This commit was manufactured by cvs2svn to create branch 'SAMBA_3_0'.(This used to be commit 6cd4d3f39a1258d51c022c99c73a7341b0ff94a5)

24 files changed, 3381 insertions, 0 deletions

diff --git a/docs/docbook/projdoc/CUPS-printing.sgml b/docs/docbook/projdoc/CUPS-printing.sgml
new file mode 100644
index 0000000000..a932127d94
--- /dev/null
+++ b/docs/docbook/projdoc/CUPS-printing.sgml
@@ -0,0 +1,1357 @@
+<chapter id="CUPS-printing">
+
+
+<chapterinfo>
+	<author>
+		<firstname>John H</firstname><surname>Terpstra</surname>
+		<affiliation>
+			<orgname>Samba Team</orgname>
+			<address>
+				<email>jht@samba.org</email>
+			</address>
+		</affiliation>
+	</author>
+	<author>
+		<firstname>Kurt</firstname><surname>Pfeifle</surname>
+		<affiliation>
+			<address><email>kpfeifle@danka.de</email></address>
+		</affiliation>
+	</author>
+	<pubdate> (25 March 2003) </pubdate>
+</chapterinfo>
+
+<title>CUPS Printing Support</title>
+
+<sect1>
+<title>Introduction</title>
+	
+<para>
+The Common Unix Print System (CUPS) has become very popular, but to many it is
+a very mystical tool. There is a great deal of uncertainty regarding CUPS and how
+it works. The result is seen in a large number of posting on the samba mailing lists
+expressing frustration when MS Windows printers appear not to work with a CUPS
+backr-end.
+/para>
+
+<para>
+This is a good time to point out how CUPS can be used and what it does. CUPS is more
+than just a print spooling system - it is a complete printer management system that
+complies with HTTP and IPP protocols. It can be managed remotely via a web browser
+and it can print using http and ipp protocols.
+</para>
+
+<para>
+CUPS allows to creation of RAW printers (ie: NO file format translation) as well as
+SMART printers (ie: CUPS does file format conversion as required for the printer). In
+many ways this gives CUPS similar capabilities to the MS Windows print monitoring
+system. Of course, if you are a CUPS advocate, you would agrue that CUPS is better!
+In any case, let us now move on to explore how one may configure CUPS for interfacing
+with MS Windows print clients via Samba.
+</para>
+
+</sect1>
+
+<sect1>
+<title>CUPS - RAW Print Through  Mode</title>
+
+<para>
+When CUPS printers are configured for RAW print-through mode operation it is the
+responsibility of the Samba client to fully render the print job (file) in a format
+that is suitable for direct delivery to the printer. In this case CUPS will NOT
+do any print file format conversion work.
+</para>
+
+<para>
+The CUPS files that need to be correctly set for RAW mode printers to work are:
+
+<itemizedlist>
+	<listitem><para><filename>/etc/cups/mime.types</filename><para></listitem>
+	<listitem><para><filename>/etc/cups/mime.convs</filename><para></listitem>
+</itemizedlist>
+
+Both contain entries that must be uncommented to allow <emphasis>RAW</emphasis> mode
+operation.
+</para>
+
+<para>
+Firstly, to enable CUPS based printing from Samba the following options must be
+enabled in your smb.conf file [globals] section:
+
+<itemizedlist>
+	<listitem><para>printing = CUPS</para></listitem>
+
+	<listitem><para>printcap = CUPS</para></listitem>
+</itemizedlist>
+
+When these parameters are specified the print directives in smb.conf (as well as in
+samba itself) will be ignored because samba will directly interface with CUPS through
+it's application program interface (API) - so long as Samba has been compiled with
+CUPS library (libcups) support. If samba has NOT been compiled with CUPS support then
+printing will use the System V AT&amp;T command set with the <emphasis>-oraw</emphasis> 
+option automatically passing through.
+</para>
+
+<para>
+Cupsomatic (an enhanced printing utility that is part of some CUPS implementations) 
+on the Samba/CUPS server does *not* add any features if a file is really
+printed "raw".  However, if you have loaded the driver for the Windows client from
+the CUPS server, using the "cupsaddsmb" utility, and if this driver is one using
+a "Foomatic" PPD, the PJL header in question is already added on the Windows client,
+at the time when the driver initially generated the PostScript data and CUPS in true
+"-oraw" manner doesn't remove this PJL header and passes the file "as is" to its
+printer communication backend.
+</para>
+
+<note><para>NOTE: editing in the "mime.convs" and the "mime.types" file does not *enforce*
+"raw" printing, it only *allows* it.</para></note>
+
+<para>
+Print files that arrive from MS Windows printing are "auto-typed" by CUPS. This aids
+the process of determining proper treatment while in the print queue system.
+
+<itemizedlist>
+	<listitem><para>
+	Files generated by PCL drivers and directed at PCK printers get auto-typed as
+	<filename>application/octet-stream</filename>. Unknown file format types also
+	get auto-typed with this tag.
+	</para></listitem>
+
+	<listitem><para>
+	Files generated by a Postscript driver and directed at a Postscript printer
+	are auto-typed depending on the auto-detected most suitable MIME type as:
+
+	<itemizedlist>
+		<listitem><para>* application/postscript</para></listitem>
+		<listitem><para>* application/vnd.cups-postscript</para></listitem>
+	</itemizedlist>
+	</para>
+</itemizedlist>
+</para>
+
+
+<para>
+"application/postscript" first goes thru the "pstops" filter (where the page counting
+and accounting takes place). The outcome will be of MIME type
+"application/vnd.cups-postscript". The pstopsfilter reads and uses information from
+the PPD and inserts user-provided options into the PostScript file. As a consequence,
+the filtered file could possibly have an unwanted PJL header.
+</para>
+
+<para>
+"application/postscript" will be all files with a ".ps", ".ai", ".eps" suffix or which
+have as their first character string one of "%!" or "<04>%".
+</para>
+
+<para>
+"application/vnd.cups-postscript" will files which contain the string
+"LANGUAGE=POSTSCRIPT" (or similar variations with different capitalization) in the
+first 512 bytes, and also contain the "PJL super escape code" in the first 128 bytes
+("<1B>%-12345X"). Very likely, most PostScript files generated on Windows using a CUPS
+or other PPD, will have to be auto-typed as "vnd.cups-postscript".  A file produced
+with a "Generic PostScript driver" will just be tagged "application/postscript".
+</para>
+
+<para>
+Once the file is in "application/vnd.cups-postscript" format, either "pstoraster"
+or "cupsomatic" will take over (depending on the printer configuration, as
+determined by the PPD in use).
+</para>
+
+<note><para>
+A printer queue with *no* PPD associated to it is a "raw" printer and all files
+will go directly there as received by the spooler. The exeptions are file types
+"application/octet-stream" which need "passthrough feature" enabled.
+"Raw" queues don't do any filtering at all, they hand the file directly to the
+CUPS backend. This backend is responsible for the sending of the data to the device
+(as in the "device URI" notation as lpd://, socket://, smb://, ipp://, http://,
+parallel:/, serial:/, usb:/ etc.)
+</para></note>
+
+<note><para>
+"cupsomatic"/Foomatic are *not* native CUPS drivers and they don't ship with CUPS.
+They are a Third Party add-on, developed at Linuxprinting.org.  As such, they are
+a brilliant hack to make all models (driven by Ghostscript drivers/filters in
+traditional spoolers) also work via CUPS, with the same (good or bad!) quality
+as in these other spoolers. "cupsomatic" is only a vehicle to execute a ghostscript
+commandline at that stage in the CUPS filtering chain, where "normally" the native
+CUPS "pstoraster" filter would kick in.  cupsomatic by-passes pstoraster, "kidnaps"
+the printfile from CUPS away and re-directs it to go through Ghostscipt. CUPS accepts this,
+because the associated CUPS-O-Matic-/Foomatic-PPD specifies:
+</para>
+
+<programlisting>
+   *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"
+</programlisting>
+
+<para>
+This line persuades CUPS to hand the file to cupsomatic, once it has successfully
+converted it to the MIME type "application/vnd.cups-postscript". This conversion will not
+happen for Jobs arriving from Windows which are auto-typed "application/octet-stream",
+with the according changes in "/etc/cups/mime.types" in place.
+</para></note>
+
+<para>
+CUPS is widely configurable and flexible, even regarding its filtering mechanism.
+Another workaround in some situations would be to have
+in "/etc/cups/mime.types" entries as follows:
+</para>
+
+<programlisting>
+   application/postscript           application/vnd.cups-raw  0  -
+   application/vnd.cups-postscript  application/vnd.cups-raw  0  -
+</programlisting>
+
+<para>
+This would prevent all Postscript files from being filtered (rather, they will go
+thru the virtual "nullfilter" denoted with "-"). This could only be useful for
+PS printers. If you want to print PS code on non-PS printers an entry as follows
+could be useful:
+</para>
+
+<programlisting>
+   */*           application/vnd.cups-raw  0  -
+</programlisting>
+
+<para>
+and would effectively send *all* files to the backend without further processing.
+</para>
+
+<para>
+Lastly, you could have the following entry:
+</para>
+
+<programlisting>
+   application/vnd.cups-postscript  application/vnd.cups-raw  0  my_PJL_stripping_filter
+</programlisting>
+
+<para>
+You will need to write a "my_PJL_stripping_filter" (could be a shellscript) that
+parses the PostScript and removes the unwanted PJL. This would need to conform to
+CUPS filter design (mainly, receive and pass the parameters printername, job-id,
+username, jobtitle, copies, print options and possibly the filename). It would
+be installed as world executable into "/usr/lib/cups/filters/" and will be called
+by CUPS if it encounters a MIME type "application/vnd.cups-postscript".
+</para>
+
+<para>
+CUPS can handle "-o job-hold-until=indefinite". This keeps the job in the queue
+"on hold". It will only be printed upon manual release by the printer operator.
+This is a requirement in many "central reproduction departments", where a few
+operators manage the jobs of hundreds of users on some big machine, where no
+user is allowed to have direct access. (The operators often need to load the
+proper paper type before running the 10.000 page job requested by marketing
+for the mailing, etc.).
+</para>
+
+</sect1>
+
+<sect1>
+<title>The CUPS Filter Chains</title>
+
+<para>
+The following diagrams reveal how CUPS handles print jobs.
+</para>
+
+<programlisting>
+#########################################################################
+#
+# CUPS in and of itself has this (general) filter chain (CAPITAL
+# letters are FILE-FORMATS or MIME types, other are filters (this is
+# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#     <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstoraster   # as shipped with CUPS, independent from any Ghostscipt
+#      |           # installation on the system
+#      |  (= "postscipt interpreter")
+#      |
+#      V
+# APPLICATION/VND.CUPS-RASTER
+#      |
+#      |
+#      V
+#     rasterto<replaceable>something</replaceable>  (f.e. Gimp-Print filters may be plugged in here)
+#      |   (= "raster driver")
+#      |
+#      V
+# SOMETHING-DEVICE-SPECIFIC
+#      |
+#      |
+#      V
+#     backend
+#
+#
+# ESP PrintPro has some enhanced "rasterto<replaceable>something</replaceable>" filters as compared to
+# CUPS, and also a somewhat improved "pstoraster" filter.
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+#########################################################################
+</programlisting>
+
+<programlisting>
+#########################################################################
+#
+# This is how "cupsomatic" comes into play:
+# =========================================
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#    <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#    pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
+#      |                                          |
+#      |                                          V
+#      V                                         cupsomatic
+#    pstoraster                                  (constructs complicated
+#      |  (= "postscipt interpreter")            Ghostscript commandline
+#      |                                         to let the file be
+#      V                                         processed by a
+# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=<replaceable>s.th.</replaceable>"
+#      |                                         call...)
+#      |                                          |
+#      V                                          |
+#    rasterto<replaceable>something</replaceable>                          V
+#      |    (= "raster driver")     +-------------------------+
+#      |                            | Ghostscript at work.... |
+#      V                            |                         |
+# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
+#      |                                          |
+#      |                                          |
+#      V                                          |
+#    backend &gt;------------------------------------+
+#      |
+#      |
+#      V
+#    THE PRINTER
+#
+#
+# Note, that cupsomatic "kidnaps" the printfile after the
+# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it through
+# the CUPS-external, systemwide Ghostscript installation, bypassing the
+# "pstoraster" filter (therefor also bypassing the CUPS-raster-drivers
+# "rasterto<replaceable>something</replaceable>", and hands the rasterized file directly to the CUPS
+# backend...
+#
+# cupsomatic is not made by the CUPS developers. It is an independent
+# contribution to printing development, made by people from
+# Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+#########################################################################
+</programlisting>
+
+<programlisting>
+#########################################################################
+#
+# And this is how it works for ESP PrintPro from 4.3:
+# ===================================================
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#     <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT
+#      |
+#      |
+#      V
+#     gsrip
+#      |  (= "postscipt interpreter")
+#      |
+#      V
+# APPLICATION/VND.CUPS-RASTER
+#      |
+#      |
+#      V
+#     rasterto<replaceable>something</replaceable>  (f.e. Gimp-Print filters may be plugged in here)
+#      |   (= "raster driver")
+#      |
+#      V
+# SOMETHING-DEVICE-SPECIFIC
+#      |
+#      |
+#      V
+#     backend
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+#########################################################################
+</programlisting>
+
+<programlisting>
+#########################################################################
+#
+# This is how "cupsomatic" would come into play with ESP PrintPro:
+# ================================================================
+#
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#    <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#    pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
+#      |                                          |
+#      |                                          V
+#      V                                         cupsomatic
+#    gsrip                                       (constructs complicated
+#      |  (= "postscipt interpreter")            Ghostscript commandline
+#      |                                         to let the file be
+#      V                                         processed by a
+# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=<replaceable>s.th.</replaceable>"
+#      |                                         call...)
+#      |                                          |
+#      V                                          |
+#    rasterto<replaceable>something</replaceable>                          V
+#      |   (= "raster driver")      +-------------------------+
+#      |                            | Ghostscript at work.... |
+#      V                            |                         |
+# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
+#      |                                          |
+#      |                                          |
+#      V                                          |
+#    backend &gt;------------------------------------+
+#      |
+#      |
+#      V
+#    THE PRINTER
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+#########################################################################
+</programlisting>
+
+<programlisting>
+#########################################################################
+#
+# And this is how it works for CUPS from 1.1.15:
+# ==============================================
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#     <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+#                                     |
+#                  +------------------v------------------------------+
+#                  | Ghostscript                                     |
+#                  | at work...                                      |
+#                  | (with                                           |
+#                  | "-sDEVICE=cups")                                |
+#                  |                                                 |
+#                  |         (= "postscipt interpreter")             |
+#                  |                                                 |
+#                  +------------------v------------------------------+
+#                                     |
+#                                     |
+# APPLICATION/VND.CUPS-RASTER &gt;-------+
+#      |
+#      |
+#      V
+#     rasterto<replaceable>something</replaceable>
+#      |   (= "raster driver")
+#      |
+#      V
+# SOMETHING-DEVICE-SPECIFIC
+#      |
+#      |
+#      V
+#     backend
+#
+#
+# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to
+#       Ghostscript. GNU Ghostscript needs to be patched to handle the
+#       CUPS requirement; ESP Ghostscript has this builtin. In any case,
+#       "gs -h" needs to show up a "cups" device. pstoraster is now a
+#       calling an appropriate "gs -sDEVICE=cups..." commandline to do
+#       the job. It will output "application/vnd.cup-raster", which will
+#       be finally processed by a CUPS raster driver "rasterto<replaceable>something</replaceable>"
+#       Note the difference to "cupsomatic", which will *not* output
+#       CUPS-raster, but a final version of the printfile, ready to be
+#       sent to the printer. cupsomatic also doesn't use the "cups"
+#       devicemode in Ghostscript, but one of the classical devicemodes....
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+#########################################################################
+</programlisting>
+
+<programlisting>
+#########################################################################
+#
+# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
+# ========================================================================
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#     <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+#                                     |
+#                  +------------------v------------------------------+
+#                  | Ghostscript        . Ghostscript at work....    |
+#                  | at work...         . (with "-sDEVICE=           |
+#                  | (with              .            <replaceable>s.th.</replaceable>"        |
+#                  | "-sDEVICE=cups")   .                            |
+#                  |                    .                            |
+#                  | (CUPS standard)    .      (cupsomatic)          |
+#                  |                    .                            |
+#                  |          (= "postscript interpreter")           |
+#                  |                    .                            |
+#                  +------------------v--------------v---------------+
+#                                     |              |
+#                                     |              |
+# APPLICATION/VND.CUPS-RASTER &gt;-------+              |
+#      |                                             |
+#      |                                             |
+#      V                                             |
+#     rasterto<replaceable>something</replaceable>                            |
+#      |   (= "raster driver")                       |
+#      |                                             |
+#      V                                             |
+# SOMETHING-DEVICE-SPECIFIC &gt;------------------------+
+#      |
+#      |
+#      V
+#     backend
+#
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+##########################################################################
+</programlisting>
+
+</sect1>
+
+
+<sect1>
+<title>CUPS Print Drivers and Devices</title>
+
+<para>
+CUPS ships with good support for HP LaserJet type printers. You can install
+the driver as follows:
+
+<itemizedlist>
+	<listitem><para>
+	lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
+	</para></listitem>
+</itemizedlist>
+
+(The "-m" switch will retrieve the "laserjet.ppd" from the standard repository
+for not-yet-installed-PPDs, which CUPS typically stores in 
+<filename>/usr/share/cups/model</filename>. Alternatively, you may use
+"-P /absolute/filesystem/path/to/where/there/is/PPD/your.ppd").
+</para>
+
+<sect2>
+<title>Further printing steps</title>
+
+<para>
+Always also consult the database on linuxprinting.org for all recommendations
+about which driver is best used for each printer:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/printer_list.cgi">http://www.linuxprinting.org/printer_list.cgi</ulink></para>
+
+<para>
+There select your model and click on "Show". You'll arrive at a page listing
+all drivers working with your model. There will always be *one* 
+<emphasis>recommended</emphasis> one. Try this one first. In your case
+("HP LaserJet 4 Plus"), you'll arrive here:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/show_printer.cgi?recnum=75104">http://www.linuxprinting.org/show_printer.cgi?recnum=75104</ulink></para>
+
+<para>
+The recommended driver is "ljet4". It has a link to the page for the ljet4
+driver too:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/show_driver.cgi?driver=ljet4">http://www.linuxprinting.org/show_driver.cgi?driver=ljet4</ulink>
+
+<para>
+On the driver's page, you'll find important and detailed info about how to use
+that driver within the various available spoolers. You can generate a PPD for
+CUPS. The PPD contains all the info about how to use your model and the driver;
+this is, once installed, working transparently for the user -- you'll only
+need to choose resolution, paper size etc. from the web-based menu or from
+the print dialog GUI or from the commandline...
+</para>
+
+<para>
+On the driver's page, choose to use the "PPD-O-Matic" online PPD generator
+program. Select your model and click "Generate PPD file". When you safe the
+appearing ASCII text file, don't use "cut'n'past" (as it could possiblly corrupt
+line endings and tabs), but use "Save as..." in your browser's menu. Save it
+at "/some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"
+</para>
+
+<para>
+Then install the printer:
+</para>
+<para><programlisting>
+    "lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P /some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"
+</programlisting></para>
+
+<para>
+Note, that for all the "Foomatic-PPDs" from Linuxprinting.org, you also need
+a special "CUPS filter" named "cupsomatic". Get the latest version of
+"cupsomatic" from:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/cupsomatic">http://www.linuxprinting.org/cupsomatic</ulink></para>
+
+<para>
+This needs to be copied to <filename>/usr/lib/cups/filter/cupsomatic</filename>
+and be made world executable. This filter is needed to read and act upon the
+specially encoded Foomatic comments, embedded in the printfile, which in turn
+are used to construct (transparently for you, the user) the complicated
+ghostscript command line needed for your printer/driver combo.
+</para>
+
+<para>
+You can have a look at all the options for the Ghostscript commandline supported
+by your printer and the ljet4 driver by going to the section "Execution details",
+selecting your model (Laserjet 4 Plus) and clicking on "Show execution details".
+This will bring up this web page:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/execution.cgi?driver=ljet4&amp;printer=75104&amp;.submit=Show+execution+details">http://www.linuxprinting.org/execution.cgi?driver=ljet4&amp;printer=75104&amp;.submit=Show+execution+details</ulink></para>
+
+<para>
+The ingenious thing is that the database is kept current. If there
+is a bug fix and an improvement somewhere in the database, you will
+always get the most current and stable and feature-rich driver by following
+the steps described above.
+</para>
+
+<note><para>
+Till Kamppeter from MandrakeSoft is doing an excellent job here that too few
+people are aware of. (So if you use it often, please send him a note showing
+your appreciation).</para></note>
+
+<para>
+The latest and greatest improvement now is support for "custom page sizes"
+for all those printers which support it.
+</para>
+
+<para>
+"cupsomatic" is documented here:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/cups-doc.html">http://www.linuxprinting.org/cups-doc.html</ulink></para>
+
+<para>
+More printing tutorial info may be found here:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/">http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/</ulink></para>
+
+<para>
+Note, that *all* the Foomatic drivers listed on Linuxprinting.org (now
+approaching the "all-time high" number of 1.000 for the supported models)
+are using a special filtering chain involving Ghostscript, as described
+in this document.
+</para>
+
+<para>
+Summary - You need:
+</para>
+
+<para>
+<simplelist>
+
+	<member>A "foomatic+<replaceable>something</replaceable>" PPD is not enough to print with CUPS (but it is *one* important component)</member>
+	<member>The "cupsomatic" filter script (Perl) in <filename>/usr/lib/cups/filters/</filename></member>
+	<member>Perl to make cupsomatic run</member>
+	<member>Ghostscript (because it is called and controlled by the PPD/cupsomatic combo in a way to fit your printermodel/driver combo.</member>
+	<member>Ghostscript *must*, depending on the driver/model, contain support for a certain "device" (as shown by "gs -h")</member>
+</simplelist>
+
+<para>
+In the case of the "hpijs" driver, you need a Ghostscript version, which
+has "ijs" amongst its supported devices in "gs -h". In the case of
+"hpijs+foomatic", a valid ghostscript commandline would be reading like this:
+</para>
+
+<para><programlisting>
+       gs -q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=ijs       \
+             -sIjsServer=hpijs<replaceable>PageSize</replaceable> -dDuplex=<replaceable>Duplex</replaceable> <replaceable>Model</replaceable>        \
+             -r<replaceable>Resolution</replaceable>,PS:MediaPosition=<replaceable>InputSlot</replaceable> -dIjsUseOutputFD \
+             -sOutputFile=- -
+</programlisting></para>
+
+<note><para>
+Note, that with CUPS and the "hpijs+foomatic" PPD (plus Perl and cupsomatic)
+you don't need to remember this. You can choose the available print options
+thru a GUI print command (like "glp" from ESP's commercially supported
+PrintPro software, or KDE's "kprinter", or GNOME's "gtklp" or the independent
+"xpp") or the CUPS web interface via human-readable drop-down selection
+menus.
+</para></note>
+
+<para>
+If you use "ESP Ghostscript" (also under the GPL, provided by Easy Software
+Products, the makers of CUPS, downloadable from
+<ulink url="http://www.cups.org/software.html">http://www.cups.org/software.html</ulink>,
+co-maintained by the developers of linuxprinting.org), you are guaranteed to
+have in use the most uptodate, bug-fixed, enhanced and stable version of a Free
+Ghostscript. It contains support for ~300 devices, whereas plain vanilla
+GNU Ghostscript 7.05 only has ~200.
+</para>
+
+<para>
+If you print only one CUPS test page, from the web interface and when you try to
+print a windows test page, it acts like the job was never sent:
+
+<simplelist>
+	<member>Can you print "standard" jobs from the CUPS machine?</member>
+	<member>Are the jobs from Windows visible in the Web interface on CUPS (http://localhost:631/)?</member>
+	<member><emphasis>Most important:</emphasis> What kind of printer driver are you using on the Windows clients?</member>
+</simplelist>
+
+You can try to get a more detailed debugging info by setting "LogLevel debug" in
+<filename>/etc/cups/cupsd.conf</filename>, re-start cupsd and investigate <filename>/var/log/cups/error_log</filename>
+for the whereabouts of your Windows-originating printjobs:
+</para>
+
+<simplelist>
+	<member>what does the "auto-typing" line say? which is the "MIME type" CUPS thinks is arriving from the Windows clients?</member>
+	<member>are there "filter" available for this MIME type?</member>
+	<member>are there "filter rules" defined in "/etc/cups/mime.convs" for this MIME type?</member>
+</simplelist>
+
+</sect1>
+
+
+<sect1>
+<title>Limiting the number of pages users can print</title>
+
+<para>
+The feature you want is dependent on the real print subsystem you're using.
+Samba's part is always to receive the job files from the clients (filtered
+*or* unfiltered) and hand it over to this printing subsystem.
+</para>
+
+<para>
+Of course one could "hack" things with one's own scripts.
+</para>
+
+<para>
+But there is CUPS (Common Unix Printing System). CUPS supports "quotas".
+Quotas can be based on sizes of jobs or on the number of pages or both,
+and are spanning any time period you want.
+</para>
+
+<para>
+This is an example command how root would set a print quota in CUPS,
+assuming an existing printer named "quotaprinter":
+</para>
+
+<programlisting>
+  lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100
+</programlisting>
+
+<para>
+This would limit every single user to print 100 pages or 1024 KB of
+data (whichever comes first) within the last 604.800 seconds ( = 1 week).
+</para>
+
+<para>
+For CUPS to count correctly, the printfile needs to pass the CUPS "pstops" filter,
+otherwise it uses a "dummy" count of "1". Some printfiles don't pass it
+(eg: image files) but then those are mostly 1 page jobs anyway. This also means,
+proprietary drivers for the target printer running on the client computers and
+CUPS/Samba then spooling these files as "raw" (i.e. leaving them untouched, not
+filtering them), will be counted as "1-pagers" too!
+</para>
+
+<para>
+You need to send PostScript from the clients (i.e. run a PostScript driver there)
+for having the chance to get accounting done. If the printer is a non-PostScript model,
+you need to let CUPS do the job to convert the file to a print-ready format for the
+target printer. This will be working for currently ~1.000 different printer models, see
+</para>
+
+<programlisting>
+     http://www.linuxprinting.org/printer_list.cgi
+</programlisting>
+
+<para>
+Before CUPS-1.1.16 your only option was to use the Adobe PostScript
+Driver on the Windows clients. The output of this driver was not always
+passed thru the "pstops" filter on the CUPS/Samba side, and therefor was
+not counted correctly (the reason is that it often --- depending on the
+"PPD" being used --- did write a "PJL"-header in front of the real
+PostScript which made CUPS to skip the pstops and go directy to
+the "pstoraster" stage).
+</para>
+
+<para>
+From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver
+for Windows NT/2K/XP clients" (it is tagged in the download area of
+http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package).
+It is *not* working for Win9x/ME clients. But it:
+</para>
+
+<simplelist>
+	<member>>it guarantees to not write an PJL-header</member>
+	<member>it guarantees to still read and support all PJL-options named in the driver PPD with its own means</member>
+	<member>it guarantees the file going thru the "pstops" filter on the CUPS/Samba server</member>
+	<member>it guarantees to page-count correctly the printfile</member>
+</simplelist>
+
+<para>
+You can read more about the setup of this combination in the
+manpage for "cupsaddsmb" (only present with CUPS installed, only
+current with CUPS 1.1.16).
+</para>
+
+<para>
+These are the items CUPS logs in the "page_log" for every single *page* of a job:
+</para>
+
+<para><programlisting>
+	* Printer name
+	* User name
+	* Job ID
+	* Time of printing
+	* the page number
+	* the number of copies
+	* a billing info string (optional)
+</programlisting></para>
+
+<para>
+Here is an extract of my CUPS server's page_log file to illustrate
+the format and included items:
+</para>
+
+<para><programlisting>
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 1 2  #marketing
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 2 2  #marketing
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 3 2  #marketing
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 4 2  #marketing
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 5 2  #marketing
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 6 2  #marketing
+</programlisting></para>
+
+<para>
+This was Job ID "40", printed on "infotec_IS2027" by user "kurt", a 6-page job
+printed in 2 copies and billed to "#marketing"...
+</para>
+
+<para>
+What flaws or shortcomings are there?
+</para>
+
+<simplelist>
+	<member>the ones named above</member>
+
+	<member>
+	CUPS really counts the job pages being *processsed in software*
+	(going thru the "RIP") rather than the physical sheets successfully
+	leaving the printing device -- if there is a jam while printing
+	the 5th sheet out of 1000 and the job is aborted by the printer,
+	the "page count" will still show the figure of 1000 for that job
+	</member>
+
+	<member>
+	all quotas are the same for all users (no flexibility to give the
+	boss a higher quota than the clerk) no support for groups
+	</member>
+
+	<member>
+	no means to read out the current balance or "used-up" number of current quota
+	</member>
+
+	<member>
+	a user having used up 99 sheets of 100 quota will still be able to send and print a 1.000 sheet job
+	</member>
+
+	<member>
+	a user being denied a job because of a filled-up quota doesn't get a meaningful
+	error message from CUPS other than "client-error-not-possible".
+	</member>
+</simplelist>
+
+<para>
+But this is the best system out there currently. And there are
+huge improvements under development:
+</para>
+
+<simplelist>
+	<member>page counting will go into the "backends" (these talk
+	directly to the printer and will increase the count in sync with the
+	 actual printing process  -- a jam at the 5th sheet will lead to a stop in the counting)</member>
+
+	<member>quotas will be handled more flexibly</member>
+
+	<member>probably there will be support for users to inquire their "accounts" in advance</member>
+
+	<member>probably there will be support for some other tools around this topic</member>
+</simplelist>
+
+<para>
+Other than the current stage of the CUPS development, I don't
+know any other ready-to-use tool which you could consider.
+</para>
+
+<para>
+You can download the driver files from
+<ulink url="http://www.cups.org/software.html">http://www.cups.org/software.html</ulink>.
+It is a separate package from the CUPS base software files, tagged as "CUPS 1.1.16
+Windows NT/2k/XP Printer Driver for SAMBA (tar.gz, 192k)". The filename to
+download is "cups-samba-1.1.16.tar.gz". Upon untar-/unzip-ping it will reveal
+the files:
+</para>
+
+<para>
+<programlisting>
+   cups-samba.install
+   cups-samba.license
+   cups-samba.readme
+   cups-samba.remove
+   cups-samba.ss
+</programlisting>
+</para>
+
+<para>
+These have been packaged with the ESP meta packager software "EPM". The
+*.install and *.remove files are simple shell script, which untars the
+*.ss (which is nothing else than a tar-archive) and puts its contents
+into <filename>/usr/share/cups/drivers/</filename>. Its contents are 3 files:
+</para>
+
+<para>
+<programlisting>
+   cupsdrvr.dll
+   cupsui.dll
+   cups.hlp
+</programlisting>
+</para>
+
+<note><para>
+ATTENTION: due to a bug one CUPS release puts the <filename>cups.hlp</filename>
+into <filename>/usr/share/drivers/</filename> instead of
+<filename>/usr/share/cups/drivers/</filename>. To work around this, copy/move
+the file after running the "./cups-samba.install" script manually to the right place:
+</para>
+
+<para>
+<programlisting>
+      cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
+</programlisting>
+</para>
+</note>
+
+<note>
+<para>
+This new CUPS PostScript driver is currently binary-only, but free
+no source code is provided (yet). The reason is this: it has
+been developed with the help of the Microsoft Driver Developer Kit (DDK)
+and compiled with Microsoft Visual Studio 6. It is not clear to the driver
+developers if they are allowed to distribute the whole of the source code
+as Free Software. However, they will likely release the "diff" in source
+code under the GPL, so anybody with a license of Visual Studio and a DDK
+will be able to compile for him/herself.
+</para>
+
+<para>
+Once you have run the install script (and possibly manually moved the
+"cups.hlp" file to "/usr/share/cups/drivers/"), the driver is ready to be
+put into Samba's [print$] share (which often maps to "/etc/samba/drivers/"
+and contains a subdir tree with WIN40 and W32X86 branches), by running
+"cupsaddsmb" (see also "man cupsaddsmb" for CUPS 1.1.16). [Don't forget to
+put root into the smbpasswd file by running "smbpasswd" should you run
+this whole procedure for the first time.] Once the driver files are in the
+[print$] share, they are ready to be downloaded and installed by the
+Win NT/2k/XP clients.
+</para></note>
+
+
+<note><para>
+NOTE 1: Win 9x/ME clients won't work with this driver. For these you'd
+still need to use the ADOBE*.* drivers as previously.
+</para></note>
+
+<note><para>
+NOTE 2: It is not harming if you've still the ADOBE*.* driver files from
+previous installations in the "/usr/share/cups/drivers/" directory.
+The new cupsaddsmb (from 1.1.16) will automatically use the
+"newest" installed driver (which here then is the CUPS drivers).
+</para></note>
+
+<note><para>
+NOTE 3: Should your Win clients have had the old ADOBE*.* files and the
+Adobe PostScript drivers installed, the download and installation
+of the new CUPS PostScript driver for Windows NT/2k/XP will fail
+at first.
+</para>
+<para>
+It is not enough to "delete" the printer (as the driver files
+will still be kept by the clients and re-used if you try to
+re-install the printer). To really get rid of the Adobe driver
+files on the clients, open the "Printers" folder (possibly via
+"Start --> Settings --> Control Panel --> Printers"), right-click
+onto the folder background and select "Server Properties". A
+new dialog opens; select the "Drivers" tab; on the list select
+the driver you want to delete and click on the "Delete" button.
+(This will only work if there is no single printer left which
+uses that particular driver -- you need to "delete" all printers
+using this driver in the "Printers" folder first.)
+</para>
+</note>
+
+<note><para>
+Once you have successfully downloaded the CUPS PostScript driver
+to a client, you can easily switch all printers to this one
+by proceeding as described elsewhere in the "Samba HOWTO
+Collection" to change a driver for an existing printer.
+</para></note>
+
+<para>
+What are the benefits with the "CUPS PostScript driver for Windows NT/2k/XP"
+as compared to the Adobe drivers?
+</para>
+       
+<para>
+<itemizedlist>
+	<listitem><para>
+	no hassle with the Adobe EULA
+	</para></listitem>
+
+	<listitem><para>
+	no hassle with the question "where do I get the ADOBE*.* driver files from?"
+	</para></listitem>
+
+	<listitem><para>
+	the Adobe drivers (depending on the printer PPD associated with them)
+	often put a PJL header in front of the core PostScript part of the print
+	file (thus the file starts with "<replaceable>1B</replaceable>%-12345X" or "<replaceable>escape</replaceable>%-12345X"
+	instead of "%!PS"). This leads to the CUPS daemon autotyping the
+	arriving file as a print-ready file, not requiring a pass thru the
+	"pstops" filter (to speak more technical, it is not regarded as the
+	generic MIME type "application/postscript", but as the more special
+	MIME type "application/cups.vnd-postscript"), which therefore also
+	leads to the page accounting in "/var/log/cups/page_log" not receiving
+	the exact mumber of pages; instead the dummy page number of "1" is
+	logged in a standard setup)
+	</para></listitem>
+
+	<listitem><para>
+	the Adobe driver has more options to "mis-configure" the PostScript
+	generated by it (like setting it inadvertedly to "Optimize for Speed",
+	instead of "Optimize for Portability", which could lead to CUPS being
+	unable to process it)
+	</para></listitem>
+
+	<listitem><para>
+	the CUPS PostScript driver output sent by Windows clients to the CUPS
+	server will be guaranteed to be auto-typed as generic MIME type
+	"application/postscript", thusly passing thru the CUPS "pstops" filter
+	and logging the correct number of pages in the page_log for accounting
+	and quota purposes
+	</para></listitem>
+
+	<listitem><para>
+	the CUPS PostScript driver supports the sending of additional print
+	options by the Win NT/2k/XP clients, such as naming the CUPS standard
+	banner pages (or the custom ones, should they be installed at the time
+	of driver download), using the CUPS "page-label" option, setting a
+	job-priority and setting the scheduled time of printing (with the option
+	to support additional useful IPP job attributes in the future).
+	</para></listitem>
+
+	<listitem><para>
+	the CUPS PostScript driver supports the inclusion of the new
+	"*cupsJobTicket" comments at the beginnig of the PostScript file (which
+	could be used in the future for all sort of beneficial extensions on
+	the CUPS side, but which will not disturb any other application as those
+	will regard it as a comment and simply ignore it).
+	</para></listitem>
+
+	<listitem><para>
+	the CUPS PostScript driver will be the heart of the fully fledged CUPS
+	IPP client for Windows NT/2k/XP to be released soon (probably alongside
+	the first Beta release for CUPS 1.2).
+	</para></listitem>
+
+</itemizedlist>
+</para>
+</sect1>
+
+<sect1>
+<title>Advanced Postscript Printing from MS Windows</title>
+
+<para>
+Let the Windows Clients use a PostScript driver to deliver poistscript to
+the samba print server (just like any Linux or Unix Client would also use
+PostScript to send to the server)
+</para>
+
+<para>
+Make the Unix printing subsystem to which Samba sends the job convert the
+incoming PostScript files to the native print format of the target printers
+(would be PCL if you have an HP printer)
+</para>
+
+<para>
+Now if you are afraid that this would just mean using a *Generic* PostScript
+driver for the clients that has no Simplex/Duplex selection, and no paper tray
+choice, but you need them to be able to set up print jobs, with all the bells
+and whistles of your printers:-
+</para>
+
+<simplelist>
+	<member>Not possible with traditional spooling systems</member>
+
+	<member>
+	But perfectly supported by CUPS (which uses "PPD" files to
+	describe how to control the print options for PostScript and
+	non-PostScript devices alike...
+	</member>
+</simplelist>
+
+<para>
+CUPS PPDs are working perfectly on Windows clients who use Adobe PostScript
+drivers (or the new CUPS PostScript driver for Windows NT/2K/XP). Clients can use
+them to setup the job to their liking and CUPS will use the received job options
+to make the (PCL-, ESC/P- or PostScript-) printer behave as required.
+</para>
+
+<para>
+If you want to have the additional benefit of page count logging and accounting
+then the CUPS PostScript driver is the best choice (better than the Adobe one).
+</para>
+
+<para>
+If you want to make the drivers downloadable for the clients then "cupsaddsmb" is
+your friend. It will setup the [print$] share on the Samba host to be ready to serve
+the clients for a "point and print" driver installation.
+</para>
+
+<warning>
+<para>What strings are attached?</para></warning>
+
+<para>
+There are some. But, given the sheer CPU power you can buy nowadays,
+these can be overcome easily. The strings:
+</para>
+
+<para>
+Well, if the CUPS/Samba side will have to print to many printers serving many users,
+you probably will need to set up a second server (which can do automatic load balancing
+with the first one, plus a degree of fail-over mechanism). Converting the incoming
+PostScript jobs, "interpreting" them for non-PostScript printers, amounts to the work
+of a "RIP" (Raster Image Processor) done in software. This requires more CPU and RAM
+than for the mere "raw spooling" task your current setup is solving. It all depends
+on the avarage and peak printing load the server should be able to handle.
+</para>
+
+</sect1>
+
+<sect1>
+<title>Auto-Deletion of CUPS spool files</title>
+
+<para>
+Samba print files pass thru two "spool" directories. One the incoming directory
+managed by Samba, (set eg: in the "path = /var/spool/samba" directive in the [printers]
+section of "smb.conf"). Second is the spool directory of your UNIX print subsystem.
+For CUPS it is normally "/var/spool/cups/", as set by the cupsd.conf directive
+"RequestRoot /var/spool/cups".
+</para>
+
+<para>
+I am not sure, which one of your directories keeps the files.  From what you say,
+it is most likely the Samba part.
+</para>
+
+<para>
+For the CUPS part, you may want to consult:
+</para>
+
+<programlisting>
+   http://localhost:631/sam.html#PreserveJobFiles and
+   http://localhost:631/sam.html#PreserveJobHistory and
+   http://localhost:631/sam.html#MaxJobs
+</programlisting>
+
+<para>
+There are the settings described for your CUPS daemon, which could lead to completed
+job files not being deleted.
+</para>
+
+<para>
+"PreserveJobHistory Yes" -- keeps some details of jobs in
+cupsd's mind (well it keeps the "c12345", "c12346" etc. files
+in the CUPS spool directory, which do a similar job as the
+old-fashioned BSD-LPD control files). This is set to "Yes"
+as a default.
+</para>
+
+<para>
+"PreserveJobFiles Yes" -- keeps the job files themselves in
+cupsd's mind (well it keeps the "d12345", "d12346" etc. files
+in the CUPS spool directory...). This is set to "No" as the
+CUPS default.
+</para>
+
+<para>
+"MaxJobs 500" -- this directive controls the maximum number
+of jobs that are kept in memory. Once the number of jobs
+reaches the limit, the oldest completed job is automatically
+purged from the system to make room for the new one. If all
+of the known jobs are still pending or active then the new
+job will be rejected. Setting the maximum to 0 disables this
+functionality. The default setting is 0.
+</para>
+
+<para>
+(There are also additional settings for "MaxJobsPerUser" and
+"MaxJobsPerPrinter"...)
+</para>
+
+<para>
+For everything to work as announced, you need to have three things:
+</para>
+
+<simplelist>
+
+	<member>
+	a Samba-smbd which is compiled against "libcups" (Check on Linux by running "ldd `which smbd`")
+	</member>
+
+	<member>
+	a Samba-smb.conf setting of "printing = cups"
+	</member>
+
+	<member>
+	another Samba-smb.conf setting of "printcap = cups"
+	</member>
+
+</simplelist>
+
+<note><para>
+Note, that in this case all other manually set printing-related
+commands (like "print command", "lpq command", "lprm command",
+"lppause command" or "lpresume command") are ignored and they
+should normally have no influence what-so-ever on your printing.
+</para></note>
+
+<para>
+If you want to do things manually, replace the "printing = cups"
+by "printing = bsd". Then your manually set commands may work
+(haven't tested this), and a "print command = lp -d %P %s; rm %s"
+may do what you need.
+</para>
+
+<para>
+You forgot to mention the CUPS version you're using. If you did
+set things up as described in the man pages, then the Samba
+spool files should be deleted. Otherwise it may be a bug. On
+the CUPS side, you can control the behaviour as described
+above.
+</para>
+
+<para>
+If you have more problems, post the output of these commands:
+</para>
+
+<para>
+<programlisting>
+   grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
+   grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
+</programlisting>
+</para>
+
+<para>
+(adapt paths as needed). These commands sanitize the files
+and cut out the empty lines and lines with comments, providing
+the "naked settings" in a compact way.
+</para>
+</sect1>
+</chapter>
diff --git a/docs/docbook/projdoc/ServerType.sgml b/docs/docbook/projdoc/ServerType.sgml
new file mode 100644
index 0000000000..41b1c0ed2f
--- /dev/null
+++ b/docs/docbook/projdoc/ServerType.sgml
@@ -0,0 +1,141 @@
+<chapter id="ServerType">
+<chapterinfo>
+        <author>
+                <firstname>John H</firstname><surname>Terpstra</surname>
+                <affiliation>
+                        <orgname>Samba Team</orgname>
+                        <address><email>jht@samba.org</email></address>
+                </affiliation>
+        </author>
+</chapterinfo>
+
+<title>Nomenclature of Server Types</title>
+
+<para>Adminstrators of Microsoft networks often refer to there being three
+different type of servers:</para>
+
+<itemizedlist>
+	<listitem><para>Stand Alone Server</para></listitem>
+	<listitem><para>Domain Member Server</para></listitem>
+	<listitem><para>Domain Controller</para>
+		<itemizedlist>
+			<listitem><para>Primary Domain Controller</para></listitem>
+			<listitem><para>Backup Domain Controller</para></listitem>
+			<listitem><para>ADS Domain Controller</para></listitem>
+		</itemizedlist>
+	</listitem>
+</itemizedlist>
+
+<para>A network administrator who is familiar with these terms and who
+wishes to migrate to or use Samba will want to know what these terms mean
+within a Samba context.</para>
+
+<sect1>
+<title>Stand Alone Server</title>
+
+<para>
+The term <emphasis>stand alone server</emphasis> means that the server
+will provide local authentication and access control for all resources
+that are available from it. In general this means that there will be a
+local user database. In more technical terms, it means that resources
+on the machine will either be made available in either SHARE mode or in
+USER mode. SHARE mode and USER mode security are documented under
+discussions regarding "security mode". The smb.conf configuration parameters
+that control security mode are: "security = user" and "security = share".
+</para>
+
+<para>
+Samba tends to blur the distinction a little in respect of what is
+a stand alone server. This is because the authentication database may be
+local or on a remote server, even if from the samba protocol perspective
+the samba server is NOT a member of a domain security context.
+</para>
+
+<para>
+Through the use of PAM (Pluggable Authentication Modules) and nsswitch
+(the name service switcher) the source of authentication may reside on 
+another server. We would be inclined to call this the authentication server.
+This means that the samba server may use the local Unix/Linux system
+password database (/etc/passwd or /etc/shadow), may use a local smbpasswd
+file (/etc/samba/smbpasswd or /usr/local/samba/lib/private/smbpasswd), or
+may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB
+server for authentication.
+</para>
+
+</sect1>
+
+<sect1>
+<title>Domain Member Server</title>
+
+<para>
+This mode of server operation involves the samba machine being made a member
+of a domain security context. This means by definition that all user authentication
+will be done from a centrally defined authentication regime. The authentication
+regime may come from an NT3/4 style (old domain technology) server, or it may be
+provided from an Active Directory server (ADS) running on MS Windows 2000 or later.
+>/para>
+
+<para><emphasis>
+Of course it should be clear that the authentication back end itself could be from any
+distributed directory architecture server that is supported by Samba. This can be
+LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory Server, etc.
+</emphasis></para>
+
+<para>
+Please refer to the section on Howto configure Samba as a Primary Domain Controller
+and for more information regarding how to create a domain machine account for a
+domain member server as well as for information regading how to enable the samba
+domain member machine to join the domain and to be fully trusted by it.
+</para>
+
+</sect1>
+
+<sect1>
+<title>Domain Controller</title>
+
+<para>
+Over the years public perceptions of what Domain Control really is has taken on an
+almost mystical nature. Before we branch into a brief overview of what Domain Control
+is the following types of controller are known:
+</para>
+
+<sect2>
+<title>Domain Controller Types</title>
+
+<simplelist>
+	<member>Primary Domain Controller</member>
+	<member>Backup Domain Controller</member>
+	<member>ADS Domain Controller</member>
+</simplelist>
+
+<para>
+The <emphasis>Primary Domain Controller</emphasis> or PDC plays an important role in the MS 
+Windows NT3 and NT4 Domain Control architecture, but not in the manner that so many
+expect. The PDC seeds the Domain Control database (a part of the Windows registry) and
+it plays a key part in synchronisation of the domain authentication database. 
+</para>
+
+<para>
+New to Samba-3.0.0 is the ability to use a back-end file that holds the same type of data as
+the NT4 style SAM (Security Account Manager) database (one of the registry files).
+The samba-3.0.0 SAM can be specified via the smb.conf file parameter "passwd backend" and
+valid options include <emphasis> smbpasswd tdbsam ldapsam nisplussam plugin unixsam</emphasis>.
+The smbpasswd, tdbsam and ldapsam options can have a "_nua" suffix to indicate that No Unix
+Accounts need to be created. In other words, the Samba SAM will be independant of Unix/Linux
+system accounts, provided a uid range is defined from which SAM accounts can be created.
+</para>
+
+<para>
+The <emphasis>Backup Domain Controller</emphasis> or BDC plays a key role in servicing network
+authentication requests. The BDC is biased to answer logon requests so that on a network segment
+that has a BDC and a PDC the BDC will be most likely to service network logon requests. The PDC will
+answer network logon requests when the BDC is too busy (high load). A BDC can be promoted to
+a PDC. If the PDC is on line at the time that the BDC is promoted to PDC the previous PDC is
+automatically demoted to a BDC.
+</para>
+
+<para>
+At this time Samba is NOT capable of acting as an <emphasis>ADS Domain Controller</emphasis>.
+
+</sect2>
+</sect1>
diff --git a/docs/docbook/projdoc/passdb.sgml b/docs/docbook/projdoc/passdb.sgml
new file mode 100644
index 0000000000..fa2d75bd34
--- /dev/null
+++ b/docs/docbook/projdoc/passdb.sgml
@@ -0,0 +1,1012 @@
+<chapter id="passdb">
+<chapterinfo>
+	<author>
+		<firstname>Jelmer</firstname><surname>Vernooij</surname>
+		<affiliation>
+			<orgname>The Samba Team</orgname>
+			<address><email>jelmer@samba.org</email></address>
+		</affiliation>
+	</author>
+	<author>
+		<firstname>Gerald (Jerry)</firstname><surname>Carter</surname>
+		<affiliation>
+			<orgname>Samba Team</orgname>
+			<address><email>jerry@samba.org</email></address>
+		</affiliation>
+	</author>
+	<author>
+		<firstname>Olivier (lem)</firstname><surname>Lemaire</surname>
+		<affiliation>
+			<orgname>IDEALX</orgname>
+			<address><email>olem@IDEALX.org</email></address>
+		</affiliation>
+	</author>
+	<author>
+		<firstname>Jeremy</firstname><surname>Allison</surname>
+		<affiliation>
+			<orgname>Samba Team</orgname>
+			<address>
+				<email>jra@samba.org</email>
+			</address>
+		</affiliation>
+	</author>
+	<author>
+		<firstname>John H</firstname><surname>Terpstra</surname>
+		<affiliation>
+			<orgname>Samba Team</orgname>
+			<address>
+				<email>jht@samba.org</email>
+			</address>
+		</affiliation>
+	</author>
+	
+	<pubdate>February 2003</pubdate>
+</chapterinfo>
+
+<title>User information database</title>
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>Old windows clients send plain text passwords over the wire. 
+	Samba can check these passwords by crypting them and comparing them 
+	to the hash stored in the unix user database.
+	</para>
+	
+	<para>
+	Newer windows clients send encrypted passwords (so-called 
+	Lanman and NT hashes) over 
+	the wire, instead of plain text passwords. The newest clients 
+	will only send encrypted passwords and refuse to send plain text 
+	passwords, unless their registry is tweaked.
+	</para>
+
+	<para>These passwords can't be converted to unix style encrypted 
+	passwords. Because of that you can't use the standard unix 
+	user database, and you have to store the Lanman and NT hashes 
+	somewhere else. </para>
+	
+	<para>Next to a differently encrypted passwords, 
+	windows also stores certain data for each user 
+	that is not stored in a unix user database, e.g. 
+	workstations the user may logon from, the location where his/her 
+	profile is stored, etc.
+	Samba retrieves and stores this information using a "passdb backend".
+	Commonly
+	available backends are LDAP, plain text file, MySQL and nisplus.
+	For more information, see the documentation about the 
+	<command>passdb backend = </command> parameter.
+	</para>
+</sect1>
+
+<sect1>
+	<title>Important Notes About Security</title>
+	
+	<para>The unix and SMB password encryption techniques seem similar 
+	on the surface. This similarity is, however, only skin deep. The unix 
+	scheme typically sends clear text passwords over the network when 
+	logging in. This is bad. The SMB encryption scheme never sends the 
+	cleartext password over the network but it does store the 16 byte 
+	hashed values on disk. This is also bad. Why? Because the 16 byte hashed 
+	values are a "password equivalent". You cannot derive the user's 
+	password from them, but they could potentially be used in a modified 
+	client to gain access to a server. This would require considerable 
+	technical knowledge on behalf of the attacker but is perfectly possible. 
+	You should thus treat the data stored in whatever 
+	passdb backend you use (smbpasswd file, ldap, mysql) as though it contained the 
+	cleartext passwords of all your users. Its contents must be kept 
+	secret, and the file should be protected accordingly.</para>
+	
+	<para>Ideally we would like a password scheme which neither requires 
+	plain text passwords on the net or on disk. Unfortunately this 
+	is not available as Samba is stuck with being compatible with 
+	other SMB systems (WinNT, WfWg, Win95 etc). </para>
+
+	<warning>
+		<para>Note that Windows NT 4.0 Service pack 3 changed the 
+		default for permissible authentication so that plaintext 
+		passwords are <emphasis>never</emphasis> sent over the wire. 
+		The solution to this is either to switch to encrypted passwords 
+		with Samba or edit the Windows NT registry to re-enable plaintext 
+		passwords. See the document WinNT.txt for details on how to do 
+		this.</para>
+		
+		<para>Other Microsoft operating systems which also exhibit 
+		this behavior includes</para>
+		
+		<para> These versions of MS Windows do not support full domain
+		security protocols, although they may log onto a domain environment.
+		Of these Only MS Windows XP Home does NOT support domain logons.</para>
+
+		<simplelist>
+			<member>MS DOS Network client 3.0 with 
+			the basic network redirector installed</member>
+			
+			<member>Windows 95 with the network redirector 
+			update installed</member>
+			
+			<member>Windows 98 [se]</member>
+
+			<member>Windows Me</member>
+
+			<member>Windows XP Home</member>
+		</simplelist>
+
+		<para> The following versions of MS Windows fully support domain
+		security protocols.</para>
+
+		<simplelist>
+			<member>Windows NT 3.5x</member>
+
+			<member>Windows NT 4.0</member>
+			
+			<member>Windows 2000 Professional</member>
+
+			<member>Windows 200x Server/Advanced Server</member>
+
+			<member>Windows XP Professional</member>
+		</simplelist>
+		
+		<para><emphasis>Note :</emphasis>All current release of 
+		Microsoft SMB/CIFS clients support authentication via the
+		SMB Challenge/Response mechanism described here.  Enabling
+		clear text authentication does not disable the ability
+		of the client to participate in encrypted authentication.</para>
+
+
+		<para>MS Windows clients will cache the encrypted password alone.
+		Even when plain text passwords are re-enabled, through the appropriate
+		registry change, the plain text password is NEVER cached. This means that
+		in the event that a network connections should become disconnected (broken)
+		only the cached (encrypted) password will be sent to the resource server
+		to affect a auto-reconnect. If the resource server does not support encrypted
+		passwords the auto-reconnect will fail. <emphasis>USE OF ENCRYPTED PASSWORDS
+		IS STRONGLY ADVISED.</emphasis></para>
+	</warning>
+
+	<sect2>
+		<title>Advantages of SMB Encryption</title>
+
+		<simplelist>
+			<member>Plain text passwords are not passed across 
+			the network. Someone using a network sniffer cannot just 
+			record passwords going to the SMB server.</member>
+		 
+			<member>WinNT doesn't like talking to a server 
+			that SM not support encrypted passwords. It will refuse 
+			to browse the server if the server is also in user level 
+			security mode. It will insist on prompting the user for the 
+			password on each connection, which is very annoying. The
+			only things you can do to stop this is to use SMB encryption.
+			</member>
+
+			<member>Encrypted password support allows auto-matic share
+			(resource) reconnects.</member>
+		</simplelist>
+	</sect2>
+
+
+	<sect2>
+		<title>Advantages of non-encrypted passwords</title>
+
+		<simplelist>
+			<member>Plain text passwords are not kept 
+			on disk, and are NOT cached in memory. </member>
+			
+			<member>Uses same password file as other unix 
+			services such as login and ftp</member>
+			
+			<member>Use of other services (such as telnet and ftp) which
+			send plain text passwords over the net, so sending them for SMB
+			isn't such a big deal.</member>
+		</simplelist>
+	</sect2>
+</sect1>
+
+
+<sect1>
+	<title>The smbpasswd Command</title>
+	
+	<para>The smbpasswd utility is a utility similar to the 
+	<command>passwd</command> or <command>yppasswd</command> programs.
+	It maintains the two 32 byte password fields in the passdb backend. </para>
+
+	<para><command>smbpasswd</command> works in a client-server mode 
+	where it contacts the local smbd to change the user's password on its 
+	behalf. This has enormous benefits - as follows.</para>
+
+	<para><command>smbpasswd</command> has the capability 
+	to change passwords on Windows NT servers (this only works when 
+	the request is sent to the NT Primary Domain Controller if you 
+	are changing an NT Domain user's password).</para>
+	
+	<para>To run smbpasswd as a normal user just type :</para>
+	
+	<para><prompt>$ </prompt><userinput>smbpasswd</userinput></para>
+	<para><prompt>Old SMB password: </prompt><userinput>&lt;type old value here - 
+	or hit return if there was no old password&gt;</userinput></para>
+	<para><prompt>New SMB Password: </prompt><userinput>&lt;type new value&gt;
+	</userinput></para>
+	<para><prompt>Repeat New SMB Password: </prompt><userinput>&lt;re-type new value
+	</userinput></para>
+	
+	<para>If the old value does not match the current value stored for 
+	that user, or the two new values do not match each other, then the 
+	password will not be changed.</para>
+	
+	<para>If invoked by an ordinary user it will only allow the user 
+	to change his or her own Samba password.</para>
+	
+	<para>If run by the root user smbpasswd may take an optional 
+	argument, specifying the user name whose SMB password you wish to 
+	change.  Note that when run as root smbpasswd does not prompt for 
+	or check the old password value, thus allowing root to set passwords 
+	for users who have forgotten their passwords.</para>
+	
+	<para><command>smbpasswd</command> is designed to work in the same way 
+	and be familiar to UNIX users who use the <command>passwd</command> or 
+	<command>yppasswd</command> commands.</para>
+
+	<para>For more details on using <command>smbpasswd</command> refer 
+	to the man page which will always be the definitive reference.</para>
+</sect1>
+
+<!--
+<sect1>
+<title>The <command>pdbedit</command> command</title>
+FIXME
+</sect1>
+-->
+
+<sect1>
+<title>Plain text</title>
+<para>
+Older versions of samba retrieved user information from the unix user database 
+and eventually some other fields from the file <filename>/etc/samba/smbpasswd</filename>
+or <filename>/etc/smbpasswd</filename>. When password encryption is disabled, no 
+data is stored at all.
+</para>
+</sect1>
+
+<sect1>
+<title>TDB</title>
+<para>Samba can also store the user data in a "TDB" (Trivial Database). Using this backend 
+doesn't require any additional configuration. This backend is recommended for new installations who 
+don't require LDAP.
+</para>
+</sect1>
+
+<sect1>
+<title>LDAP</title>
+
+<sect2>
+<title>Introduction</title>
+
+<para>
+This document describes how to use an LDAP directory for storing Samba user
+account information traditionally stored in the smbpasswd(5) file.  It is
+assumed that the reader already has a basic understanding of LDAP concepts
+and has a working directory server already installed.  For more information
+on LDAP architectures and Directories, please refer to the following sites.
+</para>
+
+<itemizedlist>
+	<listitem><para>OpenLDAP - <ulink url="http://www.openldap.org/">http://www.openldap.org/</ulink></para></listitem>
+	<listitem><para>iPlanet Directory Server - <ulink url="http://iplanet.netscape.com/directory">http://iplanet.netscape.com/directory</ulink></para></listitem>
+</itemizedlist>
+
+<para>
+Note that <ulink url="http://www.ora.com/">O'Reilly Publishing</ulink> is working on
+a guide to LDAP for System Administrators which has a planned release date of
+early summer, 2002.
+</para>
+
+<para>
+Two additional Samba resources which may prove to be helpful are
+</para>
+
+<itemizedlist>
+	<listitem><para>The <ulink url="http://www.unav.es/cti/ldap-smb/ldap-smb-3-howto.html">Samba-PDC-LDAP-HOWTO</ulink>
+	maintained by Ignacio Coupeau.</para></listitem>
+
+	<listitem><para>The NT migration scripts from <ulink url="http://samba.idealx.org/">IDEALX</ulink> that are
+	geared to manage users and group in such a Samba-LDAP Domain Controller configuration.
+	</para></listitem>
+</itemizedlist>
+
+</sect2>
+
+<sect2>
+<title>Introduction</title>
+
+<para>
+Traditionally, when configuring <ulink url="smb.conf.5.html#ENCRYPTPASSWORDS">"encrypt
+passwords = yes"</ulink> in Samba's <filename>smb.conf</filename> file, user account
+information such as username, LM/NT password hashes, password change times, and account
+flags have been stored in the <filename>smbpasswd(5)</filename> file.  There are several
+disadvantages to this approach for sites with very large numbers of users (counted
+in the thousands).
+</para>
+
+<itemizedlist>
+<listitem><para>
+The first is that all lookups must be performed sequentially.  Given that
+there are approximately two lookups per domain logon (one for a normal
+session connection such as when mapping a network drive or printer), this
+is a performance bottleneck for lareg sites.  What is needed is an indexed approach
+such as is used in databases.
+</para></listitem>
+
+<listitem><para>
+The second problem is that administrators who desired to replicate a
+smbpasswd file to more than one Samba server were left to use external
+tools such as <command>rsync(1)</command> and <command>ssh(1)</command>
+and wrote custom, in-house scripts.
+</para></listitem>
+
+<listitem><para>
+And finally, the amount of information which is stored in an
+smbpasswd entry leaves no room for additional attributes such as
+a home directory, password expiration time, or even a Relative
+Identified (RID).
+</para></listitem>
+</itemizedlist>
+
+<para>
+As a result of these defeciencies, a more robust means of storing user attributes
+used by smbd was developed.  The API which defines access to user accounts
+is commonly referred to as the samdb interface (previously this was called the passdb
+API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support
+for a samdb backend (e.g. <parameter>--with-ldapsam</parameter> or
+<parameter>--with-tdbsam</parameter>) requires compile time support.
+</para>
+
+<para>
+When compiling Samba to include the <parameter>--with-ldapsam</parameter> autoconf
+option, smbd (and associated tools) will store and lookup user accounts in
+an LDAP directory.  In reality, this is very easy to understand.  If you are
+comfortable with using an smbpasswd file, simply replace "smbpasswd" with
+"LDAP directory" in all the documentation.
+</para>
+
+<para>
+There are a few points to stress about what the <parameter>--with-ldapsam</parameter>
+does not provide.  The LDAP support referred to in the this documentation does not
+include:
+</para>
+
+<itemizedlist>
+	<listitem><para>A means of retrieving user account information from
+	an Windows 2000 Active Directory server.</para></listitem>
+	<listitem><para>A means of replacing /etc/passwd.</para></listitem>
+</itemizedlist>
+
+<para>
+The second item can be accomplished by using LDAP NSS and PAM modules.  LGPL
+versions of these libraries can be obtained from PADL Software
+(<ulink url="http://www.padl.com/">http://www.padl.com/</ulink>).  However,
+the details of configuring these packages are beyond the scope of this document.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Supported LDAP Servers</title>
+
+<para>
+The LDAP samdb code in 2.2.3 (and later) has been developed and tested
+using the OpenLDAP 2.0 server and client libraries. 
+The same code should be able to work with Netscape's Directory Server
+and client SDK. However, due to lack of testing so far, there are bound
+to be compile errors and bugs.  These should not be hard to fix.
+If you are so inclined, please be sure to forward all patches to
+<ulink url="samba-patches@samba.org">samba-patches@samba.org</ulink> and
+<ulink url="jerry@samba.org">jerry@samba.org</ulink>.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Schema and Relationship to the RFC 2307 posixAccount</title>
+
+
+<para>
+Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in
+<filename>examples/LDAP/samba.schema</filename>.  The sambaAccount objectclass is given here:
+</para>
+
+<para><programlisting>
+objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL
+     DESC 'Samba Account'
+     MUST ( uid $ rid )
+     MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
+            logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
+            displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
+            description $ userWorkstations $ primaryGroupID $ domain ))
+</programlisting></para>
+
+<para>
+The samba.schema file has been formatted for OpenLDAP 2.0.  The OID's are
+owned by the Samba Team and as such is legal to be openly published.
+If you translate the schema to be used with Netscape DS, please
+submit the modified schema file as a patch to <ulink
+url="jerry@samba.org">jerry@samba.org</ulink>
+</para>
+
+<para>
+Just as the smbpasswd file is mean to store information which supplements a
+user's <filename>/etc/passwd</filename> entry, so is the sambaAccount object
+meant to supplement the UNIX user account information.  A sambaAccount is a
+<constant>STRUCTURAL</constant> objectclass so it can be stored individually
+in the directory.  However, there are several fields (e.g. uid) which overlap
+with the posixAccount objectclass outlined in RFC2307.  This is by design.
+</para>
+
+<!--olem: we should perhaps have a note about shadowAccounts too as many
+systems use them, isn'it ? -->
+
+<para>
+In order to store all user account information (UNIX and Samba) in the directory,
+it is necessary to use the sambaAccount and posixAccount objectclasses in
+combination.  However, smbd will still obtain the user's UNIX account
+information via the standard C library calls (e.g. getpwnam(), et. al.).
+This means that the Samba server must also have the LDAP NSS library installed
+and functioning correctly.  This division of information makes it possible to
+store all Samba account information in LDAP, but still maintain UNIX account
+information in NIS while the network is transitioning to a full LDAP infrastructure.
+</para>
+</sect2>
+
+<sect2>
+<title>Configuring Samba with LDAP</title>
+
+
+<sect3>
+<title>OpenLDAP configuration</title>
+
+<para>
+To include support for the sambaAccount object in an OpenLDAP directory
+server, first copy the samba.schema file to slapd's configuration directory.
+</para>
+
+<para>
+<prompt>root# </prompt><command>cp samba.schema /etc/openldap/schema/</command>
+</para>
+
+<para>
+Next, include the <filename>samba.schema</filename> file in <filename>slapd.conf</filename>.
+The sambaAccount object contains two attributes which depend upon other schema
+files.  The 'uid' attribute is defined in <filename>cosine.schema</filename> and
+the 'displayName' attribute is defined in the <filename>inetorgperson.schema</filename>
+file.  Both of these must be included before the <filename>samba.schema</filename> file.
+</para>
+
+<para><programlisting>
+## /etc/openldap/slapd.conf
+
+## schema files (core.schema is required by default)
+include	           /etc/openldap/schema/core.schema
+
+## needed for sambaAccount
+include            /etc/openldap/schema/cosine.schema
+include            /etc/openldap/schema/inetorgperson.schema
+include            /etc/openldap/schema/samba.schema
+
+## uncomment this line if you want to support the RFC2307 (NIS) schema
+## include         /etc/openldap/schema/nis.schema
+
+....
+</programlisting></para>
+
+<para>
+It is recommended that you maintain some indices on some of the most usefull attributes,
+like in the following example, to speed up searches made on sambaAccount objectclasses
+(and possibly posixAccount and posixGroup as well).
+</para>
+<para><programlisting>
+# Indices to maintain
+## required by OpenLDAP 2.0
+index objectclass   eq
+
+## support pb_getsampwnam()
+index uid           pres,eq
+## support pdb_getsambapwrid()
+index rid           eq
+
+## uncomment these if you are storing posixAccount and
+## posixGroup entries in the directory as well
+##index uidNumber     eq
+##index gidNumber     eq
+##index cn            eq
+##index memberUid     eq
+</programlisting></para>
+</sect3>
+
+
+<sect3>
+<title>Configuring Samba</title>
+<!--lem: <title>smb.conf LDAP parameters</title> -->
+
+<para>
+The following parameters are available in smb.conf only with <parameter>--with-ldapsam</parameter>
+was included with compiling Samba.
+</para>
+
+<itemizedlist>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPSSL">ldap ssl</ulink></para></listitem>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPSERVER">ldap server</ulink></para></listitem>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPADMINDN">ldap admin dn</ulink></para></listitem>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPSUFFIX">ldap suffix</ulink></para></listitem>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPFILTER">ldap filter</ulink></para></listitem>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPPORT">ldap port</ulink></para></listitem>
+</itemizedlist>
+
+<para>
+These are described in the <ulink url="smb.conf.5.html">smb.conf(5)</ulink> man
+page and so will not be repeated here.  However, a sample smb.conf file for
+use with an LDAP directory could appear as
+</para>
+
+<para><programlisting>
+## /usr/local/samba/lib/smb.conf
+[global]
+     security = user
+     encrypt passwords = yes
+
+     netbios name = TASHTEGO
+     workgroup = NARNIA
+
+     # ldap related parameters
+
+     # define the DN to use when binding to the directory servers
+     # The password for this DN is not stored in smb.conf.  Rather it
+     # must be set by using 'smbpasswd -w <replaceable>secretpw</replaceable>' to store the
+     # passphrase in the secrets.tdb file.  If the "ldap admin dn" values
+     # changes, this password will need to be reset.
+     ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
+
+     #  specify the LDAP server's hostname (defaults to locahost)
+     ldap server = ahab.samba.org
+
+     # Define the SSL option when connecting to the directory
+     # ('off', 'start tls', or 'on' (default))
+     ldap ssl = start tls
+
+     # define the port to use in the LDAP session (defaults to 636 when
+     # "ldap ssl = on")
+     ldap port = 389
+
+     # specify the base DN to use when searching the directory
+     ldap suffix = "ou=people,dc=samba,dc=org"
+
+     # generally the default ldap search filter is ok
+     # ldap filter = "(&amp;(uid=%u)(objectclass=sambaAccount))"
+</programlisting></para>
+
+
+</sect3>
+</sect2>
+
+
+<sect2>
+<title>Accounts and Groups management</title>
+
+<para>
+As users accounts are managed thru the sambaAccount objectclass, you should
+modify you existing administration tools to deal with sambaAccount attributes.
+</para>
+
+<para>
+Machines accounts are managed with the sambaAccount objectclass, just
+like users accounts. However, it's up to you to stored thoses accounts
+in a different tree of you LDAP namespace: you should use
+"ou=Groups,dc=plainjoe,dc=org" to store groups and
+"ou=People,dc=plainjoe,dc=org" to store users. Just configure your
+NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration
+file).
+</para>
+
+<para>
+In Samba release 3.0, the group management system is based on posix
+groups. This means that Samba make usage of the posixGroup objectclass.
+For now, there is no NT-like group system management (global and local
+groups).
+</para>
+
+</sect2>
+
+<sect2>
+<title>Security and sambaAccount</title>
+
+
+<para>
+There are two important points to remember when discussing the security
+of sambaAccount entries in the directory.
+</para>
+
+<itemizedlist>
+	<listitem><para><emphasis>Never</emphasis> retrieve the lmPassword or
+	ntPassword attribute values over an unencrypted LDAP session.</para></listitem>
+	<listitem><para><emphasis>Never</emphasis> allow non-admin users to
+	view the lmPassword or ntPassword attribute values.</para></listitem>
+</itemizedlist>
+
+<para>
+These password hashes are clear text equivalents and can be used to impersonate
+the user without deriving the original clear text strings.  For more information
+on the details of LM/NT password hashes, refer to the <ulink
+url="ENCRYPTION.html">ENCRYPTION chapter</ulink> of the Samba-HOWTO-Collection.
+</para>
+
+<para>
+To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults
+to require an encrypted session (<command>ldap ssl = on</command>) using
+the default port of 636
+when contacting the directory server.  When using an OpenLDAP 2.0 server, it
+is possible to use the use the StartTLS LDAP extended  operation in the place of
+LDAPS.  In either case, you are strongly discouraged to disable this security
+(<command>ldap ssl = off</command>).
+</para>
+
+<para>
+Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS
+extended operation.  However, the OpenLDAP library still provides support for
+the older method of securing communication between clients and servers.
+</para>
+
+<para>
+The second security precaution is to prevent non-administrative users from
+harvesting password hashes from the directory.  This can be done using the
+following ACL in <filename>slapd.conf</filename>:
+</para>
+
+<para><programlisting>
+## allow the "ldap admin dn" access, but deny everyone else
+access to attrs=lmPassword,ntPassword
+     by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write
+     by * none
+</programlisting></para>
+
+
+</sect2>
+
+
+
+<sect2>
+<title>LDAP specials attributes for sambaAccounts</title>
+
+<para>
+The sambaAccount objectclass is composed of the following attributes:
+</para>
+
+<itemizedlist>
+
+	<listitem><para><constant>lmPassword</constant>: the LANMAN password 16-byte hash stored as a character
+	representation of a hexidecimal string.</para></listitem>
+
+	<listitem><para><constant>ntPassword</constant>: the NT password hash 16-byte stored as a character
+	representation of a hexidecimal string.</para></listitem>
+
+	<listitem><para><constant>pwdLastSet</constant>: The integer time in seconds since 1970 when the
+	<constant>lmPassword</constant> and <constant>ntPassword</constant> attributes were last set.
+	</para></listitem>
+
+	<listitem><para><constant>acctFlags</constant>: string of 11 characters surrounded by square brackets []
+	representing account flags such as U (user), W(workstation), X(no password expiration), and
+	D(disabled).</para></listitem>
+
+	<listitem><para><constant>logonTime</constant>: Integer value currently unused</para></listitem>
+
+	<listitem><para><constant>logoffTime</constant>: Integer value currently unused</para></listitem>
+
+	<listitem><para><constant>kickoffTime</constant>: Integer value currently unused</para></listitem>
+
+	<listitem><para><constant>pwdCanChange</constant>: Integer value currently unused</para></listitem>
+
+	<listitem><para><constant>pwdMustChange</constant>: Integer value currently unused</para></listitem>
+
+	<listitem><para><constant>homeDrive</constant>: specifies the drive letter to which to map the
+	UNC path specified by homeDirectory. The drive letter must be specified in the form "X:"
+	where X is the letter of the drive to map. Refer to the "logon drive" parameter in the
+	smb.conf(5) man page for more information.</para></listitem>
+
+	<listitem><para><constant>scriptPath</constant>: The scriptPath property specifies the path of
+	the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path
+	is relative to the netlogon share.  Refer to the "logon script" parameter in the
+	smb.conf(5) man page for more information.</para></listitem>
+
+	<listitem><para><constant>profilePath</constant>: specifies a path to the user's profile.
+	This value can be a null string, a local absolute path, or a UNC path.  Refer to the
+	"logon path" parameter in the smb.conf(5) man page for more information.</para></listitem>
+
+	<listitem><para><constant>smbHome</constant>: The homeDirectory property specifies the path of
+	the home directory for the user. The string can be null. If homeDrive is set and specifies
+	a drive letter, homeDirectory should be a UNC path. The path must be a network
+	UNC path of the form \\server\share\directory. This value can be a null string.
+	Refer to the "logon home" parameter in the smb.conf(5) man page for more information.
+	</para></listitem>
+
+	<listitem><para><constant>userWorkstation</constant>: character string value currently unused.
+	</para></listitem>
+
+	<listitem><para><constant>rid</constant>: the integer representation of the user's relative identifier
+	(RID).</para></listitem>
+
+	<listitem><para><constant>primaryGroupID</constant>: the relative identifier (RID) of the primary group
+	of the user.</para></listitem>
+
+</itemizedlist>
+
+<para>
+The majority of these parameters are only used when Samba is acting as a PDC of
+a domain (refer to the <ulink url="Samba-PDC-HOWTO.html">Samba-PDC-HOWTO</ulink> for details on
+how to configure Samba as a Primary Domain Controller). The following four attributes
+are only stored with the sambaAccount entry if the values are non-default values:
+</para>
+
+<itemizedlist>
+	<listitem><para>smbHome</para></listitem>
+	<listitem><para>scriptPath</para></listitem>
+	<listitem><para>logonPath</para></listitem>
+	<listitem><para>homeDrive</para></listitem>
+</itemizedlist>
+
+<para>
+These attributes are only stored with the sambaAccount entry if
+the values are non-default values.  For example, assume TASHTEGO has now been
+configured as a PDC and that <command>logon home = \\%L\%u</command> was defined in
+its <filename>smb.conf</filename> file. When a user named "becky" logons to the domain,
+the <parameter>logon home</parameter> string is expanded to \\TASHTEGO\becky.
+If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org",
+this value is used.  However, if this attribute does not exist, then the value
+of the <parameter>logon home</parameter> parameter is used in its place.  Samba
+will only write the attribute value to the directory entry is the value is
+something other than the default (e.g. \\MOBY\becky).
+</para>
+
+
+</sect2>
+
+
+
+<sect2>
+<title>Example LDIF Entries for a sambaAccount</title>
+
+
+<para>
+The following is a working LDIF with the inclusion of the posixAccount objectclass:
+</para>
+
+<para><programlisting>
+dn: uid=guest2, ou=people,dc=plainjoe,dc=org
+ntPassword: 878D8014606CDA29677A44EFA1353FC7
+pwdMustChange: 2147483647
+primaryGroupID: 1201
+lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+pwdLastSet: 1010179124
+logonTime: 0
+objectClass: sambaAccount
+uid: guest2
+kickoffTime: 2147483647
+acctFlags: [UX         ]
+logoffTime: 2147483647
+rid: 19006
+pwdCanChange: 0
+</programlisting></para>
+
+<para>
+The following is an LDIF entry for using both the sambaAccount and
+posixAccount objectclasses:
+</para>
+
+<para><programlisting>
+dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
+logonTime: 0
+displayName: Gerald Carter
+lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+primaryGroupID: 1201
+objectClass: posixAccount
+objectClass: sambaAccount
+acctFlags: [UX         ]
+userPassword: {crypt}BpM2ej8Rkzogo
+uid: gcarter
+uidNumber: 9000
+cn: Gerald Carter
+loginShell: /bin/bash
+logoffTime: 2147483647
+gidNumber: 100
+kickoffTime: 2147483647
+pwdLastSet: 1010179230
+rid: 19000
+homeDirectory: /home/tashtego/gcarter
+pwdCanChange: 0
+pwdMustChange: 2147483647
+ntPassword: 878D8014606CDA29677A44EFA1353FC7
+</programlisting></para>
+
+</sect2>
+</sect1>
+
+<sect1>
+<title>MySQL</title>
+
+<sect2>
+<title>Building</title>
+
+<para>To build the plugin, run <command>make bin/pdb_mysql.so</command>
+in the <filename>source/</filename> directory of samba distribution. 
+</para>
+
+<para>Next, copy pdb_mysql.so to any location you want. I 
+strongly recommend installing it in $PREFIX/lib or /usr/lib/samba/</para>
+
+</sect2>
+
+<sect2>
+<title>Creating the database</title>
+
+<para>
+You either can set up your own table and specify the field names to pdb_mysql (see below
+for the column names) or use the default table. The file <filename>examples/pdb/mysql/mysql.dump</filename> 
+contains the correct queries to create the required tables. Use the command :
+
+<command>mysql -u<replaceable>username</replaceable> -h<replaceable>hostname</replaceable> -p<replaceable>password</replaceable> <replaceable>databasename</replaceable> < <filename>/path/to/samba/examples/pdb/mysql/mysql.dump</filename></command>
+
+</para>
+</sect2>
+
+<sect2>
+<title>Configuring</title>
+
+<para>This plugin lacks some good documentation, but here is some short info:</para>
+
+<para>Add a the following to the <command>passdb backend</command> variable in your <filename>smb.conf</filename>:
+<programlisting>
+passdb backend = [other-plugins] plugin:/location/to/pdb_mysql.so:identifier [other-plugins]
+</programlisting>
+</para>
+
+<para>The identifier can be any string you like, as long as it doesn't collide with 
+the identifiers of other plugins or other instances of pdb_mysql. If you 
+specify multiple pdb_mysql.so entries in 'passdb backend', you also need to 
+use different identifiers!
+</para>
+
+<para>
+Additional options can be given thru the smb.conf file in the [global] section.
+</para>
+
+<para><programlisting>
+identifier:mysql host                     - host name, defaults to 'localhost'
+identifier:mysql password
+identifier:mysql user                     - defaults to 'samba'
+identifier:mysql database                 - defaults to 'samba'
+identifier:mysql port                     - defaults to 3306
+identifier:table                          - Name of the table containing users
+</programlisting></para>
+
+<warning>
+<para>
+Since the password for the mysql user is stored in the 
+smb.conf file, you should make the the smb.conf file 
+readable only to the user that runs samba. This is considered a security 
+bug and will be fixed soon.
+</para>
+</warning>
+
+<para>Names of the columns in this table(I've added column types those columns should have first):</para>
+
+<para><programlisting>
+identifier:logon time column             - int(9)
+identifier:logoff time column            - int(9)
+identifier:kickoff time column           - int(9)
+identifier:pass last set time column     - int(9)
+identifier:pass can change time column   - int(9)
+identifier:pass must change time column  - int(9)
+identifier:username column               - varchar(255) - unix username
+identifier:domain column                 - varchar(255) - NT domain user is part of
+identifier:nt username column            - varchar(255) - NT username
+identifier:fullname column            - varchar(255) - Full name of user
+identifier:home dir column               - varchar(255) - Unix homedir path
+identifier:dir drive column              - varchar(2) - Directory drive path (eg: 'H:')
+identifier:logon script column           - varchar(255) - Batch file to run on client side when logging on
+identifier:profile path column           - varchar(255) - Path of profile
+identifier:acct desc column              - varchar(255) - Some ASCII NT user data
+identifier:workstations column           - varchar(255) - Workstations user can logon to (or NULL for all)
+identifier:unknown string column         - varchar(255) - unknown string
+identifier:munged dial column            - varchar(255) - ?
+identifier:uid column                    - int(9) - Unix user ID (uid)
+identifier:gid column                    - int(9) - Unix user group (gid)
+identifier:user sid column               - varchar(255) - NT user SID
+identifier:group sid column              - varchar(255) - NT group ID
+identifier:lanman pass column            - varchar(255) - encrypted lanman password
+identifier:nt pass column                - varchar(255) - encrypted nt passwd
+identifier:plain pass column             - varchar(255) - plaintext password
+identifier:acct control column           - int(9) - nt user data
+identifier:unknown 3 column              - int(9) - unknown
+identifier:logon divs column             - int(9) - ?
+identifier:hours len column              - int(9) - ?
+identifier:unknown 5 column              - int(9) - unknown
+identifier:unknown 6 column              - int(9) - unknown
+</programlisting></para>
+
+<para>
+Eventually, you can put a colon (:) after the name of each column, which 
+should specify the column to update when updating the table. You can also
+specify nothing behind the colon - then the data from the field will not be 
+updated. 
+</para>
+
+</sect2>
+
+<sect2>
+<title>Using plaintext passwords or encrypted password</title>
+
+<para>
+I strongly discourage the use of plaintext passwords, however, you can use them:
+</para>
+
+<para>
+If you would like to use plaintext passwords, set 'identifier:lanman pass column' and 'identifier:nt pass column' to 'NULL' (without the quotes) and 'identifier:plain pass column' to the name of the column containing the plaintext passwords. 
+</para>
+
+<para>
+If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Getting non-column data from the table</title>
+
+<para>
+It is possible to have not all data in the database and making some 'constant'.
+</para>
+
+<para>
+For example, you can set 'identifier:fullname column' to : 
+<command>CONCAT(First_name,' ',Sur_name)</command>
+</para>
+
+<para>
+Or, set 'identifier:workstations column' to :
+<command>NULL</command></para>
+
+<para>See the MySQL documentation for more language constructs.</para>
+
+</sect2>
+</sect1>
+
+<sect1>
+<title>Passdb XML plugin</title>
+
+<sect2>
+<title>Building</title>
+
+<para>This module requires libxml2 to be installed.</para>
+
+<para>To build pdb_xml, run: <command>make bin/pdb_xml.so</command> in 
+the directory <filename>source/</filename>. </para>
+
+</sect2>
+
+<sect2>
+<title>Usage</title>
+
+<para>The usage of pdb_xml is pretty straightforward. To export data, use:
+
+<command>pdbedit -e plugin:/usr/lib/samba/pdb_xml.so:filename</command>
+
+(where filename is the name of the file to put the data in)
+</para>
+
+<para>
+To import data, use:
+<command>pdbedit -i plugin:/usr/lib/samba/pdb_xml.so:filename -e current-pdb</command>
+
+Where filename is the name to read the data from and current-pdb to put it in.
+</para>
+</sect2>
+</sect1>
+
+</chapter>
diff --git a/docs/docbook/projdoc/unicode.sgml b/docs/docbook/projdoc/unicode.sgml
new file mode 100644
index 0000000000..7d8f0a03be
--- /dev/null
+++ b/docs/docbook/projdoc/unicode.sgml
@@ -0,0 +1,93 @@
+<chapter id="unicode">
+<chapterinfo>
+	<author>
+		<firstname>Jelmer</firstname><surname>Vernooij</surname>
+		<affiliation>
+			<orgname>Samba Team</orgname>
+			<address><email>jelmer@samba.org</email></address>
+		</affiliation>
+	</author>
+	<pubdate>25 March 2003</pubdate>
+</chapterinfo>
+
+<title>Unicode/Charsets</title>
+
+<sect1>
+<title>What are charsets and unicode?</title>
+
+<para>
+Computers communicate in numbers. In texts, each number will be 
+translated to a corresponding letter. The meaning that will be assigned 
+to a certain number depends on the <emphasis>character set(charset)
+</emphasis> that is used. 
+A charset can be seen as a table that is used to translate numbers to 
+letters. Not all computers use the same charset (there are charsets 
+with German umlauts, Japanese characters, etc). Usually a charset contains 
+256 characters, which means that storing a character with it takes 
+exactly one byte. </para>
+
+<para>
+There are also charsets that support even more characters, 
+but those need twice(or even more) as much storage space. These 
+charsets can contain <command>256 * 256 = 65536</command> characters, which
+is more then all possible characters one could think of. They are called 
+multibyte charsets (because they use more then one byte to 
+store one character). 
+</para>
+
+<para>
+A standardised multibyte charset is unicode, info available at 
+<ulink url="http://www.unicode.org/">www.unicode.org</ulink>. 
+Big advantage of using a multibyte charset is that you only need one; no 
+need to make sure two computers use the same charset when they are 
+communicating.
+</para>
+
+<para>Old windows clients used to use single-byte charsets, named 
+'codepages' by microsoft. However, there is no support for 
+negotiating the charset to be used in the smb protocol. Thus, you 
+have to make sure you are using the same charset when talking to an old client.
+Newer clients (Windows NT, 2K, XP) talk unicode over the wire.
+</para>
+</sect1>
+
+<sect1>
+<title>Samba and charsets</title>
+
+<para>
+As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, 
+samba knows of three kinds of character sets: 
+</para>
+
+<variablelist>
+	<varlistentry>
+		<term>unix charset</term>
+		<listitem><para>
+		This is the charset used internally by your operating system. 
+		The default is <emphasis>ASCII</emphasis>, which is fine for most 
+		systems.
+		</para></listitem>
+	</varlistentry>
+
+	<varlistentry>
+		<term>display charset</term>
+		<listitem><para>This is the charset samba will use to print messages
+		on your screen. It should generally be the same as the <command>unix charset</command>.
+		</para></listitem>
+	</varlistentry>
+
+	<varlistentry>
+		<term>dos charset</term>
+		<listitem><para>This is the charset samba uses when communicating with 
+		DOS and Windows 9x clients. It will talk unicode to all newer clients.
+		The default depends on the charsets you have installed on your system.
+		Run <command>testparm -v | grep "dos charset"</command> to see 
+		what the default is on your system. 
+		</para></listitem>
+	</varlistentry>
+</variablelist>
+
+<para>
+
+</sect1>
+</chapter>
diff --git a/docs/docbook/smbdotconf/base/adsserver.xml b/docs/docbook/smbdotconf/base/adsserver.xml
new file mode 100644
index 0000000000..4dd2a4b635
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/adsserver.xml
@@ -0,0 +1,15 @@
+<samba:parameter name="ads server"
+                 context="G"
+                 basic="1" advanced="1" wizard="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>If this option is specified, samba does not try to figure out what
+        ads server to use itself, but uses the specified ads server. Either one
+        DNS name or IP address can be used.</para>
+        
+        <para>Default: <command moreinfo="none">ads server = </command></para>
+        
+        <para>Example: <command moreinfo="none">ads server = 192.168.1.2</command></para>
+</listitem>
+
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/bindinterfacesonly.xml b/docs/docbook/smbdotconf/base/bindinterfacesonly.xml
new file mode 100644
index 0000000000..3ad9aa4614
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/bindinterfacesonly.xml
@@ -0,0 +1,71 @@
+<samba:parameter name="bind interfaces only"
+                 context="G"
+                 advanced="1" wizard="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>This global parameter allows the Samba admin 
+        to limit what interfaces on a machine will serve SMB requests. It 
+        affects file service <citerefentry><refentrytitle>smbd</refentrytitle>
+        <manvolnum>8</manvolnum></citerefentry> and name service <citerefentry><refentrytitle>nmbd</refentrytitle>
+        <manvolnum>8</manvolnum></citerefentry> in a slightly different ways.</para>
+
+	<para>For name service it causes <command moreinfo="none">nmbd</command> to bind 
+	to ports 137 and 138 on the interfaces listed in 
+        the <link linkend="INTERFACES">interfaces</link> parameter. <command moreinfo="none">nmbd</command> also 
+        binds to the &quot;all addresses&quot; interface (0.0.0.0) 
+	on ports 137 and 138 for the purposes of reading broadcast messages. 
+	If this option is not set then <command moreinfo="none">nmbd</command> will service 
+	name requests on all of these sockets. If <parameter moreinfo="none">bind interfaces
+	only</parameter> is set then <command moreinfo="none">nmbd</command> will check the 
+	source address of any packets coming in on the broadcast sockets 
+	and discard any that don't match the broadcast addresses of the 
+	interfaces in the <parameter moreinfo="none">interfaces</parameter> parameter list. 
+	As unicast packets are received on the other sockets it allows 
+	<command moreinfo="none">nmbd</command> to refuse to serve names to machines that 
+	send packets that arrive through any interfaces not listed in the
+	<parameter moreinfo="none">interfaces</parameter> list.  IP Source address spoofing
+	does defeat this simple check, however, so it must not be used
+	seriously as a security feature for <command moreinfo="none">nmbd</command>.</para>
+
+	<para>For file service it causes <citerefentry><refentrytitle>smbd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> to bind only to the interface list 
+	given in the <link linkend="INTERFACES">interfaces</link> parameter. This 
+        restricts the networks that <command moreinfo="none">smbd</command> will serve 
+        to packets coming in those interfaces.  Note that you should not use this parameter 
+        for machines that are serving PPP or other intermittent or non-broadcast network 
+	interfaces as it will not cope with non-permanent interfaces.</para>
+
+	<para>If <parameter moreinfo="none">bind interfaces only</parameter> is set then 
+	unless the network address <emphasis>127.0.0.1</emphasis> is added 
+	to the <parameter moreinfo="none">interfaces</parameter> parameter 
+        list <citerefentry><refentrytitle>smbpasswd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> and <citerefentry><refentrytitle>swat</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> may not work as expected due 
+        to the reasons covered below.</para>
+
+	<para>To change a users SMB password, the <command moreinfo="none">smbpasswd</command>
+	by default connects to the <emphasis>localhost - 127.0.0.1</emphasis> 
+	address as an SMB client to issue the password change request. If 
+	<parameter moreinfo="none">bind interfaces only</parameter> is set then unless the 
+	network address <emphasis>127.0.0.1</emphasis> is added to the
+	<parameter moreinfo="none">interfaces</parameter> parameter list then <command moreinfo="none">
+	smbpasswd</command> will fail to connect in it's default mode. 
+	<command moreinfo="none">smbpasswd</command> can be forced to use the primary IP interface 
+	of the local host by using its <citerefentry><refentrytitle>smbpasswd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry>	<parameter moreinfo="none">-r <replaceable>remote machine</replaceable></parameter>
+	parameter, with <replaceable>remote machine</replaceable> set 
+	to the IP name of the primary interface of the local host.</para>
+
+	<para>The <command moreinfo="none">swat</command> status page tries to connect with
+	<command moreinfo="none">smbd</command> and <command moreinfo="none">nmbd</command> at the address 
+	<emphasis>127.0.0.1</emphasis> to determine if they are running.  
+	Not adding <emphasis>127.0.0.1</emphasis>  will cause <command moreinfo="none">
+	smbd</command> and <command moreinfo="none">nmbd</command> to always show
+	&quot;not running&quot; even if they really are.  This can prevent <command moreinfo="none">
+	swat</command> from starting/stopping/restarting <command moreinfo="none">smbd</command>
+	and <command moreinfo="none">nmbd</command>.</para>
+
+	<para>Default: <command moreinfo="none">bind interfaces only = no</command></para>
+		
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/comment.xml b/docs/docbook/smbdotconf/base/comment.xml
new file mode 100644
index 0000000000..f08d06ef25
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/comment.xml
@@ -0,0 +1,18 @@
+<samba:parameter name="comment"
+                 context="S"
+                 basic="1" advanced="1" share="1" print="1" developer="1" 
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>This is a text field that is seen next to a share 
+	when a client does a queries the server, either via the network 
+	neighborhood or via <command moreinfo="none">net view</command> to list what shares 
+	are available.</para>
+
+	<para>If you want to set the string that is displayed next to the 
+	machine name then see the <link linkend="SERVERSTRING"><parameter moreinfo="none">
+	server string</parameter></link> parameter.</para>
+
+	<para>Default: <emphasis>No comment string</emphasis></para>
+	<para>Example: <command moreinfo="none">comment = Fred's Files</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/directory.xml b/docs/docbook/smbdotconf/base/directory.xml
new file mode 100644
index 0000000000..f912c39c8c
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/directory.xml
@@ -0,0 +1,9 @@
+<samba:parameter name="directory"
+                 context="S"
+                 hide="1"
+                 xmlns:samba="http://samba.org/common">
+                
+<listitem>
+        <para>Synonym for <link linkend="PATH"><parameter moreinfo="none">path</parameter></link>.</para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/displaycharset.xml b/docs/docbook/smbdotconf/base/displaycharset.xml
new file mode 100644
index 0000000000..e02842ab48
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/displaycharset.xml
@@ -0,0 +1,16 @@
+<samba:parameter name="display charset"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>Specifies the charset that samba will use 
+	to print messages to stdout and stderr and SWAT will use. 
+	Should generally be the same as the <command moreinfo="none">unix charset</command>.
+	</para>
+
+	<para>Default: <command moreinfo="none">display charset = ASCII</command></para>
+
+	<para>Example: <command moreinfo="none">display charset = UTF8</command></para>
+
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/doscharset.xml b/docs/docbook/smbdotconf/base/doscharset.xml
new file mode 100644
index 0000000000..5fc718dcaa
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/doscharset.xml
@@ -0,0 +1,16 @@
+<samba:parameter name="dos charset"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>DOS SMB clients assume the server has 
+	the same charset as they do. This option specifies which 
+	charset Samba should talk to DOS clients.
+	</para>
+
+	<para>The default depends on which charsets you have installed. 
+	Samba tries to use charset 850 but falls back to ASCII in 
+	case it is not available. Run <citerefentry><refentrytitle>testparm</refentrytitle>
+	<manvolnum>1</manvolnum></citerefentry> to check the default on your system.</para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/interfaces.xml b/docs/docbook/smbdotconf/base/interfaces.xml
new file mode 100644
index 0000000000..3fa346e206
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/interfaces.xml
@@ -0,0 +1,51 @@
+<samba:parameter name="interfaces"
+                 context="G"
+                 basic="1" advanced="1" wizard="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>This option allows you to override the default 
+	network interfaces list that Samba will use for browsing, name 
+	registration and other NBT traffic. By default Samba will query 
+	the kernel for the list of all active interfaces and use any 
+	interfaces except 127.0.0.1 that are broadcast capable.</para>
+
+	<para>The option takes a list of interface strings. Each string 
+	can be in any of the following forms:</para>
+
+	<itemizedlist>
+		<listitem><para>a network interface name (such as eth0). 
+		This may include shell-like wildcards so eth* will match 
+		any interface starting with the substring &quot;eth&quot;</para></listitem>
+			
+		<listitem><para>an IP address. In this case the netmask is 
+		determined from the list of interfaces obtained from the 
+		kernel</para></listitem>
+			
+		<listitem><para>an IP/mask pair. </para></listitem>
+			
+		<listitem><para>a broadcast/mask pair.</para></listitem>
+	</itemizedlist>
+
+	<para>The &quot;mask&quot; parameters can either be a bit length (such 
+	as 24 for a C class network) or a full netmask in dotted 
+	decimal form.</para>
+
+	<para>The &quot;IP&quot; parameters above can either be a full dotted 
+	decimal IP address or a hostname which will be looked up via 
+	the OS's normal hostname resolution mechanisms.</para>
+
+	<para>For example, the following line:</para>
+		
+	<para><command moreinfo="none">interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0</command></para>
+
+	<para>would configure three network interfaces corresponding 
+	to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10. 
+	The netmasks of the latter two interfaces would be set to 255.255.255.0.</para>
+
+	<para>See also <link linkend="BINDINTERFACESONLY"><parameter moreinfo="none">bind 
+	interfaces only</parameter></link>.</para>
+		
+	<para>Default: <emphasis>all active interfaces except 127.0.0.1 
+	that are broadcast capable</emphasis></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/netbiosaliases.xml b/docs/docbook/smbdotconf/base/netbiosaliases.xml
new file mode 100644
index 0000000000..a62fb8f7d6
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/netbiosaliases.xml
@@ -0,0 +1,20 @@
+<samba:parameter name="netbios aliases"
+                 context="G"
+                 advanced="1" wizard="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>This is a list of NetBIOS names that <ulink url="nmbd.8.html">nmbd(8)</ulink> will 
+        advertise as additional names by which the Samba server is known. This allows one machine 
+	to appear in browse lists under multiple names. If a machine is acting as a browse server 
+        or logon server none of these names will be advertised as either browse server or logon 
+	servers, only the primary name of the machine will be advertised with these capabilities.
+        </para>
+		
+	<para>See also <link linkend="NETBIOSNAME"><parameter moreinfo="none">netbios 
+	name</parameter></link>.</para>
+
+	<para>Default: <emphasis>empty string (no additional names)</emphasis></para>
+
+	<para>Example: <command moreinfo="none">netbios aliases = TEST TEST1 TEST2</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/netbiosname.xml b/docs/docbook/smbdotconf/base/netbiosname.xml
new file mode 100644
index 0000000000..287a8f9f9f
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/netbiosname.xml
@@ -0,0 +1,20 @@
+<samba:parameter name="netbios name"
+                 context="G"
+                 basic="1" advanced="1" wizard="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>This sets the NetBIOS name by which a Samba 
+	server is known. By default it is the same as the first component 
+	of the host's DNS name. If a machine is a browse server or
+	logon server this name (or the first component
+	of the hosts DNS name) will be the name that these services are
+	advertised under.</para>
+		
+	<para>See also <link linkend="NETBIOSALIASES"><parameter moreinfo="none">netbios 
+	aliases</parameter></link>.</para>
+
+	<para>Default: <emphasis>machine DNS name</emphasis></para>
+
+	<para>Example: <command moreinfo="none">netbios name = MYNAME</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/netbiosscope.xml b/docs/docbook/smbdotconf/base/netbiosscope.xml
new file mode 100644
index 0000000000..8c5866bc32
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/netbiosscope.xml
@@ -0,0 +1,10 @@
+<samba:parameter name="netbios scope"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>This sets the NetBIOS scope that Samba will 
+	operate under. This should not be set unless every machine 
+	on your LAN also sets this value.</para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/path.xml b/docs/docbook/smbdotconf/base/path.xml
new file mode 100644
index 0000000000..9f0a7cd976
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/path.xml
@@ -0,0 +1,31 @@
+<samba:parameter name="path"
+                 context="S"
+                 basic="1" advanced="1" share="1" print="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>This parameter specifies a directory to which 
+	the user of the service is to be given access. In the case of 
+	printable services, this is where print data will spool prior to 
+	being submitted to the host for printing.</para>
+
+	<para>For a printable service offering guest access, the service 
+	should be readonly and the path should be world-writeable and 
+	have the sticky bit set. This is not mandatory of course, but 
+	you probably won't get the results you expect if you do 
+	otherwise.</para>
+
+	<para>Any occurrences of <parameter moreinfo="none">%u</parameter> in the path 
+	will be replaced with the UNIX username that the client is using 
+	on this connection. Any occurrences of <parameter moreinfo="none">%m</parameter> 
+	will be replaced by the NetBIOS name of the machine they are 
+	connecting from. These replacements are very useful for setting 
+	up pseudo home directories for users.</para>
+
+	<para>Note that this path will be based on <link linkend="ROOTDIR">
+	<parameter moreinfo="none">root dir</parameter></link> if one was specified.</para>
+
+	<para>Default: <emphasis>none</emphasis></para>
+
+	<para>Example: <command moreinfo="none">path = /home/fred</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/realm.xml b/docs/docbook/smbdotconf/base/realm.xml
new file mode 100644
index 0000000000..c0b1d1aad6
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/realm.xml
@@ -0,0 +1,15 @@
+<samba:parameter name="realm"
+                 context="G"
+                 basic="1" advanced="1" wizard="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>This option specifies the kerberos realm to use. The realm is 
+	used as the ADS equivalent of the NT4 <command moreinfo="none">domain</command>. It
+	is usually set to the DNS name of the kerberos server.
+	</para>
+		
+	<para>Default: <command moreinfo="none">realm = </command></para>
+
+	<para>Example: <command moreinfo="none">realm = mysambabox.mycompany.com</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/serverstring.xml b/docs/docbook/smbdotconf/base/serverstring.xml
new file mode 100644
index 0000000000..5935dd80dd
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/serverstring.xml
@@ -0,0 +1,24 @@
+<samba:parameter name="server string"
+                 context="G"
+                 basic="1" advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>This controls what string will show up in the printer comment box in print 
+        manager and next to the IPC connection in <command moreinfo="none">net view</command>. It 
+        can be any string that you wish to show to your users.</para>
+		
+	<para>It also sets what will appear in browse lists next 
+	to the machine name.</para>
+
+	<para>A <parameter moreinfo="none">%v</parameter> will be replaced with the Samba 
+	version number.</para>
+
+	<para>A <parameter moreinfo="none">%h</parameter> will be replaced with the 
+	hostname.</para>
+
+	<para>Default: <command moreinfo="none">server string = Samba %v</command></para>
+
+	<para>Example: <command moreinfo="none">server string = University of GNUs Samba 
+	Server</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/unixcharset.xml b/docs/docbook/smbdotconf/base/unixcharset.xml
new file mode 100644
index 0000000000..f003c097aa
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/unixcharset.xml
@@ -0,0 +1,15 @@
+<samba:parameter name="unix charset"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>Specifies the charset the unix machine 
+	Samba runs on uses. Samba needs to know this in order to be able to 
+	convert text to the charsets other SMB clients use.
+	</para>
+
+	<para>Default: <command moreinfo="none">unix charset = UTF8</command></para>
+
+	<para>Example: <command moreinfo="none">unix charset = ASCII</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/base/workgroup.xml b/docs/docbook/smbdotconf/base/workgroup.xml
new file mode 100644
index 0000000000..65300bca58
--- /dev/null
+++ b/docs/docbook/smbdotconf/base/workgroup.xml
@@ -0,0 +1,16 @@
+<samba:parameter name="workgroup"
+                 context="G"
+                 basic="1" advanced="1" wizard="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+        <para>This controls what workgroup your server will 
+	appear to be in when queried by clients. Note that this parameter 
+	also controls the Domain name used with 
+        the <link linkend="SECURITYEQUALSDOMAIN"><command moreinfo="none">security = domain</command></link>
+	setting.</para>
+
+	<para>Default: <emphasis>set at compile time to WORKGROUP</emphasis></para>
+
+	<para>Example: <command moreinfo="none">workgroup = MYGROUP</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/generate-file-list.sh b/docs/docbook/smbdotconf/generate-file-list.sh
new file mode 100755
index 0000000000..3495f50c43
--- /dev/null
+++ b/docs/docbook/smbdotconf/generate-file-list.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+echo "<variablelist>"
+find . -type f -name '*.xml' -mindepth 2 | sort -t/ -k3 |
+        while read ; do  
+                echo "<xi:include href='$REPLY' parse='xml' xmlns:xi='http://www.w3.org/2001/XInclude'/>"
+        done
+                
+echo "</variablelist>"
diff --git a/docs/docbook/smbdotconf/smbconf.dtd b/docs/docbook/smbdotconf/smbconf.dtd
new file mode 100644
index 0000000000..591c9b2738
--- /dev/null
+++ b/docs/docbook/smbdotconf/smbconf.dtd
@@ -0,0 +1,10 @@
+<!ELEMENT  parameter  (#PCDATA)                  >
+<!ATTLIST  parameter  name      CDATA  #REQUIRED >
+<!ATTLIST  parameter  context   CDATA  #REQUIRED >
+<!ATTLIST  parameter  basic     CDATA  #REQUIRED >
+<!ATTLIST  parameter  wizard    CDATA  #REQUIRED >
+<!ATTLIST  parameter  advanced  CDATA  #REQUIRED >
+<!ATTLIST  parameter  share     CDATA  #REQUIRED >
+<!ATTLIST  parameter  print     CDATA  #REQUIRED >
+<!ATTLIST  parameter  developer CDATA  #REQUIRED >
+<!ATTLIST  parameter  hide      CDATA  #REQUIRED >
diff --git a/docs/docbook/smbdotconf/split-original-smb.conf.xsl b/docs/docbook/smbdotconf/split-original-smb.conf.xsl
new file mode 100644
index 0000000000..7a6a2b920a
--- /dev/null
+++ b/docs/docbook/smbdotconf/split-original-smb.conf.xsl
@@ -0,0 +1,78 @@
+<?xml version='1.0'?>
+<!-- vim:set sts=2 shiftwidth=2 syntax=xml: -->
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+                xmlns:exsl="http://exslt.org/common"
+                xmlns:samba="http://samba.org/common"
+		version="1.1"
+                extension-element-prefixes="exsl">
+
+<xsl:output method="xml"/>
+
+<xsl:param name="output.dir.name" select="'test/'"/>
+
+<!-- This is needed to copy content unchanged -->
+<xsl:template match="@*|node()">
+  <xsl:copy>
+    <xsl:apply-templates select="@*|node()"/>
+  </xsl:copy>
+</xsl:template>
+
+<!-- Parse all varlistentries and extract those of them which are descriptions of smb.conf
+     parameters. We determine them by existence of <anchor> element inside <term> element.
+     If <anchor> is there, then its 'id' attribute is translated to lower case and is used
+     as basis for file name for that parameter.
+-->
+<xsl:template match="varlistentry">
+  <xsl:variable name="output.dir.name" select="$output.dir.name"/>
+  <!-- Extract anchor's 'id' and translate it to lower case -->
+  <xsl:variable name="fname">
+        <xsl:value-of select="translate(string(term/anchor/@id),
+                'ABCDEFGHIJKLMNOPQRSTUVWXYZ','abcdefghijklmnopqrstuvwxyz')"/>
+  </xsl:variable>
+  <!-- reconstruct varlistentry - not all of them will go into separate files
+       and also we must repair the main varlistentry itself.
+  -->
+  <xsl:variable name="content">
+       <xsl:apply-templates/>
+  </xsl:variable>
+  <!-- Now put varlistentry into separate file _if_ it has anchor associated with it -->
+  <xsl:choose>
+    <xsl:when test="$fname != ''">
+      <!-- full file name -->
+      <xsl:variable name="filename"><xsl:value-of select="$output.dir.name"/><xsl:value-of select="$fname"/>.xml</xsl:variable>
+      <!-- Debug message for an operator, just to show progress of processing :) -->
+      <xsl:message>
+        <xsl:text>Writing </xsl:text>
+        <xsl:value-of select="$filename"/>
+        <xsl:text> for </xsl:text>
+        <xsl:value-of select="name(.)"/>
+        <xsl:if test="term/anchor/@id">
+          <xsl:text>(</xsl:text>
+          <xsl:value-of select="term/anchor/@id"/>
+          <xsl:text>)</xsl:text>
+        </xsl:if>
+      </xsl:message>
+      <!-- Write finally varlistentry to a separate file -->
+      <exsl:document href="{$filename}" 
+                   method="xml" 
+                   encoding="UTF-8" 
+                   indent="yes"
+                   omit-xml-declaration="yes">
+        <xsl:element name="samba:parameter">
+           <xsl:copy-of select="$content"/>
+        </xsl:element>
+      </exsl:document>
+      <xsl:text disable-output-escaping="yes">&amp;smb.</xsl:text>
+      <xsl:value-of select="$fname"/>
+      <xsl:text>;</xsl:text>
+    </xsl:when>
+   <!-- this was a varlistentry w/o anchor associated, just dump it to the main document -->
+  <xsl:otherwise>
+    <xsl:element name="varlistentry">
+      <xsl:copy-of select="$content"/>
+    </xsl:element>
+  </xsl:otherwise>
+  </xsl:choose>
+</xsl:template>
+
+</xsl:stylesheet>
diff --git a/source3/include/popt_common.h b/source3/include/popt_common.h
new file mode 100644
index 0000000000..57850bf682
--- /dev/null
+++ b/source3/include/popt_common.h
@@ -0,0 +1,48 @@
+/* 
+   Unix SMB/CIFS implementation.
+   Common popt arguments
+   Copyright (C) Jelmer Vernooij	2003
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef _POPT_COMMON_H
+#define _POPT_COMMON_H
+
+/* Common popt structures */
+extern struct poptOption popt_common_samba[];
+extern struct poptOption popt_common_connection[];
+extern struct poptOption popt_common_version[];
+extern struct poptOption popt_common_credentials[];
+
+#ifndef POPT_TABLEEND
+#define POPT_TABLEEND { NULL, '\0', 0, 0, 0, NULL, NULL }
+#endif
+
+#define POPT_COMMON_SAMBA { NULL, 0, POPT_ARG_INCLUDE_TABLE, popt_common_samba, 0, "Common samba options:", NULL },
+#define POPT_COMMON_CONNECTION { NULL, 0, POPT_ARG_INCLUDE_TABLE, popt_common_connection, 0, "Connection options:", NULL },
+#define POPT_COMMON_VERSION { NULL, 0, POPT_ARG_INCLUDE_TABLE, popt_common_version, 0, "Common samba options:", NULL },
+#define POPT_COMMON_CREDENTIALS { NULL, 0, POPT_ARG_INCLUDE_TABLE, popt_common_credentials, 0, "Authentication options:", NULL },
+
+struct user_auth_info {
+	pstring username;
+	pstring password;
+	BOOL got_pass;
+	BOOL use_kerberos;
+};
+
+extern struct user_auth_info cmdline_auth_info;
+
+#endif /* _POPT_COMMON_H */
diff --git a/source3/modules/vfs_fake_perms.c b/source3/modules/vfs_fake_perms.c
new file mode 100644
index 0000000000..121a99a451
--- /dev/null
+++ b/source3/modules/vfs_fake_perms.c
@@ -0,0 +1,287 @@
+/* 
+ * Fake Perms VFS module.  Implements passthrough operation of all VFS
+ * calls to disk functions, except for file permissions, which are now
+ * mode 0700 for the current uid/gid.
+ *
+ * Copyright (C) Tim Potter, 1999-2000
+ * Copyright (C) Alexander Bokovoy, 2002
+ * Copyright (C) Andrew Bartlett, 2002
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *  
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *  
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include "config.h"
+
+#include <stdio.h>
+#include <sys/stat.h>
+#ifdef HAVE_UTIME_H
+#include <utime.h>
+#endif
+#ifdef HAVE_DIRENT_H
+#include <dirent.h>
+#endif
+#ifdef HAVE_FCNTL_H
+#include <fcntl.h>
+#endif
+#include <errno.h>
+#include <string.h>
+
+#include <includes.h>
+#include <vfs.h>
+
+static struct vfs_ops default_vfs_ops;   /* For passthrough operation */
+static struct smb_vfs_handle_struct *fake_perms_handle; /* use fake_perms_handle->data for storing per-instance private data */
+
+static int fake_perms_stat(struct connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf)
+{
+	int ret = default_vfs_ops.stat(conn, fname, sbuf);
+	if (ret == 0) {
+		extern struct current_user current_user;
+		
+		if (S_ISDIR(sbuf->st_mode)) {
+			sbuf->st_mode = S_IFDIR | S_IRWXU;
+		} else {
+			sbuf->st_mode = S_IRWXU;
+		}
+		sbuf->st_uid = current_user.uid;
+		sbuf->st_gid = current_user.gid;
+	}
+	return ret;
+}
+
+static int fake_perms_fstat(struct files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf)
+{
+	int ret = default_vfs_ops.fstat(fsp, fd, sbuf);
+	if (ret == 0) {
+		extern struct current_user current_user;
+		
+		if (S_ISDIR(sbuf->st_mode)) {
+			sbuf->st_mode = S_IFDIR | S_IRWXU;
+		} else {
+			sbuf->st_mode = S_IRWXU;
+		}
+		sbuf->st_uid = current_user.uid;
+		sbuf->st_gid = current_user.gid;
+	}
+	return ret;
+}
+
+#if 0
+static size_t fake_perms_fget_nt_acl(struct files_struct *fsp, int fd, struct security_descriptor_info **ppdesc)
+{
+	return default_vfs_ops.fget_nt_acl(fsp, fd, ppdesc);
+}
+
+static size_t fake_perms_get_nt_acl(struct files_struct *fsp, const char *name, struct security_descriptor_info **ppdesc)
+{
+	return default_vfs_ops.get_nt_acl(fsp, name, ppdesc);
+}
+
+static BOOL fake_perms_fset_nt_acl(struct files_struct *fsp, int fd, uint32 security_info_sent, struct security_descriptor_info *psd)
+{
+	return default_vfs_ops.fset_nt_acl(fsp, fd, security_info_sent, psd);
+}
+
+static BOOL fake_perms_set_nt_acl(struct files_struct *fsp, const char *name, uint32 security_info_sent, struct security_descriptor_info *psd)
+{
+	return default_vfs_ops.set_nt_acl(fsp, name, security_info_sent, psd);
+}
+
+static BOOL fake_perms_chmod_acl(struct connection_struct *conn, const char *name, mode_t mode)
+{
+	return default_vfs_ops.chmod_acl(conn, name, mode);
+}
+
+static BOOL fake_perms_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode)
+{
+	return default_vfs_ops.fchmod_acl(fsp, fd, mode);
+}
+
+static int fake_perms_sys_acl_get_entry(struct connection_struct *conn, SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p)
+{
+	return default_vfs_ops.sys_acl_get_entry(conn, theacl, entry_id, entry_p);
+}
+
+static int fake_perms_sys_acl_get_tag_type(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T *tag_type_p)
+{
+	return default_vfs_ops.sys_acl_get_tag_type(conn, entry_d, tag_type_p);
+}
+
+static int fake_perms_sys_acl_get_permset(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T *permset_p)
+{
+	return default_vfs_ops.sys_acl_get_permset(conn, entry_d, permset_p);
+}
+
+static void *fake_perms_sys_acl_get_qualifier(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d)
+{
+	return default_vfs_ops.sys_acl_get_qualifier(conn, entry_d);
+}
+
+static SMB_ACL_T fake_perms_sys_acl_get_file(struct connection_struct *conn, const char *path_p, SMB_ACL_TYPE_T type)
+{
+	return default_vfs_ops.sys_acl_get_file(conn, path_p, type);
+}
+
+static SMB_ACL_T fake_perms_sys_acl_get_fd(struct files_struct *fsp, int fd)
+{
+	return default_vfs_ops.sys_acl_get_fd(fsp, fd);
+}
+
+static int fake_perms_sys_acl_clear_perms(struct connection_struct *conn, SMB_ACL_PERMSET_T permset)
+{
+	return default_vfs_ops.sys_acl_clear_perms(conn, permset);
+}
+
+static int fake_perms_sys_acl_add_perm(struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm)
+{
+	return default_vfs_ops.sys_acl_add_perm(conn, permset, perm);
+}
+
+static char *fake_perms_sys_acl_to_text(struct connection_struct *conn, SMB_ACL_T theacl, ssize_t *plen)
+{
+	return default_vfs_ops.sys_acl_to_text(conn, theacl, plen);
+}
+
+static SMB_ACL_T fake_perms_sys_acl_init(struct connection_struct *conn, int count)
+{
+	return default_vfs_ops.sys_acl_init(conn, count);
+}
+
+static int fake_perms_sys_acl_create_entry(struct connection_struct *conn, SMB_ACL_T *pacl, SMB_ACL_ENTRY_T *pentry)
+{
+	return default_vfs_ops.sys_acl_create_entry(conn, pacl, pentry);
+}
+
+static int fake_perms_sys_acl_set_tag_type(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_TAG_T tagtype)
+{
+	return default_vfs_ops.sys_acl_set_tag_type(conn, entry, tagtype);
+}
+
+static int fake_perms_sys_acl_set_qualifier(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, void *qual)
+{
+	return default_vfs_ops.sys_acl_set_qualifier(conn, entry, qual);
+}
+
+static int fake_perms_sys_acl_set_permset(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_PERMSET_T permset)
+{
+	return default_vfs_ops.sys_acl_set_permset(conn, entry, permset);
+}
+
+static int fake_perms_sys_acl_valid(struct connection_struct *conn, SMB_ACL_T theacl )
+{
+	return default_vfs_ops.sys_acl_valid(conn, theacl );
+}
+
+static int fake_perms_sys_acl_set_file(struct connection_struct *conn, const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl)
+{
+	return default_vfs_ops.sys_acl_set_file(conn, name, acltype, theacl);
+}
+
+static int fake_perms_sys_acl_set_fd(struct files_struct *fsp, int fd, SMB_ACL_T theacl)
+{
+	return default_vfs_ops.sys_acl_set_fd(fsp, fd, theacl);
+}
+
+static int fake_perms_sys_acl_delete_def_file(struct connection_struct *conn, const char *path)
+{
+	return default_vfs_ops.sys_acl_delete_def_file(conn, path);
+}
+
+static int fake_perms_sys_acl_get_perm(struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm)
+{
+	return default_vfs_ops.sys_acl_get_perm(conn, permset, perm);
+}
+
+static int fake_perms_sys_acl_free_text(struct connection_struct *conn, char *text)
+{
+	return default_vfs_ops.sys_acl_free_text(conn, text);
+}
+
+static int fake_perms_sys_acl_free_acl(struct connection_struct *conn, SMB_ACL_T posix_acl)
+{
+	return default_vfs_ops.sys_acl_free_acl(conn, posix_acl);
+}
+
+static int fake_perms_sys_acl_free_qualifier(struct connection_struct *conn, void *qualifier, SMB_ACL_TAG_T tagtype)
+{
+	return default_vfs_ops.sys_acl_free_qualifier(conn, qualifier, tagtype);
+}
+#endif
+
+/* VFS operations structure */
+
+static vfs_op_tuple fake_perms_ops[] = {
+
+	/* NT File ACL operations */
+#if 0
+	{fake_perms_fget_nt_acl,		SMB_VFS_OP_FGET_NT_ACL,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_get_nt_acl,		SMB_VFS_OP_GET_NT_ACL,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_fset_nt_acl,		SMB_VFS_OP_FSET_NT_ACL,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_set_nt_acl,		SMB_VFS_OP_SET_NT_ACL,		SMB_VFS_LAYER_TRANSPARENT},
+
+	/* POSIX ACL operations */
+
+	{fake_perms_chmod_acl,		SMB_VFS_OP_CHMOD_ACL,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_fchmod_acl,		SMB_VFS_OP_FCHMOD_ACL,		SMB_VFS_LAYER_TRANSPARENT},
+
+	{fake_perms_sys_acl_get_entry,	SMB_VFS_OP_SYS_ACL_GET_ENTRY,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_get_tag_type,	SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE,	SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_get_permset,	SMB_VFS_OP_SYS_ACL_GET_PERMSET,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_get_qualifier,	SMB_VFS_OP_SYS_ACL_GET_QUALIFIER,	SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_get_file,		SMB_VFS_OP_SYS_ACL_GET_FILE,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_get_fd,		SMB_VFS_OP_SYS_ACL_GET_FD,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_clear_perms,	SMB_VFS_OP_SYS_ACL_CLEAR_PERMS,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_add_perm,		SMB_VFS_OP_SYS_ACL_ADD_PERM,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_to_text,		SMB_VFS_OP_SYS_ACL_TO_TEXT,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_init,		SMB_VFS_OP_SYS_ACL_INIT,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_create_entry,	SMB_VFS_OP_SYS_ACL_CREATE_ENTRY,	SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_set_tag_type,	SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE,	SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_set_qualifier,	SMB_VFS_OP_SYS_ACL_SET_QUALIFIER,	SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_set_permset,	SMB_VFS_OP_SYS_ACL_SET_PERMSET,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_valid,		SMB_VFS_OP_SYS_ACL_VALID,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_set_file,		SMB_VFS_OP_SYS_ACL_SET_FILE,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_set_fd,		SMB_VFS_OP_SYS_ACL_SET_FD,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_delete_def_file,	SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,	SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_get_perm,		SMB_VFS_OP_SYS_ACL_GET_PERM,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_free_text,	SMB_VFS_OP_SYS_ACL_FREE_TEXT,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_free_acl,		SMB_VFS_OP_SYS_ACL_FREE_ACL,		SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_sys_acl_free_qualifier,	SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER,	SMB_VFS_LAYER_TRANSPARENT},
+#endif
+	
+	{fake_perms_stat,	SMB_VFS_OP_STAT,	SMB_VFS_LAYER_TRANSPARENT},
+	{fake_perms_fstat,	SMB_VFS_OP_FSTAT,	SMB_VFS_LAYER_TRANSPARENT},
+	{NULL,	SMB_VFS_OP_NOOP,	SMB_VFS_LAYER_NOOP}
+};
+
+/* VFS initialisation - return initialized vfs_op_tuple array back to Samba */
+
+static vfs_op_tuple *fake_perms_init(const struct vfs_ops *def_vfs_ops,
+			struct smb_vfs_handle_struct *vfs_handle)
+{
+	DEBUG(3, ("Initialising default vfs hooks\n"));
+
+	memcpy(&default_vfs_ops, def_vfs_ops, sizeof(struct vfs_ops));
+	
+	/* Remember vfs_handle for further allocation and referencing of private
+	   information in vfs_handle->data
+	*/
+	fake_perms_handle = vfs_handle;
+	return fake_perms_ops;
+}
+
+int vfs_fake_perms_init(void)
+{
+	return smb_register_vfs("fake_perms", fake_perms_init, SMB_VFS_INTERFACE_VERSION);
+}