summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Bannon <dbannon@samba.org>2000-11-28 23:35:03 +0000
committerDavid Bannon <dbannon@samba.org>2000-11-28 23:35:03 +0000
commit6f044d9c4777d5a953ff578651c48683719eae5a (patch)
tree9355bc4781a2936d92d58301d4f4f62df5e2f343
parent366bf693d21a5fe3020b8528ae879d9734e67231 (diff)
downloadsamba-6f044d9c4777d5a953ff578651c48683719eae5a.tar.gz
samba-6f044d9c4777d5a953ff578651c48683719eae5a.tar.bz2
samba-6f044d9c4777d5a953ff578651c48683719eae5a.zip
First Release of the DocBook 'source'.
(This used to be commit 6cb727c033822e3e5ff3edc532457df8258beefd)
-rw-r--r--docs/docbook/docbook.txt107
-rw-r--r--docs/docbook/samba-pdc-faq.sgml943
-rw-r--r--docs/docbook/samba-pdc-howto.sgml766
3 files changed, 1816 insertions, 0 deletions
diff --git a/docs/docbook/docbook.txt b/docs/docbook/docbook.txt
new file mode 100644
index 0000000000..a69cf0ff9d
--- /dev/null
+++ b/docs/docbook/docbook.txt
@@ -0,0 +1,107 @@
+What are DocBook documents doing in the Samba Distribution ?
+-----------------------------------------------------------
+By David Bannon, D.Bannon@latrobe.edu.au November, 2000
+----------------------------------------------------------
+
+We are planning to convert some or all (?) of the samba docs to sgml DocBook to
+make them easier to maintain and produce a nicer looking product.
+
+This short note (strange isn’t it how it always starts out as a short note and becomes a
+long one ?) will explain very briefly how and why we are doing this.
+
+The format.
+--------------
+
+If you are new to sgml, regard an sgml file as 'source code'. You don't read it
+directly, use it to create other formats (like the txt and html included in ../txt and
+../html).
+
+Docbook is a particular sgml style, particularly suited to producing technical manuals.
+In the two documents I have produced so far I have used DocBook 4.1, it seems that
+products like RedHat Linux is still include only version 3.1, the differences are
+minor. The Linux Documentation Project is using a modified version of 3.1 but are
+really geared up to make multi paged documents, something we want to avoid for
+logistic reasons.
+
+The Output
+--------------
+Formatted html or xml is easily produced from a DocBook document, however I
+had difficulty making a txt file directly ! It appears that the people who make
+DocBook did not imagine anyone wanting to make plain text from a DocBook
+document. At least one set of sgml tools appears to have decided that the easiest way
+is to make the html and then convert that, this works fine.
+
+I have not had the need to make man pages from a DocBook document yet, anyone
+want to send me some pointers ??
+
+To make file handling and distribution easy I have opted for a single file or page per
+document. In the Samba 2.2 distribution I made an html and a txt version of each sgml
+file and placed that in the appropriate directory under ~/doc.
+
+The Tools
+-------------
+
+Any sgml document needs to be referred to a suitable style sheet (describing syntax)
+and other sheets that tell the translating programmes how to do the translations. The
+list of necessary ‘include’ files is a bit messy but once installed is pretty easy.
+
+On one of my RedHat 6.2 systems I installed the following:
+* sgml-common (as an rpm)
+* docbook (as an rpm)
+* stylesheets (as an rpm)
+* jade (as an rpm)
+* Docbook 4.1 from http://docbook.org
+* DSSSL 157 from http://nwalsh.com/docbook/dsssl/
+
+If you would be happy using DocBook 3.1 (and why not ?) then stop after the four
+rpms. If you want to use 4.1 and the current DSSSL then you will need a bit of
+manual editing of the catalog files.
+
+There are several downloadable descriptions of the DocBook syntax at the web sites
+mentioned above. Note that a lot of the docs only talk about version 3.1 with 4.1 as an
+add-on.
+
+In either case you will need to include in the html/docbook.dsl and most likely a
+couple of ‘defines’ to achieve a suitable output. I made a local dsl file that I called
+html.dsl that looks like this :
+
+
+<!DOCTYPE style-sheet PUBLIC "-//James Clark//DTD DSSSL Style Sheet//EN" [
+<!ENTITY dbstyle SYSTEM "/usr/lib/sgml/dsssl-157/docbook/html/docbook.dsl"
+CDATA DSSSL>
+]>
+
+<style-sheet>
+<style-specification use="docbook">
+<style-specification-body>
+
+(define nochunks #t) ;; Dont make multiple pages
+(define rootchunk #t) ;; Do make a 'root' page
+(define %use-id-as-filename% #t) ;; Use book id as filename
+(define %html-ext% ".html") ;; give it a proper html extension
+
+</style-specification-body>
+</style-specification>
+<external-specification id="docbook" document="dbstyle">
+</style-sheet>
+
+Note the top block that refers to where the dsssl-157 style sheets are installed, if you
+don’t put them there make sure you edit the file.
+
+To use this stylesheet, have it in your working directory along with your sgml files.
+Jade does the actual conversion to html, call it like this :
+
+jade -t sgml -d html.dsl stuff.sgml
+
+To create the text version run the html through lynx :
+
+Lynx -dump -nolist stuff.html > stuff.txt
+
+These instructions are crude by might help someone get going. Please feel free to
+contact me if you have any questions or if you can correct any one of the many
+mistakes I must have made above.
+
+David
+
+
+
diff --git a/docs/docbook/samba-pdc-faq.sgml b/docs/docbook/samba-pdc-faq.sgml
new file mode 100644
index 0000000000..10d3ec6a04
--- /dev/null
+++ b/docs/docbook/samba-pdc-faq.sgml
@@ -0,0 +1,943 @@
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
+<book id="samba-pdc-faq">
+
+<title>The Samba 2.2 PDC FAQ</title>
+
+<bookinfo>
+ <author>
+ <firstname>David</firstname><surname>Bannon</surname>
+ <affiliation><orgname>La Trobe University</orgname></affiliation>
+ </author>
+ <address><email>D.Bannon@latrobe.edu.au</email></address>
+ <pubdate>November 2000</pubdate>
+</bookinfo>
+
+
+<dedication><title></>
+
+ <para>Comments, corrections and additions to <email>D.Bannon@latrobe.edu.au</email></para>
+
+ <para>This is the FAQ for Samba 2.2 as an NTDomain controller.
+ This document is derived from the origional FAQ that was built and
+ maintained by Gerald Carter
+ from the early days of Samba NTDomain development up until recently.
+ It is now being updated as significent changes are made to 2.2.0.</para>
+
+ <para>Please note it does not apply to Samba2.2alpha0, Samba2.2alpha1, Samba 2.0.7, TNG nor HEAD branch.
+ </para>
+ <para>I'll repeat, it does not apply to the current snapshot [ftp mirror]:/pub/samba/alpha/samba-2.2.0-alpha1.tar.gz, only to the to the current cvs.</para>
+
+<para>
+ Also available is a Samba 2.2 PDC <ulink url="samba-pdc-howto.html">HowTo</> that takes you, step
+ by step, over the process of setting up a very basic Samba 2.2 Primary Domain Controller
+ </para>
+
+ <note><para>Please read the Introduction for the current <link linkend=stateofplay> state of play</>.</para></>
+</dedication>
+
+<toc></toc>
+
+<!-- ================ I N T R O D U C T I O N ==================== -->
+
+
+<chapter><title>Introduction</>
+
+<sect1><title id=stateofplay>State of Play</title>
+ <para><emphasis>It should be noted that 2.2.0 in its pre-release form still has a few problems,
+ I'll try and keep this section current while things are still dynamic.
+ At the time of this update (November 13, 2000) the current state of play is :</emphasis></para>
+
+ <para>Comments here about W2K joining the domain apply only to Samba 2.2 from the CVS after November 27th. The
+ 'snapshot' release Samba2.2alpha1 does not work !!! See below on how to get a CVS tree.</para>
+
+ <para>Client Side creation of Machine accounts does work but is not complete.
+ Firstly, the <filename>add user script</> runs as the user who's
+ name was entered, not as root. Secondly, the machine name passed to the script (%U)
+ has an underscore at the end, not a '$'. One alternative is to use %m and add the $.
+ This method is documented in the <ulink url="samba-pdc-howto.html">HowTo</>.
+ And thirdly, it does not work with NT4ws.
+ </para>
+
+ <para>A W2K machine can join the domain. See the <ulink url="samba-pdc-howto.html">HowTo</>
+ which explains the process. The methods
+ described are 'work arounds' and should be regarded as temporary. Although I (drb)
+ have tested these procedures a number of people have had difficulty so there
+ may be other issues at work. JFM is aware of these
+ problems and will attend to them when he can.</para>
+
+ <para>A Domain Admin account is required and at present it appears that only root
+ is a suitable candidate.</para>
+
+ <para>Much of the related code does work. For example, if an NT is removed from the
+ domain and then rejoins, the <filename>Create a Computer Account in the Domain</> dialog
+ will let you reset the smbpasswd. That is you don't need to do it from
+ the unix box. However, at the present, you do need to have root as an
+ administrator and use the root user name and password.</para>
+
+ <para><emphasis>Actually I'm
+ not sure that last paragraph is correct ....</></para>
+
+ <para><command>Policies</> do work on a W2K machine. MS says that recent builds of
+ W2K dont observe an NT policy but it appears it does in 'legacy' mode.</para>
+
+</sect1>
+<sect1><title>Introduction</>
+ <para>This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing with the 'old head'
+ version of Samba and its NTDomain facilities. It is being rewritten by David Bannon (drb)
+ so that it addresses more accurately the Samba 2.2 planned for release late 2000. </para>
+
+ <para>This document probably still contains some material that does not apply to
+ Samba 2.2 but most (all?) of the really misleading stuff has been removed. Some
+ issues are not dealt with or are dealt with badly. Please send corrections and additions to
+ David Bannon at D.Bannon@latrobe.edu.au</para>
+
+ <para>Hopefully, as we all become familiar with the Samba 2.2 as a PDC this document will
+ become much more usefull.</para>
+
+
+</sect1>
+</chapter>
+
+<!-- ============== G E N E R A L I N F O R M A T I O N ============== -->
+
+<chapter><title>General Information</>
+
+
+<sect1><title>What can we do ?</title>
+
+<sect2><title>What can Samba Primary Domain Controller (PDC) do ?</>
+
+ <para>If you wish to have Samba act as a PDC for Windows NT 3.51.and 4.0 or W2000 client, then you
+ will need to obtain the 2.2.0 version, currently in pre-release. Release of a stable,
+ full featured Samba PDC is currently slated for version 3.0. </para>
+
+ <para>The following is a list of included features currently in Samba 2.2:</para>
+<itemizedlist>
+ <listitem><para>The ability to act as a limited PDC for Windows NT and W2000 clients.
+ This includes adding NT and W2K machines to the domain and authenticating users logging
+ into the domain.</para></listitem>
+ <listitem><para>Domain account can be viewed using the User Manager for
+ Domains ????</para></listitem>
+ <listitem><para>Viewing resources on the Samba PDC via the Server Manager for Domains
+ from the NT client. ??</para></listitem>
+ <listitem><para>Windows 95 clients will allow user level security to be set
+ but will not currently allow browsing of accounts.</para></listitem>
+ <listitem><para>Machine account password updates.</para></listitem>
+ <listitem><para>Changing of user passwords from an NT client.</para></listitem>
+ <listitem><para>Partial support for Windows NT group and username mapping.</para></listitem>
+ <listitem><para>Support for a LDAP password database backend.</para></listitem>
+ <listitem><para>Printing.</para></listitem>
+</itemizedlist>
+
+
+<itemizedlist><title>These things are note expected to work in the forseeable future</title>
+ <listitem><para>Trust relationships</para></listitem>
+ <listitem><para>PDC and BDC integration</para></listitem>
+ <listitem><para>Windows NT ACLs (on the Samba shares)</para></listitem>
+ <listitem><para>Offer a list of domain users to User Manager for Domains
+ (or the Security Tab etc).</para></listitem>
+</itemizedlist>
+</sect2>
+
+<sect2><title>Can I have a Windows 2000 client logon to a Samba controlled domain?</>
+
+ <para>The 2.2 release branch of Samba supports Windows 2000 domain
+ clients in legacy mode, ie as if the PDC is a NTServer, not a
+ W2K server.</para>
+</sect2>
+
+<sect2><title>What's the status of print spool (spoolss) support in the NTDOM code? </>
+
+ <para>The implementation of support for SPOOLSS pipe is complete and it will be available
+ in the 2.2.0 release. This means that Samba will support the automatic downloading of printer
+ drivers for Windows NT clients just as it currently does for Windows 9x clients.</para>
+</sect2>
+</sect1>
+
+<sect1><title>CVS</title>
+ <para>CVS is a programme (publically available) that the Samba developers use to
+ maintain the central source code. Non developers can get access to the source in
+ a read only capacity. Many flavours of unix now arrive with cvs installed.</>
+
+<sect2><title>What are the different Samba branches available in CVS ?</>
+
+ <para>You can find out more about obtaining Samba's via
+ anonymous CVS from
+ <ulink url="http://pserver.samba.org/samba/cvs.html">
+ http://pserver.samba.org/samba/cvs.html"</>. </para>
+
+<variablelist><title>There are basically four branches to watch at the moment :</>
+ <varlistentry>
+ <term>HEAD</>
+ <listitem><para>Samba 3.0 ? This code boasts all the main development
+ work in Samba. Two things that most people are not aware of
+ which live in the HEAD branch code are winbind NSS module and
+ Tim Potter's VFS implementation. Due to its developmental
+ nature, its not really suitable for production work.
+ </para></listitem></varlistentry>
+ <varlistentry>
+ <term>SAMBA_2_0</term>
+ <listitem><para>This branch contains the current stable release release.
+ At the moment it contains 2.0.7, a version that will do some
+ limited PDC stuff. If you are really going to do PDC things then
+ I (drb) suggest that you consider 2.2 instead.
+ </para></listitem></varlistentry>
+ <varlistentry>
+ <term>SAMBA_2_2</>
+ <listitem><para>The next stable release, currently in a 'alpha' form.
+ It provides the Samba developers, testers and interested
+ people with an approximation of what is to come. This document
+ addresses only SAMBA_2_2.
+ </para></listitem></varlistentry>
+ <varlistentry>
+ <term>SAMBA_TNG</>
+ <listitem><para>This branch is no longer maintained from the Samba sites.
+ Please see <ulink url="http://www.samba-tng.org/">
+ http://www.samba-tng.org/</ulink>. It has been requested
+ that questions about TNG are not posted to the regular Samba mailing
+ lists including samba-ntdom and samba-technical.
+ </para></listitem></varlistentry>
+</variablelist>
+</sect2>
+
+<sect2><title>What are the CVS commands ?</>
+
+ <para>See <ulink url="http://pserver.samba.org/samba/cvs.html">
+ http://pserver.samba.org/samba/cvs.html</></para>
+
+
+ <itemizedlist><title>To get the Samba 2.2 version, tag SAMBA_2_2 you would do :</>
+ <listitem><para> For example : <command>cd /usr/local/src/</></></>
+ <listitem><para> <command>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot
+ login</></></>
+ <listitem><para> When prompted enter a password of <command>cvs</></></>
+ <listitem><para> <command>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot
+ co -r SAMBA_2_2 samba</></></>
+ </itemizedlist>
+
+ <itemizedlist><title>Then to update that directory at some later time,</>
+ <listitem><para> <command>cd /usr/local/src/samba</></></>
+ <listitem><para> <command>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login</></></>
+ <listitem><para> When prompted enter a password of 'cvs'.</></>
+ <listitem><para> <command>cvs update -d -P</></></>
+ </itemizedlist>
+</sect2>
+</sect1>
+</chapter>
+
+<chapter><title>Establishing Connections</>
+<sect1><title></title>
+
+<sect2><title>How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</>
+
+ <para>There is a comprehensive Samba PDC <ulink url="samba-pdc-howto.html">HowTo</>
+ accessable from the samba web site
+ under 'Documentation'. Its currently located at <ulink url="http://bioserve.latrobe.edu.au/samba">
+ http://bioserve.latrobe.edu.au/samba</>. Read it.</para>
+</sect2>
+
+<sect2><title>What is a 'machine account' ?</title>
+ <para>Every NT, W2K or Samba machine that joins a Samba controlled domain must be known to
+ the Samba PDC. There are two entries required, one in (typically) <filename>/etc/passwd</>
+ and the other in (typically) <filename>/usr/local/samba/private/smbpasswd</>. Under
+ some circumstances these entries are made <link linkend=machineaccounts>manually</>, the
+ <ulink url="samba-pdc-howto.html">HowTo</> discusses ways of creating them automatically.</para>
+</sect2>
+
+
+<sect2><title>"The machine account for this computer either does not exist or is not accessable."</>
+
+ <para>When I try to join the domain I get the message "The machine account for this computer
+ either does not exist or is not accessable". Whats wrong ?</para>
+
+ <para>This problem is caused by the PDC not having a suitable machine account.
+ If you are using the <command>add user script =</> method to create accounts
+ then this would indicate that it has not worked. Ensure the domain admin user
+ system is working.</para>
+
+ <para>Alternatively if you are creating account entries manually then they have not been created
+ correctly. Make sure that you have the entry correct for the machine account in smbpasswd
+ file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility,
+ make sure that the account name is the machine netbios name with a '$' appended to it
+ ( ie. computer_name$ ). There must be an entry in both /etc/passwd and
+ the smbpasswd file. Some people have reported that
+ inconsistent subnet masks between the Samba server and the NT client have caused this problem.
+ Make sure that these are consistent for both client and server.</para>
+</sect2>
+
+<sect2><title id=machineaccounts>How do I create machine accounts manually ?</title>
+
+ <para>This was the only option until recently, now in version 2.2 better means are available.
+ You might still need to do it manually for a couple of reasons. A machine account
+ consists of two entries (assuming a standard install and /etc/passwd use),
+ one in /etc/passwd and the other in /usr/local/samba/private/smbpasswd. The /etc/passwd
+ entry will list the machine name with a $ appended, won't have a passwd, will have a null
+ shell and no home directory. For example a machine called 'doppy' would have an /etc/passwd
+ entry like this :</para>
+
+ <para><command>doppy$:x:505:501:NTMachine:/dev/null:/bin/false</></para>
+
+ <para>On a linux system for example, you would typically add it like this :</para>
+
+ <para><command>adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n
+ doppy$</command></para>
+
+ <para>Then you need to add that entry to smbpasswd, assuming you have a suitable
+ path to the <command>smbpasswd</> programme, do this :</para>
+
+ <para><command>smbpasswd -a -m doppy$</command></para>
+
+ <para>The entry will be created with a well known password, so any machine that
+ says its doppy could join the domain as long as it gets in first. So don't create
+ the accounts any earlier than you need them.</para>
+</sect2>
+
+<sect2><title>I cannot include a '$' in a machine name.</title>
+
+ <para>A 'machine name' in (typically) <filename>/etc/passwd</> consists
+ of the machine name with a '$' appended. FreeBSD (and other BSD systems ?)
+ won't create a user with a '$' in their name.</para>
+
+ <para>The problem is only in the program used to make the entry, once made, it works
+ perfectly. So create a user without the '$' and use <command>vipw</> to edit
+ the entry, adding the '$'. Or create the whole entry with vipw if you like,
+ make sure you use a unique uid !</para>
+</sect2>
+
+<sect2><title id=alreadyhaveconnection>I get told "You already have a connection to the Domain...." when creating a
+ machine account.</>
+
+ <para>This happens if you try to create a machine account from the machine itself
+ and use a user name that does not work (for whatever reason) and then try
+ another (possibly valid) user name.
+ Exit out of the network applet to close the initial connection and try again.</para>
+
+ <para>Further, if the machine is a already a 'member of a workgroup' that is the
+ same name as the domain you are joining (bad idea) you will get this message.
+ Change the workgroup name to something else, it does not matter what, reboot,
+ and try again.</para>
+</sect2>
+
+<sect2><title>I get told "Cannot join domain, the credentials supplied conflict
+ with an existing set.."</>
+ <para>This is the same basic problem as mentioned above, <link linkend=alreadyhaveconnection>
+ "You already have a connection..."</link></para>
+</sect2>
+
+<sect2><title>"The system can not log you on (C000019B)...."</>
+ <para>I joined the domain successfully but after upgrading to a newer version of the
+ Samba code I get the message, "The system can not log you on (C000019B), Please try a
+ gain or consult your system administrator" when attempting to logon.</para>
+
+ <para>This occurs when the domain SID stored in private/WORKGROUP.SID is changed.
+ For example, you remove the file and smbd automatically creates a new one.
+ Or you are swapping back and forth between versions 2.0.7, TNG and the HEAD branch
+ code (not recommended). The only way to correct the problem is to restore the
+ original domain SID or remove the domain client from the domain and rejoin.</para>
+</sect2>
+</sect1>
+
+</chapter>
+
+
+<!-- ============ U S E R A C C O U N T M A N A G M E N T ============= -->
+
+<chapter><title>User Account Management</title>
+<sect1><title>Domain Admins</title>
+<sect2><title>How do I configure an account as a domain administrator?</title>
+
+ <para>See the NTDom <ulink url="samba-pdc-howto.html">HowTo</>.</para>
+</sect2>
+</sect1>
+
+<sect1><title>Profiles</title>
+<sect2><Title>Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</>
+
+ <para>Sometimes Windows clients will maintain a connection to the \\homes\ ( or [%U] ) share
+ even after the user has logged out. Consider the following scenario.</para>
+<itemizedlist>
+ <listitem><para> user1 logs into the Windows NT machine. Therefore the
+ [homes] share is set to \\server\user1.</para></listitem>
+ <listitem><para> user1 works for a while and then logs out. </para></listitem>
+ <listitem><para> user2 logs into the same Windows NT machine.</para></listitem>
+</itemizedlist>
+
+ <para>However, since the NT box has maintained a connection to [homes] which was
+ previously set to \\server\user1, when the operating system attempts to
+ get the profile and if it can read users1's profile, will get it otherwise it
+ will return an error. You get the picture.</para>
+
+ <para>A better solution is to use a separate [profiles] share and set the
+ "logon path = \\%N\profiles\%U" </para>
+
+
+ <note><para>Is this still a problem ????</para></note>
+</sect2>
+
+
+<sect2><title>Why are all the users listed in the "domain admin users" using the same profile?</>
+
+ <para>You are using a very very old development version of Samba. Upgrade.</para>
+</sect2>
+
+
+
+
+
+<sect2><title>The roaming profiles do not seem to be updating on the server.</title>
+
+ <para>There can be several reasons for this.</para>
+
+ <para>Make sure that the time on the client and the PDC are synchronized. You can accomplish
+ this by executing a <command>net time \\server /set /yes</> replacing server with the
+ name of your PDC (or another synchronized SMB server). See <link linkend="SettingTime">
+ about Setting Time</link></para>
+
+ <para>Make sure that the
+ logon path is writeable by the user and make sure that the connection to the logon
+ path location is by the current user. Sometimes Windows client do not drop the
+ connection immediately upon logoff.</para>
+
+ <para>Some people have reported that the logon path location should also be browseable.
+ I (GC) have yet to emperically verify this, but you can try.</para>
+</sect2>
+</sect1>
+
+<sect1><title>Policies</title>
+
+<sect2><title>What are 'Policies' ?.</title>
+ <para>When a user logs onto the domain via a client machine, the PDC sends
+ the client machine a list of things contained in the 'policy' (if it exists).
+ This list may do things like suppress a splach screen, format the dates the way you
+ like them or perhaps remove locally stored profiles.</para>
+
+ <para>On a samba PDC this list is obtained from a file called <command>ntconfig.pol</>
+ and located in the <command>[netlogon]</>share. The file is created with a policy editor
+ and must be readable by anyone and writeable by only root. See <link linkend=policyeditor>
+ below</> for how to get a suitable editor.</para>
+</sect2>
+
+<sect2><title>I can't get system policies to work.</title>
+
+ <para>There are two possible reasons for system policies not functioning correctly.
+ Make sure that you have the following parameters set in smb.conf </para>
+
+ <programlisting>
+ [netlogon]
+ ....
+ locking = no
+ public = no
+ browseable = yes
+ ....
+ </programlisting>
+
+ <para>A policy file must be in the <command>[netlogon]</> share and must be
+ readable by everyone and writeable by only root. The file must be created
+ by an NTServer <link linkend=policyeditor>Policy Editor</>.</para>
+
+ <para>Last time I (drb) looked in the source, it was
+ looking for <filename>ntconfig.pol</> first then several other combinations of upper
+ and lower case. People have reported success using <filename>NTconfig.pol</>,
+ <filename>NTconfig.POL</> and <filename>ntconfig.pol</>. These are the case
+ settings that I (GC) use with the
+ filename <filename>ntconfig.pol</></para>
+
+ <programlisting>
+ case sensitive = no
+ case preserve = yes
+ default case = yes
+ </programlisting>
+
+</sect2>
+
+<sect2><title id=policyeditor>What about Windows NT Policy Editor ?</title>
+
+ <para>To create or edit <command>ntconfig.pol</> you must use the NT Server
+ Policy Editor, <command>poledit.exe</> which is included with NT Server
+ but <emphasis>not NT Workstation</>. There is a Policy Editor on a NTws
+ but it is not suitable for creating <emphasis>Domain Policies</emphasis>.
+ Further, although the Windows 95
+ Policy Editor can be installed on an NT Workstation/Server, it will not
+ work with NT policies because the registry key that are set by the policy templates.
+ However, the files from the NT Server will run happily enough on an NTws.
+ You need <filename>poledit.exe, common.adm</> and <filename>winnt.adm</>. It is convenient
+ to put the two *.adm files in <filename>c:\winnt\inf</> which is where
+ the binary will look for them unless told otherwise. Note also that that
+ directory is 'hidden'.</para>
+
+ <para>The Windows NT policy editor is also included with the
+ Service Pack 3 (and later) for Windows NT 4.0. Extract the files using
+ <command>servicepackname /x</>, ie thats <command>Nt4sp6ai.exe /x</>
+ for service pack 6a.
+ The policy editor, <command>poledt.exe</> and the associated template files (*.adm) should
+ be extracted as well. It is also possible to downloaded the policy template
+ files for Office97 and get a copy of the policy editor. Another possible
+ location is with the Zero Administration Kit available for download from Microsoft.
+ </para>
+</sect2>
+
+
+<sect2><title>Can Win95 do Policies ?</title>
+
+ <para>Install the group policy handler for Win9x to pick up group policies.
+ Look on the Win98 CD in <filename>
+ \tools\reskit\netadmin\poledit</>. Install group policies on a Win9x client by double-clicking
+ <filename>grouppol.inf</>. Log off and on again a couple of times and see if
+ Win98 picks up group policies.
+ Unfortunately this needs to be done on every Win9x machine that uses group policies....</para>
+
+ <para>If group policies don't work one reports suggests getting the updated (read: working)
+ grouppol.dll for Windows 9x. The group list is grabbed from /etc/group.</para>
+
+</sect2>
+
+</sect1>
+
+<sect1><title>Passwords</title>
+
+<sect2><title>What is password sync and should I use it ?</title>
+
+ <para>NTws users can change their domain password by pressing Ctrl-Alt-Del and
+ choosing 'Change Password'. By default however, this does not change the unix password
+ (typically in <filename>/etc/passwd or /etc/shadow</>). In lots of situations
+ thats OK, for example :</para>
+ <itemizedlist>
+ <listitem><para>The server is only accessible to the user via samba.</para></listitem>
+ <listitem><para>Pam_smb or similar is installed so other applications
+ still refer to the samba password.</></>
+ </itemizedlist>
+ <para>But sometimes you really do need to maintain two seperate password databases and
+ there are good reasons to keep then in sync. Trying to explain to users
+ that they need to change their passwords in two seperate places or use
+ two seperate passwords is not fun.</para>
+
+ <para>However do understand that setting up password sync is not without problems either.
+ The chief difficulty is the interface between Samba and the <command>passwd</> command,
+ it can be a fiddle to set up and if the password the user has entered fails,
+ the resulting errors are ambiguously reported
+ and the user is confused. Further, you need to take steps to ensure that users
+ only ever change their passwords via samba (or use <command>smbpasswd</>),
+ otherwise they will only be changing the unix password.</para>
+
+
+</sect2>
+
+<sect2><title>How do I get remote password (unix and SMB) changing working ?</>
+
+ <para>Have a practice changing a user's password (as root) to see what
+ discussion takes place and change the text in the 'passwd chat' line below as necessary. The
+ line as shown works for recent RH Linux but most other systems seem to like to do something
+ different. The '*' is a wild card and will match anything (or nothing).
+ </para>
+
+ <para>Add these lines to smb.conf under [Global]</para>
+
+ <programlisting>
+
+ unix password sync = true
+ passwd program = /usr/bin/passwd %u
+ passwd chat = *password* %n\n *password* %n\n *successful*
+ </programlisting>
+
+ <para>As mentioned above, the change to the unix password
+ happens as root, not as the user, as is indicated in ~/smbd/chgpasswd.c If
+ you are using NIS, the Samba server must be running on the NIS master machine.</para>
+</sect2>
+
+</sect1>
+
+</chapter>
+
+<!-- =================== M I S C E L L A N E O U S ================= -->
+
+<chapter><title>Miscellaneous</title>
+<sect1><title></title>
+<sect2><title>What editor can I use in DOS/Windows that won't mess with my unix EOF</title>
+ <para>There are a number of Windows or DOS based editors that will understand, and
+ leave intact, the unix eof (as opposed to a DOS CL/LF). List members suggested :</para>
+
+ <itemizedlist>
+ <listitem><para>UltraEdit at <ulink url="http://www.ultraedit.com">www.ultraedit.com</></></>
+ <listitem><para>VI for windows at <ulink url="http://home.snafu.de/ramo/WinViEn.htm">
+ home.snafu.de/ramo/WinViEn.htm</></></>
+ <listitem><para>The author prefers PFE at <ulink url="http://www.lancs.ac.uk/people/cpaap/pfe/">
+ www.lancs.ac.uk/people/cpaap/pfe/</> but its no longer being developed...</></>
+ </itemizedlist>
+</sect2>
+
+
+
+
+<sect2><title>How do I get 'User Manager' and 'Server Manager'</title>
+
+ <para>Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for
+ Domains', the 'Server Manager' ?</para>
+
+<itemizedlist><title>Microsoft distributes a version of these tools called nexus
+ for installation on Windows 95 systems. The tools set includes</title>
+ <listitem><para>Server Manager</para></listitem>
+ <listitem><para>User Manager for Domains</para></listitem>
+ <listitem><para>Event Viewer</para></listitem>
+</itemizedlist>
+
+ <para>Click here to download the archived file
+ <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">
+ ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</ulink></para>
+
+ <para>The Windows NT 4.0 version of the 'User Manager for Domains'
+ and 'Server Manager' are available from Microsoft via ftp from
+ <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">
+ ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</ulink></para>
+</sect2>
+
+
+<sect2><title id="SettingTime">The time setting from a Samba server does not work.</title>
+ <para>If it works OK when you log on as Domain Admin then the problem is that ordinary users
+ don't have permission to change the time. (The system is running with their permission
+ at logon time.) This is not a Samba problem, you will have the same problem where ever
+ you connect. You can give 'everyone' permission to change the time from the User Manager.
+ </para>
+
+ <para>Anyone know what the registry settings are so this could be done with a Policy ?</para>
+</sect2>
+
+<sect2><title>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</>
+ <para>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS."
+ in the logs. What do I need to do?</para>
+
+ <para>You are using one of the old development versions. Upgrade.
+ (The message is unimportant, was a reminder to a developer)</para>
+
+</sect2>
+
+<sect2><title>How do I get my samba server to become a member ( not PDC ) of an NT domain?</title>
+
+
+ <para>In a domain that has a number of servers you only need one password database.
+ The machines that don't have their own ask the PDC to check for them.
+ This will work fine for a domain controlled by either a Samba or NT machine.
+ The following lines in smb.conf are typical, 'password server' points to the
+ samba machine (or an NT) that has the password list : </para>
+
+ <programlisting>
+
+ [global]
+ ...
+ security = domain
+ workgroup = { Put your domain name here }
+ password server = { Put the ip of the PDC here }
+ encrypt passwords = yes
+ ...
+ </programlisting>
+
+ <para>The samba server in question will have to 'join the domain', that requires
+ the domain controller to have a machine account for it. This is no different
+ to the machine account requirements to allow a NTws to join the domain. For
+ example, if we want a unix box called <emphasis>sleepy</> to ask the PDC called <emphasis>grumpy</>
+ to do its authentication then <emphasis>grumpy</> will need an entry in its smbpasswd
+ (assuming it's also samba) that starts with <emphasis>sleepy$</>. It would have to be
+ created <link linkend=machineaccounts>manually</>. </para>
+
+ <para>If the domain is controlled by an NTServer then the "Server Manager for Domains"
+ tool must be used to add 'sleepy' to the domain list.</para>
+
+ <para>In either case we then join the domain. If the domain is called <emphasis>forest</>
+ then on sleepy we would join the domain by typing :</para>
+
+ <para><command>smbpasswd -j forest</command></para>
+
+ <para>Note that the directory where the smbpasswd file would be
+ located should exist as this is where smbd will generate the MACHINE.SID file. This
+ might be <filename>/usr/local/samba/private/FOREST.SLEEPY.SID</> and
+ it contains the trust account password for the domain member. The permissions are
+ (and should remain) "rw-------</para>
+
+
+ <para>Note the Samba Servers without the password list will most likely still need an account
+ for each user, this means a line in its <filename>/etc/passwd</filename>. Because authentication
+ is being handled at the domain level the
+ <filename>/etc/passwd</filename> line does not need a password.
+ If the shares being offered are not user specific, ie a common (read only ?)
+ area or perhaps just printing then the user's
+ <filename>/etc/passwd</filename> does not need a home directory. A typical
+ line in <filename>/etc/passwd</filename> for a server that allows domain users to
+ connect to the samba shares but does not offer a home share ('cos that's on the PDC)
+ and does not allow logon to the unix prompt would be like this :</para>
+
+ <programlisting>jblow:x:542:100:Joe Blow:/dev/null:/bin/false</programlisting>
+
+ <note><title>Notes :</>
+ <itemizedlist>
+ <listitem><para>When removing those 'dummy' users, watch the 'remove user' scripts,
+ some OS think they should remove a users directory even when its not owned by the user !
+ </para></listitem>
+
+ <listitem><para>The <filename>username map = </> parameter might help you to avoid having
+ all those accounts created.</para></listitem>
+
+ <listitem>
+ <para>You should investigate the smb.conf parameter
+ <filename>'add user script'</filename>, it will be used to create accounts on
+ secondary servers when that account already exists on the PDC. Very nice.
+ Something like :</para>
+
+ <programlisting>
+ [Global]
+ ....
+ add user script = /usr/sbin/adduser -n -g users -c User -d /dev/null -s /bin/false %U
+ ....
+ </programlisting>
+ </listitem>
+ </itemizedlist>
+ </note>
+
+</sect2>
+</sect1>
+</chapter>
+
+
+<!-- ======== T R O U B L E S H O O T I N G and B U G R E P O R T I N G ======== -->
+
+
+
+<chapter><title>Troubleshooting and Bug Reporting</title>
+
+<sect1><title>Diagnostic tools</title>
+
+<sect2><title>What are some diagnostics tools I can use to debug the domain logon process and where can I
+ find them? </title>
+
+ <para>One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d
+ option for both smbd and nmbd to specifiy what 'debug level' at which to run. See the man
+ pages on smbd, nmbd and smb.conf for more information on debugging options. The debug
+ level can range from 1 (the default) to around 100 but a debug level of about 20 will
+ normally help you find any errors that samba is encountering. Another helpful method
+ of debugging is to compile samba using the gcc -g flag. This will include debug
+ information in the binaries and allow you to attch gdb to the running smbd / nmbd
+ process. In order to attach gdb to an smbd process for an NT workstation, first
+ get the workstation to make the connection. Pressing ctrl-alt-delete and going down
+ to the domain box is sufficient (at least, on the first time you join the domain) to
+ generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open
+ connection, and therefore there will be an smbd process running (assuming that you
+ haven't set a really short smbd idle timeout) So, in between pressing ctrl alt
+ delete, and actually typing in your password, you can gdb attach and continue.</para>
+
+ <itemizedlist><title>Some usefull samba commands worth investigating:</>
+ <listitem><para>testparam | more</></>
+ <listitem><para>smbclient -L //{netbios name of server}</></>
+ </itemizedlist>
+
+ <para>An SMB enabled version of tcpdump is available from
+ <ulink url="ftp://samba.org/pub/samba/tcpdump-smb/">ftp://samba.org/pub/samba/tcpdump-smb/
+ </ulink></para>
+
+ <para>Capconvert is a small C program for translating output from tcpdump-smb to CAP format
+ that can be read by netmon. You will need to use the raw output from tcp dump
+ ( ie. <command>tcpdump -w output.dump</> ). Good news! Now you can convert
+ Solaris' snoop output as well. The C source code for snoop2cap is available for download.
+ </para>
+
+ <para>For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available
+ on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's.
+ The version of netmon that ships with SMS allows for dumping packets between any two
+ computers (ie. placing the network interface in promiscuous mode). The version
+ on the NT Server install CD will only allow monitoring of network traffic directed to the
+ local NT box and broadcasts on the local subnet.</para>
+
+</sect2>
+
+<sect2><title>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</title>
+
+ <para>Installing netmon on an NT workstation requires a couple of steps. The following
+ are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server
+ 4.0, on Microsoft Windows NT Workstation 4.0. The process should be similar
+ for other version of Windows NT / Netmon. You will need both the Microsoft Windows
+ NT Server 4.0 Install CD and the Workstation 4.0 Install CD.</para>
+
+
+ <para>Initially you will need to install 'Network Monitor Tools and Agent' on the
+ NT Server. To do this </para>
+
+<itemizedlist>
+ <listitem><para>Goto Start - Settings - Control Panel - Network - Services - Add </para></listitem>
+ <listitem><para>Select the 'Network Monitor Tools and Agent' and click on 'OK'.</para></listitem>
+ <listitem><para>Click 'OK' on the Network Control Panel.</para></listitem>
+ <listitem><para>Insert the Windows NT Server 4.0 install CD when prompted.</para></listitem>
+</itemizedlist>
+
+ <para>At this point the Netmon files should exist in <filename>%SYSTEMROOT%\System32\netmon\*.*</>.
+ Two subdirectories exist as well, <filename>parsers\</> which contains the necessary DLL's
+ for parsing the netmon packet dump, and <filename>captures\</>.</para>
+
+ <para>In order to install the Netmon tools on an NT Workstation, you will first need to
+ install the 'Network Monitor Agent' from the Workstation install CD.</para>
+<itemizedlist>
+ <listitem><para>Goto Start - Settings - Control Panel - Network - Services - Add</para></listitem>
+ <listitem><para>Select the 'Network Monitor Agent' and click on 'OK'.</para></listitem>
+ <listitem><para>Click 'OK' on the Network Control Panel.</para></listitem>
+ <listitem><para>Insert the Windows NT Workstation 4.0 install CD when prompted.</para></listitem>
+</itemizedlist>
+
+
+ <para>Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to
+ %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as
+ you deem appropriate for your site. You will need administrative rights on the
+ NT box to run netmon.</para>
+
+ <para>To install Netmon on a Windows 9x box install the network monitor agent from
+ the Windows 9x CD (\admin\nettools\netmon).
+ There is a readme file located with the netmon driver files on the CD if you need
+ information on how to do this. Copy the files from a working Netmon installation.</para>
+
+</sect2>
+
+</sect1>
+
+<sect1><title>What other help can I get ? </title>
+
+ <para>There are many sources of information available in the form of mailing lists, RFC's
+ and documentation. The docs that come with the samba distribution contain very
+ good explanations of general SMB topics such as browsing.</para>
+
+<sect2><title>URLs and similar</title>
+
+
+<itemizedlist>
+
+ <listitem><para>Home of Samba site <ulink url="http://samba.org">
+ http://samba.org</ulink>. We have a mirror near you !</para></listitem>
+
+ <listitem><para> The <emphasis role=strong>Development</emphasis> document
+ on the Samba mirrors might mention your problem. If so,
+ it might mean that the developers are working on it.</para></listitem>
+
+ <listitem><para> Ignacio Coupeau has a very comprehesive look at LDAP with Samba at
+ <ulink url="http://www.unav.es/cti/ldap-smb-howto.html">
+ http://www.unav.es/cti/ldap-smb-howto.html</ulink>
+ Be a little carefull however, I suspect that it does not specificly
+ address samba 2.2.x. The HEAD pre-2.1 may possibly be the best
+ stream to look at.</para></listitem>
+
+ <listitem><para> Lars Kneschke's site covers <ulink url="http://www.samba-tng.org">
+ Samba-TNG</ulink> at
+ <ulink url="http://www.kneschke.de/projekte/samba_tng">
+ http://www.kneschke.de/projekte/samba_tng</ulink>, but again, a
+ lot of it does not apply to the main stream Samba.</para></listitem>
+
+ <listitem><para>Although 2.0.7 has almost had its day as a PDC, I (drb) will
+ keep the 2.0.7 PDC pages at <ulink url="http://bioserve.latrobe.edu.au/samba">
+ http://bioserve.latrobe.edu.au/samba</ulink> going for a while yet.</para></listitem>
+
+ <listitem><para>Misc links to CIFS information
+ <ulink url="http://samba.org/cifs/">http://samba.org/cifs/</ulink></para></listitem>
+
+ <listitem><para>NT Domains for Unix <ulink url="http://mailhost.cb1.com/~lkcl/ntdom/">
+ http://mailhost.cb1.com/~lkcl/ntdom/</ulink></para></listitem>
+
+ <listitem><para>FTP site for older SMB specs:
+ <ulink url="ftp://ftp.microsoft.com/developr/drg/CIFS/">
+ ftp://ftp.microsoft.com/developr/drg/CIFS/</ulink></para></listitem>
+
+</itemizedlist>
+
+
+<itemizedlist><title>There are a number of documents that no longer appear to live at their
+ origional home. Any one know where the following may be found ?</title>
+
+ <listitem><para>CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt</para></listitem>
+ <listitem><para>CIFS Remote Administration Protocol draft-leach-cifs-rap-spec-00.txt</para></listitem>
+ <listitem><para>CIFS Logon and Pass Through Authentication draft-leach-cifs-logon-spec-00.txt</para></listitem>
+ <listitem><para>A Common Internet File System (CIFS/1.0) Protocol draft-leach-cifs-v1-spec-01.txt</para></listitem>
+ <listitem><para>CIFS Printing Specification draft-leach-cifs-print-spec-00.txt</para></listitem>
+ <listitem><para>RFC1001 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Concepts and methods.
+ http://ds.internic.net/rfc/rfc1001.txt </para></listitem>
+ <listitem><para>RFC1002 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Detailed specifications.
+ http://ds.internic.net/rfc/rfc1002.txt </para></listitem>
+ <listitem><para>Microsoft's main CIFS page: http://www.microsoft.com/workshop/networking/cifs/</para></listitem>
+</itemizedlist>
+
+</sect2>
+
+
+<sect2><title>How do I get help from the mailing lists ?</title>
+
+ <para> There are a number of Samba related mailing lists. Go to <ulink url=
+ "http://samba.org">http://samba.org</ulink>, click on your nearest mirror
+ and then click on <command>Support</> and then click on <command>
+ Samba related mailing lists</>.</para>
+
+ <para>For questions relating to Samba TNG go to
+ <ulink url="http://www.samba-tng.org/">http://www.samba-tng.org/</ulink>
+ It has been requested that you don't post questions about Samba-TNG to the
+ main stream Samba lists.</para>
+
+<itemizedlist><title>If you post a message to one of the lists please
+ observe the following guide lines :</title>
+
+ <listitem><para> Always remember that the developers are volunteers, they are
+ not paid and they never guarantee to produce a particular feature at
+ a particular time. Any time lines are 'best guess' and nothing more.
+ </para></listitem>
+
+ <listitem><para> Always mention what version of samba you are using and what
+ operating system its running under. You should probably list the
+ relevant sections of your smb.conf file, at least the options
+ in [global] that affect PDC support.</para></listitem>
+
+ <listitem><para>In addition to the version, if you obtained Samba via
+ CVS mention the date when you last checked it out.</para></listitem>
+
+ <listitem><para> Try and make your question clear and brief, lots of long,
+ convoluted questions get deleted before they are completely read !
+ Don't post html encoded messages (if you can select colour or font
+ size its html).</para></listitem>
+
+ <listitem><para> If you run one of those niffy 'I'm on holidays' things when
+ you are away, make sure its configured to not answer mailing lists.
+ </para></listitem>
+
+ <listitem><para> Don't cross post. Work out which is the best list to post to
+ and see what happens, ie don't post to both samba-ntdom and samba-technical.
+ Many people active on the lists subscribe to more
+ than one list and get annoyed to see the same message two or more times.
+ Often someone will see a message and thinking it would be better dealt
+ with on another, will forward it on for you.</para></listitem>
+
+ <listitem><para>You might include <emphasis>partial</emphasis>
+ log files written at a debug level set to as much as 20.
+ Please don't send the entire log but enough to give the context of the
+ error messages.</para></listitem>
+
+ <listitem><para>(Possibly) If you have a complete netmon trace ( from the opening of
+ the pipe to the error ) you can send the *.CAP file as well.</para></listitem>
+
+ <listitem><para>Please think carefully before attaching a document to an email.
+ Consider pasting the relevant parts into the body of the message. The samba
+ mailing lists go to a huge number of people, do they all need a copy of your
+ smb.conf in their attach directory ?</para></listitem>
+
+</itemizedlist>
+</sect2>
+
+
+<sect2><title>How do I get off the mailing lists ?</title>
+ <para>To have your name removed from a samba mailing list, go to the
+ same place you went to to get on it. Go to <ulink url=
+ "http://samba.org">http://samba.org</ulink>, click on your nearest mirror
+ and then click on <command>Support</> and then click on <command>
+ Samba related mailing lists</>. Or perhaps see
+ <ulink url="http://lists.samba.org/mailman/roster/samba-ntdom">here</></para>
+
+ <para>Please don't post messages to the list asking to be removed, you will just
+ be refered to the above address (unless that process failed in some way...)
+ </para>
+</sect2>
+
+</sect1>
+
+</chapter>
+
+
+
+
+</book>
diff --git a/docs/docbook/samba-pdc-howto.sgml b/docs/docbook/samba-pdc-howto.sgml
new file mode 100644
index 0000000000..38e1ecf056
--- /dev/null
+++ b/docs/docbook/samba-pdc-howto.sgml
@@ -0,0 +1,766 @@
+
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
+<book id="samba-pdc-howto">
+
+<title>The Samba 2.2 PDC HowTo </title>
+
+<!-- ========================================================
+
+ To produce html from this file
+
+ jade -E10 -t sgml -d html.dsl ntdom.sgml
+
+ This assumes that html.dsl is present in the current dir, it includes
+ a couple of defines and then refers to the DSSSL html stylesheet.
+
+ =========================================================== -->
+
+
+<bookinfo>
+ <author><firstname>David</><surname>Bannon</>
+ <affiliation><orgname>La Trobe University</orgname></affiliation>
+ </author>
+ <pubdate>November 2000</pubdate>
+</bookinfo>
+
+<dedication><title></title>
+
+ <para>Comments, corrections and additions to <email>D.Bannon@latrobe.edu.au</email></para>
+
+ <para>
+ This document explains how to setup Samba as a Primary Domain Controller and
+ applies to version 2.2.0.
+ Before
+ using these functions make sure you understand what the controller can and cannot do.
+ Please read the sections below in the Introduction.
+ As 2.2.0 is incrementally updated
+ this document will change or become out of date very quickly, make sure you are
+ reading the most current version.
+ </para>
+
+ <para>Please note this document does not apply to Samba2.2alpha0, Samba2.2alpha1,
+ Samba 2.0.7, TNG nor HEAD branch.</para>
+
+ <para>It does apply to the current (post November 27th) cvs.</para>
+
+ <para>
+ Also available is an updated version of Jerry Carter's NTDom <ulink url="samba-pdc-faq.html">
+ FAQ</> that will answer lots of
+ the special 'tuning' questions that are not covered here. Over the next couple of weeks
+ some of the items here will be moved to the FAQ.
+ </para>
+
+
+</dedication>
+
+<toc> </toc>
+
+<!-- ================ I N T R O D U C T I O N ==================== -->
+
+<chapter><title>Introduction</title>
+
+<para>
+This document will show you one way of making Version 2.2.0
+of Samba perform some of the tasks of a
+NT Primary Domain Controller. The facilities described are built into Samba as a result of
+development work done over a number of years by a large number of people. These facilities
+are only just beginning to be officially supported and although they do appear to work reliably,
+if you use them then you take the risks upon your self. This document does not cover the
+developmental versions of Samba, particularly
+<ulink url="http://www.samba-tng.org/"><citetitle>Samba-TNG</citetitle></ulink>
+
+
+</para>
+
+
+<para>Note that <ulink url="http://bioserve.latrobe.edu.au/samba">Samba 2.0.7</>
+ supports significently less of the NT Domain facilities compared with 2.2.0
+ </para>
+
+<para>
+ This document does not replace the text files DOMAIN_CONTROL.txt, DOMAIN.txt (by
+ John H Terpstra) or NTDOMAIN.txt (by Luke Kenneth Casson Leighton). Those documents provide
+ more detail and an insight to the development
+ cycle and should be considered 'further reading'.
+
+</para>
+
+
+<sect1><title>What can we do ?</title>
+<itemizedlist>
+ <listitem><para>Permit 'domain logons' for Win95/98, NT4 and W2K workstations from one central
+ password database. WRT W2K, please see the section about adding machine
+ accounts and the Intro in the <ulink url="samba-pdc-faq.html">FAQ</>.</para></listitem>
+ <listitem><para>Grant Administrator privileges to particular domain users on an
+ NT or W2K workstation.</para></listitem>
+ <listitem><para>Apply policies from a domain policy file to NT and W2K (?)
+ workstation.</para></listitem>
+ <listitem><para>Run the appropriate logon script when a user logs on to the domain
+ .</para></listitem>
+ <listitem><para>Maintain a user's local profile on the server.</para></listitem>
+ <listitem><para>Validate a user using another system via smb (such as smb_pam) and
+ soon winbind (?).</para></listitem>
+</itemizedlist>
+</sect1>
+
+
+<sect1><title>What can't we do ?</title>
+<itemizedlist>
+ <listitem><para> Become or work with a Backup Domain Controller (a BDC).</para></listitem>
+ <listitem><para> Participate in any sort of trust relationship (with either Samba or NT
+ Servers).</para></listitem>
+ <listitem><para> Offer a list of domain users to User Manager for Domains
+ on the Security Tab etc).</para></listitem>
+ <listitem><para>Be a W2K type of Domain Controller. Samba PDC will behave like
+ an NT PDC, W2K workstations connect in legacy mode.</para></listitem>
+</itemizedlist>
+</sect1>
+
+</chapter>
+
+
+<!-- ================== I N S T A L L I N G ===================== -->
+
+<chapter><title>Installing</title>
+
+ <para>Installing consists of the usual download, configure, make and make
+ install process. These steps are well documented elsewhere.
+ The <ulink url="samba-pdc-faq.html">FAQ</> discusses getting pre-release versions via CVS.
+ Then you need to configure the server.</para>
+
+<sect1><title>Start Up Script</title>
+ <para>Skip this section if you have a working Samba already.
+ Everyone has their own favourite startup script. Here is mine, offered with no warrantee
+ at all !</para>
+
+<programlisting>
+
+ #!/bin/sh
+ # Script to control Samba server, David Bannon, 14-6-96
+ #
+ #
+ PATH=/bin:/usr/sbin:/usr/bin
+ export PATH
+ case "$1" in
+ 'start')
+ if [ -f /usr/local/samba/bin/smbd ]
+ then
+ /usr/local/samba/bin/smbd -D
+ /usr/local/samba/bin/nmbd -D
+ echo "Starting Samba Server"
+ fi
+ ;;
+ 'conf')
+ if [ -f /usr/local/samba/lib/smb.conf ]
+ then
+ vi /usr/local/samba/lib/smb.conf
+ fi
+ ;;
+ 'pw')
+ if [ -f /usr/local/samba/private/smbpasswd ]
+ then
+ vi /usr/local/samba/private/smbpasswd
+ fi
+ ;;
+ 'who')
+ /usr/local/samba/bin/smbstatus -b
+ ;;
+ 'restart')
+ psline=`/bin/ps x | grep smbd | grep -v grep`
+
+ if [ "$psline" != "" ]
+ then
+ while [ "$psline" != "" ]
+ do
+ psline=`/bin/ps x | fgrep smbd | grep -v grep`
+ if [ "$psline" ]
+ then
+ set -- $psline
+ pid=$1
+ /bin/kill -HUP $pid
+ echo "Stopped $pid line = $psline"
+ sleep 2
+ fi
+ done
+ fi
+ echo "Stopped Samba servers"
+ ;;
+ 'stop')
+ psline=`/bin/ps x | grep smbd | grep -v grep`
+
+ if [ "$psline" != "" ]
+ then
+ while [ "$psline" != "" ]
+ do
+ psline=`/bin/ps x | fgrep smbd | grep -v grep`
+ if [ "$psline" ]
+ then
+ set -- $psline
+ pid=$1
+ /bin/kill -9 $pid
+ echo "Stopped $pid line = $psline"
+ sleep 2
+ fi
+ done
+ fi
+ echo "Stopped Samba servers"
+ psline=`/bin/ps x | grep nmbd | grep -v grep`
+ if [ "$psline" ]
+ then
+ set -- $psline
+ pid=$1
+ /bin/kill -9 $pid
+ echo "Stopped Name Server "
+ fi
+ echo "Stopped Name Servers"
+ ;;
+ *)
+ echo "usage: samba {start | restart |stop | conf | pw | who}"
+ ;;
+ esac
+
+</programlisting>
+
+<para> Use this script, or some other one, you will need to ensure its used while the machine
+ is booting. (This typically involves <filename>/etc/rc.d</filename>, we'll be
+ assuming that there is a script called
+ samba in <filename>/etc/rc.d/init.d</filename> further down in this document.)
+</para>
+</sect1>
+
+<sect1><title>Config File</title>
+
+<sect2><title id=configfile>A sample conf file</title>
+ <para>Here is a fairly minimal config file to do PDC. It will also make the server
+ become the browse master for the
+ specified domain (not necessary but usually desirable). You will need to change only
+ two parameters to make this
+ file work, <filename>wins server</filename> and <filename>workgroup</filename>, plus
+ you will need to put your own name (not mine!) in the <filename>domain admin users</> fields.
+ Some of the parameters are discussed further down this document.</para>
+
+ <para>Assuming you have used the default install directories, this file should appear as
+ <filename>/usr/local/samba/lib/smb.conf</filename>. It should not be
+ writable by anyone except root.</para>
+
+ <note><para>The 'add user script' parameter is a work-around, watch for changes !</></>
+
+ <programlisting>
+
+ [global]
+ security = user
+ status = yes
+ workgroup = { Your domain name here }
+ wins server = { ip of a wins server if you have one }
+ encrypt passwords = yes
+ domain logons =yes
+ logon script = scripts\%U.bat
+ domain admin users = root dbannon andrew
+ add user script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %m$
+ guest account = ftp
+ share modes=no
+ os level=65
+ [homes]
+ guest ok = no
+ read only = no
+ create mask = 0700
+ directory mask = 0700
+ oplocks = false
+ locking = no
+ [netlogon]
+ path = /usr/local/samba/netlogon
+ writeable = no
+ guest ok = no
+
+</programlisting>
+
+</sect2>
+
+<sect2><title>PDC Config Parameters</title>
+
+
+<variablelist><title>There are a huge range of parameters that may appear in a smb.conf file. Some
+ that may be of interest to a PDC are :</title>
+
+<varlistentry><term>add user script</term>
+ <listitem><para>This parameter specifies a script (or program) that will be run
+ to add a user to the system. Here it is being used to add a machine, not a user.
+ This is probably not very nice and may change. But it does work !</para>
+
+ <para>For this example, I have a group called 'machines', entries can be added to
+ <filename>/etc/passwd</> using a programme called <filename>/usr/adduser</> and
+ the other parameters are chosen as suitable for a machine account. Works for
+ RH Linux, your system may require changes.</para>
+ </listitem>
+</varlistentry>
+
+<varlistentry><term>domain admin users = user1 users2</term>
+ <listitem><para>This parameter specifies a unix user who will be granted admin privileges
+ on a NT workstation when
+ logged onto that workstation. See the section called <link linkend=domainadmin>
+ Domain Admin</> Accounts.</para>
+ </listitem>
+</varlistentry>
+
+<varlistentry><term>encrypt passwords = yes</term>
+ <listitem><para>This parameter must be 'yes' to allow any of the recent service pack NTs to logon. There are some reg hacks that
+ turn off encrypted passwords on the NTws itself but if you are going to use the smbpasswd system (and you
+ should) you must use encrypted passwords.</para>
+ </listitem>
+</varlistentry>
+
+<varlistentry><term>logon script = scripts\%U.bat</term>
+ <listitem><para>This will make samba look for a logon script named after the user
+ (eg joeblow.bat).
+ See the section further on called <link linkend=logonscript>Logon Scripts</></para>
+ <note><para>Note that the slash is like this '\', not like this '/'.
+ NT is happy with both, win95 is not !</para></note>
+ </listitem>
+</varlistentry>
+
+<varlistentry><term>logon path</term>
+ <listitem><para>Lets you specify where you would like users profiles kept. The default, that is in the users
+ home directory, does encourage a bit of fiddling.</para>
+ </listitem>
+</varlistentry>
+
+
+</variablelist>
+
+
+</sect2>
+</sect1>
+
+<sect1><title>Special directories</title>
+ <para>You need to create a couple of special files and directories. Its nice
+ to have some of the binaries handy too, so I create links to them. Assuming
+ you have used the default samba location and have not
+ changed the locations mentioned in the sample config file, do the following :</para>
+
+ <programlisting>
+
+ mkdir /usr/local/samba/netlogon
+ mkdir /usr/local/samba/netlogon/scripts
+ mkdir /usr/local/samba/private
+ touch /usr/local/samba/private/smbpasswd
+ chmod go-rwx /usr/local/samba/private/smbpasswd
+ cd /usr/local/sbin
+ ln -s /usr/local/samba/bin/smbpasswd
+ ln -s /usr/local/samba/bin/smbclient
+ ln -s /etc/rc.d/init.d/samba
+</programlisting>
+
+ <para>Make sure permissions are appropriate !</para>
+
+ <para>OK, if you have used the scripts above and have a path to where the links are do this to start up
+ the Samba Server :</para>
+
+ <para><command>samba start</command></para>
+
+ <para>Instead, you might like to reboot the machine to make sure that you
+ got the init stuff right. Any way, a quick look in the logs
+ <filename>/usr/local/samba/var/log.smbd</filename> and <filename>
+ /usr/local/samba/var/log/nmbd</filename>
+ will give you an idea of what's happening. Assuming all is well, lets create
+ some accounts...</para>
+</sect1>
+</chapter>
+
+ <!-- ================== U S E R and M A C H I N E A C C O U N T S ================ -->
+
+<chapter><title>User and Machine Accounts</title>
+<sect1><title>Logon Accounts</title>
+
+ <para><emphasis role=bold>This section is very nearly out of date already !</emphasis> It
+ appears that while you are reading it, Jean Francois Micou is making it
+ redundant ! Jean Francois is adding facilities to add users
+ (via User Manager) and machines (when joining the domain) and it looks like these facilities will
+ make it into the official release of 2.2.</para>
+
+
+ <para>Every user and NTws (and other samba servers) that will be on the domain
+ must have its own passwd entry in both <filename>/etc/passwd</filename> and
+ <filename>/usr/local/samba/private/smbpasswd</filename> .
+ The <filename>/etc/passwd</filename> entry is really
+ only to reserve a user ID. The NT encrypted password is stored in
+ <filename>/usr/local/samba/private/smbpasswd</filename>.
+ (Note that win95/98 machines don't need an account as they don't do
+ any security aware things.)</para>
+
+ <para>Samba 2.2 will now create these entries for us. Carefull set up is required
+ and there may well be some changes to this system before its released.
+ </para>
+</sect1>
+
+<sect1 id=machineaccount><title>Machine Accounts</title>
+
+ <note><para>There is an entry in the ntdom <ulink url="samba-pdc-faq.html">FAQ</> explaining how to create
+ machine entries manually.</para></note>
+
+
+<variablelist><title><emphasis>At present</> to have the machine accounts created when a machine joins
+ the domain a number of conditions must be met :</title>
+
+<varlistentry><term>Only root can do it !</term>
+ <listitem><para>There must be an entry in <filename>/usr/local/samba/private/smbpasswd</filename>
+ for root and root must be mentioned in <filename>domain admins</filename>. This may
+ be fixed some time in the future so any 'domain admin' can do it. If you don't
+ like having root as a windows logon account, make the machine
+ entries manually (both of them).</para>
+ </listitem>
+</varlistentry>
+
+<varlistentry><term>Use the <filename>add user script</></term>
+ <listitem><para>Again, this looks a bit like a 'work around'. Use a suitable
+ command line to add a machine account <link linkend=configfile>see above</link>,
+ and pass it %m$, that is %m to get machine name plus the '$'. Now, this
+ means you cannot use the <filename>add user script</> to really add users .... </para>
+ </listitem>
+</varlistentry>
+
+<varlistentry><term>Only for W2K</term>
+ <listitem><para>This automatic creation of machine accounts does not work for
+ NT4ws at present. Watch this space.</para></listitem></varlistentry>
+</variablelist>
+
+</sect1>
+
+<sect1><title>Joining the Domain</title>
+
+ <para>You must have either added the machine account entries manually (NT4 ws)
+ or set up the automatic system (W2K), <link linkend=machineaccount>see Machine Accounts</link>
+ before proceeding.</para>
+
+<variablelist>
+<varlistentry><term><command>Windows NT</></term><listitem>
+<itemizedlist>
+ <listitem><para> (<emphasis>this step may not be necessary some time in the near future</>).
+ On the samba server that is the PDC, add a machine account manually
+ as per the instructions in the <ulink url="samba-pdc-faq.html">FAQ</>
+ Then give the command <command>smbpasswd -a -m {machine}</> substituting in the
+ client machine name.</para></listitem>
+ <listitem><para> Logon to the NTws in question as a local admin, go to the
+ <command>Control Panel, Network IdentificationTag</command>.</para></listitem>
+ <listitem><para> Press the <command>Change</> button.</para></listitem>
+ <listitem><para> Enter the Domain name (from the 'Workgroup' parameter, smb.conf)
+ in the Domain Field.</para></listitem>
+<!-- <listitem><para> Now enter a user name
+ and password for a Domain Admin <emphasis>(Who must be root
+ until a pre-release bug is fixed)</emphasis> and press
+ 'OK'.</para></listitem> -->
+ <listitem><para> Press OK and after a few seconds you will get a 'Welcome to Whatever Domain'.
+ Allow to reboot.</para></listitem>
+</itemizedlist>
+</listitem></varlistentry>
+
+<varlistentry><term><command>Windows 2000</></term><listitem>
+<itemizedlist>
+ <listitem><para>Logon to the W2k machine as Administrator, go to the Control
+ Panel and double click on <command>Network and Dialup Connections</>.
+ </para></listitem>
+ <listitem><para>Pull down the <command>Advanced</> menu and choose
+ <command>Network Identification</>. Press <command>Properties
+ </>. </para></listitem>
+ <listitem><para>Choose <command>Domain</> and enter the domain name. Press 'OK'.</para></listitem>
+ <listitem><para>Now enter a user name and password for a Domain Admin
+ <emphasis>(Who must be root until a pre-release bug is fixed)</emphasis> and press
+ 'OK'.</para></listitem>
+ <listitem><para>Wait for the confirmation, reboot when prompted.</para></listitem>
+</itemizedlist>
+ <para>To remove a W2K machine from the domain, follow the first two steps then
+ choose <command>Workgroup</>, enter a work group name (or just WORKGROUP) and follow
+ the prompts.</para>
+</listitem></varlistentry>
+
+
+</variablelist>
+
+</sect1>
+
+<sect1><title id=useraccount>User Accounts</title>
+
+ <para><emphasis>Again, doing it manually (cos' the auto way is not working pre-release).
+ </emphasis>
+ In our simple case every domain user should have an account on the PDC. The
+ account may have a null shell if they are not allowed to log on to the unix
+ prompt. Again they need an entry in both the <filename>/etc/passwd</filename> and
+ <filename>/usr/local/samba/private/smbpasswd</filename>. Again a password is
+ not necessary in <filename>/etc/passwd</filename> but the location
+ of the home directory is honoured.
+ To make an entry for a user called Joe Blow you would typically do the following :</para>
+
+ <para><command>adduser -g users -c 'Joe Blow' -s /bin/false -n joeblow</command></para>
+
+ <para><command>smbpasswd -a joeblow</command></para>
+
+ <para>And you will prompted to enter a password for Joe. Ideally he will be
+ hovering over your shoulder and will, when asked, type in a password of
+ his choice. There are a number of scripts and systems to ease the migration of users
+ from somewhere to samba. Better start looking !</para>
+</sect1>
+
+<sect1><title id=domainadmin>Domain Admin Accounts</title>
+
+ <para>Certain operations demand that the logged on user has Administrator
+ privileges, typically installing software and
+ doing maintenance tasks. It is very simple to appoint some users as Domain Admins,
+ most likely yourself. Make
+ sure you trust the appointee !</para>
+
+ <para>Samba 2.2 recognizes particular users as being
+ domain admins and tells the NTws when it thinks that it has got one logged on.
+ In the smb.conf file we declare
+ that the <filename>Domain Admin users = user1 user2</filename>.
+ Any user mentioned here will be treated as a Domain Admin by a NTws when
+ logged onto the Domain. They will have full Administrator rights
+ including the rights to change permissions on files and run the system
+ utilities such as Disk Administrator.</para>
+
+ <para>Further, and this is very new, they will be allowed to create a
+ new machine account when first connecting a new NT or W2K machine to
+ the domain. <emphasis>At present, ie pre-release, only a Domain Admin who
+ also happens to be root can do so. </emphasis></para>
+</sect1>
+</chapter>
+
+
+<!-- ======== P R O F I L E S P O L I C I E S and L O G O N S C R I P T S ======= -->
+
+<chapter><title>Profiles, Policies and Logon Scripts</title>
+
+<sect1><title>Profiles</title>
+
+ <para>NT Profiles should work if you have followed the setup so far.
+ A user's profile contains a whole lot of their personal settings,
+ the contents of their desktop, personal 'My Documents' and so on.
+ When they log off, all of the profile is copied to their directory
+ on the server and is downloaded again when they logon on again, possibly
+ on another client machine.</para>
+
+ <para>Sounds great but can be a bit of a bug bear sometimes. Users let
+ their profiles get too big and then complain about how long it takes
+ to log on each time. This sample setup only supports NT profiles,
+ rumor has it that it is also possible to do the same on Win95, my
+ users don't know and I'm not telling them.</para>
+
+ <note><para>There is more info about Profiles (including for W95/98)
+ in the <ulink url="samba-pdc-faq.html">FAQ</>.</para></note>
+</sect1>
+
+<sect1><title>Policies</title>
+
+ <para>Policies are an easy way to make or enforce specific characteristics across your network. You create a ntconfig.pol
+ file and every time someone logs on with their NTws, the settings you put in ntconfig.pol are applied to the NTws.
+ Typical setting are things like making the date appear the way you want it (none of these 2 figure years here) or
+ maybe suppressing one of the splash screens. Perhaps you want to set the NTws so it does not keep users profiles
+ on the local machine. Cool. The only problem is making the ntconfig.pol file itself. You cannot use the policy editor
+ that comes with NTws.</para>
+
+ <note><para>See the <ulink url="samba-pdc-faq.html">FAQ</> for pointers on how to get a suitable Policy Editor.</para></note>
+
+ <para>The Policy Editor (and associated files) will create a
+ <filename>ntconfig.pol</filename> file using the
+ parameters Microsoft thought of and parameters you specify by making your own
+ template file.</para>
+
+ <para>In our example configuration here, Samba will expect to find
+ the <filename>ntconfig.pol</filename> file in
+ <filename>/usr/local/samba/netlogon</filename>. Needless to say (I hope !),
+ it is vitally important that ordinary users don't have
+ write permission to the Policy files.</para>
+</sect1>
+
+<sect1><title id=logonscript>Logon Scripts</title>
+
+ <para>In the sample config file above there is a line
+ <filename>logon script = scripts\%U.bat</filename></para>
+
+ <note><para>Note that the slash is like this '\' not like this '/'.
+ NT is happy with both, win95 is not !</para></note>
+
+ <para>This allows you to run a dos batch file every time someone logs on. The batch
+ file is located on the server, in the sample install mentioned here,
+ its in <filename>/usr/local/samba/netlogon/scripts</filename> and
+ is named after the user with <filename>.bat</filename> appended, eg Joe
+ Blow's script is called <filename>/usr/local/samba/netlogon/scripts/joeblow.bat</filename>.</para>
+
+ <note><para>There is a suggestion that user names longer than 8 characters may cause
+ problems with some systems being unable to run logon scripts. This is confirmed in earlier
+ versions when connecting using W95, comments about other combinations ??</para></note>
+
+ <para>You could use a line like this <filename>logon script = default.bat</> and samba
+ will supply <filename>/usr/local/samba/netlogon/default.bat</> for any client and every
+ user. Maybe you could use %m and get a client machine dependant logon script.
+ You get the idea...</para>
+
+ <para>Note that the file is a dos batch file not a Unix script. It runs dos commands on the client
+ computer with the logon user's permissions. It must be a dos file with each line ending with
+ the dos cr/lf not a nice clean newline. Generally,
+ its best to create the initial file on a DOS system and copy it across.</para>
+
+ <para>There is lots of very clever uses of the Samba replaceable variables such
+ ( %U = user, %G = primary group, %H = client machine, see the 'man 5 smb.conf') to
+ give you control over which script runs when a particular person logs
+ on. (Gee, it would be nice to have a default.bat run when nothing else is available.)</para>
+
+ <para>Again, it is vitally important that ordinary users don't have write
+ permission to other peoples, or even probably their own, logon script files.</para>
+
+ <para>A typical logon script is reproduced below. Note that it runs separate
+ commands for win95 and NT, that's because NT has slightly different behaviour
+ when using the <filename>net use ..</filename> command. Its useful for lots of
+ other situations too. I don't know what syntax to use for win98, I don't use it
+ here.</para>
+
+<programlisting>
+
+ rem Default logon script, create links to this file.
+
+ net time \\bioserve /set /yes
+ @echo off
+ if %OS%.==Windows_NT. goto WinNT
+
+ :Win95
+ net use k: \\trillion\bio_prog
+ net use p: \\bcfile\homes
+ goto end
+ :WinNT
+ net use k: \\trillion\bio_prog /persistent:no
+ net use p: \\bcfile\homes /persistent:no
+
+ :end
+
+</programlisting>
+</sect1>
+</chapter>
+
+<chapter><title>Passwords and Authentication</title>
+
+ <para>So far our configuration assumes that ordinary users don't have unix logon access. A change
+ to the <link linkend=useraccount><filename>adduser</></> line above would allow unix logon
+ but it would be with passwords that may
+ be different from the NT logon. Clearly that won't suit everyone. Trying to explain to users
+ that they need to change their passwords in two seperate places is not fun.
+ Further, even if they cannot do a unix logon there are other processes that
+ might require authentication. We have a nice securely encrypted password in
+ <filename>/usr/local/samba/private/smbpasswd</filename>, why not use it ?</para>
+
+<sect1><title></>
+<sect2><title>Syncing Passwords</title>
+
+ <para>Yes, its possible and seems the easiest way (initially anyway).
+ The <ulink url="samba-pdc-faq.html">FAQ</> details how to
+ do so in the sections <emphasis>What is password sync and should I use it ?</> and <emphasis>
+ How do I get remote password (unix and SMB) changing working ?</></para>
+
+</sect2>
+
+<sect2><title>Using PAM</title>
+ <para>Pam enabled systems have a much better solution available. The Samba
+ PDC server will offer to authenticate domain users to other processes
+ (either on this server or on the domain). With a suitable pam stack
+ such as <ulink url="http://www.csn.ul.ie/~airlied/pam_smb/"> Pam_smb</ulink>
+ you can get any pam aware application looking to the samba password and
+ can leave the password field in <filename>/etc/shadow</filename>
+ or <filename>/etc/passwd</filename> invalid.</para>
+</sect2>
+
+<sect2><title>Authenticating other Samba Servers</title>
+ <para>In a domain that has a number of servers you only need one password database.
+ The machines that don't have their own ask the PDC to check for them.
+ This will work fine for a domain controlled by either a Samba or NT machine.</para>
+
+ <para>To do so the Samba machine must be told to refer to the PDC and where the PDC is.
+ See the section in the NTDom <ulink url="samba-pdc-faq.html">FAQ</> called <emphasis>How do I get my samba server to
+ become a member ( not PDC ) of an NT domain?</></para>
+
+
+</sect2>
+</sect1>
+</chapter>
+
+
+<chapter><title>Background</title>
+
+<sect1><title></title>
+<sect2><title>History</title>
+
+ <para>It might help you understand the limitations of the PDC in Samba if you
+ read something of its history. Well, the history as I understand it anyway.</para>
+
+ <para>For many years the Samba team have been developing Samba, some time ago
+ a number of people, possibly lead by Luke Leighton started contributing NT
+ PDC stuff. This was added to the 'head' stream (that would eventually
+ become the next version) and later to a seperate stream (NTDom). They did so
+ much that eventually this development stream was so mutated that it could not
+ be merged back into the main stream and was abandoned towards the end of 1999.
+ And that was very sad because many users, myself include had become heavily
+ dependant on the NTController facilities it offered. Oh well...</para>
+
+ <para>The NTDom team continued on with their new found knowledge however and
+ built the TNG stream. Intended to be carefully controlled so that it can be
+ merged back into the main stream and benefiting from what they learnt, it is
+ a very different product to the origional NTDom product. However, for a
+ number of reasons, the merge did not take place and now TNG is being developed
+ at <ulink url="http://www.samba-tng.org">http://www.samba-tng.org</>.</para>
+
+ <para>Now, the NTDom things that the main strean 2.0.x version does is based more
+ on the old (initial version) abandoned code than on the TNG ideas. It appears
+ that version 2.2.0 will also include an improved version of the 2.0.7 domain
+ controller charactistics, not the TNG ways. The developers have indicated
+ that 2.2.0 will be further developed incrementally and the ideas from TNG
+ incorporated into it.</para>
+
+ <para>One more little wriggle is worth mentioning. At one stage the NTDom
+ stream was called Samba 2.1.0-prealpha and similar names. This is most
+ unfortunate because at least one book published advises people who want to
+ use NTDom Samba to get version 2.1.0 or later. As main stream Samba will soon
+ be called 2.2.0 and NOT officially supporting NTDom Controlling functions,
+ the potential for confusion is certainly there.</para>
+</sect2>
+
+<sect2><title>The Future</title>
+
+ <para>There is a document on the Samba mirrors called <emphasis>'Development'
+ </emphasis>. It offers the 'best guess' of what is planned for future releases
+ of Samba.</para>
+
+ <para>The future of Samba as a Primary Domain Controller appears rosie, however
+ be aware that its the future, not the present. The developers are strongly committed
+ to building a full featured PDC into Samba but it will take time. If this
+ version does not meet your requirements then you should consider (in no particular
+ order) :</para>
+
+ <itemizedlist>
+ <listitem><para> Wait. No, we don't know how long. Repeated asking won't help.</para></listitem>
+ <listitem><para>Investigate the development versions, TNG perhaps or HEAD where new code is being added
+ all the time. Realise that development code is often unstable, poorly documented and subject to change.
+ You will need to use cvs to download development versions.</para></listitem>
+ <listitem><para>Join one of the Samba mailing lists so that you can find out
+ what is happening on the 'bleeding edge'.</para></listitem>
+ </itemizedlist>
+</sect2>
+
+<sect2><title>Getting further help</title>
+
+ <para>This document cannot possibly answer all your questions. Please understand that its very
+ likely that someone has been confrounted by the same problem that you have. The
+ <ulink url="samba-pdc-faq.html">FAQ</>
+ discusses a number of possible paths to take to get further help :</para>
+
+
+ <itemizedlist>
+ <listitem><para>Documents on the Samba Sites.</para></listitem>
+ <listitem><para>Other web sites.</para></listitem>
+ <listitem><para>Mailing list.</para></listitem>
+ </itemizedlist>
+
+ <para>There is some discussion about guide lines for using the Mailing Lists on the
+ accompanying <ulink url="samba-pdc-faq.html">FAQ</>,
+ please read them before posting.</para>
+
+</sect2>
+</sect1>
+</chapter>
+
+</book>