html 2004-12-15 10:23:49.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 9. Adding UNIX/LINUX Servers and Clients

        Chapter 9. Adding UNIX/LINUX Servers and Clients

        +Chapter 9. Adding UNIX/LINUX Servers and Clients

        Chapter 9. Adding UNIX/LINUX Servers and Clients

        The most frequently discussed Samba subjects over the past two years have focused around Domain Control and printing. It is well known that Samba is a file and print server. A recent survey conducted by Open Magazine found that of all respondents: 97% use Samba for file and print services, and 68% use Samba for Domain Control. See the @@ -11,17 +11,17 @@ exciting aspects of Samba deployment. This chapter directs your attention to provide important information on the addition of Samba servers into your present Windows network whatever the controlling technology may be. So let's get back to Abmas and our good friends Bob Jordan and company. -

        Introduction

        +

        Introduction

        Bob Jordan looks back over the achievements of the past year or two. Daily events are rather straightforward with not too many distractions or problems. Bob, your team is doing well, but a number of employees are asking for Linux desktop systems. Your network has grown and demands additional Domain Member servers. Let's get on with this; Christine and Stan are ready to go. -

        +

        Stan Soroka is firmly in control of the Department of the Future, while Christine is enjoying a stable and predictable network environment. It is time to add more servers and to add Linux desktops. It is time to meet the demands of future growth and endure trial by fire. Go on, walk the steps with Stan and Company. -

        Assignment Tasks

        +

        Assignment Tasks

        You must now add UNIX/Linux Domain Member servers to your network. You have a friend who has a Windows 2003 Active Directory Domain network who wants to add a Samba/Linux server and has asked Christine to help him out. Your real objective is to help Christine to see more of the way the Microsoft world lives and use @@ -31,7 +31,7 @@ these systems to make sure that Abmas is not building islands of technology. You ask Christine to do likewise at Swodniw Biz NL (your friend's company) to help them to evaluate a Linux desktop. You want to make the right decision, don't you? -

        Dissection and Discussion

        +

        Dissection and Discussion

        Recent Samba mailing list activity is witness to how many sites are using winbind. Some have no trouble at all with it, yet to others the problems seem insurmountable. Periodically there are complaints concerning an inability to achieve identical user and group IDs between Windows and UNIX environments. @@ -39,18 +39,18 @@ You provide step-by-step implementations of the various tools that can be used for identity resolution. You also provide working examples of solutions for integrated authentication for both UNIX/Linux and Windows environments. -

        Technical Issues

        +

        Technical Issues

        One of the great challenges we face when people ask us, “What is the best way to solve this problem?” is to get beyond the facts so we can not only clearly comprehend the immediate technical problem, but also understand how needs may change. -

        +

        There are a few facts we should note when dealing with the question of how best to integrate UNIX/Linux clients and servers into a Windows networking environment: -

        • +

          • A Domain Controller (PDC or BDC) is always authoritative for all accounts in its Domain. This means that a BDC must (of necessity) be able to resolve all account UIDs and GIDs to the same values that the PDC resolved them to. -

          • +

          • A Domain Member can be authoritative for local accounts, but is never authoritative for Domain accounts. If a user is accessing a Domain Member server and that user's account is not known locally, the Domain Member server must resolve the identity of that user @@ -60,24 +60,24 @@ Samba, when running on a Domain Member server, can resolve user identities from a number of sources: -

            • +

              • By executing a system getpwnam() or getgrnam() call. On systems that support it, this utilizes the name service switch (NSS) facility to resolve names according to the configuration of the /etc/nsswitch.conf file. NSS can be configured to use LDAP, winbind, NIS, or local files. -

              • +

              • Performing, via NSS, a direct LDAP search (where an LDAP passdb backend has been configured). This requires the use of the PADL nss_ldap tool (or equivalent). -

              • +

              • Directly by querying winbindd. The winbindd contact a Domain Controller to attempt to resolve the identity of the user or group. It receives the Windows networking security identifier (SID) for that appropriate account and then allocates a local UID or GID from the range of available IDs and creates an entry in its winbindd_idmap.tdb and winbindd_cache.tdb files. -

                +

                If the parameter - idmap backend = ldap:ldap://myserver.domain + idmap backend = ldap:ldap://myserver.domain was specified and the LDAP server has been configured with a container in which it may store the IDMAP entries, all Domain Members may share a common mapping.

              @@ -89,30 +89,30 @@ Which of the above resolver methods is chosen is determined by the way that Samba is configured in the smb.conf file. Some of the configuration options are rather less than obvious to the casual user. -

            • +

            • If you wish to make use of accounts (users and/or groups) that are local to (i.e., capable of being resolved using) the name service switch (NSS) facility, it is imperative to use the - winbind enable local accounts = Yes + winbind enable local accounts = Yes in the smb.conf file. This parameter specifically applies only to Domain Controllers, not to Domain Member servers. -

            +

          For many administrators, it should be plain that the use of an LDAP-based repository for all network accounts (both for Posix accounts as well as for Samba accounts) provides the most elegant and controllable facility. You eventually appreciate the decision to use LDAP. -

          +

          If your network account information resides in an LDAP repository, you should use it ahead of any alternative method. This means that if it is humanly possible to use the nss_ldap tools to resolve UNIX account UIDs/GIDs via LDAP, this is the preferred solution, as it provides a more readily controllable method for asserting the exact same user and group identifiers throughout the network. -

          +

          In the situation where UNIX accounts are held on the Domain Member server itself, the only effective way to use them involves the smb.conf entry - winbind trusted domains only = Yes. This forces + winbind trusted domains only = Yes. This forces Samba (smbd) to perform a getpwnam() system call that can then be controlled via /etc/nsswitch.conf file settings. The use of this parameter disables the use of Samba with Trusted Domains (i.e., External Domains). -

          +

          Winbind can be used to create an appliance mode Domain Member server. In this capacity, winbindd is configured to automatically allocate UIDs/GIDs from numeric ranges set in the smb.conf file. The allocation is made for all accounts that connect to that Domain Member server, whether within its own Domain or from @@ -120,12 +120,12 @@ This means that it is almost certain that a given user who accesses two Domain Member servers does not have the same UID/GID on both servers however, this is transparent to the Windows network user. This data is stored in the winbindd_idmap.tdb and winbindd_cache.tdb files. -

          +

          The use of an LDAP backend for the Winbind IDMAP facility permits Windows Domain security identifiers (SIDs) mappings to UIDs/GIDs to be stored centrally. The result is a consistent mapping across all Domain Member servers so configured. This solves one of the major headaches for network administrators who need to copy files between/across network file servers. -

        Political Issues

        +

        Political Issues

        One of the most fierce conflicts recently being waged is one of resistance to the adoption of LDAP, in particular OpenLDAP, as a replacement for UNIX NIS (previously called Yellow Pages). Let's face it, LDAP is different and requires a new approach to the need for a better identity management solution. The more @@ -136,30 +136,30 @@ heterogenous by design. This is fundamental it isn't religious or political. This also doesn't say that you can't use Windows Active Directory in a heterogenous environment it can be done, it just requires commercial integration products it's just not what Active Directory was designed for. -

        +

        A number of long-term UNIX devotees have recently commented in various communications that the Samba Team is the first application group to almost force network administrators to use LDAP. It should be pointed out that we resisted this as long as we could. It is not out of laziness or out of malice that LDAP has finally emerged as the preferred identity management backend for Samba. We recommend LDAP for your total organizational directory needs. -

        Implementation

        +

        Implementation

        The Domain Member server and the Domain Member client are at the center of focus in this chapter. Configuration of Samba-3 Domain Controller has been covered in earlier chapters, so if your interest is in Domain Controller configuration, you will not find that here. You will find good oil that helps you to add Domain Member servers and clients. -

        +

        In practice, Domain Member servers and Domain Member workstations are very different entities, but in terms of technology they share similar core infrastructure. A technologist would argue that servers and workstations are identical. Many users would argue otherwise, given that in a well-disciplined environment a workstation (client) is a device from which a user creates documents and files that are located on servers. A workstation is frequently viewed as a disposable (easy to replace) item, but a server is viewed as a core component of the business. -

        +

        One can look at this another way. If a workstation breaks down, one user is affected, but if a server breaks down, hundreds of users may not be able to work. The services that a workstation must provide are document and file production oriented; a server provides information storage and is distribution oriented. -

        +

        Why is this important? For starters, we must identify what components of the operating system and its environment must be configured. Also, it is necessary to recognize where the interdependencies between the various services to be used are. @@ -170,7 +170,7 @@

        So, while here we demonstrate how to implement the technology. It is done within a context of what type of service need must be fulfilled. -

        Samba Domain with Samba Domain Member Server Using LDAP

        +

        Samba Domain with Samba Domain Member Server Using LDAP

        In this example, it is assumed that you have Samba PDC/BDC servers. This means you are using an LDAP ldapsam backend. In this example, we are adding to the LDAP backend database (directory) containers for use by the IDMAP facility. This makes it possible to have globally consistent @@ -179,24 +179,24 @@ this operational context) is to permit mapping of foreign SIDs (those not originating from our own Domain). Foreign SIDs can come from any external Domain or from Windows clients that do not belong to a Domain. -

        +

        If your installation is accessed only from clients that are members of your own domain, then it is not necessary to run winbindd as long as all users can be resolved locally via the getpwnam() system call. On NSS-enabled systems, this condition is met by having: -

        • +

          • All accounts in /etc/passwd or in /etc/group. -

          • +

          • Resolution via NSS. On NSS-enabled systems, there is usually a facility to resolve IDs via multiple methods. The methods typically include: files, compat, db, ldap, nis, nisplus, hesoid. When correctly installed, Samba adds to this list the winbindd facility. The ldap facility is frequently the nss_ldap tool provided by PADL Software. -

          +

        The diagram in ??? demonstrates the relationship of samba and system components that are involved in the Identity resolution process where Samba is used as a Domain Member server within a Samba Domain Control network. -

        Figure 9.2. Samba Domain: Samba Member Server

        Samba Domain: Samba Member Server

        +

        Figure 9.2. Samba Domain: Samba Member Server

        Samba Domain: Samba Member Server

        In this example configuration, Samba will directly search the LDAP-based passwd backend ldapsam to obtain authentication and user identity information. The IDMAP information is stored in the LDAP backend so that it can be shared by all Domain Member servers so that every user will have a @@ -210,7 +210,7 @@

        Procedure 9.1. Configuration of LDAP-Based Identity Resolution

        1. Create the smb.conf file as shown in ???. Locate this file in the directory /etc/samba. -

        2. +

        3. Configure the file that will be used by nss_ldap to locate and communicate with the LDAP server. This file is called ldap.conf. If your implementation of nss_ldap is consistent with @@ -227,7 +227,7 @@

        4. Configure the name service switch (NSS) control file so it matches the one shown in ???. -

        5. +

        6. Before proceeding to configure Samba, validate the operation of the NSS Identity resolution via LDAP by executing:

          @@ -262,14 +262,14 @@
           PIOps:x:1002:
           sammy:x:4321:
           

          - + This shows that all is working as it should. Notice that in the LDAP database the users primary and secondary group memberships are identical. It is not necessary to add secondary group memberships (in the group database) if the user is already a member via primary group membership in the password database. When using winbind, it is in fact undesirable to do this as it results in doubling up of group memberships and may break winbind under certain conditions. -

        7. +

        8. The LDAP directory must have a container object for IDMAP data. There are several ways you can check that your LDAP database is able to receive IDMAP information. One of the simplest is to execute: @@ -278,7 +278,7 @@ dn: ou=Idmap,dc=abmas,dc=biz ou: idmap

          - + If the execution of this command does not return IDMAP entries, you need to create an LDIF template file (see ???). You can add the required entries using the following command:

          @@ -286,7 +286,7 @@
           		-w not24get < /etc/openldap/idmap.LDIF
           

          Samba automatically populates this LDAP directory container when it needs to. -

        9. +

        10. The system is ready to join the Domain. Execute the following:

           root#  net rpc join -U root%not24et
          @@ -294,7 +294,7 @@
           

          This indicates that the Domain join succeeded.

        11. - + Just joining the Domain is not quite enough, you must now provide a privilidged set of credentials through which winbindd can interact with the ADS Domain servers. Execute the following to implant the necessary credentials: @@ -305,79 +305,79 @@

        12. You may now start Samba in the usual manner and your Samba Domain Member server is ready for use. Just add shares as required. -

        Example 9.1. Samba Domain Member in Samba Domain Control Context smb.conf File

        # Global parameters
        [global]
        +

        Example 9.1. Samba Domain Member in Samba Domain Control Context smb.conf File

        # Global parameters
        [global]
        - unix charset = LOCALE
        + unix charset = LOCALE
        - workgroup = MEGANET2
        + workgroup = MEGANET2
        - security = DOMAIN
        + security = DOMAIN
        - username map = /etc/samba/smbusers
        + username map = /etc/samba/smbusers
        - log level = 10
        + log level = 10
        - syslog = 0
        + syslog = 0
        - log file = /var/log/samba/%m
        + log file = /var/log/samba/%m
        - max log size = 50
        + max log size = 50
        - smb ports = 139 445
        + smb ports = 139 445
        - name resolve order = wins bcast hosts
        + name resolve order = wins bcast hosts
        - printcap name = CUPS
        + printcap name = CUPS
        - wins server = 192.168.2.1
        + wins server = 192.168.2.1
        - ldap suffix = dc=abmas,dc=biz
        + ldap suffix = dc=abmas,dc=biz
        - ldap machine suffix = ou=People
        + ldap machine suffix = ou=People
        - ldap user suffix = ou=People
        + ldap user suffix = ou=People
        - ldap group suffix = ou=Groups
        + ldap group suffix = ou=Groups
        - ldap idmap suffix = ou=Idmap
        + ldap idmap suffix = ou=Idmap
        - ldap admin dn = cn=Manager,dc=abmas,dc=biz
        + ldap admin dn = cn=Manager,dc=abmas,dc=biz
        - idmap backend = ldap:ldap://lapdc.abmas.biz
        + idmap backend = ldap:ldap://lapdc.abmas.biz
        - idmap uid = 10000-20000
        + idmap uid = 10000-20000
        - idmap gid = 10000-20000
        + idmap gid = 10000-20000
        - winbind trusted domains only = Yes
        + winbind trusted domains only = Yes
        - printer admin = root
        + printer admin = root
        - printing = cups
        [homes]
        + printing = cups
        [homes]
        - comment = Home Directories
        + comment = Home Directories
        - valid users = %S
        + valid users = %S
        - read only = No
        + read only = No
        - browseable = No
        [printers]
        + browseable = No
        [printers]
        - comment = SMB Print Spool
        + comment = SMB Print Spool
        - path = /var/spool/samba
        + path = /var/spool/samba
        - guest ok = Yes
        + guest ok = Yes
        - printable = Yes
        + printable = Yes
        - browseable = No
        [print$]
        + browseable = No
        [print$]
        - comment = Printer Drivers
        + comment = Printer Drivers
        - path = /var/lib/samba/drivers
        + path = /var/lib/samba/drivers
        - admin users = root, Administrator
        + admin users = root, Administrator
        write list = root

        Example 9.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF

         dn: ou=Idmap,dc=abmas,dc=biz
        @@ -424,24 +424,24 @@
         		There are mitigating circumstances forcing a decision not to use LDAP.
         		

      4. The Samba Domain Member server must be part of a Windows NT4 Domain. -

      5. +

        Later in the chapter, you can see how to configure a Samba Domain Member server for a Windows ADS Domain. Right now your objective is to configure a Samba server that can be a member of a Windows NT4 style Domain and/or does not use LDAP. -

        Note

        +

        Note

        If you use winbind for Identity resolution, do make sure that there are no duplicate accounts. -

        +

        For example, do not have more than one account that has UID=0 in the password database. If there is an account called root in the /etc/passwd database, it is okay to have an account called root in the LDAP ldapsam or in the tdbsam. But if there are two accounts in the passdb backend that have the same UID, winbind will break. This means that the Administrator account must be called root. -

        +

        Winbind will break if there is an account in /etc/passwd that has the same UID as an account that is in LDAP ldapsam (or in tdbsam) but that differs in name only. -

        +

        The following configuration uses CIFS/SMB protocols alone to obtain user and group credentials. The winbind information is locally cached in the winbindd_cache.tdb winbindd_idmap.tdb files. This provides considerable performance benefits compared with the LDAP solution, particularly @@ -451,10 +451,10 @@

        Procedure 9.2. Configuration of Winbind-Based Identity Resolution

        1. Using your favorite text editor, create the smb.conf file so it has the contents shown in ???. -

        2. +

        3. Edit the /etc/nsswitch.conf so it has the entries shown in ???. -

        4. +

        5. The system is ready to join the Domain. Execute the following:

           net rpc join -U root%not24et
          @@ -462,7 +462,7 @@
           

          This indicates that the Domain join succeed. -

        6. +

        7. Validate operation of winbind using the wbinfo tool as follows:

          @@ -488,7 +488,7 @@
           MEGANET2+PIOps
           

          This shows that Domain groups have been correctly obtained also. -

        8. +

        9. The next step verifies that NSS is able to obtain this information correctly from winbind also.

          @@ -529,71 +529,71 @@
           

        10. The Samba member server of a Windows NT4 Domain is ready for use. -

        Example 9.5. Samba Domain Member Server smb.conf File for NT4 Domain

        # Global parameters
        [global]
        +

        Example 9.5. Samba Domain Member Server smb.conf File for NT4 Domain

        # Global parameters
        [global]
        - unix charset = LOCALE
        + unix charset = LOCALE
        - workgroup = MEGANET2
        + workgroup = MEGANET2
        - security = DOMAIN
        + security = DOMAIN
        - username map = /etc/samba/smbusers
        + username map = /etc/samba/smbusers
        - log level = 1
        + log level = 1
        - syslog = 0
        + syslog = 0
        - log file = /var/log/samba/%m
        + log file = /var/log/samba/%m
        - max log size = 0
        + max log size = 0
        - smb ports = 139 445
        + smb ports = 139 445
        - name resolve order = wins bcast hosts
        + name resolve order = wins bcast hosts
        - printcap name = CUPS
        + printcap name = CUPS
        - wins server = 192.168.2.1
        + wins server = 192.168.2.1
        - idmap uid = 10000-20000
        + idmap uid = 10000-20000
        - idmap gid = 10000-20000
        + idmap gid = 10000-20000
        - template primary group = "Domain Users"
        + template primary group = "Domain Users"
        - template shell = /bin/bash
        + template shell = /bin/bash
        - winbind separator = +
        + winbind separator = +
        - printer admin = root
        + printer admin = root
        - hosts allow = 192.168.2., 192.168.3., 127.
        + hosts allow = 192.168.2., 192.168.3., 127.
        - printing = cups
        [homes]
        + printing = cups
        [homes]
        - comment = Home Directories
        + comment = Home Directories
        - valid users = %S
        + valid users = %S
        - read only = No
        + read only = No
        - browseable = No
        [printers]
        + browseable = No
        [printers]
        - comment = SMB Print Spool
        + comment = SMB Print Spool
        - path = /var/spool/samba
        + path = /var/spool/samba
        - guest ok = Yes
        + guest ok = Yes
        - printable = Yes
        + printable = Yes
        - browseable = No
        [print$]
        + browseable = No
        [print$]
        - comment = Printer Drivers
        + comment = Printer Drivers
        - path = /var/lib/samba/drivers
        + path = /var/lib/samba/drivers
        - admin users = root, Administrator
        + admin users = root, Administrator
        write list = root

        Example 9.6. Name Service Switch Control File: /etc/nsswitch.conf

         # /etc/nsswitch.conf
        @@ -615,14 +615,14 @@
         bootparams:     files
         automount:      files
         aliases:        files
        -

        Active Directory Domain with Samba Domain Member Server

        +

        Active Directory Domain with Samba Domain Member Server

        One of the much-sought-after features new to Samba-3 is the ability to join an Active Directory Domain using Kerberos protocols. This makes it possible to operate an entire Windows network without the need to run NetBIOS over TCP/IP and permits more secure networking in general. An exhaustively complete discussion of the protocols is not possible in this book; perhaps a later book may explore the intricacies of the NetBIOS-less operation that Samba-3 can participate in. For now, we simply focus on how a Samba-3 server can be made a Domain Member server. -

        +

        The diagram in ??? demonstrates how Samba-3 interfaces with Microsoft Active Directory components. It should be noted that if Microsoft Windows Services for UNIX has been installed and correctly configured, it is possible to use client LDAP @@ -646,7 +646,7 @@ name of the server is W2K3S. In ADS realm terms, the Domain Controller is known as w2k3s.london.abmas.biz. In NetBIOS nomenclature, the Domain Name is LONDON and the server name is W2K3S. -

        Figure 9.3. Active Directory Domain: Samba Member Server

        Active Directory Domain: Samba Member Server
        1. +

          Figure 9.3. Active Directory Domain: Samba Member Server

          Active Directory Domain: Samba Member Server
          1. Before you try to use Samba-3, you want to know for certain that your executables have support for Kerberos and for LDAP. Execute the following to identify whether or not this build is perhaps suitable for use: @@ -712,7 +712,7 @@

            This does look promising; smbd has been built with Kerberos and LDAP support. You are relieved to know that it is safe to progress. -

          2. +

          3. The next step is to identify which version of the Kerberos libraries have been used. In order to permit Samba-3 to interoperate with Windows 2003 Active Directory, it is essential that it has been linked with either MIT Kerberos version 1.3.1 or later, @@ -740,7 +740,7 @@ in ???.

          4. Edit or create the NSS control file so it has the contents shown in ???. -

          5. +

          6. Delete the file /etc/samba/secrets.tdb, if it exists. Of course, you do keep a backup, don't you?

          7. @@ -750,7 +750,7 @@

             root#  rm /var/lib/samba/*tdb
             

            -

          8. +

          9. Validate your smb.conf file using testparm (as you have done previously). Correct all errors reported before proceeding. The command you execute is: @@ -759,7 +759,7 @@

            Now that you are satisfied that your Samba server is ready to join the Windows ADS Domain, let's move on. -

          10. +

          11. This is a good time to double-check everything and then execute the following command when everything you have done has checked out okay:

            @@ -769,14 +769,14 @@
             

            You have successfully made your Samba-3 server a member of the ADS Domain using Kerberos protocols. -

            +

            In the event that you receive no output messages, a silent return means that the Domain join failed. You should use ethereal to identify what may be failing. Common causes of a failed join include: -

            • +

              • Defective or misconfigured DNS name resolution. -

              • +

              • Restrictive security settings on the Windows 200x ADS Domain controller preventing needed communications protocols. You can check this by searching the Windows Server 200x Event Viewer. @@ -787,12 +787,12 @@ Kerberos (or Heimdal) in use is not up to date enough to support the necessary functionality.

              - + In any case, never execute the net rpc join command in an attempt to join the Samba server to the Domain, unless you wish not to use the Kerberos security protocols. Use of the older RPC-based Domain join facility requires that Windows Server 200x ADS has been configured appropriately for mixed mode operation. -

            • +

            • If the tdbdump is installed on your system (not essential), you can look inside the /etc/samba/secrets.tdb file. If you wish to do this, execute: @@ -822,7 +822,7 @@

            • It is now time to start Samba in the usual way (as has been done many time before in this book). -

            • +

            • This is a good time to verify that everything is working. First, check that winbind is able to obtain the list of users and groups from the ADS Domain Controller. Execute the following: @@ -848,7 +848,7 @@ LONDON+DnsUpdateProxy

              Excellent. That worked also, as expected. -

            • +

            • Now repeat this via NSS to validate that full Identity resolution is functional as required. Execute:

              @@ -880,7 +880,7 @@
               LONDON+DnsUpdateProxy:x:10008:
               

              This is very pleasing. Everything works as expected. -

            • +

            • You may now perform final verification that communications between Samba-3 winbind and the Active Directory server is using Kerberos protocols. Execute the following:

              @@ -897,7 +897,7 @@
               		It should be noted that Kerberos protocols are time-clock critical. You should
               		keep all server time clocks synchronized using the network time protocol (NTP).
               		In any case, the output we obtained confirms that all systems are operational.
              -		

            • +

            • There is one more action you elect to take, just because you are paranoid and disbelieving, so you execute the following command:

              @@ -1067,75 +1067,75 @@
               

              Now all is revealed. Your curiosity, as well as that of those with you, has been put at ease. May this server serve well all who happen upon it. -

              Example 9.7. Samba Domain Member smb.conf File for Active Directory Membership

              # Global parameters
              [global]
              +

              Example 9.7. Samba Domain Member smb.conf File for Active Directory Membership

              # Global parameters
              [global]
              - unix charset = LOCALE
              + unix charset = LOCALE
              - workgroup = LONDON
              + workgroup = LONDON
              - realm = LONDON.ABMAS.BIZ
              + realm = LONDON.ABMAS.BIZ
              - server string = Samba 3.0.2
              + server string = Samba 3.0.2
              - security = ADS
              + security = ADS
              - username map = /etc/samba/smbusers
              + username map = /etc/samba/smbusers
              - log level = 1
              + log level = 1
              - syslog = 0
              + syslog = 0
              - log file = /var/log/samba/%m
              + log file = /var/log/samba/%m
              - max log size = 50
              + max log size = 50
              - printcap name = CUPS
              + printcap name = CUPS
              - ldap ssl = no
              + ldap ssl = no
              - idmap uid = 10000-20000
              + idmap uid = 10000-20000
              - idmap gid = 10000-20000
              + idmap gid = 10000-20000
              - template primary group = "Domain Users"
              + template primary group = "Domain Users"
              - template shell = /bin/bash
              + template shell = /bin/bash
              - winbind separator = +
              + winbind separator = +
              - printing = cups
              [homes]
              + printing = cups
              [homes]
              - comment = Home Directories
              + comment = Home Directories
              - valid users = %S
              + valid users = %S
              - read only = No
              + read only = No
              - browseable = No
              [printers]
              + browseable = No
              [printers]
              - comment = SMB Print Spool
              + comment = SMB Print Spool
              - path = /var/spool/samba
              + path = /var/spool/samba
              - guest ok = Yes
              + guest ok = Yes
              - printable = Yes
              + printable = Yes
              - browseable = No
              [print$]
              + browseable = No
              [print$]
              - comment = Printer Drivers
              + comment = Printer Drivers
              - path = /var/lib/samba/drivers
              + path = /var/lib/samba/drivers
              - admin users = root, Administrator
              + admin users = root, Administrator
              - write list = root

              UNIX/Linux Client Domain Member

              + write list = root

            UNIX/Linux Client Domain Member

            So far this chapter has been mainly concerned with the provision of file and print services for Domain Member servers. However, an increasing number of UNIX/Linux workstations are being installed that do not act as file or print servers to anyone other than a single desktop user. The key demand for desktop systems is to be able to log onto any UNIX/Linux or Windows desktop using the same network user credentials. -

            +

            The ability to use a common set of user credential across a variety of network systems is generally regarded as a Single Sign-On (SOS) solution. SOS systems are sold by a large number of vendors and include a range of technologies such as: @@ -1147,7 +1147,7 @@ Meta-directory server solutions

          12. Replacement authentication systems -

          +

        There are really only three solutions that provide integrated authentication and user Identity management facilities:

        • @@ -1165,19 +1165,19 @@ systems logons (SSO) providing user and group accounts are stored in an LDAP directory. This provides logon services for UNIX/Linux users, while Windows users obtain their sign-on support via Samba-3. -

          +

          On the other hand, if the authentication and Identity resolution backend must be provided by a Windows NT4 style Domain or from an Active Directory Domain that does not have the Microsoft Windows Services for UNIX (SUS) installed, winbind is your best friend. Specific guidance for these situations now follows. -

          +

          To permit users to log onto a Linux system using Windows network credentials, you need to configure Identity resolution (NSS) and PAM. This means that the basic steps include those outlined above with the addition of PAM configuration. Given that most workstations (desktop/client) usually do not need to provide file and print services to a group of users, the configuration of shares and printers is generally less important. Often this allows the share specifications to be entirely removed from the smb.conf file. That is obviously an administrator decision. -

          NT4 Domain Member

          +

          NT4 Domain Member

          The following steps provide a Linux system that users can log onto using Windows NT4 Domain (or Samba-3) Domain network credentials:

          1. @@ -1205,7 +1205,7 @@

          2. Edit only one file at a time. Carefully validate its operation before attempting to reboot the machine. -

          ADS Domain Member

          +

        ADS Domain Member

        This procedure should be followed to permit a Linux network client (workstation/desktop) to permit users to log on using Microsoft Active Directory based user credentials.

        1. @@ -1285,7 +1285,7 @@ session required /lib/security/$ISA/pam_limits.so session sufficient /lib/security/$ISA/pam_unix.so session sufficient /lib/security/$ISA/pam_winbind.so use_first_pass -

        Key Points Learned

        +

        Key Points Learned

        The addition of UNIX/Linux Samba servers and clients is a common requirement. In this chapter, you learned how to integrate such servers so that the UID/GID mappings they use can be consistent across all Domain Member servers. You also discovered how to implement the ability to use Samba @@ -1305,51 +1305,51 @@

      6. On NSS/PAM enabled UNIX/Linux systems, NSS is responsible for Identity management and PAM is responsible for authentication of logon credentials (user name and password). -

      7. Questions and Answers

        +

        Questions and Answers

        The following questions were obtained from the mailing list and also from private discussions with Windows network administrators. -

        +

        We use NIS for all UNIX accounts. Why do we need winbind? -
        +
        Our IT management people do not like LDAP, but are looking at Microsoft Active Directory. Which is better?Active Directory -
        +
        We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible to use NIS in place of LDAP? -
        +
        Are you suggesting that users should not log onto a Domain Member server? If so, why? -
        winbind enable local accounts/etc/passwdoptions listACLshare +
        winbind enable local accounts/etc/passwdoptions listACLshare In my smb.conf file, I enabled the parameter winbind enable local accounts on all Domain Member servers, but it does not work. The accounts I put in /etc/passwd do not show up in the options list when I try to set an ACL on a share. What have I done wrong? -
        trusted domainsdomaintrustedwinbind trusted domains onlydomain members +
        trusted domainsdomaintrustedwinbind trusted domains onlydomain members We want to ensure that only users from our own domain plus from trusted domains can use our Samba servers. In the smb.conf file on all servers, we have enabled the winbind trusted domains only parameter. We now find that users from trusted domains cannot access our servers, and users from Windows clients that are not domain members can also access our servers. Is this a Samba bug? -
        +
        What are the benefits of using LDAP for my Domain Member servers? -
        +
        Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into my DNS configuration? -
        +
        Our Windows 2003 Server Active Directory Domain runs with NetBIOS disabled. Can we use Samba-3 with that configuration? -
        netadsjoinnetrpcjoin +
        netadsjoinnetrpcjoin When I tried to execute net ads join, I got no output. It did not work, so I think that it failed. I then executed net rpc join and that worked fine. That is okay, isn't it? -

        +

        We use NIS for all UNIX accounts. Why do we need winbind? -

        +

        You can use NIS for your UNIX accounts. NIS does not store the Windows encrypted passwords that need to be stored in one of the acceptable passdb backends. Your choice of backend is limited to smbpasswd or tdbsam. Winbind is needed to handle the resolution of SIDs from trusted domains to local UID/GID values. -

        +

        On a Domain Member server, you effectively map Windows Domain users to local users that are in your NIS database by specifying the winbind trusted domains only. This causes user and group account lookups to be routed via @@ -1357,17 +1357,17 @@ this pushes the resolution of users and groups out through NIS.

        As a general rule, it is always a good idea to run winbind on all Samba servers. -

        +

        Our IT management people do not like LDAP, but are looking at Microsoft Active Directory. - Which is better? -

        + Which is better? +

        Microsoft Active Directory is an LDAP server that is intricately tied to a Kerberos infrastructure. Most IT managers who object to LDAP do so because of the fact that an LDAP server is most often supplied as a raw tool that needs to be configured, and for which the administrator must create the schema, create the administration tools and devise the backup and recovery facilities in a site dependent manner. LDAP servers in general are seen as a high-energy, high-risk facility. -

        +

        Microsoft Active Directory by comparison is easy to install, configure, and is supplied with all tools necessary to implement and manage the directory. For sites that lack a lot of technical competence, Active Directory is a good choice. For sites @@ -1376,28 +1376,28 @@ the site want? If management wants a choice to use an alternative, they may want to consider the options. On the other hand, if management just wants a solution that works, Microsoft Active Directory is a good solution. -

        +

        We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible to use NIS in place of LDAP? -

        +

        Yes, it is possible to use NIS in place of LDAP, but there may be problems with keeping the Windows (SMB) encrypted passwords database correctly synchronized across the entire network. Workstations (Windows client machines) periodically change their Domain Membership secure account password. How can you keep changes that are on remote BDCs synchronized on the PDC? -

        +

        LDAP is a more elegant solution because it permits centralized storage and management of all network Identities (user, group and machine accounts) together with all information Samba needs to provide to network clients and their users. -

        +

        Are you suggesting that users should not log onto a Domain Member server? If so, why? -

        +

        Many UNIX administrators mock the model that the Personal Computer industry has adopted as normative since the early days of Novell Netware. One may well argue that the old perception of the necessity to keep users off file and print servers was a result of fears concerning the security and integrity of data. It was a simple and generally effective measure to keep users away from servers, except through mapped drives. -

        +

        UNIX administrators are fully correct in asserting that UNIX servers and workstations are identical in terms of the software that is installed. They correctly assert that in a well secured environment it is safe to store files on a system that has hundreds @@ -1406,16 +1406,16 @@ server. One must take account of the risk to operations through simple user errors. Only then can one begin to appraise the best strategy and adopt a site-specific policy that best protects the needs of users and of the organization alike. -

        +

        From experience, it is my recommendation to keep general system level logins to a practical minimum and to eliminate them if possible. This should not be taken as a hard rule, though. The better question is, what works best for the site? -

        +

        In my smb.conf file, I enabled the parameter winbind enable local accounts on all Domain Member servers, but it does not work. The accounts I put in /etc/passwd do not show up in the options list when I try to set an ACL on a share. What have I done wrong? -

        +

        The manual page for this smb.conf file parameter clearly says, “This parameter controls whether or not winbindd will act as a stand in replacement for the various account management hooks in smb.conf (for example, add user script). If enabled, winbindd @@ -1423,18 +1423,18 @@ information available via getpwnam() or getgrgid(), etc...” By default this parameter is already enabled; therefore, the action you are seeing is a result of a failure of Identity resolution in the Domain. -

        +

        These are the accounts that are available for Windows network Domain logons. Providing Identity resolution has been correctly configured on the Domain Controllers, as well as on Domain Member servers. The Domain user and group identities automatically map to a valid local UID and GID pair. -

        +

        We want to ensure that only users from our own domain plus from trusted domains can use our Samba servers. In the smb.conf file on all servers, we have enabled the winbind trusted domains only parameter. We now find that users from trusted domains cannot access our servers, and users from Windows clients that are not domain members can also access our servers. Is this a Samba bug? -

        +

        The manual page for this winbind trusted domains only parameter says, “This parameter is designed to allow Samba servers that are members of a Samba controlled domain to use UNIX accounts distributed vi NIS, rsync, or LDAP as the UIDs for winbindd users @@ -1442,7 +1442,7 @@ mapped to the account user1 in /etc/passwd instead of allocating a new UID for him or her.” This would clearly suggest that you are trying to use this parameter inappropriately. -

        +

        A far better solution would be to use the valid users by specifying precisely the Domain users and groups that should be permitted access to the shares. You could, for example, set the following parameters: @@ -1451,24 +1451,24 @@ path = /export/demodata valid users = @"Domain Users", @"OTHERDOMAIN\Domain Users"

        -

        +

        What are the benefits of using LDAP for my Domain Member servers? -

        +

        The key benefit of using LDAP is that the UID of all users and the GID of all groups are globally consistent on Domain Controllers as well as on Domain Member servers. This means that it is possible to copy/replicate files across servers without loss of identity. -

        +

        When use is made of account Identity resolution via winbind, even when an IDMAP backend is stored in LDAP, the UID/GID on Domain Member servers is consistent, but differs from the ID that the user/group has on Domain Controllers. The winbind allocated UID/GID that is stored in LDAP (or locally) will be in the numeric range specified in the idmap uid/gid in the smb.conf file. On Domain Controllers, the UID/GID is that of the Posix value assigned in the LDAP directory as part of the Posix account information. -

        +

        Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into my DNS configuration? -

        +

        Samba depends on correctly functioning resolution of host names to their IP address. Samba makes no direct DNS lookup calls, but rather redirects all name to address calls via the getXXXbyXXX() function calls. The configuration of the hosts @@ -1481,23 +1481,23 @@ This means that a host name lookup first tries the /etc/hosts. If this fails to resolve, it attempts a DNS lookup and if that fails, it tries a WINS lookup. -

        +

        The addition of the WINS-based name lookup makes sense only if NetBIOS over TCP/IP has been enabled on all Windows clients. Where NetBIOS over TCP/IP has been disabled, DNS is the preferred name resolution technology. This usually makes most sense when Samba is a client of an Active Directory Domain, where NetBIOS use has been disabled. In this case, the Windows 200x auto-registers all locator records it needs with its own DNS server/s. -

        +

        Our Windows 2003 Server Active Directory Domain runs with NetBIOS disabled. Can we use Samba-3 with that configuration?

        Yes. -

        +

        When I tried to execute “net ads join”, I got no output. It did not work, so I think that it failed. I then executed “net rpc join” and that worked fine. That is okay, isn't it? -

        +

        No. This is not okay. It means that your Samba-3 client has joined the ADS Domain as a Windows NT4 client, and Samba-3 will not be using Kerberos-based authentication.

        diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/AccessControls.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/AccessControls.html --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/AccessControls.html 2004-11-15 10:16:42.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/AccessControls.html 2004-12-15 10:24:51.000000000 -0600 @@ -1,5 +1,5 @@ -Chapter 13. File, Directory and Share Access Controls

        Chapter 13. File, Directory and Share Access Controls

        John H. Terpstra

        Samba Team

        Jeremy Allison

        Samba Team

        Jelmer R. Vernooij

        drawing
        The Samba Team

        May 10, 2003

        - +Chapter 13. File, Directory and Share Access Controls

        Chapter 13. File, Directory and Share Access Controls

        John H. Terpstra

        Samba Team

        Jeremy Allison

        Samba Team

        Jelmer R. Vernooij

        drawing
        The Samba Team

        May 10, 2003

        + Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network administrators are often confused regarding network access controls and how to @@ -13,8 +13,8 @@ between the two environments. This difference is one that Samba cannot completely hide, even though it does try to bridge the chasm to a degree.

        - - + + POSIX Access Control List technology has been available (along with Extended Attributes) for UNIX for many years, yet there is little evidence today of any significant use. This @@ -31,11 +31,11 @@ UNIX/Linux into a platform like MS Windows. Instead the purpose was and is to provide a sufficient level of exchange of data between the two environments. What is available today extends well beyond early plans and expectations, yet the gap continues to shrink. -

        Features and Benefits

        +

        Features and Benefits

        Samba offers a lot of flexibility in file system access management. These are the key access control facilities present in Samba today:

        Samba Access Control Facilities

        • - + UNIX File and Directory Permissions

          Samba honors and implements UNIX file system access controls. Users @@ -56,7 +56,7 @@ The basic options and techniques are described herein.

        • Samba Share ACLs - +

          Just like it is possible in MS Windows NT to set ACLs on shares themselves, so it is possible to do this in Samba. @@ -64,8 +64,8 @@ easiest ways to affect access controls (restrictions) and can often do so with minimum invasiveness compared with other methods.

        • - - + + MS Windows ACLs through UNIX POSIX ACLs

          The use of POSIX ACLs on UNIX/Linux is possible only if the underlying @@ -75,16 +75,16 @@ this. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information for users of platforms that support them. -

        File System Access Controls

        +

        File System Access Controls

        Perhaps the most important recognition to be made is the simple fact that MS Windows NT4/200x/XP implement a totally divergent file system technology from what is provided in the UNIX operating system environment. First we consider what the most significant differences are, then we look at how Samba helps to bridge the differences. -

        MS Windows NTFS Comparison with UNIX File Systems

        - - - - +

        MS Windows NTFS Comparison with UNIX File Systems

        + + + + Samba operates on top of the UNIX file system. This means it is subject to UNIX file system conventions and permissions. It also means that if the MS Windows networking environment requires file system @@ -96,7 +96,7 @@ but for the greater part we will stay within the bounds of default behavior. Those wishing to explore the depths of control ability should review the smb.conf man page.

        The following compares file system features for UNIX with those of Microsoft Windows NT/200x: - +

        Name Space

        MS Windows NT4/200x/XP files names may be up to 254 characters long, and UNIX file names @@ -105,8 +105,8 @@

        What MS Windows calls a folder, UNIX calls a directory.

        Case Sensitivity

        - - + + MS Windows file names are generally upper case if made up of 8.3 (8 character file name and 3 character extension. File names that are longer than 8.3 are case preserving and case insensitive. @@ -130,26 +130,26 @@ accessible to MS Windows users, the others are invisible and unaccessible any other solution would be suicidal.

        Directory Separators

        - + MS Windows and DOS uses the backslash \ as a directory delimiter, and UNIX uses the forward-slash / as its directory delimiter. This is handled transparently by Samba.

        Drive Identification

        - + MS Windows products support a notion of drive letters, like C: to represent disk partitions. UNIX has no concept of separate identifiers for file partitions, each such file system is mounted to become part of the overall directory tree. The UNIX directory tree begins at / just like the root of a DOS drive is specified as C:\.

        File Naming Conventions

        - + MS Windows generally never experiences file names that begin with a dot (.) while in UNIX these are commonly found in a user's home directory. Files that begin with a dot (.) are typically either start-up files for various UNIX applications, or they may be files that contain start-up configuration data.

        Links and Short-Cuts

        - - - + + + MS Windows make use of “links and short-cuts” that are actually special types of files that will redirect an attempt to execute the file to the real location of the file. UNIX knows of file and directory links, but they are entirely different from what MS Windows users are used to. @@ -162,11 +162,11 @@ There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort in the process of becoming familiar with UNIX/Linux. These are best left for a text that is dedicated to the purpose of UNIX/Linux training and education. -

        Managing Directories

        +

        Managing Directories

        There are three basic operations for managing directories: create, delete, rename. -

        Table 13.1. Managing Directories with UNIX and Windows

        ActionMS Windows CommandUNIX Command
        createmd foldermkdir folder
        deleterd folderrmdir folder
        renamerename oldname newnamemv oldname newname

        -

        File and Directory Access Control

        - +

        Table 13.1. Managing Directories with UNIX and Windows

        ActionMS Windows CommandUNIX Command
        createmd foldermkdir folder
        deleterd folderrmdir folder
        renamerename oldname newnamemv oldname newname

        +

        File and Directory Access Control

        + The network administrator is strongly advised to read foundational training manuals and reference materials regarding file and directory permissions maintenance. Much can be achieved with the basic UNIX permissions without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended @@ -198,7 +198,7 @@

        Figure 13.1. Overview of UNIX permissions field.

        Overview of UNIX permissions field.

        Any bit flag may be unset. An unset bit flag is the equivalent of “cannot” and is represented as a “-” character. -

        Example 13.1. Example File

        +	

        Example 13.1. Example File

         		-rwxr-x---   Means: The owner (user) can read, write, execute
         		                    the group can read and execute
         		                    everyone else cannot do anything with it.
        @@ -224,17 +224,17 @@
         	the (r) read flags are not set, files cannot be listed (seen) in the directory by anyone. The group can read files in the
         	directory but cannot create new files. If files in the directory are set to be readable and writable for the group, then
         	group members will be able to write to (or delete) them.
        -	

        Share Definition Access Controls

        - +

        Share Definition Access Controls

        + The following parameters in the smb.conf file sections define a share control or effect access controls. Before using any of the following options, please refer to the man page for smb.conf. -

        User and Group-Based Controls

        +

        User and Group-Based Controls

        User and group-based controls can prove quite useful. In some situations it is distinctly desirable to affect all - file system operations as if a single user were doing so. The use of the force user and - force group behavior will achieve this. In other situations it may be necessary to effect a + file system operations as if a single user were doing so. The use of the force user and + force group behavior will achieve this. In other situations it may be necessary to effect a paranoia level of control to ensure that only particular authorized persons will be able to access a share or - its contents. Here the use of the valid users or the - invalid users may be most useful. + its contents. Here the use of the valid users or the + invalid users may be most useful.

        As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for controlling access. Remember, when you leave the scene someone else will need to provide assistance and @@ -242,34 +242,34 @@ Samba being removed and an alternative solution being adopted.

        Following table enumerates these controls. -

        Table 13.2. User and Group Based Controls

        Control ParameterDescription - Action - Notes
        admin users

        +

        Table 13.2. User and Group Based Controls

        Control ParameterDescription - Action - Notes
        admin users

        List of users who will be granted administrative privileges on the share. They will do all file operations as the super-user (root). Any user in this list will be able to do anything they like on the share, irrespective of file permissions. -

        force group

        +

        force group

        Specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service. -

        force user

        +

        force user

        Specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. This is useful for sharing files. Incorrect use can cause security problems. -

        guest ok

        +

        guest ok

        If this parameter is set for a service, then no password is required to connect to the service. Privileges will be those of the guest account. -

        invalid users

        +

        invalid users

        List of users that should not be allowed to login to this service. -

        only user

        +

        only user

        Controls whether connections with usernames not in the user list will be allowed. -

        read list

        +

        read list

        List of users that are given read-only access to a service. Users in this list will not be given write access, no matter what the read only option is set to. -

        username

        +

        username

        Refer to the smb.conf man page for more information -- this is a complex and potentially misused parameter. -

        valid users

        +

        valid users

        List of users that should be allowed to login to this service. -

        write list

        +

        write list

        List of users that are given read-write access to a service. -

        File and Directory Permissions-Based Controls

        +

        File and Directory Permissions-Based Controls

        The following file and directory permission-based controls, if misused, can result in considerable difficulty to diagnose causes of misconfiguration. Use them sparingly and carefully. By gradually introducing each one by one, undesirable side effects may be detected. In the event of a problem, always comment all of them out and then gradually @@ -277,55 +277,55 @@

        Refer to the following table for information regarding the parameters that may be used to affect file and directory permission-based access controls. -

        Table 13.3. File and Directory Permission Based Controls

        Control ParameterDescription - Action - Notes
        create mask

        +

        Table 13.3. File and Directory Permission Based Controls

        Control ParameterDescription - Action - Notes
        create mask

        Refer to the smb.conf man page. -

        directory mask

        +

        directory mask

        The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. See also: directory security mask. -

        dos filemode

        +

        dos filemode

        Enabling this parameter allows a user who has write access to the file to modify the permissions on it. -

        force create mode

        +

        force create mode

        This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba. -

        force directory mode

        +

        force directory mode

        This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba. -

        force directory security mode

        +

        force directory security mode

        Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory. -

        force security mode

        +

        force security mode

        Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. -

        hide unreadable

        +

        hide unreadable

        Prevents clients from seeing the existence of files that cannot be read. -

        hide unwriteable files

        +

        hide unwriteable files

        Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. -

        nt acl support

        +

        nt acl support

        This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. -

        security mask

        +

        security mask

        Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. -

        Miscellaneous Controls

        +

        Miscellaneous Controls

        The following are documented because of the prevalence of administrators creating inadvertent barriers to file access by not understanding the full implications of smb.conf file settings. See following table. -

        Table 13.4. Other Controls

        Control ParameterDescription - Action - Notes
        case sensitive, default case, short preserve case

        +

        Table 13.4. Other Controls

        Control ParameterDescription - Action - Notes
        case sensitive, default case, short preserve case

        This means that all file name lookup will be done in a case sensitive manner. Files will be created with the precise file name Samba received from the MS Windows client. -

        csc policy

        +

        csc policy

        Client Side Caching Policy - parallels MS Windows client side file caching capabilities. -

        dont descend

        +

        dont descend

        Allows specifying a comma-delimited list of directories that the server should always show as empty. -

        dos filetime resolution

        +

        dos filetime resolution

        This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. -

        dos filetimes

        +

        dos filetimes

        DOS and Windows allow users to change file time stamps if they can write to the file. POSIX semantics prevent this. This option allows DOS and Windows behavior. -

        fake oplocks

        +

        fake oplocks

        Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an oplock, the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. -

        hide dot files, hide files, veto files

        +

        hide dot files, hide files, veto files

        Note: MS Windows Explorer allows over-ride of files marked as hidden so they will still be visible. -

        read only

        +

        read only

        If this parameter is yes, then users of a service may not create or modify files in the service's directory. -

        veto files

        +

        veto files

        List of files and directories that are neither visible nor accessible. -

        Access Controls on Shares

        - +

        Access Controls on Shares

        + This section deals with how to configure Samba per share access control restrictions. By default, Samba sets no restrictions on the share itself. Restrictions on the share itself can be set on MS Windows NT4/200x/XP shares. This can be an effective way to limit who can @@ -342,9 +342,9 @@ for Samba's tdb files is under /usr/local/samba/var. If the tdbdump utility has been compiled and installed on your system, then you can examine the contents of this file by executing: tdbdump share_info.tdb in the directory containing the tdb files. -

        Share Permissions Management

        +

        Share Permissions Management

        The best tool for the task is platform dependant. Choose the best tool for your environment. -

        Windows NT4 Workstation/Server

        +

        Windows NT4 Workstation/Server

        The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft see details below. @@ -354,7 +354,7 @@

      8. Click on the share that you wish to manage, then click the Properties tab. then click the Permissions tab. Now you can add or change access control settings as you wish. -

      9. Windows 200x/XP

        +

        Windows 200x/XP

        On MS Windows NT4/200x/XP system access control lists on the share itself are set using native tools, usually from File Manager. For example, in Windows 200x, right click on the shared folder, then select Sharing, then click on Permissions. The default @@ -383,8 +383,8 @@ effectively no user will be able to access the share. This is a result of what is known as ACL precedence. Everyone with no access means that MaryK who is part of the group Everyone will have no access even if she is given explicit full control access. -

        MS Windows Access Control Lists and UNIX Interoperability

        Managing UNIX Permissions Using NT Security Dialogs

        - +

        MS Windows Access Control Lists and UNIX Interoperability

        Managing UNIX Permissions Using NT Security Dialogs

        + Windows NT clients can use their native security settings dialog box to view and modify the underlying UNIX permissions.

        @@ -398,7 +398,7 @@ When trying to figure out file access problems, it is vitally important to find the identity of the Windows user as it is presented by Samba at the point of file access. This can best be determined from the Samba log files. -

        Viewing File Security on a Samba Share

        +

        Viewing File Security on a Samba Share

        From an NT4/2000/XP client, right click on any file or directory in a Samba-mounted drive letter or UNC path. When the menu pops up, click on the Properties entry at the bottom of the menu. This brings up the file Properties dialog box. Click on the @@ -409,7 +409,7 @@ to add auditing requirements to a file if the user is logged on as the NT Administrator. This dialog is non-functional with a Samba share at this time, as the only useful button, the Add button, will not currently allow a list of users to be seen. -

        Viewing File Ownership

        +

        Viewing File Ownership

        Clicking on the Ownership button brings up a dialog box telling you who owns the given file. The owner name will be displayed like this:

        @@ -420,7 +420,7 @@ descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). Click on the Close button to remove this dialog.

        - If the parameter nt acl support is set to false, + If the parameter nt acl support is set to false, the file owner will be shown as the NT user Everyone.

        The Take Ownership button will not allow you to change the ownership of this file to @@ -432,7 +432,7 @@ There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS or Samba drive. This is available as part of the Seclib NT security library written - by Jeremy Allison of the Samba Team, and is available from the main Samba FTP site.

        Viewing File or Directory Permissions

        + by Jeremy Allison of the Samba Team, and is available from the main Samba FTP site.

        Viewing File or Directory Permissions

        The third button is the Permissions button. Clicking on this brings up a dialog box that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed like this:

        SERVER\ @@ -441,13 +441,13 @@ user is the user name of the UNIX user who owns the file, and (Long name) is the descriptive string identifying the user (normally found in the GECOS field of the UNIX password database).

        - If the parameter nt acl support is set to false, + If the parameter nt acl support is set to false, the file owner will be shown as the NT user Everyone and the permissions will be shown as NT “Full Control”.

        The permissions field is displayed differently for files and directories, so I'll describe the way file permissions are displayed first. -

        File Permissions

        The standard UNIX user/group/world triplet and the corresponding read, write, execute permissions +

        File Permissions

        The standard UNIX user/group/world triplet and the corresponding read, write, execute permissions triplets are mapped by Samba into a three element NT ACL with the “r”, “w” and “x” bits mapped into the corresponding NT permissions. The UNIX world permissions are mapped into the global NT group Everyone, followed by the list of permissions allowed for UNIX world. The UNIX owner and group permissions are displayed as an NT @@ -458,17 +458,17 @@ to allow “no permissions” to be seen and modified Samba then overloads the NT Take Ownership ACL attribute (which has no meaning in UNIX) and reports a component with no permissions as having the NT O bit set. This was chosen, of course, to make it look like a zero, meaning zero permissions. More details on the decision behind this is - given below.

        Directory Permissions

        Directories on an NT NTFS file system have two different sets of permissions. The first set is the ACL set on the + given below.

        Directory Permissions

        Directories on an NT NTFS file system have two different sets of permissions. The first set is the ACL set on the directory itself, which is usually displayed in the first set of parentheses in the normal RW NT style. This first set of permissions is created by Samba in exactly the same way as normal file permissions are, described above, and is displayed in the same way.

        The second set of directory permissions has no real meaning in the UNIX permissions world and represents the inherited permissions that any file created within this directory would inherit.

        Samba synthesizes these inherited permissions for NT by returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

        Modifying File or Directory Permissions

        Modifying file and directory permissions is as simple + created by Samba on this share would receive.

        Modifying File or Directory Permissions

        Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and clicking on OK. However, there are limitations that a user needs to be aware of, and also interactions with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.

        If the parameter nt acl support + attributes that need to also be taken into account.

        If the parameter nt acl support is set to false, any attempt to set security permissions will fail with an `Access Denied' message.

        The first thing to note is that the Add @@ -496,58 +496,58 @@ component and click on the Remove button, or set the component to only have the special Take Ownership permission (displayed as O - ) highlighted.

        Interaction with the Standard Samba “create mask” Parameters

        There are four parameters that control interaction with the standard Samba create mask parameters. + ) highlighted.

        Interaction with the Standard Samba “create mask” Parameters

        There are four parameters that control interaction with the standard Samba create mask parameters. These are: -

        • security mask
        • force security mode
        • directory security mask
        • force directory security mode

        +

        • security mask
        • force security mode
        • directory security mask
        • force directory security mode

        Once a user clicks on OK to apply the permissions, Samba maps the given permissions into a user/group/world r/w/x triplet set, and then checks the changed permissions for a file against the bits set in the - security mask parameter. Any bits that + security mask parameter. Any bits that were changed that are not set to “1” in this parameter are left alone - in the file permissions.

        Essentially, zero bits in the security mask + in the file permissions.

        Essentially, zero bits in the security mask may be treated as a set of bits the user is not allowed to change, and one bits are those the user is allowed to change.

        If not explicitly set, this parameter defaults to the same value as - the create mask parameter. To allow a user to modify all the + the create mask parameter. To allow a user to modify all the user/group/world permissions on a file, set this parameter to 0777.

        Next Samba checks the changed permissions for a file against the bits set in the - force security mode parameter. Any bits + force security mode parameter. Any bits that were changed that correspond to bits set to “1” in this parameter are forced to be set.

        Essentially, bits set in the force security mode parameter may be treated as a set of bits that, when modifying security on a file, the user has always set to be “on”.

        If not explicitly set, this parameter defaults to the same value - as the force create mode parameter. + as the force create mode parameter. To allow a user to modify all the user/group/world permissions on a file with no restrictions set this parameter to 000. The - security mask and force + security mask and force security mode parameters are applied to the change request in that order.

        For a directory, Samba will perform the same operations as described above for a file except it uses the parameter directory security mask instead of security mask, and force directory security mode parameter instead of force security mode - .

        The directory security mask parameter + .

        The directory security mask parameter by default is set to the same value as the directory mask parameter and the force directory security mode parameter by default is set to the same value as - the force directory mode parameter. + the force directory mode parameter. In this way Samba enforces the permission restrictions that an administrator can set on a Samba share, while still allowing users to modify the permission bits within that restriction.

        If you want to set up a share that allows users full control in modifying the permission bits on their files and directories and does not force any particular bits to be set “on”, then set the following parameters in the smb.conf file in that share-specific section: -

        +

        - security mask = 0777
        + security mask = 0777
        - force security mode = 0
        + force security mode = 0
        - directory security mask = 0777
        + directory security mask = 0777
        - force directory security mode = 0

        Interaction with the Standard Samba File Attribute Mapping

        Note

        Samba maps some of the DOS attribute bits (such as “read + force directory security mode = 0

        Interaction with the Standard Samba File Attribute Mapping

        Note

        Samba maps some of the DOS attribute bits (such as “read only”) into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security dialog and the permission bits set by the file attribute mapping. @@ -563,10 +563,10 @@ permissions and clicking on OK to get back to the attributes dialog, you should always press Cancel rather than OK to ensure that your changes - are not overridden.

        Common Errors

        + are not overridden.

        Common Errors

        File, directory and share access problems are common on the mailing list. The following are examples taken from the mailing list in recent times. -

        Users Cannot Write to a Public Share

        +

        Users Cannot Write to a Public Share

        We are facing some troubles with file/directory permissions. I can log on the domain as admin user(root), and there's a public share on which everyone needs to have permission to create/modify files, but only @@ -628,9 +628,9 @@

      10. Now in your smb.conf for the share add: -

        +

        - force create mode = 0775
        + force create mode = 0775
        force directory mode = 6775

        Note

        @@ -638,15 +638,15 @@ you have used. That is if within the OS do not have write permission on the directory.

        An alternative is to set in the smb.conf entry for the share: -

        +

        - force user = jack
        + force user = jack
        force group = engr

        -

        File Operations Done as root with force user Set

        - When you have a user in admin users, Samba will always do file operations for - this user as root, even if force user has been set. -

        MS Word with Samba Changes Owner of File

        +

        File Operations Done as root with force user Set

        + When you have a user in admin users, Samba will always do file operations for + this user as root, even if force user has been set. +

        MS Word with Samba Changes Owner of File

        Question:When user B saves a word document that is owned by user A the updated file is now owned by user B. Why is Samba doing this? How do I fix this?

        @@ -661,9 +661,9 @@ in which you are changing Word documents: chmod g+s `directory_name' This ensures that all files will be created with the group that owns the directory. In smb.conf share declaration section set:

        -

        +

        - force create mode = 0660
        + force create mode = 0660
        force directory mode = 0770

        diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/AdvancedNetworkManagement.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/AdvancedNetworkManagement.html --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/AdvancedNetworkManagement.html 2004-11-15 10:16:49.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/AdvancedNetworkManagement.html 2004-12-15 10:25:06.000000000 -0600 @@ -1,8 +1,8 @@ -Chapter 22. Advanced Network Management

        Chapter 22. Advanced Network Management

        John H. Terpstra

        Samba Team

        April 3 2003

        +Chapter 22. Advanced Network Management

        Chapter 22. Advanced Network Management

        John H. Terpstra

        Samba Team

        April 3 2003

        This section documents peripheral issues that are of great importance to network administrators who want to improve network resource access control, to automate the user environment and to make their lives a little easier. -

        Features and Benefits

        +

        Features and Benefits

        Often the difference between a working network environment and a well appreciated one can best be measured by the little things that make everything work more harmoniously. A key part of every network environment solution is the @@ -13,29 +13,29 @@

        This chapter presents information on each of these areas. They are placed here, and not in other chapters, for ease of reference. -

        Remote Server Administration

        How do I get `User Manager' and `Server Manager'?

        - - - +

        Remote Server Administration

        How do I get `User Manager' and `Server Manager'?

        + + + Since I do not need to buy an NT4 Server, how do I get the `User Manager for Domains' and the `Server Manager'?

        - + Microsoft distributes a version of these tools called Nexus.exe for installation on Windows 9x/Me systems. The tools set includes:

        • Server Manager
        • User Manager for Domains
        • Event Viewer

        Download the archived file at ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE.

        - + The Windows NT 4.0 version of the `User Manager for Domains' and `Server Manager' are available from Microsoft via ftp. -

        Remote Desktop Management

        +

        Remote Desktop Management

        There are a number of possible remote desktop management solutions that range from free through costly. Do not let that put you off. Sometimes the most costly solution is the most cost effective. In any case, you will need to draw your own conclusions as to which is the best tool in your network environment. -

        Remote Management from NoMachine.Com

        - +

        Remote Management from NoMachine.Com

        + The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. It is presented in slightly edited form (with author details omitted for privacy reasons). The entire answer is reproduced below with some comments removed. @@ -116,7 +116,7 @@ NoMachine are encouraging and offering help to OSS/Free Software implementations for such a front end too, even if it means competition to them (they have written to this effect even to the LTSP, KDE and GNOME developer mailing lists). -

        Network Logon Script Magic

        +

        Network Logon Script Magic

        There are several opportunities for creating a custom network startup configuration environment.

        • No Logon Script.
        • Simple universal Logon Script that applies to all users.
        • Use of a conditional Logon Script that applies per user or per group attributes.
        • Use of Samba's preexec and postexec functions on access to the NETLOGON share to create a custom logon script and then execute it.
        • User of a tool such as KixStart.

        @@ -126,7 +126,7 @@

        The following listings are from the genlogon directory.

        - + This is the genlogon.pl file: @@ -207,8 +207,8 @@

        Those wishing to use more elaborate or capable logon processing system should check out these sites: -

        Adding Printers without User Intervention

        - +

        Adding Printers without User Intervention

        + Printers may be added automatically during logon script processing through the use of:

        diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/Appendix.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/Appendix.html
        --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/Appendix.html	2004-11-15 10:16:56.000000000 -0600
        +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/Appendix.html	2004-12-15 10:25:19.000000000 -0600
        @@ -1 +1 @@
        -Part VI. Appendixes
        +Part VI. Appendixes
        diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/Backup.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/Backup.html
        --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/Backup.html	2004-11-15 10:16:52.000000000 -0600
        +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/Backup.html	2004-12-15 10:25:11.000000000 -0600
        @@ -1,11 +1,11 @@
        -Chapter 28. Backup Techniques

        Chapter 28. Backup Techniques

        John H. Terpstra

        Samba Team

        Features and Benefits

        +Chapter 28. Backup Techniques

        Chapter 28. Backup Techniques

        John H. Terpstra

        Samba Team

        Features and Benefits

        The Samba project is over ten years old. During the early history of Samba, UNIX administrators were its key implementors. UNIX administrators will use UNIX system tools to backup UNIX system files. Over the past four years, an increasing number of Microsoft network administrators have taken an interest in Samba. This is reflected in the questions about backup in general on the Samba mailing lists. -

        Discussion of Backup Solutions

        +

        Discussion of Backup Solutions

        During discussions at a Microsoft Windows training course, one of the pro-UNIX delegates stunned the class when he pointed out that Windows NT4 is so limiting compared with UNIX. He likened UNIX to a Meccano set @@ -27,8 +27,8 @@ www.allmerchants.com.

        The following three free software projects might also merit consideration. -

        BackupPC

        - +

        BackupPC

        + BackupPC version 2.0.0 has been released on SourceForge. New features include support for rsync/rsyncd and internationalization of the CGI interface (including English, French, Spanish, and German). @@ -50,7 +50,7 @@ BackupPC is free software distributed under a GNU GPL license. BackupPC runs on Linux/UNIX/freenix servers, and has been tested on Linux, UNIX, Windows 9x/ME, Windows 98, Windows 200x, Windows XP, and Mac OSX clients. -

        Rsync

        rsync is a flexible program for efficiently copying files or +

        Rsync

        rsync is a flexible program for efficiently copying files or directory trees.

        rsync has many options to select which files will be copied and how they are to be transferred. It may be used as an alternative to ftp, http, scp, or rcp.

        The rsync remote-update protocol allows rsync to transfer just @@ -71,8 +71,8 @@

      11. Support for anonymous or authenticated rsync servers (ideal for mirroring). -

      12. Amanda

        - +

        Amanda

        + Amanda, the Advanced Maryland Automatic Network Disk Archiver, is a backup system that allows the administrator of a LAN to set up a single master backup server to back up multiple hosts to a single large capacity tape drive. Amanda uses native dump and/or @@ -81,8 +81,8 @@

        For more information regarding Amanda, please check the www.amanda.org/ site. -

        BOBS: Browseable Online Backup System

        - +

        BOBS: Browseable Online Backup System

        + Browseable Online Backup System (BOBS) is a complete online backup system. Uses large disks for storing backups and lets users browse the files using a Web browser. Handles some special files like AppleDouble and icon files. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/bugreport.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/bugreport.html --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/bugreport.html 2004-11-15 10:16:55.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/bugreport.html 2004-12-15 10:25:15.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 35. Reporting Bugs

        Chapter 35. Reporting Bugs

        John H. Terpstra

        Samba Team

        Jelmer R. Vernooij

        The Samba Team

        Andrew Tridgell

        Samba Team

        27 June 1997

        Introduction

        Please report bugs using Samba's +Chapter 35. Reporting Bugs

        Chapter 35. Reporting Bugs

        John H. Terpstra

        Samba Team

        Jelmer R. Vernooij

        The Samba Team

        Andrew Tridgell

        Samba Team

        27 June 1997

        Introduction

        Please report bugs using Samba's Bugzilla facilities and take the time to read this file before you submit a bug report. Also, check to see if it has changed between releases, as we @@ -20,7 +20,7 @@ You may also like to look though the recent mailing list archives, which are conveniently accessible on the Samba Web pages at http://samba.org/samba/. -

        General Information

        +

        General Information

        Before submitting a bug report, check your config for silly errors. Look in your log files for obvious messages that tell you've mis-configured something. Run testparm to check your config @@ -38,45 +38,45 @@ 10 showing the problem may be appropriate. A higher level gives more detail, but may use too much disk space.

        -To set the debug level, use the log level in your +To set the debug level, use the log level in your smb.conf. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. To do this, add the following lines to your main smb.conf file: -

        +

        - log level = 10
        + log level = 10
        - log file = /usr/local/samba/lib/log.%m
        + log file = /usr/local/samba/lib/log.%m
        include = /usr/local/samba/lib/smb.conf.%m

        and create a file /usr/local/samba/lib/smb.conf.machine where machine is the name of the client you wish to debug. In that file put any smb.conf commands you want, for example -log level may be useful. This also allows you to +log level may be useful. This also allows you to experiment with different security systems, protocol levels and so on, on just one machine.

        -The smb.conf entry log level -is synonymous with the parameter debuglevel that has +The smb.conf entry log level +is synonymous with the parameter debuglevel that has been used in older versions of Samba and is being retained for backward compatibility of smb.conf files.

        -As the log level value is increased, you will record +As the log level value is increased, you will record a significantly greater level of debugging information. For most debugging operations, you may not need a setting higher than 3. Nearly all bugs can be tracked at a setting of 10, but be prepared for a large volume of log data. -

        Debugging Specific Operations

        +

        Debugging Specific Operations

        Samba-3.x permits debugging (logging) of specific functional components without unnecessarily cluttering the log files with detailed logs for all operations. An example configuration to achive this is shown in:

        -

        +

        - log level = 0 tdb:3 passdb:5 auth:4 vfs:2
        + log level = 0 tdb:3 passdb:5 auth:4 vfs:2
        - max log size = 0
        + max log size = 0
        log file = /var/log/samba/%U.%m.log

        @@ -85,7 +85,7 @@ of 0 means turn off all unnecessary debugging except the debug classes set for the functional areas as specified. The table shown in Debugable Functions may be used to affect very precise analysis of each SMB operation Samba is conducting. -

        Table 35.1. Debuggable Functions

        Function NameFunction Name
        allpassdb
        tdbsam
        printdrivers 
        lanmanwinbind
        smbvfs
        rpc_parseidmap
        rpc_srvquota
        rpc_cliacls

        Internal Errors

        +

        Table 35.1. Debuggable Functions

        Function NameFunction Name
        allpassdb
        tdbsam
        printdrivers 
        lanmanwinbind
        smbvfs
        rpc_parseidmap
        rpc_srvquota
        rpc_cliacls

        Internal Errors

        If you get the message “INTERNAL ERROR” in your log files, it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless @@ -99,13 +99,13 @@ You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed.

        - + You may also find that a core file appeared in a corefiles subdirectory of the directory where you keep your Samba log files. This file is the most useful tool for tracking down the bug. To use it, you do this: - - + +

         $ gdb smbd core
         

        @@ -120,7 +120,7 @@ where the problem is by looking at the surrounding code. Even if you do not know assembly, including this information in the bug report can be useful. -

        Attaching to a Running Process

        +

        Attaching to a Running Process

        Unfortunately, some UNIXes (in particular some recent Linux kernels) refuse to dump a core file if the task has changed uid (which smbd does often). To debug with this sort of system, you could try to attach @@ -130,9 +130,9 @@ Then use c to continue and try to cause the core dump using the client. The debugger should catch the fault and tell you where it occurred. -

        Patches

        - - +

        Patches

        + + The best sort of bug report is one that includes a fix! If you send us patches, please use diff -u format if your version of diff supports it, otherwise use diff -c4. Make sure diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/ClientConfig.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/ClientConfig.html --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/ClientConfig.html 2004-11-15 10:16:37.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/ClientConfig.html 2004-12-15 10:24:42.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 8. MS Windows Network Configuration Guide

        Chapter 8. MS Windows Network Configuration Guide

        John H. Terpstra

        Samba Team

        Features and Benefits

        +Chapter 8. MS Windows Network Configuration Guide

        Chapter 8. MS Windows Network Configuration Guide

        John H. Terpstra

        Samba Team

        Features and Benefits

        Occasionally network administrators will report difficulty getting Microsoft Windows clients to interoperate correctly with Samba servers. It would appear that some folks just can not accept the fact that the right way to configure MS Windows network client is precisely as one would do when using Microsoft Windows NT4 or 200x @@ -7,7 +7,7 @@ The purpose of this chapter is to graphically illustrate MS Windows client configuration for the most common critical aspects of such configuration. An experienced network administrator will not be interested in the details of this chapter. -

        Technical Details

        +

        Technical Details

        This chapter discusses TCP/IP protocol configuration as well as network membership for the platforms that are in common use today. These are:

        • @@ -16,7 +16,7 @@ Windows 2000 Professional.

        • Windows Millennium edition (Me). -

        TCP/IP Configuration

        +

        TCP/IP Configuration

        The builder of a house must ensure that all construction takes place on a firm foundation. The same is true of TCP/IP-based networking. Fundamental network configuration problems will plague all network users until they are resolved. @@ -29,7 +29,7 @@ It is possible to use shortcuts or abbreviated keystrokes to arrive at a particular configuration screen. The decision was made to base all examples in this chapter on use of the Start button. -

        MS Windows XP Professional

        +

        MS Windows XP Professional

        There are two paths to the Windows XP TCP/IP configuration panel. Choose the access method that you prefer:

        Click Start -> Control Panel -> Network Connections @@ -78,7 +78,7 @@ When finished making, changes click the OK to commit the settings. See ???.

        Figure 8.5. WINS Configuration

        WINS Configuration

        -

        MS Windows 2000

        +

        MS Windows 2000

        There are two paths to the Windows 2000 Professional TCP/IP configuration panel. Choose the access method that you prefer:

        Click Start -> Control Panel -> Network and Dial-up Connections @@ -123,7 +123,7 @@ When finished making changes, click on OK to commit the settings. See ???.

        Figure 8.10. WINS Configuration.

        WINS Configuration.

        -

        MS Windows Me

        +

        MS Windows Me

        There are two paths to the Windows Millennium edition (Me) TCP/IP configuration panel. Choose the access method that you prefer:

        Click Start -> Control Panel -> Network Connections @@ -163,7 +163,7 @@ this might apply is on a network that has a single DHCP server that provides settings for multiple Windows workgroups or domains. See ???.

        Figure 8.14. WINS Configuration.

        WINS Configuration.

        -

        Joining a Domain: Windows 2000/XP Professional

        +

        Joining a Domain: Windows 2000/XP Professional

        Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security. This section steps through the process for making a Windows 200x/XP Professional machine a member of a Domain Security environment. It should be noted that this process is identical @@ -205,7 +205,7 @@

        The “Welcome to the MIDEARTH domain.” dialog box should appear. At this point the machine must be rebooted. Joining the domain is now complete. -

        Domain Logon Configuration: Windows 9x/Me

        +

        Domain Logon Configuration: Windows 9x/Me

        We follow the convention used by most in saying that Windows 9x/Me machines can participate in Domain logons. The truth is that these platforms can use only the LanManager network logon protocols.

        Note

        @@ -236,8 +236,8 @@ permissions using domain user and group accounts, it is necessary to enable User-level access control as shown in this panel. See ???.

        Figure 8.23. Identification Panel.

        Identification Panel.

        -

        Common Errors

        +

        Common Errors

        The most common errors that can afflict Windows networking systems include:

        • Incorrect IP address.

        • Incorrect or inconsistent netmasks.

        • Incorrect router address.

        • Incorrect DNS server address.

        • Incorrect WINS server address.

        • Use of a Network Scope setting watch out for this one!

        The most common reasons for which a Windows NT/200x/XP Professional client cannot join the Samba controlled domain are: -

        • smb.conf does not have correct add machine script settings.

        • root” account is not in password backend database.

        • Attempt to use a user account instead of the “root” account to join a machine to the domain.

        • Open connections from the workstation to the server.

        • Firewall or filter configurations in place on either the client or on the Samba server.

        +

        • smb.conf does not have correct add machine script settings.

        • root” account is not in password backend database.

        • Attempt to use a user account instead of the “root” account to join a machine to the domain.

        • Open connections from the workstation to the server.

        • Firewall or filter configurations in place on either the client or on the Samba server.

        diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/compiling.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/compiling.html --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/compiling.html 2004-11-15 10:16:55.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/compiling.html 2004-12-15 10:25:17.000000000 -0600 @@ -1,9 +1,9 @@ -Chapter 36. How to Compile Samba

        Chapter 36. How to Compile Samba

        Jelmer R. Vernooij

        The Samba Team

        John H. Terpstra

        Samba Team

        Andrew Tridgell

        Samba Team

        22 May 2001

        18 March 2003

        +Chapter 36. How to Compile Samba

        Chapter 36. How to Compile Samba

        Jelmer R. Vernooij

        The Samba Team

        John H. Terpstra

        Samba Team

        Andrew Tridgell

        Samba Team

        22 May 2001

        18 March 2003

        You can obtain the Samba source from the Samba Website. To obtain a development version, you can download Samba from Subversion or using rsync. -

        Access Samba Source Code via Subversion

        Introduction

        - +

        Access Samba Source Code via Subversion

        Introduction

        + Samba is developed in an open environment. Developers use a Subversion to “checkin” (also known as “commit”) new source code. Samba's various Subversion branches can @@ -12,13 +12,13 @@

        This chapter is a modified version of the instructions found at the Samba web site. -

        Subversion Access to samba.org

        +

        Subversion Access to samba.org

        The machine samba.org runs a publicly accessible Subversion repository for access to the source code of several packages, including Samba, rsync, distcc, ccache, and jitterbug. There are two main ways of accessing the Subversion server on this host: -

        Access via SVNweb

        - +

        Access via SVNweb

        + You can access the source code via your favorite WWW browser. This allows you to access the contents of individual files in the repository and also to look at the revision history and commit logs of individual files. You can also ask for a diff @@ -26,7 +26,7 @@

        Use the URL: http://svnweb.samba.org/ -

        Access via Subversion

        +

        Access via Subversion

        You can also access the source code via a normal Subversion client. This gives you much more control over what you can do with the repository and allows you to checkout whole source trees @@ -62,9 +62,9 @@ the following command from within the Samba directory:

        svn update -

        Accessing the Samba Sources via rsync and ftp

        - - +

        Accessing the Samba Sources via rsync and ftp

        + + pserver.samba.org also exports unpacked copies of most parts of the Subversion tree at the Samba pserver location and also via anonymous rsync at the Samba @@ -75,8 +75,8 @@ The disadvantage of the unpacked trees is that they do not support automatic merging of local changes like Subversion does. rsync access is most convenient for an initial install. -

        Verifying Samba's PGP Signature

        - +

        Verifying Samba's PGP Signature

        + It is strongly recommended that you verify the PGP signature for any source file before installing it. Even if you're not downloading from a mirror site, verifying PGP signatures should be a standard reflex. Many people today use the GNU GPG tool-set in place of PGP. @@ -87,7 +87,7 @@ $ wget http://us1.samba.org/samba/ftp/samba-3.0.0.tar.asc $ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc

        - + The first file is the PGP signature for the Samba source file; the other is the Samba public PGP key itself. Import the public PGP key with:

        @@ -103,14 +103,14 @@
         example of what you would not want to see would be:
         

              gpg: BAD signature from “Samba Distribution Verification Key”
        -

        Building the Binaries

        - +

        Building the Binaries

        + To build the binaries, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual needs, then you may wish to run

        root# ./configure --help
         

        first to see what special options you can enable. Now execute ./configure with any arguments it might need:

        root# ./configure [... arguments ...]

        Executing

        - +

        root# make

        will create the binaries. Once it is successfully compiled you can use

        root# make install

        to install the binaries and manual pages. You can separately install the binaries and/or man pages using

        root# make installbin
        @@ -119,7 +119,7 @@
         	of Samba you might like to know that the old versions of 
         	the binaries will be renamed with an “.old” extension. You 
         	can go back to the previous version with

        root# make revert
        -

        if you find this version a disaster!

        Compiling Samba with Active Directory Support

        In order to compile Samba with ADS support, you need to have installed +

        if you find this version a disaster!

        Compiling Samba with Active Directory Support

        In order to compile Samba with ADS support, you need to have installed on your system:

        • The MIT or Heimdal Kerberos development libraries (either install from the sources or use a package).

        • The OpenLDAP development libraries.

        If your Kerberos libraries are in a non-standard location, then remember to add the configure option @@ -130,13 +130,13 @@ #define HAVE_LDAP 1

        If it does not, configure did not find your KRB5 libraries or your LDAP libraries. Look in config.log to figure - out why and fix it.

        Installing the Required Packages for Debian

        On Debian, you need to install the following packages:

        + out why and fix it.

        Installing the Required Packages for Debian

        On Debian, you need to install the following packages:

        • libkrb5-dev

        • krb5-user

        -

        Installing the Required Packages for Red Hat Linux

        On Red Hat Linux, this means you should have at least:

        +

        Installing the Required Packages for Red Hat Linux

        On Red Hat Linux, this means you should have at least:

        • krb5-workstation (for kinit)

        • krb5-libs (for linking with)

        • krb5-devel (because you are compiling from source)

        in addition to the standard development environment.

        If these files are not installed on your system, you should check the installation CDs to find which has them and install the files using your tool of choice. If in doubt - about what tool to use, refer to the Red Hat Linux documentation.

        SuSE Linux Package Requirements

        SuSE Linux installs Heimdal packages that may be required to allow you to build + about what tool to use, refer to the Red Hat Linux documentation.

        SuSE Linux Package Requirements

        SuSE Linux installs Heimdal packages that may be required to allow you to build binary packages. You should verify that the development libraries have been installed on your system.

        SuSE Linux Samba RPMs support Kerberos. Please refer to the documentation for @@ -144,8 +144,8 @@ Additionally, SuSE are very active in the maintenance of Samba packages that provide the maximum capabilities that are available. You should consider using SuSE provided packages where they are available. -

        Starting the smbd and nmbd

        - +

        Starting the smbd and nmbd

        + You must choose to start smbd and nmbd either as daemons or from inetd. Don't try to do both! Either you can put them in @@ -159,7 +159,7 @@ Samba. In many cases, you must be root.

        The main advantage of starting smbd and nmbd using the recommended daemon method is that they will respond slightly more quickly to an initial connection - request.

        Starting from inetd.conf

        Note

        The following will be different if + request.

        Starting from inetd.conf

        Note

        The following will be different if you use NIS, NIS+ or LDAP to distribute services maps.

        Look at your /etc/services. What is defined at port 139/tcp? If nothing is defined, then add a line like this:

        netbios-ssn     139/tcp

        Similarly for 137/udp, you should have an entry like:

        netbios-ns	137/udp

        Next, edit your /etc/inetd.conf @@ -169,16 +169,16 @@

        The exact syntax of /etc/inetd.conf varies between UNIXes. Look at the other entries in inetd.conf for a guide.

        - + Some distributions use xinetd instead of inetd. Consult the xinetd manual for configuration information.

        Note

        Some UNIXes already have entries like netbios_ns (note the underscore) in /etc/services. You must edit /etc/services or /etc/inetd.conf to make them consistent.

        Note

        - + On many systems you may need to use the - interfaces option in smb.conf to specify the IP + interfaces option in smb.conf to specify the IP address and netmask of your interfaces. Run ifconfig as root if you do not know what the broadcast is for your @@ -191,8 +191,8 @@ from inetd.

        Restart inetd, perhaps just send it a HUP.

         			root# killall -HUP inetd
        -		

        Alternative: Starting smbd as a Daemon

        - +

        Alternative: Starting smbd as a Daemon

        + To start the server as a daemon, you should create a script something like this one, perhaps calling it startsmb.

        diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/CUPS-printing.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/CUPS-printing.html
        --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/CUPS-printing.html	2004-11-15 10:16:48.000000000 -0600
        +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/CUPS-printing.html	2004-12-15 10:25:04.000000000 -0600
        @@ -1,7 +1,7 @@
        -Chapter 19. CUPS Printing Support

        Chapter 19. CUPS Printing Support

        Kurt Pfeifle

        Danka Deutschland GmbH

        Ciprian Vizitiu

        drawings

        Jelmer R. Vernooij

        drawings
        The Samba Team

        (27 Jan 2004)

        Table of Contents

        Introduction
        Features and Benefits
        Overview
        Basic CUPS Support Configuration
        Linking smbd with libcups.so
        Simple smb.conf Settings for CUPS
        More Complex CUPS smb.conf Settings
        Advanced Configuration
        Central Spooling vs. Peer-to-Peer Printing
        Raw Print Serving Vendor Drivers on Windows Clients
        Installation of Windows Client Drivers
        Explicitly Enable raw Printing for application/octet-stream
        Driver Upload Methods
        Advanced Intelligent Printing with PostScript Driver Download
        GDI on Windows -- PostScript on UNIX
        Windows Drivers, GDI and EMF
        UNIX Printfile Conversion and GUI Basics
        PostScript and Ghostscript
        Ghostscript the Software RIP for Non-PostScript Printers
        PostScript Printer Description (PPD) Specification
        Using Windows-Formatted Vendor PPDs
        CUPS Also Uses PPDs for Non-PostScript Printers
        The CUPS Filtering Architecture
        MIME Types and CUPS Filters
        MIME Type Conversion Rules
        Filtering Overview
        Prefilters
        pstops
        pstoraster
        imagetops and imagetoraster
        rasterto [printers specific]
        CUPS Backends
        The Role of cupsomatic/foomatic
        The Complete Picture
        mime.convs
        Raw Printing
        application/octet-stream Printing
        PostScript Printer Descriptions (PPDs) for Non-PS Printers
        cupsomatic/foomatic-rip Versus native CUPS Printing
        Examples for Filtering Chains
        Sources of CUPS Drivers/PPDs
        Printing with Interface Scripts
        Network Printing (Purely Windows)
        From Windows Clients to an NT Print Server
        Driver Execution on the Client
        Driver Execution on the Server
        Network Printing (Windows Clients UNIX/Samba Print -Servers)
        From Windows Clients to a CUPS/Samba Print Server
        Samba Receiving Job-files and Passing Them to CUPS
        Network PostScript RIP
        PPDs for Non-PS Printers on UNIX
        PPDs for Non-PS Printers on Windows
        Windows Terminal Servers (WTS) as CUPS Clients
        Printer Drivers Running in Kernel Mode Cause Many -Problems
        Workarounds Impose Heavy Limitations
        CUPS: A Magical Stone?
        PostScript Drivers with No Major Problems Even in Kernel -Mode
        Configuring CUPS for Driver Download
        cupsaddsmb: The Unknown Utility
        Prepare Your smb.conf for cupsaddsmb
        CUPS PostScript Driver for Windows NT/200x/XP
        Recognizing Different Driver Files
        Acquiring the Adobe Driver Files
        ESP Print Pro PostScript Driver for Windows NT/200x/XP
        Caveats to be Considered
        Windows CUPS PostScript Driver Versus Adobe Driver
        Run cupsaddsmb (Quiet Mode)
        Run cupsaddsmb with Verbose Output
        Understanding cupsaddsmb
        How to Recognize If cupsaddsmb Completed Successfully
        cupsaddsmb with a Samba PDC
        cupsaddsmb Flowchart
        Installing the PostScript Driver on a Client
        Avoiding Critical PostScript Driver Settings on the Client
        Installing PostScript Driver Files Manually Using rpcclient
        A Check of the rpcclient man Page
        Understanding the rpcclient man Page
        Producing an Example by Querying a Windows Box
        Requirements for adddriver and setdriver to Succeed
        Manual Driver Installation in 15 Steps
        Troubleshooting Revisited
        The Printing *.tdb Files
        Trivial Database Files
        Binary Format
        Losing *.tdb Files
        Using tdbbackup
        CUPS Print Drivers from Linuxprinting.org
        foomatic-rip and Foomatic Explained
        foomatic-rip and Foomatic-PPD Download and Installation
        Page Accounting with CUPS
        Setting Up Quotas
        Correct and Incorrect Accounting
        Adobe and CUPS PostScript Drivers for Windows Clients
        The page_log File Syntax
        Possible Shortcomings
        Future Developments
        Additional Material
        Auto-Deletion or Preservation of CUPS Spool Files
        CUPS Configuration Settings Explained
        Pre-Conditions
        Manual Configuration
        Printing from CUPS to Windows Attached Printers
        More CUPS-Filtering Chains
        Common Errors
        Windows 9x/ME Client Can't Install Driver
        cupsaddsmb Keeps Asking for Root Password in Never-ending Loop
        cupsaddsmb Errors
        Client Can't Connect to Samba Printer
        New Account Reconnection from Windows 200x/XP Troubles
        Avoid Being Connected to the Samba Server as the Wrong User
        Upgrading to CUPS Drivers from Adobe Drivers
        Can't Use cupsaddsmb on Samba Server Which Is a PDC
        Deleted Windows 200x Printer Driver Is Still Shown
        Windows 200x/XP "Local Security Policies"
        Administrator Cannot Install Printers for All Local Users
        Print Change Notify Functions on NT-clients
        Win XP-SP1
        Print Options for All Users Can't Be Set on Windows 200x/XP
        Most Common Blunders in Driver Settings on Windows Clients
        cupsaddsmb Does Not Work with Newly Installed Printer
        Permissions on /var/spool/samba/ Get Reset After Each Reboot
        Print Queue Called lp Mis-handles Print Jobs
        Location of Adobe PostScript Driver Files for cupsaddsmb
        Overview of the CUPS Printing Processes

        Introduction

        Features and Benefits

        +Chapter 19. CUPS Printing Support

        Chapter 19. CUPS Printing Support

        Kurt Pfeifle

        Danka Deutschland GmbH

        Ciprian Vizitiu

        drawings

        Jelmer R. Vernooij

        drawings
        The Samba Team

        (27 Jan 2004)

        Table of Contents

        Introduction
        Features and Benefits
        Overview
        Basic CUPS Support Configuration
        Linking smbd with libcups.so
        Simple smb.conf Settings for CUPS
        More Complex CUPS smb.conf Settings
        Advanced Configuration
        Central Spooling vs. Peer-to-Peer Printing
        Raw Print Serving Vendor Drivers on Windows Clients
        Installation of Windows Client Drivers
        Explicitly Enable raw Printing for application/octet-stream
        Driver Upload Methods
        Advanced Intelligent Printing with PostScript Driver Download
        GDI on Windows -- PostScript on UNIX
        Windows Drivers, GDI and EMF
        UNIX Printfile Conversion and GUI Basics
        PostScript and Ghostscript
        Ghostscript the Software RIP for Non-PostScript Printers
        PostScript Printer Description (PPD) Specification
        Using Windows-Formatted Vendor PPDs
        CUPS Also Uses PPDs for Non-PostScript Printers
        The CUPS Filtering Architecture
        MIME Types and CUPS Filters
        MIME Type Conversion Rules
        Filtering Overview
        Prefilters
        pstops
        pstoraster
        imagetops and imagetoraster
        rasterto [printers specific]
        CUPS Backends
        The Role of cupsomatic/foomatic
        The Complete Picture
        mime.convs
        Raw Printing
        application/octet-stream Printing
        PostScript Printer Descriptions (PPDs) for Non-PS Printers
        cupsomatic/foomatic-rip Versus native CUPS Printing
        Examples for Filtering Chains
        Sources of CUPS Drivers/PPDs
        Printing with Interface Scripts
        Network Printing (Purely Windows)
        From Windows Clients to an NT Print Server
        Driver Execution on the Client
        Driver Execution on the Server
        Network Printing (Windows Clients UNIX/Samba Print +Servers)
        From Windows Clients to a CUPS/Samba Print Server
        Samba Receiving Job-files and Passing Them to CUPS
        Network PostScript RIP
        PPDs for Non-PS Printers on UNIX
        PPDs for Non-PS Printers on Windows
        Windows Terminal Servers (WTS) as CUPS Clients
        Printer Drivers Running in Kernel Mode Cause Many +Problems
        Workarounds Impose Heavy Limitations
        CUPS: A Magical Stone?
        PostScript Drivers with No Major Problems Even in Kernel +Mode
        Configuring CUPS for Driver Download
        cupsaddsmb: The Unknown Utility
        Prepare Your smb.conf for cupsaddsmb
        CUPS PostScript Driver for Windows NT/200x/XP
        Recognizing Different Driver Files
        Acquiring the Adobe Driver Files
        ESP Print Pro PostScript Driver for Windows NT/200x/XP
        Caveats to be Considered
        Windows CUPS PostScript Driver Versus Adobe Driver
        Run cupsaddsmb (Quiet Mode)
        Run cupsaddsmb with Verbose Output
        Understanding cupsaddsmb
        How to Recognize If cupsaddsmb Completed Successfully
        cupsaddsmb with a Samba PDC
        cupsaddsmb Flowchart
        Installing the PostScript Driver on a Client
        Avoiding Critical PostScript Driver Settings on the Client
        Installing PostScript Driver Files Manually Using rpcclient
        A Check of the rpcclient man Page
        Understanding the rpcclient man Page
        Producing an Example by Querying a Windows Box
        Requirements for adddriver and setdriver to Succeed
        Manual Driver Installation in 15 Steps
        Troubleshooting Revisited
        The Printing *.tdb Files
        Trivial Database Files
        Binary Format
        Losing *.tdb Files
        Using tdbbackup
        CUPS Print Drivers from Linuxprinting.org
        foomatic-rip and Foomatic Explained
        foomatic-rip and Foomatic-PPD Download and Installation
        Page Accounting with CUPS
        Setting Up Quotas
        Correct and Incorrect Accounting
        Adobe and CUPS PostScript Drivers for Windows Clients
        The page_log File Syntax
        Possible Shortcomings
        Future Developments
        Additional Material
        Auto-Deletion or Preservation of CUPS Spool Files
        CUPS Configuration Settings Explained
        Pre-Conditions
        Manual Configuration
        Printing from CUPS to Windows Attached Printers
        More CUPS-Filtering Chains
        Common Errors
        Windows 9x/ME Client Can't Install Driver
        cupsaddsmb Keeps Asking for Root Password in Never-ending Loop
        cupsaddsmb Errors
        Client Can't Connect to Samba Printer
        New Account Reconnection from Windows 200x/XP Troubles
        Avoid Being Connected to the Samba Server as the Wrong User
        Upgrading to CUPS Drivers from Adobe Drivers
        Can't Use cupsaddsmb on Samba Server Which Is a PDC
        Deleted Windows 200x Printer Driver Is Still Shown
        Windows 200x/XP "Local Security Policies"
        Administrator Cannot Install Printers for All Local Users
        Print Change Notify Functions on NT-clients
        Win XP-SP1
        Print Options for All Users Can't Be Set on Windows 200x/XP
        Most Common Blunders in Driver Settings on Windows Clients
        cupsaddsmb Does Not Work with Newly Installed Printer
        Permissions on /var/spool/samba/ Get Reset After Each Reboot
        Print Queue Called lp Mis-handles Print Jobs
        Location of Adobe PostScript Driver Files for cupsaddsmb
        Overview of the CUPS Printing Processes

        Introduction

        Features and Benefits

        The Common UNIX Print System (CUPS) has become quite popular. All major Linux distributions now ship it as their default printing system. To many, it is still a mystical tool. Mostly, it just works. @@ -19,7 +19,7 @@ from the beginning. This documentation will lead you to a complete understanding of CUPS. Let's start with the most basic things first. -

        Overview

        +

        Overview

        CUPS is more than just a print spooling system. It is a complete printer management system that complies with the new Internet Printing Protocol (IPP). IPP is an industry @@ -39,10 +39,10 @@ argue that CUPS is better! In any case, let us now move on to explore how one may configure CUPS for interfacing with MS Windows print clients via Samba. -

        Basic CUPS Support Configuration

        +

        Basic CUPS Support Configuration

        Printing with CUPS in the most basic smb.conf setup in Samba-3.0 (as was true for 2.2.x) only needs two - settings: printing = cups and - printcap = cups. CUPS does not need a printcap file. + settings: printing = cups and + printcap = cups. CUPS does not need a printcap file. However, the cupsd.conf configuration file knows of two related directives that control how such a file will be automatically created and maintained by CUPS for the convenience of third-party applications (example: Printcap /etc/printcap and PrintcapFormat BSD). @@ -50,14 +50,14 @@ print. Make sure CUPS is set to generate and maintain a printcap file. For details, see man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server itself: http://localhost:631/documentation.html. -

        Linking smbd with libcups.so

        +

        Linking smbd with libcups.so

        Samba has a special relationship to CUPS. Samba can be compiled with CUPS library support. Most recent installations have this support enabled. Per default, CUPS linking is compiled into smbd and other Samba binaries. Of course, you can use CUPS even if Samba is not linked against libcups.so but there are some differences in required or supported configuration.

        - When Samba is compiled against libcups, printcap = cups + When Samba is compiled against libcups, printcap = cups uses the CUPS API to list printers, submit jobs, query queues, and so on. Otherwise it maps to the System V commands with an additional -oraw option for printing. On a Linux system, you can use the ldd utility to find out details (ldd may not be present on @@ -74,38 +74,38 @@ is set, then any otherwise manually set print command in smb.conf is ignored. This is an important point to remember!

        Tip

        Should it be necessary, for any reason, to set your own print commands, you can do this by setting - printing = sysv. However, you will lose all the benefits + printing = sysv. However, you will lose all the benefits of tight CUPS/Samba integration. When you do this you must manually configure the printing system commands (most important: - print command; other commands are - lppause command, - lpresume command, - lpq command, - lprm command, - queuepause command and - queue resume command).

        Simple smb.conf Settings for CUPS

        + print command; other commands are + lppause command, + lpresume command, + lpq command, + lprm command, + queuepause command and + queue resume command).

        Simple smb.conf Settings for CUPS

        To summarize, following example shows simplest printing-related setup for smb.conf to enable basic CUPS support: -

        Example 19.1. Simplest printing-related smb.conf

        [global]
        +

        Example 19.1. Simplest printing-related smb.conf

        [global]
        - load printers = yes
        + load printers = yes
        - printing = cups
        + printing = cups
        - printcap name = cups
        [printers]
        + printcap name = cups
        [printers]
        - comment = All Printers
        + comment = All Printers
        - path = /var/spool/samba
        + path = /var/spool/samba
        - browseable = no
        + browseable = no
        - public = yes
        + public = yes
        - guest ok = yes
        + guest ok = yes
        - writable = no
        + writable = no
        - printable = yes
        + printable = yes
        printer admin = root, @ntadmins

        This is all you need for basic printing setup for CUPS. It will print @@ -122,71 +122,71 @@ printer is not a PostScript device, the print data stream is “binary,” sensible only for the target printer. Read on to learn which problem this may cause and how to avoid it. -

        More Complex CUPS smb.conf Settings

        +

        More Complex CUPS smb.conf Settings

        Next configuration is a slightly more complex printing-related setup for smb.conf. It enables general CUPS printing support for all printers, but defines one printer share, which is set up differently. -

        Example 19.2. Overriding global CUPS settings for one printer

        [global]
        +

        Example 19.2. Overriding global CUPS settings for one printer

        [global]
        - printing = cups
        + printing = cups
        - printcap name = cups
        + printcap name = cups
        - load printers = yes
        [printers]
        + load printers = yes
        [printers]
        - comment = All Printers
        + comment = All Printers
        - path = /var/spool/samba
        + path = /var/spool/samba
        - public = yes
        + public = yes
        - guest ok = yes
        + guest ok = yes
        - writable = no
        + writable = no
        - printable = yes
        + printable = yes
        - printer admin = root, @ntadmins
        [special_printer]
        + printer admin = root, @ntadmins
        [special_printer]
        - comment = A special printer with his own settings
        + comment = A special printer with his own settings
        - path = /var/spool/samba-special
        + path = /var/spool/samba-special
        - printing = sysv
        + printing = sysv
        - printcap = lpstat
        + printcap = lpstat
        - print command = echo "NEW: `date`: printfile %f" \
        >> /tmp/smbprn.log ; \
        echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \
        echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log ; rm %f
        + print command = echo "NEW: `date`: printfile %f" \
        >> /tmp/smbprn.log ; \
        echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \
        echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log ; rm %f
        - public = no
        + public = no
        - guest ok = no
        + guest ok = no
        - writable = no
        + writable = no
        - printable = yes
        + printable = yes
        - printer admin = kurt
        + printer admin = kurt
        - hosts deny = 0.0.0.0
        + hosts deny = 0.0.0.0
        hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60

        This special share is only there for testing purposes. It does not write the print job to a file. It just logs the job parameters known to Samba into the /tmp/smbprn.log file and deletes the job-file. Moreover, the - printer admin of this share is “kurt” (not the “@ntadmins” group), + printer admin of this share is “kurt” (not the “@ntadmins” group), guest access is not allowed, the share isn't published to the Network Neighborhood (so you need to know it is there), and it only allows access from only three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set - printing = sysv and - printcap = lpstat. -

        Advanced Configuration

        + printing = sysv and + printcap = lpstat. +

        Advanced Configuration

        Before we delve into all the configuration options, let us clarify a few points. Network printing needs to be organized and setup correctly. This frequently doesn't happen. Legacy systems or small business LAN environments often lack design and good housekeeping. -

        Central Spooling vs. “Peer-to-Peer” Printing

        - - +

        Central Spooling vs. “Peer-to-Peer” Printing

        + + Many small office or home networks, as well as badly organized larger environments, allow each client a direct access to available network printers. This is generally a bad idea. It often blocks one client's @@ -198,9 +198,9 @@ central system, which responds immediately, takes jobs from multiple concurrent clients at the same time, and in turn transfers them to the printer(s) in the correct order. -

        Raw Print Serving Vendor Drivers on Windows Clients

        - - +

        Raw Print Serving Vendor Drivers on Windows Clients

        + + Most traditionally configured UNIX print servers acting on behalf of Samba's Windows clients represented a really simple setup. Their only task was to manage the “raw” spooling of all jobs handed to them by @@ -237,10 +237,10 @@ Choose Raw. Choose queue name Raw Queue.

      13. In the smb.conf file [printers] section add - use client driver = Yes, + use client driver = Yes, and in the [global] section add - printing = CUPS, plus - printcap = CUPS. + printing = CUPS, plus + printcap = CUPS.

      14. Install the printer as if it is a local printer. i.e.: Printing to LPT1:.

      15. @@ -249,14 +249,14 @@ you have configured above. Example: \\server\raw_q. Here, the name raw_q is the name you gave the print queue in the CUPS environment. -

      16. Installation of Windows Client Drivers

        +

        Installation of Windows Client Drivers

        The printer drivers on the Windows clients may be installed in two functionally different ways:

        • Manually install the drivers locally on each client, one by one; this yields the old LanMan style printing and uses a \\sambaserver\printershare type of connection.

        • - + Deposit and prepare the drivers (for later download) on the print server (Samba); this enables the clients to use “Point'n'Print” to get drivers semi-automatically installed the @@ -265,9 +265,9 @@ type printing calls.

        The second method is recommended for use over the first.

        Explicitly Enable “raw” Printing for application/octet-stream

        - - - + + + If you use the first option (drivers are installed on the client side), there is one setting to take care of: CUPS needs to be told that it should allow “raw” printing of deliberate (binary) file @@ -283,13 +283,13 @@ application/octet-stream

        - - + + In /etc/cups/mime.convs, have this line: - +

         		application/octet-stream   application/vnd.cups-raw   0   - 
        @@ -303,7 +303,7 @@
         	enforceraw” printing, it only
         	allows it.
         	

        Background.  - + CUPS being a more security-aware printing system than traditional ones does not by default allow a user to send deliberate (possibly binary) data to printing devices. This could be easily abused to launch a @@ -320,11 +320,11 @@ locally installed. If you are not interested in background information about more advanced CUPS/Samba printing, simply skip the remaining sections of this chapter. -

        Driver Upload Methods

        +

        Driver Upload Methods

        This section describes three familiar methods, plus one new one, by which printer drivers may be uploaded.

        - + If you want to use the MS-RPC type printing, you must upload the drivers onto the Samba server first ([print$] share). For a discussion on how to deposit printer drivers on the @@ -333,25 +333,25 @@ HOWTO Collection. There you will find a description or reference to three methods of preparing the client drivers on the Samba server:

        • - + The GUI, “Add Printer Wizardupload-from-a-Windows-client method.

        • The command line, “smbclient/rpcclient” upload-from-a-UNIX-workstation method.

        • - + The Imprints Toolset method.

        These three methods apply to CUPS all the same. A new and more convenient way to load the Windows drivers into Samba is provided if you use CUPS:

        • - + the cupsaddsmb utility.

        cupsaddsmb is discussed in much detail further below. But we first explore the CUPS filtering system and compare the Windows and UNIX printing architectures. -

        Advanced Intelligent Printing with PostScript Driver Download

        - +

        Advanced Intelligent Printing with PostScript Driver Download

        + We now know how to set up a “dump” printserver, that is, a server which is spooling print-jobs “raw”, leaving the print data untouched. @@ -374,14 +374,14 @@ Windows and UNIX printing; then follows a description of the CUPS filtering system, how it works and how you can tweak it.

        GDI on Windows -- PostScript on UNIX

        - - + + Network printing is one of the most complicated and error-prone day-to-day tasks any user or administrator may encounter. This is true for all OS platforms. And there are reasons for this.

        - - + + You can't expect most file formats to just throw them toward printers and they get printed. There needs to be a file format conversion in between. The problem is that there is no common standard for @@ -393,10 +393,10 @@ many manufacturers who “roll their own” (their reasons may be unacceptable license fees for using printer-embedded PostScript interpreters, and so on). -

        Windows Drivers, GDI and EMF

        - - - +

        Windows Drivers, GDI and EMF

        + + + In Windows OS, the format conversion job is done by the printer drivers. On MS Windows OS platforms all application programmers have at their disposal a built-in API, the Graphical Device @@ -413,24 +413,24 @@ MetaFile (EMF). The EMF is processed by the printer driver and converted to the printer-specific file format.

        Note

        - + To the GDI foundation in MS Windows, Apple has chosen to put paper and screen output on a common foundation for their (BSD-UNIX-based, did you know?) Mac OS X and Darwin Operating - - - - + + + + Systems. Their Core Graphic Engine uses a PDF derivative for all display work.

        Figure 19.1. Windows printing to a local printer.

        Windows printing to a local printer.

        -

        UNIX Printfile Conversion and GUI Basics

        - - - - +

        UNIX Printfile Conversion and GUI Basics

        + + + + In UNIX and Linux, there is no comparable layer built into the OS kernel(s) or the X (screen display) server. Every application is responsible for itself to create its print output. Fortunately, most @@ -451,7 +451,7 @@ system; there are separate ones for fonts used for X display and fonts to be used on paper.

        Background.  - + The PostScript programming language is an “invention” by Adobe Inc., but its specifications have been published to the full. Its strength lies in its powerful abilities to describe graphical objects (fonts, @@ -468,9 +468,9 @@ produce pixel images, which may be displayed on screen by a viewer program or on paper by a printer.

        PostScript and Ghostscript

        - - - + + + So, UNIX is lacking a common ground for printing on paper and displaying on screen. Despite this unfavorable legacy for UNIX, basic printing is fairly easy if you have PostScript printers at your @@ -483,7 +483,7 @@ you see it on paper, in a resolution as done by your printer. This is no different to PostScript printing a file from a Windows origin.

        Note

        - + Traditional UNIX programs and printing systems while using PostScript are largely not PPD-aware. PPDs are “PostScript Printer Description” files. They enable you to specify and control all @@ -494,7 +494,7 @@

        Figure 19.2. Printing to a PostScript printer.

        Printing to a PostScript printer.

        - + However, there are other types of printers out there. These do not know how to print PostScript. They use their own Page Description Language (PDL, often proprietary). To print to them is much @@ -502,8 +502,8 @@ PostScript, and since these devices do not understand PostScript, you need to convert the print files to a format suitable for your printer on the host before you can send it away. -

        Ghostscript the Software RIP for Non-PostScript Printers

        - +

        Ghostscript the Software RIP for Non-PostScript Printers

        + Here is where Ghostscript kicks in. Ghostscript is the traditional (and quite powerful) PostScript interpreter used on UNIX platforms. It is a RIP in software, capable of doing a @@ -525,14 +525,14 @@ “AFPL” license, but re-released under the GNU GPL as soon as the next AFPL version appears. GNU Ghostscript is probably the version installed on most Samba systems. But it has some deficiencies. - + Therefore, ESP Ghostscript was developed as an enhancement over GNU Ghostscript, with lots of bug-fixes, additional devices and improvements. It is jointly maintained by developers from CUPS, Gimp-Print, MandrakeSoft, SuSE, Red Hat, and Debian. It includes the “cups” device (essential to print to non-PS printers from CUPS). -

        PostScript Printer Description (PPD) Specification

        - +

        PostScript Printer Description (PPD) Specification

        + While PostScript in essence is a Page Description Language (PDL) to represent the page layout in a device-independent way, real-world print jobs are @@ -558,13 +558,13 @@ PostScript, PJL, JCL or vendor-dependent commands) into the PostScript file created by the driver.

        Warning

        - + A PostScript file that was created to contain device-specific commands for achieving a certain print job output (e.g., duplex-ed, stapled and punched) on a specific target machine, may not print as expected, or may not be printable at all on other models; it also may not be fit for further processing by software (e.g., by a PDF distilling program). -

        Using Windows-Formatted Vendor PPDs

        +

        Using Windows-Formatted Vendor PPDs

        CUPS can handle all spec-compliant PPDs as supplied by the manufacturers for their PostScript models. Even if a vendor might not have mentioned our favorite @@ -579,8 +579,8 @@ internal PPD parsing and checking code enabled; in case of printing trouble, this online resource should be one of your first pit-stops.

        Warning

        - - + + For real PostScript printers, do not use the Foomatic or cupsomatic PPDs from Linuxprinting.org. With these devices, the original @@ -593,7 +593,7 @@ access the Windows directory where all printer driver files are stored. First look in the W32X86/2 subdir for the PPD you are seeking. -

        CUPS Also Uses PPDs for Non-PostScript Printers

        +

        CUPS Also Uses PPDs for Non-PostScript Printers

        CUPS also uses specially crafted PPDs to handle non-PostScript printers. These PPDs are usually not available from the vendors (and no, you can't just take the PPD of a PostScript printer with the same @@ -601,7 +601,7 @@ understand how these PPDs work for non-PS printers, we first need to dive deeply into the CUPS filtering and file format conversion architecture. Stay tuned. -

        The CUPS Filtering Architecture

        +

        The CUPS Filtering Architecture

        The core of the CUPS filtering system is based on Ghostscript. In addition to Ghostscript, CUPS uses some other filters of its own. You (or your OS vendor) may have @@ -627,27 +627,27 @@ may encounter the dreaded Unable to convert file 0 in your CUPS error_log file. To have “cups” as a device in your Ghostscript, you either need to patch GNU -Ghostscript and re-compile, or use ESP Ghostscript. The +Ghostscript and re-compile, or use ESP Ghostscript. The superior alternative is ESP Ghostscript. It supports not just CUPS, but 300 other devices too (while GNU Ghostscript supports only about 180). Because of this broad output device support, ESP Ghostscript is the first choice for non-CUPS spoolers, too. It is now recommended by Linuxprinting.org for all spoolers.

        - - + + CUPS printers may be setup to use external rendering paths. One of the most common is provided by the Foomatic/cupsomatic concept from Linuxprinting.org. This uses the classical Ghostscript approach, doing everything in one step. It does not use the “cups” device, but one of the many others. However, even for Foomatic/cupsomatic usage, best results and - + broadest printer model support is provided by ESP Ghostscript (more about cupsomatic/Foomatic, particularly the new version called now foomatic-rip, follows below). -

        MIME Types and CUPS Filters

        - - +

        MIME Types and CUPS Filters

        + + CUPS reads the file /etc/cups/mime.types (and all other files carrying a *.types suffix in the same directory) upon startup. These files contain the MIME @@ -657,7 +657,7 @@ mime.types file itself. A simple rule reads like this: - +

          application/pdf         pdf string(0,%PDF)
         

        @@ -701,9 +701,9 @@ many image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster, PNM, PBM, SGI-RGB, and more) and their associated MIME types with its filters. -

        MIME Type Conversion Rules

        - - +

        MIME Type Conversion Rules

        + + CUPS reads the file /etc/cups/mime.convs (and all other files named with a *.convs suffix in the same directory) upon startup. These files contain @@ -722,7 +722,7 @@ cost of this operation is 33 CUPS-$. The next filter is more expensive, costing 66 CUPS-$: - +

          application/vnd.hp-HPGL application/postscript   66   hpgltops
        @@ -731,7 +731,7 @@
         This is the hpgltops, which processes HP-GL
         plotter files to PostScript.
         
        -
        +
         
         

          application/octet-stream
        @@ -739,7 +739,7 @@
         
         Here are two more examples: 
         
        -
        +
         
         

          application/x-shell     application/postscript   33    texttops
        @@ -750,8 +750,8 @@
         to work on text/plain as well as on application/x-shell. (Hint:
         This differentiation is needed for the syntax highlighting feature of
         texttops).
        -

        Filtering Overview

        - +

        Filtering Overview

        + There are many more combinations named in mime.convs. However, you are not limited to use the ones pre-defined there. You can plug in any filter you like into the CUPS framework. It must meet, or must be made @@ -760,7 +760,7 @@ needs and put in the right lines in mime.types and mime.convs, then it will work seamlessly inside CUPS. -

        Filter requirements

        +

        Filter requirements

        The mentioned “CUPS requirements” for filters are simple. Take filenames or stdin as input and write to stdout. They should take these 5 or 6 arguments: @@ -772,8 +772,8 @@ attribute.

        options

        The job options.

        filename

        (Optionally) The print request file (if missing, filters expected data fed through stdin). In most cases, it is easy to write a simple wrapper script around existing -filters to make them work with CUPS.

        Prefilters

        - +filters to make them work with CUPS.

        Prefilters

        + As previously stated, PostScript is the central file format to any UNIX-based printing system. From PostScript, CUPS generates raster data to feed non-PostScript printers. @@ -792,7 +792,7 @@ print options already embedded into the file.

        Figure 19.4. Pre-filtering in CUPS to form PostScript.

        Pre-filtering in CUPS to form PostScript.

        -

        pstops

        +

        pstops

        pstops is the filter to convert application/postscript to application/vnd.cups-postscript. It was said @@ -812,7 +812,7 @@ so-called “number-up” function).

      17. Counting the pages of the job to insert the accounting information into the /var/log/cups/page_log. -

      18. pstoraster

        +

        pstoraster

        pstoraster is at the core of the CUPS filtering system. It is responsible for the first stage of the rasterization process. Its input is of MIME type application/vnd.cups-postscript; @@ -848,7 +848,7 @@ parameter. If your Ghostscript does not show a success on asking for gs -h |grep cups, you might not be able to print. Update your Ghostscript. -

        imagetops and imagetoraster

        +

        imagetops and imagetoraster

        In the section about pre-filters, we mentioned the pre-filter that generates PostScript from image formats. The imagetoraster filter is used to convert directly from image to raster, without the @@ -857,7 +857,7 @@ filtering on next picture.

        Figure 19.8. Image format to CUPS-raster format conversion.

        Image format to CUPS-raster format conversion.

        -

        rasterto [printers specific]

        +

        rasterto [printers specific]

        CUPS ships with quite different raster drivers processing CUPS raster. On my system I find in /usr/lib/cups/filter/ these: rastertoalps, rastertobj, rastertoepson, rastertoescp, @@ -871,7 +871,7 @@ closely as possible with CUPS.

        Figure 19.9. Raster to printer-specific formats.

        Raster to printer-specific formats.

        -

        CUPS Backends

        +

        CUPS Backends

        The last part of any CUPS filtering chain is a backend. Backends are special programs that send the print-ready file to the final device. There is a separate backend program for any transfer @@ -952,9 +952,9 @@ all available backends:

         $ lpinfo -v
        -

        The Role of cupsomatic/foomatic

        - - +

        The Role of cupsomatic/foomatic

        + + cupsomatic filters may be the most widely used on CUPS installations. You must be clear about the fact that these were not developed by the CUPS people. They are a third party add-on to @@ -980,7 +980,7 @@ auto-constructed from the selected PPD and command line options give to the print-job.

        - + However, cupsomatic is now deprecated. Its PPDs (especially the first generation of them, still in heavy use out there) are not meeting the Adobe specifications. You might also suffer difficulties when you try @@ -1004,11 +1004,11 @@ best thing is the new foomatic-rip now works seamlessly with all legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR and so on), providing for them access to use PPDs for their printing. -

        The Complete Picture

        +

        The Complete Picture

        If you want to see an overview of all the filters and how they relate to each other, the complete picture of the puzzle is at the end of this document. -

        mime.convs

        +

        mime.convs

        CUPS auto-constructs all possible filtering chain paths for any given MIME type, and every printer installed. But how does it decide in favor or against a specific alternative? (There may often be cases @@ -1025,7 +1025,7 @@ server by setting an appropriate “FilterLimit” value. A FilterLimit of 200 allows roughly one job at a time, while a FilterLimit of 1000 allows approximately five jobs maximum at a time. -

        Raw” Printing

        +

        Raw” Printing

        You can tell CUPS to print (nearly) any file “raw”. “Raw” means it will not be filtered. CUPS will send the file to the printer “as is” without bothering if the printer is able to digest it. Users need to @@ -1046,7 +1046,7 @@ if it can't find a PPD associated with the queue. However, CUPS will only send known MIME types (as defined in its own mime.types file) and refuse others. -

        application/octet-stream Printing

        +

        application/octet-stream Printing

        Any MIME type with no rule in the /etc/cups/mime.types file is regarded as unknown or application/octet-stream and will not be @@ -1065,7 +1065,7 @@ application/octet-stream. In /etc/cups/mime.types make sure this line is present: - +

         application/octet-stream
        @@ -1080,7 +1080,7 @@
         application/octet-stream   application/vnd.cups-raw   0   -
         

        - + This line tells CUPS to use the Null Filter (denoted as “-”, doing nothing at all) on @@ -1106,8 +1106,8 @@ recognizes MIME types. The file /etc/cups/mime.convs decides which file conversion filter(s) may be applied to which MIME types. -

        PostScript Printer Descriptions (PPDs) for Non-PS Printers

        - +

        PostScript Printer Descriptions (PPDs) for Non-PS Printers

        + Originally PPDs were meant to be used for PostScript printers only. Here, they help to send device-specific commands and settings to the RIP which processes the job file. CUPS has extended this @@ -1121,7 +1121,7 @@ PPDs for a non-PS printer have a few lines that are unique to CUPS. The most important one looks similar to this: - +

          *cupsFilter: application/vnd.cups-raster  66   rastertoprinter
        @@ -1142,13 +1142,13 @@
         different paper trays, or you may get larger margins than your
         specific model supports. See PPDs shipped with CUPS for summary information.
         

        Table 19.1. PPDs shipped with CUPS

        PPD filePrinter type
        deskjet.ppdolder HP inkjet printers and compatible
        deskjet2.ppdnewer HP inkjet printers and compatible
        dymo.ppdlabel printers
        epson9.ppdEpson 24pin impact printers and compatible
        epson24.ppdEpson 24pin impact printers and compatible
        okidata9.ppdOkidata 9pin impact printers and compatible
        okidat24.ppdOkidata 24pin impact printers and compatible
        stcolor.ppdolder Epson Stylus Color printers
        stcolor2.ppdnewer Epson Stylus Color printers
        stphoto.ppdolder Epson Stylus Photo printers
        stphoto2.ppdnewer Epson Stylus Photo printers
        laserjet.ppdall PCL printers. Further below is a discussion - of several other driver/PPD-packages suitable for use with CUPS.

        cupsomatic/foomatic-rip Versus native CUPS Printing

        - - + of several other driver/PPD-packages suitable for use with CUPS.

        cupsomatic/foomatic-rip Versus native CUPS Printing

        + + Native CUPS rasterization works in two steps:

        • First is the pstoraster step. It uses the special CUPS - + device from ESP Ghostscript 7.05.x as its tool.

        • Second comes the rasterdriver step. It uses various @@ -1163,7 +1163,7 @@ One other method is the cupsomatic/foomatic-rip way. Note that cupsomatic is not made by the CUPS developers. It is an independent contribution to printing development, -made by people from Linuxprinting.org [5]. +made by people from Linuxprinting.org [5]. cupsomatic is no longer developed and maintained and is no longer supported. It has now been replaced by foomatic-rip. foomatic-rip is a complete re-write @@ -1172,8 +1172,8 @@ advised, especially if you are upgrading to a recent version of CUPS, too.

          - - + + Both the cupsomatic (old) and the foomatic-rip (new) methods from Linuxprinting.org use the traditional Ghostscript print file processing, doing everything in a single step. It therefore relies on @@ -1195,7 +1195,7 @@ cupsomatic hands the rendered file directly to the CUPS backend. The flowchart in cupsomatic/foomatic processing versus Native CUPS illustrates the difference between native CUPS rendering and the Foomatic/cupsomatic method. -

        Examples for Filtering Chains

        +

        Examples for Filtering Chains

        Here are a few examples of commonly occurring filtering chains to illustrate the workings of CUPS.

        @@ -1244,11 +1244,11 @@ print-options into the print data stream.

      19. The file goes to the usb backend, which transfers the job to the printers.

      20. The resulting filter chain therefore is as drawn in this figure. -

        Figure 19.12. PDF to USB chain.

        PDF to USB chain.

        Sources of CUPS Drivers/PPDs

        +

        Figure 19.12. PDF to USB chain.

        PDF to USB chain.

        Sources of CUPS Drivers/PPDs

        On the Internet you can now find many thousands of CUPS-PPD files (with their companion filters), in many national languages supporting more than thousand non-PostScript models. -

        • ESP +

          • ESP PrintPro (commercial, non-free) is packaged with more than three thousand PPDs, ready for successful use “out of the box” on Linux, Mac OS X, IBM-AIX, @@ -1273,7 +1273,7 @@ excellent print quality now (currently available only via the Foomatic path).

          • Foomatic/cupsomatic (LPGL, free) from Linuxprinting.org are providing PPDs for practically every Ghostscript -filter known to the world (including Omni, Gimp-Print and HPIJS).

        Printing with Interface Scripts

        +filter known to the world (including Omni, Gimp-Print and HPIJS).

        Printing with Interface Scripts

        CUPS also supports the usage of “interface scripts” as known from System V AT&T printing systems. These are often used for PCL printers, from applications that generate PCL print jobs. Interface @@ -1294,16 +1294,16 @@ custom-written filtering script or program into one specific print queue (some information about the traditional usage of interface scripts is to be found at http://playground.sun.com/printing/documentation/interface.html). -

        Network Printing (Purely Windows)

        +

        Network Printing (Purely Windows)

        Network printing covers a lot of ground. To understand what exactly goes on with Samba when it is printing on behalf of its Windows clients, let's first look at a “purely Windows” setup: Windows clients with a Windows NT print server. -

        From Windows Clients to an NT Print Server

        +

        From Windows Clients to an NT Print Server

        Windows clients printing to an NT-based print server have two options. They may: - - + +

        • Execute the driver locally and render the GDI output (EMF) into the printer-specific format on their own.

        • Send the GDI output (EMF) to the server, where the @@ -1311,7 +1311,7 @@ output.

        Both print paths are shown in the flowcharts Print driver execution on the client and Print driver execution on the server. -

        Driver Execution on the Client

        +

        Driver Execution on the Client

        In the first case the print server must spool the file as raw, meaning it shouldn't touch the jobfile and try to convert it in any way. This is what a traditional UNIX-based print server can do too, and @@ -1323,12 +1323,12 @@ clients.

        Figure 19.13. Print driver execution on the client.

        Print driver execution on the client.

        -

        Driver Execution on the Server

        - - - - - +

        Driver Execution on the Server

        + + + + + The other path executes the printer driver on the server. The client transfers print files in EMF format to the server. The server uses the PostScript, PCL, ESC/P or other driver to convert the EMF file into @@ -1340,14 +1340,14 @@

        Figure 19.14. Print driver execution on the server.

        Print driver execution on the server.

        However, there is something similar possible with CUPS. Read on. -

        Network Printing (Windows Clients UNIX/Samba Print +

        Network Printing (Windows Clients UNIX/Samba Print Servers)

        Since UNIX print servers cannot execute the Win32 program code on their platform, the picture is somewhat different. However, this does not limit your options all that much. On the contrary, you may have a way here to implement printing features that are not possible otherwise. -

        From Windows Clients to a CUPS/Samba Print Server

        +

        From Windows Clients to a CUPS/Samba Print Server

        Here is a simple recipe showing how you can take advantage of CUPS' powerful features for the benefit of your Windows network printing clients: @@ -1360,13 +1360,13 @@ First, to enable CUPS-based printing through Samba the following options should be set in your smb.conf file [global] section: -

        +

        - printing = cups
        + printing = cups
        printcap = cups

        When these parameters are specified, all manually set print directives -(like print command, or lppause command) in smb.conf (as well as +(like print command, or lppause command) in smb.conf (as well as in Samba itself) will be ignored. Instead, Samba will directly interface with CUPS through its application program interface (API), as long as Samba has been compiled with CUPS library (libcups) @@ -1375,12 +1375,12 @@ System V AT&T command set, with the -oraw option automatically passing through (if you want your own defined print commands to work with a Samba that has CUPS support compiled in, -simply use printing = sysv). +simply use printing = sysv).

        Figure 19.15. Printing via CUPS/Samba server.

        Printing via CUPS/Samba server.

        -

        Samba Receiving Job-files and Passing Them to CUPS

        +

        Samba Receiving Job-files and Passing Them to CUPS

        Samba must use its own spool directory (it is set -by a line similar to path = /var/spool/samba, +by a line similar to path = /var/spool/samba, in the [printers] or [printername] section of smb.conf). Samba receives the job in its own @@ -1396,13 +1396,13 @@ configured). If Samba runs on the same host as CUPS, you only need to allow “localhost” to print. If they run on different machines, you need to make sure the Samba host gets access to printing on CUPS. -

        Network PostScript RIP

        +

        Network PostScript RIP

        This section discusses the use of CUPS filters on the server configuration where clients make use of a PostScript driver with CUPS-PPDs.

        - - - + + + PPDs can control all print device options. They are usually provided by the manufacturer, if you own a PostScript printer, that is. PPD files (PostScript Printer Descriptions) are always a component of @@ -1421,8 +1421,8 @@ different GUI front-ends on Linux/UNIX, which can present PPD options to users. PPD options are normally meant to be evaluated by the PostScript RIP on the real PostScript printer. -

        PPDs for Non-PS Printers on UNIX

        - +

        PPDs for Non-PS Printers on UNIX

        + CUPS does not limit itself to “real” PostScript printers in its usage of PPDs. The CUPS developers have extended the scope of the PPD concept to also describe available device and driver options for @@ -1439,8 +1439,8 @@ PostScript devices to its clients, because it can act as a PostScript RIP for those printers, processing the received PostScript code into a proper raster print format. -

        PPDs for Non-PS Printers on Windows

        - +

        PPDs for Non-PS Printers on Windows

        + CUPS-PPDs can also be used on Windows-Clients, on top of a “core” PostScript driver (now recommended is the "CUPS PostScript Driver for Windows NT/200x/XP"; you can also use the Adobe one, with @@ -1456,13 +1456,13 @@ driver, even for many different target printers.

        Using CUPS PPDs on Windows clients enables these to control all print job settings just as a UNIX client can do. -

        Windows Terminal Servers (WTS) as CUPS Clients

        +

        Windows Terminal Servers (WTS) as CUPS Clients

        This setup may be of special interest to people experiencing major problems in WTS environments. WTS often need a multitude of non-PostScript drivers installed to run their clients' variety of different printer models. This often imposes the price of much increased instability. -

        Printer Drivers Running in “Kernel Mode” Cause Many +

        Printer Drivers Running in “Kernel Mode” Cause Many Problems

        In Windows NT printer drivers which run in “Kernel Mode”, introduces a high risk for the stability of the system @@ -1479,7 +1479,7 @@ drivers: the ones from Adobe and the one from Microsoft. Both are well tested and are as stable as you can imagine on Windows. The CUPS driver is derived from the Microsoft one. -

        Workarounds Impose Heavy Limitations

        +

        Workarounds Impose Heavy Limitations

        In many cases, in an attempt to work around this problem, site administrators have resorted to restricting the allowed drivers installed on their WTS to one generic PCL and one PostScript driver. This, @@ -1487,9 +1487,9 @@ available for them. Often they can't get out more than simplex prints from one standard paper tray, while their devices could do much better, if driven by a different driver! -

        CUPS: A “Magical Stone”?

        - - +

        CUPS: A “Magical Stone”?

        + + Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these shortcomings. There are, depending on the version of Windows OS you use, up to three different PostScript @@ -1501,9 +1501,9 @@ RIP for its clients requires more CPU and RAM than when just acting as a “raw spooling” device. Plus, this setup is not yet widely tested, although the first feedbacks look very promising. -

        PostScript Drivers with No Major Problems Even in Kernel +

        PostScript Drivers with No Major Problems Even in Kernel Mode

        - + More recent printer drivers on W200x and XP no longer run in kernel mode (unlike Windows NT). However, both operating systems can still use the NT drivers, running in kernel mode (you can roughly tell which @@ -1519,15 +1519,15 @@ license does not allow them to publish the whole of the source code. However, they have released the “diff” under the GPL, and if you are the owner of an “MS DDK for Windows NT,” you can check the driver yourself. -

        Configuring CUPS for Driver Download

        +

        Configuring CUPS for Driver Download

        As we have said before, all previously known methods to prepare client printer drivers on the Samba server for download and Point'n'Print convenience of Windows workstations are working with CUPS, too. These methods were described in the previous chapter. In reality, this is a pure Samba business and only relates to the Samba/Windows client relationship. -

        cupsaddsmb: The Unknown Utility

        - +

        cupsaddsmb: The Unknown Utility

        + The cupsaddsmb utility (shipped with all current CUPS versions) is an alternate method to transfer printer drivers into the Samba [print$] share. Remember, this share is where @@ -1552,45 +1552,45 @@ However, currently only Windows NT, 2000 and XP are supported by the CUPS drivers. You will also need to get the respective part of Adobe driver if you need to support Windows 95, 98 and ME clients. -

        Prepare Your smb.conf for cupsaddsmb

        +

        Prepare Your smb.conf for cupsaddsmb

        Prior to running cupsaddsmb, you need the settings in smb.conf as shown in the next example: -

        Example 19.3. smb.conf for cupsaddsmb usage

        [global]
        +

        Example 19.3. smb.conf for cupsaddsmb usage

        [global]
        - load printers = yes
        + load printers = yes
        - printing = cups
        + printing = cups
        - printcap name = cups
        [printers]
        + printcap name = cups
        [printers]
        - comment = All Printers
        + comment = All Printers
        - path = /var/spool/samba
        + path = /var/spool/samba
        - browseable = no
        + browseable = no
        - public = yes
        # setting depends on your requirements
        + public = yes
        # setting depends on your requirements
        - guest ok = yes
        + guest ok = yes
        - writable = no
        + writable = no
        - printable = yes
        + printable = yes
        - printer admin = root
        [print$]
        + printer admin = root
        [print$]
        - comment = Printer Drivers
        + comment = Printer Drivers
        - path = /etc/samba/drivers
        + path = /etc/samba/drivers
        - browseable = yes
        + browseable = yes
        - guest ok = no
        + guest ok = no
        - read only = yes
        + read only = yes
        - write list = root

        CUPS “PostScript Driver for Windows NT/200x/XP

        - + write list = root

        CUPS “PostScript Driver for Windows NT/200x/XP

        + CUPS users may get the exact same packages from http://www.cups.org/software.html. It is a separate package from the CUPS base software files, tagged as CUPS 1.1.x Windows NT/200x/XP Printer Driver for Samba @@ -1605,8 +1605,8 @@ cups-samba.remove cups-samba.ss

        - - + + These have been packaged with the ESP meta packager software EPM. The *.install and *.remove files are simple shell scripts, which @@ -1644,7 +1644,7 @@

         root# cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
         

        - + This new CUPS PostScript driver is currently binary-only, but free of charge. No complete source code is provided (yet). The reason is that it has been developed with the help of the Microsoft Driver @@ -1653,7 +1653,7 @@ the source code as free software. However, CUPS developers released the “diff” in source code under the GPL, so anybody with a license of Visual Studio and a DDK will be able to compile for him/herself. -

        Recognizing Different Driver Files

        +

        Recognizing Different Driver Files

        The CUPS drivers do not support the older Windows 95/98/Me, but only the Windows NT/2000/XP client.

        Windows NT, 2000 and XP are supported by:

        @@ -1673,7 +1673,7 @@ and the CUPS ones will be used. If you prefer for whatever reason to use Adobe-only drivers, move away the three CUPS driver files. The Windows 9x/Me clients use the Adobe drivers in any case. -

        Acquiring the Adobe Driver Files

        +

        Acquiring the Adobe Driver Files

        Acquiring the Adobe driver files seems to be unexpectedly difficult for many users. They are not available on the Adobe Web site as single files and the self-extracting and/or self-installing Windows-.exe is @@ -1684,8 +1684,8 @@ Generic PostScript printer. After this, the client's [print$] share holds the Adobe files, from where you can get them with smbclient from the CUPS host. -

        ESP Print Pro PostScript Driver for Windows NT/200x/XP

        - +

        ESP Print Pro PostScript Driver for Windows NT/200x/XP

        + Users of the ESP Print Pro software are able to install their Samba drivers package for this purpose with no problem. Retrieve the driver files from the normal download area of the ESP Print Pro software @@ -1700,8 +1700,8 @@ share, and so on. The ESP Print Pro package includes the CUPS driver files as well as a (licensed) set of Adobe drivers for the Windows 95/98/Me client family. -

        Caveats to be Considered

        - +

        Caveats to be Considered

        + Once you have run the install script (and possibly manually moved the cups.hlp file to /usr/share/cups/drivers/), the driver is @@ -1712,7 +1712,7 @@ cupsaddsmb (see also man cupsaddsmb for CUPS since release 1.1.16).

        Tip

        - + You may need to put root into the smbpasswd file by running smbpasswd; this is especially important if you should run this whole procedure for the first time, and are not @@ -1733,7 +1733,7 @@ directory. The new cupsaddsmb (from 1.1.16) will automatically prefer its own drivers if it finds both.

        Note

        - + Should your Windows clients have had the old ADOBE*.* files for the Adobe PostScript driver installed, the download and installation of the new CUPS PostScript driver for Windows NT/200x/XP @@ -1751,20 +1751,20 @@ using this driver in the Printers folder first. You will need Administrator privileges to do this.

        Note

        - + Once you have successfully downloaded the CUPS PostScript driver to a client, you can easily switch all printers to this one by proceeding as described in Classical Printing Support. Either change a driver for an existing printer by running the Printer Properties dialog, or use rpcclient with the setdriver subcommand. -

        Windows CUPS PostScript Driver Versus Adobe Driver

        +

        Windows CUPS PostScript Driver Versus Adobe Driver

        Are you interested in a comparison between the CUPS and the Adobe PostScript drivers? For our purposes these are the most important items that weigh in favor of the CUPS ones:

        • No hassle with the Adobe EULA.

        • No hassle with the question “Where do I get the ADOBE*.* driver files from?

        • - + The Adobe drivers (on request of the printer PPD associated with them) often put a PJL header in front of the main PostScript part of the print file. Thus, the printfile starts with @@ -1774,10 +1774,10 @@ CUPS daemon auto-typing the incoming file as a print-ready file, not initiating a pass through the pstops filter (to speak more technically, it is not regarded as the generic MIME-type - + application/postscript, but as the more special MIME type - + application/cups.vnd-postscript), which therefore also leads to the page accounting in /var/log/cups/page_log not @@ -1807,9 +1807,9 @@ and simply ignore it).

        • The CUPS PostScript driver will be the heart of the fully fledged CUPS IPP client for Windows NT/200x/XP to be released soon (probably alongside the first beta release for CUPS -1.2).

        Run cupsaddsmb (Quiet Mode)

        - - +1.2).

        Run cupsaddsmb (Quiet Mode)

        + + The cupsaddsmb command copies the needed files into your [print$] share. Additionally, the PPD associated with this printer is copied from @@ -1818,7 +1818,7 @@ Windows client installations via Point'n'Print. Before we can run the command successfully, we need to be sure that we can authenticate toward Samba. If you have a small network, you are probably using user-level -security (security = user). +security (security = user).

        Here is an example of a successfully run cupsaddsmb command:

        @@ -1829,8 +1829,8 @@
         -a parameter instead of a printer name. Since
         cupsaddsmbexports” the printer drivers to Samba, it should be
         obvious that it only works for queues with a CUPS driver associated.
        -

        Run cupsaddsmb with Verbose Output

        - +

        Run cupsaddsmb with Verbose Output

        + Probably you want to see what's going on. Use the -v parameter to get a more verbose output. The output below was edited for better readability: all “\” at the end of @@ -1841,8 +1841,8 @@ screen.

        - - + +

         root# cupsaddsmb -U root -v infotec_2105
         Password for root required to access localhost via GANDALF:
        @@ -1909,23 +1909,23 @@
         If you look closely, you'll discover your root password was transferred
         unencrypted over the wire, so beware! Also, if you look further,
         you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because the directories WIN40 and W32X86 already existed in the [print$] driver download share (from a previous driver installation). They are harmless here.
        -

        Understanding cupsaddsmb

        - +

        Understanding cupsaddsmb

        + What has happened? What did cupsaddsmb do? There are five stages of the procedure:

        1. - + Call the CUPS server via IPP and request the driver files and the PPD file for the named printer.

        2. Store the files temporarily in the local TEMPDIR (as defined in cupsd.conf).

        3. Connect via smbclient to the Samba server's [print$] share and put the files into the share's WIN40 (for Windows 9x/Me) and W32X86/ (for Windows NT/200x/XP) subdirectories.

        4. - + Connect via rpcclient to the Samba server and execute the adddriver command with the correct parameters.

        5. - + Connect via rpcclient to the Samba server a second time and execute the setdriver command.

        Note

        You can run the cupsaddsmb utility with parameters to @@ -1936,7 +1936,7 @@ same host):

         root# cupsaddsmb -H sambaserver -h cupsserver -v printer
        -

        How to Recognize If cupsaddsmb Completed Successfully

        +

        How to Recognize If cupsaddsmb Completed Successfully

        You must always check if the utility completed successfully in all fields. You need as a minimum these three messages among the output: @@ -1958,7 +1958,7 @@ SetPrinter call failed! result was WERR_ACCESS_DENIED

        -It means that you might have set use client driver = yes for this printer. +It means that you might have set use client driver = yes for this printer. Set it to “no” will solve the problem. Refer to man samba(5) for explanantion on use client driver.

        Note

        @@ -1966,8 +1966,8 @@ cupsaddsmb in verbose mode. Therefore, we strongly recommend to not use the default quiet mode. It will hide any problems from you that might occur. -

        cupsaddsmb with a Samba PDC

        - +

        cupsaddsmb with a Samba PDC

        + Can't get the standard cupsaddsmb command to run on a Samba PDC? Are you asked for the password credential all over again and again and the command just will not take off at all? Try one of these @@ -1979,21 +1979,21 @@

        (Note the two backslashes: the first one is required to “escape” the second one). -

        cupsaddsmb Flowchart

        - +

        cupsaddsmb Flowchart

        + cupsaddsmb flowchart shows a chart about the procedures, command-flows and data-flows of the cupaddsmb command. Note again: cupsaddsmb is not intended to, and does not work with, raw queues!

        Figure 19.16. cupsaddsmb flowchart.

        cupsaddsmb flowchart.

        -

        Installing the PostScript Driver on a Client

        - +

        Installing the PostScript Driver on a Client

        + After cupsaddsmb is completed, your driver is prepared for the clients to use. Here are the steps you must perform to download and install it via Point'n'Print. From a Windows client, browse to the CUPS/Samba server:

        • - + Open the Printers share of Samba in Network Neighborhood.

        • Right-click on the printer in question.

        • From the opening context-menu select @@ -2009,7 +2009,7 @@ \\SambaServer\PrinterName entry in the drop-down list of available printers.

          - + cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher and Samba from 2.2.4. If it does not work, or if the automatic printer driver download to the clients does not succeed, you can still manually @@ -2024,7 +2024,7 @@ with the required privileges to access the printershare.) This sets up the printer connection in the traditional LanMan way (not using MS-RPC). -

        Avoiding Critical PostScript Driver Settings on the Client

        +

        Avoiding Critical PostScript Driver Settings on the Client

        Printing works, but there are still problems. Most jobs print well, some do not print at all. Some jobs have problems with fonts, which do not look very good. Some jobs print fast and some are @@ -2049,7 +2049,7 @@ Level: In case of problems try 2 instead of 3 (the latest ESP Ghostscript package handles Level 3 PostScript very well) (Adobe).

      21. Say Yes to PostScript -Error Handler (Adobe).

      22. Installing PostScript Driver Files Manually Using rpcclient

        +Error Handler (Adobe).

        Installing PostScript Driver Files Manually Using rpcclient

        Of course, you can run all the commands that are embedded into the cupsaddsmb convenience utility yourself, one by one, and hereby upload and prepare the driver files for future client downloads. @@ -2057,17 +2057,17 @@ printer should be there. We are providing the driver now).

      23. Copy all files to [print$].

      24. - + Run rpcclient adddriver (for each client architecture you want to support).

      25. - + Run rpcclient setdriver.

      26. - - - - - + + + + + We are going to do this now. First, read the man page on rpcclient to get a first idea. Look at all the printing related subcommands. enumprinters, @@ -2078,7 +2078,7 @@ (or 200x/XP) PC, too. MS-RPC is used by Windows clients, among other things, to benefit from the Point'n'Print features. Samba can now mimic this as well. -

        A Check of the rpcclient man Page

        +

        A Check of the rpcclient man Page

        First let's check the rpcclient man page. Here are two relevant passages:

        @@ -2111,13 +2111,13 @@ driver must already be correctly installed on the print server.

        See also the enumprinters and enumdrivers commands for obtaining a list of installed printers and drivers. -

        Understanding the rpcclient man Page

        +

        Understanding the rpcclient man Page

        The exact format isn't made too clear by the man page, since you have to deal with some parameters containing spaces. Here is a better description for it. We have line-broken the command and indicated the breaks with “\”. Usually you would type the command in one line without the line-breaks: - +

          adddriver "Architecture" \
                    "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
        @@ -2146,9 +2146,9 @@
         with rpcclient to see what it tells us and
         try to understand the man page more clearly that we've read just
         now.
        -

        Producing an Example by Querying a Windows Box

        - - +

        Producing an Example by Querying a Windows Box

        + + We could run rpcclient with a getdriver or a getprinter subcommand (in level 3 verbosity) against it. Just sit down at a UNIX or @@ -2159,7 +2159,7 @@

        From the result it should become clear which is which. Here is an example from my installation:

        - +

         root# rpcclient -U'Danka%xxxx' W200xSERVER \
         	-c'getdriver "DANKA InfoStream Virtual Printer" 3'
        @@ -2192,16 +2192,16 @@
         ListOfFiles,Comma-separated. For the CUPS
         PostScript drivers, we do not need any (nor would we for the Adobe
         PostScript driver), therefore, the field will get a “NULL” entry.
        -

        Requirements for adddriver and setdriver to Succeed

        +

        Requirements for adddriver and setdriver to Succeed

        >From the man page (and from the quoted output of cupsaddsmb above) it becomes clear that you need to have certain conditions in order to make the manual uploading and initializing of the driver files succeed. The two rpcclient - + subcommands (adddriver and setdriver) need to encounter the following preconditions to complete successfully: -

        • You are connected as printer admin or root (this is not the “Printer Operators” group in +

          • You are connected as printer admin or root (this is not the “Printer Operators” group in NT, but the printer admin group as defined in the [global] section of smb.conf).

          • Copy all required driver files to @@ -2216,8 +2216,8 @@ the [print$] share and create subdirectories.

          • The printer you are going to setup for the Windows clients needs to be installed in CUPS already.

          • - - + + The CUPS printer must be known to Samba, otherwise the setdriver subcommand fails with an NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by @@ -2226,7 +2226,7 @@ printer list until every smbd process had received a SIGHUP or was restarted. Remember this in case you've created the CUPS printer just recently and encounter problems: try restarting -Samba.

        Manual Driver Installation in 15 Steps

        +Samba.

        Manual Driver Installation in 15 Steps

        We are going to install a printer driver now by manually executing all required commands. As this may seem a rather complicated process at first, we go through the procedure step by step, explaining every @@ -2240,7 +2240,7 @@ (a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root for this step.

      27. (Optional) Check if the printer is recognized by Samba.

        - +

         	root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost \
           | grep -C2 mysmbtstprn
        @@ -2261,8 +2261,8 @@
         users from the “write list” as defined in smb.conf for
         [print$].
         

      28. (Optional) Check if Samba knows a driver for the printer.

        - - + +

         root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
         			| grep driver 
        @@ -2319,7 +2319,7 @@
         The driver files now are in the W32X86 architecture “root” of
         [print$].
         

      29. Tell Samba that these are driver files (adddriver).

        - +

         root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \
         	"mydrivername:cupsdrvr.dll:mysmbtstprn.PPD: \
        @@ -2353,7 +2353,7 @@
         Notice how step 6 also moved the driver files to the appropriate
         subdirectory. Compare this with the situation after step 5.
         

      30. (Optional) Verify if Samba now recognizes the driver.

        - +

         root# rpcclient -Uroot%xxxx -c 'enumdrivers 3' \
         	localhost | grep -B2 -A5 mydrivername
        @@ -2369,7 +2369,7 @@
         Remember, this command greps for the name you chose for the
         driver in step 6. This command must succeed before you can proceed.
         

      31. Tell Samba which printer should use these driver files (setdriver).

        - +

         root# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' \
         	localhost
        @@ -2382,9 +2382,9 @@
         enumdrivers must find the driver and
         enumprinters must find the printer.
         

      32. (Optional) Verify if Samba has recognized this association.

        - - - + + +

         root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
           | grep driver
        @@ -2424,13 +2424,13 @@
              comment:[mysmbtstprn]
         
         

        - + Compare these results with the ones from steps 2 and 3. Every one of these commands show the driver is installed. Even the enumprinters command now lists the driver on the “description” line.

      33. (Optional) Tickle the driver into a correct device mode.

        - + You certainly know how to install the driver on the client. In case you are not particularly familiar with Windows, here is a short recipe: Browse the Network Neighborhood, go to the Samba server, and look @@ -2455,7 +2455,7 @@ back.

      34. Install the printer on a client (Point'n'Print).

        - +

         C:\> rundll32 printui.dll,PrintUIEntry /in /n “\\sambaserver\mysmbtstprn
         

        @@ -2474,7 +2474,7 @@

      35. (Obligatory) Enjoy. Jump. Celebrate your success.

         root# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd
        -
      36. Troubleshooting Revisited

        +

        Troubleshooting Revisited

        The setdriver command will fail, if in Samba's mind the queue is not already there. You had promising messages about the:

        @@ -2485,7 +2485,7 @@
         

        result was NT_STATUS_UNSUCCESSFUL

        - + It is not good enough that you can see the queue in CUPS, using the lpstat -p ir85wm command. A @@ -2496,14 +2496,14 @@ execute the setdriver command successfully, check if Samba “sees” the printer:

        - +

         root# rpcclient transmeta -N -U'root%xxxx' -c 'enumprinters 0'|grep ir85wm
                 printername:[ir85wm]
         

        An alternate command could be this:

        - +

         root# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' 
                 cmd = getprinter ir85wm
        @@ -2514,20 +2514,20 @@
         

        By the way, you can use these commands, plus a few more, of course, to install drivers on remote Windows NT print servers too! -

        The Printing *.tdb Files

        - - - - - - - - - - - - - +

        The Printing *.tdb Files

        + + + + + + + + + + + + + Some mystery is associated with the series of files with a tdb suffix appearing in every Samba installation. They are connections.tdb, @@ -2542,8 +2542,8 @@ ntprinters.tdb, sessionid.tdb and secrets.tdb. What is their purpose? -

        Trivial Database Files

        - +

        Trivial Database Files

        + A Windows NT (print) server keeps track of all information needed to serve its duty toward its clients by storing entries in the Windows registry. Client queries are answered by reading from the registry, @@ -2556,7 +2556,7 @@ are ntprinters.tdb, printing.tdb,ntforms.tdb and ntdrivers.tdb. -

        Binary Format

        +

        Binary Format

        *.tdb files are not human readable. They are written in a binary format. “Why not ASCII?”, you may ask. “After all, ASCII configuration files are a good and proven tradition on UNIX.” @@ -2569,7 +2569,7 @@ *.tdb files allows for this provision. Many smbd processes may write to the same *.tdb file at the same time. This wouldn't be possible with pure ASCII files. -

        Losing *.tdb Files

        +

        Losing *.tdb Files

        It is very important that all *.tdb files remain consistent over all write and read accesses. However, it may happen that these files do get corrupted. (A @@ -2579,9 +2579,9 @@ *.tdb files may be the only option. After that you need to re-create all print-related setup or you have made a backup of the *.tdb files in time. -

        Using tdbbackup

        - - +

        Using tdbbackup

        + + Samba ships with a little utility that helps the root user of your system to backup your *.tdb files. If you run it with no argument, it prints a usage message: @@ -2610,12 +2610,12 @@ -rw------- 1 root root 40960 May 2 03:44 printing.tdb -rw------- 1 root root 40960 May 2 03:44 printing.tdb.bak -

        CUPS Print Drivers from Linuxprinting.org

        - +

        CUPS Print Drivers from Linuxprinting.org

        + CUPS ships with good support for HP LaserJet-type printers. You can install the generic driver as follows:

        - +

         root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
         

        @@ -2636,7 +2636,7 @@ tireless work of Till Kamppeter from MandrakeSoft, who is also the principal author of the foomatic-rip utility.

        Note

        - + The former cupsomatic concept is now being replaced by the new successor, a much more powerful foomatic-rip. @@ -2648,9 +2648,9 @@ PPDs are 100% compliant to the Adobe PPD specification. They are also intended to be used by Samba and the cupsaddsmb utility, to provide the driver files for the Windows clients! -

        foomatic-rip and Foomatic Explained

        - - +

        foomatic-rip and Foomatic Explained

        + + Nowadays, most Linux distributions rely on the utilities of Linuxprinting.org to create their printing-related software (which, by the way, works on all UNIXes and on Mac OS X or Darwin, too). It is not known as well as it @@ -2667,7 +2667,7 @@ database. Currently there are 245 drivers in the database. Many drivers support various models, and many models may be driven by different drivers its your choice! -

        690 “Perfect” Printers

        +

        690 “Perfect” Printers

        At present, there are 690 devices dubbed as working perfectly, 181 mostly, 96 partially, and 46 are paperweights. Keeping in mind that most of these are non-PostScript models (PostScript printers are @@ -2678,7 +2678,7 @@ truly astonishing achievement! Three years ago the number was not more than 500, and Linux or UNIX printing at the time wasn't anywhere near the quality it is today. -

        How the Printing HOWTO Started It All

        +

        Foomatic's Strange Name

        - +

        Foomatic's Strange Name

        +Why the funny name?” you ask. When it really took off, around spring 2000, CUPS was far less popular than today, and most systems used LPD, LPRng or even PDQ to print. CUPS shipped with a few generic drivers @@ -2716,10 +2716,10 @@ to CUPS users (because often the traditional Ghostscript way of printing was the only one available).

      37. It gave all the advanced CUPS options (Web interface, GUI driver configurations) to users wanting (or needing) to use -Ghostscript filters.

      38. cupsomatic, pdqomatic, lpdomatic, directomatic

        - - - +Ghostscript filters.

        cupsomatic, pdqomatic, lpdomatic, directomatic

        + + + CUPS worked through a quickly-hacked up filter script named cupsomatic. cupsomatic ran the printfile through Ghostscript, constructing automatically the rather complicated command line needed. It just @@ -2753,8 +2753,8 @@ attached to Linuxprinting.org PPDs for CUPS. It had a different “*omatic” script for every spooler, as well as different printer configuration files. -

        The Grand Unification Achieved

        - +

        The Grand Unification Achieved

        + This has all changed in Foomatic versions 2.9 (beta) and released as “stable” 3.0. It has now achieved the convergence of all *omatic scripts and is called the foomatic-rip. @@ -2787,7 +2787,7 @@ from different paper trays within the same job (in both cases, even where there is no support for this from Windows-based vendor printer drivers). -

        Driver Development Outside

        +

        Driver Development Outside

        Most driver development itself does not happen within Linuxprinting.org. Drivers are written by independent maintainers. Linuxprinting.org just pools all the information and stores it in its @@ -2810,7 +2810,7 @@ directed by Robert Krawitz, which has achieved an amazing level of photo print quality (many Epson users swear that its quality is better than the vendor drivers provided by Epson for the Microsoft -platforms). This currently supports 522 models.

        Forums, Downloads, Tutorials, Howtos also for Mac OS X and Commercial UNIX

        +platforms). This currently supports 522 models.

        Forums, Downloads, Tutorials, Howtos also for Mac OS X and Commercial UNIX

        Linuxprinting.org today is the one-stop shop to download printer drivers. Look for printer information and tutorials or solve printing problems in its popular forums. This forum @@ -2830,7 +2830,7 @@ Till Kamppeter from MandrakeSoft is doing an excellent job in his spare time to maintain Linuxprinting.org and Foomatic. So if you use it often, please send him a note showing your appreciation. -

        Foomatic Database-Generated PPDs

        +

        Foomatic Database-Generated PPDs

        The Foomatic database is an amazing piece of ingenuity in itself. Not only does it keep the printer and driver information, but it is organized in a way that it can generate PPD files on the fly from @@ -2855,7 +2855,7 @@ or the GNOME gtklp, xpp and the CUPS Web interface) read the PPD as well and use this information to present the available settings to the user as an intuitive menu selection. -

        foomatic-rip and Foomatic-PPD Download and Installation

        +

        foomatic-rip and Foomatic-PPD Download and Installation

        Here are the steps to install a foomatic-rip driven LaserJet 4 Plus-compatible printer in CUPS (note that recent distributions of SuSE, UnitedLinux and Mandrake may ship with a complete package of Foomatic-PPDs plus the @@ -2954,8 +2954,8 @@ the selected driver for your model (as shown by gs -h).

      39. foomatic-rip needs a new version of PPDs (PPD versions produced for cupsomatic do not work with -foomatic-rip).

      40. Page Accounting with CUPS

        - +foomatic-rip).

        Page Accounting with CUPS

        + Often there are questions regarding print quotas where Samba users (that is, Windows clients) should not be able to print beyond a certain number of pages or data volume per day, week or month. This @@ -2968,12 +2968,12 @@ there is CUPS. CUPS supports quotas that can be based on the size of jobs or on the number of pages or both, and span any time period you want. -

        Setting Up Quotas

        - +

        Setting Up Quotas

        + This is an example command of how root would set a print quota in CUPS, assuming an existing printer named “quotaprinter”:

        - +

         root# lpadmin -p quotaprinter -o job-quota-period=604800 \
         	-o job-k-limit=1024 -o job-page-limit=100
        @@ -2981,7 +2981,7 @@
         This would limit every single user to print 100 pages or 1024 KB of
         data (whichever comes first) within the last 604,800 seconds ( = 1
         week).
        -

        Correct and Incorrect Accounting

        +

        Correct and Incorrect Accounting

        For CUPS to count correctly, the printfile needs to pass the CUPS pstops filter, otherwise it uses a dummy count of “one”. Some print files do not pass it (e.g., image files) but then those are mostly one- @@ -2997,7 +2997,7 @@ is currently working for about a thousand different printer models. Linuxprinting has a driver list. -

        Adobe and CUPS PostScript Drivers for Windows Clients

        +

        Adobe and CUPS PostScript Drivers for Windows Clients

        Before CUPS 1.1.16, your only option was to use the Adobe PostScript Driver on the Windows clients. The output of this driver was not always passed through the pstops filter on the CUPS/Samba side, and @@ -3010,14 +3010,14 @@ Windows NT/200x/XP clients (which is tagged in the download area of http://www.cups.org/ as the cups-samba-1.1.16.tar.gz package). It does not work for Windows 9x/ME clients, but it guarantees: -

        • To not write a PJL-header.

        • To still read and support all PJL-options named in the +

          • To not write a PJL-header.

          • To still read and support all PJL-options named in the driver PPD with its own means.

          • That the file will pass through the pstops filter on the CUPS/Samba server.

          • To page-count correctly the print file.

          You can read more about the setup of this combination in the man page for cupsaddsmb (which is only present with CUPS installed, and only current from CUPS 1.1.16). -

        The page_log File Syntax

        - +

        The page_log File Syntax

        + These are the items CUPS logs in the page_log for every page of a job:

        • Printer name

        • User name

        • Job ID

        • Time of printing

        • The page number

        • The number of copies

        • A billing information string (optional)

        • The host that sent the job (included since version 1.1.19)

        @@ -3036,7 +3036,7 @@ The next job had ID 402, was sent by user boss from IP address 10.160.51.33, printed from one page 440 copies and is set to be billed to finance-dep. -

        Possible Shortcomings

        +

        Possible Shortcomings

        What flaws or shortcomings are there with this quota system?

        • The ones named above (wrongly logged job in case of printer hardware failure, and so on).

        • In reality, CUPS counts the job pages that are being @@ -3050,7 +3050,7 @@ “used-up” number of current quota.

        • A user having used up 99 sheets of a 100 quota will still be able to send and print a thousand sheet job.

        • A user being denied a job because of a filled-up quota does not get a meaningful error message from CUPS other than -“client-error-not-possible”.

        Future Developments

        +“client-error-not-possible”.

        Future Developments

        This is the best system currently available, and there are huge improvements under development for CUPS 1.2:

        • Page counting will go into the backends (these talk @@ -3058,7 +3058,7 @@ actual printing process; thus, a jam at the fifth sheet will lead to a stop in the counting).

        • Quotas will be handled more flexibly.

        • Probably there will be support for users to inquire about their accounts in advance.

        • Probably there will be support for some other tools -around this topic.

        Additional Material

        +around this topic.

        Additional Material

        A printer queue with no PPD associated to it is a “raw” printer and all files will go directly there as received by the spooler. The exceptions are file types application/octet-stream @@ -3137,16 +3137,16 @@ allowed to have direct access (such as when the operators often need to load the proper paper type before running the 10,000 page job requested by marketing for the mailing, and so on). -

        Auto-Deletion or Preservation of CUPS Spool Files

        +

        Auto-Deletion or Preservation of CUPS Spool Files

        Samba print files pass through two spool directories. One is the incoming directory managed by Samba, (set in the -path = /var/spool/samba +path = /var/spool/samba directive in the [printers] section of smb.conf). The other is the spool directory of your UNIX print subsystem. For CUPS it is normally /var/spool/cups/, as set by the cupsd.conf directive RequestRoot /var/spool/cups. -

        CUPS Configuration Settings Explained

        +

        CUPS Configuration Settings Explained

        Some important parameter settings in the CUPS configuration file cupsd.conf are:

        PreserveJobHistory Yes

        @@ -3170,26 +3170,26 @@

        (There are also additional settings for MaxJobsPerUser and MaxJobsPerPrinter...) -

        Pre-Conditions

        +

        Pre-Conditions

        For everything to work as announced, you need to have three things:

        • A Samba-smbd that is compiled against libcups (check on Linux by running ldd `which smbd').

        • A Samba-smb.conf setting of - printing = cups.

        • Another Samba-smb.conf setting of - printcap = cups.

        Note

        + printing = cups.

      41. Another Samba-smb.conf setting of + printcap = cups.

      42. Note

        In this case, all other manually set printing-related commands (like -print command, -lpq command, -lprm command, -lppause command or -lpresume command) are ignored and they should normally have no +print command, +lpq command, +lprm command, +lppause command or +lpresume command) are ignored and they should normally have no influence whatsoever on your printing. -

        Manual Configuration

        -If you want to do things manually, replace the printing = cups -by printing = bsd. Then your manually set commands may work -(I haven't tested this), and a print command = lp -d %P %s; rm %s" +

        Manual Configuration

        +If you want to do things manually, replace the printing = cups +by printing = bsd. Then your manually set commands may work +(I haven't tested this), and a print command = lp -d %P %s; rm %s" may do what you need. -

        Printing from CUPS to Windows Attached Printers

        +

        Printing from CUPS to Windows Attached Printers

        >From time to time the question arises, how can you print to a Windows attached printer from Samba? Normally the local connection @@ -3265,12 +3265,12 @@ working netbios name resolution up and running. Note that this is a feature of CUPS and you do not necessarily need to have smbd running. -

        More CUPS-Filtering Chains

        +

        More CUPS-Filtering Chains

        The following diagrams reveal how CUPS handles print jobs. -

        Figure 19.17. Filtering chain 1.

        Filtering chain 1.

        Figure 19.18. Filtering chain with cupsomatic

        Filtering chain with cupsomatic

        Common Errors

        Windows 9x/ME Client Can't Install Driver

        For Windows 9x/ME, clients require the printer names to be eight +

        Figure 19.17. Filtering chain 1.

        Filtering chain 1.

        Figure 19.18. Filtering chain with cupsomatic

        Filtering chain with cupsomatic

        Common Errors

        Windows 9x/ME Client Can't Install Driver

        For Windows 9x/ME, clients require the printer names to be eight characters (or “8 plus 3 chars suffix”) max; otherwise, the driver files will not get transferred when you want to download them from -Samba.

        cupsaddsmb” Keeps Asking for Root Password in Never-ending Loop

        Have you security = user? Have +Samba.

        cupsaddsmb” Keeps Asking for Root Password in Never-ending Loop

        Have you security = user? Have you used smbpasswd to give root a Samba account? You can do two things: open another terminal and execute smbpasswd -a root to create the account and @@ -3279,7 +3279,7 @@ password).

        If the error is: “tree connect failed: NT_STATUS_BAD_NETWORK_NAME”, you may have forgotten to create the /etc/samba/drivers directory. -

        cupsaddsmb” Errors

        +

        cupsaddsmb” Errors

        The use of “cupsaddsmb” gives “No PPD file for printer...” Message While PPD File Is Present. What might the problem be?

        Have you enabled printer sharing on CUPS? This means: @@ -3292,12 +3292,12 @@ sambaserver -h cupsserver -v printername.

        Is your TempDir directive in cupsd.conf set to a valid value and is it writable? -

        Client Can't Connect to Samba Printer

        Use smbstatus to check which user +

        Client Can't Connect to Samba Printer

        Use smbstatus to check which user you are from Samba's point of view. Do you have the privileges to write into the [print$] - share?

        New Account Reconnection from Windows 200x/XP Troubles

        Once you are connected as the wrong user (for + share?

        New Account Reconnection from Windows 200x/XP Troubles

        Once you are connected as the wrong user (for example, as nobody, which often occurs if you have -map to guest = bad user), Windows Explorer will not accept an +map to guest = bad user), Windows Explorer will not accept an attempt to connect again as a different user. There will not be any byte transfered on the wire to Samba, but still you'll see a stupid error message that makes you think Samba has denied access. Use @@ -3315,41 +3315,41 @@ different account. Now open the Printers folder (on the Samba server in the Network Neighborhood), right-click on the printer in question and select -Connect...

        Avoid Being Connected to the Samba Server as the Wrong User

        You see per smbstatus that you are +Connect...

        Avoid Being Connected to the Samba Server as the Wrong User

        You see per smbstatus that you are connected as user nobody; while you want to be root or printer admin. This is probably due to -map to guest = bad user, which silently connects you under the guest account +map to guest = bad user, which silently connects you under the guest account when you gave (maybe by accident) an incorrect username. Remove -map to guest, if you want to prevent -this.

        Upgrading to CUPS Drivers from Adobe Drivers

        +map to guest, if you want to prevent +this.

        Upgrading to CUPS Drivers from Adobe Drivers

        This information came from a mailing list posting regarding problems experienced when upgrading from Adobe drivers to CUPS drivers on Microsoft Windows NT/200x/XP Clients.

        First delete all old Adobe-using printers. Then delete all old Adobe drivers. (On Windows 200x/XP, right-click in the background of Printers folder, select Server Properties..., select -tab Drivers and delete here).

        Can't Use “cupsaddsmb” on Samba Server Which Is a PDC

        Do you use the “naked” root user name? Try to do it +tab Drivers and delete here).

        Can't Use “cupsaddsmb” on Samba Server Which Is a PDC

        Do you use the “naked” root user name? Try to do it this way: cupsaddsmb -U DOMAINNAME\\root -v printername> (note the two backslashes: the first one is -required to “escape” the second one).

        Deleted Windows 200x Printer Driver Is Still Shown

        Deleting a printer on the client will not delete the +required to “escape” the second one).

        Deleted Windows 200x Printer Driver Is Still Shown

        Deleting a printer on the client will not delete the driver too (to verify, right-click on the white background of the Printers folder, select Server Properties and click on the Drivers tab). These same old drivers will be re-used when you try to install a printer with the same name. If you want to update to a new driver, delete the old ones first. Deletion is only possible if no -other printer uses the same driver.

        Windows 200x/XP "Local Security Policies"

        Local Security Policies may not +other printer uses the same driver.

        Windows 200x/XP "Local Security Policies"

        Local Security Policies may not allow the installation of unsigned drivers. “Local Security Policies” may not allow the installation of printer drivers at -all.

        Administrator Cannot Install Printers for All Local Users

        Windows XP handles SMB printers on a “per-user” basis. +all.

        Administrator Cannot Install Printers for All Local Users

        Windows XP handles SMB printers on a “per-user” basis. This means every user needs to install the printer himself. To have a printer available for everybody, you might want to use the built-in IPP client capabilities of Win XP. Add a printer with the print path of http://cupsserver:631/printers/printername. We're still looking into this one. Maybe a logon script could automatically install printers for all -users.

        Print Change Notify Functions on NT-clients

        For print change, notify functions on NT++ clients. +users.

        Print Change Notify Functions on NT-clients

        For print change, notify functions on NT++ clients. These need to run the Server service first (renamed to File & Print Sharing for MS Networks in -XP).

        Win XP-SP1

        Win XP-SP1 introduced a Point and Print Restriction Policy (this restriction does not apply to +XP).

        Win XP-SP1

        Win XP-SP1 introduced a Point and Print Restriction Policy (this restriction does not apply to “Administrator” or “Power User” groups of users). In Group Policy Object Editor, go to User Configuration -> Administrative Templates -> Control Panel -> Printers. The policy is automatically set to @@ -3358,7 +3358,7 @@ to change it to Disabled or Users can only Point and Print to these servers to make driver downloads from Samba possible. -

        Print Options for All Users Can't Be Set on Windows 200x/XP

        How are you doing it? I bet the wrong way (it is not +

        Print Options for All Users Can't Be Set on Windows 200x/XP

        How are you doing it? I bet the wrong way (it is not easy to find out, though). There are three different ways to bring you to a dialog that seems to set everything. All three dialogs look the same, yet only one of them @@ -3397,12 +3397,12 @@ one, which you arrived at with steps “C.1.-6.”, will save any settings permanently and be the defaults for new users. If you want all clients to get the same defaults, you need to conduct these steps as -Administrator (printer admin in +Administrator (printer admin in smb.conf) before a client downloads the driver (the clients can later set their own per-user defaults by following the procedures A or B -above).

        Most Common Blunders in Driver Settings on Windows Clients

        Don't use Optimize for +above).

        Most Common Blunders in Driver Settings on Windows Clients

        Don't use Optimize for Speed, but use Optimize for Portability instead (Adobe PS Driver). Don't use Page Independence: No: always @@ -3414,7 +3414,7 @@ TrueType Download Options choose Outline. Use PostScript Level 2, if you are having trouble with a non-PS printer and if -there is a choice.

        cupsaddsmb Does Not Work with Newly Installed Printer

        Symptom: The last command of +there is a choice.

        cupsaddsmb Does Not Work with Newly Installed Printer

        Symptom: The last command of cupsaddsmb does not complete successfully: cmd = setdriver printername printername result was NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet @@ -3423,18 +3423,18 @@ hostname -c `enumprinters'? Restart smbd (or send a kill -HUP to all processes listed by smbstatus and try -again.

        Permissions on /var/spool/samba/ Get Reset After Each Reboot

        Have you ever by accident set the CUPS spool directory to +again.

        Permissions on /var/spool/samba/ Get Reset After Each Reboot

        Have you ever by accident set the CUPS spool directory to the same location? (RequestRoot /var/spool/samba/ in cupsd.conf or the other way round: /var/spool/cups/ is set as -path> in the [printers] +path> in the [printers] section). These must be different. Set RequestRoot /var/spool/cups/ in -cupsd.conf and path = +cupsd.conf and path = /var/spool/samba in the [printers] section of smb.conf. Otherwise cupsd will sanitize permissions to its spool directory with each restart and -printing will not work reliably.

        Print Queue Called “lp” Mis-handles Print Jobs

        +printing will not work reliably.

        Print Queue Called “lp” Mis-handles Print Jobs

        In this case a print queue called “lp” intermittently swallows jobs and spits out completely different ones from what was sent.

        It is a bad idea to name any printer “lp”. This @@ -3447,10 +3447,10 @@ tight control over the printer names, set BrowseShortNames No. It will present any printer as printername@cupshost and then gives you better control over what may happen in a large -networked environment.

        Location of Adobe PostScript Driver Files for “cupsaddsmb

        Use smbclient to connect to any +networked environment.

        Location of Adobe PostScript Driver Files for “cupsaddsmb

        Use smbclient to connect to any Windows box with a shared PostScript printer: smbclient //windowsbox/print\$ -U guest. You can navigate to the W32X86/2 subdir to mget ADOBE* and other files or to WIN40/0 to do the same. Another option is to download the *.exe packaged -files from the Adobe Web site.

        Overview of the CUPS Printing Processes

        A complete overview of the CUPS printing processes can be found in the next flowchart.

        Figure 19.19. CUPS printing overview.

        CUPS printing overview.


        [5] http://www.cups.org/cups-help.html
        +files from the Adobe Web site.

        Overview of the CUPS Printing Processes

        A complete overview of the CUPS printing processes can be found in the next flowchart.

        Figure 19.19. CUPS printing overview.

        CUPS printing overview.


        [5] http://www.cups.org/cups-help.html
        diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/diagnosis.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/diagnosis.html --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/diagnosis.html 2004-11-15 10:16:54.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/diagnosis.html 2004-12-15 10:25:14.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 33. The Samba Checklist

        Chapter 33. The Samba Checklist

        Andrew Tridgell

        Samba Team

        Jelmer R. Vernooij

        The Samba Team

        Dan Shearer

        Samba Team

        Wed Jan 15

        Introduction

        +Chapter 33. The Samba Checklist

        Chapter 33. The Samba Checklist

        Andrew Tridgell

        Samba Team

        Jelmer R. Vernooij

        The Samba Team

        Dan Shearer

        Samba Team

        Wed Jan 15

        Introduction

        This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem is if it fails any one of these steps. If it passes all these tests, @@ -13,7 +13,7 @@ If you send one of the Samba mailing lists an email saying, “it does not work” and you have not followed this test procedure, you should not be surprised if your email is ignored. -

        Assumptions

        +

        Assumptions

        In all of the tests, it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.

        @@ -23,11 +23,11 @@ smb.conf. I will assume this share is called tmp. You can add a tmp share like this by adding the lines shown in the next example. -

        Example 33.1. smb.conf with [tmp] share

        [tmp]
        +

        Example 33.1. smb.conf with [tmp] share

        [tmp]
        - comment = temporary files
        + comment = temporary files
        - path = /tmp
        + path = /tmp
        read only = yes

        Note

        @@ -43,7 +43,7 @@ that the settings for your smb.conf file results in dns proxy = no. The best way to check this is with testparm smb.conf.

        - + It is helpful to monitor the log files during testing by using the tail -F log_file_name in a separate terminal console (use ctrl-alt-F1 through F6 or multiple terminals in X). @@ -54,8 +54,8 @@

        If you make changes to your smb.conf file while going through these test, remember to restart smbd and nmbd. -

        The Tests

        Procedure 33.1. Diagnosing your Samba server

        1. - +

        The Tests

        Procedure 33.1. Diagnosing your Samba server

        1. + In the directory in which you store your smb.conf file, run the command testparm smb.conf. If it reports any errors, then your smb.conf configuration file is faulty. @@ -129,8 +129,8 @@ it is running, and check that the netbios-ssn port is in a LISTEN state using netstat -a.

          Note

          - - + + Some UNIX/Linux systems use xinetd in place of inetd. Check your system documentation for the location of the control files for your particular system implementation of @@ -148,13 +148,13 @@ a session request. The most common of these involve one or more of the smb.conf file entries as shown in the next example.

          -

          Example 33.2. Configuration for only allowing connections from a certain subnet

          [globals]
          ...
          +

          Example 33.2. Configuration for only allowing connections from a certain subnet

          [globals]
          ...
          - hosts deny = ALL
          + hosts deny = ALL
          - hosts allow = xxx.xxx.xxx.xxx/yy
          + hosts allow = xxx.xxx.xxx.xxx/yy
          - interfaces = eth0
          + interfaces = eth0
          bind interfaces only = Yes
          ...

          @@ -162,17 +162,17 @@ will automatically translate to the loopback adapter address 127.0.0.1. To solve this problem, change these lines as shown in the following example.

          -

          Example 33.3. Configuration for allowing connections from a certain subnet and localhost

          [globals]
          ...
          +

          Example 33.3. Configuration for allowing connections from a certain subnet and localhost

          [globals]
          ...
          - hosts deny = ALL
          + hosts deny = ALL
          - hosts allow = xxx.xxx.xxx.xxx/yy 127.
          + hosts allow = xxx.xxx.xxx.xxx/yy 127.
          interfaces = eth0 lo
          ...

          - + Another common cause of these two errors is having something already running - + on port 139, such as Samba (smbd is running from inetd already) or something like Digital's Pathworks. Check your inetd.conf file before trying to start smbd as a daemon it can avoid a lot of frustration! @@ -214,7 +214,7 @@ If this does not give a similar result to the previous test, then nmblookup isn't correctly getting your broadcast address through its automatic mechanism. In this case you should experiment with the -interfaces option in smb.conf to manually configure your IP +interfaces option in smb.conf to manually configure your IP address, broadcast and netmask.

          If your PC and server aren't on the same subnet, then you will need to use the @@ -223,7 +223,7 @@ This test will probably fail if your subnet mask and broadcast address are not correct. (Refer to TEST 3 notes above).

        2. - + Run the command: smbclient //BIGSERVER/TMP. You should then be prompted for a password. You should use the password of the account with which you are logged into the UNIX box. If you want to test with @@ -242,11 +242,11 @@ You have shadow passwords (or some other password system) but didn't compile in support for them in smbd.

        3. - Your valid users configuration is incorrect. + Your valid users configuration is incorrect.

        4. - You have a mixed case password and you haven't enabled the password level option at a high enough level. + You have a mixed case password and you haven't enabled the password level option at a high enough level.

        5. - The path line in smb.conf is incorrect. Check it with testparm. + The path line in smb.conf is incorrect. Check it with testparm.

        6. You enabled password encryption but didn't map UNIX to Samba users. Run: smbpasswd -a username @@ -296,14 +296,14 @@

          It's also possible that the server can't work out what user name to connect you as. To see if this is the problem, add the line -user = username to the +user = username to the [tmp] section of smb.conf where username is the username corresponding to the password you typed. If you find this fixes things, you may need the username mapping option.

          It might also be the case that your client only sends encrypted passwords -and you have encrypt passwords = no in smb.conf. +and you have encrypt passwords = no in smb.conf. Change this to "yes" to fix this.

        7. Run the command nmblookup -M testgroup where @@ -314,7 +314,7 @@ If you do not, then the election process has failed. Wait a minute to see if it is just being slow, then try again. If it still fails after that, then look at the browsing options you have set in smb.conf. Make -sure you have preferred master = yes to ensure that +sure you have preferred master = yes to ensure that an election is held at startup.

        8. >From file manager, try to browse the server. Your Samba server should @@ -324,8 +324,8 @@ you are probably running Windows NT and it is refusing to browse a server that has no encrypted password capability and is in User Level Security mode. In this case, either set -security = server and -password server = Windows_NT_Machine in your -smb.conf file, or make sure encrypt passwords is +security = server and +password server = Windows_NT_Machine in your +smb.conf file, or make sure encrypt passwords is set to “yes”.

        9. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/DNSDHCP.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/DNSDHCP.html --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/DNSDHCP.html 2004-11-15 10:16:56.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/DNSDHCP.html 2004-12-15 10:25:19.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 40. DNS and DHCP Configuration Guide

          Chapter 40. DNS and DHCP Configuration Guide

          John H. Terpstra

          Samba Team

          Features and Benefits

          +Chapter 40. DNS and DHCP Configuration Guide

          Chapter 40. DNS and DHCP Configuration Guide

          John H. Terpstra

          Samba Team

          Features and Benefits

          There are few subjects in the UNIX world that might raise as much contention as Domain Name System (DNS) and Dynamic Host Configuration Protocol (DHCP). Not all opinions held for or against particular implementations of DNS and DHCP @@ -14,8 +14,8 @@ themselves on a network. Windows 2000 Active Directory registers entries in the DNS name space that are equally perplexing to UNIX administrators. Welcome to the new world!

          - - + + The purpose of this chapter is to demonstrate the configuration of the Internet Software Consortium (ISC) DNS and DHCP servers to provide dynamic services that are compatible with their equivalents in the Microsoft Windows 2000 Server products. @@ -30,11 +30,11 @@ on DNS or DHCP should visit the ISC Web sites at http://www.isc.org. Those wanting a written text might also be interested in the O'Reilly publications on these two subjects. -

          Example Configuration

          +

          Example Configuration

          The domain name system is to the Internet what water is to life. By it nearly all information resources (host names) are resolved to their Internet protocol (IP) address. Windows networking tried hard to avoid the complexities of DNS, but alas, DNS won. - + The alternative to DNS, the Windows Internet Name Service (WINS) an artifact of NetBIOS networking over the TCP/IP protocols, has demonstrated scalability problems as well as a flat non-hierarchical name space that became unmanageable as the size and @@ -59,13 +59,13 @@

          The following configurations demonstrate a simple insecure Dynamic DNS server and a simple DHCP server that matches the DNS configuration. -

          Dynamic DNS

          - +

          Dynamic DNS

          + The example DNS configuration is for a private network in the IP address space for network 192.168.1.0/24. The private class network address space is set forth in RFC1918.

          - + It is assumed that this network will be situated behind a secure firewall. The files that follow work with ISC BIND version 9. BIND is the Berkeley Internet Name Daemon. The following configuration files are offered: diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/domain-member.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/domain-member.html --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/domain-member.html 2004-11-15 10:16:35.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/domain-member.html 2004-12-15 10:24:41.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 6. Domain Membership

          Chapter 6. Domain Membership

          John H. Terpstra

          Samba Team

          Jeremy Allison

          Samba Team

          Gerald (Jerry) Carter

          Samba Team

          Andrew Tridgell

          Samba Team

          Jelmer R. Vernooij

          The Samba Team

          Guenther Deschner

          LDAP updates

          +Chapter 6. Domain Membership

          Chapter 6. Domain Membership

          John H. Terpstra

          Samba Team

          Jeremy Allison

          Samba Team

          Gerald (Jerry) Carter

          Samba Team

          Andrew Tridgell

          Samba Team

          Jelmer R. Vernooij

          The Samba Team

          Guenther Deschner

          LDAP updates

          Domain Membership is a subject of vital concern. Samba must be able to participate as a member server in a Microsoft Domain Security context, and Samba must be capable of providing Domain machine member trust accounts, @@ -11,7 +11,7 @@ UNIX/Linux networking and administration world, a considerable level of misinformation, incorrect understanding and a lack of knowledge. Hopefully this chapter will fill the voids. -

          Features and Benefits

          +

          Features and Benefits

          MS Windows workstations and servers that want to participate in Domain Security need to be made Domain Members. Participating in Domain Security is often called Single Sign On or SSO for short. This @@ -19,12 +19,12 @@ (or another server be it an MS Windows NT4 / 200x server) or a Samba server a member of an MS Windows Domain Security context.

          - + Samba-3 can join an MS Windows NT4-style domain as a native member server, an MS Windows Active Directory Domain as a native member server, or a Samba Domain Control network. Domain Membership has many advantages:

          • - + MS Windows workstation users get the benefit of SSO.

          • Domain user access rights and file ownership/access controls can be set @@ -47,7 +47,7 @@ (either NT4/Samba SAM style Domain, NT4 Domain that is backend-ed with an LDAP directory, or via an Active Directory infrastructure).

          MS Windows Workstation/Server Machine Trust Accounts

          - + A Machine Trust Account is an account that is used to authenticate a client machine (rather than a user) to the Domain Controller server. In Windows terminology, this is known as a “Computer Account.” The purpose of the machine account @@ -72,7 +72,7 @@

          • A Domain Security Account (stored in the - passdb backend that has been configured in the + passdb backend that has been configured in the smb.conf file. The precise nature of the account information that is stored depends on the type of backend database that has been chosen.

            @@ -92,13 +92,13 @@ this may not be a feature of the early releases of Samba-3.

          - + There are three ways to create Machine Trust Accounts:

          • Manual creation from the UNIX/Linux command line. Here, both the Samba and corresponding UNIX account are created by hand.

          • - + Using the MS Windows NT4 Server Manager, either from an NT4 Domain Member server, or using the Nexus toolkit available from the Microsoft Web site. This tool can be run from any MS Windows machine as long as the user is @@ -108,25 +108,25 @@ created by Samba at the time the client is joined to the domain. (For security, this is the recommended method.) The corresponding UNIX account may be created automatically or manually. -

          Manual Creation of Machine Trust Accounts

          +

          Manual Creation of Machine Trust Accounts

          The first step in manually creating a Machine Trust Account is to manually create the corresponding UNIX account in /etc/passwd. This can be done using vipw or another “add user” command that is normally used to create new UNIX accounts. The following is an example for a Linux-based Samba server:

          - - + +

           root# /usr/sbin/useradd -g machines -d /dev/null -c "machine nickname" \
              -s /bin/false machine_name$ 
           
           root# passwd -l machine_name$
           

          -

          In the above example above there is an existing system group “machines” which is used +

          In the example above there is an existing system group “machines” which is used as the primary group for all machine accounts. In the following examples the “machines” group has numeric GID equal 100.

          - + On *BSD systems, this can be done using the chpass utility:

          @@ -164,26 +164,26 @@
           

          Join the client to the domain immediately

          Manually creating a Machine Trust Account using this method is the equivalent of creating a Machine Trust Account on a Windows NT PDC using - + the Server Manager. From the time at which the account is created to the time the client joins the domain and changes the password, your domain is vulnerable to an intruder joining your domain using a machine with the same NetBIOS name. A PDC inherently trusts members of the domain and will serve out a large degree of user information to such clients. You have been warned! -

          Managing Domain Machine Accounts using NT4 Server Manager

          -A working add machine script script is essential +

          Managing Domain Machine Accounts using NT4 Server Manager

          +A working add machine script is essential for machine trust accounts to be automatically created. This applies no matter whether one uses automatic account creation, or if one wishes to use the NT4 Domain Server Manager.

          - + If the machine from which you are trying to manage the domain is an MS Windows NT4 workstation or MS Windows 200x/XP Professional, the tool of choice is the package called SRVTOOLS.EXE. When executed in the target directory it will unpack SrvMgr.exe and UsrMgr.exe (both are domain management tools for MS Windows NT4 workstation).

          - + If your workstation is a Microsoft Windows 9x/Me family product you should download the Nexus.exe package from the Microsoft web site. When executed from the target directory this will unpack the same tools but for use on @@ -211,7 +211,7 @@ Add NT Workstation of Server, then enter the machine name in the field provided, and click the Add button. -

          On-the-Fly Creation of Machine Trust Accounts

          +

          On-the-Fly Creation of Machine Trust Accounts

          The second (and recommended) way of creating Machine Trust Accounts is simply to allow the Samba server to create them as needed when the client is joined to the domain. @@ -221,12 +221,12 @@ accounts may also be created manually.

          Here is an example for a Red Hat Linux system. -

          [global]
          # <...remainder of parameters...>
          +

          [global]
          # <...remainder of parameters...>
          - add machine script = /usr/sbin/useradd -d /dev/null -g 100 \
          -s /bin/false -M %u

          Making an MS Windows Workstation or Server a Domain Member

          + add machine script = /usr/sbin/useradd -d /dev/null -g 100 \

          -s /bin/false -M %u

          Making an MS Windows Workstation or Server a Domain Member

          The procedure for making an MS Windows workstation or server a member of the domain varies with the version of Windows. -

          Windows 200x/XP Professional Client

          +

          Windows 200x/XP Professional Client

          When the user elects to make the client a Domain Member, Windows 200x prompts for an account and password that has privileges to create machine accounts in the domain. A Samba Administrator Account (i.e., a Samba account that has root privileges on the @@ -239,11 +239,11 @@ The name of the account that is used to create Domain Member machine accounts can be anything the network administrator may choose. If it is other than root then this is easily mapped to root in the file named in the smb.conf parameter - username map = /etc/samba/smbusers. + username map = /etc/samba/smbusers.

          The session key of the Samba Administrator Account acts as an encryption key for setting the password of the machine trust account. The Machine Trust Account will be created on-the-fly, or updated if it already exists. -

          Windows NT4 Client

          +

          Windows NT4 Client

          If the Machine Trust Account was created manually, on the Identification Changes menu enter the domain name, but do not check the box Create a Computer Account in the Domain. @@ -254,7 +254,7 @@ name and check the box Create a Computer Account in the Domain. In this case, joining the domain proceeds as above for Windows 2000 (i.e., you must supply a Samba Administrator Account when prompted). -

          Samba Client

          Joining a Samba client to a domain is documented in +

          Samba Client

          Joining a Samba client to a domain is documented in Domain Member Server.

          Domain Member Server

          This mode of server operation involves the Samba machine being made a member @@ -280,35 +280,35 @@ how to create a domain machine account for a Domain Member server as well as for information on how to enable the Samba Domain Member machine to join the domain and be fully trusted by it. -

          Joining an NT4-type Domain with Samba-3

          Next table lists names that have been used in the remainder of this chapter.

          Table 6.1. Assumptions

          NetBIOS name:SERV1
          Windows 200x/NT domain name:MIDEARTH
          Domain's PDC NetBIOS name:DOMPDC
          Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

          +

          Joining an NT4-type Domain with Samba-3

          Next table lists names that have been used in the remainder of this chapter.

          Table 6.1. Assumptions

          NetBIOS name:SERV1
          Windows 200x/NT domain name:MIDEARTH
          Domain's PDC NetBIOS name:DOMPDC
          Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

          First, you must edit your smb.conf file to tell Samba it should now use domain security.

          Change (or add) your - security line in the [global] section + security line in the [global] section of your smb.conf to read:

          -

          +

          security = domain

          -Next change the workgroup line in the [global] +Next change the workgroup line in the [global] section to read:

          -

          +

          workgroup = MIDEARTH

          This is the name of the domain we are joining.

          -You must also have the parameter encrypt passwords +You must also have the parameter encrypt passwords set to yes in order for your users to authenticate to the NT PDC. This is the default setting if this parameter is not specified. There is no need to specify this parameter, but if it is specified in the smb.conf file, it must be set to Yes.

          -Finally, add (or modify) a password server line in the [global] +Finally, add (or modify) a password server line in the [global] section to read:

          -

          +

          password server = DOMPDC DOMBDC1 DOMBDC2

          @@ -322,7 +322,7 @@ the list of Domain Controllers to use for authentication, you may set this line to be:

          -

          +

          password server = *

          @@ -378,14 +378,14 @@

           root# /etc/init.d/samba restart
           

          -

          Why Is This Better Than security = server?

          +

          Why Is This Better Than security = server?

          Currently, domain security in Samba does not free you from having to create local UNIX users to represent the users attaching to your server. This means that if Domain user DOM\fred attaches to your Domain Security Samba server, there needs to be a local UNIX user fred to represent that user in the UNIX file system. This is similar to the older Samba security mode -security = server, +security = server, where Samba would pass through the authentication request to a Windows NT server in the same way as a Windows 95 or Windows 98 server would.

          @@ -400,11 +400,11 @@ a resource domain and have the authentication passed on from a resource domain PDC to an account domain PDC).

          -In addition, with security = server, every Samba +In addition, with security = server, every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run -out of available connections. With security = domain, +out of available connections. With security = domain, however, the Samba daemons connect to the PDC/BDC only for as long as is necessary to authenticate the user and then drop the connection, thus conserving PDC connection resources. @@ -418,33 +418,33 @@ LinuxWorld as the article http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html Doing the NIS/NT Samba.

          Samba ADS Domain Membership

          - - - - + + + + This is a rough guide to setting up Samba-3 with Kerberos authentication against a Windows 200x KDC. A familiarity with Kerberos is assumed. -

          Configure smb.conf

          +

          Configure smb.conf

          You must use at least the following three options in smb.conf: -

          +

          - realm = your.kerberos.REALM
          + realm = your.kerberos.REALM
          - security = ADS
          # The following parameter need only be specified if present.
          # The default setting is not present is Yes.
          + security = ADS
          # The following parameter need only be specified if present.
          # The default setting is not present is Yes.
          encrypt passwords = yes

          In case samba cannot correctly identify the appropriate ADS server using the realm name, use the -password server option in smb.conf: -

          +password server option in smb.conf: +

          password server = your.kerberos.server

          Note

          You do not need a smbpasswd file, and older clients will be authenticated as -if security = domain, although it will not do any harm and +if security = domain, although it will not do any harm and allows you to have local users not in the domain. -

          Configure /etc/krb5.conf

          - - +

          Configure /etc/krb5.conf

          + + With both MIT and Heimdal Kerberos, it is unnecessary to configure the /etc/krb5.conf, and it may be detrimental.

          @@ -488,7 +488,7 @@ .kerberos.server = YOUR.KERBEROS.REALM

          - + Test your config by doing a kinit USERNAME@REALM and making sure that your password is accepted by the Win2000 KDC. @@ -545,7 +545,7 @@

           root#  net ads join "Computers\BusinessUnit\Department\Servers"
           

          -

          Possible Errors

          +

          Possible Errors

          ADS support not compiled in

          Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the Kerberos libraries and headers files are installed.

          net ads join prompts for user name

          You need to login to the domain using kinit @@ -567,32 +567,32 @@

          Note

          Samba can use both DES-CBC-MD5 encryption as well as ARCFOUR-HMAC-MD5 encoding.

          Testing with smbclient

          - + On your Samba server try to login to a Win2000 server or your Samba server using smbclient and Kerberos. Use smbclient as usual, but specify the -k option to choose Kerberos authentication. -

          Notes

          +

          Notes

          You must change administrator password at least once after DC install, to create the right encryption types.

          Windows 200x does not seem to create the _kerberos._udp and _ldap._tcp in the default DNS setup. Perhaps this will be fixed later in service packs. -

          Sharing User ID Mappings between Samba Domain Members

          +

          Sharing User ID Mappings between Samba Domain Members

          Samba maps UNIX users and groups (identified by UIDs and GIDs) to Windows users and groups (identified by SIDs). These mappings are done by the idmap subsystem of Samba.

          In some cases it is useful to share these mappings between Samba Domain Members, so name->id mapping is identical on all machines. This may be needed in particular when sharing files over both CIFS and NFS. -

          To use the LDAP ldap idmap suffix, set:

          +

          To use the LDAP ldap idmap suffix, set:

          - ldap idmap suffix = ou=Idmap,dc=quenya,dc=org

          See the smb.conf man page entry for the ldap idmap suffix + ldap idmap suffix = ou=Idmap,dc=quenya,dc=org

          See the smb.conf man page entry for the ldap idmap suffix parameter for further information.

          -Do not forget to specify also the ldap admin dn +Do not forget to specify also the ldap admin dn and to make certain to set the LDAP administrative password into the secrets.tdb using:

           root#  smbpasswd -w ldap-admin-password
          -

          Common Errors

          +

          Common Errors

          In the process of adding/deleting/re-adding Domain Member machine accounts, there are many traps for the unwary player and many “little” things that can go wrong. It is particularly interesting how often subscribers on the Samba mailing list have concluded @@ -600,7 +600,7 @@ MS Windows on the machine. In truth, it is seldom necessary to reinstall because of this type of problem. The real solution is often quite simple and with an understanding of how MS Windows networking functions, it is easy to overcome. -

          Cannot Add Machine Back to Domain

          +

          Cannot Add Machine Back to Domain

          A Windows workstation was re-installed. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already @@ -609,14 +609,14 @@ The original name is still in the NetBIOS name cache and must expire after machine account deletion before adding that same name as a Domain Member again. The best advice is to delete the old account and then add the machine with a new name. -

          Adding Machine to Domain Fails

          +

          Adding Machine to Domain Fails

          Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a message that, `The machine could not be added at this time, there is a network problem. Please try again later.' Why?

          -You should check that there is an add machine script in your smb.conf +You should check that there is an add machine script in your smb.conf file. If there is not, please add one that is appropriate for your OS platform. If a script -has been defined, you will need to debug its operation. Increase the log level +has been defined, you will need to debug its operation. Increase the log level in the smb.conf file to level 10, then try to rejoin the domain. Check the logs to see which operation is failing.

          @@ -635,9 +635,9 @@ tool. Useradd on some systems will not allow any upper case characters nor will it allow spaces in the name.

          -The add machine script does not create the +The add machine script does not create the machine account in the Samba backend database, it is there only to create a UNIX system account to which the Samba backend database account can be mapped. -

          I Can't Join a Windows 2003 PDC

          Windows 2003 requires SMB signing. Client side SMB signing has been implemented in Samba-3.0. - Set client use spnego = yes when communicating +

          I Can't Join a Windows 2003 PDC

          Windows 2003 requires SMB signing. Client side SMB signing has been implemented in Samba-3.0. + Set client use spnego = yes when communicating with a Windows 2003 server.

          diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/FastStart.html samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/FastStart.html --- samba-3.0.9/docs/htmldocs/Samba-HOWTO-Collection/FastStart.html 2004-11-15 10:16:33.000000000 -0600 +++ samba-3.0.10/docs/htmldocs/Samba-HOWTO-Collection/FastStart.html 2004-12-15 10:24:39.000000000 -0600 @@ -1,4 +1,4 @@ -Chapter 2. Fast Start: Cure for Impatience

          Chapter 2. Fast Start: Cure for Impatience

          John H. Terpstra

          Samba Team

          +Chapter 2. Fast Start: Cure for Impatience

          Chapter 2. Fast Start: Cure for Impatience

          John H. Terpstra

          Samba Team

          When we first asked for suggestions for inclusion in the Samba HOWTO documentation, someone wrote asking for example configurations and lots of them. That is remarkably difficult to do, without losing a lot of value that can be derived from presenting @@ -41,20 +41,20 @@ Microsoft Windows networks, or replace them entirely. The examples provided cover domain member servers as well as Samba Domain Control (PDC/BDC) and finally describes in detail a large distributed network with branch offices in remote locations. -

          Worked Examples

          +

          Worked Examples

          The configuration examples are designed to cover everything necessary to get Samba running. They do not cover basic operating system platform configuration, which is clearly beyond the scope of this text.

          It is also assumed that Samba has been correctly installed, either by way of installation of the packages that are provided by the operating system vendor, or through other means. -

          Stand-alone Server

          - +

          Stand-alone Server

          + A Stand-alone Server implies no more than the fact that it is not a Domain Controller and it does not participate in Domain Control. It can be a simple workgroup-like server, or it may be a complex server that is a member of a domain security context.

          Anonymous Read-Only Document Server

          - + The purpose of this type of server is to make available to any user any documents or files that are placed on the shared resource. The shared resource could be a CD-ROM drive, a CD-ROM image, or a file @@ -64,19 +64,19 @@ system toward greater capability, just as one might expect would happen in a real business office as that office grows in size and its needs change. -

          The configuration file is:

          Example 2.1. Anonymous Read-Only Server Configuration

          # Global parameters
          [global]
          +

          The configuration file is:

          Example 2.1. Anonymous Read-Only Server Configuration

          # Global parameters
          [global]
          - workgroup = MIDEARTH
          + workgroup = MIDEARTH
          - netbios name = HOBBIT
          + netbios name = HOBBIT
          - security = share
          [data]
          + security = share
          [data]
          - comment = Data
          + comment = Data
          - path = /export
          + path = /export
          - read only = Yes
          + read only = Yes
          guest ok = Yes

          • @@ -147,8 +147,8 @@

          The information above (following # Global parameters) provides the complete contents of the /etc/samba/smb.conf file. -

          Anonymous Read-Write Document Server

          - +

          Anonymous Read-Write Document Server

          + We should view this configuration as a progression from the previous example. The difference is that shared access is now forced to the user identity of jackb and to the primary group jackb belongs to. One other refinement we can make is to @@ -166,27 +166,27 @@

          The complete, modified smb.conf file is as shown in ???.

          -

          Example 2.2. Modified Anonymous Read-Write smb.conf

          # Global parameters
          [global]
          +

          Example 2.2. Modified Anonymous Read-Write smb.conf

          # Global parameters
          [global]
          - workgroup = MIDEARTH
          + workgroup = MIDEARTH
          - netbios name = HOBBIT
          + netbios name = HOBBIT
          - security = SHARE
          [data]
          + security = SHARE
          [data]
          - comment = Data
          + comment = Data
          - path = /export
          + path = /export
          - force user = jackb
          + force user = jackb
          - force group = users
          + force group = users
          - read only = No
          + read only = No
          guest ok = Yes

          -

          Anonymous Print Server

          - +

          Anonymous Print Server

          + An anonymous print server serves two purposes: