Large number of small fixes to the layout and the build system.

(This used to be commit 73fac0653c774a8ed8654b064fd63d4e486f6b0f)

77 files changed, 29542 insertions, 0 deletions

diff --git a/docs/Samba3-ByExample/SBE-2000UserNetwork.xml b/docs/Samba3-ByExample/SBE-2000UserNetwork.xml
new file mode 100644
index 0000000000..2023e43f92
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-2000UserNetwork.xml
@@ -0,0 +1,1619 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="2000users">
+  <title>A Distributed 2000-User Network</title>
+
+<para>
+There is something indeed mystical about things that are
+big. Large networks exhibit a certain magnetism and exude a sense of
+importance that obscures reality. You and I know that it is no more
+difficult to secure a large network than it is a small one. We all
+know that over and above a particular number of network clients, the
+rules no longer change; the only real dynamic is the size of the domain
+(much like a kingdom) over which the network ruler (oops, administrator)
+has control. The real dynamic then transforms from the technical to the
+political. Then again, that point is often reached well before the
+kingdom (or queendom) grows large.
+</para>
+
+<para>
+If you have systematically worked your way to this chapter, hopefully you
+have found some gems and techniques that are applicable in your
+world. The network designs you have worked with in this book have their
+strong points as well as weak ones. That is to be expected given that
+they are based on real business environments, the specifics of which are
+molded to serve the purposes of this book.
+</para>
+
+<para>
+This chapter is intent on wrapping up issues that are central to
+implementation and design of progressively larger networks. Are you ready
+for this chapter? Good, it is time to move on.
+</para>
+
+<para>
+In previous chapters, you made the assumption that your network
+administration staff need detailed instruction right down to the
+nuts and bolts of implementing the solution. That is still the case,
+but they have graduated now. You decide to document only those issues,
+methods, and techniques that are new or complex. Routine tasks such as
+implementing a DNS or a DHCP server are under control. Even the basics of
+Samba are largely under control. So in this section you focus on the
+specifics of implementing LDAP changes, Samba changes, and approach and
+design of the solution and its deployment.
+</para>
+
+<sect1>
+<title>Introduction</title>
+
+<para>
+Abmas is a miracle company. Most businesses would have collapsed under
+the weight of rapid expansion that this company has experienced. Samba 
+is flexible, so there is no need to reinstall the whole operating 
+system just because you need to implement a new network design. In fact, 
+you can keep an old server running right up to the moment of cutover 
+and then do a near-live conversion. There is no need to reinstall a 
+Samba server just to change the way your network should function.
+</para>
+
+<para>
+<indexterm><primary>LDAP</primary></indexterm>
+Network growth is common to all organizations. In this exercise,
+your preoccupation is with the mechanics of implementing Samba and
+LDAP so that network users on each network segment can work
+without impediment.
+</para>
+
+	<sect2>
+	<title>Assignment Tasks</title>
+
+	<para>
+	Starting with the configuration files for the server called
+	<constant>MASSIVE</constant> in <link linkend="happy"/>, you now deal with the
+	issues that are particular to large distributed networks. Your task
+	is simple &smbmdash; identify the challenges, consider the 
+	alternatives, and then design and implement a solution.
+	</para>
+
+	<para>
+	<indexterm><primary>VPN</primary></indexterm>
+	Remember, you have users based in London (UK), Los Angeles,
+	Washington. DC, and, three buildings in New York. A significant portion
+	of your workforce have notebook computers and roam all over the
+	world. Some dial into the office, others use VPN connections over the
+	Internet, and others just move between buildings.i
+	</para>
+
+	<para>
+	What do you say to an employee who normally uses a desktop
+	system but must spend six weeks on the road with a notebook computer?
+	She is concerned about email access and how to keep coworkers current
+	with changing documents.
+	</para>
+
+		<para>
+	To top it all off, you have one network support person and one 
+	help desk person based in London, a single person dedicated to all 
+	network operations in Los Angeles, five staff for user administration 
+	and help desk in New York, plus one <emphasis>floater</emphasis> for 
+	Washington.
+	</para>
+
+		<para>
+	You have outsourced all desktop deployment and management to
+	DirectPointe. Your concern is server maintenance and third-level
+	support. Build a plan and show what must be done.
+	</para>
+
+	</sect2>
+</sect1>
+
+<sect1>
+<title>Dissection and Discussion</title>
+
+<para>
+<indexterm><primary>passdb backend</primary></indexterm>
+<indexterm><primary>LDAP</primary></indexterm>
+In <link linkend="happy"/>, you implemented an LDAP server that provided the
+<parameter>passdb backend</parameter> for the Samba servers. You
+explored ways to accelerate Windows desktop profile handling and you
+took control of network performance.
+</para>
+
+<para>
+<indexterm><primary>ldapsam</primary></indexterm>
+<indexterm><primary>tdbsam</primary></indexterm>
+<indexterm><primary>smbpasswd</primary></indexterm>
+<indexterm><primary>replicated</primary></indexterm>
+The implementation of an LDAP-based passdb backend (known as
+<emphasis>ldapsam</emphasis> in Samba parlance), or some form of database
+that can be distributed, is essential to permit the deployment of Samba
+Primary and Backup Domain Controllers (PDC/BDCs). You see, the problem
+is that the <emphasis>tdbsam</emphasis>-style passdb backend does not
+lend itself to being replicated. The older plain-text-based
+<emphasis>smbpasswd</emphasis>-style passdb backend can be replicated
+using a tool such as <command>rsync</command>, but
+<emphasis>smbpasswd</emphasis> suffers the drawback that it does not
+support the range of account facilities demanded by modern network
+managers.
+</para>
+
+<para>
+<indexterm><primary>XML</primary></indexterm>
+<indexterm><primary>SQL</primary></indexterm>
+The new <emphasis>tdbsam</emphasis> facility supports functionality
+that is similar to an <emphasis>ldapsam</emphasis>, but the lack of
+distributed infrastructure sorely limits the scope for its
+deployment. This raises the following questions: Why can't I just use
+an XML-based backend, or for that matter, why not use an SQL-based
+backend? Is support for these tools broken? Answers to these
+questions require a bit of background.</para>
+
+<para>
+<indexterm><primary>directory</primary></indexterm>
+<indexterm><primary>database</primary></indexterm>
+<indexterm><primary>transaction processing</primary></indexterm>
+<indexterm><primary>LDAP</primary></indexterm>
+<emphasis>What is a directory?</emphasis> A directory is a
+collection of information regarding objects that can be accessed to
+rapidly find information that is relevant in a particular and
+consistent manner. A directory differs from a database in that it is
+generally more often searched (read) than updated. As a consequence, the
+information is organized to facilitate read access rather than to
+support transaction processing.</para>
+
+<para>
+<indexterm><primary>Lightweight Directory Access Protocol</primary><see>LDAP</see></indexterm>
+<indexterm><primary>LDAP</primary></indexterm>
+<indexterm><primary>master</primary></indexterm>
+<indexterm><primary>slave</primary></indexterm>
+The Lightweight Directory Access Protocol (LDAP) differs
+considerably from a traditional database. It has a simple search
+facility that uniquely makes a highly preferred mechanism for managing
+user identities. LDAP provides a scalable mechanism for distributing
+the data repository and for keeping all copies (slaves) in sync with
+the master repository.</para>
+
+<para>
+<indexterm><primary>identity management</primary></indexterm>
+<indexterm><primary>Active Directory</primary></indexterm>
+<indexterm><primary>OpenLDAP</primary></indexterm>
+Samba is a flexible and powerful file and print sharing
+technology. It can use many external authentication sources and can be
+part of a total authentication and identity management
+infrastructure. The two most important external sources for large sites
+are Microsoft Active Directory and LDAP. Sites that specifically wish to
+avoid the proprietary implications of Microsoft Active Directory
+naturally gravitate toward OpenLDAP.</para>
+
+<para>
+<indexterm><primary>network</primary><secondary>routed</secondary></indexterm>
+In <link linkend="happy"/>, you had to deal with a locally routed
+network. All deployment concerns focused around making users happy,
+and that simply means taking control over all network practices and
+usage so that no one user is disadvantaged by any other. The real
+lesson is one of understanding that no matter how much network
+bandwidth you provide, bandwidth remains a precious resource.</para>
+
+<para>In this chapter, you must now consider how the overall network must
+function. In particular, you must be concerned with users who move
+between offices. You must take into account the way users need to
+access information globally. And you must make the network robust
+enough so that it can sustain partial breakdown without causing loss of
+productivity.</para>
+
+	<sect2>
+	<title>Technical Issues</title>
+
+	<para>
+	There are at least three areas that need to be addressed as you
+	approach the challenge of designing a network solution for the newly
+	expanded business:
+	</para>
+
+	<itemizedlist>
+		<listitem><para><indexterm><primary>mobility</primary></indexterm>
+		User needs such as mobility and data access</para></listitem>
+
+		<listitem><para>The nature of Windows networking protocols</para></listitem>
+
+		<listitem><para>Identity management infrastructure needs</para></listitem>
+	</itemizedlist>
+
+	<para>Let's look at each in turn.</para>
+
+	<sect3>
+	  <title>User Needs</title>
+
+	<para>
+	The new company has three divisions. Staff for each division are spread across
+	the company. Some staff are office-bound and some are mobile users. Mobile
+	users travel globally. Some spend considerable periods working in other offices.
+	Everyone wants to be able to work without constraint of productivity.
+	</para> 
+
+	<para>
+	The challenge is not insignificant. In some parts of the world, even dial-up
+	connectivity is poor, while in other regions political encumbrances severely
+	curtail user needs. Parts of the global Internet infrastructure remain shielded
+	off for reasons outside the scope of this discussion.
+	</para>
+
+	<para>
+	<indexterm><primary>synchronize</primary></indexterm>
+	Decisions must be made regarding where data is to be stored, how it will be
+	replicated (if at all), and what the network bandwidth implications are. For
+	example, one decision that can be made is to give each office its own master
+	file storage area that can be synchronized to a central repository in New
+	York. This would permit global data to be backed up from a single location.
+	The synchronization tool could be <command>rsync,</command> run via a cron
+	job. Mobile users may use off-line file storage under Windows XP Professional.
+	This way, they can synchronize all files that have changed since each logon
+	to the network.
+	</para>
+
+	<para>
+	<indexterm><primary>bandwidth</primary><secondary>requirements</secondary></indexterm>
+	<indexterm><primary>roaming profile</primary></indexterm>
+	No matter which way you look at this, the bandwidth requirements
+	for acceptable performance are substantial even if only 10 percent of
+	staff are global data users. A company with 3,500 employees,
+	280 of whom are mobile users who use a similarly distributed
+	network, found they needed at least 2 Mb/sec connectivity
+	between the UK and US offices. Even over 2 Mb/sec bandwidth, this
+	company abandoned any attempt to run roaming profile usage for
+	mobile users. At that time, the average roaming profile took 480
+	KB, while today the minimum Windows XP Professional roaming
+	profile involves a transfer of over 750 KB from the profile
+	server to and from the client.
+	</para>
+
+	<para>
+	<indexterm><primary>wide-area</primary></indexterm>
+	Obviously then, user needs and wide-area practicalities dictate the economic and
+	technical aspects of your network design as well as for standard operating procedures.
+	</para>
+
+	</sect3>
+
+	<sect3>
+	  <title>The Nature of Windows Networking Protocols</title>
+
+	<para>
+	<indexterm><primary>profile</primary><secondary>mandatory</secondary></indexterm>
+	Network logons that include roaming profile handling requires from 140 KB to 2 MB.
+	The inclusion of support for a minimal set of common desktop applications can push
+	the size of a complete profile to over 15 MB. This has substantial implications
+	for location of user profiles. Additionally, it is a significant factor in
+	determining the nature and style of mandatory profiles that may be enforced as
+	part of a total service-level assurance program that might be implemented.
+	</para>
+
+	<para>
+	<indexterm><primary>logon traffic</primary></indexterm>
+	<indexterm><primary>redirected folders</primary></indexterm>
+	One way to reduce the network bandwidth impact of user logon
+	traffic is through folder redirection. In <link linkend="happy"/>, you
+	implemented this in the new Windows XP Professional standard
+	desktop configuration. When desktop folders such as <guimenu>My
+	Documents</guimenu> are redirected to a network drive, they should
+	also be excluded from synchronization to and from the server on
+	logon or logout. Redirected folders are analogous to network drive
+	connections.
+	</para>
+
+	<para><indexterm><primary>application servers</primary></indexterm>
+	Of course, network applications should only be run off
+	local application servers. As a general rule, even with 2 Mb/sec
+	network bandwidth, it would not make sense at all for someone who
+	is working out of the London office to run applications off a
+	server that is located in New York.
+	</para>
+
+	<para>
+	<indexterm><primary>affordability</primary></indexterm>
+	When network bandwidth becomes a precious commodity (that is most
+	of the time), there is a significant demand to understand network
+	processes and to mold the limits of acceptability around the
+	constraints of affordability.
+	</para>
+
+	<para>
+	When a Windows NT4/200x/XP Professional client user logs onto
+	the network, several important things must happen.
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		<indexterm><primary>DHCP</primary></indexterm>
+		The client obtains an IP address via DHCP. (DHCP is
+		necessary so that users can roam between offices.)
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>WINS</primary></indexterm>
+		<indexterm><primary>DNS</primary></indexterm>
+		The client must register itself with the WINS and/or DNS server.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>Domain Controller</primary><secondary>closest</secondary></indexterm>
+		The client must locate the closest domain controller.
+		</para></listitem>
+
+		<listitem><para>
+		The client must log onto a domain controller and obtain as part of
+		that process the location of the user's profile, load it, connect to
+		redirected folders, and establish all network drive and printer connections.
+		</para></listitem>
+
+		<listitem><para>
+		The domain controller must be able to resolve the user's
+		credentials before the logon process is fully implemented.
+		</para></listitem>
+	</itemizedlist>
+
+	<para>
+	Given that this book is about Samba and that it implements the Windows
+	NT4-style domain semantics, it makes little sense to compare Samba with
+	Microsoft Active Directory insofar as the logon protocols and principles
+	of operation are concerned. The following information pertains exclusively
+	to the interaction between a Windows XP Professional workstation and a
+	Samba-3.0.20 server. In the discussion that follows, use is made of DHCP and WINS.
+	</para>
+
+	<para>
+	As soon as the Windows workstation starts up, it obtains an
+	IP address. This is immediately followed by registration of its
+	name both by broadcast and Unicast registration that is directed
+	at the WINS server.
+	</para>
+
+	<para>
+	<indexterm><primary>Unicast</primary></indexterm>
+	<indexterm><primary>broadcast</primary><secondary>directed</secondary>
+	</indexterm><indexterm><primary>NetBIOS</primary></indexterm>
+	Given that the client is already a domain member, it then sends
+	a directed (Unicast) request to the WINS server seeking the list of
+	IP addresses for domain controllers (NetBIOS name type 0x1C). The
+	WINS server replies with the information requested.</para>
+
+	<para>
+	<indexterm><primary>broadcast</primary><secondary>mailslot</secondary></indexterm>
+	<indexterm><primary>Unicast</primary></indexterm>
+	<indexterm><primary>WINS</primary></indexterm>
+	The client sends two netlogon mailslot broadcast requests
+	to the local network and to each of the IP addresses returned by
+	the WINS server. Whichever answers this request first appears to
+	be the machine that the Windows XP client attempts to use to
+	process the network logon. The mailslot messages use UDP broadcast
+	to the local network and UDP Unicast directed at each machine that
+	was listed in the WINS server response to a request for the list of
+	domain controllers.
+	</para>
+
+	<para>
+	<indexterm><primary>protocol</primary><secondary>negotiation</secondary></indexterm>
+	<indexterm><primary>logon server</primary></indexterm>
+	<indexterm><primary>fail</primary></indexterm>
+	The logon process begins with negotiation of the SMB/CIFS
+	protocols that are to be used; this is followed by an exchange of
+	information that ultimately includes the client sending the
+	credentials with which the user is attempting to logon. The logon
+	server must now approve the further establishment of the
+	connection, but that is a good point to halt for now. The priority
+	here must center around identification of network infrastructure
+	needs. A secondary fact we need to know is, what happens when
+	local domain controllers fail or break?
+	</para>
+
+	<para>
+	<indexterm><primary>Domain Controller</primary></indexterm>
+	<indexterm><primary>PDC</primary></indexterm>
+	<indexterm><primary>BDC</primary></indexterm>
+	<indexterm><primary>netlogon</primary></indexterm>
+	Under most circumstances, the nearest domain controller
+	responds to the netlogon mailslot broadcast. The exception to this
+	norm occurs when the nearest domain controller is too busy or is out
+	of service. Herein lies an important fact. This means it is
+	important that every network segment should have at least two
+	domain controllers. Since there can be only one PDC, all additional
+	domain controllers are by definition BDCs.
+	</para>
+
+	<para>
+	<indexterm><primary>authentication</primary></indexterm>
+	<indexterm><primary>Identity Management</primary></indexterm>
+	The provision of sufficient servers that are BDCs is an
+	important design factor. The second important design factor
+	involves how each of the BDCs obtains user authentication
+	data. That is the subject of the next section, which involves key
+	decisions regarding Identity Management facilities.
+	</para>
+
+	</sect3>
+
+	<sect3>
+	<title>Identity Management Needs</title>
+
+	<para>
+	<indexterm><primary>privacy</primary></indexterm>
+	<indexterm><primary>user credentials</primary></indexterm>
+	<indexterm><primary>validated</primary></indexterm>
+	<indexterm><primary>privileges</primary></indexterm>
+	Network managers recognize that in large organizations users
+	generally need to be given resource access based on needs, while
+	being excluded from other resources for reasons of privacy. It is
+	therefore essential that all users identify themselves at the
+	point of network access. The network logon is the principal means
+	by which user credentials are validated and filtered and appropriate
+	rights and privileges are allocated.
+	</para>
+
+	<para>
+	<indexterm><primary>Identity Management</primary></indexterm>
+	<indexterm><primary>Yellow Pages</primary></indexterm>
+	<indexterm><primary>NIS</primary></indexterm>
+	Unfortunately, network resources tend to have their own Identity 
+	Management facilities, the quality and manageability of which varies 
+	from quite poor to exceptionally good. Corporations that use a mixture 
+	of systems soon discover that until recently, few systems were 
+	designed to interoperate. For example, UNIX systems each have an 
+	independent user database. Sun Microsystems developed a facility that 
+	was originally called <constant>Yellow Pages</constant>, and was renamed 
+	when a telephone company objected to the use of its trademark. 
+	What was once called <constant>Yellow Pages</constant> is today known 
+	as <constant>Network Information System</constant> (NIS).
+	</para>
+
+	<para>
+	<indexterm><primary>NIS+</primary></indexterm>
+	NIS gained a strong following throughout the UNIX/VMS space in a short
+	period of time and retained that appeal and use for over a decade.
+	Security concerns and inherent limitations have caused it to enter its
+	twilight. NIS did not gain widespread appeal outside of the UNIX world
+	and was not universally adopted. Sun updated this to a more secure
+	implementation called NIS+, but even it has fallen victim to changing
+	demands as the demand for directory services that can be coupled with
+	other information systems is catching on.
+	</para>
+
+
+	<para>
+	<indexterm><primary>NIS</primary></indexterm>
+	<indexterm><primary>government</primary></indexterm>
+	<indexterm><primary>education</primary></indexterm>
+	Nevertheless, both NIS and NIS+ continue to hold ground in
+	business areas where UNIX still has major sway. Examples of
+	organizations that remain firmly attached to the use of NIS and
+	NIS+ include large government departments, education institutions,
+	and large corporations that have a scientific or engineering
+	focus.
+	</para>
+
+	<para>
+	<indexterm><primary>scalable</primary></indexterm>
+	<indexterm><primary>distributed</primary></indexterm>
+	Today's networking world needs a scalable, distributed Identity 
+	Management infrastructure, commonly called a directory. The most 
+	popular technologies today are Microsoft Active Directory service 
+	and a number of LDAP implementations.
+	</para>
+
+	<para>
+	<indexterm><primary>multiple directories</primary></indexterm>
+	The problem of managing multiple directories has become a focal
+	point over the past decade, creating a large market for
+	metadirectory products and services that allow organizations that
+	have multiple directories and multiple management and control
+	centers to provision information from one directory into
+	another. The attendant benefit to end users is the promise of
+	having to remember and deal with fewer login identities and
+	passwords.</para>
+
+	<para>
+	<indexterm><primary>network</primary><secondary>bandwidth</secondary></indexterm>
+	The challenge of every large network is to find the optimum
+	balance of internal systems and facilities for Identity
+	Management resources. How well the solution is chosen and
+	implemented has potentially significant impact on network bandwidth
+	and systems response needs.</para>
+
+	<para>
+	<indexterm><primary>LDAP server</primary></indexterm>
+	<indexterm><primary>LDAP</primary><secondary>master</secondary></indexterm>
+	<indexterm><primary>LDAP</primary><secondary>slave</secondary></indexterm>
+	In <link linkend="happy"/>, you implemented a single LDAP server for the
+	entire network. This may work for smaller networks, but almost
+	certainly fails to meet the needs of large and complex networks. The
+	following section documents how you may implement a single
+	master LDAP server with multiple slave servers.</para>
+
+	<para>
+	What is the best method for implementing master/slave LDAP
+	servers within the context of a distributed 2,000-user network is a
+	question that remains to be answered.</para>
+
+	<para>
+	<indexterm><primary>distributed domain</primary></indexterm>
+	<indexterm><primary>wide-area</primary></indexterm>
+	One possibility that has great appeal is to create a single,
+	large distributed domain. The practical implications of this
+	design (see <link linkend="chap7net"/>) demands the placement of
+	sufficient BDCs in each location. Additionally, network
+	administrators must make sure that profiles are not transferred
+	over the wide-area links, except as a totally unavoidable
+	measure. Network design must balance the risk of loss of user
+	productivity against the cost of network management and
+	maintenance.
+	</para>
+
+	<para>
+	<indexterm><primary>domain name space</primary></indexterm>
+	The network design in <link linkend="chap7net2"/> takes the approach
+	that management of networks that are too remote to be managed
+	effectively from New York ought to be given a certain degree of
+	autonomy. With this rationale, the Los Angeles and London networks,
+	though fully integrated with those on the East Coast, each have their
+	own domain name space and can be independently managed and controlled.
+	One of the key drawbacks of this design is that it flies in the face of
+	the ability for network users to roam globally without some compromise
+	in how they may access global resources.
+	</para>
+
+	<para>
+	<indexterm><primary>interdomain trusts</primary></indexterm>
+	Desk-bound users need not be negatively affected by this design, since
+	the use of interdomain trusts can be used to satisfy the need for global
+	data sharing.
+	</para>
+
+	<para>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>LDAP</primary><secondary>backend</secondary></indexterm>
+	<indexterm><primary>SID</primary></indexterm>
+	When Samba-3 is configured to use an LDAP backend, it stores the domain
+	account information in a directory entry. This account entry contains the
+	domain SID. An unintended but exploitable side effect is that this makes it
+	possible to operate with more than one PDC on a distributed network.
+	</para>
+
+	<para>
+	<indexterm><primary>WINS</primary></indexterm>
+	<indexterm><primary>wins.dat</primary></indexterm>
+	<indexterm><primary>SID</primary></indexterm>
+	How might this peculiar feature be exploited? The answer is simple. It is
+	imperative that each network segment have its own WINS server. Major
+	servers on remote network segments can be given a static WINS entry in
+	the <filename>wins.dat</filename> file on each WINS server. This allows
+	all essential data to be visible from all locations. Each location would,
+	however, function as if it is an independent domain, while all sharing the
+	same domain SID. Since all domain account information can be stored in a
+	single LDAP backend, users have unfettered ability to roam.
+	</para>
+
+	<para>
+	<indexterm><primary>NetBIOS name</primary><secondary>aliases</secondary></indexterm>
+	<indexterm><primary>fail-over</primary></indexterm>
+	This concept has not been exhaustively validated, though we can see no reason
+	why this should not work. The important facets are the following: The name of
+	the domain must be identical in all locations. Each network segment must have
+	its own WINS server. The name of the PDC must be the same in all locations; this
+	necessitates the use of NetBIOS name aliases for each PDC so that they can be
+	accessed globally using the alias and not the PDC's primary name. A single master
+	LDAP server can be based in New York, with multiple LDAP slave servers located
+	on every network segment. Finally, the BDCs should each use failover LDAP servers
+	that are in fact slave LDAP servers on the local segments.
+	</para>
+
+	<para>
+	<indexterm><primary>LDAP</primary><secondary>updates</secondary></indexterm>
+	<indexterm><primary>domain tree</primary></indexterm>
+	<indexterm><primary>LDAP</primary><secondary>database</secondary></indexterm>
+	<indexterm><primary>LDAP</primary><secondary>directory</secondary></indexterm>
+	With a single master LDAP server, all network updates are effected on a single
+	server. In the event that this should become excessively fragile or network
+	bandwidth limiting, one could implement a delegated LDAP domain. This is also
+	known as a partitioned (or multiple partition) LDAP database and as a distributed
+	LDAP directory.
+	</para>
+
+	<para>
+	As the LDAP directory grows, it becomes increasingly important
+	that its structure is implemented in a manner that mirrors
+	organizational needs, so as to limit network update and
+	referential traffic. It should be noted that all directory
+	administrators must of necessity follow the same standard
+	procedures for managing the directory, because retroactive correction of
+	inconsistent directory information can be exceedingly difficult.
+	</para>
+
+	<image id="chap7net">
+		<imagedescription>Network Topology &smbmdash; 2000 User Complex Design A</imagedescription>
+		<imagefile scale="70">chap7-net-Ar</imagefile>
+	</image>
+
+	<image id="chap7net2">
+		<imagedescription>Network Topology &smbmdash; 2000 User Complex Design B</imagedescription>
+		<imagefile scale="70">chap7-net2-Br</imagefile>
+	</image>
+
+	</sect3>
+
+	</sect2>
+
+
+	<sect2>
+		<title>Political Issues</title>
+
+	<para>
+	As organizations grow, the number of points of control increases
+	also. In a large distributed organization, it is important that the
+	Identity Management system be capable of being updated from
+	many locations, and it is equally important that changes made should
+	become usable in a reasonable period, typically
+	minutes rather than days (the old limitation of highly manual
+	systems).
+	</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Implementation</title>
+
+	<para>
+	<indexterm><primary>winbind</primary></indexterm>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>UID</primary></indexterm>
+	<indexterm><primary>GID</primary></indexterm>
+	Samba-3 has the ability to use multiple password (authentication and
+	identity resolution) backends. The diagram in <link linkend="chap7idres"/>
+	demonstrates how Samba uses winbind, LDAP, and NIS, the traditional system
+	password database. The diagram only documents the mechanisms for
+	authentication and identity resolution (obtaining a UNIX UID/GID)
+	using the specific systems shown.
+	</para>
+
+	<image id="chap7idres">
+		<imagedescription>Samba and Authentication Backend Search Pathways</imagedescription>
+		<imagefile scale="55">chap7-idresol</imagefile>
+	</image>
+
+	<para>
+	<indexterm><primary>smbpasswd</primary></indexterm>
+	<indexterm><primary>xmlsam</primary></indexterm>
+	<indexterm><primary>SMB passwords</primary></indexterm>
+	<indexterm><primary>tdbsam</primary></indexterm>
+	<indexterm><primary>mysqlsam</primary></indexterm>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>distributed</primary></indexterm>
+	Samba is capable of using the <constant>smbpasswd</constant>,
+	<constant>tdbsam</constant>, <constant>xmlsam</constant>,
+	and <constant>mysqlsam</constant> authentication databases. The SMB
+	passwords can, of course, also be stored in an LDAP ldapsam
+	backend. LDAP is the preferred passdb backend for distributed network
+	operations.
+	</para>
+
+	<para>
+	<indexterm><primary>passdb backend</primary></indexterm>
+	Additionally, it is possible to use multiple passdb backends
+	concurrently as well as have multiple LDAP backends. As a result, you
+	can specify a failover LDAP backend. The syntax for specifying a
+	single LDAP backend in &smb.conf; is:
+<screen>
+...
+passdb backend = ldapsam:ldap://master.abmas.biz
+...
+</screen>
+	This configuration tells Samba to use a single LDAP server, as shown in <link linkend="ch7singleLDAP"/>.
+	<image id="ch7singleLDAP">
+		<imagedescription>Samba Configuration to Use a Single LDAP Server</imagedescription>
+		<imagefile scale="65">ch7-singleLDAP</imagefile>
+	</image>
+	<indexterm><primary>LDAP</primary><secondary>fail-over</secondary></indexterm>
+	<indexterm><primary>fail-over</primary></indexterm>
+	The addition of a failover LDAP server can simply be done by adding a
+	second entry for the failover server to the single <parameter>ldapsam</parameter>
+	entry, as shown here (note the particular use of the double quotes):
+<screen>
+...
+passdb backend = ldapsam:"ldap://master.abmas.biz \
+	                  ldap://slave.abmas.biz"
+...
+</screen>
+	This configuration tells Samba to use a master LDAP server, with failover to a slave server if necessary,
+	as shown in <link linkend="ch7dualLDAP"/>.
+	<image id="ch7dualLDAP">
+		<imagedescription>Samba Configuration to Use a Dual (Fail-over) LDAP Server</imagedescription>
+		<imagefile scale="65">ch7-fail-overLDAP</imagefile>
+	</image>
+	</para>
+
+	<para>
+	Some folks have tried to implement this without the use of double quotes. This is the type of entry they
+	created:
+<screen>
+...
+passdb backend = ldapsam:ldap://master.abmas.biz \
+                 ldapsam:ldap://slave.abmas.biz
+...
+</screen>
+	<indexterm><primary>contiguous directory</primary></indexterm>
+	The effect of this style of entry is that Samba lists the users
+	that are in both LDAP databases. If both contain the same information,
+	it results in each record being shown twice. This is, of course, not the
+	solution desired for a failover implementation. The net effect of this
+	configuration is shown in <link linkend="ch7dualadd"/>
+	</para>
+
+	<image id="ch7dualadd">
+		<imagedescription>Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</imagedescription>
+		<imagefile scale="55">ch7-dual-additive-LDAP</imagefile>
+	</image>
+
+	<para>
+	If, however, each LDAP database contains unique information, this may 
+	well be an advantageous way to effectively integrate multiple LDAP databases 
+	into one seemingly contiguous directory. Only the first database will be updated.
+	An example of this configuration is shown in <link linkend="ch7dualok"/>.
+	</para>
+
+	<image id="ch7dualok">
+		<imagedescription>Samba Configuration to Use Two LDAP Databases - The result is additive.</imagedescription>
+		<imagefile scale="55">ch7-dual-additive-LDAP-Ok</imagefile>
+	</image>
+
+	<note><para>
+	When the use of ldapsam is specified twice, as shown here, it is imperative
+	that the two LDAP directories must be disjoint. If the entries are for a
+	master LDAP server as well as its own slave server, updates to the LDAP
+	database may end up being lost or corrupted. You may safely use multiple
+	LDAP backends only if both are entirely separate from each other.
+	</para></note>
+
+    <para>
+	It is assumed that the network you are working with follows in a
+	pattern similar to what was covered in <link linkend="happy"/>. The following steps
+    permit the operation of a master/slave OpenLDAP arrangement.
+	</para>
+
+	<procedure>
+	<title>Implementation Steps for an LDAP Slave Server</title>
+
+		<step><para>
+	    <indexterm><primary>SUSE Linux</primary></indexterm>
+		<indexterm><primary>Red Hat Linux</primary></indexterm>
+		Log onto the master LDAP server as <constant>root</constant>.
+		You are about to change the configuration of the LDAP server, so it
+		makes sense to temporarily halt it. Stop OpenLDAP from running on 
+		SUSE Linux by executing:
+<screen>
+&rootprompt; rcldap stop
+</screen>
+		On Red Hat Linux, you can do this by executing:
+<screen>
+&rootprompt; service ldap stop
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/openldap/slapd.conf</primary></indexterm>
+		Edit the <filename>/etc/openldap/slapd.conf</filename> file so it
+		matches the content of <link linkend="ch7-LDAP-master"/>.
+		</para></step>
+
+		<step><para>
+		Create a file called <filename>admin-accts.ldif</filename> with the following contents:
+<screen>
+dn: cn=updateuser,dc=abmas,dc=biz
+objectClass: person
+cn: updateuser
+sn: updateuser
+userPassword: not24get
+
+dn: cn=sambaadmin,dc=abmas,dc=biz
+objectClass: person
+cn: sambaadmin
+sn: sambaadmin
+userPassword: buttercup
+</screen>
+		</para></step>
+
+		<step><para>
+		Add an account called <quote>updateuser</quote> to the master LDAP server as shown here:
+<screen>
+&rootprompt; slapadd -v -l admin-accts.ldif
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>LDIF</primary></indexterm>
+		<indexterm><primary>LDAP</primary><secondary>preload</secondary></indexterm>
+		Change directory to a suitable place to dump the contents of the
+		LDAP server. The dump file (and LDIF file) is used to preload
+		the slave LDAP server database. You can dump the database by executing:
+<screen>
+&rootprompt; slapcat -v -l LDAP-transfer-LDIF.txt
+</screen>
+		Each record is written to the file.	
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>LDAP-transfer-LDIF.txt</primary></indexterm>
+		Copy the file <filename>LDAP-transfer-LDIF.txt</filename> to the intended
+		slave LDAP server. A good location could be in the directory 
+		<filename>/etc/openldap/preload</filename>.
+		</para></step>
+
+		<step><para>
+		Log onto the slave LDAP server as <constant>root</constant>. You can
+		now configure this server so the <filename>/etc/openldap/slapd.conf</filename>
+		file matches the content of <link linkend="ch7-LDAP-slave"/>.
+		</para></step>
+
+		<step><para>
+		Change directory to the location in which you stored the 
+		<filename>LDAP-transfer-LDIF.txt</filename> file (<filename>/etc/openldap/preload</filename>).
+		While in this directory, execute:
+<screen>
+&rootprompt; slapadd -v -l LDAP-transfer-LDIF.txt
+</screen>
+		If all goes well, the following output confirms that the data is being loaded
+		as intended:
+<screen>
+added: "dc=abmas,dc=biz" (00000001)
+added: "cn=sambaadmin,dc=abmas,dc=biz" (00000002)
+added: "cn=updateuser,dc=abmas,dc=biz" (00000003)
+added: "ou=People,dc=abmas,dc=biz" (00000004)
+added: "ou=Groups,dc=abmas,dc=biz" (00000005)
+added: "ou=Computers,dc=abmas,dc=biz" (00000006)
+added: "uid=Administrator,ou=People,dc=abmas,dc=biz" (00000007)
+added: "uid=nobody,ou=People,dc=abmas,dc=biz" (00000008)
+added: "cn=Domain Admins,ou=Groups,dc=abmas,dc=biz" (00000009)
+added: "cn=Domain Users,ou=Groups,dc=abmas,dc=biz" (0000000a)
+added: "cn=Domain Guests,ou=Groups,dc=abmas,dc=biz" (0000000b)
+added: "uid=bobj,ou=People,dc=abmas,dc=biz" (0000000c)
+added: "sambaDomainName=MEGANET2,dc=abmas,dc=biz" (0000000d)
+added: "uid=stans,ou=People,dc=abmas,dc=biz" (0000000e)
+added: "uid=chrisr,ou=People,dc=abmas,dc=biz" (0000000f)
+added: "uid=maryv,ou=People,dc=abmas,dc=biz" (00000010)
+added: "cn=Accounts,ou=Groups,dc=abmas,dc=biz" (00000011)
+added: "cn=Finances,ou=Groups,dc=abmas,dc=biz" (00000012)
+added: "cn=PIOps,ou=Groups,dc=abmas,dc=biz" (00000013)
+</screen>
+		</para></step>
+
+		<step><para>
+		Now start the LDAP server and set it to run automatically on system reboot by executing:
+<screen>
+&rootprompt; rcldap start
+&rootprompt; chkconfig ldap on
+</screen>
+		On Red Hat Linux, execute the following:
+<screen>
+&rootprompt; service ldap start
+&rootprompt; chkconfig ldap on
+</screen>
+		</para></step>
+
+		<step><para>
+	    <indexterm><primary>chkconfig</primary></indexterm>
+		<indexterm><primary>service</primary></indexterm>
+		<indexterm><primary>rcldap</primary></indexterm>
+		Go back to the master LDAP server. Execute the following to start LDAP as well
+		as <command>slurpd</command>, the synchronization daemon, as shown here:
+<screen>
+&rootprompt; rcldap start
+&rootprompt; chkconfig ldap on
+&rootprompt; rcslurpd start
+&rootprompt; chkconfig slurpd on
+</screen>
+	    <indexterm><primary>slurpd</primary></indexterm>
+		On Red Hat Linux, check the equivalent command to start <command>slurpd</command>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>smbldap-useradd</primary></indexterm>
+		On the master LDAP server you may now add an account to validate that replication
+		is working. Assuming the configuration shown in <link linkend="happy"/>, execute:
+<screen>
+&rootprompt; /var/lib/samba/sbin/smbldap-useradd -a fruitloop
+</screen>
+		</para></step>
+
+		<step><para>
+		On the slave LDAP server, change to the directory <filename>/var/lib/ldap</filename>.
+		There should now be a file called <filename>replogfile</filename>. If replication worked
+		as expected, the content of this file should be:
+<screen>
+time: 1072486403
+dn: uid=fruitloop,ou=People,dc=abmas,dc=biz
+changetype: modify
+replace: sambaProfilePath
+sambaProfilePath: \\MASSIVE\profiles\fruitloop
+-
+replace: sambaHomePath
+sambaHomePath: \\MASSIVE\homes
+-
+replace: entryCSN
+entryCSN: 2003122700:43:38Z#0x0005#0#0000
+-
+replace: modifiersName
+modifiersName: cn=Manager,dc=abmas,dc=biz
+-
+replace: modifyTimestamp
+modifyTimestamp: 20031227004338Z
+-
+</screen>
+		</para></step>
+
+		<step><para>
+		Given that this first slave LDAP server is now working correctly, you may now
+		implement additional slave LDAP servers as required.
+		</para></step>
+
+	</procedure>
+
+<example id="ch7-LDAP-master">
+<title>LDAP Master Server Configuration File &smbmdash; <filename>/etc/openldap/slapd.conf</filename></title>
+<screen>
+include     /etc/openldap/schema/core.schema
+include     /etc/openldap/schema/cosine.schema
+include     /etc/openldap/schema/inetorgperson.schema
+include     /etc/openldap/schema/nis.schema
+include     /etc/openldap/schema/samba.schema
+
+pidfile     /var/run/slapd/slapd.pid
+argsfile    /var/run/slapd/slapd.args
+
+database    bdb
+suffix      "dc=abmas,dc=biz"
+rootdn      "cn=Manager,dc=abmas,dc=biz"
+
+# rootpw = not24get
+rootpw      {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
+
+replica     host=lapdc.abmas.biz:389
+            suffix="dc=abmas,dc=biz"
+            binddn="cn=updateuser,dc=abmas,dc=biz"
+            bindmethod=simple credentials=not24get
+
+access to attrs=sambaLMPassword,sambaNTPassword
+           by dn="cn=updateuser,dc=abmas,dc=biz" write
+           by * none
+
+replogfile  /var/lib/ldap/replogfile
+
+directory   /var/lib/ldap
+
+# Indices to maintain
+index objectClass           eq
+index cn                    pres,sub,eq
+index sn                    pres,sub,eq
+index uid                   pres,sub,eq
+index displayName           pres,sub,eq
+index uidNumber             eq
+index gidNumber             eq
+index memberUID             eq
+index sambaSID              eq
+index sambaPrimaryGroupSID  eq
+index sambaDomainName       eq
+index default               sub
+</screen>
+</example>
+
+<example id="ch7-LDAP-slave">
+<title>LDAP Slave Configuration File &smbmdash; <filename>/etc/openldap/slapd.conf</filename></title>
+<screen>
+include     /etc/openldap/schema/core.schema
+include     /etc/openldap/schema/cosine.schema
+include     /etc/openldap/schema/inetorgperson.schema
+include     /etc/openldap/schema/nis.schema
+include     /etc/openldap/schema/samba.schema
+
+pidfile     /var/run/slapd/slapd.pid
+argsfile    /var/run/slapd/slapd.args
+
+database    bdb
+suffix      "dc=abmas,dc=biz"
+rootdn      "cn=Manager,dc=abmas,dc=biz"
+
+# rootpw = not24get
+rootpw      {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
+
+access to *
+            by dn=cn=updateuser,dc=abmas,dc=biz write
+            by * read
+
+updatedn    cn=updateuser,dc=abmas,dc=biz
+updateref   ldap://massive.abmas.biz
+
+directory   /var/lib/ldap
+
+# Indices to maintain
+index objectClass           eq
+index cn                    pres,sub,eq
+index sn                    pres,sub,eq
+index uid                   pres,sub,eq
+index displayName           pres,sub,eq
+index uidNumber             eq
+index gidNumber             eq
+index memberUID             eq
+index sambaSID              eq
+index sambaPrimaryGroupSID  eq
+index sambaDomainName       eq
+index default               sub
+</screen>
+</example>
+
+<smbconfexample id="ch7-massmbconfA">
+<title>Primary Domain Controller &smb.conf; File &smbmdash; Part A</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="unix charset">LOCALE</smbconfoption>
+<smbconfoption name="workgroup">MEGANET2</smbconfoption>
+<smbconfoption name="passdb backend">ldapsam:ldap://massive.abmas.biz</smbconfoption>
+<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+<smbconfoption name="log level">1</smbconfoption>
+<smbconfoption name="syslog">0</smbconfoption>
+<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+<smbconfoption name="max log size">0</smbconfoption>
+<smbconfoption name="smb ports">139 445</smbconfoption>
+<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+<smbconfoption name="time server">Yes</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="add user script">/opt/IDEALX/sbin/smbldap-useradd -m '%u'</smbconfoption>
+<smbconfoption name="delete user script">/opt/IDEALX/sbin/smbldap-userdel '%u'</smbconfoption>
+<smbconfoption name="add group script">/opt/IDEALX/sbin/smbldap-groupadd -p '%g'</smbconfoption>
+<smbconfoption name="delete group script">/opt/IDEALX/sbin/smbldap-groupdel '%g'</smbconfoption>
+<smbconfoption name="add user to group script">/opt/IDEALX/sbin/</smbconfoption>
+<member><parameter>smbldap-groupmod -m '%g' '%u'</parameter></member>
+<smbconfoption name="delete user from group script">/opt/IDEALX/sbin/</smbconfoption>
+<member><parameter>smbldap-groupmod -x '%g' '%u'</parameter></member>
+<smbconfoption name="set primary group script">/opt/IDEALX/sbin/</smbconfoption>
+<member><parameter>smbldap-usermod -g '%g' '%u'</parameter></member>
+<smbconfoption name="add machine script">/opt/IDEALX/sbin/</smbconfoption>
+<member><parameter>smbldap-useradd -w '%u'</parameter></member>
+<smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
+<smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
+<smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
+<smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption>
+<smbconfoption name="logon drive">X:</smbconfoption>
+<smbconfoption name="domain logons">Yes</smbconfoption>
+<smbconfoption name="domain master">Yes</smbconfoption>
+<smbconfoption name="wins support">Yes</smbconfoption>
+<smbconfoption name="ldap suffix">dc=abmas,dc=biz</smbconfoption>
+<smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
+<smbconfoption name="ldap user suffix">ou=People</smbconfoption>
+<smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
+<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
+<smbconfoption name="ldap admin dn">cn=Manager,dc=abmas,dc=biz</smbconfoption>
+<smbconfoption name="idmap backend">ldap://massive.abmas.biz</smbconfoption>
+<smbconfoption name="idmap uid">10000-20000</smbconfoption>
+<smbconfoption name="idmap gid">10000-20000</smbconfoption>
+<smbconfoption name="printer admin">root</smbconfoption>
+<smbconfoption name="printing">cups</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="ch7-massmbconfB">
+<title>Primary Domain Controller &smb.conf; File &smbmdash; Part B</title>
+<smbconfsection name="[IPC$]"/>
+<smbconfoption name="path">/tmp</smbconfoption>
+
+<smbconfsection name="[accounts]"/>
+<smbconfoption name="comment">Accounting Files</smbconfoption>
+<smbconfoption name="path">/data/accounts</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[service]"/>
+<smbconfoption name="comment">Financial Services Files</smbconfoption>
+<smbconfoption name="path">/data/service</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[pidata]"/>
+<smbconfoption name="comment">Property Insurance Files</smbconfoption>
+<smbconfoption name="path">/data/pidata</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[homes]"/>
+<smbconfoption name="comment">Home Directories</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">SMB Print Spool</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="ch7-massmbconfC">
+<title>Primary Domain Controller &smb.conf; File &smbmdash; Part C</title>
+<smbconfsection name="[apps]"/>
+<smbconfoption name="comment">Application Files</smbconfoption>
+<smbconfoption name="path">/apps</smbconfoption>
+<smbconfoption name="admin users">bjones</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[netlogon]"/>
+<smbconfoption name="comment">Network Logon Service</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
+<smbconfoption name="admin users">root, Administrator</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="locking">No</smbconfoption>
+
+<smbconfsection name="[profiles]"/>
+<smbconfoption name="comment">Profile Share</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="profile acls">Yes</smbconfoption>
+
+<smbconfsection name="[profdata]"/>
+<smbconfoption name="comment">Profile Data Share</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/profdata</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="profile acls">Yes</smbconfoption>
+
+<smbconfsection name="[print$]"/>
+<smbconfoption name="comment">Printer Drivers</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
+<smbconfoption name="write list">root</smbconfoption>
+<smbconfoption name="admin users">root, Administrator</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="ch7-slvsmbocnfA">
+<title>Backup Domain Controller &smb.conf; File &smbmdash; Part A</title>
+<smbconfcomment># Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="unix charset">LOCALE</smbconfoption>
+<smbconfoption name="workgroup">MEGANET2</smbconfoption>
+<smbconfoption name="netbios name">BLDG1</smbconfoption>
+<smbconfoption name="passdb backend">ldapsam:ldap://lapdc.abmas.biz</smbconfoption>
+<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+<smbconfoption name="log level">1</smbconfoption>
+<smbconfoption name="syslog">0</smbconfoption>
+<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+<smbconfoption name="max log size">50</smbconfoption>
+<smbconfoption name="smb ports">139 445</smbconfoption>
+<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="show add printer wizard">No</smbconfoption>
+<smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
+<smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption>
+<smbconfoption name="logon drive">X:</smbconfoption>
+<smbconfoption name="domain logons">Yes</smbconfoption>
+<smbconfoption name="os level">63</smbconfoption>
+<smbconfoption name="domain master">No</smbconfoption>
+<smbconfoption name="wins server">192.168.2.1</smbconfoption>
+<smbconfoption name="ldap suffix">dc=abmas,dc=biz</smbconfoption>
+<smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
+<smbconfoption name="ldap user suffix">ou=People</smbconfoption>
+<smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
+<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
+<smbconfoption name="ldap admin dn">cn=Manager,dc=abmas,dc=biz</smbconfoption>
+<smbconfoption name="utmp">Yes</smbconfoption>
+<smbconfoption name="idmap backend">ldap://massive.abmas.biz</smbconfoption>
+<smbconfoption name="idmap uid">10000-20000</smbconfoption>
+<smbconfoption name="idmap gid">10000-20000</smbconfoption>
+<smbconfoption name="printing">cups</smbconfoption>
+
+<smbconfsection name="[accounts]"/>
+<smbconfoption name="comment">Accounting Files</smbconfoption>
+<smbconfoption name="path">/data/accounts</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[service]"/>
+<smbconfoption name="comment">Financial Services Files</smbconfoption>
+<smbconfoption name="path">/data/service</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="ch7-slvsmbocnfB">
+<title>Backup Domain Controller &smb.conf; File &smbmdash; Part B</title>
+<smbconfsection name="[pidata]"/>
+<smbconfoption name="comment">Property Insurance Files</smbconfoption>
+<smbconfoption name="path">/data/pidata</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[homes]"/>
+<smbconfoption name="comment">Home Directories</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">SMB Print Spool</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[apps]"/>
+<smbconfoption name="comment">Application Files</smbconfoption>
+<smbconfoption name="path">/apps</smbconfoption>
+<smbconfoption name="admin users">bjones</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[netlogon]"/>
+<smbconfoption name="comment">Network Logon Service</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="locking">No</smbconfoption>
+
+<smbconfsection name="[profiles]"/>
+<smbconfoption name="comment">Profile Share</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="profile acls">Yes</smbconfoption>
+
+<smbconfsection name="[profdata]"/>
+<smbconfoption name="comment">Profile Data Share</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/profdata</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="profile acls">Yes</smbconfoption>
+</smbconfexample>
+
+	<sect2>
+		<title>Key Points Learned</title>
+
+		<itemizedlist>
+			<listitem><para>
+			<indexterm><primary>LDAP</primary></indexterm><indexterm><primary>BDC</primary></indexterm>
+			Where Samba-3 is used as a domain controller, the use of LDAP is an 
+			essential component to permit the use of BDCs.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>wide-area</primary></indexterm>
+			Replication of the LDAP master server to create a network of BDCs
+			is an important mechanism for limiting WAN traffic.
+			</para></listitem>
+
+			<listitem><para>
+			Network administration presents many complex challenges, most of which
+			can be satisfied by good design but that also require sound communication
+			and unification of management practices. This can be highly challenging in
+			a large, globally distributed network.
+			</para></listitem>
+
+			<listitem><para>
+			Roaming profiles must be contained to the local network segment. Any
+			departure from this may clog wide-area arteries and slow legitimate network
+			traffic to a crawl.
+			</para></listitem>
+		</itemizedlist>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Questions and Answers</title>
+
+	<para>
+	There is much rumor and misinformation regarding the use of MS Windows networking protocols.
+	These questions are just a few of those frequently asked.
+	</para>
+
+	<qandaset defaultlabel="chap07qa">
+	<qandaentry>
+	<question>
+
+	    <para>
+		<indexterm><primary>DHCP</primary></indexterm>
+		<indexterm><primary>network</primary><secondary>bandwidth</secondary></indexterm>
+		Is it true that DHCP uses lots of WAN bandwidth?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para>
+		<indexterm><primary>DHCP</primary><secondary>Relay Agent</secondary></indexterm>
+		<indexterm><primary>routers</primary></indexterm>
+		<indexterm><primary>DHCP</primary><secondary>servers</secondary></indexterm>
+		It is a smart practice to localize DHCP servers on each network segment. As a 
+		rule, there should be two DHCP servers per network segment. This means that if
+		one server fails, there is always another to service user needs. DHCP requests use
+		only UDP broadcast protocols. It is possible to run a DHCP Relay Agent on network
+		routers. This makes it possible to run fewer DHCP servers.
+		</para>
+
+	    <para>
+		<indexterm><primary>DHCP</primary><secondary>request</secondary></indexterm>
+		<indexterm><primary>DHCP</primary><secondary>traffic</secondary></indexterm>
+		A DHCP network address request and confirmation usually results in about six UDP packets.
+		The packets are from 60 to 568 bytes in length. Let us consider a site that has 300 DHCP
+		clients and that uses a 24-hour IP address lease. This means that all clients renew
+		their IP address lease every 24 hours. If we assume an average packet length equal to the
+		maximum (just to be on the safe side), and we have a 128 Kb/sec wide-area connection, 
+		how significant would the DHCP traffic be if all of it were to use DHCP Relay?
+		</para>
+
+		<para>
+		I must stress that this is a bad design, but here is the calculation:
+<screen>
+Daily Network Capacity: 128,000 (Kbits/s) / 8 (bits/byte) 
+                             x 3600 (sec/hr) x 24 (hrs/day)= 2288 Mbytes/day.
+
+DHCP traffic:          300 (clients) x 6 (packets) 
+                                       x 512 (bytes/packet) = 0.9 Mbytes/day.
+</screen>
+		From this can be seen that the traffic impact would be minimal.
+		</para>
+
+	    <para>
+		<indexterm><primary>DNS</primary><secondary>Dynamic</secondary></indexterm>
+		<indexterm><primary>DHCP</primary></indexterm>
+		Even when DHCP is configured to do DNS update (dynamic DNS) over a wide-area link,
+		the impact of the update is no more than the DHCP IP address renewal traffic and thus
+		still insignificant for most practical purposes.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para>
+		<indexterm><primary>background communication</primary></indexterm>
+		<indexterm><primary>LDAP</primary><secondary>master/slave</secondary><tertiary>background communication</tertiary></indexterm>
+		How much background communication takes place between a master LDAP server and its slave LDAP servers?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para>
+		<indexterm><primary>slurpd</primary></indexterm>
+		The process that controls the replication of data from the master LDAP server to the slave LDAP
+		servers is called <command>slurpd</command>. The <command>slurpd</command> remains nascent (quiet)
+		until an update must be propagated. The propagation traffic per LDAP slave to update (add/modify/delete)
+		two user accounts requires less than 10KB traffic.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		LDAP has a database. Is LDAP not just a fancy database front end?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para>
+		<indexterm><primary>database</primary></indexterm>
+		<indexterm><primary>LDAP</primary><secondary>database</secondary></indexterm>
+		<indexterm><primary>SQL</primary></indexterm>
+		<indexterm><primary>transactional</primary></indexterm>
+		LDAP does store its data in a database of sorts. In fact, the LDAP backend is an application-specific
+		data storage system. This type of database is indexed so that records can be rapidly located, but the
+		database is not generic and can be used only in particular pre-programmed ways. General external
+		applications do not gain access to the data. This type of database is used also by SQL servers. Both
+		an SQL server and an LDAP server provide ways to access the data. An SQL server has a transactional
+		orientation and typically allows external programs to perform ad hoc queries, even across data tables.
+		An LDAP front end is a purpose-built tool that has a search orientation that is designed around specific
+		simple queries. The term <constant>database</constant> is heavily overloaded and thus much misunderstood.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para>
+		<indexterm><primary>OpenLDAP</primary></indexterm>
+		Can Active Directory obtain account information from an OpenLDAP server?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para>
+		<indexterm><primary>meta-directory</primary></indexterm>
+		No, at least not directly. It is possible to provision Active Directory from and/or to an OpenLDAP
+		database through use of a metadirectory server. Microsoft MMS (now called MIIS) can interface
+		to OpenLDAP using standard LDAP queries and updates. 
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What are the parts of a roaming profile? How large is each part?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>roaming profile</primary>
+	      </indexterm>
+		A roaming profile consists of
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			Desktop folders such as <constant>Desktop</constant>, <constant>My Documents</constant>,
+			<constant>My Pictures</constant>, <constant>My Music</constant>, <constant>Internet Files</constant>,
+			<constant>Cookies</constant>, <constant>Application Data</constant>,
+			<constant>Local Settings,</constant> and more. See <link linkend="happy"/>, <link linkend="XP-screen001"/>.
+			</para>
+
+			<para>
+			<indexterm><primary>folder redirection</primary></indexterm>
+			Each of these can be anywhere from a few bytes to gigabytes in capacity. Fortunately, all
+			such folders can be redirected to network drive resources. See <link linkend="redirfold"/>
+			for more information regarding folder redirection.
+			</para></listitem>
+
+			<listitem><para>
+			A static or rewritable portion that is typically only a few files (2-5 KB of information).
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>NTUSER.DAT</primary></indexterm>
+			<indexterm><primary>HKEY_LOCAL_USER</primary></indexterm>
+			The registry load file that modifies the <constant>HKEY_LOCAL_USER</constant> hive. This is
+			the <filename>NTUSER.DAT</filename> file. It can be from 0.4 to 1.5 MB.
+			</para></listitem>
+		</itemizedlist>
+
+	    <para>
+		<indexterm><primary>Microsoft Outlook</primary><secondary>PST files</secondary></indexterm>
+		Microsoft Outlook PST files may be stored in the <constant>Local Settings\Application Data</constant>
+		folder. It can be up to 2 GB in size per PST file.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Can the <constant>My Documents</constant> folder be stored on a network drive?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para>
+		<indexterm><primary>UNC name</primary></indexterm>
+		<indexterm><primary>Universal Naming Convention</primary><see>UNC name</see></indexterm>
+		Yes. More correctly, such folders can be redirected to network shares. No specific network drive
+		connection is required. Registry settings permit this to be redirected directly to a UNC (Universal
+		Naming Convention) resource, though it is possible to specify a network drive letter instead of a
+		UNC name. See <link linkend="redirfold"/>.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para>
+		<indexterm><primary>wide-area</primary></indexterm>
+		<indexterm><primary>network</primary><secondary>bandwidth</secondary></indexterm>
+		<indexterm><primary>WINS</primary></indexterm>
+		How much WAN bandwidth does WINS consume?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para>
+		<indexterm><primary>NetBIOS</primary><secondary>name cache</secondary></indexterm>
+		<indexterm><primary>WINS server</primary></indexterm>
+		<indexterm><primary>domain replication</primary></indexterm>
+		MS Windows clients cache information obtained from WINS lookups in a local NetBIOS name cache.
+		This keeps WINS lookups to a minimum. On a network with 3500 MS Windows clients and a central WINS
+		server, the total bandwidth demand measured at the WINS server, averaged over an 8-hour working day,
+		was less than 30 KB/sec. Analysis of network traffic over a 6-week period showed that the total
+		of all background traffic consumed about 11 percent of available bandwidth over 64 Kb/sec links.
+		Background traffic consisted of domain replication, WINS queries, DNS lookups, and authentication
+		traffic. Each of 11 branch offices had a 64 Kb/sec wide-area link, with a 1.5 Mb/sec main connection
+		that aggregated the branch office connections plus an Internet connection.
+		</para>
+
+		<para>
+		In conclusion, the total load afforded through WINS traffic is again marginal to total operational
+		usage &smbmdash; as it should be.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		How many BDCs should I have? What is the right number of Windows clients per server?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		It is recommended to have at least one BDC per network segment, including the segment served
+		by the PDC. Actual requirements vary depending on the working load on each of the BDCs and the
+		load demand pattern of client usage. I have seen sites that function without problem with 200
+		clients served by one BDC, and yet other sites that had one BDC per 20 clients. In one particular
+		company, there was a drafting office that had 30 CAD/CAM operators served by one server, a print
+		server; and an application server. While all three were BDCs, typically only the print server would
+		service network logon requests after the first 10 users had started to use the network. This was
+		a reflection of the service load placed on both the application server and the data server.
+		</para>
+
+		<para>
+		As unsatisfactory as the answer might sound, it all depends on network and server load
+		characteristics.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para>
+		<indexterm><primary>NIS server</primary></indexterm><indexterm><primary>LDAP</primary></indexterm>
+		I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to
+		run an NIS server?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The correct answer to both questions is yes. But do understand that an LDAP server has
+		a configurable schema that can store far more information for many more purposes than
+		just NIS.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Can I use NIS in place of LDAP?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para>
+		<indexterm><primary>NIS</primary></indexterm>
+		<indexterm><primary>NIS schema</primary></indexterm>
+		No. The NIS database does not have provision to store Microsoft encrypted passwords and does not deal
+		with the types of data necessary for interoperability with Microsoft Windows networking. The use
+		of LDAP with Samba requires the use of a number of schemas, one of which is the NIS schema, but also
+		a Samba-specific schema extension.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	</qandaset>
+
+</sect1>
+
+</chapter>
+
diff --git a/docs/Samba3-ByExample/SBE-500UserNetwork.xml b/docs/Samba3-ByExample/SBE-500UserNetwork.xml
new file mode 100644
index 0000000000..11bd09ac04
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-500UserNetwork.xml
@@ -0,0 +1,2004 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="Big500users">
+  <title>The 500-User Office</title>
+
+	<para>
+	The Samba-3 networking you explored in <link linkend="secure"/> covers the finer points of 
+	configuration of peripheral services such as DHCP and DNS, and WINS. You experienced
+	implementation of a simple configuration of the services that are important adjuncts 
+	to successful deployment of Samba. 
+	</para>
+
+	<para>
+	An analysis of the history of postings to the Samba mailing list easily demonstrates 
+	that the two most prevalent Samba problem areas are
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		Defective resolution of a NetBIOS name to its IP address
+		</para></listitem>
+
+		<listitem><para>
+		Printing problems
+		</para></listitem>
+
+	</itemizedlist>
+
+	<para>
+	The exercises
+	so far in this book have focused on implementation of the simplest printing processes
+	involving  no print job processing intelligence. In this chapter, you maintain 
+	that same approach to printing, but <link linkend="happy"/> presents an opportunity 
+	to make printing more complex for the administrator while making it easier for the user.
+	</para>
+
+	<para>
+	<indexterm><primary>WINS server</primary></indexterm>
+	<indexterm><primary>tdbsam</primary></indexterm>
+	<indexterm><primary>passdb backend</primary></indexterm>
+	<link linkend="secure"/> demonstrates operation of a DHCP server and a DNS server 
+	as well as a central WINS server. You validated the operation of these services and
+	saw an effective implementation of a Samba domain controller using the 
+	<parameter>tdbsam</parameter> passdb backend.
+	</para>
+
+	<para>
+	The objective of this chapter is to introduce more complex techniques that can be used to
+	improve manageability of Samba as networking needs grow. In this chapter, you implement
+	a distributed DHCP server environment, a distributed DNS server arrangement, a centralized
+	WINS server, and a centralized Samba domain controller.
+	</para>
+
+	<para>
+	A note of caution is important regarding the Samba configuration that is used in this
+	chapter. The use of a single domain controller on a routed, multisegment network is 
+	a poor design choice that leads to potential network user complaints. 
+	This chapter demonstrates some successful 
+	techniques in deployment and configuration management. This should be viewed as a 
+	foundation chapter for complex Samba deployments.
+	</para>
+
+	<para>
+	As you master the techniques presented here, you may find much better methods to 
+	improve network management and control while reducing human resource overheads.
+	You should take the opportunity to innovate and expand on the methods presented 
+	here and explore them to the fullest.
+	</para>
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>
+	Business continues to go well for Abmas. Mr. Meany is driving your success and the
+	network continues to grow thanks to the hard work Christine has done. You recently
+	hired Stanley Soroka as manager of information systems. Christine recommended Stan
+	to the role. She told you Stan is so good at handling Samba that he can make a cast
+	iron rocking horse that is embedded in concrete kick like a horse at a rodeo. You
+	need skills like his. Christine and Stan get along just fine. Let's see what 
+	you can get out of this pair as they plot the next-generation networks.
+	</para>
+
+	<para>
+	Ten months ago Abmas closed an acquisition of a property insurance business. The
+	founder lost interest in the business and decided to sell it to Mr. Meany.  Because
+	they were former university classmates, the purchase was concluded with mutual assent.
+	The acquired business is located at the other end of town in much larger facilities.
+	The old Abmas building has become too small. Located on the same campus as the newly
+	acquired business are two empty buildings that are ideal to provide Abmas with
+	opportunity for growth.
+	</para>
+
+	<para>
+	Abmas has now completed the purchase of the two empty buildings, and you are
+	to install a new network and relocate staff in nicely furnished new facilities.
+	The new network is to be used to fully integrate company operations. You have
+	decided to locate the new network operations control center in the larger building
+	in which the insurance group is located to take advantage of an ideal floor space
+	and to allow Stan and Christine to fully stage the new network and test it before
+	it is rolled out. Your strategy is to complete the new network so that it
+	is ready for operation when the old office moves into the new premises.
+	</para>
+
+	<sect2>
+		<title>Assignment Tasks</title>
+
+		<para>
+		The acquired business had 280 network users. The old Abmas building housed
+		220 network users in unbelievably cramped conditions. The network that
+		initially served 130 users now handles 220 users quite well.
+		</para>
+
+		<para>
+		The two businesses will be fully merged to create a single campus company.
+		The Property Insurance Group (PIG) houses 300 employees, the new Accounting
+		Services Group (ASG) will be in a small building (BLDG1) that houses 50 
+		employees, and the Financial Services Group (FSG) will be housed in a large
+		building that has capacity for growth (BLDG2). Building 2 houses 150 network
+		users.
+		</para>
+
+		<para>
+		You have decided to connect the building using fiber optic links between new
+		routers. As a backup, the buildings are interconnected using line-of-sight
+		high-speed infrared facilities. The infrared connection provides a
+		secondary route to be used during periods of high demand for network
+		bandwidth.
+		</para>
+
+		<para>
+		The Internet gateway is upgraded to 15 Mb/sec service. Your ISP
+		provides on your premises a fully managed Cisco PIX firewall. You no longer need
+		to worry about firewall facilities on your network.
+		</para>
+
+		<para>
+		Stanley and Christine have purchased new server hardware. Christine wants to
+		roll out a network that has whistles and bells. Stan wants to start off with
+		a simple to manage, not-too-complex network. He believes that network
+		users need to be gradually introduced to new features and capabilities and not
+		rushed into an environment that may cause disorientation and loss of productivity.
+		</para>
+
+		<para>
+		Your intrepid network team has decided to implement a network configuration
+		that closely mirrors the successful system you installed in the old Abmas building.
+		The new network infrastructure is owned by Abmas, but all desktop systems
+		are being procured through a new out-source services and leasing company. Under
+		the terms of a deal with Mr. M. Proper (CEO), DirectPointe, Inc., provides
+		all desktop systems and includes full level-one help desk support for 
+		a flat per-machine monthly fee. The deal allows you to add workstations on demand.
+		This frees Stan and Christine to deal with deeper issues as they emerge and 
+		permits Stan to work on creating new future value-added services.
+		</para>
+
+		<para>
+		DirectPointe Inc. receives from you a new standard desktop configuration
+		every four months. They automatically roll that out to each desktop system.
+		You must keep DirectPointe informed of all changes.
+		</para>
+
+	<para><indexterm>
+	    <primary>PDC</primary>
+	  </indexterm>
+		The new network has a single Samba Primary Domain Controller (PDC) located in the
+		Network Operation Center (NOC). Buildings 1 and 2 each have a local server
+		for local application servicing. It is a domain member. The new system
+		uses the <parameter>tdbsam</parameter> passdb backend.
+		</para>
+
+		<para>
+		Printing is based on raw pass-through facilities just as it has been used so far.
+		All printer drivers are installed on the desktop and notebook computers.
+		</para>
+
+	</sect2>
+</sect1>
+
+<sect1>
+	<title>Dissection and Discussion</title>
+
+	<para>
+	<indexterm><primary>network load factors</primary></indexterm>
+	The example you are building in this chapter is of a network design that works, but this
+	does not make it a design that is recommended. As a general rule, there should be at least
+	one Backup Domain Controller (BDC) per 150 Windows network clients. The principle behind
+	this recommendation is that correct operation of MS Windows clients requires rapid
+	network response to all SMB/CIFS requests. The same rule says that if there are more than
+	50 clients per domain controller, they are too busy to service requests. Let's put such
+	rules aside and recognize that network load affects the integrity of domain controller
+	responsiveness. This network will have 500 clients serviced by one central domain
+	controller. This is not a good omen for user satisfaction. You, of course, address this
+	very soon (see <link linkend="happy"/>).
+	</para>
+
+	<sect2>
+		<title>Technical Issues</title>
+
+		<para>
+		Stan has talked you into a horrible compromise, but it is addressed. Just make
+		certain that the performance of this network is well validated before going live.
+		</para>
+
+		<para>
+		Design decisions made in this design include the following:
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			<indexterm><primary>PDC</primary></indexterm>
+			<indexterm><primary>LDAP</primary></indexterm>
+			<indexterm><primary>identity management</primary></indexterm>
+			A single PDC is being implemented. This limitation is based on the choice not to
+			use LDAP. Many network administrators fear using LDAP because of the perceived
+			complexity of implementation and management of an LDAP-based backend for all user
+			identity management as well as to store network access credentials.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>BDC</primary></indexterm>
+			<indexterm><primary>machine secret password</primary></indexterm>
+			Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the
+			only choice that makes sense with 500 users is to use the tdbsam passwd backend. 
+			This type of backend is not receptive to replication to BDCs.  If the tdbsam
+			<filename>passdb.tdb</filename> file is replicated to BDCs using
+			<command>rsync</command>, there are two potential problems: (1) data that is in
+			memory but not yet written to disk will not be replicated, and (2) domain member
+			machines periodically change the secret machine password. When this happens, there
+			is no mechanism to return the changed password to the PDC.
+			</para></listitem>
+
+			<listitem><para>
+			All domain user, group, and machine accounts are managed on the PDC. This makes
+			for a simple mode of operation but has to be balanced with network performance and
+			integrity of operations considerations.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>WINS</primary></indexterm>
+			A single central WINS server is being used. The PDC is also the WINS server.
+			Any attempt to operate a routed network without a WINS server while using NetBIOS
+			over TCP/IP protocols does not work unless on each client the name resolution
+			entries for the PDC are added to the <filename>LMHOSTS</filename>. This file is
+			normally located on the Windows XP Professional client in the 
+			<filename>C:\WINDOWS\SYSTEM32\ETC\DRIVERS</filename> directory.
+			</para></listitem>
+
+			<listitem><para>
+			At this time the Samba WINS database cannot be replicated. That is
+			why a single WINS server is being implemented. This should work without a problem.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>winbindd</primary></indexterm>
+			BDCs make use of <command>winbindd</command> to provide
+			access to domain security credentials for file system access and object storage.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>DHCP</primary><secondary>relay</secondary></indexterm>
+			<indexterm><primary>DHCP</primary><secondary>requests</secondary></indexterm>
+			Configuration of Windows XP Professional clients is achieved using DHCP. Each
+			subnet has its own DHCP server. Backup DHCP serving is provided by one
+			alternate DHCP server. This necessitates enabling of the DHCP Relay agent on
+			all routers. The DHCP Relay agent must be programmed to pass DHCP Requests from the
+			network directed at the backup DHCP server.
+			</para></listitem>
+
+			<listitem><para>
+			All network users are granted the ability to print to any printer that is
+			network-attached. All printers are available from each server. Print jobs that
+			are spooled to a printer that is not on the local network segment are automatically
+			routed to the print spooler that is in control of that printer. The specific details
+			of how this might be done are demonstrated for one example only.
+			</para></listitem>
+
+			<listitem><para>
+			The network address and subnetmask chosen provide 1022 usable IP addresses in
+			each subnet. If in the future more addresses are required, it would make sense
+			to add further subnets rather than change addressing.
+			</para></listitem>
+
+		</itemizedlist>
+
+	</sect2>
+
+
+	<sect2>
+		<title>Political Issues</title>
+
+		<para>
+		This case gets close to the real world. You and I know the right way to implement
+		domain control. Politically, we have to navigate a minefield. In this case, the need is to
+		get the PDC rolled out in compliance with expectations and also to be ready to save the day
+		by having the real solution ready before it is needed. That real solution is presented in
+		<link linkend="happy"/>.
+		</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Implementation</title>
+
+	<para>
+	The following configuration process begins following installation of Red Hat Fedora Core2 on the
+	three servers shown in the network topology diagram in <link linkend="chap05net"/>. You have
+	selected hardware that is appropriate to the task.
+	</para>
+
+	<image id="chap05net">
+		<imagedescription>Network Topology &smbmdash; 500 User Network Using tdbsam passdb backend.</imagedescription>
+		<imagefile scale="50">chap5-net</imagefile>
+	</image>
+
+	<sect2 id="ch5-dnshcp-setup">
+	<title>Installation of DHCP, DNS, and Samba Control Files</title>
+
+	<para>
+	Carefully install the configuration files into the correct locations as shown in 
+	<link linkend="ch5-filelocations"/>. You should validate that the full file path is
+	correct as shown.
+	</para>
+
+	<para>
+	The abbreviation shown in this table as <constant>{VLN}</constant> refers to
+	the directory location beginning with <filename>/var/lib/named</filename>.
+	</para>
+
+
+	<table id="ch5-filelocations"><title>Domain: <constant>MEGANET</constant>, File Locations for Servers</title>
+		<tgroup cols="5">
+			<colspec colname='c1' align="left"/>
+			<colspec colname='c2' align="left"/>
+			<colspec colname='c3' align="center"/>
+			<colspec colname='c4' align="center"/>
+			<colspec colname='c5' align="center"/>
+			<thead>
+				<row>
+					<entry align="center" namest='c1' nameend='c2'>File Information</entry>
+					<entry align="center" namest="c3" nameend="c5">Server Name</entry>
+				</row>
+				<row>
+					<entry align="center">Source</entry>
+					<entry align="center">Target Location</entry>
+					<entry align="center">MASSIVE</entry>
+					<entry align="center">BLDG1</entry>
+					<entry align="center">BLDG2</entry>
+				</row>
+			</thead>
+			<tbody>
+				<row>
+					<entry><link linkend="ch5-massivesmb"/></entry>
+					<entry><filename>/etc/samba/smb.conf</filename></entry>
+					<entry>Yes</entry>
+					<entry>No</entry>
+					<entry>No</entry>
+				</row>
+				<row>
+					<entry><link linkend="ch5-dc-common"/></entry>
+					<entry><filename>/etc/samba/dc-common.conf</filename></entry>
+					<entry>Yes</entry>
+					<entry>No</entry>
+					<entry>No</entry>
+				</row>
+				<row>
+					<entry><link linkend="ch5-commonsmb"/></entry>
+					<entry><filename>/etc/samba/common.conf</filename></entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+				</row>
+				<row>
+					<entry><link linkend="ch5-bldg1-smb"/></entry>
+					<entry><filename>/etc/samba/smb.conf</filename></entry>
+					<entry>No</entry>
+					<entry>Yes</entry>
+					<entry>No</entry>
+				</row>
+				<row>
+					<entry><link linkend="ch5-bldg2-smb"/></entry>
+					<entry><filename>/etc/samba/smb.conf</filename></entry>
+					<entry>No</entry>
+					<entry>No</entry>
+					<entry>Yes</entry>
+				</row>
+				<row>
+					<entry><link linkend="ch5-dommem-smb"/></entry>
+					<entry><filename>/etc/samba/dommem.conf</filename></entry>
+					<entry>No</entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+				</row>
+				<row>
+					<entry><link linkend="massive-dhcp"/></entry>
+					<entry><filename>/etc/dhcpd.conf</filename></entry>
+					<entry>Yes</entry>
+					<entry>No</entry>
+					<entry>No</entry>
+				</row>
+				<row>
+					<entry><link linkend="bldg1dhcp"/></entry>
+					<entry><filename>/etc/dhcpd.conf</filename></entry>
+					<entry>No</entry>
+					<entry>Yes</entry>
+					<entry>No</entry>
+				</row>
+				<row>
+					<entry><link linkend="bldg2dhcp"/></entry>
+					<entry><filename>/etc/dhcpd.conf</filename></entry>
+					<entry>No</entry>
+					<entry>No</entry>
+					<entry>Yes</entry>
+				</row>
+				<row>
+					<entry><link linkend="massive-nameda"/></entry>
+					<entry><filename>/etc/named.conf (part A)</filename></entry>
+					<entry>Yes</entry>
+					<entry>No</entry>
+					<entry>No</entry>
+				</row>
+				<row>
+					<entry><link linkend="massive-namedb"/></entry>
+					<entry><filename>/etc/named.conf (part B)</filename></entry>
+					<entry>Yes</entry>
+					<entry>No</entry>
+					<entry>No</entry>
+				</row>
+				<row>
+					<entry><link linkend="massive-namedc"/></entry>
+					<entry><filename>/etc/named.conf (part C)</filename></entry>
+					<entry>Yes</entry>
+					<entry>No</entry>
+					<entry>No</entry>
+				</row>
+				<row>
+					<entry><link linkend="abmasbizdns"/></entry>
+					<entry><filename>{VLN}/master/abmas.biz.hosts</filename></entry>
+					<entry>Yes</entry>
+					<entry>No</entry>
+					<entry>No</entry>
+				</row>
+				<row>
+					<entry><link linkend="abmasusdns"/></entry>
+					<entry><filename>{VLN}/master/abmas.us.hosts</filename></entry>
+					<entry>Yes</entry>
+					<entry>No</entry>
+					<entry>No</entry>
+				</row>
+				<row>
+					<entry><link linkend="bldg12nameda"/></entry>
+					<entry><filename>/etc/named.conf (part A)</filename></entry>
+					<entry>No</entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+				</row>
+				<row>
+					<entry><link linkend="bldg12namedb"/></entry>
+					<entry><filename>/etc/named.conf (part B)</filename></entry>
+					<entry>No</entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+				</row>
+				<row>
+					<entry><link linkend="loopback"/></entry>
+					<entry><filename>{VLN}/localhost.zone</filename></entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+				</row>
+				<row>
+					<entry><link linkend="dnsloopy"/></entry>
+					<entry><filename>{VLN}/127.0.0.zone</filename></entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+				</row>
+				<row>
+					<entry><link linkend="roothint"/></entry>
+					<entry><filename>{VLN}/root.hint</filename></entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+					<entry>Yes</entry>
+				</row>
+			</tbody>
+		</tgroup>
+	</table>
+
+	</sect2>
+
+	<sect2>
+	<title>Server Preparation: All Servers</title>
+
+	<para>
+	The following steps apply to all servers. Follow each step carefully.
+	</para>
+
+		<procedure>
+		<title>Server Preparation Steps</title>
+
+			<step><para>
+			Using the UNIX/Linux system tools, set the name of the server as shown in the network
+			topology diagram in <link linkend="chap05net"/>. For SUSE Linux products, the tool
+			that permits this is called <command>yast2</command>; for Red Hat Linux products,
+			you can use the <command>netcfg</command> tool.
+			Verify that your hostname is correctly set by running:
+<screen>
+&rootprompt; uname -n
+</screen>
+			An alternate method to verify the hostname is:
+<screen>
+&rootprompt; hostname -f
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>/etc/hosts</primary></indexterm>
+			<indexterm><primary>named</primary></indexterm>
+			Edit your <filename>/etc/hosts</filename> file to include the primary names and addresses
+			of all network interfaces that are on the host server. This is necessary so that during
+			startup the system is able to resolve all its own names to the IP address prior to
+			startup of the DNS server. You should check the startup order of your system. If the 
+			CUPS print server is started before the DNS server (<command>named</command>), you 
+			should also include an entry for the printers in the <filename>/etc/hosts</filename> file.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>/etc/resolv.conf</primary></indexterm>
+			All DNS name resolution should be handled locally. To ensure that the server is configured
+			correctly to handle this, edit <filename>/etc/resolv.conf</filename> so it has the following
+			content:
+<screen>
+search abmas.us abmas.biz
+nameserver 127.0.0.1
+</screen>
+			This instructs the name resolver function (when configured correctly) to ask the DNS server
+			that is running locally to resolve names to addresses.
+			</para></step>
+
+
+			<step><para>
+			<indexterm><primary>administrator</primary></indexterm>
+			<indexterm><primary>smbpasswd</primary></indexterm>
+			Add the <constant>root</constant> user to the password backend:
+<screen>
+&rootprompt; smbpasswd -a root
+New SMB password: XXXXXXXX
+Retype new SMB password: XXXXXXXX
+&rootprompt;
+</screen>
+			The <constant>root</constant> account is the UNIX equivalent of the Windows domain administrator.
+			This account is essential in the regular maintenance of your Samba server. It must never be
+			deleted. If for any reason the account is deleted, you may not be able to recreate this account
+			without considerable trouble.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>username map</primary></indexterm>
+			<indexterm><primary>/etc/samba/smbusers</primary></indexterm>
+			Create the username map file to permit the <constant>root</constant> account to be called
+			<constant>Administrator</constant> from the Windows network environment. To do this, create
+			the file <filename>/etc/samba/smbusers</filename> with the following contents:
+<screen>
+####
+# User mapping file
+####
+# File Format
+# -----------
+# Unix_ID = Windows_ID
+#
+# Examples:
+# root = Administrator
+# janes = "Jane Smith"
+# jimbo = Jim Bones
+#
+# Note: If the name contains a space it must be double quoted.
+#       In the example above the name 'jimbo' will be mapped to Windows
+#       user names 'Jim' and 'Bones' because the space was not quoted.
+#######################################################################
+root = Administrator
+####
+# End of File
+####
+</screen>
+			</para></step>
+
+			<step><para>
+			Configure all network-attached printers to have a fixed IP address.
+			</para></step>
+
+			<step><para>
+			Create an entry in the DNS database on the server <constant>MASSIVE</constant>
+			in both the forward lookup database for the zone <constant>abmas.biz.hosts</constant>
+			and in the reverse lookup database for the network segment that the printer is
+			located in. Example configuration files for similar zones were presented in <link linkend="secure"/>,
+			<link linkend="abmasbiz"/> and <link linkend="eth2zone"/>.
+			</para></step>
+
+			<step><para>
+			Follow the instructions in the printer manufacturer's manuals to permit printing 
+			to port 9100.  Use any other port the manufacturer specifies for direct mode, 
+			raw printing.  This allows the CUPS spooler to print using raw mode protocols.
+			<indexterm><primary>CUPS</primary></indexterm>
+			<indexterm><primary>raw printing</primary></indexterm>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm>
+			Only on the server to which the printer is attached configure the CUPS Print 
+			Queues as follows:
+<screen>
+&rootprompt; lpadmin -p <parameter>printque</parameter> -v socket://<parameter>printer-name</parameter>.abmas.biz:9100 -E
+</screen>
+			<indexterm><primary>print filter</primary></indexterm>
+			This step creates the necessary print queue to use no assigned print filter. This
+			is ideal for raw printing, that is, printing without use of filters.
+			The name <parameter>printque</parameter> is the name you have assigned for
+			the particular printer.
+			</para></step>
+
+			<step><para>
+			Print queues may not be enabled at creation. Make certain that the queues
+			you have just created are enabled by executing the following:
+<screen>
+&rootprompt; /usr/bin/enable <parameter>printque</parameter>
+</screen>
+			</para></step>
+
+			<step><para>
+			Even though your print queue may be enabled, it is still possible that it
+			does not accept print jobs. A print queue services incoming printing
+			requests only when configured to do so. Ensure that your print queue is
+			set to accept incoming jobs by executing the following command:
+<screen>
+&rootprompt; /usr/bin/accept <parameter>printque</parameter>
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>mime type</primary></indexterm>
+			<indexterm><primary>/etc/mime.convs</primary></indexterm>
+			<indexterm><primary>application/octet-stream</primary></indexterm>
+			This step, as well as the next one, may be omitted where CUPS version 1.1.18
+			or later is in use.  Although it does no harm to follow it anyway, and may
+			help to avoid time spent later trying to figure out why print jobs may be
+			disappearing without a trace. Look at these two steps as <emphasis>insurance</emphasis>
+			against lost time. Edit file <filename>/etc/cups/mime.convs</filename> to 
+			uncomment the line:
+<screen>
+application/octet-stream     application/vnd.cups-raw      0     -
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>/etc/mime.types</primary></indexterm>
+			Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
+<screen>
+application/octet-stream
+</screen>
+			</para></step>
+
+			<step><para>
+			Refer to the CUPS printing manual for instructions regarding how to configure
+			CUPS so that print queues that reside on CUPS servers on remote networks
+			route print jobs to the print server that owns that queue. The default setting
+			on your CUPS server may automatically discover remotely installed printers and
+			may permit this functionality without requiring specific configuration.
+			</para></step>
+
+			<step><para>
+			As part of the roll-out program, you need to configure the application's
+			server shares. This can be done once on the central server and may then be
+			replicated using a tool such as <command>rsync</command>. Refer to the man
+			page for <command>rsync</command> for details regarding use. The notes in	
+			<link linkend="ch4appscfg"/> may help in your decisions to use an application
+			server facility.
+			</para></step>
+
+		</procedure>
+
+	<note><para>
+	Logon scripts that are run from a domain controller (PDC or BDC) are capable of using semi-intelligent
+	processes to automap Windows client drives to an application server that is nearest to the client. This
+	is considerably more difficult when a single PDC is used on a routed network. It can be done, but not
+	as elegantly as you see in the next chapter.
+	</para></note>
+
+	</sect2>
+
+	<sect2>
+	<title>Server-Specific Preparation</title>
+
+	<para>
+	There are some steps that apply to particular server functionality only. Each step is critical
+	to correct server operation. The following step-by-step installation guidance will assist you 
+	in working through the process of configuring the PDC and then both BDC's.
+	</para>
+
+		<sect3>
+		<title>Configuration for Server: <constant>MASSIVE</constant></title>
+
+		<para>
+		The steps presented here attempt to implement Samba installation in a generic manner. While
+		some steps are clearly specific to Linux, it should not be too difficult to apply them to
+		your platform of choice.
+		</para>
+
+		<procedure>
+		<title>Primary Domain Controller Preparation</title>
+
+			<step><para>
+			<indexterm><primary>/etc/rc.d/boot.local</primary></indexterm>
+			<indexterm><primary>IP forwarding</primary></indexterm>
+			The host server acts as a router between the two internal network segments as well
+			as for all Internet access. This necessitates that IP forwarding be enabled. This can be
+			achieved by adding to the <filename>/etc/rc.d/boot.local</filename> an entry as follows:
+<screen>
+echo 1 > /proc/sys/net/ipv4/ip_forward
+</screen>
+			To ensure that your kernel is capable of IP forwarding during configuration, you may wish to execute
+			that command manually also. This setting permits the Linux system to act as a router.
+			</para></step>
+
+			<step><para>
+			This server is dual hosted (i.e., has two network interfaces) &smbmdash; one goes to the Internet
+			and the other to a local network that has a router that is the gateway to the remote networks.
+			You must therefore configure the server with route table entries so that it can find machines
+			on the remote networks. You can do this using the appropriate system tools for your Linux
+			server or using static entries that you place in one of the system startup files. It is best
+			to always use the tools that the operating system vendor provided. In the case of SUSE Linux, the
+			best tool to do this is YaST (refer to SUSE Administration Manual); in the case of Red Hat,
+			this is best done using the graphical system configuration tools (see the Red Hat documentation).
+			An example of how this may be done manually is as follows:
+<screen>
+&rootprompt; route add net 172.16.4.0 netmask 255.255.252.0 gw 172.16.0.128
+&rootprompt; route add net 172.16.8.0 netmask 255.255.252.0 gw 172.16.0.128
+</screen>
+			If you just execute these commands manually, the route table entries you have created are
+			not persistent across system reboots. You may add these commands directly to the local
+			startup files as follows: (SUSE) <filename>/etc/rc.d/boot.local</filename>, (Red Hat)
+			<filename>/etc/rc.d/init.d/rc.local</filename>.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+			The final step that must be completed is to edit the <filename>/etc/nsswitch.conf</filename> file.
+			This file controls the operation of the various resolver libraries that are part of the Linux
+			Glibc libraries. Edit this file so that it contains the following entries:
+<screen>
+hosts:      files dns wins
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>initGrps.sh</primary></indexterm>
+			Create and map Windows domain groups to UNIX groups. A sample script is provided in
+			<link linkend="ch5-initgrps"/>. Create a file containing this script. You called yours
+			<filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed
+			and then execute the script. An example of the execution of this script as well as its
+			validation are shown in Section 4.3.2, Step 5.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>/etc/passwd</primary></indexterm>
+			<indexterm><primary>password</primary><secondary>backend</secondary></indexterm>
+			<indexterm><primary>smbpasswd</primary></indexterm>
+			For each user who needs to be given a Windows domain account, make an entry in the
+			<filename>/etc/passwd</filename> file as well as in the Samba password backend.
+			Use the system tool of your choice to create the UNIX system account, and use the Samba
+			<command>smbpasswd</command> to create a domain user account.
+			</para>
+
+			<para>
+			<indexterm><primary>useradd</primary></indexterm>
+			<indexterm><primary>adduser</primary></indexterm>
+			<indexterm><primary>user</primary><secondary>management</secondary></indexterm>
+			There are a number of tools for user management under UNIX, such as
+			<command>useradd</command>, <command>adduser</command>, as well as a plethora of custom
+			tools. With the tool of your choice, create a home directory for each user.
+			</para></step>
+
+			<step><para>
+			Using the preferred tool for your UNIX system, add each user to the UNIX groups created
+			previously as necessary. File system access control is based on UNIX group membership.
+			</para></step>
+
+			<step><para>
+			Create the directory mount point for the disk subsystem that is to be mounted to provide
+			data storage for company files, in this case, the mount point indicated in the &smb.conf;
+			file is <filename>/data</filename>. Format the file system as required and mount the formatted
+			file system partition using appropriate system tools.
+			</para></step>
+
+			<step><para>
+		<indexterm><primary>file system</primary>
+		  <secondary>permissions</secondary></indexterm>
+			Create the top-level file storage directories for data and applications as follows:
+<screen>
+&rootprompt; mkdir -p /data/{accounts,finsvcs,pidata}
+&rootprompt; mkdir -p /apps
+&rootprompt; chown -R root:root /data
+&rootprompt; chown -R root:root /apps
+&rootprompt; chown -R bjordan:accounts /data/accounts
+&rootprompt; chown -R bjordan:finsvcs /data/finsvcs
+&rootprompt; chown -R bjordan:finsvcs /data/pidata
+&rootprompt; chmod -R ug+rwxs,o-rwx /data
+&rootprompt; chmod -R ug+rwx,o+rx-w /apps
+</screen>
+			Each department is responsible for creating its own directory structure within the departmental
+			share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>.
+			The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>.
+			The <filename>/apps</filename> directory is the root of the <constant>apps</constant> share
+			that provides the application server infrastructure.
+			</para></step>
+
+			<step><para>
+			The &smb.conf; file specifies an infrastructure to support roaming profiles and network
+			logon services. You can now create the file system infrastructure to provide the
+			locations on disk that these services require. Adequate planning is essential
+			because desktop profiles can grow to be quite large. For planning purposes, a minimum of
+			200 MB of storage should be allowed per user for profile storage. The following
+			commands create the directory infrastructure needed:
+<screen>
+&rootprompt; mkdir -p /var/spool/samba
+&rootprompt; mkdir -p /var/lib/samba/{netlogon/scripts,profiles}
+&rootprompt; chown -R root:root /var/spool/samba
+&rootprompt; chown -R root:root /var/lib/samba
+&rootprompt; chmod a+rwxt /var/spool/samba
+</screen>
+			For each user account that is created on the system, the following commands should be
+			executed:
+<screen>
+&rootprompt; mkdir /var/lib/samba/profiles/'username'
+&rootprompt; chown 'username':users /var/lib/samba/profiles/'username'
+&rootprompt; chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username'
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>unix2dos</primary></indexterm>
+			<indexterm><primary>dos2unix</primary></indexterm>
+			Create a logon script. It is important that each line is correctly terminated with
+			a carriage return and line-feed combination (i.e., DOS encoding). The following procedure
+			works if the right tools (<constant>unxi2dos</constant> and <constant>dos2unix</constant>) are installed.
+			First, create a file called <filename>/var/lib/samba/netlogon/scripts/logon.bat.unix</filename>
+			with the following contents:
+<screen>
+net time \\massive /set /yes
+net use h: /home
+</screen>
+			Convert the UNIX file to a DOS file:
+<screen>
+&rootprompt; dos2unix &lt; /var/lib/samba/netlogon/scripts/logon.bat.unix \
+        &gt; /var/lib/samba/netlogon/scripts/logon.bat
+</screen>
+			</para></step>
+
+			<step><para>
+			There is one preparatory step without which you cannot have a working Samba network
+			environment. You must add an account for each network user. You can do this by executing
+			the following steps for each user:
+<screen>
+&rootprompt; useradd -m <parameter>username</parameter>
+&rootprompt; passwd <parameter>username</parameter>
+Changing password for <parameter>username</parameter>.
+New password: XXXXXXXX
+Re-enter new password: XXXXXXXX
+Password changed
+&rootprompt; smbpasswd -a <parameter>username</parameter>
+New SMB password: XXXXXXXX
+Retype new SMB password: XXXXXXXX
+Added user <parameter>username</parameter>.
+</screen>
+			You do, of course, use a valid user login ID in place of <parameter>username</parameter>.
+			</para></step>
+
+			<step><para>
+			Follow the processes shown in <link linkend="ch5-procstart"/> to start all services.
+			</para></step>
+
+			<step><para>
+			Your server is ready for validation testing. Do not proceed with the steps in
+			<link linkend="ch5-domsvrspec"/> until after the operation of the server has been
+			validated following the same methods as outlined in <link linkend="secure"/>, <link linkend="ch4valid"/>.
+			</para></step>
+
+		</procedure>
+		
+		</sect3>
+
+		<sect3 id="ch5-domsvrspec">
+		<title>Configuration Specific to Domain Member Servers: <constant>BLDG1, BLDG2</constant></title>
+
+		<para>
+		The following steps will guide you through the nuances of implementing BDCs for the broadcast
+		isolated network segments. Remember that if the target installation platform is not Linux, it may
+		be necessary to adapt some commands to the equivalent on the target platform.
+		</para>
+
+		<procedure>
+		<title>Backup Domain Controller Configuration Steps</title>
+
+			<step><para>
+			<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+			The final step that must be completed is to edit the <filename>/etc/nsswitch.conf</filename> file.
+			This file controls the operation of the various resolver libraries that are part of the Linux
+			Glibc libraries. Edit this file so that it contains the following entries:
+<screen>
+passwd:     files winbind
+group:      files winbind
+hosts:      files dns wins
+</screen>
+                        </para></step>
+
+			<step><para>
+			Follow the steps outlined in <link linkend="ch5-procstart"/> to start all services. Do not
+			start Samba at this time. Samba is controlled by the process called <command>smb</command>.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
+			You must now attempt to join the domain member servers to the domain. The following
+			instructions should be executed to effect this:
+<screen>
+&rootprompt; net rpc join 
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>service</primary><secondary>smb</secondary><tertiary>start</tertiary></indexterm>
+			You now start the Samba services by executing:
+<screen>
+&rootprompt; service smb start
+</screen>
+			</para></step>
+
+                        <step><para>
+                        Your server is ready for validation testing. Do not proceed with the steps in
+                        <link linkend="ch5-domsvrspec"/> until after the operation of the server has been
+                        validated following the same methods as outlined in <link linkend="ch4valid"/>.
+                        </para></step>
+
+		</procedure>
+
+		</sect3>
+
+	</sect2>
+
+<!-- One -->
+<smbconfexample id="ch5-massivesmb">
+<title>Server: MASSIVE (PDC), File: <filename>/etc/samba/smb.conf</filename></title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">MEGANET</smbconfoption>
+<smbconfoption name="netbios name">MASSIVE</smbconfoption>
+<smbconfoption name="interfaces">eth1, lo</smbconfoption>
+<smbconfoption name="bind interfaces only">Yes</smbconfoption>
+<smbconfoption name="passdb backend">tdbsam</smbconfoption>
+<smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption>
+<smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption>
+<smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
+<smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption>
+<smbconfoption name="add user to group script">/usr/sbin/usermod -G '%g' '%u'</smbconfoption>
+<smbconfoption name="add machine script">/usr/sbin/</smbconfoption>
+<member><parameter>useradd -s /bin/false -d /var/lib/nobody '%u'</parameter></member>
+<smbconfoption name="preferred master">Yes</smbconfoption>
+<smbconfoption name="wins support">Yes</smbconfoption>
+<smbconfoption name="include">/etc/samba/dc-common.conf</smbconfoption>
+
+<smbconfsection name="[IPC$]"/>
+<smbconfoption name="path">/tmp</smbconfoption>
+<smbconfoption name="hosts allow">172.16.0.0/16, 127.0.0.1</smbconfoption>
+<smbconfoption name="hosts deny">0.0.0.0/0</smbconfoption>
+
+<smbconfsection name="[accounts]"/>
+<smbconfoption name="comment">Accounting Files</smbconfoption>
+<smbconfoption name="path">/data/accounts</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[service]"/>
+<smbconfoption name="comment">Financial Services Files</smbconfoption>
+<smbconfoption name="path">/data/service</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[pidata]"/>
+<smbconfoption name="comment">Property Insurance Files</smbconfoption>
+<smbconfoption name="path">/data/pidata</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+</smbconfexample>
+
+<!-- Two -->
+<smbconfexample id="ch5-dc-common">
+<title>Server: MASSIVE (PDC), File: <filename>/etc/samba/dc-common.conf</filename></title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
+<smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
+<smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
+<smbconfoption name="logon path">\%L\profiles\%U</smbconfoption>
+<smbconfoption name="logon drive">X:</smbconfoption>
+<smbconfoption name="logon home">\%L\%U</smbconfoption>
+<smbconfoption name="domain logons">Yes</smbconfoption>
+<smbconfoption name="preferred master">Yes</smbconfoption>
+<smbconfoption name="include">/etc/samba/common.conf</smbconfoption>
+
+<smbconfsection name="[homes]"/>
+<smbconfoption name="comment">Home Directories</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[netlogon]"/>
+<smbconfoption name="comment">Network Logon Service</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="locking">No</smbconfoption>
+
+<smbconfsection name="[profiles]"/>
+<smbconfoption name="comment">Profile Share</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="profile acls">Yes</smbconfoption>
+</smbconfexample>
+
+<!-- Three -->
+<smbconfexample id="ch5-commonsmb">
+<title>Common Samba Configuration File: <filename>/etc/samba/common.conf</filename></title>
+<smbconfsection name="[global]"/>
+<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+<smbconfoption name="log level">1</smbconfoption>
+<smbconfoption name="syslog">0</smbconfoption>
+<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+<smbconfoption name="max log size">50</smbconfoption>
+<smbconfoption name="smb ports">139 445</smbconfoption>
+<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+<smbconfoption name="time server">Yes</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="show add printer wizard">No</smbconfoption>
+<smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
+<smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
+<smbconfoption name="utmp">Yes</smbconfoption>
+<smbconfoption name="map acl inherit">Yes</smbconfoption>
+<smbconfoption name="printing">cups</smbconfoption>
+<smbconfoption name="veto files">/*.eml/*.nws/*.{*}/</smbconfoption>
+<smbconfoption name="veto oplock files">/*.doc/*.xls/*.mdb/</smbconfoption>
+<smbconfoption name="include"> </smbconfoption>
+
+<smbconfcomment>Share and Service Definitions are common to all servers</smbconfcomment>
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">SMB Print Spool</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="use client driver">Yes</smbconfoption>
+<smbconfoption name="default devmode">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[apps]"/>
+<smbconfoption name="comment">Application Files</smbconfoption>
+<smbconfoption name="path">/apps</smbconfoption>
+<smbconfoption name="admin users">bjordan</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+</smbconfexample>
+
+<!-- Four -->
+<smbconfexample id="ch5-bldg1-smb">
+<title>Server: BLDG1 (Member), File: smb.conf</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">MEGANET</smbconfoption>
+<smbconfoption name="netbios name">BLDG1</smbconfoption>
+<smbconfoption name="include">/etc/samba/dom-mem.conf</smbconfoption>
+</smbconfexample>
+
+<!-- Five -->
+<smbconfexample id="ch5-bldg2-smb">
+<title>Server: BLDG2 (Member), File: smb.conf</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">MEGANET</smbconfoption>
+<smbconfoption name="netbios name">BLDG2</smbconfoption>
+<smbconfoption name="include">/etc/samba/dom-mem.conf</smbconfoption>
+</smbconfexample>
+
+<!-- Six -->
+<smbconfexample id="ch5-dommem-smb">
+<title>Common Domain Member Include File: dom-mem.conf</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
+<smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
+<smbconfoption name="preferred master">Yes</smbconfoption>
+<smbconfoption name="wins server">172.16.0.1</smbconfoption>
+<smbconfoption name="idmap uid">15000-20000</smbconfoption>
+<smbconfoption name="idmap gid">15000-20000</smbconfoption>
+<smbconfoption name="include">/etc/samba/common.conf</smbconfoption>
+</smbconfexample>
+
+<!-- Seven -->
+<example id="massive-dhcp">
+<title>Server: MASSIVE, File: dhcpd.conf</title>
+<screen>
+# Abmas Accounting Inc.
+
+default-lease-time 86400;
+max-lease-time 172800;
+default-lease-time 86400;
+ddns-updates on;
+ddns-update-style interim;
+
+option ntp-servers 172.16.0.1;
+option domain-name "abmas.biz";
+option domain-name-servers 172.16.0.1, 172.16.4.1;
+option netbios-name-servers 172.16.0.1;
+option netbios-node-type 8;
+
+subnet 172.16.1.0 netmask 255.255.252.0 {
+        range dynamic-bootp 172.16.1.0 172.16.2.255;
+        option subnet-mask 255.255.252.0;
+        option routers 172.16.0.1, 172.16.0.128;
+        allow unknown-clients;
+	}
+subnet 172.16.4.0 netmask 255.255.252.0 {
+        range dynamic-bootp 172.16.7.0 172.16.7.254;
+        option subnet-mask 255.255.252.0;
+        option routers 172.16.4.128;
+        allow unknown-clients;
+	}
+subnet 172.16.8.0 netmask 255.255.252.0 {
+        range dynamic-bootp 172.16.11.0 172.16.11.254;
+        option subnet-mask 255.255.252.0;
+        option routers 172.16.4.128;
+        allow unknown-clients;
+	}
+subnet 127.0.0.0 netmask 255.0.0.0 {
+        }
+subnet 123.45.67.64 netmask 255.255.255.252 {
+        }
+</screen>
+</example>
+
+<!-- Eight -->
+<example id="bldg1dhcp">
+<title>Server: BLDG1, File: dhcpd.conf</title>
+<screen>
+# Abmas Accounting Inc.
+
+default-lease-time 86400;
+max-lease-time 172800;
+default-lease-time 86400;
+ddns-updates on;
+ddns-update-style ad-hoc;
+
+option ntp-servers 172.16.0.1;
+option domain-name "abmas.biz";
+option domain-name-servers 172.16.0.1, 172.16.4.1;
+option netbios-name-servers 172.16.0.1;
+option netbios-node-type 8;
+
+subnet 172.16.1.0 netmask 255.255.252.0 {
+        range dynamic-bootp 172.16.3.0 172.16.2.254;
+        option subnet-mask 255.255.252.0;
+        option routers 172.16.0.1, 172.16.0.128;
+        allow unknown-clients;
+	}
+subnet 172.16.4.0 netmask 255.255.252.0 {
+        range dynamic-bootp 172.16.5.0 172.16.6.255;
+        option subnet-mask 255.255.252.0;
+        option routers 172.16.4.128;
+        allow unknown-clients;
+	}
+subnet 127.0.0.0 netmask 255.0.0.0 {
+        }
+</screen>
+</example>
+
+<!-- Nine -->
+<example id="bldg2dhcp">
+<title>Server: BLDG2, File: dhcpd.conf</title>
+<screen>
+# Abmas Accounting Inc.
+
+default-lease-time 86400;
+max-lease-time 172800;
+default-lease-time 86400;
+ddns-updates on;
+ddns-update-style interim;
+
+option ntp-servers 172.16.0.1;
+option domain-name "abmas.biz";
+option domain-name-servers 172.16.0.1, 172.16.4.1;
+option netbios-name-servers 172.16.0.1;
+option netbios-node-type 8;
+
+subnet 172.16.8.0 netmask 255.255.252.0 {
+        range dynamic-bootp 172.16.9.0 172.16.10.255;
+        option subnet-mask 255.255.252.0;
+        option routers 172.16.8.128;
+        allow unknown-clients;
+	}
+subnet 127.0.0.0 netmask 255.0.0.0 {
+        }
+</screen>
+</example>
+
+<!-- Ten -->
+<example id="massive-nameda">
+<title>Server: MASSIVE, File: named.conf, Part: A</title>
+<screen>
+###
+# Abmas Biz DNS Control File
+###
+# Date: November 15, 2003
+###
+options {
+	directory "/var/lib/named";
+	forwarders {
+		123.45.12.23;
+		123.45.54.32;
+		};
+	forward first;
+	listen-on {
+		mynet;
+		};
+	auth-nxdomain yes;
+	multiple-cnames yes;
+	notify no;
+};
+
+zone "." in {
+	type hint;
+	file "root.hint";
+};
+
+zone "localhost" in {
+	type master;
+	file "localhost.zone";
+};
+
+zone "0.0.127.in-addr.arpa" in {
+	type master;
+	file "127.0.0.zone";
+};
+
+acl mynet {
+	172.16.0.0/24;
+	172.16.4.0/24;
+	172.16.8.0/24;
+	127.0.0.1;
+};
+
+acl seconddns {
+        123.45.54.32;
+}
+</screen>
+</example>
+
+<!-- Eleven -->
+<example id="massive-namedb">
+<title>Server: MASSIVE, File: named.conf, Part: B</title>
+<screen>
+zone "abmas.biz" {
+	type master;
+	file "/var/lib/named/master/abmas.biz.hosts";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+	allow-update {
+		mynet;
+	};
+};
+
+zone "abmas.us" {
+        type master;
+        file "/var/lib/named/master/abmas.us.hosts";
+        allow-query {
+                all;
+        };
+        allow-transfer {
+                seconddns;
+        };
+};
+</screen>
+</example>
+
+<!-- Twelve -->
+<example id="massive-namedc">
+<title>Server: MASSIVE, File: named.conf, Part: C</title>
+<screen>
+zone "0.16.172.in-addr.arpa" {
+	type master;
+	file "/var/lib/named/master/172.16.0.0.rev";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+	allow-update {
+		mynet;
+	};
+};
+
+zone "4.16.172.in-addr.arpa" {
+	type master;
+	file "/var/lib/named/master/172.16.4.0.rev";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+	allow-update {
+		mynet;
+	};
+};
+
+zone "8.16.172.in-addr.arpa" {
+	type master;
+	file "/var/lib/named/master/172.16.8.0.rev";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+	allow-update {
+		mynet;
+	};
+};
+</screen>
+</example>
+
+<!-- Thirteen -->
+<example id="abmasbizdns">
+<title>Forward Zone File: abmas.biz.hosts</title>
+<screen>
+$ORIGIN .
+$TTL 38400	; 10 hours 40 minutes
+abmas.biz	IN SOA	massive.abmas.biz. root.abmas.biz. (
+				2003021833 ; serial
+				10800      ; refresh (3 hours)
+				3600       ; retry (1 hour)
+				604800     ; expire (1 week)
+				38400      ; minimum (10 hours 40 minutes)
+				)
+			NS	massive.abmas.biz.
+			NS	bldg1.abmas.biz.
+			NS	bldg2.abmas.biz.
+			MX	10 massive.abmas.biz.
+$ORIGIN abmas.biz.
+massive			A	172.16.0.1
+router0                 A       172.16.0.128
+bldg1                   A       172.16.4.1
+router4                 A       172.16.4.128
+bldg2                   A       172.16.8.1
+router8                 A       172.16.8.128
+</screen>
+</example>
+
+<!-- Forteen -->
+<example id="abmasusdns">
+<title>Forward Zone File: abmas.biz.hosts</title>
+<screen>
+$ORIGIN .
+$TTL 38400	; 10 hours 40 minutes
+abmas.us	IN SOA	server.abmas.us. root.abmas.us. (
+				2003021833 ; serial
+				10800      ; refresh (3 hours)
+				3600       ; retry (1 hour)
+				604800     ; expire (1 week)
+				38400      ; minimum (10 hours 40 minutes)
+				)
+			NS	dns.abmas.us.
+			NS	dns2.abmas.us.
+			MX	10 mail.abmas.us.
+$ORIGIN abmas.us.
+server			A	123.45.67.66
+dns2			A	123.45.54.32
+gw			A	123.45.67.65
+www			CNAME	server
+mail			CNAME	server
+dns			CNAME	server
+</screen>
+</example>
+
+<!-- Fifteen -->
+<example id="bldg12nameda">
+<title>Servers: BLDG1/BLDG2, File: named.conf, Part: A</title>
+<screen>
+###
+# Abmas Biz DNS Control File
+###
+# Date: November 15, 2003
+###
+options {
+	directory "/var/lib/named";
+	forwarders {
+		172.16.0.1;
+		};
+	forward first;
+	listen-on {
+		mynet;
+		};
+	auth-nxdomain yes;
+	multiple-cnames yes;
+	notify no;
+};
+
+zone "." in {
+	type hint;
+	file "root.hint";
+};
+
+zone "localhost" in {
+	type master;
+	file "localhost.zone";
+};
+
+zone "0.0.127.in-addr.arpa" in {
+	type master;
+	file "127.0.0.zone";
+};
+
+acl mynet {
+	172.16.0.0/24;
+	172.16.4.0/24;
+	172.16.8.0/24;
+	127.0.0.1;
+};
+
+acl seconddns {
+        123.45.54.32;
+}
+</screen>
+</example>
+
+<!-- Sixteen -->
+<example id="bldg12namedb">
+<title>Servers: BLDG1/BLDG2, File: named.conf, Part: B</title>
+<screen>
+zone "abmas.biz" {
+	type slave;
+	file "/var/lib/named/slave/abmas.biz.hosts";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+};
+
+zone "0.16.172.in-addr.arpa" {
+	type slave;
+	file "/var/lib/slave/master/172.16.0.0.rev";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+};
+
+zone "4.16.172.in-addr.arpa" {
+	type slave;
+	file "/var/lib/named/slave/172.16.4.0.rev";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+};
+
+zone "8.16.172.in-addr.arpa" {
+	type slave;
+	file "/var/lib/named/slave/172.16.8.0.rev";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+};
+</screen>
+</example>
+
+
+<!-- Seventeen -->
+<example id="ch5-initgrps">
+<title>Initialize Groups Script, File: /etc/samba/initGrps.sh</title>
+<screen>
+#!/bin/bash
+
+# Create UNIX groups
+groupadd acctsdep
+groupadd finsrvcs
+groupadd piops
+
+# Map Windows Domain Groups to UNIX groups
+net groupmap modify ntgroup="Domain Admins"  unixgroup=root
+net groupmap modify ntgroup="Domain Users"   unixgroup=users
+net groupmap modify ntgroup="Domain Guests"  unixgroup=nobody
+
+# Add Functional Domain Groups
+net groupmap add ntgroup="Accounts Dept"       unixgroup=acctsdep type=d
+net groupmap add ntgroup="Financial Services"  unixgroup=finsrvcs type=d
+net groupmap add ntgroup="Insurance Group"     unixgroup=piops type=d
+</screen>
+</example>
+
+<!-- End of Examples -->
+
+        <sect2 id="ch5-procstart">
+        <title>Process Startup Configuration</title>
+
+        <para>
+		<indexterm><primary>chkconfig</primary></indexterm>
+		<indexterm><primary>daemon control</primary></indexterm>
+        There are two essential steps to process startup configuration. A process
+        must be configured so that it is automatically restarted each time the server
+        is rebooted. This step involves use of the <command>chkconfig</command> tool that
+        created appropriate symbolic links from the master daemon control file that is
+        located in the <filename>/etc/rc.d</filename> directory to the <filename>/etc/rc'x'.d</filename>
+        directories. Links are created so that when the system run-level is changed, the
+        necessary start or kill script is run.
+        </para>
+
+        <para>
+        <indexterm><primary>/etc/xinetd.d</primary></indexterm>
+        In the event that a service is provided not as a daemon but via the internetworking
+        super daemon (<command>inetd</command> or <command>xinetd</command>), then the <command>chkconfig</command>
+        tool makes the necessary entries in the <filename>/etc/xinetd.d</filename> directory
+        and sends a hang-up (HUP) signal to the super daemon, thus forcing it to
+        re-read its control files.
+        </para>
+
+        <para>
+        Last, each service must be started to permit system validation to proceed. The following steps
+		are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you 
+		are installing Samba.
+        </para>
+
+        <procedure>
+		<title>Process Startup Configuration Steps</title>
+
+                <step><para>
+                Use the standard system tool to configure each service to restart
+                automatically at every system reboot. For example,
+                <indexterm><primary>chkconfig</primary></indexterm>
+<screen>
+&rootprompt; chkconfig dhpc on
+&rootprompt; chkconfig named on
+&rootprompt; chkconfig cups on
+&rootprompt; chkconfig smb on
+&rootprompt; chkconfig swat on
+</screen>
+                </para></step>
+
+                <step><para>
+                <indexterm><primary>starting dhcpd</primary></indexterm>
+                <indexterm><primary>starting samba</primary></indexterm>
+                <indexterm><primary>starting CUPS</primary></indexterm>
+                Now start each service to permit the system to be validated.
+                Execute each of the following in the sequence shown:
+
+<screen>
+&rootprompt; service dhcp restart
+&rootprompt; service named restart
+&rootprompt; service cups restart
+&rootprompt; service smb restart
+&rootprompt; service swat restart
+</screen>
+                </para></step>
+        </procedure>
+
+        </sect2>
+
+	<sect2 id="ch5wincfg">
+	<title>Windows Client Configuration</title>
+
+	<para>
+	The procedure for desktop client configuration for the network in this chapter is similar to
+	that used for the previous one. There are a few subtle changes that should be noted.
+	</para>
+
+	<procedure>
+	<title>Windows Client Configuration Steps</title>
+
+		<step><para>
+		Install MS Windows XP Professional. During installation, configure the client to use DHCP for 
+		TCP/IP protocol configuration.
+		<indexterm><primary>WINS</primary></indexterm>
+		<indexterm><primary>DHCP</primary></indexterm>
+		DHCP configures all Windows clients to use the WINS Server address that has been defined
+		for the local subnet.
+		</para></step>
+
+		<step><para>
+		Join the Windows domain <constant>MEGANET</constant>. Use the domain administrator
+		username <constant>root</constant> and the SMB password you assigned to this account.
+		A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
+		a Windows domain is given in Appendix A, <link linkend="domjoin"/>. 
+		Reboot the machine as prompted and then log on using the domain administrator account
+		(<constant>root</constant>).
+		</para></step>
+
+		<step><para>
+		Verify that the server called <constant>MEGANET</constant> is visible in <guimenu>My Network Places</guimenu>, 
+		that it is possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>,
+		<guimenuitem>apps</guimenuitem>, and <guimenuitem>finsvcs</guimenuitem>,
+		and that it is possible to open each share to reveal its contents.
+		</para></step>
+
+		<step><para>
+		Create a drive mapping to the <constant>apps</constant> share on a server. At this time, it does
+		not particularly matter which application server is used. It is necessary to manually
+		set a persistent drive mapping to the local applications server on each workstation at the time of 
+		installation. This step is avoided by the improvements to the design of the network configuration
+		in the next chapter.
+		</para></step>
+
+		<step><para>
+		Perform an administrative installation of each application to be used. Select the options
+		that you wish to use. Of course, you choose to run applications over the network, correct?
+		</para></step>
+
+		<step><para>
+		Now install all applications to be installed locally. Typical tools include Adobe Acrobat,
+		NTP-based time synchronization software, drivers for specific local devices such as fingerprint
+		scanners, and the like. Probably the most significant application to be locally installed
+		is antivirus software.
+		</para></step>
+
+		<step><para>
+		Now install all four printers onto the staging system. The printers you install
+		include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers, and you
+		also configure use of the identical printers that are located in the financial services department.
+		Install printers on each machine using the following steps:
+
+			<procedure>
+			<title>Steps to Install Printer Drivers on Windows Clients</title>
+
+				<step><para>
+				Click <menuchoice>
+					<guimenu>Start</guimenu>
+					<guimenuitem>Settings</guimenuitem>
+					<guimenuitem>Printers</guimenuitem>
+					<guiicon>Add Printer</guiicon>
+					<guibutton>Next</guibutton>
+					</menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
+					Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
+				</para></step>
+
+				<step><para>
+				Click <guibutton>Next</guibutton>. In the
+				<guimenuitem>Manufacturer:</guimenuitem> panel, select <constant>HP</constant>.
+				In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
+				<constant>HP LaserJet 6</constant>. Click <guibutton>Next</guibutton>.
+				</para></step>
+
+				<step><para>
+				In the <guimenuitem>Available ports:</guimenuitem> panel, select
+				<constant>FILE:</constant>. Accept the default printer name by clicking
+				<guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
+				test page?</quote>, click <guimenuitem>No</guimenuitem>. Click
+				<guibutton>Finish</guibutton>.
+				</para></step>
+
+				<step><para>
+				You may be prompted for the name of a file to print to. If so, close the
+				dialog panel. Right-click <menuchoice>
+					<guiicon>HP LaserJet 6</guiicon>
+					<guimenuitem>Properties</guimenuitem>
+					<guimenusub>Details (Tab)</guimenusub>
+					<guimenubutton>Add Port</guimenubutton>
+					</menuchoice>.
+				</para></step>
+
+				<step><para>
+				In the <guimenuitem>Network</guimenuitem> panel, enter the name of
+				the print queue on the Samba server as follows: <constant>\\BLDG1\hplj6a</constant>.
+				Click <menuchoice> 
+					<guibutton>OK</guibutton>
+					<guibutton>OK</guibutton>
+					</menuchoice> to complete the installation.
+				</para></step>
+
+				<step><para>
+				Repeat the printer installation steps above for both HP LaserJet 6 printers
+				as well as for both QMS Magicolor laser printers. Remember to install all
+				printers but to set the destination port for each to the server on the
+				local network. For example, a workstation in the accounting group should
+				have all printers directed at the server <constant>BLDG1</constant>.
+				You may elect to point all desktop workstation configurations at the
+				server called <constant>MASSIVE</constant> and then in your deployment	
+				procedures, it would be wise to document the need to redirect the printer
+				configuration (as well as the applications server drive mapping) to the
+				server on the network segment on which the workstation is to be located.
+				</para></step>
+			</procedure>
+		</para></step>
+
+		<step><para>
+		When you are satisfied that the staging systems are complete, use the appropriate procedure to
+		remove the client from the domain. Reboot the system, and then log on as the local administrator
+		and clean out all temporary files stored on the system. Before shutting down, use the disk
+		defragmentation tool so that the file system is in optimal condition before replication.
+		</para></step>
+
+		<step><para>
+		Boot the workstation using the Norton (Symantec) Ghosting disk (or CD-ROM) and image the
+		machine to a network share on the server.
+		</para></step>
+
+		<step><para>
+		You may now replicate the image using the appropriate Norton Ghost procedure to the target
+		machines. Make sure to use the procedure that ensures each machine has a unique
+		Windows security identifier (SID). When the installation of the disk image is complete, boot the PC. 
+		</para></step>
+
+		<step><para>
+		Log onto the machine as the local Administrator (the only option), and join the machine to
+		the domain following the procedure set out in Appendix A, <link linkend="domjoin"/>. You must now set the 
+		persistent drive mapping to the applications server that the user is to use. The system is now 
+		ready for the user to log on, provided you have created a network logon account for that 
+		user, of course.
+		</para></step>
+
+		<step><para>
+		Instruct all users to log onto the workstation using their assigned username and password.
+		</para></step>
+	</procedure>
+
+	</sect2>
+
+	<sect2>
+		<title>Key Points Learned</title>
+
+		<para>
+		The network you have just deployed has been a valuable exercise in forced constraint.
+		You have deployed a network that works well, although you may soon start to see
+		performance problems, at which time the modifications demonstrated in <link linkend="happy"/>
+		bring the network to life. The following key learning points were experienced:
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			The power of using &smb.conf; include files
+			</para></listitem>
+
+			<listitem><para>
+			Use of a single PDC over a routed network
+			</para></listitem>
+
+			<listitem><para>
+			Joining a Samba-3 domain member server to a Samba-3 domain
+			</para></listitem>
+
+			<listitem><para>
+			Configuration of winbind to use domain users and groups for Samba access
+			to resources on the domain member servers
+			</para></listitem>
+
+			<listitem><para>
+			The introduction of roaming profiles
+			</para></listitem>
+
+		</itemizedlist>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Questions and Answers</title>
+
+	<para>
+	</para>
+
+	<qandaset defaultlabel="chap01qa" type="number">
+	<qandaentry>
+	<question>
+
+		<para>
+		The example &smb.conf; files in this chapter make use of the <parameter>include</parameter> facility.
+		How may I get to see what the actual working &smb.conf; settings are?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		You may readily see the net compound effect of the included files by running:
+<screen>
+&rootprompt; testparm -s | less
+</screen>
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why does the include file <filename>common.conf</filename> have an empty include statement?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The use of the empty include statement nullifies further includes. For example, let's say you 
+		desire to have just an smb.conf file that is built from the array of include files of which the
+		master control file is called <filename>master.conf</filename>. The following command 
+		produces a compound &smb.conf; file.
+<screen>
+&rootprompt; testparm -s /etc/samba/master.conf > /etc/samba/smb.conf
+</screen>
+		If the include parameter was not in the common.conf file, the final &smb.conf; file leaves
+		the include in place, even though the file it points to has already been included. This is a bug
+		that will be fixed at a future date.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		I accept that the simplest configuration necessary to do the job is the best. The use of <parameter>tdbsam</parameter>
+		passdb backend is much simpler than having to manage an LDAP-based <parameter>ldapsam</parameter> passdb backend.
+		I tried using <command>rsync</command> to replicate the <filename>passdb.tdb</filename>, and it seems to work fine!
+		So what is the problem?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Replication of the <parameter>tdbsam</parameter> database file can result in loss of currency in its
+		contents between the PDC and BDCs. The most notable symptom is that workstations may not be able
+		to log onto the network following a reboot and may have to rejoin the domain to recover network
+		access capability.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		No. It is possible to have as many DHCP servers on a network segment as makes sense. A DHCP server
+		offers an IP address lease, but it is the client that determines which offer is accepted, no matter how many
+		offers are made. Under normal operation, the client accepts the first offer it receives.
+		</para>
+
+		<para>
+		The only exception to this rule is when the client makes a directed request from a specific DHCP server
+		for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		How does the Windows client find the PDC?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The Windows client obtains the WINS server address from the DHCP lease information. It also
+		obtains from the DHCP lease information the parameter that causes it to use directed UDP (UDP Unicast)
+		to register itself with the WINS server and to obtain enumeration of vital network information to 
+		enable it to operate successfully.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why did you enable IP forwarding (routing) only on the server called <constant>MASSIVE</constant>?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The server called <constant>MASSIVE</constant> is acting as a router to the Internet. No other server
+		(BLDG1 or BLDG2) has any need for IP forwarding because they are attached only to their own network.
+		Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network
+		segments to the router that is its gateway to them.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		You did nothing special to implement roaming profiles. Why?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional
+		clients is to use roaming profiles.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		On the domain member computers, you configured winbind in the <filename>/etc/nsswitch.conf</filename> file.
+		You did not configure any PAM settings. Is this an omission?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		PAM is needed only for authentication. When Samba is using Microsoft encrypted passwords, it makes only
+		marginal use of PAM. PAM configuration handles only authentication. If you want to log onto the domain
+		member servers using Windows networking usernames and passwords, it is necessary to configure PAM
+		to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name
+		service switch (NSS).
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Oh, I did not think you would notice that. It is there so that it can be used. This is more fully discussed
+		in <emphasis>TOSHARG</emphasis>, which has a full chapter dedicated to the subject. While we are on the 
+		subject, it should be noted that you should definitely not use SWAT on any system that makes use 
+		of &smb.conf; <parameter>include</parameter> files because SWAT optimizes them out into an aggregated 
+		file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to 
+		handle this functionality gracefully.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		The domain controller has an auto-shutdown script. Isn't that dangerous?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Well done, you spotted that! I guess it is dangerous. It is good to know that you can do this, though.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	</qandaset>
+
+</sect1>
+
+</chapter>
+
diff --git a/docs/Samba3-ByExample/SBE-AddingUNIXClients.xml b/docs/Samba3-ByExample/SBE-AddingUNIXClients.xml
new file mode 100644
index 0000000000..49db512a44
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-AddingUNIXClients.xml
@@ -0,0 +1,2922 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="unixclients">
+  <title>Adding Domain Member Servers and Clients</title>
+
+    <para><indexterm>
+	<primary>Open Magazine</primary>
+      </indexterm><indexterm>
+	<primary>survey</primary>
+      </indexterm>
+	The most frequently discussed Samba subjects over the past 2 years have focused around domain control and printing. 
+	It is well known that Samba is a file and print server. A recent survey conducted by <emphasis>Open Magazine</emphasis> found 
+	that of all respondents, 97 percent use Samba for file and print services, and 68 percent use Samba for Domain Control. See the 
+	<ulink url="http://www.open-mag.com/cgi-bin/opencgi/surveys/survey.cgi?survey_name=samba">Open-Mag</ulink>
+	Web site for current information. The survey results as found on January 14, 2004, are shown in
+	<link linkend="ch09openmag"/>.
+	</para>
+
+	<image id="ch09openmag">
+		<imagedescription>Open Magazine Samba Survey</imagedescription>
+		<imagefile scale="60">openmag</imagefile>
+	</image>
+
+	<para>
+	While domain control is an exciting subject, basic file and print sharing remains the staple bread-and-butter
+	function that Samba provides. Yet this book may give the appearance of having focused too much on more
+	exciting aspects of Samba deployment. This chapter directs your attention to provide important information on
+	the addition of Samba servers into your present Windows network &smbmdash; whatever the controlling technology
+	may be. So let's get back to our good friends at Abmas.
+	</para>
+
+<sect1>
+	<title>Introduction</title>
+
+      <para><indexterm>
+	  <primary>Linux desktop</primary>
+	</indexterm><indexterm>
+	  <primary>Domain Member</primary>
+	  <secondary>server</secondary>
+	</indexterm>
+	Looking back over the achievements of the past year or two, daily events at Abmas are rather straightforward
+	with not too many distractions or problems. Your team is doing well, but a number of employees
+	are asking for Linux desktop systems. Your network has grown and demands additional domain member servers. Let's
+	get on with this; Christine and Stan are ready to go.
+	</para>
+
+      <para><indexterm>
+	  <primary>Domain Member</primary>
+	  <secondary>desktop</secondary>
+	</indexterm>
+	Stan is firmly in control of the department of the future, while Christine is enjoying a stable and
+	predictable network environment. It is time to add more servers and to add Linux desktops. It is
+	time to meet the demands of future growth and endure trial by fire.
+	</para>
+
+	<sect2>
+	<title>Assignment Tasks</title>
+
+	<para><indexterm>
+	    <primary>Active Directory</primary>
+	  </indexterm>
+	You must now add UNIX/Linux domain member servers to your network. You have a friend who has a Windows 2003
+	Active Directory domain network who wants to add a Samba/Linux server and has asked Christine to help him
+	out. Your real objective is to help Christine to see more of the way the Microsoft world lives and use
+	her help to get validation that Samba really does live up to expectations.
+	</para>
+
+	<para>
+	Over the past 6 months, you have hired several new staff who want Linux on their desktops. You must integrate
+	these systems to make sure that Abmas is not building islands of technology. You ask Christine to
+	do likewise at Swodniw Biz NL (your friend's company) to help them to evaluate a Linux desktop. You want to make
+	the right decision, don't you?
+	</para>
+
+	</sect2>
+</sect1>
+
+<sect1>
+	<title>Dissection and Discussion</title>
+
+	<para>
+	<indexterm><primary>winbind</primary></indexterm>
+	Recent Samba mailing-list activity is witness to how many sites are using winbind. Some have no trouble
+	at all with it, yet to others the problems seem insurmountable. Periodically there are complaints concerning
+	an inability to achieve identical user and group IDs between Windows and UNIX environments.
+	</para>
+
+	<para>
+	You provide step-by-step implementations of the various tools that can be used for identity
+	resolution. You also provide working examples of solutions for integrated authentication for
+	both UNIX/Linux and Windows environments.
+	</para>
+
+	<sect2>
+		<title>Technical Issues</title>
+
+		<para>
+		One of the great challenges we face when people ask us, <quote>What is the best way to solve
+		this problem?</quote> is to get beyond the facts so we not only can clearly comprehend
+		the immediate technical problem, but also can understand how needs may change.
+		</para>
+
+		<para>
+		<indexterm><primary>integrate</primary></indexterm>
+		There are a few facts we should note when dealing with the question of how best to
+		integrate UNIX/Linux clients and servers into a Windows networking environment:
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			<indexterm><primary>Domain Controller</primary></indexterm>
+			<indexterm><primary>authoritative</primary></indexterm>
+			<indexterm><primary>accounts</primary><secondary>authoritative</secondary></indexterm>
+			<indexterm><primary>PDC</primary></indexterm>
+			<indexterm><primary>BDC</primary></indexterm>
+			A domain controller (PDC or BDC) is always authoritative for all accounts in its domain.
+			This means that a BDC must (of necessity) be able to resolve all account UIDs and GIDs
+			to the same values that the PDC resolved them to.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>local accounts</primary></indexterm>
+			<indexterm><primary>Domain Member</primary><secondary>authoritative</secondary><tertiary>local accounts</tertiary></indexterm>
+			<indexterm><primary>Domain accounts</primary></indexterm>
+			<indexterm><primary>winbindd</primary></indexterm>
+			A domain member can be authoritative for local accounts, but is never authoritative for
+			domain accounts. If a user is accessing a domain member server and that user's account
+			is not known locally, the domain member server must resolve the identity of that user
+			from the domain in which that user's account resides. It must then map that ID to a
+			UID/GID pair that it can use locally. This is handled by <command>winbindd</command>.
+			</para></listitem>
+
+			<listitem><para>
+			Samba, when running on a domain member server, can resolve user identities from a
+			number of sources:
+			</para>
+
+			<itemizedlist>
+				<listitem><para>
+				<indexterm><primary>getpwnam</primary></indexterm>
+				<indexterm><primary>getgrnam</primary></indexterm>
+				<indexterm><primary>NSS</primary></indexterm>
+				<indexterm><primary>LDAP</primary></indexterm>
+				<indexterm><primary>NIS</primary></indexterm>
+				By executing a system <command>getpwnam()</command> or <command>getgrnam()</command> call. 
+				On systems that support it, this utilizes the name service switch (NSS) facility to 
+				resolve names according to the configuration of the <filename>/etc/nsswitch.conf</filename> 
+				file. NSS can be configured to use LDAP, winbind, NIS, or local files.
+				</para></listitem>
+
+				<listitem><para>
+				<indexterm><primary>passdb backend</primary></indexterm>
+				<indexterm><primary>PADL</primary></indexterm>
+				<indexterm><primary>nss_ldap</primary></indexterm>
+				Performing, via NSS, a direct LDAP search (where an LDAP passdb backend has been configured).
+				This requires the use of the PADL nss_ldap tool (or equivalent).
+				</para></listitem>
+
+				<listitem><para>
+				<indexterm><primary>winbindd</primary></indexterm>
+				<indexterm><primary>SID</primary></indexterm>
+				<indexterm><primary>winbindd_idmap.tdb</primary></indexterm>
+				<indexterm><primary>winbindd_cache.tdb</primary></indexterm>
+				Directly by querying <command>winbindd</command>. The <command>winbindd</command>
+				contacts a domain controller to attempt to resolve the identity of the user or group. It
+				receives the Windows networking security identifier (SID) for that appropriate
+				account and then allocates a local UID or GID from the range of available IDs and
+				creates an entry in its <filename>winbindd_idmap.tdb</filename> and 
+				<filename>winbindd_cache.tdb</filename> files.
+				</para>
+
+				<para>
+				<indexterm><primary>idmap backend</primary></indexterm>
+				<indexterm><primary>mapping</primary></indexterm>
+				If the parameter <smbconfoption name="idmap backend">ldap:ldap://myserver.domain</smbconfoption>
+				was specified and the LDAP server has been configured with a container in which it may
+				store the IDMAP entries, all domain members may share a common mapping.
+				</para></listitem>
+			</itemizedlist>
+
+			<para>
+			Irrespective of how &smb.conf; is configured, winbind creates and caches a local copy of
+			the ID mapping database. It uses the <filename>winbindd_idmap.tdb</filename> and
+                                <filename>winbindd_cache.tdb</filename> files to do this.
+			</para>
+
+			<para>
+			Which of the resolver methods is chosen is determined by the way that Samba is configured 
+			in the &smb.conf; file. Some of the configuration options are rather less than obvious to the 
+			casual user.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>winbind enable local accounts</primary></indexterm>
+			<indexterm><primary>Domain Member</primary><secondary>servers</secondary></indexterm>
+			<indexterm><primary>Domain Controllers</primary></indexterm>
+			If you wish to make use of accounts (users and/or groups) that are local to (i.e., capable
+			of being resolved using) the NSS facility, it is imperative to use the 
+			<smbconfoption name="winbind enable local accounts">Yes</smbconfoption>
+			in the &smb.conf; file. This parameter specifically applies only to domain controllers, 
+			not to domain member servers.
+			</para></listitem>
+
+		</itemizedlist>
+
+		<para>
+		<indexterm><primary>Posix accounts</primary></indexterm>
+		<indexterm><primary>Samba accounts</primary></indexterm>
+		<indexterm><primary>LDAP</primary></indexterm>
+		For many administrators, it should be plain that the use of an LDAP-based repository for all network
+		accounts (both for POSIX accounts and for Samba accounts) provides the most elegant and
+		controllable facility. You eventually appreciate the decision to use LDAP.
+		</para>
+
+		<para>
+		<indexterm><primary>nss_ldap</primary></indexterm>
+		<indexterm><primary>identifiers</primary></indexterm>
+		<indexterm><primary>resolve</primary></indexterm>
+		If your network account information resides in an LDAP repository, you should use it ahead of any
+		alternative method. This means that if it is humanly possible to use the <command>nss_ldap</command>
+		tools to resolve UNIX account UIDs/GIDs via LDAP, this is the preferred solution, because it provides
+		a more readily controllable method for asserting the exact same user and group identifiers 
+		throughout the network.
+		</para>
+
+		<para>
+		<indexterm><primary>Domain Member</primary><secondary>server</secondary></indexterm>
+		<indexterm><primary>winbind trusted domains only</primary></indexterm>
+		<indexterm><primary>getpwnam</primary></indexterm>
+		<indexterm><primary>smbd</primary></indexterm>
+		<indexterm><primary>Trusted Domains</primary></indexterm>
+		<indexterm><primary>External Domains</primary></indexterm>
+		In the situation where UNIX accounts are held on the domain member server itself, the only effective
+		way to use them involves the &smb.conf; entry 
+		<smbconfoption name="winbind trusted domains only">Yes</smbconfoption>. This forces 
+		Samba (<command>smbd</command>) to perform a <command>getpwnam()</command> system call that can
+		then be controlled via <filename>/etc/nsswitch.conf</filename> file settings. The use of this parameter
+		disables the use of Samba with trusted domains (i.e., external domains).
+		</para>
+
+		<para>
+		<indexterm><primary>appliance mode</primary></indexterm>
+		<indexterm><primary>Domain Member</primary><secondary>server</secondary></indexterm>
+		<indexterm><primary>winbindd</primary></indexterm>
+		<indexterm><primary>automatically allocate</primary></indexterm>
+		Winbind can be used to create an appliance mode domain member server. In this capacity, <command>winbindd</command>
+		is configured to automatically allocate UIDs/GIDs from numeric ranges set in the &smb.conf; file. The allocation
+		is made for all accounts that connect to that domain member server, whether within its own domain or from
+		trusted domains. If not stored in an LDAP backend, each domain member maintains its own unique mapping database.
+		This means that it is almost certain that a given user who accesses two domain member servers does not have the
+		same UID/GID on both servers &smbmdash; however, this is transparent to the Windows network user. This data
+		is stored in the <filename>winbindd_idmap.tdb</filename> and <filename>winbindd_cache.tdb</filename> files.
+		</para>
+	
+		<para>
+		<indexterm><primary>mapping</primary></indexterm>
+		The use of an LDAP backend for the Winbind IDMAP facility permits Windows domain SIDs
+		mappings to UIDs/GIDs to be stored centrally. The result is a consistent mapping across all domain member
+		servers so configured. This solves one of the major headaches for network administrators who need to copy
+		files between or across network file servers.
+		</para>
+
+	</sect2>
+
+	<sect2>
+		<title>Political Issues</title>
+
+		<para>
+		<indexterm><primary>OpenLDAP</primary></indexterm>
+		<indexterm><primary>NIS</primary></indexterm>
+		<indexterm><primary>yellow pages</primary><see>NIS</see></indexterm>
+		<indexterm><primary>identity management</primary></indexterm>
+		One of the most fierce conflicts recently being waged is resistance to the adoption of LDAP, in
+		particular OpenLDAP, as a replacement for UNIX NIS (previously called Yellow Pages). Let's face it, LDAP
+		is different and requires a new approach to the need for a better identity management solution. The more
+		you work with LDAP, the more its power and flexibility emerges from its dark, cavernous chasm.
+		</para>
+
+		<para>
+		LDAP is a most suitable solution for heterogenous environments. If you need crypto, add Kerberos. 
+		The reason these are preferable is because they are heterogenous. Windows solutions of this sort are <emphasis>not</emphasis> 
+		heterogenous by design. This is fundamental &smbmdash; it isn't religious or political. This also doesn't say that 
+		you can't use Windows Active Directory in a heterogenous environment &smbmdash; it can be done, it just requires 
+		commercial integration products. But it's not what Active Directory was designed for.
+		</para>
+
+		<para>
+		<indexterm><primary>directory</primary></indexterm>
+		<indexterm><primary>management</primary></indexterm>
+		A number of long-term UNIX devotees have recently commented in various communications that the Samba Team
+		is the first application group to almost force network administrators to use LDAP. It should be pointed
+		out that we resisted this for as long as we could. It is not out of laziness or malice that LDAP has
+		finally emerged as the preferred identity management backend for Samba. We recommend LDAP for your total
+		organizational directory needs.
+		</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Implementation</title>
+
+	<para>
+	<indexterm><primary>Domain Member</primary><secondary>server</secondary></indexterm>
+	<indexterm><primary>Domain Member</primary><secondary>client</secondary></indexterm>
+	<indexterm><primary>Domain Controller</primary></indexterm>
+	The domain member server and the domain member client are at the center of focus in this chapter.
+	Configuration of Samba-3 domain controller is covered in earlier chapters, so if your 
+	interest is in domain controller configuration, you will not find that here. You will find good
+	oil that helps you to add domain member servers and clients.
+	</para>
+
+	<para>
+	<indexterm><primary>Domain Member</primary><secondary>workstations</secondary></indexterm>
+	In practice, domain member servers and domain member workstations are very different entities, but in
+	terms of technology they share similar core infrastructure. A technologist would argue that servers
+	and workstations are identical. Many users would argue otherwise, given that in a well-disciplined
+	environment a workstation (client) is a device from which a user creates documents and files that
+	are located on servers. A workstation is frequently viewed as a disposable (easy to replace) item,
+	but a server is viewed as a core component of the business.
+	</para>
+
+	<para>
+	<indexterm><primary>workstation</primary></indexterm>
+	We can look at this another way. If a workstation breaks down, one user is affected, but if a
+	server breaks down, hundreds of users may not be able to work. The services that a workstation
+	must provide are document- and file-production oriented; a server provides information storage
+	and is distribution oriented.
+	</para>
+
+	<para>
+	<indexterm><primary>authentication process</primary></indexterm>
+	<indexterm><primary>logon process</primary></indexterm>
+	<indexterm><primary>user identities</primary></indexterm>
+	<emphasis>Why is this important?</emphasis> For starters, we must identify what
+	components of the operating system and its environment must be configured. Also, it is necessary
+	to recognize where the interdependencies between the various services to be used are.
+	In particular, it is important to understand the operation of each critical part of the
+	authentication process, the logon process, and how user identities get resolved and applied
+	within the operating system and applications (like Samba) that depend on this and may
+	actually contribute to it.
+	</para>
+
+	<para>
+	So, in this chapter we demonstrate how to implement the technology. It is done within a context of
+	what type of service need must be fulfilled.
+	</para>
+
+	<sect2 id="sdcsdmldap">
+	<title>Samba Domain with Samba Domain Member Server &smbmdash; Using NSS LDAP</title>
+
+	<para>
+	<indexterm><primary>ldapsam</primary></indexterm>
+	<indexterm><primary>ldapsam backend</primary></indexterm>
+	<indexterm><primary>IDMAP</primary></indexterm>
+	<indexterm><primary>mapping</primary><secondary>consistent</secondary></indexterm>
+	<indexterm><primary>winbindd</primary></indexterm>
+	<indexterm><primary>foreign SID</primary></indexterm>
+	In this example, it is assumed that you have Samba PDC/BDC servers. This means you are using
+	an LDAP ldapsam backend. We are adding to the LDAP backend database (directory)
+	containers for use by the IDMAP facility. This makes it possible to have globally consistent
+	mapping of SIDs to and from UIDs and GIDs. This means that it is necessary to run 
+	<command>winbindd</command> as part of your configuration. The primary purpose of running
+	<command>winbindd</command> (within this operational context) is to permit mapping of foreign
+	SIDs (those not originating from the the local Samba server). Foreign SIDs can come from any
+	domain member client or server, or from Windows clients that do not belong to a domain. Another
+	way to explain the necessity to run <command>winbindd</command> is that Samba can locally
+	resolve only accounts that belong to the security context of its own machine SID. Winbind
+	handles all non-local SIDs and maps them to a local UID/GID value. The UID and GID are allocated
+	from the parameter values set in the &smb.conf; file for the <parameter>idmap uid</parameter> and
+	<parameter>idmap gid</parameter> ranges. Where LDAP is used, the mappings can be stored in LDAP
+	so that all domain member servers can use a consistent mapping.
+	</para>
+
+	<para>
+	<indexterm><primary>winbindd</primary></indexterm>
+	<indexterm><primary>getpwnam</primary></indexterm>
+	<indexterm><primary>NSS</primary></indexterm>
+	If your installation is accessed only from clients that are members of your own domain, and all 
+	user accounts are present in a local passdb backend then it is not necessary to run
+	<command>winbindd</command>. The local passdb backend can be in smbpasswd, tdbsam, or in ldapsam.
+	</para>
+
+	<para>
+	It is possible to use a local passdb backend with any convenient means of resolving the POSIX
+	user and group account information. The POSIX information is usually obtained using the
+	<command>getpwnam()</command> system call. On NSS-enabled systems, the actual POSIX account
+	source can be provided from
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		<indexterm><primary>/etc/passwd</primary></indexterm>
+		<indexterm><primary>/etc/group</primary></indexterm>
+		Accounts in <filename>/etc/passwd</filename> or in <filename>/etc/group</filename>.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>NSS</primary></indexterm>
+		<indexterm><primary>compat</primary></indexterm>
+		<indexterm><primary>ldap</primary></indexterm>
+		<indexterm><primary>nis</primary></indexterm>
+		<indexterm><primary>nisplus</primary></indexterm>
+		<indexterm><primary>hesiod</primary></indexterm>
+		<indexterm><primary>ldap</primary></indexterm>
+		<indexterm><primary>nss_ldap</primary></indexterm>
+		<indexterm><primary>PADL Software</primary></indexterm>
+		Resolution via NSS. On NSS-enabled systems, there is usually a facility to resolve IDs
+		via multiple methods. The methods typically include <command>files</command>,
+		<command>compat</command>, <command>db</command>, <command>ldap</command>, 
+		<command>nis</command>, <command>nisplus</command>, <command>hesiod.</command>  When
+		correctly installed, Samba adds to this list the <command>winbindd</command> facility.
+		The ldap facility is frequently the nss_ldap tool provided by PADL Software.
+		</para></listitem>
+	</itemizedlist>
+
+	<note><para>
+	To advoid confusion the use of the term <literal>local passdb backend</literal> means that
+	the user account backend is not shared by any other Samba server &smbmdash; instead, it is
+	used only locally on the Samba domain member server under discussion.
+	</para></note>
+
+	<para>
+	<indexterm><primary>Identity resolution</primary></indexterm>
+	The diagram in <link linkend="ch9-sambadc"/> demonstrates the relationship of Samba and system 
+	components that are involved in the identity resolution process where Samba is used as a domain
+	member server within a Samba domain control network.
+	</para>
+
+<image id="ch9-sambadc">
+	<imagedescription>Samba Domain: Samba Member Server</imagedescription>
+	<imagefile scale="60">chap9-SambaDC</imagefile>
+</image>
+
+	<para>
+	<indexterm><primary>IDMAP</primary></indexterm>
+	<indexterm><primary>foreign</primary></indexterm>
+	In this example configuration, Samba will directly search the LDAP-based passwd backend ldapsam
+	to obtain authentication and user identity information. The IDMAP information is stored in the LDAP
+	backend so that it can be shared by all domain member servers so that every user will have a
+	consistent UID and GID across all of them. The IDMAP facility will be used for all foreign
+	(i.e., not having the same SID as the domain it is a member of) domains. The configuration of 
+	NSS will ensure that all UNIX processes will obtain a consistent UID/GID.
+	</para>
+
+	<para>
+	The instructions given here apply to the Samba environment shown in <link linkend="happy"/> and <link linkend="2000users"/>.
+	If the network does not have an LDAP slave server (i.e., <link linkend="happy"/> configuration), 
+	change the target LDAP server from <constant>lapdc</constant> to <constant>massive.</constant>
+	</para>
+
+	<procedure>
+	<title>Configuration of NSS_LDAP-Based Identity Resolution</title>
+
+		<step><para>
+		Create the &smb.conf; file as shown in <link linkend="ch9-sdmsdc"/>. Locate
+		this file in the directory <filename>/etc/samba</filename>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>ldap.conf</primary></indexterm>
+		Configure the file that will be used by <constant>nss_ldap</constant> to
+		locate and communicate with the LDAP server. This file is called <filename>ldap.conf</filename>.
+		If your implementation of <constant>nss_ldap</constant> is consistent with
+		the defaults suggested by PADL (the authors), it will be located in the
+		<filename>/etc</filename> directory. On some systems, the default location is
+		the <filename>/etc/openldap</filename> directory, however this file is intended
+		for use by the OpenLDAP utilities and should not really be used by the nss_ldap
+		utility since its content and structure serves the specific purpose of enabling
+		the resolution of user and group IDs via NSS.
+		</para>
+
+		<para>
+		Change the parameters inside the file that is located on your OS so it matches
+		<link linkend="ch9-sdmlcnf"/>.  To find the correct location of this file, you
+		can obtain this from the library that will be used by executing the following:
+<screen>
+&rootprompt; strings /lib/libnss_ldap* | grep ldap.conf
+/etc/ldap.conf
+</screen>
+		</para></step>
+
+		<step><para>
+		Configure the NSS control file so it matches the one shown in
+		<link linkend="ch9-sdmnss"/>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>Identity resolution</primary></indexterm>
+		<indexterm><primary>getent</primary></indexterm>
+		Before proceeding to configure Samba, validate the operation of the NSS identity 
+		resolution via LDAP by executing:
+<screen>
+&rootprompt; getent passwd
+...
+root:x:0:512:Netbios Domain Administrator:/root:/bin/false
+nobody:x:999:514:nobody:/dev/null:/bin/false
+bobj:x:1000:513:Robert Jordan:/home/bobj:/bin/bash
+stans:x:1001:513:Stanley Soroka:/home/stans:/bin/bash
+chrisr:x:1002:513:Christine Roberson:/home/chrisr:/bin/bash
+maryv:x:1003:513:Mary Vortexis:/home/maryv:/bin/bash
+jht:x:1004:513:John H Terpstra:/home/jht:/bin/bash
+bldg1$:x:1006:553:bldg1$:/dev/null:/bin/false
+temptation$:x:1009:553:temptation$:/dev/null:/bin/false
+vaioboss$:x:1005:553:vaioboss$:/dev/null:/bin/false
+fran$:x:1008:553:fran$:/dev/null:/bin/false
+josephj:x:1007:513:Joseph James:/home/josephj:/bin/bash
+</screen>
+		You should notice the location of the users' home directories. First, make certain that
+		the home directories exist on the domain member server; otherwise, the home directory
+		share is not available. The home directories could be mounted off a domain controller
+		using NFS or by any other suitable means. Second, the absence of the domain name in the
+		home directory path is indicative that identity resolution is not being done via winbind.
+<screen>
+&rootprompt; getent group
+...
+Domain Admins:x:512:root,jht
+Domain Users:x:513:bobj,stans,chrisr,maryv,jht,josephj
+Domain Guests:x:514:
+Accounts:x:1000:
+Finances:x:1001:
+PIOps:x:1002:
+sammy:x:4321:
+</screen>
+		<indexterm><primary>secondary group</primary></indexterm>
+		<indexterm><primary>primary group</primary></indexterm>
+		<indexterm><primary>group membership</primary></indexterm>
+		This shows that all is working as it should be. Notice that in the LDAP database
+		the users' primary and secondary group memberships are identical. It is not
+		necessary to add secondary group memberships (in the group database) if the
+		user is already a member via primary group membership in the password database.
+		When using winbind, it is in fact undesirable to do this because it results in
+		doubling up of group memberships and may cause problems with winbind under certain 
+		conditions. It is intended that these limitations with winbind will be resolved soon
+		after Samba-3.0.20 has been released.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>slapcat</primary></indexterm>
+		The LDAP directory must have a container object for IDMAP data. There are several ways you can
+		check that your LDAP database is able to receive IDMAP information. One of the simplest is to
+		execute:
+<screen>
+&rootprompt; slapcat | grep -i idmap
+dn: ou=Idmap,dc=abmas,dc=biz
+ou: idmap
+</screen>
+		<indexterm><primary>ldapadd</primary></indexterm>
+		If the execution of this command does not return IDMAP entries, you need to create an LDIF
+		template file (see <link linkend="ch9-ldifadd"/>). You can add the required entries using
+		the following command:
+<screen>
+&rootprompt; ldapadd -x -D "cn=Manager,dc=abmas,dc=biz" \
+		-w not24get &lt; /etc/openldap/idmap.LDIF
+</screen>
+		</para></step>
+
+		<step><para>
+		Samba automatically populates the LDAP directory container when it needs to. To permit Samba
+		write access to the LDAP directory it is necessary to set the LDAP administrative password
+		in the <filename>secrets.tdb</filename> file as shown here:
+<screen>
+&rootprompt; smbpasswd -w not24get
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
+		<indexterm><primary>Domain join</primary></indexterm>
+		The system is ready to join the domain. Execute the following:
+<screen>
+&rootprompt; net rpc join -U root%not24get
+Joined domain MEGANET2.
+</screen>
+		This indicates that the domain join succeeded.
+		</para>
+
+		<para>
+		Failure to join the domain could be caused by any number of variables. The most common
+		causes of failure to join are:
+		</para>
+
+		<para>
+		<itemizedlist>
+			<listitem><para>Broken resolution of NetBIOS names to the respective IP address.</para></listitem>
+			<listitem><para>Incorrect username and password credentials.</para></listitem>
+			<listitem><para>The NT4 <parameter>restrict anonymous</parameter> is set to exclude anonymous
+				connections.</para></listitem>
+		</itemizedlist> 
+		</para>
+
+		<para>
+		The connection setup can be diagnosed by executing:
+<screen>
+&rootprompt; net rpc join -S 'pdc-name' -U administrator%password -d 5
+</screen>
+		<indexterm><primary>failed</primary></indexterm>
+		<indexterm><primary>failed join</primary></indexterm>
+		<indexterm><primary>rejected</primary></indexterm>
+		<indexterm><primary>restrict anonymous</primary></indexterm>
+		Note: Use "root" for UNIX/Linux and Samba, use "Administrator" for Windows NT4/200X. If the cause of
+		the failure appears to be related to a rejected or failed NT_SESSION_SETUP*  or an error message that
+		says NT_STATUS_ACCESS_DENIED immediately check the Windows registry setting that controls the
+		<constant>restrict anonymous</constant> setting. Set this to the value 0 so that an anonymous connection
+		can be sustained, then try again.
+		</para>
+
+		<para>
+		It is possible (perhaps even recommended) to use the following to validate the ability to connect
+		to an NT4 PDC/BDC:
+<screen>
+&rootprompt; net rpc info -S 'pdc-name' -U Administrator%not24get
+Domain Name: MEGANET2
+Domain SID: S-1-5-21-422319763-4138913805-7168186429
+Sequence number: 1519909596
+Num users: 7003
+Num domain groups: 821
+Num local groups: 8
+
+&rootprompt; net rpc testjoin -S 'pdc-name' -U Administrator%not24get
+Join to 'MEGANET2' is OK
+</screen>
+		If for any reason the following response is obtained to the last command above,it is time to
+		call in the Networking Super-Snooper task force (i.e., start debugging):
+<screen>
+NT_STATUS_ACCESS_DENIED
+Join to 'MEGANET2' failed.
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>wbinfo</primary></indexterm>
+		Just joining the domain is not quite enough; you must now provide a privileged set
+		of credentials through which <command>winbindd</command> can interact with the 
+		domain servers. Execute the following to implant the necessary credentials:
+<screen>
+&rootprompt; wbinfo --set-auth-user=Administrator%not24get
+</screen>
+		The configuration is now ready to obtain the Samba domain user and group information.
+		</para></step>
+
+		<step><para>
+		You may now start Samba in the usual manner, and your Samba domain member server
+		is ready for use. Just add shares as required.
+		</para></step>
+
+	</procedure>
+
+<smbconfexample id="ch9-sdmsdc">
+<title>Samba Domain Member in Samba Domain Using LDAP &smbmdash; &smb.conf; File</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="unix charset">LOCALE</smbconfoption>
+<smbconfoption name="workgroup">MEGANET2</smbconfoption>
+<smbconfoption name="security">DOMAIN</smbconfoption>
+<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+<smbconfoption name="log level">10</smbconfoption>
+<smbconfoption name="syslog">0</smbconfoption>
+<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+<smbconfoption name="max log size">50</smbconfoption>
+<smbconfoption name="smb ports">139 445</smbconfoption>
+<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="wins server">192.168.2.1</smbconfoption>
+<smbconfoption name="ldap suffix">dc=abmas,dc=biz</smbconfoption>
+<smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
+<smbconfoption name="ldap user suffix">ou=People</smbconfoption>
+<smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
+<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
+<smbconfoption name="ldap admin dn">cn=Manager,dc=abmas,dc=biz</smbconfoption>
+<smbconfoption name="idmap backend">ldap:ldap://lapdc.abmas.biz</smbconfoption>
+<smbconfoption name="idmap uid">10000-20000</smbconfoption>
+<smbconfoption name="idmap gid">10000-20000</smbconfoption>
+<smbconfoption name="winbind trusted domains only">Yes</smbconfoption>
+<smbconfoption name="printer admin">root</smbconfoption>
+<smbconfoption name="printing">cups</smbconfoption>
+
+<smbconfsection name="[homes]"/>
+<smbconfoption name="comment">Home Directories</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">SMB Print Spool</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[print$]"/>
+<smbconfoption name="comment">Printer Drivers</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
+<smbconfoption name="admin users">root, Administrator</smbconfoption>
+<smbconfoption name="write list">root</smbconfoption>
+</smbconfexample>
+
+<example id="ch9-ldifadd">
+<title>LDIF IDMAP Add-On Load File &smbmdash; File: /etc/openldap/idmap.LDIF</title>
+<screen>
+dn: ou=Idmap,dc=abmas,dc=biz
+objectClass: organizationalUnit
+ou: idmap
+structuralObjectClass: organizationalUnit
+</screen>
+</example>
+
+<example id="ch9-sdmlcnf">
+<title>Configuration File for NSS LDAP Support &smbmdash; <filename>/etc/ldap.conf</filename></title>
+<screen>
+URI     ldap://massive.abmas.biz ldap://massive.abmas.biz:636
+host    192.168.2.1
+base    dc=abmas,dc=biz
+binddn  cn=Manager,dc=abmas,dc=biz
+bindpw  not24get
+
+pam_password exop
+
+nss_base_passwd ou=People,dc=abmas,dc=biz?one
+nss_base_shadow ou=People,dc=abmas,dc=biz?one
+nss_base_group  ou=Groups,dc=abmas,dc=biz?one
+ssl     no
+</screen>
+</example>
+
+<example id="ch9-sdmnss">
+<title>NSS using LDAP for Identity Resolution &smbmdash; File: <filename>/etc/nsswitch.conf</filename></title>
+<screen>
+passwd:         files ldap
+shadow:         files ldap
+group:          files ldap
+
+hosts:          files dns wins
+networks:       files dns
+
+services:       files
+protocols:      files
+rpc:            files
+ethers:         files
+netmasks:       files
+netgroup:       files
+publickey:      files
+
+bootparams:     files
+automount:      files
+aliases:        files
+</screen>
+</example>
+
+	</sect2>
+
+	<sect2 id="wdcsdm">
+		<title>NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</title>
+
+	<para>
+	You need to use this method for creating a Samba domain member server if any of the following conditions
+	prevail:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		LDAP support (client) is not installed on the system.
+		</para></listitem>
+
+		<listitem><para>
+		There are mitigating circumstances forcing a decision not to use LDAP.
+		</para></listitem>
+
+		<listitem><para>
+		The Samba domain member server must be part of a Windows NT4 Domain, or a Samba Domain.
+		</para></listitem>
+	</itemizedlist>
+
+	<para>
+	<indexterm><primary>Windows ADS Domain</primary></indexterm>
+	<indexterm><primary>Samba Domain</primary></indexterm>
+	<indexterm><primary>LDAP</primary></indexterm>
+	Later in the chapter, you can see how to configure a Samba domain member server for a Windows ADS domain.
+	Right now your objective is to configure a Samba server that can be a member of a Windows NT4-style
+	domain and/or does not use LDAP.
+	</para>
+
+	<note><para>
+	<indexterm><primary>duplicate accounts</primary></indexterm>
+	If you use <command>winbind</command> for identity resolution, make sure that there are no
+	duplicate accounts.
+	</para>
+
+	<para>
+	<indexterm><primary>/etc/passwd</primary></indexterm>
+	For example, do not have more than one account that has UID=0 in the password database. If there 
+	is an account called <constant>root</constant> in the <filename>/etc/passwd</filename> database, 
+	it is okay to have an account called <constant>root</constant> in the LDAP ldapsam or in the 
+	tdbsam. But if there are two accounts in the passdb backend that have the same UID, winbind will 
+	break. This means that the <constant>Administrator</constant> account must be called 
+	<constant>root</constant>.
+	</para>
+
+	<para>
+	<indexterm><primary>/etc/passwd</primary></indexterm>
+	<indexterm><primary>ldapsam</primary></indexterm>
+	<indexterm><primary>tdbsam</primary></indexterm>
+	Winbind will break if there is an account in <filename>/etc/passwd</filename> that has 
+	the same UID as an account that is in LDAP ldapsam (or in tdbsam) but that differs in name only.
+	</para></note>
+
+	<para>
+	<indexterm><primary>credentials</primary></indexterm>
+	<indexterm><primary>traverse</primary></indexterm>
+	<indexterm><primary>wide-area</primary></indexterm>
+	<indexterm><primary>network</primary><secondary>wide-area</secondary></indexterm>
+	<indexterm><primary>tdbdump</primary></indexterm>
+	The following configuration uses CIFS/SMB protocols alone to obtain user and group credentials.
+	The winbind information is locally cached in the <filename>winbindd_cache.tdb winbindd_idmap.tdb</filename>
+	files. This provides considerable performance benefits compared with the LDAP solution, particularly
+	where the LDAP lookups must traverse WAN links. You may examine the contents of these
+	files using the tool <command>tdbdump</command>, though you may have to build this from the Samba
+	source code if it has not been supplied as part of a binary package distribution that you may be using.
+	</para>
+
+	<procedure>
+	<title>Configuration of Winbind-Based Identity Resolution</title>
+
+		<step><para>
+		Using your favorite text editor, create the &smb.conf; file so it has the contents
+		shown in <link linkend="ch0-NT4DSDM"/>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+		Edit the <filename>/etc/nsswitch.conf</filename> so it has the entries shown in
+		<link linkend="ch9-sdmnss"/>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
+		The system is ready to join the domain. Execute the following:
+<screen>
+net rpc join -U root%not2g4et
+Joined domain MEGANET2.
+</screen>
+		This indicates that the domain join succeed.
+
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>winbind</primary></indexterm>
+		<indexterm><primary>wbinfo</primary></indexterm>
+		Validate operation of <command>winbind</command> using the <command>wbinfo</command>
+		tool as follows:
+<screen>
+&rootprompt; wbinfo -u
+MEGANET2+root
+MEGANET2+nobody
+MEGANET2+jht
+MEGANET2+maryv
+MEGANET2+billr
+MEGANET2+jelliott
+MEGANET2+dbrady
+MEGANET2+joeg
+MEGANET2+balap
+</screen>
+		This shows that domain users have been listed correctly.
+<screen>
+&rootprompt; wbinfo -g
+MEGANET2+Domain Admins
+MEGANET2+Domain Users
+MEGANET2+Domain Guests
+MEGANET2+Accounts
+MEGANET2+Finances
+MEGANET2+PIOps
+</screen>
+		This shows that domain groups have been correctly obtained also.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>NSS</primary></indexterm>
+		<indexterm><primary>getent</primary></indexterm>
+		<indexterm><primary>winbind</primary></indexterm>
+		The next step verifies that NSS is able to obtain this information
+		correctly from <command>winbind</command> also.
+<screen>
+&rootprompt; getent passwd
+...
+MEGANET2+root:x:10000:10001:NetBIOS Domain Admin:
+                      /home/MEGANET2/root:/bin/bash
+MEGANET2+nobody:x:10001:10001:nobody:
+                      /home/MEGANET2/nobody:/bin/bash
+MEGANET2+jht:x:10002:10001:John H Terpstra:
+                      /home/MEGANET2/jht:/bin/bash
+MEGANET2+maryv:x:10003:10001:Mary Vortexis:
+                      /home/MEGANET2/maryv:/bin/bash
+MEGANET2+billr:x:10004:10001:William Randalph:
+                      /home/MEGANET2/billr:/bin/bash
+MEGANET2+jelliott:x:10005:10001:John G Elliott:
+                      /home/MEGANET2/jelliott:/bin/bash
+MEGANET2+dbrady:x:10006:10001:Darren Brady:
+                      /home/MEGANET2/dbrady:/bin/bash
+MEGANET2+joeg:x:10007:10001:Joe Green:
+                      /home/MEGANET2/joeg:/bin/bash
+MEGANET2+balap:x:10008:10001:Bala Pillay:
+                      /home/MEGANET2/balap:/bin/bash
+</screen>
+		The user account information has been correctly obtained. This information has
+		been merged with the winbind template information configured in the &smb.conf; file.
+<screen>
+&rootprompt;# getent group
+...
+MEGANET2+Domain Admins:x:10000:MEGANET2+root,MEGANET2+jht
+MEGANET2+Domain Users:x:10001:MEGANET2+jht,MEGANET2+maryv,\
+        MEGANET2+billr,MEGANET2+jelliott,MEGANET2+dbrady,\
+        MEGANET2+joeg,MEGANET2+balap
+MEGANET2+Domain Guests:x:10002:MEGANET2+nobody
+MEGANET2+Accounts:x:10003:
+MEGANET2+Finances:x:10004:
+MEGANET2+PIOps:x:10005:
+</screen>
+		</para></step>
+
+		<step><para>
+		The Samba member server of a Windows NT4 domain is ready for use.
+		</para></step>
+
+	</procedure>
+
+<smbconfexample id="ch0-NT4DSDM">
+<title>Samba Domain Member Server Using Winbind &smb.conf; File for NT4 Domain</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="unix charset">LOCALE</smbconfoption>
+<smbconfoption name="workgroup">MEGANET2</smbconfoption>
+<smbconfoption name="security">DOMAIN</smbconfoption>
+<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+<smbconfoption name="log level">1</smbconfoption>
+<smbconfoption name="syslog">0</smbconfoption>
+<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+<smbconfoption name="max log size">0</smbconfoption>
+<smbconfoption name="smb ports">139 445</smbconfoption>
+<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="wins server">192.168.2.1</smbconfoption>
+<smbconfoption name="idmap uid">10000-20000</smbconfoption>
+<smbconfoption name="idmap gid">10000-20000</smbconfoption>
+<smbconfoption name="template primary group">"Domain Users"</smbconfoption>
+<smbconfoption name="template shell">/bin/bash</smbconfoption>
+<smbconfoption name="winbind separator">+</smbconfoption>
+<smbconfoption name="printer admin">root</smbconfoption>
+<smbconfoption name="hosts allow">192.168.2., 192.168.3., 127.</smbconfoption>
+<smbconfoption name="printing">cups</smbconfoption>
+
+<smbconfsection name="[homes]"/>
+<smbconfoption name="comment">Home Directories</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">SMB Print Spool</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[print$]"/>
+<smbconfoption name="comment">Printer Drivers</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
+<smbconfoption name="admin users">root, Administrator</smbconfoption>
+<smbconfoption name="write list">root</smbconfoption>
+</smbconfexample>
+
+	</sect2>
+
+	<sect2 id="dcwonss">
+	<title>NT4/Samba Domain with Samba Domain Member Server without NSS Support</title>
+
+	<para>
+	No matter how many UNIX/Linux administrators there may be who believe that a UNIX operating
+	system that does not have NSS and PAM support to be outdated, the fact is there
+	are still many such systems in use today. Samba can be used without NSS support, but this
+	does limit it to the use of local user and group accounts only.
+	</para>
+
+	<para>
+	The following steps may be followed to implement Samba with support for local accounts.
+	In this configuration Samba is made a domain member server. All incoming connections
+	to the Samba server will cause the look-up of the incoming username. If the account
+	is found, it is used. If the account is not found, one will be automatically created
+	on the local machine so that it can then be used for all access controls.
+	</para>
+
+	<procedure>
+	<title>Configuration Using Local Accounts Only</title>
+
+		<step><para>
+		Using your favorite text editor, create the &smb.conf; file so it has the contents
+		shown in <link linkend="ch0-NT4DSCM"/>.
+		</para></step>
+
+		<step>
+		<para><indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
+		The system is ready to join the domain. Execute the following:
+<screen>
+net rpc join -U root%not24get
+Joined domain MEGANET2.
+</screen>
+		This indicates that the domain join succeed.
+		</para></step>
+
+		<step><para>
+		Be sure to run all three Samba daemons: <command>smbd</command>, <command>nmbd</command>, <command>winbindd</command>.
+		</para></step>
+
+		<step><para>
+		The Samba member server of a Windows NT4 domain is ready for use.
+		</para></step>
+	</procedure>
+
+<smbconfexample id="ch0-NT4DSCM">
+<title>Samba Domain Member Server Using Local Accounts &smb.conf; File for NT4 Domain</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="unix charset">LOCALE</smbconfoption>
+<smbconfoption name="workgroup">MEGANET3</smbconfoption>
+<smbconfoption name="netbios name">BSDBOX</smbconfoption>
+<smbconfoption name="security">DOMAIN</smbconfoption>
+<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+<smbconfoption name="log level">1</smbconfoption>
+<smbconfoption name="syslog">0</smbconfoption>
+<smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption>
+<smbconfoption name="add machine script">/usr/sbin/useradd -M '%u'</smbconfoption>
+<smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
+<smbconfoption name="winbind enable local accounts">Yes</smbconfoption>
+<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+<smbconfoption name="max log size">0</smbconfoption>
+<smbconfoption name="smb ports">139 445</smbconfoption>
+<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="wins server">192.168.2.1</smbconfoption>
+<smbconfoption name="printer admin">root</smbconfoption>
+<smbconfoption name="hosts allow">192.168.2., 192.168.3., 127.</smbconfoption>
+<smbconfoption name="printing">cups</smbconfoption>
+
+<smbconfsection name="[homes]"/>
+<smbconfoption name="comment">Home Directories</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">SMB Print Spool</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[print$]"/>
+<smbconfoption name="comment">Printer Drivers</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
+<smbconfoption name="admin users">root, Administrator</smbconfoption>
+<smbconfoption name="write list">root</smbconfoption>
+</smbconfexample>
+	</sect2>
+
+	<sect2 id="adssdm">
+	<title>Active Directory Domain with Samba Domain Member Server</title>
+
+	<para>
+	<indexterm><primary>Active Directory</primary><secondary>join</secondary></indexterm>
+	<indexterm><primary>Kerberos</primary></indexterm>
+	<indexterm><primary>Domain Member</primary><secondary>server</secondary></indexterm>
+	One of the much-sought-after features new to Samba-3 is the ability to join an Active Directory
+	domain using Kerberos protocols. This makes it possible to operate an entire Windows network
+	without the need to run NetBIOS over TCP/IP and permits more secure networking in general. An
+	exhaustively complete discussion of the protocols is not possible in this book; perhaps a
+	later book may explore the intricacies of the NetBIOS-less operation that Samba-3 can participate
+	in. For now, we simply focus on how a Samba-3 server can be made a domain member server.
+	</para>
+
+	<para>
+	<indexterm><primary>Active Directory</primary></indexterm>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>Identity resolution</primary></indexterm>
+	<indexterm><primary>Kerberos</primary></indexterm>
+	The diagram in <link linkend="ch9-adsdc"/> demonstrates how Samba-3 interfaces with
+	Microsoft Active Directory components. It should be noted that if Microsoft Windows Services
+	for UNIX (SFU) has been installed and correctly configured, it is possible to use client LDAP
+	for identity resolution just as can be done with Samba-3 when using an LDAP passdb backend.
+	The UNIX tool that you need for this, as in the case of LDAP on UNIX/Linux, is the PADL
+	Software nss_ldap tool-set. Compared with use of winbind and Kerberos, the use of 
+	LDAP-based identity resolution is a little less secure. In view of the fact that this solution
+	requires additional software to be installed on the Windows 200x ADS domain controllers,
+	and that means more management overhead, it is likely that most Samba-3 ADS client sites
+	may elect to use winbind.
+	</para>
+
+	<para>
+	Do not attempt to use this procedure if you are not 100 percent certain that the build of Samba-3
+	you are using has been compiled and linked with all the tools necessary for this to work.
+	Given the importance of this step, you must first validate that the Samba-3 message block
+	daemon (<command>smbd</command>) has the necessary features.
+	</para>
+
+	<para>
+	The hypothetical domain you are using in this example assumes that the Abmas London office
+	decided to take its own lead (some would say this is a typical behavior in a global
+	corporate world; besides, a little divergence and conflict makes for an interesting life).
+	The Windows Server 2003 ADS domain is called <constant>london.abmas.biz</constant> and the
+	name of the server is <constant>W2K3S</constant>. In ADS realm terms, the domain controller
+	is known as <constant>w2k3s.london.abmas.biz</constant>. In NetBIOS nomenclature, the
+	domain name is <constant>LONDON</constant> and the server name is <constant>W2K3S</constant>.
+	</para>
+
+	<image id="ch9-adsdc">
+		<imagedescription>Active Directory Domain: Samba Member Server</imagedescription>
+		<imagefile scale="60">chap9-ADSDC</imagefile>
+	</image>
+
+	<procedure>
+	<title>Joining a Samba Server as an ADS Domain Member</title>
+
+		<step><para>
+		<indexterm><primary>smbd</primary></indexterm>
+		Before you try to use Samba-3, you want to know for certain that your executables have
+		support for Kerberos and for LDAP. Execute the following to identify whether or
+		not this build is perhaps suitable for use:
+<screen>
+&rootprompt; cd /usr/sbin
+&rootprompt; smbd -b | grep KRB
+   HAVE_KRB5_H
+   HAVE_ADDR_TYPE_IN_KRB5_ADDRESS
+   HAVE_KRB5
+   HAVE_KRB5_AUTH_CON_SETKEY
+   HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES
+   HAVE_KRB5_GET_PW_SALT
+   HAVE_KRB5_KEYBLOCK_KEYVALUE
+   HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK
+   HAVE_KRB5_MK_REQ_EXTENDED
+   HAVE_KRB5_PRINCIPAL_GET_COMP_STRING
+   HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES
+   HAVE_KRB5_STRING_TO_KEY
+   HAVE_KRB5_STRING_TO_KEY_SALT
+   HAVE_LIBKRB5
+</screen>
+		This output was obtained on a SUSE Linux system and shows the output for
+		Samba that has been compiled and linked with the Heimdal Kerberos libraries.
+		The following is a typical output that will be found on a Red Hat Linux system that
+		has been linked with the MIT Kerberos libraries:
+<screen>
+&rootprompt; cd /usr/sbin
+&rootprompt; smbd -b | grep KRB
+   HAVE_KRB5_H
+   HAVE_ADDRTYPE_IN_KRB5_ADDRESS
+   HAVE_KRB5
+   HAVE_KRB5_AUTH_CON_SETUSERUSERKEY
+   HAVE_KRB5_ENCRYPT_DATA
+   HAVE_KRB5_FREE_DATA_CONTENTS
+   HAVE_KRB5_FREE_KTYPES
+   HAVE_KRB5_GET_PERMITTED_ENCTYPES
+   HAVE_KRB5_KEYTAB_ENTRY_KEY
+   HAVE_KRB5_LOCATE_KDC
+   HAVE_KRB5_MK_REQ_EXTENDED
+   HAVE_KRB5_PRINCIPAL2SALT
+   HAVE_KRB5_PRINC_COMPONENT
+   HAVE_KRB5_SET_DEFAULT_TGS_KTYPES
+   HAVE_KRB5_SET_REAL_TIME
+   HAVE_KRB5_STRING_TO_KEY
+   HAVE_KRB5_TKT_ENC_PART2
+   HAVE_KRB5_USE_ENCTYPE
+   HAVE_LIBGSSAPI_KRB5
+   HAVE_LIBKRB5
+</screen>
+		You can validate that Samba has been compiled and linked with LDAP support
+		by executing:
+<screen>
+&rootprompt; smbd -b | grep LDAP
+massive:/usr/sbin # smbd -b | grep LDAP
+   HAVE_LDAP_H
+   HAVE_LDAP
+   HAVE_LDAP_DOMAIN2HOSTLIST
+   HAVE_LDAP_INIT
+   HAVE_LDAP_INITIALIZE
+   HAVE_LDAP_SET_REBIND_PROC
+   HAVE_LIBLDAP
+   LDAP_SET_REBIND_PROC_ARGS
+</screen>
+		This does look promising; <command>smbd</command> has been built with Kerberos and LDAP
+		support. You are relieved to know that it is safe to progress.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>Kerberos</primary><secondary>libraries</secondary></indexterm>
+		<indexterm><primary>MIT Kerberos</primary></indexterm>
+		<indexterm><primary>Heimdal Kerberos</primary></indexterm>
+		<indexterm><primary>Kerberos</primary><secondary>MIT</secondary></indexterm>
+		<indexterm><primary>Kerberos</primary><secondary>Heimdal</secondary></indexterm>
+		<indexterm><primary>Red Hat Linux</primary></indexterm>
+		<indexterm><primary>SUSE Linux</primary></indexterm>
+		<indexterm><primary>SerNet</primary></indexterm>
+		<indexterm><primary>validated</primary></indexterm>
+		The next step is to identify which version of the Kerberos libraries have been used.
+		In order to permit Samba-3 to interoperate with Windows 2003 Active Directory, it is
+		essential that it has been linked with either MIT Kerberos version 1.3.1 or later,
+		or that it has been linked with Heimdal Kerberos 0.6 plus specific patches. You may
+		identify what version of the MIT Kerberos libraries are installed on your system by
+		executing (on Red Hat Linux):
+<screen>
+&rootprompt; rpm -q krb5
+</screen>
+		Or on SUSE Linux, execute:
+<screen>
+&rootprompt; rpm -q heimdal
+</screen>
+		Please note that the RPMs provided by the Samba-Team are known to be working and have
+		been validated. Red Hat Linux RPMs may be obtained from the Samba FTP sites. SUSE
+		Linux RPMs may be obtained from <ulink url="ftp://ftp.sernet.de">Sernet</ulink> in
+		Germany.
+		</para>
+
+		<para>
+		From this point on, you are certain that the Samba-3 build you are using has the
+		necessary capabilities. You can now configure Samba-3 and the NSS. 
+		</para></step>
+
+		<step><para>
+		Using you favorite editor, configure the &smb.conf; file that is located in the 
+		<filename>/etc/samba</filename> directory so that it has the contents shown 
+		in <link linkend="ch9-adssdm"/>.
+		</para></step>
+
+		<step><para>
+		Edit or create the NSS control file so it has the contents shown in <link linkend="ch9-sdmnss"/>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/samba/secrets.tdb</primary></indexterm>
+		Delete the file <filename>/etc/samba/secrets.tdb</filename> if it exists. Of course, you
+		do keep a backup, don't you?
+		</para></step>
+
+		<step><para>
+		Delete the tdb files that cache Samba information. You keep a backup of the old
+		files, of course. You also remove all files to ensure that nothing can pollute your
+		nice, new configuration. Execute the following (example is for SUSE Linux):
+<screen>
+&rootprompt; rm /var/lib/samba/*tdb
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>testparm</primary></indexterm>
+		Validate your &smb.conf; file using <command>testparm</command> (as you have
+		done previously). Correct all errors reported before proceeding. The command you
+		execute is:
+<screen>
+&rootprompt; testparm -s | less
+</screen>
+		Now that you are satisfied that your Samba server is ready to join the Windows
+		ADS domain, let's move on.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>join</tertiary></indexterm>
+		<indexterm><primary>Kerberos</primary></indexterm>
+		This is a good time to double-check everything and then execute the following
+		command when everything you have done has checked out okay:
+<screen>
+&rootprompt; net ads join -UAdministrator%not24get
+Using short domain name -- LONDON
+Joined 'FRAN' to realm 'LONDON.ABMAS.BIZ'
+</screen>
+		You have successfully made your Samba-3 server a member of the ADS domain
+		using Kerberos protocols.
+		</para>
+
+	    <para>
+		<indexterm><primary>silent return</primary></indexterm>
+		<indexterm><primary>failed join</primary></indexterm>
+		In the event that you receive no output messages, a silent return means that the
+		domain join failed. You should use <command>ethereal</command> to identify what
+		may be failing. Common causes of a failed join include:
+
+		<itemizedlist>
+			<listitem><para>
+			<indexterm><primary>name resolution</primary><secondary>Defective</secondary></indexterm>
+			Defective or misconfigured DNS name resolution.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>Restrictive security</primary></indexterm>
+			Restrictive security settings on the Windows 200x ADS domain controller
+			preventing needed communications protocols. You can check this by searching
+			the Windows Server 200x Event Viewer.
+			</para></listitem>
+
+			<listitem><para>
+			Incorrectly configured &smb.conf; file settings.
+			</para></listitem>
+
+			<listitem><para>
+			Lack of support of necessary Kerberos protocols because the version of MIT
+			Kerberos (or Heimdal) in use is not up to date enough to support the necessary
+			functionality.
+			</para></listitem>
+		</itemizedlist>
+
+		<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
+		<indexterm><primary>RPC</primary></indexterm>
+		<indexterm><primary>mixed mode</primary></indexterm>
+		In any case, never execute the <command>net rpc join</command> command in an attempt
+		to join the Samba server to the domain, unless you wish not to use the Kerberos
+		security protocols. Use of the older RPC-based domain join facility requires that
+		Windows Server 200x ADS has been configured appropriately for mixed mode operation.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>tdbdump</primary></indexterm>
+		<indexterm><primary>/etc/samba/secrets.tdb</primary></indexterm>
+		If the <command>tdbdump</command> is installed on your system (not essential),
+		you can look inside the <filename>/etc/samba/secrets.tdb</filename> file. If
+		you wish to do this, execute:
+<screen>
+&rootprompt; tdbdump secrets.tdb
+{
+key = "SECRETS/SID/LONDON"
+data = "\01\04\00\00\00\00\00\05\15\00\00\00\EBw\86\F1\ED\BD\
+   F6{\5C6\E5W\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\
+   00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\
+   00\00\00\00\00\00\00\00"
+}
+{
+key = "SECRETS/MACHINE_PASSWORD/LONDON"
+data = "le3Q5FPnN5.ueC\00"
+}
+{
+key = "SECRETS/MACHINE_SEC_CHANNEL_TYPE/LONDON"
+data = "\02\00\00\00"
+}
+{
+key = "SECRETS/MACHINE_LAST_CHANGE_TIME/LONDON"
+data = "E\89\F6?"
+}
+</screen>
+		This is given to demonstrate to the skeptics that this process truly does work.
+		</para></step>
+
+		<step><para>
+		It is now time to start Samba in the usual way (as has been done many time before
+		in this book).	
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>wbinfo</primary></indexterm>
+		This is a good time to verify that everything is working. First, check that
+		winbind is able to obtain the list of users and groups from the ADS domain controller.
+		Execute the following:
+<screen>
+&rootprompt; wbinfo -u
+LONDON+Administrator
+LONDON+Guest
+LONDON+SUPPORT_388945a0
+LONDON+krbtgt
+LONDON+jht
+</screen>
+		Good, the list of users was obtained. Now do likewise for group accounts:
+<screen>
+&rootprompt; wbinfo -g
+LONDON+Domain Computers
+LONDON+Domain Controllers
+LONDON+Schema Admins
+LONDON+Enterprise Admins
+LONDON+Domain Admins
+LONDON+Domain Users
+LONDON+Domain Guests
+LONDON+Group Policy Creator Owners
+LONDON+DnsUpdateProxy
+</screen>
+		Excellent. That worked also, as expected.
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>getent</primary>
+	      </indexterm>
+		Now repeat this via NSS to validate that full identity resolution is
+		functional as required. Execute:
+<screen>
+&rootprompt; getent passwd
+...
+LONDON+Administrator:x:10000:10000:Administrator:
+             /home/LONDON/administrator:/bin/bash
+LONDON+Guest:x:10001:10001:Guest:
+             /home/LONDON/guest:/bin/bash
+LONDON+SUPPORT_388945a0:x:10002:10000:SUPPORT_388945a0:
+             /home/LONDON/support_388945a0:/bin/bash
+LONDON+krbtgt:x:10003:10000:krbtgt:
+             /home/LONDON/krbtgt:/bin/bash
+LONDON+jht:x:10004:10000:John H. Terpstra:
+             /home/LONDON/jht:/bin/bash
+</screen>
+		Okay, ADS user accounts are being resolved. Now you try group resolution:
+<screen>
+&rootprompt; getent group
+...
+LONDON+Domain Computers:x:10002:
+LONDON+Domain Controllers:x:10003:
+LONDON+Schema Admins:x:10004:LONDON+Administrator
+LONDON+Enterprise Admins:x:10005:LONDON+Administrator
+LONDON+Domain Admins:x:10006:LONDON+jht,LONDON+Administrator
+LONDON+Domain Users:x:10000:
+LONDON+Domain Guests:x:10001:
+LONDON+Group Policy Creator Owners:x:10007:LONDON+Administrator
+LONDON+DnsUpdateProxy:x:10008:
+</screen>
+		This is very pleasing. Everything works as expected.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>info</tertiary></indexterm>
+		<indexterm><primary>Active Directory</primary><secondary>server</secondary></indexterm>
+		<indexterm><primary>Kerberos</primary></indexterm>
+		You may now perform final verification that communications between Samba-3 winbind and
+		the Active Directory server is using Kerberos protocols. Execute the following:
+<screen>
+&rootprompt; net ads info
+LDAP server: 192.168.2.123
+LDAP server name: w2k3s
+Realm: LONDON.ABMAS.BIZ
+Bind Path: dc=LONDON,dc=ABMAS,dc=BIZ
+LDAP port: 389
+Server time: Sat, 03 Jan 2004 02:44:44 GMT
+KDC server: 192.168.2.123
+Server time offset: 2
+</screen>
+		It should be noted that Kerberos protocols are time-clock critical. You should
+		keep all server time clocks synchronized using the network time protocol (NTP).
+		In any case, the output we obtained confirms that all systems are operational.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>status</tertiary></indexterm>
+		There is one more action you elect to take, just because you are paranoid and disbelieving,
+		so you execute the following command:
+<programlisting>
+&rootprompt; net ads status -UAdministrator%not24get
+objectClass: top
+objectClass: person
+objectClass: organizationalPerson
+objectClass: user
+objectClass: computer
+cn: fran
+distinguishedName: CN=fran,CN=Computers,DC=london,DC=abmas,DC=biz
+instanceType: 4
+whenCreated: 20040103092006.0Z
+whenChanged: 20040103092006.0Z
+uSNCreated: 28713
+uSNChanged: 28717
+name: fran
+objectGUID: 58f89519-c467-49b9-acb0-f099d73696e
+userAccountControl: 69632
+badPwdCount: 0
+codePage: 0
+countryCode: 0
+badPasswordTime: 0
+lastLogoff: 0
+lastLogon: 127175965783327936
+localPolicyFlags: 0
+pwdLastSet: 127175952062598496
+primaryGroupID: 515
+objectSid: S-1-5-21-4052121579-2079768045-1474639452-1109
+accountExpires: 9223372036854775807
+logonCount: 13
+sAMAccountName: fran$
+sAMAccountType: 805306369
+operatingSystem: Samba
+operatingSystemVersion: 3.0.20-SUSE
+dNSHostName: fran
+userPrincipalName: HOST/fran@LONDON.ABMAS.BIZ
+servicePrincipalName: CIFS/fran.london.abmas.biz
+servicePrincipalName: CIFS/fran
+servicePrincipalName: HOST/fran.london.abmas.biz
+servicePrincipalName: HOST/fran
+objectCategory: CN=Computer,CN=Schema,CN=Configuration,
+                              DC=london,DC=abmas,DC=biz
+isCriticalSystemObject: FALSE
+-------------- Security Descriptor (revision: 1, type: 0x8c14)
+owner SID: S-1-5-21-4052121579-2079768045-1474639452-512
+group SID: S-1-5-21-4052121579-2079768045-1474639452-513
+------- (system) ACL (revision: 4, size: 120, number of ACEs: 2)
+------- ACE (type: 0x07, flags: 0x5a, size: 0x38, 
+               mask: 0x20, object flags: 0x3)
+access SID:  S-1-1-0
+access type: AUDIT OBJECT
+Permissions:
+        [Write All Properties]
+------- ACE (type: 0x07, flags: 0x5a, size: 0x38, 
+               mask: 0x20, object flags: 0x3)
+access SID:  S-1-1-0
+access type: AUDIT OBJECT
+Permissions:
+        [Write All Properties]
+------- (user) ACL (revision: 4, size: 1944, number of ACEs: 40)
+------- ACE (type: 0x00, flags: 0x00, size: 0x24, mask: 0xf01ff)
+access SID:  S-1-5-21-4052121579-2079768045-1474639452-512
+access type: ALLOWED
+Permissions: [Full Control]
+------- ACE (type: 0x00, flags: 0x00, size: 0x18, mask: 0xf01ff)
+access SID:  S-1-5-32-548
+...
+------- ACE (type: 0x05, flags: 0x12, size: 0x38, 
+                mask: 0x10, object flags: 0x3)
+access SID:  S-1-5-9
+access type: ALLOWED OBJECT
+Permissions:
+        [Read All Properties]
+-------------- End Of Security Descriptor
+</programlisting>
+		And now you have conclusive proof that your Samba-3 ADS domain member server
+		called <constant>FRAN</constant> is able to communicate fully with the ADS
+		domain controllers.
+		</para></step>
+
+	</procedure>
+
+
+	<para>
+	Your Samba-3 ADS domain member server is ready for use. During training sessions,
+	you may be asked what is inside the <filename>winbindd_cache.tdb and winbindd_idmap.tdb</filename>
+	files. Since curiosity just took hold of you, execute the following:
+<programlisting>
+&rootprompt; tdbdump /var/lib/samba/winbindd_idmap.tdb
+{
+key = "S-1-5-21-4052121579-2079768045-1474639452-501\00"
+data = "UID 10001\00"
+}
+{
+key = "UID 10005\00"
+data = "S-1-5-21-4052121579-2079768045-1474639452-1111\00"
+}
+{
+key = "GID 10004\00"
+data = "S-1-5-21-4052121579-2079768045-1474639452-518\00"
+}
+{
+key = "S-1-5-21-4052121579-2079768045-1474639452-502\00"
+data = "UID 10003\00"
+}
+...
+
+&rootprompt; tdbdump /var/lib/samba/winbindd_cache.tdb
+{
+key = "UL/LONDON"
+data = "\00\00\00\00bp\00\00\06\00\00\00\0DAdministrator\0D
+   Administrator-S-1-5-21-4052121579-2079768045-1474639452-500-
+   S-1-5-21-4052121579-2079768045-1474639452-513\05Guest\05
+   Guest-S-1-5-21-4052121579-2079768045-1474639452-501-
+   S-1-5-21-4052121579-2079768045-1474639452-514\10
+   SUPPORT_388945a0\10SUPPORT_388945a0.
+   S-1-5-21-4052121579-2079768045-1474639452-1001-
+   S-1-5-21-4052121579-2079768045-1474639452-513\06krbtgt\06
+   krbtgt-S-1-5-21-4052121579-2079768045-1474639452-502-
+   S-1-5-21-4052121579-2079768045-1474639452-513\03jht\10
+   John H. Terpstra.S-1-5-21-4052121579-2079768045-1474639452-1110-
+   S-1-5-21-4052121579-2079768045-1474639452-513"
+}
+{
+key = "GM/S-1-5-21-4052121579-2079768045-1474639452-512"
+data = "\00\00\00\00bp\00\00\02\00\00\00.
+   S-1-5-21-4052121579-2079768045-1474639452-1110\03
+   jht\01\00\00\00-S-1-5-21-4052121579-2079768045-1474639452-500\0D
+   Administrator\01\00\00\00"
+}
+{
+key = "SN/S-1-5-21-4052121579-2079768045-1474639452-513"
+data = "\00\00\00\00xp\00\00\02\00\00\00\0CDomain Users"
+}
+{
+key = "GM/S-1-5-21-4052121579-2079768045-1474639452-518"
+data = "\00\00\00\00bp\00\00\01\00\00\00-
+   S-1-5-21-4052121579-2079768045-1474639452-500\0D
+   Administrator\01\00\00\00"
+}
+{
+key = "SEQNUM/LONDON\00"
+data = "xp\00\00C\92\F6?"
+}
+{
+key = "U/S-1-5-21-4052121579-2079768045-1474639452-1110"
+data = "\00\00\00\00xp\00\00\03jht\10John H. Terpstra.
+   S-1-5-21-4052121579-2079768045-1474639452-1110-
+   S-1-5-21-4052121579-2079768045-1474639452-513"
+}
+{
+key = "NS/S-1-5-21-4052121579-2079768045-1474639452-502"
+data = "\00\00\00\00bp\00\00-
+   S-1-5-21-4052121579-2079768045-1474639452-502"
+}
+{
+key = "SN/S-1-5-21-4052121579-2079768045-1474639452-1001"
+data = "\00\00\00\00bp\00\00\01\00\00\00\10SUPPORT_388945a0"
+}
+{
+key = "SN/S-1-5-21-4052121579-2079768045-1474639452-500"
+data = "\00\00\00\00bp\00\00\01\00\00\00\0DAdministrator"
+}
+{
+key = "U/S-1-5-21-4052121579-2079768045-1474639452-502"
+data = "\00\00\00\00bp\00\00\06krbtgt\06krbtgt-
+   S-1-5-21-4052121579-2079768045-1474639452-502-
+   S-1-5-21-4052121579-2079768045-1474639452-513"
+}
+....
+</programlisting>
+	Now all is revealed. Your curiosity, as well as that of your team, has been put at ease.
+	May this server serve well all who happen upon it.
+	</para>
+
+<smbconfexample id="ch9-adssdm">
+<title>Samba Domain Member &smb.conf; File for Active Directory Membership</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="unix charset">LOCALE</smbconfoption>
+<smbconfoption name="workgroup">LONDON</smbconfoption>
+<smbconfoption name="realm">LONDON.ABMAS.BIZ</smbconfoption>
+<smbconfoption name="server string">Samba 3.0.20</smbconfoption>
+<smbconfoption name="security">ADS</smbconfoption>
+<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+<smbconfoption name="log level">1</smbconfoption>
+<smbconfoption name="syslog">0</smbconfoption>
+<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+<smbconfoption name="max log size">50</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="ldap ssl">no</smbconfoption>
+<smbconfoption name="idmap uid">10000-20000</smbconfoption>
+<smbconfoption name="idmap gid">10000-20000</smbconfoption>
+<smbconfoption name="template primary group">"Domain Users"</smbconfoption>
+<smbconfoption name="template shell">/bin/bash</smbconfoption>
+<smbconfoption name="winbind separator">+</smbconfoption>
+<smbconfoption name="printing">cups</smbconfoption>
+
+<smbconfsection name="[homes]"/>
+<smbconfoption name="comment">Home Directories</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">SMB Print Spool</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[print$]"/>
+<smbconfoption name="comment">Printer Drivers</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
+<smbconfoption name="admin users">root, Administrator</smbconfoption>
+<smbconfoption name="write list">root</smbconfoption>
+</smbconfexample>
+
+        <sect3>
+        <title>IDMAP_RID with Winbind</title>
+
+        <para>
+        <indexterm><primary>idmap_rid</primary></indexterm>
+        <indexterm><primary>SID</primary></indexterm>
+        <indexterm><primary>RID</primary></indexterm>
+        <indexterm><primary>IDMAP</primary></indexterm>
+        The <command>idmap_rid</command> facility is a new tool that, unlike native winbind, creates a
+        predictable mapping of MS Windows SIDs to UNIX UIDs and GIDs. The key benefit of this method
+        of implementing the Samba IDMAP facility is that it eliminates the need to store the IDMAP data
+        in a central place. The downside is that it can be used only within a single ADS domain and
+        is not compatible with trusted domain implementations.
+        </para>
+
+        <para>
+        <indexterm><primary>SID</primary></indexterm>
+        <indexterm><primary>allow trusted domains</primary></indexterm>
+        <indexterm><primary>idmap uid</primary></indexterm>
+        <indexterm><primary>idmap gid</primary></indexterm>
+        This alternate method of SID to UID/GID  mapping can be achieved with the idmap_rid
+        plug-in. This plug-in uses the RID of the user SID to derive the UID and GID by adding the
+        RID to a base value specified. This utility requires that the parameter
+        <quote>allow trusted domains = No</quote> must be specified, as it is not compatible
+        with multiple domain environments. The <parameter>idmap uid</parameter> and
+        <parameter>idmap gid</parameter> ranges must be specified.
+        </para>
+
+        <para>
+        <indexterm><primary>idmap_rid</primary></indexterm>
+        <indexterm><primary>realm</primary></indexterm>
+        The idmap_rid facility can be used both for NT4/Samba-style domains as well as with Active Directory.
+        To use this with an NT4 domain, the <parameter>realm</parameter> is not used. Additionally the
+        method used to join the domain uses the <constant>net rpc join</constant> process.
+        </para>
+
+        <para>
+        An example &smb.conf; file for an ADS domain environment is shown in <link linkend="sbe-idmapridex"/>.
+        </para>
+
+<smbconfexample id="sbe-idmapridex">
+<title>Example &smb.conf; File Using <constant>idmap_rid</constant></title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">KPAK</smbconfoption>
+<smbconfoption name="netbios name">BIGJOE</smbconfoption>
+<smbconfoption name="realm">CORP.KPAK.COM</smbconfoption>
+<smbconfoption name="server string">Office Server</smbconfoption>
+<smbconfoption name="security">ADS</smbconfoption>
+<smbconfoption name="allow trusted domains">No</smbconfoption>
+<smbconfoption name="idmap backend">idmap_rid:KPAK=500-100000000</smbconfoption>
+<smbconfoption name="idmap uid">500-100000000</smbconfoption>
+<smbconfoption name="idmap gid">500-100000000</smbconfoption>
+<smbconfoption name="template shell">/bin/bash</smbconfoption>
+<smbconfoption name="winbind use default domain">Yes</smbconfoption>
+<smbconfoption name="winbind enum users">No</smbconfoption>
+<smbconfoption name="winbind enum groups">No</smbconfoption>
+<smbconfoption name="winbind nested groups">Yes</smbconfoption>
+<smbconfoption name="printer admin">"KPAK\Domain Admins"</smbconfoption>
+</smbconfexample>
+
+        <para>
+        <indexterm><primary>large domain</primary></indexterm>
+        <indexterm><primary>Active Directory</primary></indexterm>
+        <indexterm><primary>response</primary></indexterm>
+        <indexterm><primary>getent</primary></indexterm>
+        In a large domain with many users, it is imperative to disable enumeration of users and groups.
+        For example, at a site that has 22,000 users in Active Directory the winbind-based user and
+        group resolution is unavailable for nearly 12 minutes following first start-up of
+        <command>winbind</command>. Disabling of such enumeration results in instantaneous response.
+        The disabling of user and group enumeration means that it will not be possible to list users
+        or groups using the <command>getent passwd</command> and <command>getent group</command>
+        commands. It will be possible to perform the lookup for individual users, as shown in the procedure
+        below.
+        </para>
+
+        <para>
+        <indexterm><primary>NSS</primary></indexterm>
+        <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+        The use of this tool requires configuration of NSS as per the native use of winbind. Edit the
+        <filename>/etc/nsswitch.conf</filename> so it has the following parameters:
+<screen>
+...
+passwd: files winbind
+shadow: files winbind
+group:  files winbind
+...
+hosts:  files wins
+...
+</screen>
+        </para>
+
+        <para>
+        The following procedure can be used to utilize the idmap_rid facility:
+        </para>
+
+        <procedure>
+                <step><para>
+                Create or install and &smb.conf; file with the above configuration.
+                </para></step>
+
+                <step><para>
+                Edit the <filename>/etc/nsswitch.conf</filename> file as shown above.
+                </para></step>
+
+                <step><para>
+                Execute:
+<screen>
+&rootprompt; net ads join -UAdministrator%password
+Using short domain name -- KPAK
+Joined 'BIGJOE' to realm 'CORP.KPAK.COM'
+</screen>
+                </para>
+
+                <para>
+                <indexterm><primary>failed join</primary></indexterm>
+                An invalid or failed join can be detected by executing:
+<screen>
+&rootprompt; net ads testjoin
+BIGJOE$@'s password:
+[2004/11/05 16:53:03, 0] utils/net_ads.c:ads_startup(186)
+  ads_connect: No results returned
+Join to domain is not valid
+</screen>
+                The specific error message may differ from the above because it depends on the type of failure that
+                may have occurred. Increase the <parameter>log level</parameter> to 10, repeat the above test,
+                and then examine the log files produced to identify the nature of the failure.
+                </para></step>
+
+                <step><para>
+                Start the <command>nmbd</command>, <command>winbind,</command> and <command>smbd</command> daemons in the order shown.
+                </para></step>
+
+                <step><para>
+                Validate the operation of this configuration by executing:
+                <indexterm><primary></primary></indexterm>
+<screen>
+&rootprompt; getent passwd administrator
+administrator:x:1000:1013:Administrator:/home/BE/administrator:/bin/bash
+</screen>
+                </para></step>
+        </procedure>
+
+        </sect3>
+
+        <sect3>
+        <title>IDMAP Storage in LDAP using Winbind</title>
+
+        <para>
+        <indexterm><primary>ADAM</primary></indexterm>
+        <indexterm><primary>ADS</primary></indexterm>
+        The storage of IDMAP information in LDAP can be used with both NT4/Samba-3-style domains as well as
+        with ADS domains. OpenLDAP is a commonly used LDAP server for this purpose, although any standards-compliant
+        LDAP server can be used. It is therefore possible to deploy this IDMAP configuration using
+        the Sun iPlanet LDAP server, Novell eDirectory, Microsoft ADS plus ADAM, and so on.
+        </para>
+
+        <para>
+        The example in <link linkend="sbeunxa"/> is for an ADS-style domain.
+        </para>
+
+<smbconfexample id="sbeunxa">
+<title>Typical ADS Style Domain &smb.conf; File</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">SNOWSHOW</smbconfoption>
+<smbconfoption name="netbios name">GOODELF</smbconfoption>
+<smbconfoption name="realm">SNOWSHOW.COM</smbconfoption>
+<smbconfoption name="server string">Samba Server</smbconfoption>
+<smbconfoption name="security">ADS</smbconfoption>
+<smbconfoption name="log level">1 ads:10 auth:10 sam:10 rpc:10</smbconfoption>
+<smbconfoption name="ldap admin dn">cn=Manager,dc=SNOWSHOW,dc=COM</smbconfoption>
+<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
+<smbconfoption name="ldap suffix">dc=SNOWSHOW,dc=COM</smbconfoption>
+<smbconfoption name="idmap backend">ldap:ldap://ldap.snowshow.com</smbconfoption>
+<smbconfoption name="idmap uid">150000-550000</smbconfoption>
+<smbconfoption name="idmap gid">150000-550000</smbconfoption>
+<smbconfoption name="template shell">/bin/bash</smbconfoption>
+<smbconfoption name="winbind use default domain">Yes</smbconfoption>
+</smbconfexample>
+
+        <para>
+        <indexterm><primary>realm</primary></indexterm>
+        In the case of an NT4 or Samba-3-style domain the <parameter>realm</parameter> is not used, and the
+        command used to join the domain is <command>net rpc join</command>. The above example also demonstrates
+        advanced error reporting techniques that are documented in the chapter called "Reporting Bugs" in
+	<quote>The Official Samba-3 HOWTO and Reference Guide</quote> (TOSHARG).
+        </para>
+
+        <para>
+        <indexterm><primary>MIT kerberos</primary></indexterm>
+        <indexterm><primary>Heimdal kerberos</primary></indexterm>
+        <indexterm><primary>/etc/krb5.conf</primary></indexterm>
+        Where MIT kerberos is installed (version 1.3.4 or later), edit the <filename>/etc/krb5.conf</filename>
+        file so it has the following contents:
+<screen>
+[logging]
+ default = FILE:/var/log/krb5libs.log
+ kdc = FILE:/var/log/krb5kdc.log
+ admin_server = FILE:/var/log/kadmind.log
+
+[libdefaults]
+ default_realm = SNOWSHOW.COM
+ dns_lookup_realm = false
+ dns_lookup_kdc = true
+
+[appdefaults]
+ pam = {
+   debug = false
+   ticket_lifetime = 36000
+   renew_lifetime = 36000
+   forwardable = true
+   krb4_convert = false
+ }
+</screen>
+        </para>
+
+        <para>
+        Where Heimdal kerberos is installed, edit the <filename>/etc/krb5.conf</filename>
+        file so it is either empty (i.e., no contents) or it has the following contents:
+<screen>
+[libdefaults]
+        default_realm = SNOWSHOW.COM
+        clockskew = 300
+
+[realms]
+        SNOWSHOW.COM = {
+                kdc = ADSDC.SHOWSHOW.COM
+        }
+
+[domain_realm]
+        .snowshow.com = SNOWSHOW.COM
+</screen>
+        </para>
+
+        <note><para>
+        Samba cannot use the Heimdal libraries if there is no <filename>/etc/krb5.conf</filename> file.
+        So long as there is an empty file, the Heimdal kerberos libraries will be usable. There is no
+        need to specify any settings because Samba, using the Heimdal libraries, can figure this out automatically.
+        </para></note>
+        <para>
+        Edit the NSS control file <filename>/etc/nsswitch.conf</filename> so it has the following entries:
+<screen>
+...
+passwd: files ldap
+shadow: files ldap
+group:  files ldap
+...
+hosts:  files wins
+...
+</screen>
+        </para>
+
+        <para>
+        <indexterm><primary>PADL</primary></indexterm>
+        <indexterm><primary>/etc/ldap.conf</primary></indexterm>
+        You will need the <ulink url="http://www.padl.com">PADL</ulink> <command>nss_ldap</command>
+        tool set for this solution. Configure the <filename>/etc/ldap.conf</filename> file so it has
+        the information needed. The following is an example of a working file:
+<screen>
+host    192.168.2.1
+base    dc=snowshow,dc=com
+binddn  cn=Manager,dc=snowshow,dc=com
+bindpw  not24get
+
+pam_password exop
+
+nss_base_passwd ou=People,dc=snowshow,dc=com?one
+nss_base_shadow ou=People,dc=snowshow,dc=com?one
+nss_base_group  ou=Groups,dc=snowshow,dc=com?one
+ssl     no
+</screen>
+        </para>
+
+        <para>
+        The following procedure may be followed to affect a working configuration:
+        </para>
+        <procedure>
+                <step><para>
+                Configure the &smb.conf; file as shown above.
+                </para></step>
+
+                <step><para>
+                Create the <filename>/etc/krb5.conf</filename> file following the indications above.
+                </para></step>
+
+                <step><para>
+                Configure the <filename>/etc/nsswitch.conf</filename> file as shown above.
+                </para></step>
+
+                <step><para>
+                Download, build, and install the PADL nss_ldap tool set. Configure the
+                <filename>/etc/ldap.conf</filename> file as shown above.
+                </para></step>
+
+                <step><para>
+                Configure an LDAP server and initialize the directory with the top-level entries needed by IDMAP
+                as shown in the following LDIF file:
+<screen>
+dn: dc=snowshow,dc=com
+objectClass: dcObject
+objectClass: organization
+dc: snowshow
+o: The Greatest Snow Show in Singapore.
+description: Posix and Samba LDAP Identity Database
+
+dn: cn=Manager,dc=snowshow,dc=com
+objectClass: organizationalRole
+cn: Manager
+description: Directory Manager
+
+dn: ou=Idmap,dc=snowshow,dc=com
+objectClass: organizationalUnit
+ou: idmap
+</screen>
+                </para></step>
+
+                <step><para>
+                Execute the command to join the Samba domain member server to the ADS domain as shown here:
+<screen>
+&rootprompt; net ads testjoin
+Using short domain name -- SNOWSHOW
+Joined 'GOODELF' to realm 'SNOWSHOW.COM'
+</screen>
+                </para></step>
+
+                <step><para>
+                Store the LDAP server access password in the Samba <filename>secrets.tdb</filename> file as follows:
+<screen>
+&rootprompt; smbpasswd -w not24get
+</screen>
+                </para></step>
+
+                <step><para>
+                Start the <command>nmbd</command>, <command>winbind</command>, and <command>smbd</command> daemons in the order shown.
+                </para></step>
+        </procedure>
+
+
+        <para>
+        <indexterm><primary>diagnostic</primary></indexterm>
+        Follow the diagnostic procedures shown earlier in this chapter to identify success or failure of the join.
+        In many cases a failure is indicated by a silent return to the command prompt with no indication of the
+        reason for failure.
+        </para>
+
+        </sect3>
+
+        <sect3>
+        <title>IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</title>
+
+        <para>
+        <indexterm><primary>rfc2307bis</primary></indexterm>
+        <indexterm><primary>schema</primary></indexterm>
+        The use of this method is messy. The information provided in this section is for guidance only
+        and is very definitely not complete. This method does work; it is used in a number of large sites
+        and has an acceptable level of performance.
+        </para>
+
+        <para>
+        An example &smb.conf; file is shown in <link linkend="sbewinbindex"/>.
+        </para>
+
+<smbconfexample id="sbewinbindex">
+<title>ADS Membership Using RFC2307bis Identity Resolution &smb.conf; File</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">BUBBAH</smbconfoption>
+<smbconfoption name="netbios name">MADMAX</smbconfoption>
+<smbconfoption name="realm">BUBBAH.COM</smbconfoption>
+<smbconfoption name="server string">Samba Server</smbconfoption>
+<smbconfoption name="security">ADS</smbconfoption>
+<smbconfoption name="idmap uid">150000-550000</smbconfoption>
+<smbconfoption name="idmap gid">150000-550000</smbconfoption>
+<smbconfoption name="template shell">/bin/bash</smbconfoption>
+<smbconfoption name="winbind use default domain">Yes</smbconfoption>
+<smbconfoption name="winbind trusted domains only">Yes</smbconfoption>
+<smbconfoption name="winbind nested groups">Yes</smbconfoption>
+</smbconfexample>
+
+        <para>
+        <indexterm><primary>nss_ldap</primary></indexterm>
+        The DMS must be joined to the domain using the usual procedure. Additionally, it is necessary
+        to build and install the PADL nss_ldap tool set. Be sure to build this tool set with the
+        following:
+<screen>
+./configure --enable-rfc2307bis --enable-schema-mapping
+make install
+</screen>
+        </para>
+
+        <para>
+        <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+        The following <filename>/etc/nsswitch.conf</filename> file contents are required:
+<screen>
+...
+passwd: files ldap
+shadow: files ldap
+group:  files ldap
+...
+hosts:  files wins
+...
+</screen>
+        </para>
+
+        <para>
+        <indexterm><primary>/etc/ldap.conf</primary></indexterm>
+        <indexterm><primary>nss_ldap</primary></indexterm>
+        The <filename>/etc/ldap.conf</filename> file must be configured also. Refer to the PADL documentation
+        and source code for nss_ldap instructions.
+        </para>
+
+        <para>
+        The next step involves preparation on the ADS schema. This is briefly discussed in the remaining
+        part of this chapter.
+        </para>
+
+                <sect4>
+                <title>IDMAP, Active Directory, and MS Services for UNIX 3.5</title>
+
+                <para>
+                <indexterm><primary>SFU</primary></indexterm>
+                The Microsoft Windows Service for UNIX version 3.5 is available for free
+                <ulink url="http://www.microsoft.com/windows/sfu/">download</ulink>
+                from the Microsoft Web site. You will need to download this tool and install it following
+                Microsoft instructions.
+                </para>
+
+                </sect4>
+
+                <sect4>
+                <title>IDMAP, Active Directory, and AD4UNIX</title>
+
+                <para>
+                Instructions for obtaining and installing the AD4UNIX tool set can be found from the
+                <ulink url="http://www.geekcomix.com/cgi-bin/classnotes/wiki.pl?LDAP01/An_Alternative_Approach">
+                Geekcomix</ulink> Web site.
+                </para>
+
+                </sect4>
+
+        </sect3>
+
+        </sect2>
+
+
+	<sect2>
+	<title>UNIX/Linux Client Domain Member</title>
+
+	<para><indexterm>
+	    <primary>user credentials</primary>
+	  </indexterm>
+	So far this chapter has been mainly concerned with the provision of file and print
+	services for domain member servers. However, an increasing number of UNIX/Linux
+	workstations are being installed that do not act as file or print servers to anyone
+	other than a single desktop user. The key demand for desktop systems is to be able
+	to log onto any UNIX/Linux or Windows desktop using the same network user credentials.
+	</para>
+
+	<para><indexterm>
+	    <primary>Single Sign-On</primary>
+	    <see>SSO</see>
+	  </indexterm>
+	The ability to use a common set of user credential across a variety of network systems
+	is generally regarded as a single sign-on (SSO) solution. SSO systems are sold by a
+	large number of vendors and include a range of technologies such as:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		Proxy sign-on
+		</para></listitem>
+
+		<listitem><para>
+		Federated directory provisioning
+		</para></listitem>
+
+		<listitem><para>
+		Metadirectory server solutions
+		</para></listitem>
+
+		<listitem><para>
+		Replacement authentication systems
+		</para></listitem>
+	</itemizedlist>
+
+	<para><indexterm>
+	    <primary>Identity management</primary>
+	  </indexterm>
+	There are really only three solutions that provide integrated authentication and
+	user identity management facilities:
+	</para>
+
+	<itemizedlist>
+                <listitem><para>
+		Samba winbind (free)
+                </para></listitem>
+
+                <listitem><para>
+		<ulink url="http://www.padl.com">PADL</ulink> PAM and LDAP tools (free)
+                </para></listitem>
+
+                <listitem><para>
+		<ulink url="http://www.vintela.com">Vintela</ulink> Authentication Services (commercial)
+                </para></listitem>
+        </itemizedlist>
+
+	<para>
+	The following guidelines are pertinent to the deployment of winbind-based authentication
+	and identity resolution with the express purpose of allowing users to log on to UNIX/Linux desktops
+	using Windows network domain user credentials (username and password).
+	</para>
+
+	<para>
+	You should note that it is possible to use LDAP-based PAM and NSS tools to permit distributed
+	systems logons (SSO), providing user and group accounts are stored in an LDAP directory. This
+	provides logon services for UNIX/Linux users, while Windows users obtain their sign-on
+	support via Samba-3.
+	</para>
+
+	<para>
+	<indexterm><primary>Windows Services for UNIX</primary><see>SUS</see></indexterm>
+	On the other hand, if the authentication and identity resolution backend must be provided by
+	a Windows NT4-style domain or from an Active Directory Domain that does not have the Microsoft
+	Windows Services for UNIX installed, winbind is your best friend. Specific guidance for these
+	situations now follows.
+	</para>
+
+	<para>
+	<indexterm><primary>PAM</primary></indexterm>
+	<indexterm><primary>Identity resolution</primary></indexterm>
+	<indexterm><primary>NSS</primary></indexterm>
+	To permit users to log on to a Linux system using Windows network credentials, you need to
+	configure identity resolution (NSS) and PAM. This means that the basic steps include those
+	outlined above with the addition of PAM configuration. Given that most workstations (desktop/client)
+	usually do not need to provide file and print services to a group of users, the configuration
+	of shares and printers is generally less important. Often this allows the share specifications
+	to be entirely removed from the &smb.conf; file. That is obviously an administrator decision.
+	</para>
+
+		<sect3>
+		<title>NT4 Domain Member</title>
+
+		<para>
+		The following steps provide a Linux system that users can log onto using
+		Windows NT4 (or Samba-3) domain network credentials:
+		</para>
+
+		<procedure>
+			<step><para>
+			Follow the steps outlined in <link linkend="wdcsdm"/> and ensure that
+			all validation tests function as shown.
+			</para></step>
+
+			<step><para>
+			Identify what services users must log on to. On Red Hat Linux, if it is
+			intended that the user shall be given access to all services, it may be
+			most expeditious to simply configure the file 
+			<filename>/etc/pam.d/system-auth</filename>.
+			</para></step>
+
+			<step><para>
+			Carefully make a backup copy of all PAM configuration files before you
+			begin making changes. If you break the PAM configuration, please note
+			that you may need to use an emergency boot process to recover your Linux
+			system. It is possible to break the ability to log into the system if
+			PAM files are incorrectly configured. The entire directory 
+			<filename>/etc/pam.d</filename> should be backed up to a safe location.
+			</para></step>
+
+			<step><para>
+			If you require only console login support, edit the <filename>/etc/pam.d/login</filename>
+			so it matches <link linkend="ch9-pamwnbdlogin"/>.
+			</para></step>
+
+			<step><para>
+			To provide the ability to log onto the graphical desktop interface, you must edit
+			the files <filename>gdm</filename> and <filename>xdm</filename> in the 
+			<filename>/etc/pam.d</filename> directory.
+			</para></step>
+
+			<step><para>
+			Edit only one file at a time. Carefully validate its operation before attempting
+			to reboot the machine.
+			</para></step>
+		</procedure>
+
+		</sect3>
+
+		<sect3>
+		<title>ADS Domain Member</title>
+
+		<para>
+		This procedure should be followed to permit a Linux network client (workstation/desktop)
+		to permit users to log on using Microsoft Active Directory-based user credentials.
+		</para>
+
+		<procedure>
+			<step><para>
+			Follow the steps outlined in <link linkend="adssdm"/> and ensure that
+			all validation tests function as shown.
+			</para></step>
+
+			<step><para>
+			Identify what services users must log on to. On Red Hat Linux, if it is
+			intended that the user shall be given access to all services, it may be
+			most expeditious to simply configure the file 
+			<filename>/etc/pam.d/system-auth</filename> as shown in <link linkend="ch9-rhsysauth"/>.
+			</para></step>
+
+			<step><para>
+			Carefully make a backup copy of all PAM configuration files before you
+			begin making changes. If you break the PAM configuration, please note
+			that you may need to use an emergency boot process to recover your Linux
+			system. It is possible to break the ability to log into the system if
+			PAM files are incorrectly configured. The entire directory 
+			<filename>/etc/pam.d</filename> should be backed up to a safe location.
+			</para></step>
+
+			<step><para>
+			If you require only console login support, edit the <filename>/etc/pam.d/login</filename>
+			so it matches <link linkend="ch9-pamwnbdlogin"/>.
+			</para></step>
+
+			<step><para>
+			To provide the ability to log onto the graphical desktop interface, you must edit
+			the files <filename>gdm</filename> and <filename>xdm</filename> in the 
+			<filename>/etc/pam.d</filename> directory.
+			</para></step>
+
+			<step><para>
+			Edit only one file at a time. Carefully validate its operation before attempting
+			to reboot the machine.
+			</para></step>
+		</procedure>
+
+		</sect3>
+
+<example id="ch9-pamwnbdlogin">
+<title>SUSE: PAM <filename>login</filename> Module Using Winbind</title>
+<screen>
+# /etc/pam.d/login
+
+#%PAM-1.0
+auth sufficient pam_unix2.so    nullok
+auth sufficient pam_winbind.so use_first_pass use_authtok
+auth required   pam_securetty.so
+auth required   pam_nologin.so
+auth required   pam_env.so
+auth required   pam_mail.so
+account sufficient      pam_unix2.so
+account sufficient      pam_winbind.so user_first_pass use_authtok
+password required       pam_pwcheck.so  nullok
+password sufficient     pam_unix2.so    nullok use_first_pass use_authtok
+password sufficient     pam_winbind.so  use_first_pass use_authtok
+session sufficient      pam_unix2.so    none
+session sufficient      pam_winbind.so  use_first_pass use_authtok
+session required        pam_limits.so
+</screen>
+</example>
+
+<example id="ch9-pamwbndxdm">
+<title>SUSE: PAM <filename>xdm</filename> Module Using Winbind</title>
+<screen>
+# /etc/pam.d/gdm (/etc/pam.d/xdm)
+
+#%PAM-1.0
+auth     sufficient     pam_unix2.so     nullok
+auth     sufficient     pam_winbind.so   use_first_pass use_authtok
+account  sufficient     pam_unix2.so
+account  sufficient     pam_winbind.so   use_first_pass use_authtok
+password sufficient     pam_unix2.so
+password sufficient     pam_winbind.so   use_first_pass use_authtok
+session  sufficient     pam_unix2.so
+session  sufficient     pam_winbind.so   use_first_pass use_authtok
+session  required       pam_dev perm.so
+session  required       pam_resmgr.so
+</screen>
+</example>
+
+<example id="ch9-rhsysauth">
+<title>Red Hat 9: PAM System Authentication File: <filename>/etc/pam.d/system-auth</filename> Module Using Winbind</title>
+<screen>
+#%PAM-1.0
+auth        required      /lib/security/$ISA/pam_env.so
+auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
+auth        sufficient    /lib/security/$ISA/pam_winbind.so use_first_pass
+auth        required      /lib/security/$ISA/pam_deny.so
+
+account     required      /lib/security/$ISA/pam_unix.so
+account     sufficient    /lib/security/$ISA/pam_winbind.so use_first_pass
+
+password    required      /lib/security/$ISA/pam_cracklib.so retry=3 type=
+# Note: The above line is complete. There is nothing following the '='
+password    sufficient    /lib/security/$ISA/pam_unix.so \
+                                             nullok use_authtok md5 shadow
+password    sufficient    /lib/security/$ISA/pam_winbind.so use_first_pass
+password    required      /lib/security/$ISA/pam_deny.so
+
+session     required      /lib/security/$ISA/pam_limits.so
+session     sufficient    /lib/security/$ISA/pam_unix.so
+session     sufficient    /lib/security/$ISA/pam_winbind.so use_first_pass
+</screen>
+</example>
+
+	</sect2>
+
+	<sect2>
+		<title>Key Points Learned</title>
+
+		<para>
+		The addition of UNIX/Linux Samba servers and clients is a common requirement. In this chapter, you
+		learned how to integrate such servers so that the UID/GID mappings they use can be consistent
+		across all domain member servers. You also discovered how to implement the ability to use Samba
+		or Windows domain account credentials to log on to a UNIX/Linux client.
+		</para>
+
+		<para>
+		The following are key points made in this chapter:
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			Domain controllers are always authoritative for the domain.
+			</para></listitem>
+
+			<listitem><para>
+			Domain members may have local accounts and must be able to resolve the identity of 
+			domain user accounts. Domain user account identity must map to a local UID/GID. That 
+			local UID/GID can be stored in LDAP. This way, it is possible to share the IDMAP data 
+			across all domain member machines.
+			</para></listitem>
+
+			<listitem><para>
+			Resolution of user and group identities on domain member machines may be implemented 
+			using direct LDAP services or using winbind.
+			</para></listitem>
+
+			<listitem><para>
+			On NSS/PAM enabled UNIX/Linux systems, NSS is responsible for identity management 
+			and PAM is responsible for authentication of logon credentials (username and password).
+			</para></listitem>
+		</itemizedlist>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Questions and Answers</title>
+
+	<para>
+	The following questions were obtained from the mailing list and also from private discussions
+	with Windows network administrators.
+	</para>
+
+	<qandaset defaultlabel="chap09qa" type="number">
+	<qandaentry>
+	<question>
+
+		<para>
+		We use NIS for all UNIX accounts. Why do we need winbind?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para>
+		<indexterm><primary>NIS</primary></indexterm>
+		<indexterm><primary>encrypted passwords</primary></indexterm>
+		<indexterm><primary>smbpasswd</primary></indexterm>
+		<indexterm><primary>tdbsam</primary></indexterm>
+		<indexterm><primary>passdb backend</primary></indexterm>
+		<indexterm><primary>Winbind</primary></indexterm>
+		You can use NIS for your UNIX accounts. NIS does not store the Windows encrypted
+		passwords that need to be stored in one of the acceptable passdb backends.
+		Your choice of backend is limited to <parameter>smbpasswd</parameter> or
+		<parameter>tdbsam</parameter>. Winbind is needed to handle the resolution of
+		SIDs from trusted domains to local UID/GID values.
+		</para>
+
+	    <para>
+		<indexterm><primary>winbind trusted domains only</primary></indexterm>
+		<indexterm><primary>getpwnam()</primary></indexterm>
+		On a domain member server, you effectively map Windows domain users to local users
+		that are in your NIS database by specifying the <parameter>winbind trusted domains
+		only</parameter>. This causes user and group account lookups to be routed via
+		the <command>getpwnam()</command> family of systems calls. On an NIS-enabled client,
+		this pushes the resolution of users and groups out through NIS.
+		</para>
+
+		<para>
+		As a general rule, it is always a good idea to run winbind on all Samba servers.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Our IT management people do not like LDAP but are looking at Microsoft Active Directory. 
+	      Which is better?<indexterm>
+		<primary>Active Directory</primary>
+	      </indexterm>
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>LDAP</primary>
+		<secondary>server</secondary>
+	      </indexterm><indexterm>
+		<primary>Kerberos</primary>
+	      </indexterm><indexterm>
+		<primary>schema</primary>
+	      </indexterm>
+		Microsoft Active Directory is an LDAP server that is intricately tied to a Kerberos
+		infrastructure. Most IT managers who object to LDAP do so because
+		an LDAP server is most often supplied as a raw tool that needs to be configured and
+		for which the administrator must create the schema, create the administration tools, and
+		devise the backup and recovery facilities in a site-dependent manner. LDAP servers
+		in general are seen as a high-energy, high-risk facility.
+		</para>
+
+	    <para><indexterm>
+		<primary>management</primary>
+	      </indexterm>
+		Microsoft Active Directory by comparison is easy to install and configure and
+		is supplied with all tools necessary to implement and manage the directory. For sites
+		that lack a lot of technical competence, Active Directory is a good choice. For sites
+		that have the technical competence to handle Active Directory well, LDAP is a good
+		alternative. The real issue is, What type of solution does
+		the site want? If management wants a choice to use an alternative, they may want to
+		consider the options. On the other hand, if management just wants a solution that works,
+		Microsoft Active Directory is a good solution.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible 
+		to use NIS in place of LDAP?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>NIS</primary>
+	      </indexterm><indexterm>
+		<primary>LDAP</primary>
+	      </indexterm><indexterm>
+		<primary>encrypted passwords</primary>
+	      </indexterm><indexterm>
+		<primary>synchronized</primary>
+	      </indexterm><indexterm>
+		<primary>secure account password</primary>
+	      </indexterm><indexterm>
+		<primary>PDC</primary>
+	      </indexterm><indexterm>
+		<primary>BDC</primary>
+	      </indexterm>
+		Yes, it is possible to use NIS in place of LDAP, but there may be problems with keeping
+		the Windows (SMB) encrypted passwords database correctly synchronized across the entire
+		network. Workstations (Windows client machines) periodically change their domain
+		membership secure account password. How can you keep changes that are on remote BDCs
+		synchronized on the PDC?
+		</para>
+
+	    <para><indexterm>
+		<primary>centralized storage</primary>
+	      </indexterm><indexterm>
+		<primary>management</primary>
+	      </indexterm><indexterm>
+		<primary>network Identities</primary>
+	      </indexterm>
+		LDAP is a more elegant solution because it permits centralized storage and management
+		of all network identities (user, group, and machine accounts) together with all information
+		Samba needs to provide to network clients and their users.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Are you suggesting that users should not log on to a domain member server? If so, why?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>security</primary>
+	      </indexterm><indexterm>
+		<primary>data</primary>
+		<secondary>integrity</secondary>
+	      </indexterm><indexterm>
+		<primary>mapped drives</primary>
+	      </indexterm>
+		Many UNIX administrators mock the model that the personal computer industry has adopted
+		as normative since the early days of Novell NetWare. The old
+		perception of the necessity to keep users off file and print servers was a result of
+		fears concerning the security and integrity of data. It was a simple and generally
+		effective measure to keep users away from servers, except through mapped drives.
+		</para>
+
+	    <para><indexterm>
+		<primary>user logins</primary>
+	      </indexterm><indexterm>
+		<primary>risk</primary>
+	      </indexterm><indexterm>
+		<primary>user errors</primary>
+	      </indexterm><indexterm>
+		<primary>strategy</primary>
+	      </indexterm><indexterm>
+		<primary>policy</primary>
+	      </indexterm>
+		UNIX administrators are fully correct in asserting that UNIX servers and workstations
+		are identical in terms of the software that is installed. They correctly assert that
+		in a well-secured environment it is safe to store files on a system that has hundreds
+		of users. But all network administrators must factor into the decision to allow or
+		reject general user logins to a UNIX system that is principally a file and print
+		server the risk to operations through simple user errors.
+		Only then can one begin to appraise the best strategy and adopt a site-specific
+		policy that best protects the needs of users and of the organization alike.
+		</para>
+
+	    <para><indexterm>
+		<primary>system level logins</primary>
+	      </indexterm>
+		From experience, it is my recommendation to keep general system-level logins to a
+		practical minimum and to eliminate them if possible. This should not be taken as a
+		hard rule, though. The better question is, what works best for the site?
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>winbind enable local accounts</primary>
+	      </indexterm><indexterm>
+		<primary>/etc/passwd</primary>
+	      </indexterm><indexterm>
+		<primary>options list</primary>
+	      </indexterm><indexterm>
+		<primary>ACL</primary>
+	      </indexterm><indexterm>
+		<primary>share</primary>
+	      </indexterm>
+		In my &smb.conf; file, I enabled the parameter <parameter>winbind enable local accounts
+		</parameter> on all domain member servers, but it does not work. The accounts I put in 
+		<filename>/etc/passwd</filename> do not show up in the options list when I try to set an
+		ACL on a share. What have I done wrong?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>local users</primary>
+	      </indexterm><indexterm>
+		<primary>local groups</primary>
+	      </indexterm><indexterm>
+		<primary>UNIX account</primary>
+	      </indexterm><indexterm>
+		<primary>getpwnam()</primary>
+	      </indexterm><indexterm>
+		<primary>getgrgid()</primary>
+	      </indexterm><indexterm>
+		<primary>Identity resolution</primary>
+	      </indexterm><indexterm>
+		<primary>failure</primary>
+	      </indexterm><indexterm>
+		<primary>Domain</primary>
+	      </indexterm>
+		The manual page for this &smb.conf; file parameter clearly says, <quote>This parameter 
+		controls whether or not winbindd will act as a stand-in replacement for the various 
+		account management hooks in smb.conf (for example, add user script). If enabled, winbindd 
+		will support the creation of local users and groups as another source of UNIX account 
+		information available via getpwnam() or getgrgid(), etc....</quote> By default this
+		parameter is already enabled; therefore, the action you are seeing is a result of a failure
+		of identity resolution in the domain.
+		</para>
+
+	    <para><indexterm>
+		<primary>Domain logons</primary>
+	      </indexterm><indexterm>
+		<primary>Identity resolution</primary>
+	      </indexterm><indexterm>
+		<primary>Domain</primary>
+		<secondary>user</secondary>
+	      </indexterm><indexterm>
+		<primary>Domain</primary>
+		<secondary>group</secondary>
+	      </indexterm><indexterm>
+		<primary>UID</primary>
+	      </indexterm><indexterm>
+		<primary>GID</primary>
+	      </indexterm>
+		These are the accounts that are available for Windows network domain logons. Providing 
+		identity resolution has been correctly configured on the domain controllers as well as 
+		on domain member servers. The domain user and group identities automatically map 
+		to a valid local UID and GID pair.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>trusted domains</primary>
+	      </indexterm><indexterm>
+		<primary>domain</primary>
+		<secondary>trusted</secondary>
+	      </indexterm><indexterm>
+		<primary>winbind trusted domains only</primary>
+	      </indexterm><indexterm>
+		<primary>domain members</primary>
+	      </indexterm>
+		We want to ensure that only users from our own domain plus from trusted domains can use our
+		Samba servers. In the &smb.conf; file on all servers, we have enabled the <parameter>winbind
+		trusted domains only</parameter> parameter. We now find that users from trusted domains 
+		cannot access our servers, and users from Windows clients that are not domain members
+		can also access our servers. Is this a Samba bug?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>distributed</primary>
+	      </indexterm><indexterm>
+		<primary>NIS</primary>
+	      </indexterm><indexterm>
+		<primary>rsync</primary>
+	      </indexterm><indexterm>
+		<primary>LDAP</primary>
+	      </indexterm><indexterm>
+		<primary>winbindd</primary>
+	      </indexterm><indexterm>
+		<primary>/etc/passwd</primary>
+	      </indexterm>
+		The manual page for this <parameter>winbind trusted domains only</parameter> parameter says,
+		<quote>This parameter is designed to allow Samba servers that are members of a Samba-controlled 
+		domain to use UNIX accounts distributed vi NIS, rsync, or LDAP as the UIDs for winbindd users 
+		in the hosts primary domain. Therefore,  the user <constant>SAMBA\user1</constant> would be 
+		mapped to the account <constant>user1</constant> in <filename>/etc/passwd</filename> instead 
+		of allocating a new UID for him or her.</quote> This clearly suggests that you are trying
+		to use this parameter inappropriately.
+		</para>
+
+	    <para><indexterm>
+		<primary>valid users</primary>
+	      </indexterm>
+		A far better solution is to use the <parameter>valid users</parameter> by specifying
+		precisely the domain users and groups that should be permitted access to the shares. You could, 
+		for example, set the following parameters:
+<screen>
+[demoshare]
+	path = /export/demodata
+	valid users = @"Domain Users", @"OTHERDOMAIN\Domain Users"
+</screen>
+		</para>
+
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What are the benefits of using LDAP for my domain member servers?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>LDAP</primary>
+	      </indexterm><indexterm>
+		<primary>benefit</primary>
+	      </indexterm><indexterm>
+		<primary>UID</primary>
+	      </indexterm><indexterm>
+		<primary>GID</primary>
+	      </indexterm><indexterm>
+		<primary>Domain Controllers</primary>
+	      </indexterm><indexterm>
+		<primary>Domain Member servers</primary>
+	      </indexterm><indexterm>
+		<primary>copy</primary>
+	      </indexterm><indexterm>
+		<primary>replicate</primary>
+	      </indexterm><indexterm>
+		<primary>identity</primary>
+	      </indexterm>
+		The key benefit of using LDAP is that the UID of all users and the GID of all groups
+		are globally consistent on domain controllers as well as on domain member servers.
+		This means that it is possible to copy/replicate files across servers without
+		loss of identity.
+		</para>
+
+	    <para><indexterm>
+		<primary>Identity resolution</primary>
+	      </indexterm><indexterm>
+		<primary>winbind</primary>
+	      </indexterm><indexterm>
+		<primary>IDMAP backend</primary>
+	      </indexterm><indexterm>
+		<primary>LDAP</primary>
+	      </indexterm><indexterm>
+		<primary>Domain Controllers</primary>
+	      </indexterm><indexterm>
+		<primary>Domain Member</primary>
+		<secondary>servers</secondary>
+	      </indexterm><indexterm>
+		<primary>Posix</primary>
+	      </indexterm><indexterm>
+		<primary>account information</primary>
+	      </indexterm>
+		When use is made of account identity resolution via winbind, even when an IDMAP backend
+		is stored in LDAP, the UID/GID on domain member servers is consistent, but differs
+		from the ID that the user/group has on domain controllers. The winbind allocated UID/GID
+		that is stored in LDAP (or locally) will be in the numeric range specified in the <parameter>
+		idmap uid/gid</parameter> in the &smb.conf; file. On domain controllers, the UID/GID is
+		that of the POSIX value assigned in the LDAP directory as part of the POSIX account information.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into
+		my DNS configuration?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>DNS</primary>
+		<secondary>configuration</secondary>
+	      </indexterm><indexterm>
+		<primary>DNS</primary>
+		<secondary>lookup</secondary>
+	      </indexterm><indexterm>
+		<primary>hosts</primary>
+	      </indexterm><indexterm>
+		<primary>/etc/nsswitch.conf</primary>
+	      </indexterm><indexterm>
+		<primary>NSS</primary>
+	      </indexterm><indexterm>
+		<primary>/etc/hosts</primary>
+	      </indexterm><indexterm>
+		<primary>WINS</primary>
+		<secondary>lookup</secondary>
+	      </indexterm>
+		Samba depends on correctly functioning resolution of hostnames to their IP address. Samba
+		makes no direct DNS lookup calls, but rather redirects all name-to-address calls via the
+		<command>getXXXbyXXX()</command> function calls. The configuration of the <constant>hosts</constant>
+		entry in the NSS <filename>/etc/nsswitch.conf</filename> file determines how the underlying
+		resolution process is implemented. If the <constant>hosts</constant> entry in your NSS
+		control file says:
+<screen>
+hosts: files dns wins
+</screen>
+		this means that a hostname lookup first tries the <filename>/etc/hosts</filename>.
+		If this fails to resolve, it attempts a DNS lookup, and if that fails, it tries a
+		WINS lookup.
+		</para>
+
+	    <para><indexterm>
+		<primary>NetBIOS</primary>
+	      </indexterm><indexterm>
+		<primary>TCP/IP</primary>
+	      </indexterm><indexterm>
+		<primary>name resolution</primary>
+	      </indexterm>
+		The addition of the WINS-based name lookup makes sense only if NetBIOS over TCP/IP has
+		been enabled on all Windows clients. Where NetBIOS over TCP/IP has been disabled, DNS
+		is the preferred name resolution technology. This usually makes most sense when Samba
+		is a client of an Active Directory domain, where NetBIOS use has been disabled. In this
+		case, the Windows 200x autoregisters all locator records it needs with its own DNS
+		server or servers.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we
+		use Samba-3 with that configuration?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Yes.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>net</primary>
+		<secondary>ads</secondary>
+		<tertiary>join</tertiary>
+	      </indexterm><indexterm>
+		<primary>net</primary>
+		<secondary>rpc</secondary>
+		<tertiary>join</tertiary>
+	      </indexterm>
+		When I tried to execute net ads join, I got no output. It did not work, so
+		I think that it failed. I then executed net rpc join and that worked fine.
+		That is okay, isn't it?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>Kerberos</primary>
+	      </indexterm><indexterm>
+		<primary>authentication</primary>
+	      </indexterm>
+		No. This is not okay. It means that your Samba-3 client has joined the ADS domain as
+		a Windows NT4 client, and Samba-3 will not be using Kerberos-based authentication.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	</qandaset>
+
+</sect1>
+
+</chapter>
diff --git a/docs/Samba3-ByExample/SBE-Appendix1.xml b/docs/Samba3-ByExample/SBE-Appendix1.xml
new file mode 100644
index 0000000000..9d0e816e42
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-Appendix1.xml
@@ -0,0 +1,1585 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE appendix PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+
+<appendix id="appendix">
+  <title>A Collection of Useful Tidbits</title>
+
+	<para>
+	<indexterm><primary>material</primary></indexterm>
+	<indexterm><primary>domain</primary><secondary>joining</secondary></indexterm>
+	Information presented here is considered to be either basic or well-known material that is informative
+	yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that
+	the process for joining a Windows client to a Samba-controlled Windows domain may somehow involve steps
+	different from doing so with Windows NT4 or a Windows ADS domain. Be assured that the steps are identical,
+	as shown in the example given below.
+	</para>
+
+<sect1 id="domjoin">
+<title>Joining a Domain: Windows 200x/XP Professional</title>
+
+	<para>
+	<indexterm><primary>joining a domain</primary></indexterm>
+	Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security.
+	This section steps through the process for making a Windows 200x/XP Professional machine a
+	member of a Domain Security environment. It should be noted that this process is identical
+	when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC.
+	</para>
+
+	<procedure>
+	<title>Steps to Join a Domain</title>
+
+		<step><para>
+		Click <guimenu>Start</guimenu>.
+		</para></step>
+
+		<step><para>
+		Right-click <guimenu>My Computer</guimenu>, and then select <guimenuitem>Properties</guimenuitem>.
+		</para></step>
+
+		<step><para>
+		The opening panel is the same one that can be reached by clicking <guimenu>System</guimenu> on the Control Panel.
+		See <link linkend="swxpp001"></link>.
+		<image id="swxpp001"><imagefile>wxpp001</imagefile><imagedescription>The General Panel.</imagedescription></image>
+		</para></step>
+
+		<step><para>
+		Click the <guimenu>Computer Name</guimenu> tab.
+		This panel shows the <guimenuitem>Computer Description</guimenuitem>, the <guimenuitem>Full computer name</guimenuitem>,
+		and the <guimenuitem>Workgroup</guimenuitem> or <guimenuitem>Domain name</guimenuitem>.
+		</para>
+
+		<para>
+		Clicking the <guimenu>Network ID</guimenu> button launches the configuration wizard. Do not use this with
+		Samba-3. If you wish to change the computer name, or join or leave the domain, click the <guimenu>Change</guimenu> button.
+		See <link linkend="swxpp004"></link>.
+		<image id="swxpp004"><imagefile>wxpp004</imagefile><imagedescription>The Computer Name Panel.</imagedescription></image>
+		</para></step>
+
+		<step><para>
+		Click on <guimenu>Change</guimenu>. This panel shows that our example machine (TEMPTATION) is in a workgroup called WORKGROUP.
+		We join the domain called MIDEARTH. See <link linkend="swxpp006"></link>.
+		<image id="swxpp006"><imagefile>wxpp006</imagefile><imagedescription>The Computer Name Changes Panel</imagedescription></image>
+		</para></step>
+
+		<step><para>
+		Enter the name <guimenu>MIDEARTH</guimenu> in the field below the Domain radio button.
+		</para>
+
+		<para>
+		This panel shows that our example machine (TEMPTATION) is set to join the domain called MIDEARTH. See <link linkend="swxpp007"></link>.
+		<image id="swxpp007"><imagefile>wxpp007</imagefile><imagedescription>The Computer Name Changes Panel &smbmdash; Domain MIDEARTH</imagedescription></image>
+		</para></step>
+
+		<step><para>
+		Now click the <guimenu>OK</guimenu> button. A dialog box should appear to allow you to provide the credentials (username and password)
+		of a domain administrative account that has the rights to add machines to the domain.
+		</para>
+
+		<para>
+		Enter the name <quote>root</quote> and the root password from your Samba-3 server. See <link linkend="swxpp008"></link>.
+		<image id="swxpp008"><imagefile>wxpp008</imagefile><imagedescription>Computer Name Changes &smbmdash; User name and Password Panel</imagedescription></image>
+		</para></step>
+
+		<step><para>
+		Click <guimenu>OK</guimenu>.
+		</para>
+
+		<para>
+		The <quote>Welcome to the MIDEARTH domain</quote> dialog box should appear. At this point, the machine must be rebooted.
+		Joining the domain is now complete.
+		</para></step>
+
+	</procedure>
+
+	<para>
+	<indexterm><primary>Active Directory</primary></indexterm>
+	<indexterm><primary>DNS</primary></indexterm>
+	The screen capture shown in <link linkend="swxpp007"/> has a button labeled <guimenu>More...</guimenu>. This button opens a
+	panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members
+	of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace.
+	</para>
+
+	<para>
+	<indexterm><primary>Netlogon</primary></indexterm>
+	<indexterm><primary>DNS</primary><secondary>dynamic</secondary></indexterm>
+	Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers
+	register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server
+	to find the services (like which machines are domain controllers or which machines have the Netlogon service running).
+	</para>
+
+	<para>
+	<indexterm><primary>DNS</primary><secondary>suffix</secondary></indexterm>
+	The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix,
+	this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to
+	a valid IP address.
+	</para>
+
+	<para>
+	The Primary DNS suffix parameter principally affects MS Windows clients that are members of an Active Directory domain.
+	Where the client is a member of a Samba domain, it is preferable to leave this field blank.
+	</para>
+
+	<para>
+	<indexterm><primary>Group Policy</primary></indexterm>
+	According to Microsoft documentation, <quote>If this computer belongs to a group with <constant>Group Policy</constant>
+	enabled on <command>Primary DNS suffice of this computer</command>, the string specified in the Group Policy is used
+	as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is
+	used only if Group Policy is disabled or unspecified.</quote>
+	</para>
+
+</sect1>
+
+<sect1>
+	<title>Samba System File Location</title>
+
+      <para><indexterm>
+	  <primary>default installation</primary>
+	</indexterm><indexterm>
+	  <primary>/usr/local/samba</primary>
+	</indexterm><indexterm>
+	  <primary>/usr/local</primary>
+	</indexterm>
+	One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team
+	build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is
+	in the <filename>/usr/local/samba</filename> directory. This is a perfectly reasonable location, particularly given all the other
+	Open Source software that installs into the <filename>/usr/local</filename> subdirectories.
+	</para>
+
+	<para>
+	Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team
+	default. 
+	</para>
+
+      <para><indexterm>
+	  <primary>Free Standards Group</primary>
+	  <see>FSG</see>
+	</indexterm><indexterm>
+	  <primary>FSG</primary>
+	</indexterm><indexterm>
+	  <primary>Linux Standards Base</primary>
+	  <see>LSB</see>
+	</indexterm><indexterm>
+	  <primary>LSB</primary>
+	</indexterm><indexterm>
+	  <primary>File Hierarchy System</primary>
+	  <see>FHS</see>
+	</indexterm><indexterm>
+	  <primary>FHS</primary>
+	</indexterm><indexterm>
+	  <primary>file locations</primary>
+	</indexterm><indexterm>
+	  <primary>/etc/samba</primary>
+	</indexterm><indexterm>
+	  <primary>/usr/sbin</primary>
+	</indexterm><indexterm>
+	  <primary>/usr/bin</primary>
+	</indexterm><indexterm>
+	  <primary>/usr/share</primary>
+	</indexterm><indexterm>
+	  <primary>/usr/share/swat</primary>
+	</indexterm><indexterm>
+	  <primary>/usr/lib/samba</primary>
+	</indexterm><indexterm>
+	  <primary>/usr/share/samba/swat</primary>
+	</indexterm><indexterm>
+	  <primary>SWAT</primary>
+	</indexterm><indexterm>
+	  <primary>VFS modules</primary>
+	</indexterm>
+	Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy	
+	System (FHS), have elected to locate the configuration files under the <filename>/etc/samba</filename> directory, common binary
+	files (those used by users) in the <filename>/usr/bin</filename> directory, and the administrative files (daemons) in the
+	<filename>/usr/sbin</filename> directory. Support files for the Samba Web Admin Tool (SWAT) are located under the
+	<filename>/usr/share</filename> directory, either in <filename>/usr/share/samba/swat</filename> or in
+	<filename>/usr/share/swat</filename>. There are additional support files for <command>smbd</command> in the
+	<filename>/usr/lib/samba</filename> directory tree. The files located there include the dynamically loadable modules for the
+	passdb backend as well as for the VFS modules.
+	</para>
+
+      <para><indexterm>
+	  <primary>/var/lib/samba</primary>
+	</indexterm><indexterm>
+	  <primary>/var/log/samba</primary>
+	</indexterm><indexterm>
+	  <primary>run-time control files</primary>
+	</indexterm>
+	Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in
+	the <filename>/var/lib/samba</filename> directory. Log files are created in <filename>/var/log/samba.</filename>
+	</para>
+
+	<para>
+	When Samba is built and installed using the default Samba Team process, all files are located under the 
+	<filename>/usr/local/samba</filename> directory tree. This makes it simple to find the files that Samba owns.
+	</para>
+
+      <para><indexterm>
+	  <primary>smbd</primary>
+	  <secondary>location of files</secondary>
+	</indexterm>
+	One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location
+	of all files called <command>smbd</command>. Here is an example:
+<screen>
+&rootprompt; find / -name smbd -print
+</screen>
+	You can find the location of the configuration files by running:
+<screen>
+&rootprompt; /path-to-binary-file/smbd -b | more
+...
+Paths:
+   SBINDIR: /usr/sbin
+   BINDIR: /usr/bin
+   SWATDIR: /usr/share/samba/swat
+   CONFIGFILE: /etc/samba/smb.conf
+   LOGFILEBASE: /var/log/samba
+   LMHOSTSFILE: /etc/samba/lmhosts
+   LIBDIR: /usr/lib/samba
+   SHLIBEXT: so
+   LOCKDIR: /var/lib/samba
+   PIDDIR: /var/run/samba
+   SMB_PASSWD_FILE: /etc/samba/smbpasswd
+   PRIVATE_DIR: /etc/samba
+...
+</screen>
+	If you wish to locate the Samba version, just run:
+<screen>
+&rootprompt; /path-to-binary-file/smbd -V
+Version 3.0.20-SUSE
+</screen>
+	</para>
+
+	<para>
+	Many people have been caught by installation of Samba using the default Samba Team process when it was already installed
+	by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by
+	executing:<indexterm>
+	  <primary>rpm</primary>
+	</indexterm>
+<screen>
+&rootprompt; rpm -qa | grep samba
+samba3-pdb-3.0.20-1
+samba3-vscan-0.3.6-0
+samba3-winbind-3.0.20-1
+samba3-3.0.20-1
+samba3-python-3.0.20-1
+samba3-utils-3.0.20-1
+samba3-doc-3.0.20-1
+samba3-client-3.0.20-1
+samba3-cifsmount-3.0.20-1
+	</screen><indexterm>
+	  <primary>package names</primary>
+	</indexterm>
+	The package names, of course, vary according to how the vendor, or the binary package builder, prepared them.
+	</para>
+
+</sect1>
+
+<sect1>
+	<title>Starting Samba</title>
+
+      <para><indexterm>
+	  <primary>daemon</primary>
+	</indexterm>
+	Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services.
+	An example of a service is the Apache Web server for which the daemon is called <command>httpd</command>. In the case of Samba, there
+	are three daemons, two of which are needed as a minimum.
+	</para>
+
+	<para>
+	The Samba server is made up of the following daemons:
+	</para>
+
+<example id="ch12SL">
+<title>A Useful Samba Control Script for SUSE Linux</title>
+<screen>
+#!/bin/bash
+#
+# Script to start/stop samba
+# Locate this in /sbin as a file called 'samba'
+
+RCD=/etc/rc.d
+
+if [ z$1 == 'z' ]; then
+        echo $0 - No arguments given; must be start or stop.
+        exit
+fi
+
+if [ $1 == 'start' ]; then
+        ${RCD}/nmb start
+        ${RCD}/smb start
+        ${RCD}/winbind start
+
+fi
+if [ $1 == 'stop' ]; then
+        ${RCD}/smb stop
+        ${RCD}/winbind stop
+        ${RCD}/nmb stop
+fi
+if [ $1 == 'restart' ]; then
+        ${RCD}/smb stop
+        ${RCD}/winbind stop
+        ${RCD}/nmb stop
+        sleep 5
+        ${RCD}/nmb start
+        ${RCD}/smb start
+        ${RCD}/winbind start
+fi
+exit 0
+</screen>
+</example>
+
+	<variablelist>
+		<varlistentry><term>nmbd</term>
+			<listitem><para>
+			<indexterm><primary>smbd</primary></indexterm>
+			<indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
+			This daemon handles all name registration and resolution requests. It is the primary vehicle involved
+			in network browsing. It handles all UDP-based protocols. The <command>nmbd</command> daemon should
+			be the first command started as part of the Samba startup process.
+			</para></listitem>
+		</varlistentry>
+
+		<varlistentry><term>smbd</term>
+			<listitem><para>
+			<indexterm><primary>nmbd</primary></indexterm>
+			<indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
+			This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also
+			manages local authentication. It should be started immediately following the startup of <command>nmbd</command>.
+			</para></listitem>
+		</varlistentry>
+
+		<varlistentry><term>winbindd</term>
+			<listitem><para>
+			<indexterm><primary>winbindd</primary></indexterm>
+			<indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
+			This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when
+			Samba has trust relationships with another domain. The <command>winbindd</command> daemon will check the
+			&smb.conf; file for the presence of the <parameter>idmap uid</parameter> and <parameter>idmap gid</parameter>
+			parameters. If they are not found, <command>winbindd</command> bails out and refuses to start.
+			</para></listitem>
+		</varlistentry>
+	</variablelist>
+
+	<para>
+	When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its
+	integration into the platform as a whole. Please refer to your operating system platform administration manuals for
+	specific information pertaining to correct management of Samba startup.
+	</para>
+
+<example id="ch12RHscript">
+<title>A Sample Samba Control Script for Red Hat Linux</title>
+<screen>
+#!/bin/sh
+#
+# chkconfig: 345 81 35
+# description: Starts and stops the Samba smbd and nmbd daemons \
+#              used to provide SMB network services.
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+# Source networking configuration.
+. /etc/sysconfig/network
+# Check that networking is up.
+[ ${NETWORKING} = "no" ] &amp;&amp; exit 0
+CONFIG=/etc/samba/smb.conf
+# Check that smb.conf exists.
+[ -f $CONFIG ] || exit 0
+
+# See how we were called.
+case "$1" in
+  start)
+        echo -n "Starting SMB services: "
+        daemon smbd -D; daemon nmbd -D; echo;
+        touch /var/lock/subsys/smb
+        ;;
+  stop)
+        echo -n "Shutting down SMB services: "
+        smbdpids=`ps guax | grep smbd | grep -v grep | awk '{print $2}'`
+        for pid in $smbdpids; do
+                kill -TERM $pid
+        done
+        killproc nmbd -TERM; rm -f /var/lock/subsys/smb
+        echo ""
+        ;;
+  status)
+        status smbd; status nmbd;
+        ;;
+  restart)
+        echo -n "Restarting SMB services: "
+        $0 stop; $0 start;
+        echo "done."
+        ;;
+  *)
+        echo "Usage: smb {start|stop|restart|status}"
+        exit 1
+esac
+</screen>
+</example>
+
+      <para><indexterm>
+	  <primary>samba control script</primary>
+	</indexterm>
+	SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently
+	executed from the command line is shown in <link linkend="ch12SL"/>. This can be located in the directory
+	<filename>/sbin</filename> in a file called <filename>samba</filename>. This type of control script should be
+	owned by user root and group root, and set so that only root can execute it.
+	</para>
+
+      <para><indexterm>
+	  <primary>startup script</primary>
+	</indexterm>
+	A sample startup script for a Red Hat Linux system is shown in <link linkend="ch12RHscript"/>.
+	This file could be located in the directory <filename>/etc/rc.d</filename> and can be called
+	<filename>samba</filename>. A similar startup script is required to control <command>winbind</command>.
+	If you want to find more information regarding startup scripts please refer to the packaging section of
+	the Samba source code distribution tarball. The packaging files for each platform include a
+	startup control file.
+	</para>
+
+</sect1>
+
+<sect1>
+	<title>DNS Configuration Files</title>
+
+	<para>
+	The following files are common to all DNS server configurations. Rather than repeat them multiple times, they
+	are presented here for general reference.
+	</para>
+
+	<sect2>
+	<title>The Forward Zone File for the Loopback Adaptor</title>
+
+	<para>
+	The forward zone file for the loopback address never changes. An example file is shown
+	in <link linkend="loopback"/>. All traffic destined for an IP address that is hosted on a
+	physical interface on the machine itself is routed to the loopback adaptor. This is
+	a fundamental design feature of the TCP/IP protocol implementation. The loopback adaptor
+	is called <constant>localhost</constant>.
+	</para>
+
+<example id="loopback">
+<title>DNS Localhost Forward Zone File: <filename>/var/lib/named/localhost.zone</filename></title>
+<screen>
+$TTL 1W
+@		IN SOA	@   root (
+				42		; serial
+				2D		; refresh
+				4H		; retry
+				6W		; expiry
+				1W )		; minimum
+
+		IN NS		@
+		IN A		127.0.0.1
+</screen>
+</example>
+
+	</sect2>
+
+	<sect2>
+	<title>The Reverse Zone File for the Loopback Adaptor</title>
+
+	<para>
+	The reverse zone file for the loopback address as shown in <link linkend="dnsloopy"/>
+	is necessary so that references to the address <constant>127.0.0.1</constant> can be
+	resolved to the correct name of the interface. 
+	</para>
+
+<example id="dnsloopy">
+<title>DNS Localhost Reverse Zone File: <filename>/var/lib/named/127.0.0.zone</filename></title>
+<screen>
+$TTL 1W
+@		IN SOA		localhost.   root.localhost. (
+				42		; serial
+				2D		; refresh
+				4H		; retry
+				6W		; expiry
+				1W )		; minimum
+
+		IN NS		localhost.
+1		IN PTR		localhost.
+</screen>
+</example>
+
+<example id="roothint">
+<title>DNS Root Name Server Hint File: <filename>/var/lib/named/root.hint</filename></title>
+<screen>
+; This file is made available by InterNIC under anonymous FTP as
+;       file                /domain/named.root
+;       on server           FTP.INTERNIC.NET
+; last update: Nov 5, 2002. Related version of root zone: 2002110501
+; formerly NS.INTERNIC.NET
+.                        3600000  IN  NS    A.ROOT-SERVERS.NET.
+A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
+; formerly NS1.ISI.EDU
+.                        3600000      NS    B.ROOT-SERVERS.NET.
+B.ROOT-SERVERS.NET.      3600000      A     128.9.0.107
+; formerly C.PSI.NET
+.                        3600000      NS    C.ROOT-SERVERS.NET.
+C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
+; formerly TERP.UMD.EDU
+.                        3600000      NS    D.ROOT-SERVERS.NET.
+D.ROOT-SERVERS.NET.      3600000      A     128.8.10.90
+; formerly NS.NASA.GOV
+.                        3600000      NS    E.ROOT-SERVERS.NET.
+E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
+; formerly NS.ISC.ORG
+.                        3600000      NS    F.ROOT-SERVERS.NET.
+F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
+; formerly NS.NIC.DDN.MIL
+.                        3600000      NS    G.ROOT-SERVERS.NET.
+G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
+; formerly AOS.ARL.ARMY.MIL
+.                        3600000      NS    H.ROOT-SERVERS.NET.
+H.ROOT-SERVERS.NET.      3600000      A     128.63.2.53
+; formerly NIC.NORDU.NET
+.                        3600000      NS    I.ROOT-SERVERS.NET.
+I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
+; operated by VeriSign, Inc. 
+.                        3600000      NS    J.ROOT-SERVERS.NET.
+J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
+; housed in LINX, operated by RIPE NCC
+.                        3600000      NS    K.ROOT-SERVERS.NET.
+K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129 
+; operated by IANA
+.                        3600000      NS    L.ROOT-SERVERS.NET.
+L.ROOT-SERVERS.NET.      3600000      A     198.32.64.12
+; housed in Japan, operated by WIDE
+.                        3600000      NS    M.ROOT-SERVERS.NET.
+M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
+; End of File
+</screen>
+</example>
+	</sect2>
+
+	<sect2>
+	<title>DNS Root Server Hint File</title>
+
+	<para>
+	The content of the root hints file as shown in <link linkend="roothint"/>  changes slowly over time. 
+	Periodically this file should be updated from the source shown. Because
+	  of its size, this file is located at the end of this appendix.
+	</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1 id="altldapcfg">
+	<title>Alternative LDAP Database Initialization</title>
+
+      <para><indexterm>
+	  <primary>LDAP</primary>
+	  <secondary>database</secondary>
+	</indexterm><indexterm>
+	  <primary>LDAP</primary>
+	  <secondary>initial configuration</secondary>
+	</indexterm>
+	The following procedure may be used as an alternative means of configuring
+	the initial LDAP database. Many administrators prefer to have greater control
+	over how system files get configured.
+	</para>
+
+	<sect2>
+	<title>Initialization of the LDAP Database</title>
+
+	<para><indexterm>
+	    <primary>LDIF</primary>
+	  </indexterm><indexterm>
+	    <primary>Domain Groups</primary>
+	    <secondary>well-known</secondary>
+	  </indexterm><indexterm>
+	    <primary>SID</primary>
+	  </indexterm>
+	The first step to get the LDAP server ready for action is to create the LDIF file from
+	which the LDAP database will be preloaded. This is necessary to create the containers
+	into which the user, group, and other accounts are written. It is also necessary to
+	preload the well-known Windows NT Domain Groups, as they must have the correct SID so
+	that they can be recognized as special NT Groups by the MS Windows clients.
+	</para>
+
+	<procedure id="ldapinit">
+	<title>LDAP Directory Pre-Load Steps</title>
+
+		<step><para>
+		Create a directory in which to store the files you use to generate
+		the LDAP LDIF file for your system. Execute the following:
+<screen>
+&rootprompt; mkdir /etc/openldap/SambaInit
+&rootprompt; chown root:root /etc/openldap/SambaInit
+&rootprompt; chmod 700 /etc/openldap/SambaInit
+</screen>
+		</para></step>
+
+		<step><para>
+		Install the files shown in <link linkend="sbehap-ldapreconfa"/>, <link linkend="sbehap-ldapreconfb"/>,
+		and <link linkend="sbehap-ldapreconfc"/> into the directory 
+		<filename>/etc/openldap/SambaInit/SMBLDAP-ldif-preconfig.sh.</filename> These three files are,
+		respectively, parts A, B, and C of the <filename>SMBLDAP-ldif-preconfig.sh</filename> file.
+		</para></step>
+
+		<step><para>
+		Install the files shown in <link linkend="sbehap-ldifpata"/> and <link linkend="sbehap-ldifpatb"/> into the directory
+		<filename>/etc/openldap/SambaInit/nit-ldif.pat.</filename> These two files are
+                parts A and B, respectively, of the <filename>init-ldif.pat</filename> file.
+		</para></step>
+
+		<step><para>
+		Change to the <filename>/etc/openldap/SambaInit</filename> directory. Execute the following:
+<screen>
+&rootprompt; ./SMBLDAP-ldif-preconfig.sh
+
+How do you wish to refer to your organization?
+Suggestions:
+        Black Tire Company, Inc.
+        Cat With Hat Ltd.
+How would you like your organization name to appear?
+Your organization name is: My Organization
+Enter a new name is this is not what you want, press Enter to Continue.
+Name [My Organization]: Abmas Inc.
+
+Samba Config File Location [/etc/samba/smb.conf]:
+Enter a new full path or press Enter to continue.
+Samba Config File Location [/etc/samba/smb.conf]:
+Domain Name: MEGANET2
+Domain SID: S-1-5-21-3504140859-1010554828-2431957765
+
+The name of your Internet domain is now needed in a special format
+as follows, if your domain name is mydomain.org, what we need is
+the information in the form of:
+        Domain ID: mydomain
+        Top level: org
+If your fully qualified hostname is: snoopy.bazaar.garagesale.net
+where "snoopy" is the name of the machine,
+Then the information needed is:
+        Domain ID: garagesale
+        Top Level: net
+
+Found the following domain name: abmas.biz
+I think the bit we are looking for might be: abmas
+Enter the domain name or press Enter to continue:
+
+The top level organization name I will use is: biz
+Enter the top level org name or press Enter to continue:
+&rootprompt;
+</screen>
+		This creates a file called <filename>MEGANET2.ldif</filename>.
+		</para></step>
+
+		<step><para>
+		It is now time to preload the LDAP database with the following
+		command:
+<screen>
+&rootprompt; slapadd -v -l MEGANET2.ldif
+added: "dc=abmas,dc=biz" (00000001)
+added: "cn=Manager,dc=abmas,dc=biz" (00000002)
+added: "ou=People,dc=abmas,dc=biz" (00000003)
+added: "ou=Computers,dc=abmas,dc=biz" (00000004)
+added: "ou=Groups,dc=abmas,dc=biz" (00000005)
+added: "ou=Domains,dc=abmas,dc=biz" (00000006)
+added: "sambaDomainName=MEGANET2,ou=Domains,dc=abmas,dc=biz" (00000007)
+added: "cn=domadmins,ou=Groups,dc=abmas,dc=biz" (00000008)
+added: "cn=domguests,ou=Groups,dc=abmas,dc=biz" (00000009)
+added: "cn=domusers,ou=Groups,dc=abmas,dc=biz" (0000000a)
+</screen>
+		You should verify that the account information was correctly loaded by executing:
+<screen>
+&rootprompt; slapcat
+dn: dc=abmas,dc=biz
+objectClass: dcObject
+objectClass: organization
+dc: abmas
+o: Abmas Inc.
+description: Posix and Samba LDAP Identity Database
+structuralObjectClass: organization
+entryUUID: af552f8e-c4a1-1027-9002-9421e01bf474
+creatorsName: cn=manager,dc=abmas,dc=biz
+modifiersName: cn=manager,dc=abmas,dc=biz
+createTimestamp: 20031217055747Z
+modifyTimestamp: 20031217055747Z
+entryCSN: 2003121705:57:47Z#0x0001#0#0000
+...
+
+dn: cn=domusers,ou=Groups,dc=abmas,dc=biz
+objectClass: posixGroup
+objectClass: sambaGroupMapping
+gidNumber: 513
+cn: domusers
+sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513
+sambaGroupType: 2
+displayName: Domain Users
+description: Domain Users
+structuralObjectClass: posixGroup
+entryUUID: af7e98ba-c4a1-1027-900b-9421e01bf474
+creatorsName: cn=manager,dc=abmas,dc=biz
+modifiersName: cn=manager,dc=abmas,dc=biz
+createTimestamp: 20031217055747Z
+modifyTimestamp: 20031217055747Z
+entryCSN: 2003121705:57:47Z#0x000a#0#0000
+</screen>
+		</para></step>
+
+		<step><para>
+		Your LDAP database is ready for testing. You can now start the LDAP server
+		using the system tool for your Linux operating system. For SUSE Linux, you can
+		do this as follows:
+<screen>
+&rootprompt; rcldap start
+</screen>
+		</para></step>
+
+		<step><para>
+		It is now a good idea to validate that the LDAP server is running correctly.
+		Execute the following:
+<screen>
+&rootprompt; ldapsearch -x -b "dc=abmas,dc=biz" "(ObjectClass=*)"
+# extended LDIF
+#
+# LDAPv3
+# base &lt;dc=abmas,dc=biz&gt; with scope sub
+# filter: (ObjectClass=*)
+# requesting: ALL
+#
+
+# abmas.biz
+dn: dc=abmas,dc=biz
+objectClass: dcObject
+objectClass: organization
+dc: abmas
+o: Abmas Inc.
+description: Posix and Samba LDAP Identity Database
+...
+# domusers, Groups, abmas.biz
+dn: cn=domusers,ou=Groups,dc=abmas,dc=biz
+objectClass: posixGroup
+objectClass: sambaGroupMapping
+gidNumber: 513
+cn: domusers
+sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513
+sambaGroupType: 2
+displayName: Domain Users
+description: Domain Users
+
+# search result
+search: 2
+result: 0 Success
+
+# numResponses: 11
+# numEntries: 10
+</screen>
+		Your LDAP server is ready for creation of additional accounts.
+		</para></step>
+	</procedure>
+
+	</sect2>
+
+<example id="sbehap-ldapreconfa">
+<title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part A</title>
+<screen>
+#!/bin/bash
+#
+# This script prepares the ldif LDAP load file only
+#
+
+# Pattern File Name
+file=init-ldif.pat
+
+# The name of my organization
+ORGNAME="My Organization"
+
+# My Internet domain. ie: if my domain is: buckets.org, INETDOMAIN="buckets"
+INETDOMAIN="my-domain"
+
+# In the above case, md domain is: buckets.org, TLDORG="org"
+TLDORG="org"
+
+# This is the Samba Domain/Workgroup Name
+DOMNAME="MYWORKGROUP"
+
+#
+# Here We Go ...
+#
+
+cat &lt;&lt;EOF
+
+How do you wish to refer to your organization?
+
+Suggestions:
+	Black Tire Company, Inc.
+	Cat With Hat Ltd.
+
+How would you like your organization name to appear?
+
+EOF
+
+echo "Your organization name is: $ORGNAME"
+echo
+echo "Enter a new name or, press Enter to Continue."
+echo
+</screen>
+</example>
+
+<example id="sbehap-ldapreconfb">
+<title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part B</title>
+<screen>
+echo -e -n "Name [$ORGNAME]: "
+	read name
+
+if [ ! -z "$name" ]; then 
+	ORGNAME=${name}
+fi
+echo
+sed "s/ORGNAME/${ORGNAME}/g" &lt; $file &gt; $file.tmp1
+
+# Try to find smb.conf
+
+if [ -e /usr/local/samba/lib/smb.conf ]; then
+	CONF=/usr/local/samba/lib/smb.conf
+elif [ -e /etc/samba/smb.conf ]; then
+	CONF=/etc/samba/smb.conf
+fi
+
+echo "Samba Config File Location [$CONF]: "
+echo
+echo "Enter a new full path or press Enter to continue."
+echo
+echo -n "Samba Config File Location [$CONF]: "
+	read name
+if [ ! -z "$name" ]; then
+	CONF=$name
+fi
+echo
+
+# Find the name of our Domain/Workgroup
+DOMNAME=`grep -i workgroup ${CONF} | sed "s/ //g" | cut -f2 -d=`
+echo Domain Name: $DOMNAME
+echo
+
+sed "s/DOMNAME/${DOMNAME}/g" &lt; $file.tmp1 &gt; $file.tmp2
+
+DOMSID=`net getlocalsid ${DOMNAME} | cut -f2 -d: | sed "s/ //g"`
+echo Domain SID: $DOMSID
+
+sed "s/DOMSID/${DOMSID}/g" &lt; $file.tmp2 &gt; $file.tmp1
+</screen>
+</example>
+
+<example id="sbehap-ldapreconfc">
+<title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part C</title>
+<screen>
+cat &gt;&gt;EOL
+The name of your Internet domain is now needed in a special format
+as follows, if your domain name is mydomain.org, what we need is
+the information in the form of:
+	Domain ID: mydomain
+	Top level: org
+
+If your fully qualified hostname is: snoopy.bazaar.garagesale.net
+where "snoopy" is the name of the machine,
+Then the information needed is:
+	Domain ID: garagesale
+	Top Level: net
+
+EOL
+INETDOMAIN=`hostname -d | cut -f1 -d.`
+echo Found the following domain name: `hostname -d`
+echo "I think the bit we are looking for might be: $INETDOMAIN"
+echo
+echo -n "Enter the domain name or press Enter to continue: "
+	read domnam
+if [ ! -z $domnam ]; then
+	INETDOMAIN=$domnam
+fi
+echo
+sed "s/INETDOMAIN/${INETDOMAIN}/g" &lt; $file.tmp1 &gt; $file.tmp2
+TLDORG=`hostname -d | sed "s/${INETDOMAIN}.//g"`
+echo "The top level organization name I will use is: ${TLDORG}"
+echo
+echo -n "Enter the top level org name or press Enter to continue: "
+	read domnam
+if [ ! -z $domnam ]; then
+        TLDORG=$domnam
+fi
+sed "s/TLDORG/${TLDORG}/g" &lt; $file.tmp2 &gt; $DOMNAME.ldif
+rm $file.tmp*
+exit 0
+</screen>
+</example>
+
+<example id="sbehap-ldifpata">
+<title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part A</title>
+<screen>
+dn: dc=INETDOMAIN,dc=TLDORG
+objectClass: dcObject
+objectClass: organization
+dc: INETDOMAIN
+o: ORGNAME
+description: Posix and Samba LDAP Identity Database
+
+dn: cn=Manager,dc=INETDOMAIN,dc=TLDORG
+objectClass: organizationalRole
+cn: Manager
+description: Directory Manager
+
+dn: ou=People,dc=INETDOMAIN,dc=TLDORG
+objectClass: top
+objectClass: organizationalUnit
+ou: People
+
+dn: ou=Computers,dc=INETDOMAIN,dc=TLDORG
+objectClass: top
+objectClass: organizationalUnit
+ou: Computers
+
+dn: ou=Groups,dc=INETDOMAIN,dc=TLDORG
+objectClass: top
+objectClass: organizationalUnit
+ou: Groups
+
+dn: ou=Idmap,dc=INETDOMAIN,dc=TLDORG
+objectClass: top
+objectClass: organizationalUnit
+ou: Idmap
+
+dn: sambaDomainName=DOMNAME,ou=Domains,dc=INETDOMAIN,dc=TLDORG
+objectClass: sambaDomain
+sambaDomainName: DOMNAME
+sambaSID: DOMSID
+sambaAlgorithmicRidBase: 1000
+structuralObjectClass: sambaDomain
+</screen>
+</example>
+
+<example id="sbehap-ldifpatb">
+<title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part B</title>
+<screen>
+dn: cn=domadmins,ou=Groups,dc=INETDOMAIN,dc=TLDORG
+objectClass: posixGroup
+objectClass: sambaGroupMapping
+gidNumber: 512
+cn: domadmins
+sambaSID: DOMSID-512
+sambaGroupType: 2
+displayName: Domain Admins
+description: Domain Administrators
+
+dn: cn=domguests,ou=Groups,dc=INETDOMAIN,dc=TLDORG
+objectClass: posixGroup
+objectClass: sambaGroupMapping
+gidNumber: 514
+cn: domguests
+sambaSID: DOMSID-514
+sambaGroupType: 2
+displayName: Domain Guests
+description: Domain Guests Users
+
+dn: cn=domusers,ou=Groups,dc=INETDOMAIN,dc=TLDORG
+objectClass: posixGroup
+objectClass: sambaGroupMapping
+gidNumber: 513
+cn: domusers
+sambaSID: DOMSID-513
+sambaGroupType: 2
+displayName: Domain Users
+description: Domain Users
+</screen>
+</example>
+
+</sect1>
+
+<sect1>
+<title>The LDAP Account Manager</title>
+
+<para>
+<indexterm><primary>LAM</primary></indexterm>
+<indexterm><primary>LDAP Account Manager</primary><see>LAM</see></indexterm>
+<indexterm><primary>PHP</primary></indexterm>
+<indexterm><primary>unencrypted</primary></indexterm>
+<indexterm><primary>SSL</primary></indexterm>
+<indexterm><primary>Posix</primary></indexterm>
+<indexterm><primary>accounts</primary><secondary>manage</secondary></indexterm>
+The LDAP Account Manager (LAM) is an application suite that has been written in PHP.
+LAM can be used with any Web server that has PHP4 support. It connects to the LDAP
+server either using unencrypted connections or via SSL/TLS. LAM can be used to manage
+Posix accounts as well as SambaSAMAccounts for users, groups, and Windows machines
+(hosts).
+</para>
+
+<para>
+LAM is available from the <ulink url="http://sourceforge.net/projects/lam/">LAM</ulink>
+home page and from its mirror sites. LAM has been released under the GNU GPL version 2.
+The current version of LAM is 0.4.9. Release of version 0.5 is expected in the third quarter
+of 2005.
+</para>
+
+<para>
+<indexterm><primary>PHP4</primary></indexterm>
+<indexterm><primary>OpenLDAP</primary></indexterm>
+<indexterm><primary>Perl</primary></indexterm>
+Requirements:
+</para>
+
+<itemizedlist>
+	<listitem><para>A web server that will work with PHP4.</para></listitem>
+	<listitem><para>PHP4 (available from the <ulink url="http://www.php.net/">PHP</ulink> home page.)</para></listitem>
+	<listitem><para>OpenLDAP 2.0 or later.</para></listitem>
+	<listitem><para>A Web browser that supports CSS.</para></listitem>
+	<listitem><para>Perl.</para></listitem>
+	<listitem><para>The gettext package.</para></listitem>
+	<listitem><para>mcrypt + mhash (optional).</para></listitem>
+	<listitem><para>It is also a good idea to install SSL support.</para></listitem>
+</itemizedlist>
+
+<para>
+LAM is a useful tool that provides a simple Web-based device that can be used to
+manage the contents of the LDAP directory to:
+<indexterm><primary>organizational units</primary></indexterm>
+<indexterm><primary>operating profiles</primary></indexterm>
+<indexterm><primary>account policies</primary></indexterm>
+</para>
+
+<itemizedlist>
+	<listitem><para>Display user/group/host and Domain entries.</para></listitem>
+	<listitem><para>Manage entries (Add/Delete/Edit).</para></listitem>
+	<listitem><para>Filter and sort entries.</para></listitem>
+	<listitem><para>Store and use multiple operating profiles.</para></listitem>
+	<listitem><para>Edit organizational units (OUs).</para></listitem>
+	<listitem><para>Upload accounts from a file.</para></listitem>
+	<listitem><para>Is compatible with Samba-2.2.x and Samba-3.</para></listitem>
+</itemizedlist>
+
+<para>
+When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba
+user, group, and windows domain member machine accounts.
+</para>
+
+<para>
+<indexterm><primary>default password</primary></indexterm>
+<indexterm><primary>secure connections</primary></indexterm>
+<indexterm><primary>LAM</primary></indexterm>
+<indexterm><primary>SSL</primary></indexterm>
+The default password is <quote>lam.</quote> It is highly recommended that you use only 
+an SSL connection to your Web server for all remote operations involving LAM. If you 
+want secure connections, you must configure your Apache Web server to permit connections 
+to LAM using only SSL.
+</para>
+
+<procedure id="sbehap-laminst">
+<title>Apache Configuration Steps for LAM</title>
+
+	<step><para>
+	Extract the LAM package by untarring it as shown here:
+<screen>
+&rootprompt; tar xzf ldap-account-manager_0.4.9.tar.gz
+</screen>
+	Alternatively, install the LAM DEB for your system using the following command:
+<screen>
+&rootprompt; dpkg -i ldap-account-manager_0.4.9.all.deb
+</screen>
+	</para></step>
+	
+	<step><para>
+	Copy the extracted files to the document root directory of your Web server.
+	For example, on SUSE Linux Enterprise Server 9, copy to the 
+	<filename>/srv/www/htdocs</filename> directory.
+	</para></step>
+
+	<step><para>
+	<indexterm><primary>file permissions</primary></indexterm>
+	Set file permissions using the following commands:
+<screen>
+&rootprompt; chown -R wwwrun:www /srv/www/htdocs/lam
+&rootprompt; chmod 755 /srv/www/htdocs/lam/sess
+&rootprompt; chmod 755 /srv/www/htdocs/lam/tmp
+&rootprompt; chmod 755 /srv/www/htdocs/lam/config
+&rootprompt; chmod 755 /srv/www/htdocs/lam/lib/*pl
+</screen>
+	</para></step>
+
+	<step><para>
+	<indexterm><primary>LAM</primary><secondary>configuration file</secondary></indexterm>
+       Using your favorite editor create the following <filename>config.cfg</filename>
+       LAM configuration file:
+<screen>
+&rootprompt; cd /srv/www/htdocs/lam/config
+&rootprompt; cp config.cfg_sample config.cfg
+&rootprompt; vi config.cfg
+</screen>
+	<indexterm><primary>LAM</primary><secondary>profile</secondary></indexterm>
+	<indexterm><primary>LAM</primary><secondary>wizard</secondary></indexterm>
+	An example file is shown in <link linkend="lamcfg"/>.
+	This is the minimum configuration that must be completed. The LAM profile
+	file can be created using a convenient wizard that is part of the LAM
+	configuration suite.
+	</para></step>
+
+	<step><para>
+	Start your Web server then, using your Web browser, connect to 
+	<ulink url="http://localhost/lam">LAM</ulink> URL. Click on the
+	the <parameter>Configuration Login</parameter> link then click on the
+	Configuration Wizard link to begin creation of the default profile so that 
+	LAM can connect to your LDAP server. Alternately, copy the 
+	<filename>lam.conf_sample</filename> file to a file called 
+	<filename>lam.conf</filename> then, using your favorite editor, 
+	change the settings to match local site needs.
+	</para></step>
+</procedure>
+
+	<para>
+	<indexterm><primary>pitfalls</primary></indexterm>
+	An example of a working file is shown here in <link linkend="lamconf"/>.
+	This file has been stripped of comments to keep the size small. The comments
+	and help information provided in the profile file that the wizard creates
+	is very useful and will help many administrators to avoid pitfalls.
+	Your configuration file obviously reflects the configuration options that
+	are preferred at your site.
+	</para>
+
+	<para>
+	<indexterm><primary>LAM</primary><secondary>login screen</secondary></indexterm>
+	It is important that your LDAP server is running at the time that LAM is 
+	being configured. This permits you to validate correct operation.
+	An example of the LAM login screen is provided in <link linkend="lam-login"/>.
+	</para>
+
+	<image id="lam-login">
+		<imagedescription>The LDAP Account Manager Login Screen</imagedescription>
+		<imagefile scale="50">lam-login</imagefile>
+	</image>
+
+	<para>
+	<indexterm><primary>LAM</primary><secondary>configuration editor</secondary></indexterm>
+	The LAM configuration editor has a number of options that must be managed correctly.
+	An example of use of the LAM configuration editor is shown in <link linkend="lam-config"/>.
+	It is important that you correctly set the minimum and maximum UID/GID values that are
+	permitted for use at your site. The default values may not be compatible with a need to
+	modify initial default account values for well-known Windows network users and groups.
+	The best work-around is to temporarily set the minimum values to zero (0) to permit
+	the initial settings to be made. Do not forget to reset these to sensible values before
+	using LAM to add additional users and groups.
+	</para>
+
+	<image id="lam-config">
+		<imagedescription>The LDAP Account Manager Configuration Screen</imagedescription>
+		<imagefile scale="50">lam-config</imagefile>
+	</image>
+
+	<para>
+	<indexterm><primary>PDF</primary></indexterm>
+	LAM has some nice, but unusual features. For example, one unexpected feature in most application
+	screens permits the generation of a PDF file that lists configuration information. This is a well
+	thought out facility. This option has been edited out of the following screen shots to conserve
+	space.
+	</para>
+
+	<para>
+	<indexterm><primary>LAM</primary><secondary>opening screen</secondary></indexterm>
+	When you log onto LAM the opening screen drops you right into the user manager as shown in
+	<link linkend="lam-user"/>. This is a logical action as it permits the most-needed facility
+	to be used immediately. The editing of an existing user, as with the addition of a new user,
+	is easy to follow and very clear in both layout and intent. It is a simple matter to edit
+	generic settings, UNIX specific parameters, and then Samba account requirements. Each step
+	involves clicking a button that intuitively drives you through the process. When you have
+	finished editing simply press the <guimenu>Final</guimenu> button.
+	</para>
+
+	<image id="lam-user">
+		<imagedescription>The LDAP Account Manager User Edit Screen</imagedescription>
+		<imagefile scale="50">lam-users</imagefile>
+	</image>
+
+	<para>
+	The edit screen for groups is shown in <link linkend="lam-group"/>. As with the edit screen
+	for user accounts, group accounts may be rapidly dealt with. <link linkend="lam-group-mem"/>
+	shows a sub-screen from the group editor that permits users to be assigned secondary group
+	memberships. 
+	</para>
+
+	<image id="lam-group">
+		<imagedescription>The LDAP Account Manager Group Edit Screen</imagedescription>
+		<imagefile scale="50">lam-groups</imagefile>
+	</image>
+
+	<image id="lam-group-mem">
+		<imagedescription>The LDAP Account Manager Group Membership Edit Screen</imagedescription>
+		<imagefile scale="50">lam-group-members</imagefile>
+	</image>
+
+	<para>
+	<indexterm><primary>smbldap-tools</primary></indexterm><indexterm><primary>scripts</primary></indexterm>
+	The final screen presented here is one that you should not normally need to use. Host accounts will
+	be automatically managed using the smbldap-tools scripts. This means that the screen <link linkend="lam-host"/>
+	will, in most cases, not be used.
+	</para>
+
+	<image id="lam-host">
+		<imagedescription>The LDAP Account Manager Host Edit Screen</imagedescription>
+		<imagefile scale="50">lam-hosts</imagefile>
+	</image>
+
+	<para>
+	One aspect of LAM that may annoy some users is the way it forces certain conventions on
+	the administrator. For example, LAM does not permit the creation of Windows user and group
+	accounts that contain spaces even though the underlying UNIX/Linux
+	operating system may exhibit no problems with them. Given the propensity for using upper-case
+	characters and spaces (particularly in the default Windows account names) this may cause
+	some annoyance. For the rest, LAM is a very useful administrative tool.
+	</para>
+	
+	<para>
+	The next major release, LAM 0.5, will have fewer restrictions and support the latest Samba features
+	(e.g., logon hours). The new plugin-based architecture also allows management of much more different
+	account types like plain UNIX accounts. The upload can now handle groups and hosts, too. Another
+	important point is the tree view which allows browsing and editing LDAP objects directly.
+	</para>
+
+<example id="lamcfg">
+<title>Example LAM Configuration File &smbmdash; <filename>config.cfg</filename></title>
+<screen>
+# password to add/delete/rename configuration profiles
+password: not24get
+
+# default profile, without ".conf"
+default: lam
+</screen>
+</example>
+
+<example id="lamconf">
+<title>LAM Profile Control File &smbmdash; <filename>lam.conf</filename></title>
+<screen>
+ServerURL: ldap://massive.abmas.org:389
+Admins: cn=Manager,dc=abmas,dc=biz
+Passwd: not24get
+usersuffix: ou=People,dc=abmas,dc=biz
+groupsuffix: ou=Groups,dc=abmas,dc=biz
+hostsuffix: ou=Computers,dc=abmas,dc=biz
+domainsuffix: ou=Domains,dc=abmas,dc=biz
+MinUID: 0
+MaxUID: 65535
+MinGID: 0
+MaxGID: 65535
+MinMachine: 20000
+MaxMachine: 25000
+userlistAttributes: #uid;#givenName;#sn;#uidNumber;#gidNumber
+grouplistAttributes: #cn;#gidNumber;#memberUID;#description
+hostlistAttributes: #cn;#description;#uidNumber;#gidNumber
+maxlistentries: 30
+defaultLanguage: en_GB:ISO-8859-1:English (Great Britain)
+scriptPath: 
+scriptServer: 
+samba3: yes
+cachetimeout: 5
+pwdhash: SSHA
+</screen>
+</example>
+
+</sect1>
+
+<sect1 id="ch12-SUIDSGID">
+	<title>Effect of Setting File and Directory SUID/SGID Permissions Explained</title>
+
+	<indexterm><primary>SUID</primary></indexterm>
+	<indexterm><primary>SGID</primary></indexterm>
+	<para>
+	The setting of the SUID/SGID bits on the file or directory permissions flag has particular
+	consequences. If the file is executable and the SUID bit is set, it executes with the privilege
+	of (with the UID of) the owner of the file. For example, if you are logged onto a system as
+	a normal user (let's say as the user <constant>bobj</constant>), and you execute a file that is owned
+	by the user <constant>root</constant> (uid = 0), and the file has the SUID bit set, then the file is
+	executed as if you had logged in as the user <constant>root</constant> and then executed the file.
+	The SUID bit effectively gives you (as <constant>bobj</constant>) administrative privilege for the
+	use of that executable file.
+	</para>
+
+	<para>
+	The setting of the SGID bit does precisely the same as the effect of the SUID bit, except that it
+	applies the privilege to the UNIX group setting. In other words, the file executes with the force
+	of capability of the group.
+	</para>
+
+	<para>
+	When the SUID/SGID permissions are set on a directory, all files that are created within that directory
+	are automatically given the ownership of the SUID user and the SGID group, as per the ownership
+	of the directory in which the file is created. This means that the system level <command>create()</command>
+	function executes with the SUID user and/or SGID group of the directory in which the file is
+	created.
+	</para>
+
+	<para>
+	If you want to obtain the SUID behavior, simply execute the following command:
+<screen>
+&rootprompt; chmod u+s file-or-directory
+</screen>
+	To set the SGID properties on a file or a directory, execute this command:
+<screen>
+&rootprompt; chmod g+s file-or-directory
+</screen>
+	And to set both SUID and SGID properties, execute the following:
+<screen>
+&rootprompt; chmod ug+s file-or-directory
+</screen>
+	</para>
+
+	<para>
+	Let's consider the example of a directory <filename>/data/accounts</filename>. The permissions on this
+	directory before setting both SUID and SGID on this directory are:
+<screen>
+&rootprompt; ls -al /data/accounts
+total 1
+drwxr-xr-x   10 root     root          232 Dec 18 17:08 .
+drwxr-xr-x   21 root     root          600 Dec 17 23:15 ..
+drwxrwxrwx    2 bobj     Domain Users  48 Dec 18 17:08 accounts/
+drwx------    2 root     root           48 Jan 26  2002 lost+found
+</screen>
+	In this example, if the user <constant>maryv</constant> creates a file, it is owned by her.
+	If <constant>maryv</constant> has the primary group of <constant>Accounts</constant>, the file is
+	owned by the group <constant>Accounts</constant>, as shown in this listing:
+<screen>
+&rootprompt; ls -al /data/accounts/maryvfile.txt
+drw-rw-r--    2 maryv    Accounts     12346 Dec 18 17:53
+</screen>
+	</para>
+
+	<para>
+	Now you set the SUID and SGID and check the result as follows:
+<screen>
+&rootprompt; chmod ug+s /data/accounts
+&rootprompt; ls -al /data/accounts
+total 1
+drwxr-xr-x   10 root     root          232 Dec 18 17:08 .
+drwxr-xr-x   21 root     root          600 Dec 17 23:15 ..
+drwsrwsr-x    2 bobj     Domain Users  48 Dec 18 17:08 accounts
+drwx------    2 root     root           48 Jan 26  2002 lost+found
+</screen>
+	If <constant>maryv</constant> creates a file in this directory after this change has been made, the
+	file is owned by the user <constant>bobj</constant>, and the group is set to the group
+	<constant>Domain Users</constant>, as shown here:
+<screen>
+&rootprompt; chmod ug+s /data/accounts
+&rootprompt; ls -al /data/accounts/maryvfile.txt
+total 1
+drw-rw-r--    2 bobj     Domain Users  12346 Dec 18 18:11 maryvfile.txt
+</screen>
+	</para>
+
+</sect1>
+
+<sect1 id="ch12dblck">
+	<title>Shared Data Integrity</title>
+
+      <para><indexterm>
+	  <primary>data integrity</primary>
+	</indexterm><indexterm>
+	  <primary>multi-user</primary>
+	  <secondary>data access</secondary>
+	</indexterm>
+	The integrity of shared data is often viewed as a particularly emotional issue, especially where
+	there are concurrent problems with multiuser data access. Contrary to the assertions of some who have
+	experienced problems in either area, the cause has nothing to do with the phases of the moons of Jupiter.
+	</para>
+
+	<para>
+	The solution to concurrent multiuser data access problems must consider three separate areas
+	from which the problem may stem:<indexterm>
+	  <primary>locking</primary>
+	  <secondary>Application level</secondary>
+	</indexterm><indexterm>
+	  <primary>locking</primary>
+	  <secondary>Client side</secondary>
+	</indexterm><indexterm>
+	  <primary>locking</primary>
+	  <secondary>Server side</secondary>
+	</indexterm>
+	</para>
+
+	<itemizedlist>
+		<listitem><para>application-level locking controls</para></listitem>
+		<listitem><para>client-side locking controls</para></listitem>
+		<listitem><para>server-side locking controls</para></listitem>
+	</itemizedlist>
+
+      <para><indexterm>
+	  <primary>database applications</primary>
+	</indexterm><indexterm>
+	  <primary>Microsoft Access</primary>
+	</indexterm>
+	Many database applications use some form of application-level access control. An example of one
+	well-known application that uses application-level locking is Microsoft Access. Detailed guidance
+	is provided here because this is the most common application for which problems have been reported.
+	</para>
+
+      <para><indexterm>
+	  <primary>Microsoft Excel</primary>
+	</indexterm><indexterm>
+	  <primary>Act!</primary>
+	</indexterm>
+	Common applications that are affected by client- and server-side locking controls include MS
+	Excel and Act!. Important locking guidance is provided here.
+	</para>
+
+
+	<sect2>
+	<title>Microsoft Access</title>
+
+	<para>
+	The best advice that can be given is to carefully read the Microsoft knowledgebase articles that
+	cover this area. Examples of relevant documents include:
+	</para>
+
+	<itemizedlist>
+	<listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</para></listitem>
+	<listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</para></listitem>
+	</itemizedlist>
+
+
+	<para><indexterm>
+	    <primary>multi-user</primary>
+	    <secondary>access</secondary>
+	  </indexterm><indexterm>
+	    <primary>exclusive open</primary>
+	  </indexterm>
+	Make sure that your MS Access database file is configured for multiuser access (not set for 
+	exclusive open). Open MS Access on each client workstation, then set the following: <menuchoice>
+	<guimenu>(Menu bar) Tools</guimenu><guimenu>Options</guimenu><guimenu>[tab] General</guimenu>
+	</menuchoice>.  Set network path to Default database folder: <filename>\\server\share\folder</filename>.
+	</para>
+
+	<para>
+        You can configure MS Access file sharing behavior as follows: click <guimenu>[tab] Advanced</guimenu>.
+	  Set:<indexterm>
+	    <primary>record locking</primary>
+	  </indexterm>
+	</para>
+
+	<itemizedlist>
+                <listitem><para>Default open mode: Shared</para></listitem>
+                <listitem><para>Default Record Locking: Edited Record</para></listitem>
+                <listitem><para>Open databases using record_level locking</para></listitem>
+	</itemizedlist>
+
+	<para><indexterm>
+	    <primary>MS Access</primary>
+	    <secondary>validate</secondary>
+	  </indexterm>
+        You must now commit the changes so that they will take effect. To do so, click 
+	<guimenu>Apply</guimenu><guimenu>Ok</guimenu>. At this point, you should exit MS Access, restart 
+	it, and then validate that these settings have not changed.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Act! Database Sharing</title>
+
+	<para><indexterm>
+	    <primary>ACT! database</primary>
+	  </indexterm><indexterm>
+	    <primary>data corruption</primary>
+	  </indexterm>
+	Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you 
+	must disable opportunistic locking on the server and all workstations. Failure to do so
+	results in data corruption. This information is available from the Act! Web site
+	knowledgebase articles 
+	<ulink url="http://itdomino.saleslogix.com/act.nsf/docid/1998223162925">1998223162925</ulink>
+	as well as from article
+	<ulink url="http://itdomino.saleslogix.com/act.nsf/docid/200110485036">200110485036</ulink>.
+	</para>
+
+	<para><indexterm>
+	    <primary>opportunistic locking</primary>
+	  </indexterm><indexterm>
+	    <primary>Act!Diag</primary>
+	  </indexterm>
+	These documents clearly state that opportunistic locking must be disabled on both
+	the server (Samba in the case we are interested in here), as well as on every workstation
+	from which the centrally shared Act! database will be accessed. Act! provides
+	a tool called <command>Act!Diag</command> that may be used to disable all workstation
+	registry settings that may otherwise interfere with the operation of Act! 
+	Registered Act! users may download this utility from the Act! Web 
+	<ulink url="http://www.act.com/support/updates/index.cfm">site.</ulink>
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Opportunistic Locking Controls</title>
+
+	<para><indexterm>
+	    <primary>file caching</primary>
+	  </indexterm>
+	Third-party Windows applications may not be compatible with the use of opportunistic file
+	and record locking. For applications that are known not to be compatible,<footnote>Refer to
+	the application manufacturer's installation guidelines and knowledge base for specific
+	information regarding compatibility. It is often safe to assume that if the software
+	manufacturer does not specifically mention incompatibilities with opportunistic file
+	and record locking, or with Windows client file caching, the application is probably
+	compatible with Windows (as well as Samba) default settings.</footnote> oplock
+	support may need to be disabled both on the Samba server and on the Windows workstations.
+	</para>
+
+	<para><indexterm>
+	    <primary>cache</primary>
+	  </indexterm><indexterm>
+	    <primary>write lock</primary>
+	  </indexterm><indexterm>
+	    <primary>flush</primary>
+	    <secondary>cache memory</secondary>
+	  </indexterm>
+	Oplocks enable a Windows client to cache parts of a file that are being
+	edited. Another windows client may then request to open the file with the
+	ability to write to it. The server will then ask the original workstation
+	that had the file open with a write lock to release its lock. Before
+	doing so, that workstation must flush the file from cache memory to the
+	disk or network drive.
+	</para>
+
+	<para><indexterm>
+	    <primary>Oplocks</primary>
+	    <secondary>disabled</secondary>
+	  </indexterm>
+	Disabling of Oplocks usage may require server and client changes.
+	Oplocks may be disabled by file, by file pattern, on the share, or on the
+	Samba server.
+	</para>
+
+	<para>
+	The following are examples showing how Oplock support may be managed using
+	Samba &smb.conf; file settings:
+<screen>
+By file:        veto oplock files = myfile.mdb
+
+By Pattern:     veto oplock files = /*.mdb/
+
+On the Share:   oplocks = No
+                level2 oplocks = No
+
+On the server:
+(in [global])   oplocks = No
+                level2 oplocks = No
+</screen>
+	</para>
+
+	<para>
+	The following registry entries on Microsoft Windows XP Professional, 2000 Professional, and Windows NT4
+	workstation clients must be configured as shown here:
+<screen>
+REGEDIT4
+
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
+            Services\LanmanServer\Parameters]
+      "EnableOplocks"=dword:00000000
+
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
+            Services\LanmanWorkstation\Parameters]
+      "UseOpportunisticLocking"=dword:00000000
+</screen>
+	</para>
+
+	<para>
+	Comprehensive coverage of file and record-locking controls is provided in TOSHARG, Chapter 13.
+	The information in that chapter was obtained from a wide variety of sources.
+	</para>
+
+	</sect2>
+
+</sect1>
+
+</appendix>
+
diff --git a/docs/Samba3-ByExample/SBE-Appendix2.xml b/docs/Samba3-ByExample/SBE-Appendix2.xml
new file mode 100644
index 0000000000..c2e8f29de0
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-Appendix2.xml
@@ -0,0 +1,1283 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<appendix id="primer">
+  <title>Networking Primer</title>
+
+	<para>
+	You are about to use the equivalent of a microscope to look at the information
+	that runs through the veins of a Windows network. We do more to observe the information than
+	to interrogate it. When you are done with this primer, you should have a good understanding
+	of the types of information that flow over the network. Do not worry, this is not
+	a biology lesson. We won't lose you in unnecessary detail. Think to yourself, <quote>This
+	is easy,</quote> then tackle each exercise without fear.
+	</para>
+
+	<para>
+	Samba can be configured with a minimum of complexity. Simplicity should be mastered
+	before you get too deeply into complexities. Let's get moving: we have work to do.
+	</para>
+
+<sect1>
+	<title>Requirements and Notes</title>
+	<para>
+	Successful completion of this primer requires two Microsoft Windows 9x/Me Workstations
+	as well as two Microsoft Windows XP Professional Workstations, each equipped with an Ethernet
+	card connected using a hub. Also required is one additional server (either Windows
+	NT4 Server, Windows 2000 Server, or a Samba-3 on UNIX/Linux server) running a network
+	sniffer and analysis application (ethereal is a good choice). All work should be undertaken
+	on a quiet network where there is no other traffic. It is best to use a dedicated hub
+	with only the machines under test connected at the time of the exercises.
+	</para>
+
+      <para><indexterm>
+	  <primary>Ethereal</primary>
+	</indexterm>
+	Ethereal has become the network protocol analyzer of choice for many network administrators. 
+	You may find more information regarding this tool from the 
+	<ulink url="http://www.ethereal.com">Ethereal</ulink> Web site. Ethereal installation 
+	files for Windows may be obtained from the Ethereal Web site. Ethereal is provided with 
+	SUSE and Red Hat Linux distributions, as well as with many other Linux distributions. It may 
+	not be installed on your system by default. If it is not installed, you may also need 
+	to install the <command>libpcap </command> software before you can install or use Ethereal. 
+	Please refer to the instructions for your operating system or to the Ethereal Web site 
+	for information regarding the installation and operation of Ethereal.
+	</para>
+
+	<para>
+	To obtain <command>ethereal</command> for your system, please visit the Ethereal
+	<ulink url="http://www.ethereal.com/download.html#binaries">download site</ulink>.
+	</para>
+
+	<note><para>
+	The successful completion of this appendix requires that you capture network traffic
+	using <command>Ethereal</command>. It is recommended that you use a hub, not an
+	Ethernet switch. It is necessary for the device used to act as a repeater, not as a
+	filter. Ethernet switches may filter out traffic that is not directed at the machine
+	that is used to monitor traffic; this would not allow you to complete the projects.
+	</para></note>
+
+	<para>
+	<indexterm><primary>network</primary><secondary>captures</secondary></indexterm>
+	Do not worry too much if you do not have access to all this equipment; network captures
+	from the exercises are provided on the enclosed CD-ROM. This makes it possible to dive directly
+	into the analytical part of the exercises if you so desire.
+	</para>
+
+      <para><indexterm>
+	  <primary>network</primary>
+	  <secondary>sniffer</secondary>
+	</indexterm><indexterm>
+	  <primary>protocol analysis</primary>
+	</indexterm>
+	Please do not be alarmed at the use of a high-powered analysis tool (Ethereal) in this
+	primer.  We expose you only to a minimum of detail necessary to complete 
+	the exercises. If you choose to use any other network sniffer and protocol
+	analysis tool, be advised that it may not allow you to examine the contents of
+	recently added security protocols used by Windows 200x/XP.
+	</para>
+
+	<para>
+	You could just skim through the exercises and try to absorb the key points made. 
+	The exercises provide all the information necessary to convince the die-hard network 
+	engineer. You possibly do not require so much convincing and may just want to move on, 
+	in which case you should at least read <link linkend="chap01conc"/>.
+	</para>
+
+	<para>
+	<link linkend="chap01qa"/> also provides useful information
+	that may help you to avoid significantly time-consuming networking problems.
+	</para>
+</sect1>
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>
+	The purpose of this appendix is to create familiarity with key aspects of Microsoft Windows
+	network computing. If you want a solid technical grounding, do not gloss over these exercises. 
+	The points covered are recurrent issues on the Samba mailing lists. 
+	</para>
+
+      <para><indexterm>
+	  <primary>network</primary>
+	  <secondary>broadcast</secondary>
+	</indexterm>
+	You can see from these exercises that Windows networking involves quite a lot of network
+	broadcast traffic. You can look into the contents of some packets, but only to see
+	some particular information that the Windows client sends to a server in the course of
+	establishing a network connection.
+	</para>
+
+	<para>
+	To many people, browsing is everything that happens when one uses Microsoft Internet Explorer.
+	It is only when you start looking at network traffic and noting the protocols
+	and types of information that are used that you can begin to appreciate the complexities of
+	Windows networking and, more importantly, what needs to be configured so that it can work.
+	Detailed information regarding browsing is provided in the recommended
+	preparatory reading.
+	</para>
+
+	<para>
+	Recommended preparatory reading: <emphasis>The Official Samba-3 HOWTO and Reference Guide</emphasis> (TOSHARG) 
+	Chapter 9, <quote>Network Browsing,</quote> and Chapter 3, <quote>Server Types and 
+	Security Modes.</quote>
+	</para>
+
+	<sect2>
+	<title>Assignment Tasks</title>
+
+	<para><indexterm>
+	    <primary>browsing</primary>
+	  </indexterm>
+		You are about to witness how Microsoft Windows computer networking functions. The
+		exercises step through identification of how a client machine establishes a
+		connection to a remote Windows server. You observe how Windows machines find
+		each other (i.e., how browsing works) and how the two key types of user identification
+		(share mode security and user mode security) are affected.
+		</para>
+
+	<para><indexterm>
+	    <primary>network</primary>
+	    <secondary>analyzer</secondary>
+	  </indexterm>
+		The networking protocols used by MS Windows networking when working with Samba
+		use TCP/IP as the transport protocol. The protocols that are specific to Windows
+		networking are encapsulated in TCP/IP. The network analyzer we use (Ethereal)
+		is able to show you the contents of the TCP/IP packets (or messages).
+		</para>
+
+		<procedure id="chap01tasks">
+		<title>Diagnostic Tasks</title>
+
+	  <step><para><indexterm>
+		<primary>network</primary>
+		<secondary>trace</secondary>
+	      </indexterm><indexterm>
+		<primary>host announcement</primary>
+	      </indexterm><indexterm>
+		<primary>name resolution</primary>
+	      </indexterm>
+			Examine network traces to witness SMB broadcasts, host announcements,
+			and name resolution processes.
+			</para></step>
+
+			<step><para>
+			Examine network traces to witness how share mode security functions.
+			</para></step>
+
+			<step><para>
+			Examine network traces to witness the use of user mode security.
+			</para></step>
+
+			<step><para>
+			Review traces of network logons for a Windows 9x/Me client as well as
+			a domain logon for a Windows XP Professional client.
+			</para></step>
+		</procedure>
+
+	</sect2>
+</sect1>
+
+<sect1>
+	<title>Exercises</title>
+
+	<para>
+	<indexterm><primary>ethereal</primary></indexterm>
+	You are embarking on a course of discovery. The first part of the exercise requires
+	two MS Windows 9x/Me systems. We called one machine <constant>WINEPRESSME</constant> and the
+	other <constant>MILGATE98</constant>. Each needs an IP address; we used <literal>10.1.1.10</literal>
+	and <literal>10.1.1.11</literal>. The test machines need to be networked via a <emphasis>hub</emphasis>. A UNIX/Linux
+	machine is required to run <command>Ethereal</command> to enable the network activity to be captured.
+	It is important that the machine from which network activity is captured must not interfere with
+	the operation of the Windows workstations. It is helpful for this machine to be passive (does not
+	send broadcast information) to the network.
+	</para>
+
+	<para>
+	For these exercises, our test environment consisted of a SUSE 9.2 Professional Linux Workstation running
+	VMWare 4.5. The following VMWare images were prepared:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>Windows 98 &smbmdash; name: MILGATE98</para></listitem>
+		<listitem><para>Windows Me &smbmdash; name: WINEPRESSME</para></listitem>
+		<listitem><para>Windows XP Professional &smbmdash; name: LightrayXP</para></listitem>
+		<listitem><para>Samba-3.0.20 running on a SUSE Enterprise Linux 9</para></listitem>
+	</itemizedlist>
+
+	<para>
+	Choose a workgroup name (MIDEARTH) for each exercise.
+	</para>
+
+	<para>
+	<indexterm><primary>ethereal</primary></indexterm>
+	The network captures provided on the CD-ROM included with this book were captured using <constant>Ethereal</constant>
+	version <literal>0.10.6</literal>. A later version suffices without problems, but an earlier version may not
+	expose all the information needed. Each capture file has been decoded and listed as a trace file. A summary of all
+	packets has also been included. This makes it possible for you to do all the studying you like without the need to
+	perform the time-consuming equipment configuration and test work. This is a good time to point out that the value
+	that can be derived from this book really does warrant your taking sufficient time to practice each exercise with
+	care and attention to detail.
+	</para>
+
+	<sect2>
+	<title>Single-Machine Broadcast Activity</title>
+
+	<para>
+	In this section, we start a single Windows 9x/Me machine, then monitor network activity for 30 minutes.
+	</para>
+
+	<procedure>
+	<title>Monitoring Windows 9x Steps</title>
+
+		<step><para>
+		Start the machine from which network activity will be monitored (using <command>ethereal</command>).
+		Launch <command>ethereal</command>, click
+			<menuchoice>
+				<guimenu>Capture</guimenu>
+				<guimenuitem>Start</guimenuitem>
+			</menuchoice>.
+		</para>
+
+		<para>
+		Click the following: 
+		<orderedlist>
+		<listitem><para>Update list of packets in real time</para></listitem>
+		<listitem><para>Automatic scrolling in live capture</para></listitem>
+		<listitem><para>Enable MAC name resolution</para></listitem>
+		<listitem><para>Enable network name resolution</para></listitem>
+		<listitem><para>Enable transport name resolution</para></listitem>
+		</orderedlist>
+		Click <guibutton>OK</guibutton>.
+		</para></step>
+
+		<step><para>
+		Start the Windows 9x/Me machine to be monitored. Let it run for a full 30 minutes. While monitoring,
+		do not press any keyboard keys, do not click any on-screen icons or menus, and do not answer any dialog boxes.
+		</para></step>
+
+		<step><para>
+		At the conclusion of 30 minutes, stop the capture. Save the capture to a file so you can go back to it later.
+		Leave this machine running in preparation for the task in <link linkend="secondmachine"/>.
+		</para></step>
+
+		<step><para>
+		Analyze the capture. Identify each discrete message type that was captured. Note what transport protocol
+		was used. Identify the timing between messages of identical types.
+		</para></step>
+
+	</procedure>
+
+		<sect3>
+		<title>Findings</title>
+
+		<para>
+		The summary of the first 10 minutes of the packet capture should look like <link linkend="pktcap01"/>.
+		A screenshot of a later stage of the same capture is shown in <link linkend="pktcap02"/>.
+		</para>
+
+		<image id="pktcap01">
+			<imagedescription>Windows Me &smbmdash; Broadcasts &smbmdash; The First 10 Minutes</imagedescription>
+			<imagefile scale="40">WINREPRESSME-Capture</imagefile>
+		</image>
+
+		<image id="pktcap02">
+			<imagedescription>Windows Me &smbmdash; Later Broadcast Sample</imagedescription>
+			<imagefile scale="42">WINREPRESSME-Capture2</imagefile>
+		</image>
+
+	  <para><indexterm>
+	      <primary>Local Master Browser</primary>
+	      <see>LMB</see>
+	    </indexterm><indexterm>
+	      <primary>LMB</primary>
+	    </indexterm>
+		Broadcast messages observed are shown in <link linkend="capsstats01"/>.
+		Actual observations vary a little, but not by much.
+		Early in the startup process, the Windows Me machine broadcasts its name for two reasons:
+		first to ensure that its name would not result in a name clash, and second to establish its
+		presence with the Local Master Browser (LMB).
+		</para>
+
+		<table id="capsstats01">
+			<title>Windows Me &smbmdash; Startup Broadcast Capture Statistics</title>
+			<tgroup cols="4">
+				<colspec align="left" colwidth="3*"/>
+				<colspec align="center"/>
+				<colspec align="center"/>
+				<colspec align="left" colwidth="3*"/>
+				<thead>
+					<row>
+						<entry>Message</entry>
+						<entry>Type</entry>
+						<entry>Num</entry>
+						<entry>Notes</entry>
+					</row>
+				</thead>
+				<tbody>
+					<row>
+						<entry>WINEPRESSME&lt;00&gt;</entry>
+						<entry>Reg</entry>
+						<entry>8</entry>
+						<entry>4 lots of 2, 0.6 sec apart</entry>
+					</row>
+					<row>
+						<entry>WINEPRESSME&lt;03&gt;</entry>
+						<entry>Reg</entry>
+						<entry>8</entry>
+						<entry>4 lots of 2, 0.6 sec apart</entry>
+					</row>
+					<row>
+						<entry>WINEPRESSME&lt;20&gt;</entry>
+						<entry>Reg</entry>
+						<entry>8</entry>
+						<entry>4 lots of 2, 0.75 sec apart</entry>
+					</row>
+					<row>
+						<entry>MIDEARTH&lt;00&gt;</entry>
+						<entry>Reg</entry>
+						<entry>8</entry>
+						<entry>4 lots of 2, 0.75 sec apart</entry>
+					</row>
+					<row>
+						<entry>MIDEARTH&lt;1d&gt;</entry>
+						<entry>Reg</entry>
+						<entry>8</entry>
+						<entry>4 lots of 2, 0.75 sec apart</entry>
+					</row>
+					<row>
+						<entry>MIDEARTH&lt;1e&gt;</entry>
+						<entry>Reg</entry>
+						<entry>8</entry>
+						<entry>4 lots of 2, 0.75 sec apart</entry>
+					</row>
+					<row>
+						<entry>MIDEARTH&lt;1b&gt;</entry>
+						<entry>Qry</entry>
+						<entry>84</entry>
+						<entry>300 sec apart at stable operation</entry>
+					</row>
+					<row>
+						<entry>__MSBROWSE__</entry>
+						<entry>Reg</entry>
+						<entry>8</entry>
+						<entry>Registered after winning election to Browse Master</entry>
+					</row>
+					<row>
+						<entry>JHT&lt;03&gt;</entry>
+						<entry>Reg</entry>
+						<entry>8</entry>
+						<entry>4 x 2. This is the name of the user that logged onto Windows</entry>
+					</row>
+					<row>
+						<entry>Host Announcement WINEPRESSME</entry>
+						<entry>Ann</entry>
+						<entry>2</entry>
+						<entry>Observed at 10 sec</entry>
+					</row>
+					<row>
+						<entry>Domain/Workgroup Announcement MIDEARTH</entry>
+						<entry>Ann</entry>
+						<entry>18</entry>
+						<entry>300 sec apart at stable operation</entry>
+					</row>
+					<row>
+						<entry>Local Master Announcement WINEPRESSME</entry>
+						<entry>Ann</entry>
+						<entry>18</entry>
+						<entry>300 sec apart at stable operation</entry>
+					</row>
+					<row>
+						<entry>Get Backup List Request</entry>
+						<entry>Qry</entry>
+						<entry>12</entry>
+						<entry>6 x 2 early in startup, 0.5 sec apart</entry>
+					</row>
+					<row>
+						<entry>Browser Election Request</entry>
+						<entry>Ann</entry>
+						<entry>10</entry>
+						<entry>5 x 2 early in startup</entry>
+					</row>
+					<row>
+						<entry>Request Announcement WINEPRESSME</entry>
+						<entry>Ann</entry>
+						<entry>4</entry>
+						<entry>Early in startup</entry>
+					</row>
+				</tbody>
+			</tgroup>
+		</table>
+
+	  <para><indexterm>
+	      <primary>election</primary>
+	    </indexterm><indexterm>
+	      <primary>browse master</primary>
+	    </indexterm>
+		From the packet trace, it should be noted that no messages were propagated over TCP/IP;
+		all messages employed UDP/IP.  When steady-state operation has been achieved, there is a cycle
+		of various announcements, re-election of a browse master, and name queries. These create
+		the symphony of announcements by which network browsing is made possible.
+		</para>
+	
+	  <para><indexterm>
+	      <primary>CIFS</primary>
+	    </indexterm>
+		For detailed information regarding the precise behavior of the CIFS/SMB protocols,
+		refer to the book <quote>Implementing CIFS: The Common Internet File System,</quote>
+		by Christopher Hertel, (Prentice Hall PTR, ISBN: 013047116X).
+		</para>
+
+		</sect3>
+
+	</sect2>
+
+	<sect2 id="secondmachine">
+	<title>Second Machine Startup Broadcast Interaction</title>
+
+	<para>
+	At this time, the machine you used to capture the single-system startup trace should still be running.
+	The objective of this task is to identify the interaction of two machines in respect to broadcast activity.
+	</para>
+
+	<procedure>
+	<title>Monitoring of Second Machine Activity</title>
+
+		<step><para>
+		On the machine from which network activity will be monitored (using <command>ethereal</command>),
+		launch <command>ethereal</command> and click
+			<menuchoice>
+				<guimenu>Capture</guimenu>
+				<guimenuitem>Start</guimenuitem>
+			</menuchoice>.
+		</para>
+
+		<para>
+		Click: 
+		<orderedlist>
+			<listitem><para>Update list of packets in real time</para></listitem>
+			<listitem><para>Automatic scrolling in live capture</para></listitem>
+			<listitem><para>Enable MAC name resolution</para></listitem>
+			<listitem><para>Enable network name resolution</para></listitem>
+			<listitem><para>Enable transport name resolution</para></listitem>
+		</orderedlist>
+		Click <guibutton>OK</guibutton>.
+		</para></step>
+
+		<step><para>
+		Start the second Windows 9x/Me machine. Let it run for 15 to 20 minutes. While monitoring, do not press
+		any keyboard keys, do not click any on-screen icons or menus, and do not answer any dialog boxes.
+		</para></step>
+
+		<step><para>
+		At the conclusion of the capture time, stop the capture. Be sure to save the captured data so you
+		can examine the network data capture again at a later date should that be necessary.
+		</para></step>
+
+		<step><para>
+		Analyze the capture trace, taking note of the transport protocols used, the types of messages observed,
+		and what interaction took place between the two machines. Leave both machines running for the next task.
+		</para></step>
+	</procedure>
+
+		<sect3>
+		<title>Findings</title>
+
+		<para>
+		<link linkend="capsstats02"/> summarizes capture statistics observed. As in the previous case,
+		all announcements used UDP/IP broadcasts. Also, as was observed with the last example, the second
+		Windows 9x/Me machine broadcasts its name on startup to ensure that there exists no name clash
+		(i.e., the name is already registered by another machine) on the network segment. Those wishing
+		to explore the inner details of the precise mechanism of how this functions should refer to
+		<quote>Implementing CIFS: The Common Internet File System.</quote>
+		</para>
+
+		<table id="capsstats02">
+                        <title>Second Machine (Windows 98) &smbmdash; Capture Statistics</title>
+                        <tgroup cols="4">
+                                <colspec align="left" colwidth="3*"/>
+                                <colspec align="center"/>
+                                <colspec align="center"/>
+                                <colspec align="left" colwidth="3*"/>
+                                <thead>
+                                        <row>
+                                                <entry>Message</entry>
+                                                <entry>Type</entry>
+                                                <entry>Num</entry>
+                                                <entry>Notes</entry>
+                                        </row>
+                                </thead>
+                                <tbody>
+                                        <row>
+                                                <entry>MILGATE98&lt;00&gt;</entry>
+                                                <entry>Reg</entry>
+                                                <entry>8</entry>
+                                                <entry>4 lots of 2, 0.6 sec apart</entry>
+                                        </row>
+                                        <row>
+                                                <entry>MILGATE98&lt;03&gt;</entry>
+                                                <entry>Reg</entry>
+                                                <entry>8</entry>
+                                                <entry>4 lots of 2, 0.6 sec apart</entry>
+                                        </row>
+                                        <row>
+                                                <entry>MILGATE98&lt;20&gt;</entry>
+                                                <entry>Reg</entry>
+                                                <entry>8</entry>
+                                                <entry>4 lots of 2, 0.75 sec apart</entry>
+                                        </row>
+                                        <row>
+                                                <entry>MIDEARTH&lt;00&gt;</entry>
+                                                <entry>Reg</entry>
+                                                <entry>8</entry>
+                                                <entry>4 lots of 2, 0.75 sec apart</entry>
+                                        </row>
+                                        <row>
+                                                <entry>MIDEARTH&lt;1d&gt;</entry>
+                                                <entry>Reg</entry>
+                                                <entry>8</entry>
+                                                <entry>4 lots of 2, 0.75 sec apart</entry>
+                                        </row>
+                                        <row>
+                                                <entry>MIDEARTH&lt;1e&gt;</entry>
+                                                <entry>Reg</entry>
+                                                <entry>8</entry>
+                                                <entry>4 lots of 2, 0.75 sec apart</entry>
+                                        </row>
+                                        <row>
+                                                <entry>MIDEARTH&lt;1b&gt;</entry>
+                                                <entry>Qry</entry>
+                                                <entry>18</entry>
+                                                <entry>900 sec apart at stable operation</entry>
+                                        </row>
+                                        <row>
+                                                <entry>JHT&lt;03&gt;</entry>
+                                                <entry>Reg</entry>
+                                                <entry>2</entry>
+                                                <entry>This is the name of the user that logged onto Windows</entry>
+                                        </row>
+                                        <row>
+                                                <entry>Host Announcement MILGATE98</entry>
+                                                <entry>Ann</entry>
+                                                <entry>14</entry>
+                                                <entry>Every 120 sec</entry>
+                                        </row>
+                                        <row>
+                                                <entry>Domain/Workgroup Announcement MIDEARTH</entry>
+                                                <entry>Ann</entry>
+                                                <entry>6</entry>
+                                                <entry>900 sec apart at stable operation</entry>
+                                        </row>
+                                        <row>
+                                                <entry>Local Master Announcement WINEPRESSME</entry>
+                                                <entry>Ann</entry>
+                                                <entry>6</entry>
+                                                <entry>Insufficient detail to determine frequency</entry>
+                                        </row>
+				</tbody>
+			</tgroup>
+		</table>
+
+		<para>
+	    	<indexterm><primary>host announcement</primary></indexterm>
+		<indexterm><primary>Local Master Announcement</primary></indexterm>
+		<indexterm><primary>Workgroup Announcement</primary></indexterm>
+		Observation of the contents of Host Announcements, Domain/Workgroup Announcements,
+		and Local Master Announcements is instructive. These messages convey a significant
+		level of detail regarding the nature of each machine that is on the network. An example
+		dissection of a Host Announcement is given in <link linkend="hostannounce"/>.
+		</para>
+
+
+		<image id="hostannounce">
+			<imagedescription>Typical Windows 9x/Me Host Announcement</imagedescription>
+			<imagefile scale="41">HostAnnouncment</imagefile>
+		</image>
+		</sect3>
+
+	</sect2>
+
+	<sect2>
+	<title>Simple Windows Client Connection Characteristics</title>
+
+	<para>
+	The purpose of this exercise is to discover how Microsoft Windows clients create (establish)
+	connections with remote servers. The methodology involves analysis of a key aspect of how
+	Windows clients access remote servers: the session setup protocol.
+	</para>
+
+	<procedure>
+	<title>Client Connection Exploration Steps</title>
+
+		<step><para>
+		Configure a Windows 9x/Me machine (MILGATE98) with a share called <constant>Stuff</constant>.
+		Create a <parameter>Full Access</parameter> control password on this share.
+		</para></step>
+
+		<step><para>
+		Configure another Windows 9x/Me machine (WINEPRESSME) as a client. Make sure that it exports
+		no shared resources.
+		</para></step>
+
+		<step><para>
+		Start both Windows 9x/Me machines and allow them to stabilize for 10 minutes. Log on to both
+		machines using a user name (JHT) of your choice. Wait approximately 2 minutes before proceeding.
+		</para></step>
+
+		<step><para>
+		Start ethereal (or the network sniffer of your choice).
+		</para></step>
+
+		<step><para>
+		From the WINEPRESSME machine, right-click <guimenu>Network Neighborhood</guimenu>, select
+		<guimenuitem>Explore</guimenuitem>, select 
+		<menuchoice>
+			<guimenuitem>My Network Places</guimenuitem>
+			<guimenuitem>Entire Network</guimenuitem>
+			<guimenuitem>MIDEARTH</guimenuitem>
+			<guimenuitem>MILGATE98</guimenuitem>
+			<guimenuitem>Stuff</guimenuitem>
+		</menuchoice>.
+		Enter the password you set for the <constant>Full Control</constant> mode for the
+		<constant>Stuff</constant> share.
+		</para></step>
+
+		<step><para>
+		When the share called <constant>Stuff</constant> is being displayed, stop the capture.
+		Save the captured data in case it is needed for later analysis.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>session setup</primary></indexterm>
+		From the top of the packets captured, scan down to locate the first packet that has
+		interpreted as <constant>Session Setup AndX, User: anonymous; Tree Connect AndX, 
+		Path: \\MILGATE98\IPC$</constant>.
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>Session Setup</primary>
+	      </indexterm><indexterm>
+		<primary>Tree Connect</primary>
+	      </indexterm>
+		In the dissection (analysis) panel, expand the <constant>SMB, Session Setup AndX Request,
+		and Tree Connect AndX Request</constant>. Examine both operations. Identify the name of
+		the user Account and what password was used. The Account name should be empty.
+		This is a <constant>NULL</constant> session setup packet.
+		</para></step>
+
+		<step><para>
+		Return to the packet capture sequence. There will be a number of packets that have been
+		decoded of the type <constant>Session Setup AndX</constant>. Locate the last such packet
+		that was targeted at the <constant>\\MILGATE98\IPC$</constant> service.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>password length</primary></indexterm>
+		<indexterm><primary>User Mode</primary></indexterm>
+		Dissect this packet as per the previous one. This packet should have a password length
+		of 24 (characters) and should have a password field, the contents of which is a
+		long hexadecimal number. Observe the name in the Account field. This is a User Mode
+		session setup packet.
+		</para></step>
+	</procedure>
+
+		<sect3>
+		<title>Findings and Comments</title>
+
+	  	<para>
+		<indexterm><primary>IPC$</primary></indexterm>
+		The <constant>IPC$</constant> share serves a vital purpose<footnote><para>TOSHARG, Sect 4.5.1</para></footnote> 
+		in SMB/CIFS-based networking.  A Windows client connects to this resource to obtain the list of 
+		resources that are available on the server. The server responds with the shares and print queues that
+		are available. In most but not all cases, the connection is made with a <constant>NULL</constant>
+		username and a <constant>NULL</constant> password.
+		</para>
+
+	  	<para>
+		<indexterm><primary>account credentials</primary></indexterm>
+		The two packets examined are material evidence of how Windows clients may
+		interoperate with Samba. Samba requires every connection setup to be authenticated using
+		valid UNIX account credentials (UID/GID). This means that even a <constant>NULL</constant>
+		session setup can be established only by automatically mapping it to a valid UNIX
+		account.
+		</para>
+
+		<para>
+	    <indexterm><primary>NULL session</primary></indexterm><indexterm>
+	      <primary>guest account</primary>
+	    </indexterm>
+	    <indexterm><primary>nobody</primary></indexterm>
+		Samba has a special name for the <constant>NULL</constant>, or empty, user account:
+		it calls it the <smbconfoption name="guest account"/>. The
+		default value of this parameter is <constant>nobody</constant>; however, this can be
+		changed to map the function of the guest account to any other UNIX identity. Some
+		UNIX administrators prefer to map this account to the system default anonymous
+		FTP account. A sample NULL Session Setup AndX packet dissection is shown in
+		<link linkend="nullconnect"/>.
+		</para>
+
+		<image id="nullconnect">
+			<imagedescription>Typical Windows 9x/Me NULL SessionSetUp AndX Request</imagedescription>
+
+			<imagefile scale="41">NullConnect</imagefile>
+		</image>
+
+		<para>
+	    	<indexterm><primary>nobody</primary></indexterm>
+		<indexterm><primary>/etc/passwd</primary></indexterm>
+		<indexterm><primary>guest account</primary></indexterm>
+		When a UNIX/Linux system does not have a <constant>nobody</constant> user account
+		(<filename>/etc/passwd</filename>), the operation of the <constant>NULL</constant>
+		account cannot validate and thus connections that utilize the guest account
+		fail. This breaks all ability to browse the Samba server and is a common
+		problem reported on the Samba mailing list. A sample User Mode session setup AndX
+		is shown in <link linkend="userconnect"/>.
+		</para>
+
+		<image id="userconnect">
+			<imagedescription>Typical Windows 9x/Me User SessionSetUp AndX Request</imagedescription>
+			<imagefile scale="41">UserConnect</imagefile>
+		</image>
+
+	 	<para>
+		<indexterm><primary>encrypted</primary></indexterm>
+		The User Mode connection packet contains the account name and the domain name.
+		The password is provided in Microsoft encrypted form, and its length is shown
+		as 24 characters. This is the length of Microsoft encrypted passwords.
+		</para>
+
+		</sect3>
+
+	</sect2>
+
+	<sect2>
+	<title>Windows 200x/XP Client Interaction with Samba-3</title>
+
+	<para>
+	By now you may be asking, <quote>Why did you choose to work with Windows 9x/Me?</quote>
+	</para>
+
+	<para>
+	First, we want to demonstrate the simple case. This book is not intended to be a detailed treatise
+	on the Windows networking protocols, but rather to provide prescriptive guidance for deployment of Samba.
+	Second, by starting out with the simple protocol, it can be demonstrated that the more complex case mostly
+	follows the same principles.
+	</para>
+
+	<para>
+	The following exercise demonstrates the case that even MS Windows XP Professional with up-to-date service
+	updates also uses the <constant>NULL</constant> account, as well as user accounts. Simply follow the procedure
+	to complete this exercise.
+	</para>
+
+	<para>
+	To complete this exercise, you need a Windows XP Professional client that has been configured as
+	a domain member of either a Samba-controlled domain or a Windows NT4 or 200x Active Directory domain.
+	Here we do not provide details for how to configure this, as full coverage is provided earlier in this book.
+	</para>
+
+	<procedure>
+	<title>Steps to Explore Windows XP Pro Connection Set-up</title>
+
+		<step><para>
+		Start your domain controller. Also, start the ethereal monitoring machine, launch ethereal,
+		and then wait for the next step to complete.
+		</para></step>
+
+		<step><para>
+		Start the Windows XP Client and wait 5 minutes before proceeding.
+		</para></step>
+
+		<step><para>
+		On the machine from which network activity will be monitored (using <command>ethereal</command>),
+                launch <command>ethereal</command> and click
+                        <menuchoice>
+                                <guimenu>Capture</guimenu>
+                                <guimenuitem>Start</guimenuitem>
+                        </menuchoice>.
+                </para>
+
+                <para>
+                Click:
+                <orderedlist>
+				<listitem><para>Update list of packets in real time</para></listitem>
+				<listitem><para>Automatic scrolling in live capture</para></listitem>
+				<listitem><para>Enable MAC name resolution</para></listitem>
+				<listitem><para>Enable network name resolution</para></listitem>
+				<listitem><para>Enable transport name resolution</para></listitem>
+                </orderedlist>
+                Click <guibutton>OK</guibutton>.
+		</para></step>
+
+		<step><para>
+		On the Windows XP Professional client, press <guimenu>Ctrl-Alt-Delete</guimenu> to bring 
+		up the domain logon screen. Log in using valid credentials for a domain user account.
+		</para></step>
+
+		<step><para>
+		Now proceed to connect to the domain controller as follows:
+		<menuchoice>
+			<guimenu>Start</guimenu>
+			<guimenuitem>(right-click) My Network Places</guimenuitem>
+			<guimenuitem>Explore</guimenuitem>
+			<guimenuitem>{Left Panel} [+] Entire Network</guimenuitem>
+			<guimenuitem>{Left Panel} [+] Microsoft Windows Network</guimenuitem>
+			<guimenuitem>{Left Panel} [+] Midearth</guimenuitem>
+			<guimenuitem>{Left Panel} [+] Frodo</guimenuitem>
+			<guimenuitem>{Left Panel} [+] data</guimenuitem>
+		</menuchoice>. Close the explorer window.
+		</para>
+
+		<para>
+		In this step, our domain name is <constant>Midearth</constant>, the domain controller is called
+		<constant>Frodo</constant>, and we have connected to a share called <constant>data</constant>.
+		</para></step>
+
+		<step><para>
+		Stop the capture on the <command>ethereal</command> monitoring machine. Be sure to save the captured data
+		to a file so that you can refer to it again later.
+		</para></step>
+
+		<step><para>
+		If desired, the Windows XP Professional client and the domain controller are no longer needed for exercises
+		in this appendix.
+		</para></step>
+
+		 <step><para>
+		<indexterm><primary>NTLMSSP_AUTH</primary></indexterm>
+                <indexterm><primary>session setup</primary></indexterm>
+                From the top of the packets captured, scan down to locate the first packet that has
+                interpreted as <constant>Session Setup AndX Request, NTLMSSP_AUTH</constant>.
+                </para></step>
+
+                <step><para>
+		<indexterm><primary>GSS-API</primary></indexterm>
+		<indexterm><primary>SPNEGO</primary></indexterm>
+		<indexterm><primary>NTLMSSP</primary></indexterm>
+                In the dissection (analysis) panel, expand the <constant>SMB, Session Setup AndX Request</constant>.
+		Expand the packet decode information, beginning at the <constant>Security Blob:</constant>
+		entry. Expand the <constant>GSS-API -> SPNEGO -> netTokenTarg -> responseToken -> NTLMSSP</constant>
+		keys.  This should reveal that this is a <constant>NULL</constant> session setup packet.
+		The <constant>User name: NULL</constant> so indicates. An example decode is shown in
+		<link linkend="XPCap01"/>.
+                </para></step>
+
+                <step><para>
+                Return to the packet capture sequence. There will be a number of packets that have been
+                decoded of the type <constant>Session Setup AndX Request</constant>. Click the last such packet that
+		has been decoded as <constant>Session Setup AndX Request, NTLMSSP_AUTH</constant>.
+                </para></step>
+
+                <step><para>
+		<indexterm><primary>encrypted password</primary></indexterm>
+                In the dissection (analysis) panel, expand the <constant>SMB, Session Setup AndX Request</constant>.
+                Expand the packet decode information, beginning at the <constant>Security Blob:</constant>
+                entry. Expand the <constant>GSS-API -> SPNEGO -> netTokenTarg -> responseToken -> NTLMSSP</constant>
+                keys.  This should reveal that this is a <constant>User Mode</constant> session setup packet.
+                The <constant>User name: jht</constant> so indicates. An example decode is shown in
+                <link linkend="XPCap02"/>. In this case the user name was <constant>jht</constant>. This packet
+		decode includes the <constant>Lan Manager Response:</constant> and the <constant>NTLM Response:</constant>.
+		The values of these two parameters are the Microsoft encrypted password hashes: respectively, the LanMan
+		password and then the NT (case-preserving) password hash.
+                </para></step>
+
+                <step><para>
+                <indexterm><primary>password length</primary></indexterm>
+                <indexterm><primary>User Mode</primary></indexterm>
+                The passwords are 24-character hexadecimal numbers. This packet confirms that this is a User Mode
+		session setup packet.
+                </para></step>
+
+	</procedure>
+
+	<image id="XPCap01">
+        <imagedescription>Typical Windows XP NULL Session Setup AndX Request</imagedescription>
+		<imagefile scale="50">WindowsXP-NullConnection</imagefile>
+	</image>
+
+	<image id="XPCap02">
+        <imagedescription>Typical Windows XP User Session Setup AndX Request</imagedescription>
+		<imagefile scale="50">WindowsXP-UserConnection</imagefile>
+	</image>
+
+		<sect3>
+		<title>Discussion</title>
+
+	  <para><indexterm>
+	      <primary>NULL-Session</primary>
+	    </indexterm>
+		This exercise demonstrates that, while the specific protocol for the Session Setup AndX is handled
+		in a more sophisticated manner by recent MS Windows clients, the underlying rules or principles
+		remain the same. Thus it is demonstrated  that MS Windows XP Professional clients still use a 
+		<constant>NULL-Session</constant> connection to query and locate resources on an advanced network
+		technology server (one using Windows NT4/200x or Samba). It also demonstrates that an authenticated
+		connection must be made before resources can be used.
+		</para>
+
+		</sect3>
+
+	</sect2>
+
+	<sect2>
+	<title>Conclusions to Exercises</title>
+
+	<para>
+	In summary, the following points have been established in this appendix:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		When NetBIOS over TCP/IP protocols are enabled, MS Windows networking employs broadcast-oriented messaging protocols to provide knowledge of network services.
+		</para></listitem>
+
+		<listitem><para>
+		Network browsing protocols query information stored on browse masters that manage
+		information provided by NetBIOS Name Registrations and by way of ongoing host 
+		announcements and workgroup announcements.
+		</para></listitem>
+
+		<listitem><para>
+		All Samba servers must be configured with a mechanism for mapping the <constant>NULL-Session</constant>
+		to a valid but nonprivileged UNIX system account.
+		</para></listitem>
+
+		<listitem><para>
+		The use of Microsoft encrypted passwords is built right into the fabric of Windows
+		networking operations. Such passwords cannot be provided from the UNIX <filename>/etc/passwd</filename>
+		database and thus must be stored elsewhere on the UNIX system in a manner that Samba can
+		use. Samba-2.x permitted such encrypted passwords to be stored in the <constant>smbpasswd</constant>
+		file or in an LDAP database. Samba-3 permits use of multiple <parameter>passdb backend</parameter>
+		databases in concurrent deployment. Refer to <emphasis>TOSHARG</emphasis>, Chapter 10, <quote>Account Information Databases.</quote>
+		</para></listitem>
+	</itemizedlist>
+
+	</sect2>
+
+</sect1>
+
+<sect1 id="chap01conc">
+	<title>Dissection and Discussion</title>
+
+	<para>
+	<indexterm><primary>guest account</primary></indexterm>
+	The exercises demonstrate the use of the <constant>guest</constant> account, the way that
+	MS Windows clients and servers resolve computer names to a TCP/IP address, and how connections
+	between a client and a server are established.
+	</para>
+
+	<para>
+	Those wishing background information regarding NetBIOS name types should refer to
+	the Microsoft knowledgebase article
+	<ulink url="http://support.microsoft.com/support/kb/articles/Q102/78/8.asp">Q102878.</ulink>
+	</para>
+
+	<sect2>
+		<title>Technical Issues</title>
+
+		<para>
+		<indexterm><primary>guest account</primary></indexterm>
+		Network browsing involves SMB broadcast announcements, SMB enumeration requests,
+		connections to the <constant>IPC$</constant> share, share enumerations, and SMB connection
+		setup processes. The use of anonymous connections to a Samba server involve the use of
+		the <parameter>guest account</parameter> that must map to a valid UNIX UID.
+		</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1 id="chap01qa">
+	<title>Questions and Answers</title>
+
+	<para>
+	The questions and answers given in this section are designed to highlight important aspects of Microsoft
+	Windows networking.
+	</para>
+
+	<qandaset defaultlabel="chap01qa">
+	<qandaentry>
+	<question>
+
+		<para>
+		What is the significance of the MIDEARTH&lt;1b&gt; type query?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		<indexterm><primary>Domain Master Browser</primary><see>DMB</see></indexterm>
+		<indexterm><primary>DMB</primary></indexterm>
+		This is a broadcast announcement by which the Windows machine is attempting to
+		locate a Domain Master Browser (DMB) in the event that it might exist on the network.
+		Refer to <emphasis>TOSHARG,</emphasis> Chapter 9, Section 9.7, <quote>Technical Overview of Browsing,</quote>
+		for details regarding the function of the DMB and its role in network browsing.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What is the significance of the MIDEARTH&lt;1d&gt; type name registration?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		<indexterm><primary>Local Master Browser</primary><see>LMB</see></indexterm>
+		<indexterm><primary>LMB</primary></indexterm>
+		This name registration records the machine IP addresses of the LMBs.
+		Network clients can query this name type to obtain a list of browser servers from the
+		master browser.
+		</para>
+
+		<para>
+		The LMB is responsible for monitoring all host announcements on the local network and for
+		collating the information contained within them. Using this information, it can provide answers to other Windows
+		network clients that request information such as:
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			The list of machines known to the LMB (i.e., the browse list)
+			</para></listitem>
+
+			<listitem><para>
+			The IP addresses of all domain controllers known for the domain
+			</para></listitem>
+
+			<listitem><para>
+			The IP addresses of LMBs
+			</para></listitem>
+
+			<listitem><para>
+			The IP address of the DMB (if one exists)
+			</para></listitem>
+
+			<listitem><para>
+			The IP address of the LMB on the local segment
+			</para></listitem>
+		</itemizedlist>
+
+        </answer>
+        </qandaentry>
+
+        <qandaentry>
+        <question>
+
+                <para>
+		What is the role and significance of the &lt;01&gt;&lt;02&gt;__MSBROWSE__&lt;02&gt;&lt;01&gt;
+		name registration?
+                </para>
+
+        </question>
+        <answer>
+
+                <para>
+		<indexterm><primary>Browse Master</primary></indexterm>
+		This name is registered by the browse master to broadcast and receive domain announcements.
+		Its scope is limited to the local network segment, or subnet. By querying this name type,
+		master browsers on networks that have multiple domains can find the names of master browsers
+		for each domain.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What is the significance of the MIDEARTH&lt;1e&gt; type name registration?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		<indexterm><primary>Browser Election Service</primary></indexterm>
+		This name is registered by all browse masters in a domain or workgroup. The registration
+		name type is known as the Browser Election Service. Master browsers register themselves
+		with this name type so that DMBs can locate them to perform cross-subnet
+		browse list updates. This name type is also used to initiate elections for Master Browsers.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		<indexterm><primary>guest account</primary></indexterm>
+		What is the significance of the <parameter>guest account</parameter> in smb.conf?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		This parameter specifies the default UNIX account to which MS Windows networking
+		NULL session connections are mapped. The default name for the UNIX account used for
+		this mapping is called <constant>nobody</constant>. If the UNIX/Linux system that
+		is hosting Samba does not have a <constant>nobody</constant> account and an alternate
+		mapping has not been specified, network browsing will not work at all.
+		</para>
+
+		<para>
+		It should be noted that the <parameter>guest account</parameter> is essential to
+		Samba operation. Either the operating system must have an account called <constant>nobody</constant>
+		or there must be an entry in the &smb.conf; file with a valid UNIX account, such as
+		<smbconfoption name="guest account">ftp</smbconfoption>.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Is it possible to reduce network broadcast activity with Samba-3?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		<indexterm><primary>WINS</primary></indexterm>
+		<indexterm><primary>NetBIOS</primary></indexterm>
+		Yes, there are two ways to do this. The first involves use of WINS (See <emphasis>TOSHARG</emphasis>, Chapter 9, 
+		Section 9.5, <quote>WINS &smbmdash; The Windows Inter-networking Name Server</quote>); the
+		alternate method involves disabling the use of NetBIOS over TCP/IP. This second method requires
+		a correctly configured DNS server (see <emphasis>TOSHARG</emphasis>, Chapter 9, Section 9.3, <quote>Discussion</quote>).
+		</para>
+
+		<para>
+		<indexterm><primary>broadcast</primary></indexterm>
+		<indexterm><primary>NetBIOS</primary><secondary>Node Type</secondary></indexterm>
+		<indexterm><primary>Hybrid</primary></indexterm>
+		The use of WINS reduces network broadcast traffic. The reduction is greatest when all network 
+		clients are configured to operate in <parameter>Hybrid Mode</parameter>. This can be effected through 
+		use of DHCP to set the NetBIOS node type to type 8 for all network clients. Additionally, it is 
+		beneficial to configure Samba to use <smbconfoption name="name resolve order">wins host cast</smbconfoption>.
+		</para>
+
+		<note><para>
+		Use of SMB without NetBIOS is possible only on Windows 200x/XP Professional clients and servers, as
+		well as with Samba-3.
+		</para></note>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Can I just use plain-text passwords with Samba?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Yes, you can configure Samba to use plain-text passwords, though this does create a few problems.
+		</para>
+
+		<para>
+		First, the use of <filename>/etc/passwd</filename>-based plain-text passwords requires that registry
+		modifications be made on all MS Windows client machines to enable plain-text passwords support. This
+		significantly diminishes the security of MS Windows client operation. Many network administrators
+		are bitterly opposed to doing this.
+		</para>
+
+		<para>
+		Second, Microsoft has not maintained plain-text password support since the default setting was made
+		disabling this. When network connections are dropped by the client, it is not possible to re-establish
+		the connection automatically. Users need to log off and then log on again. Plain-text password support
+		may interfere with recent enhancements that are part of the Microsoft move toward a more secure computing
+		environment. 
+		</para>
+
+		<para>
+		Samba-3 supports Microsoft encrypted passwords. Be advised not to reintroduce plain-text password handling. 
+		Just create user accounts by running <command>smbpasswd -a 'username'</command>
+		</para>
+
+		<para>
+		It is not possible to add a user to the <parameter>passdb backend</parameter> database unless there is
+		a UNIX system account for that user. On systems that run <command>winbindd</command> to access the Samba
+		PDC/BDC to provide Windows user and group accounts, the <parameter>idmap uid, idmap gid</parameter> ranges
+		set in the &smb.conf; file provide the local UID/GIDs needed for local identity management purposes.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What parameter in the &smb.conf; file is used to enable the use of encrypted passwords?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The parameter in the &smb.conf; file that controls this behavior is known as <parameter>encrypt
+		passwords</parameter>. The default setting for this in Samba-3 is <constant>Yes (Enabled)</constant>.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Is it necessary to specify <smbconfoption name="encrypt passwords">Yes</smbconfoption>
+		when Samba-3 is configured as a domain member?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		No. This is the default behavior.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Is it necessary to specify a <parameter>guest account</parameter> when Samba-3 is configured
+		as a domain member server?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Yes. This is a local function on the server. The default setting is to use the UNIX account
+		<constant>nobody</constant>. If this account does not exist on the UNIX server, then it is
+		necessary to provide a <smbconfoption name="guest account">an_account</smbconfoption>,
+		where <constant>an_account</constant> is a valid local UNIX user account.
+		</para>
+
+	</answer>
+	</qandaentry>
+	</qandaset>
+
+</sect1>
+
+</appendix>
+
diff --git a/docs/Samba3-ByExample/SBE-DomainAppsSupport.xml b/docs/Samba3-ByExample/SBE-DomainAppsSupport.xml
new file mode 100644
index 0000000000..eefc9c9fb2
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-DomainAppsSupport.xml
@@ -0,0 +1,916 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+
+<chapter id="DomApps">
+<title>Integrating Additional Services</title>
+
+	<para>
+	<indexterm><primary>authentication</primary></indexterm>
+	<indexterm><primary>backends</primary></indexterm>
+	<indexterm><primary>smbpasswd</primary></indexterm>
+	<indexterm><primary>ldapsam</primary></indexterm>
+	<indexterm><primary>Active Directory</primary></indexterm>
+	You've come a long way now. You have pretty much mastered Samba-3 for 
+	most uses it can be put to. Up until now, you have cast Samba-3 in the leading 
+	role, and where authentication was required, you have used one or another of 
+	Samba's many authentication backends (from flat text files with smbpasswd 
+	to LDAP directory integration with ldapsam). Now you can design a 
+	solution for a new Abmas business. This business is running Windows Server 
+	2003 and Active Directory, and these are to stay. It's time to master 
+	implementing Samba and Samba-supported services in a domain controlled by 
+	the latest Windows authentication technologies. Let's get started &smbmdash; this is 
+	leading edge.
+	</para>
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>
+	Abmas has continued its miraculous growth; indeed, nothing seems to be able 
+	to stop its diversification into multiple (and seemingly unrelated) fields. 
+	Its latest acquisition is Abmas Snack Foods, a big player in the snack-food 
+	business.
+	</para>
+
+	<para>
+	With this acquisition comes new challenges for you and your team. Abmas Snack 
+	Foods is a well-developed business with a huge and heterogeneous network. It 
+	already has Windows, NetWare, and Proprietary UNIX, but as yet no Samba or Linux. 
+	The network is mature and well-established, and there is no question of its chosen 
+	user authentication scheme being changed for now. You need to take a wise new 
+	approach.
+	</para>
+
+	<para>
+	You have decided to set the ball rolling by introducing Samba-3 into the network 
+	gradually, taking over key services and easing the way to a full migration and, 
+	therefore, integration into Abmas's existing business later.
+	</para>
+
+	<sect2>
+	<title>Assignment Tasks</title>
+
+		<para>
+		<indexterm><primary>web</primary><secondary>proxying</secondary></indexterm>
+		<indexterm><primary>web</primary><secondary>caching</secondary></indexterm>
+	        You've promised the skeptical Abmas Snack Foods management team 
+		that you can show them how Samba can ease itself and other Open Source 
+		technologies into their existing infrastructure and deliver sound business 
+		advantages. Cost cutting is high on their agenda (a major promise of the 
+		acquisition). You have chosen Web proxying and caching as your proving ground.
+		</para>
+
+		<para>
+		<indexterm><primary>bandwidth</primary></indexterm>
+		<indexterm><primary>Microsoft ISA</primary></indexterm>
+		Abmas Snack Foods has several thousand users housed at its head office 
+		and multiple regional offices, plants, and warehouses. A high proportion of 
+		the business's work is done online, so Internet access for most of these 
+		users is essential. All Internet access, including for all regional offices, 
+		is funneled through the head office and is the job of the (now your) networking 
+		team. The bandwidth requirements were horrific (comparable to a small ISP), and 
+		the team soon discovered proxying and caching. In fact, they became one of 
+		the earliest commercial users of Microsoft ISA.
+		</para>
+
+		<para>
+		<indexterm><primary>Active Directory</primary></indexterm>
+		<indexterm><primary>authenticated</primary></indexterm>
+		<indexterm><primary>proxy</primary></indexterm>
+		The team is not happy with ISA. Because it never lived up to its marketing promises, 
+		it underperformed and had reliability problems. You have pounced on the opportunity 
+		to show what Open Source can do. The one thing they do like, however, is ISA's 
+		integration with Active Directory. They like that their users, once logged on, 
+		are automatically authenticated against the proxy. If your alternative to ISA 
+		can operate completely seamlessly in their Active Directory domain, it will be
+		approved.
+		</para>
+
+		<para>
+		This is a hands-on exercise. You build software applications so
+		that you obtain the functionality Abmas needs.
+		</para>
+
+	</sect2>
+</sect1>
+
+<sect1>
+<title>Dissection and Discussion</title>
+
+	<para>
+	The key requirements in this business example are straightforward. You are not required 
+	to do anything new, just to replicate an existing system, not lose any existing features, 
+	and improve performance. The key points are:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		Internet access for most employees
+		</para></listitem>
+		<listitem><para>
+		Distributed system to accommodate load and geographical distribution of users
+		</para></listitem>
+		<listitem><para>
+		Seamless and transparent interoperability with the existing Active Directory domain
+		</para></listitem>
+	</itemizedlist>
+
+
+	<sect2>
+		<title>Technical Issues</title>
+
+		<para>
+		<indexterm><primary>browsing</primary></indexterm>
+		<indexterm><primary>Squid proxy</primary></indexterm>
+		<indexterm><primary>proxy</primary></indexterm>
+		<indexterm><primary>authentication</primary></indexterm>
+		<indexterm><primary>Internet Explorer</primary></indexterm>
+		<indexterm><primary>winbind</primary></indexterm>
+		<indexterm><primary>NTLM</primary></indexterm>
+		<indexterm><primary>NTLM authentication daemon</primary></indexterm>
+		<indexterm><primary>authentication</primary></indexterm>
+		<indexterm><primary>daemon</primary></indexterm>
+		<indexterm><primary>Active Directory</primary></indexterm>
+		<indexterm><primary>domain</primary><secondary>Active Directory</secondary></indexterm>
+		<indexterm><primary>Kerberos</primary></indexterm><indexterm><primary>token</primary></indexterm>
+		Functionally, the user's Internet Explorer requests a browsing session with the 
+		Squid proxy, for which it offers its AD authentication token. Squid hands off 
+		the authentication request to the Samba-3 authentication helper application
+		called <command>ntlm_auth</command>. This helper is a hook into winbind, the 
+		Samba-3 NTLM authentication daemon. Winbind enables UNIX services to authenticate 
+		against Microsoft Windows domains, including Active Directory domains. As Active 
+		Directory authentication is a modified Kerberos authentication, winbind is assisted 
+		in this by local Kerberos 5 libraries configured to check passwords with the Active 
+		Directory server. Once the token has been checked, a browsing session is established. 
+		This process is entirely transparent and seamless to the user.
+		</para>
+
+		<para>
+		Enabling this consists of:
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			Preparing the necessary environment using preconfigured packages
+			</para></listitem>
+
+			<listitem><para>
+			Setting up raw Kerberos authentication against the Active Directory domain
+			</para></listitem>
+
+			<listitem><para>
+			Configuring, compiling, and then installing the supporting Samba-3 components
+			</para></listitem>
+
+			<listitem><para>
+			Tying it all together
+			</para></listitem>
+		</itemizedlist>
+
+	</sect2>
+
+
+	<sect2>
+		<title>Political Issues</title>
+
+		<para>
+		You are a stranger in a strange land, and all eyes are upon you. Some would even like to see 
+		you fail. For you to gain the trust of your newly acquired IT people, it is essential that your 
+		solution does everything the old one did, but does it better in every way. Only then 
+		will the entrenched positions consider taking up your new way of doing things on a 
+		wider scale.
+		</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Implementation</title>
+
+	<para>
+	<indexterm><primary>Squid</primary></indexterm>
+	First, your system needs to be prepared and in a known good state to proceed. This consists 
+	of making sure that everything the system depends on is present and that everything that could 
+	interfere or conflict with the system is removed. You will be configuring the Squid and Samba-3 
+	packages and updating them if necessary. If conflicting packages of these programs are installed, 
+	they must be removed.
+	</para>
+
+	<para>
+	<indexterm><primary>Red Hat Linux</primary></indexterm>
+	The following packages should be available on your Red Hat Linux system:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		<indexterm><primary>krb5</primary></indexterm>
+		<indexterm><primary>Kerberos</primary></indexterm>
+		krb5-libs
+		</para></listitem>
+
+		<listitem><para>
+		krb5-devel
+		</para></listitem>
+
+		<listitem><para>
+		krb5-workstation
+		</para></listitem>
+
+		<listitem><para>
+		krb5-server
+		</para></listitem>
+
+		<listitem><para>
+		pam_krb5
+		</para></listitem>
+	</itemizedlist>
+
+	<para>
+	<indexterm><primary>SUSE Linux</primary></indexterm>
+	In the case of SUSE Linux, these packages are called:
+	</para>
+
+        <itemizedlist>
+                <listitem><para>
+                heimdal-lib
+                </para></listitem>
+
+                <listitem><para>
+                heimdal-devel
+                </para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>Heimdal</primary></indexterm>
+                heimdal
+                </para></listitem>
+
+                <listitem><para>
+                pam_krb5
+                </para></listitem>
+        </itemizedlist>
+
+	<para>
+	If the required packages are not present on your system, you must install
+	them from the vendor's installation media. Follow the administrative guide
+	for your Linux system to ensure that the packages are correctly updated.
+	</para>
+
+	<note><para>
+	<indexterm><primary>MS Windows Server 2003</primary></indexterm>
+	<indexterm><primary>Kerberos</primary></indexterm>
+	<indexterm><primary>MIT</primary></indexterm>
+	If the requirement is for interoperation with MS Windows Server 2003, it
+	will be necessary to ensure that you are using MIT Kerberos version 1.3.1
+	or later. Red Hat Linux 9 ships with MIT Kerberos 1.2.7 and thus requires
+	updating.
+	</para>
+
+	<para>
+	<indexterm><primary>Heimdal</primary></indexterm>
+	<indexterm><primary>SUSE Enterprise Linux Server</primary></indexterm>
+	Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise
+	Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version.
+	</para></note>
+
+	<sect2 id="ch10-one">
+	<title>Removal of Pre-Existing Conflicting RPMs</title>
+
+	<para>
+	<indexterm><primary>Squid</primary></indexterm>
+	If Samba and/or Squid RPMs are installed, they should be updated. You can 
+	build both from source.
+	</para>
+
+	<para>
+	<indexterm><primary>rpm</primary></indexterm>
+	<indexterm><primary>samba</primary></indexterm>
+	<indexterm><primary>squid</primary></indexterm>
+	Locating the packages to be un-installed can be achieved by running:
+<screen>
+&rootprompt; rpm -qa | grep -i samba
+&rootprompt; rpm -qa | grep -i squid
+</screen>
+	The identified packages may be removed using:
+<screen>
+&rootprompt; rpm -e samba-common
+</screen>
+	</para>
+
+	<sect2>
+	<title>Kerberos Configuration</title>
+
+	<para>
+	<indexterm><primary>Kerberos</primary></indexterm>
+	<indexterm><primary>Active Directory</primary><secondary>server</secondary></indexterm>
+	<indexterm><primary>ADS</primary></indexterm>
+	<indexterm><primary>KDC</primary></indexterm>
+	The systems Kerberos installation must be configured to communicate with 
+	your primary Active Directory server (ADS KDC).
+	</para>
+
+	<para>
+	Strictly speaking, MIT Kerberos version 1.3.4 currently gives the best results, 
+	although the current default Red Hat MIT version 1.2.7 gives acceptable results 
+	unless you are using Windows 2003 servers.
+	</para>
+
+	<para>
+	<indexterm><primary>MIT</primary></indexterm>
+	<indexterm><primary>Heimdal</primary></indexterm>
+	<indexterm><primary>Kerberos</primary></indexterm>
+	<indexterm><primary>/etc/krb5.conf</primary></indexterm>
+	<indexterm><primary>DNS</primary><secondary>SRV records</secondary></indexterm>
+	<indexterm><primary>KDC</primary></indexterm>
+	<indexterm><primary>DNS</primary><secondary>lookup</secondary></indexterm>
+	Officially, neither MIT (1.3.4) nor Heimdal (0.63) Kerberos needs an <filename>/etc/krb5.conf</filename> 
+	file in order to work correctly. All ADS domains automatically create SRV records in the 
+	DNS zone <constant>Kerberos.REALM.NAME</constant> for each KDC in the realm. Since both 
+	MIT and Heimdal, KRB5 libraries default to checking for these records, so they 
+	automatically find the KDCs. In addition, <filename>krb5.conf</filename> allows 
+	specifying only a single KDC, even if there is more than one. Using the DNS lookup 
+	allows the KRB5 libraries to use whichever KDCs are available.
+	</para>
+
+	<procedure>
+	<title>Kerberos Configuration Steps</title>
+
+		<step><para>
+		<indexterm><primary>krb5.conf</primary></indexterm>
+		If you find the need to manually configure the <filename>krb5.conf</filename>, you should edit it
+		to have the contents shown in <link linkend="ch10-krb5conf"/>. The final fully qualified path for this file 
+		should be <filename>/etc/krb5.conf</filename>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>Kerberos</primary></indexterm>
+		<indexterm><primary>realm</primary></indexterm>
+		<indexterm><primary>case-sensitive</primary></indexterm>
+		<indexterm><primary>KDC</primary></indexterm>
+		<indexterm><primary>synchronization</primary></indexterm>
+		<indexterm><primary>initial credentials</primary></indexterm>
+		<indexterm><primary>Clock skew</primary></indexterm>
+		<indexterm><primary>NTP</primary></indexterm>
+		<indexterm><primary>DNS</primary><secondary>lookup</secondary></indexterm>
+		<indexterm><primary>reverse DNS</primary></indexterm>
+		<indexterm><primary>NetBIOS name </primary></indexterm>
+		<indexterm><primary>/etc/hosts</primary></indexterm>
+		<indexterm><primary>mapping</primary></indexterm>
+		The following gotchas often catch people out. Kerberos is case sensitive. Your realm must
+		be in UPPERCASE, or you will get an error: <quote>Cannot find KDC for requested realm while getting
+		initial credentials</quote>.  Kerberos is picky about time synchronization. The time
+		according to your participating servers must be within 5 minutes or you get an error:
+		<quote>kinit(v5): Clock skew too great while getting initial credentials</quote>.
+		Clock skew limits are, in fact, configurable in the Kerberos protocols (the default is
+		5 minutes). A better solution is to implement NTP throughout your server network.
+		Kerberos needs to be able to do a reverse DNS lookup on the IP address of your KDC.
+		Also, the name that this reverse lookup maps to must either be the NetBIOS name of
+		the KDC (i.e., the hostname with no domain attached) or the
+		NetBIOS name followed by the realm. If all else fails, you can add a
+		<filename>/etc/hosts</filename> entry mapping the IP address of your KDC to its
+		NetBIOS name. If Kerberos cannot do this reverse lookup, you will get a local error
+		when you try to join the realm.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>kinit</primary></indexterm>
+		You are now ready to test your installation by issuing the command:
+<screen>
+&rootprompt; kinit [USERNAME@REALM]
+</screen> 
+		You are asked for your password, which you should enter. The following
+		is a typical console sequence:
+<screen>
+&rootprompt; kinit ADMINISTRATOR@LONDON.ABMAS.BIZ
+Password for ADMINISTRATOR@LONDON.ABMAS.BIZ: 
+</screen>
+		Make sure that your password is accepted by the Active Directory KDC.
+		</para></step>
+	</procedure>
+
+<example id="ch10-krb5conf">
+<title>Kerberos Configuration &smbmdash; File: <filename>/etc/krb5.conf</filename></title>
+<screen>
+[libdefaults]
+	default_realm = LONDON.ABMAS.BIZ
+
+[realms] 
+	LONDON.ABMAS.BIZ = {
+	kdc = w2k3s.london.abmas.biz
+	}
+</screen>
+</example>
+
+	<para><indexterm>
+	    <primary>klist</primary>
+	  </indexterm>
+	The command
+<screen>
+&rootprompt; klist -e 
+</screen>
+	shows the Kerberos tickets cached by the system.
+	</para>
+
+	<sect3>
+	<title>Samba Configuration</title>
+
+	<para>
+	<indexterm><primary>Active Directory</primary></indexterm>
+	Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it 
+	has the necessary components to interface with Active Directory.
+	</para>
+
+	<procedure>
+	<title>Securing Samba-3 With ADS Support Steps</title>
+
+		<step><para>
+		<indexterm><primary>Red Hat Linux</primary></indexterm>
+		<indexterm><primary>Samba Tea</primary></indexterm>
+		<indexterm><primary>Red Hat Fedora Linux</primary></indexterm>
+		<indexterm><primary>MIT KRB5</primary></indexterm>
+		<indexterm><primary>ntlm_auth</primary></indexterm>
+		Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team
+		<ulink url="http://ftp.samba.org">FTP site.</ulink> The official Samba Team
+		RPMs for Red Hat Fedora Linux contain the <command>ntlm_auth</command> tool
+		needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use.
+		</para>
+
+		<para>
+		<indexterm><primary>SerNet</primary></indexterm>
+		<indexterm><primary>RPMs</primary></indexterm>
+		The necessary, validated RPM packages for SUSE Linux may be obtained from
+		the <ulink url="ftp://ftp.sernet.de/pub/samba">SerNet</ulink> FTP site that
+		is located in Germany. All SerNet RPMs are validated, have the necessary
+		<command>ntlm_auth</command> tool, and are statically linked 
+		against suitably patched Heimdal 0.6 libraries.
+		</para></step>
+
+		<step><para>
+		Using your favorite editor, change the <filename>/etc/samba/smb.conf</filename>
+		file so it has contents similar to the example shown in <link linkend="ch10-smbconf"/>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>computer account</primary></indexterm>
+		<indexterm><primary>Active Directory</primary></indexterm>
+		<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>join</tertiary></indexterm>i
+		<indexterm><primary>Kerberos ticket</primary></indexterm>
+		<indexterm><primary>ticket</primary></indexterm>
+		Next you need to create a computer account in the Active Directory. 
+		This sets up the trust relationship needed for other clients to 
+		authenticate to the Samba server with an Active Directory Kerberos ticket. 
+		This is done with the <quote>net ads join -U [Administrator%Password]</quote>
+		command, as follows:
+<screen>
+&rootprompt; net ads join -U administrator%vulcon
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>smbd</primary></indexterm>
+		<indexterm><primary>nmbd</primary></indexterm>
+		<indexterm><primary>winbindd</primary></indexterm>
+		<indexterm><primary>Active Directory</primary></indexterm>
+		<indexterm><primary>Samba</primary></indexterm>
+		Your new Samba binaries must be started in the standard manner as is applicable
+		to the platform you are running on. Alternatively, start your Active Directory-enabled Samba with the following commands:
+<screen>
+&rootprompt; smbd -D
+&rootprompt; nmbd -D
+&rootprompt; winbindd -B
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>winbind</primary></indexterm>
+		<indexterm><primary>Active Directory</primary><secondary>domain</secondary></indexterm>
+		<indexterm><primary>wbinfo</primary></indexterm>
+		<indexterm><primary>enumerating</primary></indexterm>
+		<indexterm><primary>Active Directory</primary><secondary>tree</secondary></indexterm>
+		We now need to test that Samba is communicating with the Active 
+		Directory domain; most specifically, we want to see whether winbind 
+		is enumerating users and groups. Issue the following commands:
+<screen>
+&rootprompt; wbinfo -t
+checking the trust secret via RPC calls succeeded
+</screen>
+		This tests whether we are authenticating against Active Directory:
+<screen>
+&rootprompt; wbinfo -u
+LONDON+Administrator
+LONDON+Guest
+LONDON+SUPPORT_388945a0
+LONDON+krbtgt
+LONDON+jht
+LONDON+xjht
+</screen>
+		This enumerates all the users in your Active Directory tree:
+<screen>
+&rootprompt; wbinfo -g
+LONDON+Domain Computers
+LONDON+Domain Controllers
+LONDON+Schema Admins
+LONDON+Enterprise Admins
+LONDON+Domain Admins
+LONDON+Domain Users
+LONDON+Domain Guests
+LONDON+Group Policy Creator Owners
+LONDON+DnsUpdateProxy
+</screen>
+		This enumerates all the groups in your Active Directory tree.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>Squid</primary></indexterm>
+		<indexterm><primary>ntlm_auth</primary></indexterm>
+		Squid uses the <command>ntlm_auth</command> helper build with Samba-3.
+		You may test <command>ntlm_auth</command> with the command:
+<screen>
+&rootprompt; /usr/bin/ntlm_auth --username=jht
+password: XXXXXXXX
+</screen>
+		You are asked for your password, which you should enter. You are rewarded with:
+<screen>
+&rootprompt; NT_STATUS_OK: Success (0x0)
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>ntlm_auth</primary></indexterm>
+		<indexterm><primary>authenticate</primary></indexterm>
+		<indexterm><primary>winbind</primary></indexterm>
+		<indexterm><primary>privileged pipe</primary></indexterm>
+		<indexterm><primary>squid</primary></indexterm>
+		<indexterm><primary>chgrp</primary></indexterm>
+		<indexterm><primary>chmod</primary></indexterm>
+		<indexterm><primary>failure</primary></indexterm>
+		The <command>ntlm_auth</command> helper, when run from a command line as the user 
+		<quote>root</quote>, authenticates against your Active Directory domain (with 
+		the aid of winbind). It manages this by reading from the winbind privileged pipe. 
+		Squid is running with the permissions of user <quote>squid</quote> and group 
+		<quote>squid</quote> and is not able to do this unless we make a vital change. 
+		Squid cannot read from the winbind privilege pipe unless you change the 
+		permissions of its directory. This is the single biggest cause of failure in the 
+		whole process. Remember to issue the following command (for Red Hat Linux):
+<screen>
+&rootprompt; chgrp squid /var/cache/samba/winbindd_privileged
+&rootprompt; chmod 750 /var/cache/samba/winbindd_privileged
+</screen>
+		For SUSE Linux 9, execute the following:
+<screen>
+&rootprompt; chgrp squid /var/lib/samba/winbindd_privileged
+&rootprompt; chmod 750 /var/lib/samba/winbindd_privileged
+</screen>
+		</para></step>
+
+	</procedure>
+	</sect3>
+
+	<sect3>
+	<title>NSS Configuration</title>
+
+	<para>
+	<indexterm><primary>NSS</primary></indexterm>
+	<indexterm><primary>winbind</primary></indexterm>
+	<indexterm><primary>authentication</primary></indexterm>
+	For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication.
+	</para>
+
+	<para>
+	Edit your <filename>/etc/nsswitch.conf</filename> file so it has the parameters shown
+	in <link linkend="ch10-etcnsscfg"/>.
+	</para>
+
+<smbconfexample id="ch10-smbconf">
+<title>Samba Configuration &smbmdash; File: <filename>/etc/samba/smb.conf</filename></title>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">LONDON</smbconfoption>
+<smbconfoption name="netbios name">W2K3S</smbconfoption>
+<smbconfoption name="realm">LONDON.ABMAS.BIZ</smbconfoption>
+<smbconfoption name="security">ads</smbconfoption>
+<smbconfoption name="encrypt passwords">yes</smbconfoption>
+<smbconfoption name="password server">w2k3s.london.abmas.biz</smbconfoption>
+
+<smbconfcomment>separate domain and username with '/', like DOMAIN/username</smbconfcomment>
+<smbconfoption name="winbind separator">/</smbconfoption>
+
+<smbconfcomment>use UIDs from 10000 to 20000 for domain users</smbconfcomment>
+<smbconfoption name="idmap uid">10000-20000</smbconfoption>
+# use GIDs from 10000 to 20000 for domain groups
+<smbconfoption name="idmap gid">10000-20000</smbconfoption>
+
+<smbconfcomment>allow enumeration of winbind users and groups</smbconfcomment>
+<smbconfoption name="winbind enum users">yes</smbconfoption>
+<smbconfoption name="winbind enum groups">yes</smbconfoption>
+<smbconfoption name="winbind user default domain">yes</smbconfoption>
+</smbconfexample>
+
+<example id="ch10-etcnsscfg">
+<title>NSS Configuration File Extract &smbmdash; File: <filename>/etc/nsswitch.conf</filename></title>
+<screen>
+passwd: files winbind
+shadow: files
+group: files winbind
+</screen>
+</example>
+
+	</sect3>
+
+	<sect3>
+	<title>Squid Configuration</title>
+
+	<para>
+	<indexterm><primary>Squid</primary></indexterm>
+	<indexterm><primary>Active Directory</primary><secondary>authentication</secondary></indexterm>
+	Squid must be configured correctly to interact with the Samba-3 
+	components that handle Active Directory authentication.
+	</para>
+
+	</sect3>
+
+	</sect2>
+
+	<sect2>
+	<title>Configuration</title></sect2>
+
+	<procedure>
+	<title>Squid Configuration Steps</title>
+
+		<step><para>
+		<indexterm><primary>SUSE Linux</primary></indexterm>
+		<indexterm><primary>Squid</primary> </indexterm>
+		<indexterm><primary>helper agent</primary></indexterm>
+		If your Linux distribution is SUSE Linux 9, the version of Squid 
+		supplied is already enabled to use the winbind helper agent. You
+		can therefore omit the steps that would build the Squid binary
+		programs.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>nobody</primary></indexterm>
+		<indexterm><primary>squid</primary></indexterm>
+		<indexterm><primary>rpms</primary></indexterm>
+		<indexterm><primary>/etc/passwd</primary></indexterm>
+		<indexterm><primary>/etc/group</primary></indexterm>
+		Squid, by default, runs as the user <constant>nobody</constant>. You need to 
+		add a system user <constant>squid</constant> and a system group 
+		<constant>squid</constant> if they are not set up already (if the default 
+		Red Hat squid rpms were installed, they will be).  Set up a 
+		<constant>squid</constant> user in <filename>/etc/passwd</filename> 
+		and a <constant>squid</constant> group in <filename>/etc/group</filename> if these aren't there already.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>permissions</primary></indexterm>
+		<indexterm><primary>chown</primary></indexterm>
+		You now need to change the permissions on Squid's <constant>var</constant>
+		directory.  Enter the following command:
+<screen>
+&rootprompt; chown -R squid /var/cache/squid
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>logging</primary></indexterm>
+		<indexterm><primary>Squid</primary></indexterm>
+		Squid must also have control over its logging. Enter the following commands:
+<screen>
+&rootprompt; chown -R chown squid:squid /var/log/squid
+&rootprompt; chmod 770 /var/log/squid
+</screen>
+		</para></step>
+
+		<step><para>
+		Finally, Squid must be able to write to its disk cache!
+		Enter the following commands:
+<screen>
+&rootprompt; chown -R chown squid:squid /var/cache/squid
+&rootprompt; chmod 770 /var/cache/squid
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/squid/squid.conf</primary></indexterm>
+		The <filename>/etc/squid/squid.conf</filename> file must be edited to include the lines from 
+		<link linkend="etcsquidcfg"/> and <link linkend="etcsquid2"/>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>cache directories</primary></indexterm>
+		You must create Squid's cache directories before it may be run.  Enter the following command: 
+<screen>
+&rootprompt; squid -z
+</screen>
+		</para></step>
+
+		<step><para>
+		Finally, start Squid and enjoy transparent Active Directory authentication.
+		Enter the following command:
+<screen>
+&rootprompt; squid
+</screen>
+		</para></step>
+	</procedure>
+
+<example id="etcsquidcfg">
+<title>Squid Configuration File Extract &smbmdash; <filename>/etc/squid.conf</filename> [ADMINISTRATIVE PARAMETERS Section]</title>
+<screen>
+	cache_effective_user squid
+	cache_effective_group squid
+</screen>
+</example>
+
+<example id="etcsquid2">
+<title>Squid Configuration File extract &smbmdash; File: <filename>/etc/squid.conf</filename> [AUTHENTICATION PARAMETERS Section]</title>
+<screen>
+	auth_param ntlm program /usr/bin/ntlm_auth \
+                                --helper-protocol=squid-2.5-ntlmssp
+	auth_param ntlm children 5
+	auth_param ntlm max_challenge_reuses 0
+	auth_param ntlm max_challenge_lifetime 2 minutes
+	auth_param basic program /usr/bin/ntlm_auth \
+                                --helper-protocol=squid-2.5-basic
+	auth_param basic children 5
+	auth_param basic realm Squid proxy-caching web server
+	auth_param basic credentialsttl 2 hours
+	acl AuthorizedUsers proxy_auth REQUIRED
+	http_access allow all AuthorizedUsers
+</screen>
+</example>
+
+	</sect2>
+
+	<sect2>
+		<title>Key Points Learned</title>
+
+		<para>
+		<indexterm><primary>Web browsers</primary></indexterm>
+		<indexterm><primary>services</primary></indexterm>
+		<indexterm><primary>authentication protocols</primary></indexterm>
+		<indexterm><primary>Web</primary><secondary>proxy</secondary><tertiary>access</tertiary></indexterm>
+		<indexterm><primary>NTLMSSP</primary></indexterm>
+		Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft
+		Windows clients use, even when accessing traditional services such as Web browsers. Depending 
+		on whom you discuss this with, this is either good or bad. No matter how you might evaluate this,
+		the use of NTLMSSP as the authentication protocol for Web proxy access has some advantages over
+		the cookie-based authentication regime used by all competing browsers. It is Samba's implementation
+		of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter.
+		</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Questions and Answers</title>
+
+	<para>
+	<indexterm><primary>ntlm_auth</primary></indexterm>
+	<indexterm><primary>SambaXP conference</primary></indexterm>
+	<indexterm><primary>Goettingen</primary></indexterm>
+	<indexterm><primary>Italian</primary></indexterm>
+	The development of the <command>ntlm_auth</command> module was first discussed in many Open Source circles
+	in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of 
+	<command>ntlm_auth</command> during one of the late developer meetings that took place. Since that time, the 
+	adoption of <command>ntlm_auth</command> has spread considerably.
+	</para>
+
+	<para>
+	The largest report from a site that uses Squid with <command>ntlm_auth</command>-based authentication
+	support uses a dual processor server that has 2 GB of memory. It provides Web and FTP proxy services for 10,000
+	users. Approximately 2,000 of these users make heavy use of the proxy services. According to the source, who
+	wishes to remain anonymous, the sustained transaction load on this server hovers around 140 hits/sec. The following
+	comments were made with respect to questions regarding the performance of this installation:
+	</para>
+
+	<blockquote><para>
+	[In our] EXTREMELY optimized environment . . . [the] performance impact is almost [nothing]. The <quote>almost</quote> 
+	part is due to the brain damage of the ntlm-over-http protocol definition. Suffice to say that its worst-case 
+	scenario triples the number of hits needed to perform the same transactions versus basic or digest auth[entication].
+	</para></blockquote>
+
+	<para>
+	You would be well-advised to recognize that all cache-intensive proxying solutions demand a lot of memory.
+	Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run 
+	out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk.
+	</para>
+
+	<qandaset defaultlabel="chap10bqa" type="number">
+	<qandaentry>
+	<question>
+
+		<para>
+		What does Samba have to do with Web proxy serving?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		<indexterm><secondary>transparent inter-operability</secondary></indexterm>
+		<indexterm><primary>Windows clients</primary></indexterm>
+		<indexterm><primary>network</primary><secondary>services</secondary></indexterm>
+		<indexterm><primary>authentication</primary></indexterm>
+		<indexterm><primary>wrapper</primary></indexterm>
+		To provide transparent interoperability between Windows clients and the network services
+		that are used from them, Samba had to develop tools and facilities that deliver that feature. The benefit
+		of Open Source software is that it can readily be reused. The current <command>ntlm_auth</command>
+		module is basically a wrapper around authentication code from the core of the Samba project.
+		</para>
+
+		<para>
+		<indexterm><primary>plain-text</primary></indexterm>
+		<indexterm><primary>authentication</primary><secondary>plain-text</secondary></indexterm>
+		<indexterm><primary>Web</primary><secondary>proxy</secondary></indexterm>
+		<indexterm><primary>FTP</primary><secondary>proxy</secondary></indexterm>
+		<indexterm><primary>NTLMSSP</primary></indexterm>
+		<indexterm><primary>logon credentials</primary></indexterm>
+		<indexterm><primary>Windows explorer</primary></indexterm>
+		<indexterm><primary>Internet Information Server</primary></indexterm>
+		<indexterm><primary>Apache Web server</primary></indexterm>
+		The <command>ntlm_auth</command> module supports basic plain-text authentication and NTLMSSP 
+		protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without
+		the user being interrupted via his or her Windows logon credentials. This facility is available with
+		MS Windows Explorer and is one of the key benefits claimed for Microsoft Internet Information Server.
+		There are a few open source initiatives to provide support for these protocols in the Apache Web server
+		also.
+		</para>
+
+		<para>
+		<indexterm><primary>wrapper</primary></indexterm>
+		The short answer is that by adding a wrapper around key authentication components of Samba, other
+		projects (like Squid) can benefit from the labors expended in meeting user interoperability needs.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What other services does Samba provide?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		<indexterm><primary>winbindd</primary></indexterm>
+		<indexterm><primary>Identity resolver</primary></indexterm>
+		<indexterm><primary>daemon</primary></indexterm>
+		<indexterm><primary>smbd</primary></indexterm>
+		<indexterm><primary>file and print server</primary></indexterm>
+		Samba-3 is a file and print server. The core components that provide this functionality are <command>smbd</command>,
+		<command>nmbd</command>, and the identity resolver daemon, <command>winbindd</command>.
+		</para>
+
+		<para>
+		<indexterm><primary>SMB/CIFS</primary></indexterm>
+		<indexterm><primary>smbclient</primary></indexterm>
+		Samba-3 is an SMB/CIFS client. The core component that provides this is called <command>smbclient</command>.
+		</para>
+
+		<para>
+		<indexterm><primary>modules</primary></indexterm>
+		<indexterm><primary>utilities</primary></indexterm>
+		<indexterm><primary>validation</primary></indexterm>
+		<indexterm><primary>inter-operability</primary></indexterm>
+		<indexterm><primary>authentication</primary></indexterm>
+		Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities.
+		Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux
+		servers and clients. It includes Winbind agents that make it possible to authenticate UNIX/Linux access attempts
+		as well as logins to an SMB/CIFS authentication server backend. Samba-3 includes name service switch (NSS) modules
+		to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial
+		server products).
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Does use of Samba (<command>ntlm_auth</command>) improve the performance of Squid?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Not really. Samba's <command>ntlm_auth</command> module handles only authentication. It requires that
+		Squid make an external call to <command>ntlm_auth</command> and therefore actually incurs a
+		little more overhead. Compared with the benefit obtained, that overhead is well worth enduring. Since
+		Squid is a proxy server, and proxy servers tend to require lots of memory, it is good advice to provide
+		sufficient memory when using Squid. Just add a little more to accommodate <command>ntlm_auth</command>.
+		</para>
+
+	</answer>
+	</qandaentry>
+	</qandaset>
+
+</sect1>
+
+</chapter>
+
diff --git a/docs/Samba3-ByExample/SBE-HighAvailability.xml b/docs/Samba3-ByExample/SBE-HighAvailability.xml
new file mode 100644
index 0000000000..db94af4d2f
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-HighAvailability.xml
@@ -0,0 +1,701 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+
+<chapter id="HA">
+<title>Performance, Reliability, and Availability</title>
+
+	<para>
+	<indexterm><primary>performance</primary></indexterm>
+	<indexterm><primary>reliability</primary></indexterm>
+	<indexterm><primary>availability</primary></indexterm>
+	Well, you have reached the chapter before the appendix. It is customary to attempt
+	to wrap up the theme and contents of a book in what is generally regarded as the
+	chapter that should draw conclusions. This book is a suspense thriller, and since
+	the plot of the stories told mostly lead you to bigger, better Samba-3 networking
+	solutions, it is perhaps appropriate to close this book with a few pertinent comments
+	regarding some of the things everyone can do to deliver a reliable Samba-3 network.
+	</para>
+
+	<blockquote><attribution>Anonymous</attribution><para>
+	In a world so full of noise, how can the sparrow be heard?
+	</para></blockquote>
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>
+	<indexterm><primary>clustering</primary></indexterm>
+	The sparrow is a small bird whose sounds are drowned out by the noise of the busy
+	world it lives in. Likewise, the simple steps that can be taken to improve the
+	reliability and availability of a Samba network are often drowned out by the volume
+	of discussions about grandiose Samba clustering designs. This is not intended to
+	suggest that clustering is not important, because clearly it is. This chapter does not devote
+	itself to discussion of clustering because each clustering methodology uses its own
+	custom tools and methods. Only passing comments are offered concerning these methods.
+	</para>
+
+	<para>
+	<indexterm><primary>cluster</primary></indexterm>
+	<indexterm><primary>samba cluster</primary></indexterm>
+	<indexterm><primary>scalability</primary></indexterm>
+<ulink url="http://www.google.com/search?hl=en&amp;lr=&amp;ie=ISO-8859-1&amp;q=samba+cluster&amp;btnG=Google+Search">A search</ulink> 
+	for <quote>samba cluster</quote> produced 71,600 hits. And a search for <quote>highly available samba</quote>
+	and <quote>highly available windows</quote> produced an amazing number of references.
+	It is clear from the resources on the Internet that Windows file and print services 
+	availability, reliability, and scalability are of vital interest to corporate network users.
+	</para>
+
+	<para>
+	<indexterm><primary>performance</primary></indexterm>
+	So without further background, you can review a checklist of simple steps that
+	can be taken to ensure acceptable network performance while keeping costs of ownership
+	well under control.
+	</para>
+
+</sect1>
+
+<sect1>
+	<title>Dissection and Discussion</title>
+
+	<para>
+	<indexterm><primary>simple</primary></indexterm>
+	<indexterm><primary>complexities</primary></indexterm>
+	If it is your purpose to get the best mileage out of your Samba servers, there is one rule that
+	must be obeyed. If you want the best, keep your implementation as simple as possible. You may
+	well be forced to introduce some complexities, but you should do so only as a last resort.
+	</para>
+
+	<para>
+	Simple solutions are likely to be easier to get right than are complex ones. They certainly
+	make life easier for your successor. Simple implementations can be more readily audited than can
+	complex ones. 
+	</para>
+
+	<para>
+	<indexterm><primary>broken behavior</primary></indexterm>
+	<indexterm><primary>poor performance</primary></indexterm>
+	Problems reported by users fall into three categories: configurations that do not work, those 
+	that have broken behavior, and poor performance. The term <emphasis>broken behavior</emphasis>
+	means that the function of a particular Samba component appears to work sometimes, but not at
+	others. The resulting intermittent operation is clearly unacceptable. An example of 
+	<emphasis>broken behavior</emphasis> known to many Windows networking users occurs when the
+	list of Windows machines in MS Explorer changes, sometimes listing machines that are running
+	and at other times not listing them even though the machines are in use on the network.
+	</para>
+
+	<para>
+	<indexterm><primary>smbfs</primary></indexterm>
+	<indexterm><primary>smbmnt</primary></indexterm>
+	<indexterm><primary>smbmount</primary></indexterm>
+	<indexterm><primary>smbumnt</primary></indexterm>
+	<indexterm><primary>smbumount</primary></indexterm>
+	<indexterm><primary>front-end</primary></indexterm>
+	A significant number of reports concern problems with the <command>smbfs</command> file system
+	driver that is part of the Linux kernel, not part of Samba. Users continue to interpret that
+	<command>smbfs</command> is part of Samba, simply because Samba includes the front-end tools
+	that are used to manage <command>smbfs</command>-based file service connections. So, just
+	for the record, the tools <command>smbmnt</command>, <command>smbmount</command>,
+	<command>smbumount</command>, and <command>smbumnt</command> are front-end
+	facilities to core drivers that are supplied as part of the Linux kernel. These tools share a
+	common infrastructure with some Samba components, but they are not maintained as part of
+	Samba and are really foreign to it.
+	</para>
+
+	<para>
+	<indexterm><primary>cifsfs</primary></indexterm>
+	The new project, <command>cifsfs</command>, is destined to replace <command>smbfs</command>.
+	It, too, is not part of Samba, even though one of the Samba Team members is a prime mover in
+	this project.
+	</para>
+
+	<para>
+	Table 13.1 lists typical causes of:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>Not Working (NW)</para></listitem>
+		<listitem><para>Broken Behavior (BB)</para></listitem>
+		<listitem><para>Poor Performance (PP)</para></listitem>
+	</itemizedlist>
+
+
+	<table id="ProbList">
+		<title>Effect of Common Problems</title>
+		<tgroup cols="4">
+			<colspec align="left"/>
+			<colspec align="center"/>
+			<colspec align="center"/>
+			<colspec align="center"/>
+			<thead>
+				<row>
+					<entry><para>Problem</para></entry>
+					<entry><para>NW</para></entry>
+					<entry><para>BB</para></entry>
+					<entry><para>PP</para></entry>
+				</row>
+			</thead>
+			<tbody>
+				<row>
+					<entry><para>File locking</para></entry>
+					<entry><para>-</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>-</para></entry>
+				</row>
+				<row>
+					<entry><para>Hardware problems</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>X</para></entry>
+				</row>
+				<row>
+					<entry><para>Incorrect authentication</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>-</para></entry>
+				</row>
+				<row>
+					<entry><para>Incorrect configuration</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>X</para></entry>
+				</row>
+				<row>
+					<entry><para>LDAP problems</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>-</para></entry>
+				</row>
+				<row>
+					<entry><para>Name resolution</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>X</para></entry>
+				</row>
+				<row>
+					<entry><para>Printing problems</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>-</para></entry>
+				</row>
+				<row>
+					<entry><para>Slow file transfer</para></entry>
+					<entry><para>-</para></entry>
+					<entry><para>-</para></entry>
+					<entry><para>X</para></entry>
+				</row>
+				<row>
+					<entry><para>Winbind problems</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>X</para></entry>
+					<entry><para>-</para></entry>
+				</row>
+			</tbody>
+		</tgroup>
+	</table>
+
+	<para>
+	<indexterm><primary>network hygiene</primary></indexterm>
+	It is obvious to all that the first requirement (as a matter of network hygiene) is to eliminate
+	problems that affect basic network operation. This book has provided sufficient working examples
+	to help you to avoid all these problems.
+	</para>
+
+</sect1>
+
+<sect1>
+	<title>Guidelines for Reliable Samba Operation</title>
+
+	<para>
+	<indexterm><primary>resilient</primary></indexterm>
+	<indexterm><primary>extreme demand</primary></indexterm>
+	Your objective is to provide a network that works correctly, can grow at all times, is resilient
+	at times of extreme demand, and can scale to meet future needs. The following subject areas provide
+	pointers that can help you today.
+	</para>
+
+	<sect2>
+	<title>Name Resolution</title>
+
+	<para>
+	There are three basic current problem areas: bad hostnames, routed networks, and network collisions.
+	These are covered in the following discussion.
+	</para>
+
+		<sect3>
+		<title>Bad Hostnames</title>
+
+		<para>
+		<indexterm><primary>DHCP</primary><secondary>client</secondary></indexterm>
+		<indexterm><primary>netbios name</primary></indexterm>
+		<indexterm><primary>localhost</primary></indexterm>
+		<indexterm><primary>/etc/hosts</primary></indexterm>
+		<indexterm><primary>NetBIOS</primary></indexterm>
+		When configured as a DHCP client, a number of Linux distributions set the system hostname
+		to <constant>localhost</constant>. If the parameter <parameter>netbios name</parameter> is not
+		specified to something other than <constant>localhost</constant>, the Samba server appears
+		in the Windows Explorer as <constant>LOCALHOST</constant>. Moreover, the entry in the <filename>/etc/hosts</filename>
+		on the Linux server points to IP address <constant>127.0.0.1</constant>. This means that
+		when the Windows client obtains the IP address of the Samba server called <constant>LOCALHOST</constant>,
+		it obtains the IP address <constant>127.0.0.1</constant> and then proceeds to attempt to
+		set up a NetBIOS over TCP/IP connection to it. This cannot work, because that IP address is
+		the local Windows machine itself. Hostnames must be valid for Windows networking to function
+		correctly.
+		</para>
+
+		<para>
+		<indexterm><primary>digits</primary></indexterm>
+		A few sites have tried to name Windows clients and Samba servers with a name that begins
+		with the digits 1-9. This does not work either because it may result in the client or
+		server attempting to use that name as an IP address.
+		</para>
+
+		<para>
+		<indexterm><primary>DNS</primary><secondary>name lookup</secondary></indexterm>
+		<indexterm><primary>resolve</primary></indexterm>
+		A Samba server called <constant>FRED</constant> in a NetBIOS domain called <constant>COLLISION</constant>
+		in a network environment that is part of the fully-qualified Internet domain namespace known
+		as <constant>parrots.com</constant>, results in DNS name lookups for <constant>fred.parrots.com</constant>
+		and <constant>collision.parrots.com</constant>. It is therefore a mistake to name the domain
+		(workgroup) <constant>collision.parrots.com</constant>, since this results in DNS lookup
+		attempts to resolve <constant>fred.parrots.com.parrots.com</constant>, which most likely
+		fails given that you probably do not have this in your DNS namespace.
+		</para>
+
+		<note><para>
+		<indexterm><primary>Active Directory</primary><secondary>realm</secondary></indexterm>
+		<indexterm><primary>ADS</primary></indexterm>
+		<indexterm><primary>DNS</primary></indexterm>
+		An Active Directory realm called <constant>collision.parrots.com</constant> is perfectly okay,
+		although it too must be capable of being resolved via DNS, something that functions correctly
+		if Windows 200x ADS has been properly installed and configured.
+		</para></note>
+
+		</sect3>
+
+		<sect3>
+		<title>Routed Networks</title>
+
+		<para>
+		<indexterm><primary>NetBIOS</primary></indexterm>
+		<indexterm><primary>UDP</primary><secondary>broadcast</secondary></indexterm>
+		<indexterm><primary>broadcast</primary></indexterm>
+		NetBIOS networks (Windows networking with NetBIOS over TCP/IP enabled) makes extensive use
+		of UDP-based broadcast traffic, as you saw during the exercises in <link linkend="primer"/>.
+		</para>
+
+		<para>
+		<indexterm><primary>routers</primary></indexterm>
+		<indexterm><primary>forwarded</primary></indexterm>
+		<indexterm><primary>multi-subnet</primary></indexterm>
+		UDP broadcast traffic is not forwarded by routers. This means that NetBIOS broadcast-based
+		networking cannot function across routed networks (i.e., multi-subnet networks) unless
+		special provisions are made:
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			<indexterm><primary>LMHOSTS</primary></indexterm>
+			<indexterm><primary>remote announce</primary></indexterm>
+			<indexterm><primary>remote browse sync</primary></indexterm>
+			Either install on every Windows client an LMHOSTS file (located in the directory
+			<filename>C:\windows\system32\drivers\etc</filename>). It is also necessary to
+			add to the Samba server &smb.conf; file the parameters <parameter>remote announce</parameter>
+			and <parameter>remote browse sync</parameter>. For more information, refer to the online
+			manual page for the &smb.conf; file.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>WINS</primary><secondary>server</secondary></indexterm>
+			Or configure Samba as a WINS server, and configure all network clients to use that
+			WINS server in their TCP/IP configuration.
+			</para></listitem>
+		</itemizedlist>
+
+		<note><para>
+		<indexterm><primary>WINS</primary><secondary>name resolution</secondary></indexterm>
+		<indexterm><primary>DNS</primary></indexterm>
+		The use of DNS is not an acceptable substitute for WINS. DNS does not store specific
+		information regarding NetBIOS networking particulars that get stored in the WINS
+		name resolution database and that Windows clients require and depend on.
+		</para></note>
+
+		</sect3>
+
+		<sect3>
+		<title>Network Collisions</title>
+
+		<para>
+		<indexterm><primary>network</primary><secondary>collisions</secondary></indexterm>
+		<indexterm><primary>network</primary><secondary>timeouts</secondary></indexterm>
+		<indexterm><primary>collision rates</primary></indexterm>
+		<indexterm><primary>network</primary><secondary>load</secondary></indexterm>
+		Excessive network activity causes NetBIOS network timeouts. Timeouts may result in
+		blue screen of death (BSOD) experiences. High collision rates may be caused by excessive
+		UDP broadcast activity, by defective networking hardware, or through excessive network
+		loads (another way of saying that the network is poorly designed).
+		</para>
+
+		<para>
+		The use of WINS is highly recommended to reduce network broadcast traffic, as outlined
+		in <link linkend="primer"/>.
+		</para>
+
+		<para>
+		<indexterm><primary>netbios forwarding</primary></indexterm>
+		<indexterm><primary>broadcast storms</primary></indexterm>
+		<indexterm><primary>performance</primary></indexterm>
+		Under no circumstances should the facility be supported by many routers, known as <constant>NetBIOS
+		forwarding</constant>, unless you know exactly what you are doing. Inappropriate use of this
+		facility can result in UDP broadcast storms. In one case in 1999, a university network became
+		unusable due to NetBIOS forwarding being enabled on all routers. The problem was discovered during performance
+		testing of a Samba server. The maximum throughput on a 100-Base-T (100 MB/sec) network was
+		less than 15 KB/sec. After the NetBIOS forwarding was turned off, file transfer performance
+		immediately returned to 11 MB/sec.
+		</para>
+
+		</sect3>
+
+	</sect2>
+
+	<sect2>
+	<title>Samba Configuration</title>
+
+	<para>
+	As a general rule, the contents of the &smb.conf; file should be kept as simple as possible.
+	No parameter should be specified unless you know it is essential to operation.
+	</para>
+
+	<para>
+	<indexterm><primary>document the settings</primary></indexterm>
+	<indexterm><primary>documented</primary></indexterm>
+	<indexterm><primary>optimized</primary></indexterm>
+	Many UNIX administrators like to fully document the settings in the &smb.conf; file. This is a
+	bad idea because it adds content to the file. The &smb.conf; file is re-read by every <command>smbd</command>
+	process every time the file timestamp changes (or, on systems where this does not work, every 20 seconds or so).
+	</para>
+
+	<para>
+	As the size of the &smb.conf; file grows, the risk of introducing parsing errors also increases.
+	It is recommended to keep a fully documented &smb.conf; file on hand, and then to operate Samba only
+	with an optimized file.
+	</para>
+
+	<para><indexterm>
+	    <primary>testparm</primary>
+	  </indexterm>
+	The preferred way to maintain a documented file is to call it something like <filename>smb.conf.master</filename>.
+	You can generate the optimized file by executing:
+<screen>
+&rootprompt; testparm -s smb.conf.master > smb.conf
+</screen>
+	You should carefully observe all warnings issued. It is also a good practice to execute the following
+	command to confirm correct interpretation of the &smb.conf; file contents:
+<screen>
+&rootprompt; testparm
+Load smb config files from /etc/samba/smb.conf
+Can't find include file /etc/samba/machine.
+Processing section "[homes]"
+Processing section "[print$]"
+Processing section "[netlogon]"
+Processing section "[Profiles]"
+Processing section "[printers]"
+Processing section "[media]"
+Processing section "[data]"
+Processing section "[cdr]"
+Processing section "[apps]"
+Loaded services file OK.
+'winbind separator = +' might cause problems with group membership.
+Server role: ROLE_DOMAIN_PDC
+Press enter to see a dump of your service definitions
+</screen>
+	<indexterm><primary>fatal problem</primary></indexterm>
+	You now, of course, press the enter key to complete the command, or else abort it by pressing Ctrl-C.
+	The important thing to note is the noted Server role, as well as warning messages. Noted configuration
+	conflicts must be remedied before proceeding. For example, the following error message represents a
+	common fatal problem:
+<screen>
+ERROR: both 'wins support = true' and 'wins server = &lt;server list&gt;' 
+cannot be set in the smb.conf file. nmbd will abort with this setting.
+</screen>
+	</para>
+
+	<para>
+	<indexterm><primary>performance degradation</primary></indexterm>
+	<indexterm><primary>socket options</primary></indexterm>
+	<indexterm><primary>socket address</primary></indexterm>
+	There are two parameters that can cause severe network performance degradation: <parameter>socket options</parameter>
+	and <parameter>socket address</parameter>. The <parameter>socket options</parameter> parameter was often necessary
+	when Samba was used with the Linux 2.2.x kernels. Later kernels are largely self-tuning and seldom benefit from
+	this parameter being set. Do not use either parameter unless it has been proven necessary to use them.
+	</para>
+
+	<para>
+	<indexterm><primary>strict sync</primary></indexterm>
+	<indexterm><primary>sync always</primary></indexterm>
+	<indexterm><primary>severely degrade</primary></indexterm>
+	<indexterm><primary>network</primary><secondary>performance</secondary></indexterm>
+	Another &smb.conf; parameter that may cause severe network performance degradation is the 
+	<parameter>strict sync</parameter> parameter. Do not use this at all. There is no good reason
+	to use this with any modern Windows client. The <parameter>strict sync</parameter> is often
+	used with the <parameter>sync always</parameter> parameter. This, too, can severely	
+	degrade network performance, so do not set it; if you must, do so with caution.
+	</para>
+
+	<para>
+	<indexterm><primary>opportunistic locking</primary></indexterm>
+	<indexterm><primary>file caching</primary></indexterm>
+	<indexterm><primary>caching</primary></indexterm>
+	<indexterm><primary>oplocks</primary></indexterm>
+	Finally, many network administrators deliberately disable opportunistic locking support. While this
+	does not degrade Samba performance, it significantly degrades Windows client performance because
+	this disables local file caching on Windows clients and forces every file read and written to
+	invoke a network read or write call. If for any reason you must disable oplocks (opportunistic locking)
+	support, do so only on the share on which it is required. That way, all other shares can provide
+	oplock support for operations that are tolerant of it. See <link linkend="ch12dblck"/> for more
+	information.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Use and Location of BDCs</title>
+
+	<para>
+	<indexterm><primary>BDC</primary></indexterm>
+	<indexterm><primary>PDC</primary></indexterm>
+	<indexterm><primary>routed network</primary></indexterm>
+	<indexterm><primary>wide-area network</primary></indexterm>
+	<indexterm><primary>network segment</primary></indexterm>
+	On a network segment where there is a PDC and a BDC, the BDC carries the bulk of the network logon
+	processing. If the BDC is a heavily loaded server, the PDC carries a greater proportion of
+	authentication and logon processing. When a sole BDC on a routed network segment gets heavily
+	loaded, it is possible that network logon requests and authentication requests may be directed
+	to a BDC on a distant network segment. This significantly hinders WAN operations
+	and is undesirable.
+	</para>
+
+	<para>
+	<indexterm><primary>Domain Member</primary></indexterm>
+	<indexterm><primary>Domain Controller</primary></indexterm>
+	As a general guide, instead of adding domain member servers to a network, you would be better advised
+	to add BDCs until there are fewer than 30 Windows clients per BDC. Beyond that ratio, you should add
+	domain member servers. This practice ensures that there are always sufficient domain controllers
+	to handle logon requests and authentication traffic.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Use One Consistent Version of MS Windows Client</title>
+
+	<para>
+	Every network client has its own peculiarities. From a management perspective, it is easier to deal
+	with one version of MS Windows that is maintained to a consistent update level than it is to deal
+	with a mixture of clients.
+	</para>
+
+	<para>
+	On a number of occasions, particular Microsoft service pack updates of a Windows server or client
+	have necessitated special handling from the Samba server end. If you want to remain sane, keep you
+	client workstation configurations consistent.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>For Scalability, Use SAN-Based Storage on Samba Servers</title>
+
+	<para>
+	<indexterm><primary>SAN</primary></indexterm>
+	<indexterm><primary>synchronization</primary></indexterm>
+	Many SAN-based storage systems permit more than one server to share a common data store.
+	Use of a shared SAN data store means that you do not need to use time- and resource-hungry data 
+	synchronization techniques.
+	</para>
+
+	<para>
+	<indexterm><primary>load distribution</primary></indexterm>
+	<indexterm><primary>clustering</primary></indexterm>
+	The use of a collection of relatively low-cost front-end Samba servers that are coupled to
+	a shared backend SAN data store permits load distribution while containing costs below that
+	of installing and managing a complex clustering facility.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Distribute Network Load with MSDFS</title>
+
+	<para>
+	<indexterm><primary>MSDFS</primary></indexterm>
+	<indexterm><primary>distributed</primary></indexterm>
+	Microsoft DFS (distributed file system) technology has been implemented in Samba. MSDFS permits
+	data to be accessed from a single share and yet to actually be distributed across multiple actual
+	servers. Refer to <emphasis>TOSHARG</emphasis>, Chapter 19, for information regarding
+	implementation of an MSDFS installation.
+	</para>
+
+	<para>
+	<indexterm><primary>front-end</primary><secondary>server</secondary></indexterm>
+	<indexterm><primary>MSDFS</primary></indexterm>
+	The combination of multiple backend servers together with a front-end server and use of MSDFS
+	can achieve almost the same as you would obtain with a clustered Samba server.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</title>
+
+	<para>
+	<indexterm><primary>replicate</primary></indexterm>
+	<indexterm><primary>rsync</primary></indexterm>
+	<indexterm><primary>wide-area network</primary></indexterm>
+	Consider using <command>rsync</command> to replicate data across the WAN during times
+	of low utilization. Users can then access the replicated data store rather than needing to do so
+	across the WAN. This works best for read-only data, but with careful planning can be
+	implemented so that modified files get replicated back to the point of origin. Be careful with your
+	implementation if you choose to permit modification and return replication of the modified file;
+	otherwise, you may inadvertently overwrite important data.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Hardware Problems</title>
+
+	<para>
+	<indexterm><primary>hardware prices</primary></indexterm>
+	<indexterm><primary>hardware problems</primary></indexterm>
+	<indexterm><primary>NICs</primary></indexterm>
+	<indexterm><primary>defective</primary><secondary>HUBs</secondary></indexterm>
+	<indexterm><primary>defective</primary><secondary>switches</secondary></indexterm>
+	<indexterm><primary>defective</primary><secondary>cables</secondary></indexterm>
+	Networking hardware prices have fallen sharply over the past 5 years. A surprising number
+	of Samba networking problems over this time have been traced to defective network interface
+	cards (NICs) or defective HUBs, switches, and cables.
+	</para>
+
+	<para>
+	<indexterm><primary>corrective action</primary></indexterm>
+	Not surprising is the fact that network administrators do not like to be shown to have made
+	a bad decision. Money saved in buying low-cost hardware may result in high costs incurred
+	in corrective action.
+	</para>
+
+	<para>
+	<indexterm><primary>intermittent</primary></indexterm>
+	<indexterm><primary>data corruption</primary></indexterm>
+	<indexterm><primary>slow network</primary></indexterm>
+	<indexterm><primary>low performance</primary></indexterm>
+	<indexterm><primary>data integrity</primary></indexterm>
+	Defective NICs, HUBs, and switches may appear as intermittent network access problems, intermittent
+	or persistent data corruption, slow network throughput, low performance, or even as BSOD
+	problems with MS Windows clients. In one case, a company updated several workstations with newer, faster
+	Windows client machines that triggered problems during logon as well as data integrity problems on
+	an older PC that was unaffected so long as the new machines were kept shut down.
+	</para>
+
+	<para>
+	Defective hardware problems may take patience and persistence before the real cause can be discovered.
+	</para>
+
+	<para>
+	<indexterm><primary>RAID controllers</primary></indexterm>
+	Networking hardware defects can significantly impact perceived Samba performance, but defective
+	RAID controllers as well as SCSI and IDE hard disk controllers have also been known to impair Samba server
+	operations. One business came to this realization only after replacing a Samba installation with MS 
+	Windows Server 2000 running on the same hardware. The root of the problem completely eluded the network
+	administrator until the entire server was replaced. While you may well think that this would never
+	happen to you, experience shows that given the right (unfortunate) circumstances, this can happen to anyone.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Large Directories</title>
+
+	<para>
+	There exist applications that create or manage directories containing many thousands of files. Such
+	applications typically generate many small files (less than 100 KB). At the best of times, under UNIX,
+	listing of the files in a directory that contains many files is slow. By default, Windows NT, 200x, 
+	and XP Pro cause network file system directory lookups on a Samba server to be performed for both 
+	the case preserving file name as well as for the mangled (8.3) file name. This incurs a huge overhead
+	on the Samba server that may slow down the system dramatically.
+	</para>
+
+	<para>
+	In an extreme case, the performance impact was dramatic. File transfer from the Samba server to a Windows
+	XP Professional workstation over 1 Gigabit Ethernet for 250-500 KB files was measured at approximately
+	30 MB/sec. But when tranferring a directory containing 120,000 files, all from 50KB to 60KB in size, the
+	transfer rate to the same workstation was measured at approximately 1.5 KB/sec. The net transfer was
+	on the order of a factor of 20-fold slower.
+	</para>
+
+	<para>
+	The symptoms that will be observed on the Samba server when a large directory is accessed will be that
+	aggregate I/O (typically blocks read) will be relatively low, yet the wait I/O times will be incredibly
+	long while at the same time the read queue is large. Close observation will show that the hard drive
+	that the file system is on will be thrashing wildly.
+	</para>
+
+	<para>
+	Samba-3.0.12 and later, includes new code that radically improves Samba perfomance. The secret to this is
+	really in the <smbconfoption name="case sensitive">True</smbconfoption> line. This tells smbd never to scan
+	for case-insensitive versions of names. So if an application asks for a file called <filename>FOO</filename>,
+	and it can not be found by a simple stat call, then smbd will return "file not found" immediately without
+	scanning the containing directory for a version of a different case.
+	</para>
+
+	<para>
+	Canonicalize all the files in the directory to have one case, upper or lower - either will do. Then set up 
+	a new custom share for the application as follows:
+	<screen>
+	[bigshare]
+			path = /data/xrayfiles/neurosurgeons/
+			read only = no
+			case sensitive = True
+			default case = upper
+			preserve case = no
+			short preserve case = no
+	</screen>
+	</para>
+
+	<para>
+	All files and directories under the <parameter>path</parameter> directory must be in the same case
+	as specified in the &smb.conf; stanza. This means that smbd will not be able to find lower case 
+	filenames with these settings.  Note, this is done on a per-share basis.
+	</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Key Points Learned</title>
+
+	<para>
+	This chapter has touched in broad sweeps on a number of simple steps that can be taken
+	to ensure that your Samba network is resilient, scalable, and reliable, and that it
+	performs well.
+	</para>
+
+	<para>
+	Always keep in mind that someone is responsible to maintain and manage your design.
+	In the long term, that may not be you. Spare a thought for your successor and give him or
+	her an even break.
+	</para>
+
+	<para>
+	<indexterm><primary>assumptions</primary></indexterm>
+	Last, but not least, you should not only keep the network design simple, but also be sure it is
+	well documented. This book may serve as your pattern for documenting every
+	aspect of your design, its implementation, and particularly the objects and assumptions
+	that underlie it.
+	</para>
+
+</sect1>
+
+
+</chapter>
+
diff --git a/docs/Samba3-ByExample/SBE-KerberosFastStart.xml b/docs/Samba3-ByExample/SBE-KerberosFastStart.xml
new file mode 100644
index 0000000000..58ac2b6931
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-KerberosFastStart.xml
@@ -0,0 +1,2074 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="kerberos">
+  <title>Active Directory, Kerberos, and Security</title>
+
+    <para><indexterm>
+	<primary>experiment</primary>
+      </indexterm>
+	By this point in the book, you have been exposed to many Samba-3 features and capabilities.
+	More importantly, if you have implemented the examples given, you are well on your way to becoming 
+	a Samba-3 networking guru who knows a lot about Microsoft Windows. If you have taken the time to 
+	practice, you likely have thought of improvements and scenarios with which you can experiment. You 
+	are rather well plugged in to the many flexible ways Samba can be used.
+	</para>
+
+    <para><indexterm>
+	<primary>criticism</primary>
+      </indexterm>
+	This is a book about Samba-3. Understandably, its intent is to present it in a positive light. 
+	The casual observer might conclude that this book is one-eyed about Samba. It is &smbmdash; what 
+	would you expect? This chapter exposes some criticisms that have been raised concerning 
+	the use of Samba. For each criticism, there are good answers and appropriate solutions.
+	</para>
+
+	<para>
+	Some criticism always comes from deep inside ranks that one would expect to be supportive of a particular 
+	decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of 
+	criticism develops with respect to Abmas.
+	</para>
+
+    <para><indexterm>
+	<primary>straw-man</primary>
+      </indexterm>
+	This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled
+	out of thin air. They were drawn from comments made by Samba users and from criticism during 
+	discussions with Windows network administrators. The tone of the objections reflects as closely 
+	as possible that of the original. The case presented is a straw-man example that is designed to 
+	permit each objection to be answered as it might occur in real life.
+	</para>
+
+<sect1>
+	<title>Introduction</title>
+
+      <para><indexterm>
+	  <primary>acquisitions</primary>
+	</indexterm><indexterm>
+	  <primary>risk</primary>
+	</indexterm><indexterm>
+	  <primary>assessment</primary>
+	</indexterm><indexterm>
+	  <primary>Active Directory</primary>
+	</indexterm><indexterm>
+	  <primary>Windows 2003 Serve</primary>
+	</indexterm>
+	Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took
+	note of the spectacular projection of Abmas onto the global business stage. Abmas is building an
+	interesting portfolio of companies that includes accounting services, financial advice, investment
+	portfolio management, property insurance, risk assessment, and the recent addition of a a video rental
+	business. The pieces do not always appear to fit together, but Mr. Meany is certainly executing an 
+	interesting business growth and development plan. Abmas Video Rentals was recently acquired. 
+	During the time that the acquisition was closing, the Video Rentals business upgraded its Windows 
+	NT4-based network to Windows 2003 Server and Active Directory.
+	</para>
+
+      <para><indexterm>
+	  <primary>Active Directory</primary>
+	</indexterm>
+	You have accepted the fact that Abmas Video Rentals will use Microsoft Active Directory.
+	The IT team, led by Stan Soroka, is committed to Samba-3 and to maintaining a uniform technology platform. 
+	Stan Soroka's team voiced its disapproval over the decision to permit this business to continue to 
+	operate with a solution that is viewed by Christine and her group as <quote>an island of broken 
+	technologies.</quote> This comment was made by one of Christine's staff as they were installing a new 
+	Samba-3 server at the new business.
+	</para>
+
+
+      <para><indexterm>
+	  <primary>consultant</primary>
+	</indexterm><indexterm>
+	  <primary>hypothetical</primary>
+	</indexterm>
+	Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer
+	should make such a comment. He felt that he had to prepare in case he might be criticized for his 
+	decision to use Active Directory. He decided he would defend his decision by hiring the services 
+	of an outside security systems consultant to report<footnote>This report is entirely fictitious. 
+	Any resemblance to a factual report is purely coincidental.</footnote> on his unit's operations 
+	and to investigate the role of Samba at his site. Here are key extracts from this hypothetical 
+	report:
+	</para>
+
+      <blockquote><para><indexterm>
+	    <primary>vulnerabilities</primary>
+	  </indexterm><indexterm>
+	    <primary>integrity</primary>
+	  </indexterm><indexterm>
+	    <primary>practices</primary>
+	  </indexterm><indexterm>
+	    <primary>Active Directory</primary>
+	  </indexterm>
+	... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site,
+	 has been examined. We find no evidence to support a notion that vulnerabilities exist at your site.  
+	... we took additional steps to validate the integrity of the installation and operation of Active 
+	Directory and are pleased that your staff are following sound practices.
+	</para>
+
+	<para>
+	...
+	</para>
+
+	<para><indexterm>
+	    <primary>accounts</primary>
+	    <secondary>user</secondary>
+	  </indexterm><indexterm>
+	    <primary>accounts</primary>
+	    <secondary>group</secondary>
+	  </indexterm><indexterm>
+	    <primary>Backup</primary>
+	  </indexterm><indexterm>
+	    <primary>disaster recovery</primary>
+	  </indexterm><indexterm>
+	    <primary>validated</primary>
+	  </indexterm><indexterm>
+	    <primary>off-site storage</primary>
+	  </indexterm>
+	User and group accounts, and respective privileges, have been well thought out. File system shares are
+	appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and
+	effective off-site storage practices are considered to exceed industry norms.
+	</para>
+
+	<para><indexterm>
+	    <primary>compromise</primary>
+	  </indexterm><indexterm>
+	    <primary>secure</primary>
+	  </indexterm><indexterm>
+	    <primary>network</primary>
+	    <secondary>secure</secondary>
+	  </indexterm>
+	Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain
+	a secure network. 
+	</para>
+
+	<para><indexterm>
+	    <primary>winbind</primary>
+	  </indexterm><indexterm>
+	    <primary>security</primary>
+	  </indexterm><indexterm>
+	    <primary>secure</primary>
+	  </indexterm><indexterm>
+	    <primary>network</primary>
+	    <secondary>management</secondary>
+	  </indexterm>
+	The recently installed Linux file and application server uses a tool called <command>winbind</command> 
+	that is indiscriminate about security. All user accounts in Active Directory can be used to access data 
+	stored on the Linux system. We are alarmed that secure information is accessible to staff who should 
+	not even be aware that it exists. We share the concerns of your network management staff who have gone 
+	to great lengths to set fine-grained controls that limit information access to those who need access. 
+	It seems incongruous to us that Samba winbind should be permitted to be used considering that it voids this fine work.
+	</para>
+
+	<para><indexterm>
+	    <primary>isolated</primary>
+	  </indexterm><indexterm>
+	    <primary>firewall</primary>
+	  </indexterm><indexterm>
+	    <primary>best practices</primary>
+	  </indexterm>
+	Graham Judd [head of network administration] has locked down the security of all systems and is following 
+	the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network 
+	is isolated from the outside world, the [product name removed] firewall is under current contract 
+	maintenance support from [the manufacturer].  ... our attempts to penetrate security of your systems 
+	failed to find problems common to Windows networking sites. We commend your staff on their attention to 
+	detail and for following Microsoft recommended best practices.
+	</para>
+
+	<para>
+	...
+	</para>
+
+	<para><indexterm>
+	    <primary>security</primary>
+	  </indexterm><indexterm>
+	    <primary>disable</primary>
+	  </indexterm><indexterm>
+	    <primary>essential</primary>
+	  </indexterm><indexterm>
+	    <primary>trusted computing</primary>
+	  </indexterm>
+	Regarding the use of Samba, we offer the following comments: Samba is in use in nearly half of
+	all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft
+	... what worries us regarding Samba is the need to disable essential Windows security features such as
+	secure channel support, digital sign'n'seal on all communication traffic, and running Active Directory in
+	mixed mode so that Samba clients and servers can authenticate all of it. Additionally, we are concerned that
+	Samba is not at the full capabilities of Microsoft Windows NT4 server. Microsoft has moved well beyond that
+	with trusted computing initiatives that the Samba developers do not participate in.
+	</para>
+
+	<para><indexterm>
+	    <primary>integrity</primary>
+	  </indexterm><indexterm>
+	    <primary>hackers</primary>
+	  </indexterm><indexterm>
+	    <primary>accountable</primary>
+	  </indexterm><indexterm>
+	    <primary>flaws</primary>
+	  </indexterm><indexterm>
+	    <primary>updates</primary>
+	  </indexterm><indexterm>
+	    <primary>bug fixes</primary>
+	  </indexterm><indexterm>
+	    <primary>alarm</primary>
+	  </indexterm>
+	One wonders about the integrity of an open source program that is developed by a team of hackers 
+	who cannot be held accountable for the flaws in their code. The sheer number of updates and bug
+	fixes they have released should ring alarm bells in any business.
+	</para>
+
+	<para><indexterm>
+	    <primary>employment</primary>
+	  </indexterm><indexterm>
+	    <primary>jobs</primary>
+	  </indexterm><indexterm>
+	    <primary>risk</primary>
+	  </indexterm>
+	Another factor that should be considered is that buying Microsoft products and services helps to 
+	provide employment in the IT industry. Samba and Open Source software place those jobs at risk.
+	</para></blockquote>
+
+      <para><indexterm>
+	  <primary>Active Directory</primary>
+	</indexterm><indexterm>
+	  <primary>independent expert</primary>
+	</indexterm>
+	This is also a challenge to rise above the trouble spot. You call Stan's team together for a simple 
+	discussion, but it gets further out of hand.  When you return to your office, you find the following 
+	email in your in-box:
+	</para>
+
+	<para>
+	Good afternoon,
+	</para>
+
+	<blockquote><attribution>Stan</attribution><para>
+	I apologize for the leak of internal discussions to the new business. It reflects poorly on our 
+	professionalism and has put you in an unpleasant position. I regret the incident.
+	</para>
+
+	<para>
+	I also wish to advise that two of the recent recruits want to implement Kerberos authentication 
+	across all systems. I concur with the desire to improve security. One of the new guys who is championing
+	the move to Kerberos was responsible for the comment that caused the embarrassment.
+	</para>
+
+	<para><indexterm>
+	    <primary>Kerberos</primary>
+	  </indexterm><indexterm>
+	    <primary>OpenLDAP</primary>
+	  </indexterm><indexterm>
+	    <primary>Active Directory</primary>
+	  </indexterm><indexterm>
+	    <primary>consultant</primary>
+	  </indexterm>
+	I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP, 
+	plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect 
+	to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent, 
+	I would like to hire the services of a well-known Samba consultant to set the record straight.
+	</para>
+
+	<para><indexterm>
+	    <primary>criticism</primary>
+	  </indexterm><indexterm>
+	    <primary>policy</primary>
+	  </indexterm><indexterm>
+	    <primary>Windows Servers</primary>
+	  </indexterm><indexterm>
+	    <primary>Active Directory</primary>
+	  </indexterm><indexterm>
+	    <primary>budgetted</primary>
+	  </indexterm><indexterm>
+	    <primary>financial responsibility</primary>
+	  </indexterm>
+	I intend to use this report to answer the criticism raised and would like to establish a policy that we
+	will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered 
+	out of the budget of the division that wishes to go its own way. I propose that dissenters will still remain
+	responsible to meet the budgeted contribution to IT operations as a whole. I believe we should not coerce 
+	use of any centrally proposed standards, but make all noncompliance the financial responsibility of the 
+	out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone.
+	</para></blockquote>
+
+	<sect2>
+		<title>Assignment Tasks</title>
+
+		<para>
+		You agreed with Stan's recommendations and hired a consultant to help defuse the powder
+		keg. The consultant's task is to provide a tractable answer to each of the issues raised. The consultant must be able
+		to support his or her claims, keep emotions to the side, and answer technically.
+		</para>
+
+	</sect2>
+</sect1>
+
+<sect1>
+	<title>Dissection and Discussion</title>
+
+      <para><indexterm>
+	  <primary>tool</primary>
+	</indexterm><indexterm>
+	  <primary>benefit</primary>
+	</indexterm><indexterm>
+	  <primary>choice</primary>
+	</indexterm><indexterm>
+	  <primary>consultant</primary>
+	</indexterm><indexterm>
+	  <primary>installation</primary>
+	</indexterm><indexterm>
+	  <primary>income</primary>
+	</indexterm><indexterm>
+	  <primary>employment</primary>
+	</indexterm>
+	Samba-3 is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to 
+	make or reject. It is likely that your decision to use Samba can greatly benefit your company. 
+	The Samba Team obviously believes that the Samba software is a worthy choice. 
+	If you hire a consultant to assist with the installation and/or deployment of Samba, or if you hire 
+	someone to help manage your Samba installation, you can create income and employment. Alternately, 
+	money saved by not spending in the IT area can be spent elsewhere in the business. All money saved 
+	or spent creates employment.
+	</para>
+
+      <para><indexterm>
+	  <primary>economically sustainable</primary>
+	</indexterm><indexterm>
+	  <primary>inter-operability</primary>
+	</indexterm><indexterm>
+	  <primary>file and print service</primary>
+	</indexterm><indexterm>
+	  <primary>cost</primary>
+	</indexterm><indexterm>
+	  <primary>alternative</primary>
+	</indexterm>
+	In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted
+	purely to provide file and print service interoperability on platforms that otherwise cannot provide 
+	access to data and to printers for Microsoft Windows clients. Samba is used by some businesses to
+	effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an 
+	alternative to the use of a Microsoft file and print serving platforms with no consideration of costs.
+	</para>
+
+      <para><indexterm>
+	  <primary>documentation</primary>
+	</indexterm><indexterm>
+	  <primary>responsibility</primary>
+	</indexterm><indexterm>
+	  <primary>fix</primary>
+	</indexterm><indexterm>
+	  <primary>broken</primary>
+	</indexterm>
+	It would be foolish to adopt a technology that might put any data or users at risk. Security affects 
+	everyone. The Samba-Team is fully cognizant of the responsibility they have to their users. 
+	The Samba documentation clearly reveals that full responsibility is accepted to fix anything 
+	that is broken.
+	</para>
+
+      <para><indexterm>
+	  <primary>commercial</primary>
+	</indexterm><indexterm>
+	  <primary>software</primary>
+	</indexterm><indexterm>
+	  <primary>commercial software</primary>
+	</indexterm><indexterm>
+	  <primary>End User License Agreement</primary>
+	  <see>EULA</see>
+	</indexterm><indexterm>
+	  <primary>accountable</primary>
+	</indexterm><indexterm>
+	  <secondary>liability</secondary>
+	</indexterm><indexterm>
+	  <primary>accepts liability</primary>
+	</indexterm><indexterm>
+	  <primary>price paid</primary>
+	</indexterm><indexterm>
+	  <primary>product defects</primary>
+	</indexterm><indexterm>
+	  <primary>reimburse</primary>
+	</indexterm><indexterm>
+	  <primary>extent</primary>
+	</indexterm>
+	There is a mistaken perception in the IT industry that commercial software providers are fully 
+	accountable for the defects in products. Open Source software comes with no warranty, so it is 
+	often assumed that its use confers a higher degree of risk. Everyone should read commercial software 
+	End User License Agreements (EULAs). You should determine what real warranty is offered and the 
+	extent of liability that is accepted. Doing so soon dispels the popular notion that
+	commercial software vendors are willingly accountable for product defects. In many cases, the
+	commercial vendor accepts liability only to reimburse the price paid for the software. 
+	</para>
+
+      <para><indexterm>
+	  <primary>consumer</primary>
+	</indexterm><indexterm>
+	  <primary>EULA</primary>
+	</indexterm><indexterm>
+	  <primary>track record</primary>
+	</indexterm><indexterm>
+	  <primary>commercial software</primary>
+	</indexterm><indexterm>
+	  <primary>support</primary>
+	</indexterm><indexterm>
+	  <primary>vendor</primary>
+	</indexterm>
+	The real issues that a consumer (like you) needs answered are What is the way of escape from technical 
+	problems, and how long will it take? The average problem turnaround time in the Open Source community is 
+	approximately 48 hours. What does the EULA offer? What is the track record in the commercial software 
+	industry? What happens when your commercial vendor decides to cease providing support?
+	</para>
+
+      <para><indexterm>
+	  <primary>source code</primary>
+	</indexterm><indexterm>
+	  <primary>Open Source</primary>
+	</indexterm><indexterm>
+	  <primary>hire</primary>
+	</indexterm><indexterm>
+	  <primary>programmer</primary>
+	</indexterm><indexterm>
+	  <primary>solve</primary>
+	</indexterm><indexterm>
+	  <primary>fix</primary>
+	</indexterm><indexterm>
+	  <secondary>problem</secondary>
+	</indexterm>
+	Open Source software at least puts you in possession of the source code. This means that when
+	all else fails, you can hire a programmer to solve the problem.
+	</para>
+
+	<sect2>
+		<title>Technical Issues</title>
+
+		<para>
+		Each issue is now discussed and, where appropriate, example implementation steps are
+		provided.
+		</para>
+
+	<variablelist>
+		<varlistentry>
+			<term>Winbind and Security</term>
+	    <listitem><para><indexterm>
+		  <primary>Winbind</primary>
+		</indexterm><indexterm>
+		  <primary>Security</primary>
+		</indexterm><indexterm>
+		  <primary>network</primary>
+		  <secondary>administrators</secondary>
+		</indexterm><indexterm>
+		  <primary>Domain users</primary>
+		</indexterm><indexterm>
+		  <secondary>Domain account</secondary>
+		</indexterm><indexterm>
+		  <primary>credentials</primary>
+		</indexterm><indexterm>
+		  <primary>Network Neighborhood</primary>
+		</indexterm><indexterm>
+		  <primary>UNIX/Linux server</primary>
+		</indexterm><indexterm>
+		  <primary>browse</primary>
+		</indexterm><indexterm>
+		  <primary>shares</primary>
+		</indexterm>
+				Windows network administrators may be dismayed to find that <command>winbind</command> 
+				exposes all domain users so that they may use their domain account credentials to 
+				log on to a UNIX/Linux system. The fact that all users in the domain can see the 
+				UNIX/Linux server in their Network Neighborhood and can browse the shares on the 
+				server seems to excite them further.
+				</para>
+
+	      <para><indexterm>
+		  <primary>Domain Member server</primary>
+		</indexterm><indexterm>
+		  <primary>familiar</primary>
+		</indexterm><indexterm>
+		  <primary>fear</primary>
+		</indexterm><indexterm>
+		  <primary>unknown</primary>
+		</indexterm>
+				<command>winbind</command> provides for the UNIX/Linux domain member server or 
+				client, the same as one would obtain by adding a Microsoft Windows server or 
+				client to the domain. The real objection is the fact that Samba is not MS Windows 
+				and therefore requires handling a little differently from the familiar Windows systems.
+				One must recognize fear of the unknown.
+				</para>
+
+	      <para><indexterm>
+		  <primary>network administrators</primary>
+		</indexterm><indexterm>
+		  <primary>recognize</primary>
+		</indexterm><indexterm>
+		  <primary>winbind</primary>
+		</indexterm><indexterm>
+		  <primary>over-ride</primary>
+		</indexterm><indexterm>
+		  <primary>Active Directory</primary>
+		  <secondary>management tools</secondary>
+		</indexterm><indexterm>
+		  <primary>fears</primary>
+		</indexterm>
+				Windows network administrators need to recognize that <command>winbind</command> does
+				not, and cannot, override account controls set using the Active Directory management
+				tools. The control is the same. Have no fear.
+				</para>
+
+	      <para><indexterm>
+		  <primary>ADS Domain</primary>
+		</indexterm><indexterm>
+		  <primary>account</primary>
+		  <secondary>ADS Domain</secondary>
+		</indexterm><indexterm>
+		  <primary>winbind</primary>
+		</indexterm><indexterm>
+		  <primary>browsing</primary>
+		</indexterm><indexterm>
+		  <primary>permits</primary>
+		</indexterm><indexterm>
+		  <primary>access</primary>
+		</indexterm><indexterm>
+		  <primary>drive mapping</primary>
+		</indexterm><indexterm>
+		  <primary>protected</primary>
+		</indexterm><indexterm>
+		  <primary>security controls</primary>
+		</indexterm><indexterm>
+		  <primary>access controls</primary>
+		</indexterm>
+				Where Samba and the ADS domain account information obtained through the use of
+				<command>winbind</command> permits access, by browsing or by the drive mapping to
+				a share, to data that should be better protected. This can only happen when security
+				controls have not been properly implemented. Samba permits access controls to be set
+				on:
+				</para>
+
+				<itemizedlist>
+					<listitem><para>Shares themselves (i.e., the logical share itself)</para></listitem>
+					<listitem><para>The share definition in &smb.conf;</para></listitem>
+					<listitem><para>The shared directories and files using UNIX permissions</para></listitem>
+                                        <listitem><para>Using Windows 2000 ACLs &smbmdash; if the file system is POSIX enabled</para></listitem>
+				</itemizedlist>
+
+				<para>
+				Examples of each are given in <link linkend="ch10expl"/>.
+				</para>
+				</listitem>
+		</varlistentry>
+
+		<varlistentry>
+			<term>User and Group Controls</term>
+	    <listitem><para><indexterm>
+		  <primary>User and Group Controls</primary>
+		</indexterm><indexterm>
+		  <primary>management</primary>
+		  <secondary>User</secondary>
+		</indexterm><indexterm>
+		  <primary>management</primary>
+		  <secondary>group</secondary>
+		</indexterm><indexterm>
+		  <primary>ADS</primary>
+		</indexterm><indexterm>
+		  <primary>permissions</primary>
+		</indexterm><indexterm>
+		  <primary>privileges</primary>
+		</indexterm><indexterm>
+		  <primary>flexibility</primary>
+		</indexterm><indexterm>
+		  <primary>access controls</primary>
+		</indexterm><indexterm>
+		  <primary>share definition</primary>
+		</indexterm>
+				User and group management facilities as known in the Windows ADS environment may be
+				used to provide equivalent access control constraints or to provide equivalent
+				permissions and privileges on Samba servers. Samba offers greater flexibility in the
+				use of user and group controls because it has additional layers of control compared to
+				Windows 200x/XP. For example, access controls on a Samba server may be set within
+				the share definition in a manner for which Windows has no equivalent.
+				</para>
+
+	      <para><indexterm>
+		  <primary>analysis</primary>
+		</indexterm><indexterm>
+		  <primary>system security</primary>
+		</indexterm><indexterm>
+		  <primary>safe-guards</primary>
+		</indexterm><indexterm>
+		  <primary>permissions</primary>
+		  <secondary>excessive</secondary>
+		</indexterm><indexterm>
+		  <primary>file system</primary>
+		</indexterm><indexterm>
+		  <primary>shared resource</primary>
+		</indexterm><indexterm>
+		  <primary>share definition</primary>
+		</indexterm>
+				In any serious analysis of system security, it is important to examine the safeguards
+				that remain when all other protective measures fail. An administrator may inadvertently
+				set excessive permissions on the file system of a shared resource, or he may set excessive
+				privileges on the share itself. If that were to happen in a Windows 2003 Server environment,
+				the data would indeed be laid bare to abuse. Yet, within a Samba share definition, it is
+				possible to guard against that by enforcing controls on the share definition itself. You
+				see a practical example of this a little later in this chapter.
+				</para>
+
+	      <para><indexterm>
+		  <primary>diligence</primary>
+		</indexterm><indexterm>
+		  <primary>weakness</primary>
+		</indexterm>
+				The report that is critical of Samba really ought to have exercised greater due
+				diligence: the real weakness is on the side of a Microsoft Windows environment.
+				</para></listitem>
+		</varlistentry>
+
+		<varlistentry>
+			<term>Security Overall</term>
+	    <listitem><para><indexterm>
+		  <primary>defects</primary>
+		</indexterm>
+				Samba is designed in such a manner that weaknesses inherent in the design of
+				Microsoft Windows networking ought not to expose the underlying UNIX/Linux file
+				system in any way. All software has potential defects, and Samba is no exception.
+				What matters more is how defects that are discovered get dealt with.
+				</para>
+
+	      <para><indexterm>
+		  <primary>security</primary>
+		</indexterm><indexterm>
+		  <primary>protection</primary>
+		</indexterm><indexterm>
+		  <primary>compromise</primary>
+		</indexterm><indexterm>
+		  <primary>consequential risk</primary>
+		</indexterm>
+				The Samba Team totally agrees with the necessity to observe and fully implement
+				every security facility to provide a level of protection and security that is necessary
+				and that the end user (or network administrator) needs. Never would the Samba Team
+				recommend a compromise to system security, nor would deliberate defoliation of
+				security be publicly condoned; yet this is the practice by many Windows network
+				administrators just to make happy users who have no notion of consequential risk.
+				</para>
+
+	      <para><indexterm>
+		  <primary>condemns</primary>
+		</indexterm><indexterm>
+		  <primary>security fixes</primary>
+		</indexterm><indexterm>
+		  <primary>updates</primary>
+		</indexterm><indexterm>
+		  <primary>development</primary>
+		</indexterm><indexterm>
+		  <primary>documentation</primary>
+		</indexterm><indexterm>
+		  <primary>security updates</primary>
+		</indexterm><indexterm>
+		  <primary>turn-around time</primary>
+		</indexterm>
+				The report condemns Samba for releasing updates and security fixes, yet Microsoft
+				online updates need to be applied almost weekly. The answer to the criticism 
+				lies in the fact that Samba development is continuing, documentation is improving, 
+				user needs are being increasingly met or exceeded, and security updates are issued 
+				with a short turnaround time.
+				</para>
+
+	      <para><indexterm>
+		  <primary>modularization</primary>
+		</indexterm><indexterm>
+		  <primary>next generation</primary>
+		</indexterm><indexterm>
+		  <primary>responsible</primary>
+		</indexterm><indexterm>
+		  <primary>dependability</primary>
+		</indexterm><indexterm>
+		  <primary>road-map</primary>
+		  <secondary>published</secondary>
+		</indexterm>
+				The release of Samba-4 is expected around late 2004 to early 2005 and involves a near 
+				complete rewrite to permit extensive modularization and to prepare Samba for new 
+				functionality planned for addition during the next-generation series. The Samba Team 
+				is responsible and can be depended upon; the history to date suggests a high 
+				degree of dependability and on charter development consistent with published 
+				roadmap projections.
+				</para>
+
+	      <para><indexterm>
+		  <primary>foundation members</primary>
+		</indexterm><indexterm>
+		  <primary>Common Internet File System</primary>
+		  <see>CIFS</see>
+		</indexterm><indexterm>
+		  <primary>network attached storage</primary>
+		  <see>NAS</see>
+		</indexterm><indexterm>
+		  <primary>conferences</primary>
+		</indexterm><indexterm>
+		  <primary>presence and leadership</primary>
+		</indexterm><indexterm>
+		  <primary>leadership</primary>
+		</indexterm><indexterm>
+		  <primary>inter-operability</primary>
+		</indexterm>
+				Not well published is the fact that Microsoft was a foundation member of
+				the Common Internet File System (CIFS) initiative, together with the participation 
+				of the network attached storage (NAS) industry. Unfortunately, for the past few years,
+				Microsoft has been absent from active involvement at CIFS conferences and has
+				not exercised the leadership expected of a major force in the networking technology
+				space. The Samba Team has maintained consistent presence and leadership at all
+				CIFS conferences and at the interoperability laboratories run concurrently with
+				them.
+				</para></listitem>
+		</varlistentry>
+
+		<varlistentry>
+			<term>Cryptographic Controls (schannel, sign'n'seal)</term>
+	    <listitem><para><indexterm>
+		  <primary>Cryptographic</primary>
+		</indexterm><indexterm>
+		  <primary>schannel</primary>
+		</indexterm><indexterm>
+		  <primary>digital sign'n'seal</primary>
+		</indexterm>
+				The report correctly mentions that Samba did not support the most recent
+				<constant>schannel</constant> and <constant>digital sign'n'seal</constant> features
+				of Microsoft Windows NT/200x/XPPro products. This is one of the key features 
+				of the Samba-3 release. Market research reports take so long to generate that they are
+				seldom a reflection of current practice, and in many respects reports are like a
+				pathology report &smbmdash; they reflect accurately (at best) status at a snapshot in time.
+				Meanwhile, the world moves on.
+				</para>
+
+	      <para><indexterm>
+		  <primary>public specifications</primary>
+		</indexterm><indexterm>
+		  <primary>protocols</primary>
+		</indexterm><indexterm>
+		  <primary>algorithm</primary>
+		</indexterm><indexterm>
+		  <primary>compatible</primary>
+		</indexterm><indexterm>
+		  <primary>network</primary>
+		  <secondary>traffic</secondary>
+		  <tertiary>observation</tertiary>
+		</indexterm><indexterm>
+		  <primary>defensible standards</primary>
+		</indexterm><indexterm>
+		  <primary>secure networking</primary>
+		</indexterm>
+				It should be pointed out that had clear public specifications for the protocols
+				been published, it would have been much easier to implement these features and would have
+				taken less time to do. The sole mechanism used to find an algorithm that is compatible
+				with the methods used by Microsoft has been based on observation of network traffic
+				and trial-and-error implementation of potential techniques. The real value of public
+				and defensible standards is obvious to all and would have enabled more secure networking
+				for everyone.
+				</para>
+
+	      <para><indexterm>
+		  <primary>Critics</primary>
+		</indexterm><indexterm>
+		  <primary>digital sign'n'seal</primary>
+		</indexterm>
+				Critics of Samba often ignore fundamental problems that may plague (or may have plagued)
+				the users of Microsoft's products also. Those who are first to criticize Samba
+				for not rushing into release of <constant>digital sign'n'seal</constant> support
+				often dismiss the problems that Microsoft has 
+				<ulink url="http://support.microsoft.com/default.aspx?kbid=321733">acknowledged</ulink>
+				and for which a fix was provided. In fact,
+				<ulink url="http://www.tangent-systems.com/support/delayedwrite.html">Tangent Systems</ulink> 
+				appears even today<footnote>January 2004</footnote> to be unsure whether the problem has been resolved,
+				it is evident that some delay in release of new functionality may have
+				fortuitous consequences.
+				</para>
+
+	      <para><indexterm>
+		  <primary>secure networking protocols</primary>
+		</indexterm><indexterm>
+		  <primary>refereed standards</primary>
+		</indexterm><indexterm>
+		  <primary>proprietary</primary>
+		</indexterm><indexterm>
+		  <primary>digital rights</primary>
+		</indexterm><indexterm>
+		  <primary>protection</primary>
+		</indexterm><indexterm>
+		  <primary>networking protocols</primary>
+		</indexterm><indexterm>
+		  <primary>diffusion</primary>
+		</indexterm><indexterm>
+		  <primary>consumer</primary>
+		</indexterm><indexterm>
+		  <primary>choice</primary>
+		</indexterm>
+				One final comment is warranted. If companies want more secure networking protocols,
+				the most effective method by which this can be achieved is by users seeking
+				and working together to help define open and publicly refereed standards. The
+				development of closed source, proprietary methods that are developed in a
+				clandestine framework of secrecy, under claims of digital rights protection, does
+				not favor the diffusion of safe networking protocols and certainly does not
+				help the consumer to make a better choice.
+				</para></listitem>
+		</varlistentry>
+
+		<varlistentry>
+			<term>Active Directory Replacement with Kerberos, LDAP, and Samba</term>
+	        <indexterm>
+		  <primary>Active Directory</primary>
+		  <secondary>Replacement</secondary>
+		</indexterm><indexterm>
+		  <primary>Kerberos</primary>
+		</indexterm><indexterm>
+		  <primary>LDAP</primary>
+		</indexterm><indexterm>
+		  <primary>remote procedure call</primary>
+		  <see>RPC</see>
+		</indexterm>
+				<listitem><para>
+				<literallayout>    </literallayout>
+				The Microsoft networking protocols extensively make use of remote procedure call (RPC)
+				technology. Active Directory is not a simple mixture of LDAP and Kerberos together
+				with file and print services, but rather is a complex, intertwined implementation
+				of them that uses RPCs that are not supported by any of these component technologies
+				and yet by which they are made to interoperate in ways that the components do not
+				support.
+				</para>
+
+	      <para><indexterm>
+		  <primary>Active Directory</primary>
+		  <secondary>Server</secondary>
+		</indexterm><indexterm>
+		  <primary>OpenLDAP</primary>
+		</indexterm><indexterm>
+		  <primary>Kerberos</primary>
+		</indexterm><indexterm>
+		  <primary>project maintainers</primary>
+		</indexterm><indexterm>
+		  <primary>LDAP</primary>
+		</indexterm>
+				In order to make the popular request for Samba to be an Active Directory Server a
+				reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls
+				that are not presently supported. The Samba Team has not been able to gain critical
+				overall support for all project maintainers to work together on the complex
+				challenge of developing and integrating the necessary technologies. Therefore, if
+				the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality
+				into the Samba project, this dream request cannot become a reality.
+				</para>
+
+	      <para><indexterm>
+		  <primary>missing RPC's</primary>
+		</indexterm><indexterm>
+		  <primary>road-map</primary>
+		</indexterm><indexterm>
+		  <primary>ADS</primary>
+		  <secondary>server</secondary>
+		</indexterm><indexterm>
+		  <primary>MMC</primary>
+		</indexterm><indexterm>
+		  <primary>managed</primary>
+		</indexterm>
+				At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the
+				Samba development roadmap. If it is not on the published roadmap, it cannot be delivered
+				anytime soon. Ergo, ADS server support is not a current goal for Samba development.
+				The Samba Team is most committed to permitting Samba to be a full ADS domain member
+				that is increasingly capable of being managed using Microsoft Windows MMC tools.
+				</para></listitem>
+		</varlistentry>
+	</variablelist>
+
+	<sect3>
+	<title>Kerberos Exposed</title>
+
+	  <para><indexterm>
+	      <primary>kerberos</primary>
+	    </indexterm><indexterm>
+	      <primary>unauthorized activities</primary>
+	    </indexterm><indexterm>
+	      <primary>authorized location</primary>
+	    </indexterm>
+	Kerberos is a network authentication protocol that provides secure authentication for 
+	client-server applications by using secret-key cryptography. Firewalls are an insufficient 
+	barrier mechanism in today's networking world; at best they only restrict incoming network 
+	traffic but cannot prevent network traffic that comes from authorized locations from 
+	performing unauthorized activities.
+	</para>
+
+	  <para><indexterm>
+	      <primary>strong cryptography</primary>
+	    </indexterm><indexterm>
+	      <primary>identity</primary>
+	    </indexterm><indexterm>
+	      <primary>integrity</primary>
+	    </indexterm>
+	Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses 
+	strong cryptography so that a client can prove its identity to a server (and vice versa) across an 
+	insecure network connection. After a client and server has used Kerberos to prove their identity, 
+	they can also encrypt all of their communications to assure privacy and data integrity as they go 
+	about their business.
+	</para>
+
+	  <para><indexterm>
+	      <primary>trusted third-party</primary>
+	    </indexterm><indexterm>
+	      <primary>principals</primary>
+	    </indexterm><indexterm>
+	      <primary>trusting</primary>
+	    </indexterm><indexterm>
+	      <primary>kerberos</primary>
+	      <secondary>server</secondary>
+	    </indexterm><indexterm>
+	      <primary>secret</primary>
+	    </indexterm>
+	Kerberos is a trusted third-party service. That means that there is a third party (the kerberos 
+	server) that is trusted by all the entities on the network (users and services, usually called 
+	principals). All principals share a secret password (or key) with the kerberos server and this 
+	enables principals to verify that the messages from the kerberos server are authentic. Therefore, 
+	trusting the kerberos server, users and services can authenticate each other.
+	</para>
+
+	  <para><indexterm>
+	      <primary>restricted export</primary>
+	    </indexterm><indexterm>
+	      <primary>MIT Kerberos</primary>
+	    </indexterm><indexterm>
+	      <primary>Heimdal Kerberos</primary>
+	    </indexterm>
+	Kerberos was, until recently, a technology that was restricted from being exported from the United States.
+	For many years that hindered global adoption of more secure networking technologies both within the United States
+	and abroad. A free and unencumbered implementation of MIT Kerberos has been produced in Europe
+	and is available from the University of Paderborn, Sweden. It is known as the Heimdal Kerberos project.
+	In recent times the U.S. government has removed sanctions affecting the global distribution of MIT Kerberos.
+	It is likely that there will be a significant surge forward in the development of Kerberos-enabled applications
+	and in the general deployment and use of Kerberos across the spectrum of the information technology industry.
+	</para>
+
+	  <para><indexterm>
+	      <primary>Kerberos</primary>
+	      <secondary>interoperability</secondary>
+	    </indexterm>
+	A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation
+	of it. For example, a 2002 report by <ulink url="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument">IDG</ulink>
+	states:
+	</para>
+
+	<blockquote><para>
+	A Microsoft Corp. executive testified at the software giant's remedy hearing that the company goes to 
+	great lengths to disclose interfaces and protocols that allow third-party software products to interact 
+	with Windows. But a lawyer with the states suing Microsoft pointed out that when it comes to the company's 
+	use of the Kerberos authentication specification, not everyone agrees.
+	</para>
+
+	    <para><indexterm>
+		<primary>Kerberos</primary>
+		<secondary>unspecified fields</secondary>
+	      </indexterm>
+	Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared 
+	before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version 
+	5 specification that Windows clients use for proprietary purposes and still achieve interoperability with 
+	the Microsoft OS. Microsoft takes advantage of unspecified fields in the Kerberos specification for storing 
+	Windows-specific authorization data, Short wrote. The designers of Kerberos left these fields undefined so 
+	that software developers could add their own authorization information, he said.
+	</para></blockquote>
+
+	  <para><indexterm>
+	      <primary>DCE</primary>
+	    </indexterm><indexterm>
+	      <primary>RPC</primary>
+	    </indexterm>
+	It so happens that Microsoft Windows clients depend on and expect the contents of the <emphasis>unspecified
+	fields</emphasis> in the Kerberos 5 communications data stream for their Windows interoperability,
+	particularly when Samba is expected to emulate a Windows Server 200x domain controller. But the interoperability
+	issue goes far deeper than this. In the domain control protocols that are used by MS Windows XP Professional,
+	there is a tight interdependency between the Kerberos protocols and the Microsoft distributed computing environment
+	(DCE) RPCs that themselves are an integral part of the SMB/CIFS protocols as used by
+	Microsoft.
+	</para>
+
+	<para>
+	Microsoft makes the following comment in a reference in a <ulink url="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp">
+	technet</ulink> article:
+	</para>
+
+	  <blockquote><para><indexterm>
+		<primary>Privilege Attribute Certificates</primary>
+		<see>PAC</see>
+	      </indexterm><indexterm>
+		<primary>access control</primary>
+	      </indexterm>
+	The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC 
+	representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos 
+	tickets to convey Privilege Attribute Certificates (PACs) that define user identity and group membership. 
+	The DCE PAC is used in a similar manner as Windows NT Security IDs for user authorization and access control. 
+	Windows NT services will not be able to translate DCE PACs into Windows NT user and group identifiers. This 
+	is not an issue with Kerberos interoperability, but rather an issue of interoperability between DCE and 
+	Windows NT access control information.
+	</para></blockquote>
+
+	</sect3>
+
+	</sect2>
+
+</sect1>
+
+<sect1 id="ch10expl">
+	<title>Implementation</title>
+
+	<para>
+	The following procedures outline the implementation of the security measures discussed so far.
+	</para>
+
+	<sect2>
+	<title>Share Access Controls</title>
+
+	<para><indexterm>
+	    <primary>Share Access Controls</primary>
+	  </indexterm><indexterm>
+	    <primary>filter</primary>
+	  </indexterm><indexterm>
+	    <primary>connection</primary>
+	  </indexterm>
+	Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as
+	Windows XP Pro) attempts to make a connection to the Samba server.
+	</para>
+
+	<procedure>
+	<title>Create/Edit/Delete Share ACLs</title>
+	  <step><para><indexterm>
+		<primary>Domain Administrator</primary>
+	      </indexterm><indexterm>
+		<primary>account</primary>
+	      </indexterm>
+		From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 
+		account (on Samba domains, this is usually the account called <constant>root</constant>).
+		</para></step>
+
+		<step><para>
+		Click 
+		<menuchoice>
+			<guimenu>Start</guimenu>
+			<guimenuitem>Settings</guimenuitem>
+			<guimenuitem>Control Panel</guimenuitem>
+			<guimenuitem>Administrative Tools</guimenuitem>
+			<guimenuitem>Computer Management</guimenuitem>
+		</menuchoice>.
+		</para></step>
+
+		<step><para>
+		In the left panel,
+		<menuchoice>
+			<guimenu>[Right mouse menu item] Computer Management (Local)</guimenu>
+			<guimenuitem>Connect to another computer ...</guimenuitem>
+			<guimenuitem>Browse...</guimenuitem>
+			<guimenuitem>Advanced</guimenuitem>
+			<guimenuitem>Find Now</guimenuitem>
+		</menuchoice>. In the lower panel, click on the name of the server you wish to
+		administer. Click <menuchoice>
+				<guimenu>OK</guimenu>
+				<guimenuitem>OK</guimenuitem>
+				<guimenuitem>OK</guimenuitem>
+	      </menuchoice>.<indexterm>
+		<primary>Computer Management</primary>
+	      </indexterm>
+		In the left panel, the entry <guimenu>Computer Management (Local)</guimenu> should now reflect
+		the change made. For example, if the server you are administering is called <constant>FRODO</constant>,
+		the Computer Management entry should now say <guimenu>Computer Management (FRODO)</guimenu>.
+		</para></step>
+
+		<step><para>
+		In the left panel, click <menuchoice>
+			<guimenu>Computer Management (FRODO)</guimenu>
+			<guimenuitem>[+] Shared Folders</guimenuitem>
+			<guimenuitem>Shares</guimenuitem>
+		</menuchoice>.
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>ACLs</primary>
+	      </indexterm><indexterm>
+		<primary>Share Permissions</primary>
+	      </indexterm>
+		In the right panel, double-click on the share on which you wish to set/edit ACLs. This
+		will bring up the Properties panel. Click the <guimenu>Share Permissions</guimenu> tab.
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>access control settings</primary>
+	      </indexterm><indexterm>
+		<primary>Everyone</primary>
+	      </indexterm><indexterm>
+		<primary>full control</primary>
+	      </indexterm><indexterm>
+		<primary>over-rule</primary>
+	      </indexterm><indexterm>
+		<primary>permissions</primary>
+	      </indexterm><indexterm>
+		<primary>rejected</primary>
+	      </indexterm>
+		You may now edit/add/remove access control settings. Be very careful. Many problems have been
+		created by people who decided that everyone should be rejected but one particular group should
+		have full control. This is a catch-22 situation because members of that particular group also
+		belong to the group <constant>Everyone</constant>, which therefore overrules any permissions
+		set for the permitted group.
+		</para></step>
+
+		<step><para>
+		When you are done with editing, close all panels by clicking through the <guimenu>OK</guimenu>
+		buttons.
+		</para></step>
+	</procedure>
+
+	</sect2>
+
+	<sect2>
+	<title>Share Definition Controls</title>
+
+	<para><indexterm>
+	    <primary>Share Definition</primary>
+	    <secondary>Controls</secondary>
+	  </indexterm><indexterm>
+	    <primary>check-point</primary>
+	  </indexterm><indexterm>
+	    <primary>pile-driver</primary>
+	  </indexterm><indexterm>
+	    <primary>credential</primary>
+	  </indexterm><indexterm>
+	    <primary>powers</primary>
+	  </indexterm><indexterm>
+	    <primary>privileges</primary>
+	  </indexterm>
+	Share-definition-based access controls can be used like a checkpoint or like a pile-driver. Just as a
+	checkpoint can be used to require someone who wants to get through to meet certain requirements, so
+	it is possible to require the user (or group the user belongs to) to meet specified credential-related 
+	objectives. It can be likened to a pile-driver by overriding default controls in that having met the 
+	credential-related objectives, the user can be granted powers and privileges that would not normally be 
+	available under default settings.
+	</para>
+
+	<para><indexterm>
+	    <primary>access controls</primary>
+	  </indexterm><indexterm>
+	    <primary>ACLs</primary>
+	  </indexterm><indexterm>
+	    <primary>share definition controls</primary>
+	  </indexterm><indexterm>
+	    <primary>hierarchy of control</primary>
+	  </indexterm>
+	It must be emphasized that the controls discussed here can act as a filter or give rights of passage
+	that act as a superstructure over normal directory and file access controls. However, share-level
+	ACLs act at a higher level than do share definition controls because the user must filter through the
+	share-level controls to get to the share-definition controls. The proper hierarchy of controls implemented
+	by Samba and Windows networking consists of:
+	</para>
+
+	<orderedlist>
+		<listitem><para>Share-level ACLs</para></listitem>
+		<listitem><para>Share-definition controls</para></listitem>
+		<listitem><para>Directory and file permissions</para></listitem>
+		<listitem><para>Directory and file POSIX ACLs</para></listitem>
+	</orderedlist>
+
+	<sect3>
+	<title>Checkpoint Controls</title>
+
+	  <para><indexterm>
+	      <primary>Checkpoint Controls</primary>
+	    </indexterm>
+	Consider the following extract from a &smb.conf; file defining the share called <constant>Apps</constant>:
+<screen>
+[Apps]
+	comment = Application Share
+	path = /data/apps
+	read only = Yes
+	valid users = @Employees
+</screen>
+	This definition permits only those who are members of the group called <constant>Employees</constant> to 
+	access the share.
+	</para>
+
+	  <note><para><indexterm>
+		<primary>Domain Member</primary>
+		<secondary>servers</secondary>
+	      </indexterm><indexterm>
+		<primary>winbind use default domain</primary>
+	      </indexterm><indexterm>
+		<primary>fully qualified</primary>
+	      </indexterm><indexterm>
+		<primary>valid users</primary>
+	      </indexterm><indexterm>
+		<primary>delimiter</primary>
+	      </indexterm>
+	On domain member servers and clients, even when the <parameter>winbind use default domain</parameter> has
+	been specified, the use of domain accounts in security controls requires fully qualified domain specification,
+	for example, <smbconfoption name="valid users">@"MEGANET\Northern Engineers"</smbconfoption>. 
+	Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a
+	delimiter. 
+	</para></note>
+
+	  <para><indexterm>
+	      <primary>ACL</primary>
+	    </indexterm><indexterm>
+	      <primary>access</primary>
+	    </indexterm><indexterm>
+	      <primary>validate</primary>
+	    </indexterm>
+	If there is an ACL on the share itself to permit read/write access for all <constant>Employees</constant>
+	as well as read/write for the group <constant>Doctors</constant>, both groups are permitted through
+	to the share. However, at the moment an attempt is made to set up a connection to the share, a member of
+	the group <constant>Doctors</constant>, who is not also a member of the group <constant>Employees</constant>,
+	would immediately fail to validate.
+	</para>
+
+	  <para><indexterm>
+	      <primary>share definition controls</primary>
+	    </indexterm>
+	Consider another example. In this case, you want to permit all members of the group <constant>Employees</constant>
+	except the user <constant>patrickj</constant> to access the <constant>Apps</constant> share. This can be
+	easily achieved by setting a share-level ACL permitting only <constant>Employees</constant> to access the share,
+	and then in the share definition controls excluding just <constant>patrickj</constant>. Here is how that might
+	be done:
+<screen>
+[Apps]
+        comment = Application Share
+        path = /data/apps
+        read only = Yes
+        invalid users = patrickj
+</screen>
+	    <indexterm>
+	      <primary>permissions</primary>
+	    </indexterm>
+	Let us assume that you want to permit the user <constant>gbshaw</constant> to manage any file in the
+	UNIX/Linux file system directory <filename>/data/apps</filename>, but you do not want to grant any write
+	permissions beyond that directory tree. Here is one way this can be done:
+<screen>
+[Apps]
+        comment = Application Share
+        path = /data/apps
+        read only = Yes
+        invalid users = patrickj
+        admin users = gbshaw
+</screen>
+	    <indexterm>
+	      <primary>administrative rights</primary>
+	    </indexterm>
+	Now we have a set of controls that permits only <constant>Employees</constant> who are also members of
+	the group <constant>Doctors</constant>, excluding the user <constant>patrickj</constant>, to have 
+	read-only privilege, but the user <constant>gbshaw</constant> is granted administrative rights.
+	The administrative rights conferred upon the user <constant>gbshaw</constant> permit operation as
+	if that user has logged in as the user <constant>root</constant> on the UNIX/Linux system and thus,
+	for access to the directory tree that has been shared (exported), permit the user to override controls
+	that apply to all other users on that resource.
+	</para>
+
+	<para>
+	There are additional checkpoint controls that may be used. For example, if for the same share we now
+	want to provide the user <constant>peters</constant> with the ability to write to one directory to
+	which he has write privilege in the UNIX file system, you can specifically permit that with the
+	following settings:
+<screen>
+[Apps]
+        comment = Application Share
+        path = /data/apps
+        read only = Yes
+        invalid users = patrickj
+        admin users = gbshaw
+        write list = peters
+</screen>
+	    <indexterm>
+	      <primary>check-point controls</primary>
+	    </indexterm>
+	This is a particularly complex example at this point, but it begins to demonstrate the possibilities.
+	You should refer to the online manual page for the &smb.conf; file for more information regarding
+	the checkpoint controls that Samba implements.
+	</para>
+
+	</sect3>
+
+	<sect3>
+	<title>Override Controls</title>
+
+	  <para><indexterm>
+	      <primary>over-ride controls</primary>
+	    </indexterm>
+	Override controls implemented by Samba permit actions like the adoption of a different identity 
+	during file system operations, the forced overwriting of normal file and directory permissions,
+	and so on. You should refer to the online manual page for the &smb.conf; file for more information regarding
+        the override controls that Samba implements.
+	</para>
+
+	<para>
+	In the following example, you want to create a Windows networking share that any user can access.
+	However, you want all read and write operations to be performed as if the user <constant>billc</constant>
+	and member of the group <constant>Mentors</constant> read/write the files. Here is one way this
+	can be done:
+<screen>
+[someshare]
+	comment = Some Files Everyone May Overwrite
+	path = /data/somestuff
+	read only = No
+	force user = billc
+	force group = Mentors
+</screen>
+	    <indexterm>
+	      <primary>forced settings</primary>
+	    </indexterm><indexterm>
+	      <primary>overheads</primary>
+	    </indexterm>
+	That is all there is to it. Well, it is almost that simple. The downside of this method is that
+	users are logged onto the Windows client as themselves, and then immediately before accessing the
+	file, Samba makes system calls to change the effective user and group to the forced settings
+	specified, completes the file transaction, and then reverts to the actually logged-on identity.
+	This imposes significant overhead on Samba. The alternative way to effectively achieve the same result
+	(but with lower system CPU overheads) is described next.
+	</para>
+
+	  <para><indexterm>
+	      <primary>force user</primary>
+	    </indexterm><indexterm>
+	      <primary>force group</primary>
+	    </indexterm><indexterm>
+	      <primary>opportunistic</primary>
+	      <secondary>locking</secondary>
+	    </indexterm><indexterm>
+	      <primary>oplock break</primary>
+	    </indexterm><indexterm>
+	      <primary>performance degradation</primary>
+	    </indexterm>
+	The use of the <parameter>force user</parameter> or the <parameter>force group</parameter> may
+	also have a severe impact on system (particularly on Windows client) performance. If opportunistic
+	locking is enabled on the share (the default), it causes an <constant>oplock break</constant> to be
+	sent to the client even if the client has not opened the file. On networks that have high traffic
+	density, or on links that are routed to a remote network segment, <constant>oplock breaks</constant>
+	can be lost. This results in possible retransmission of the request, or the client may time-out while
+	waiting for the file system transaction (read or write) to complete. The result can be a profound
+	apparent performance degradation as the client continually attempts to reconnect to overcome the
+	effect of the lost <constant>oplock break</constant>, or time-out.
+	</para>
+	
+	</sect3>
+
+	</sect2>
+
+	<sect2>
+	<title>Share Point Directory and File Permissions</title>
+
+	<para><indexterm>
+	    <primary>security</primary>
+	  </indexterm><indexterm>
+	    <primary>privilege controls</primary>
+	  </indexterm><indexterm>
+	    <primary>permission</primary>
+	  </indexterm><indexterm>
+	    <primary>share definition controls</primary>
+	  </indexterm>
+	Samba has been designed and implemented so that it respects as far as is feasible the security and
+	user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing
+	with respect to file system access that violates file system permission settings, unless it is
+	explicitly instructed to do otherwise through share definition controls. Given that Samba obeys
+	UNIX file system controls, this chapter does not document simple information that can be obtained
+	from a basic UNIX training guide. Instead, one common example of a typical problem is used
+	to demonstrate the most effective solution referred to in the immediately preceding paragraph.
+	</para>
+
+	<para><indexterm>
+	    <primary>Microsoft Office</primary>
+	  </indexterm><indexterm>
+	    <primary>Word</primary>
+	  </indexterm><indexterm>
+	    <primary>Excel</primary>
+	  </indexterm>
+	One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of
+	Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence:
+	</para>
+
+	<orderedlist>
+		<listitem><para>
+		A user opens a Work document from a network drive. The file was owned by user <constant>janetp</constant>
+		and <group>users</group>, and was set read/write-enabled for everyone.
+		</para></listitem>
+
+		<listitem><para>
+		File changes and edits are made.
+		</para></listitem>
+
+		<listitem><para>
+		The file is saved, and MS Word is closed.
+		</para></listitem>
+
+		<listitem><para>
+		The file is now owned by the user <constant>billc</constant> and group <constant>doctors</constant>,
+		and is set read/write by <constant>billc</constant>, read-only by <constant>doctors</constant>, and
+		no access by everyone.
+		</para></listitem>
+
+		<listitem><para>
+		The original owner cannot now access her own file and is <quote>justifiably</quote> upset.
+		</para></listitem>
+	</orderedlist>
+
+	<para>
+	There have been many postings over the years that report the same basic problem. Frequently Samba users
+	want to know when this <quote>bug</quote> will be fixed. The fact is, this is not a bug in Samba at all.
+	Here is the real sequence of what happens in this case.
+	</para>
+
+	<para><indexterm>
+	    <primary>MS Word</primary>
+	  </indexterm><indexterm>
+	    <primary>ownership</primary>
+	  </indexterm><indexterm>
+	    <primary>permissions</primary>
+	  </indexterm>
+	When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned
+	by the user who creates the file (<constant>billc</constant>) and has the permissions that follow
+	that user's default settings within the operating system (UNIX/Linux). When MS Word has finished writing
+	the file to disk, it then renames the new (temporary) file to the name of the old one. MS Word does not
+	change the ownership or permissions to what they were on the original file. The file is thus a totally
+	new file, and the old one has been deleted in the process.
+	</para>
+
+	<para>
+	Samba received a request to create a new file, and then to rename the file to a new name. The old file that
+	has the same name is now automatically deleted. Samba has no way of knowing that the new file should
+	perhaps have the same ownership and permissions as the old file. To Samba, these are entirely independent
+	operations.
+	</para>
+
+	<para>
+	The question is, <quote>How can we solve the problem?</quote>
+	</para>
+
+	<para>
+	The solution is simple. Use UNIX file system permissions and controls to your advantage. Follow these
+	simple steps to create a share in which all files will consistently be owned by the same user and the
+	same group:
+	</para>
+
+
+	<procedure>
+	<title>Using Directory Permissions to Force File User and Group Ownership</title>
+		<step><para>
+		Change your share definition so that it matches this pattern:
+<screen>
+[finance]
+        path = /usr/data/finance
+        browseable = Yes
+        read only = No
+</screen>
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>permissions</primary>
+		<secondary>user</secondary>
+	      </indexterm><indexterm>
+		<primary>permissions</primary>
+		<secondary>group</secondary>
+	      </indexterm>
+		Set consistent user and group permissions recursively down the directory tree as shown here:
+<screen>
+&rootprompt; chown -R janetp.users /usr/data/finance
+</screen>
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>accessible</primary>
+	      </indexterm>
+		Set the files and directory permissions to be read/write for owner and group, and not accessible
+		to others (everyone), using the following command:
+<screen>
+&rootprompt; chmod ug+rwx,o-rwx /usr/data/finance
+</screen>
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>SGID</primary>
+	      </indexterm>
+		Set the SGID (supergroup) bit on all directories from the top down. This means all files 
+		can be created with the permissions of the group set on the directory. It means all users 
+		who are members of the group <constant>finance</constant> can read and write all files in 
+		the directory. The directory is not readable or writable by anyone who is not in the 
+		<constant>finance</constant> group. Simply follow this example:
+<screen>
+&rootprompt; find /usr/data/finance -type d -exec chmod ug+s {}\;
+</screen>
+
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>group membership</primary>
+	      </indexterm><indexterm>
+		<primary>primary group</primary>
+	      </indexterm><indexterm>
+		<primary>/etc/passwd</primary>
+	      </indexterm>
+		Make sure all users that must have read/write access to the directory have 
+		<constant>finance</constant> group membership as their primary group, 
+		for example, the group they belong to in <filename>/etc/passwd</filename>.
+		</para></step>
+	</procedure>
+
+	</sect2>
+
+	<sect2>
+	<title>Managing Windows 200x ACLs</title>
+
+	<para><indexterm>
+	    <primary>translate</primary>
+	  </indexterm><indexterm>
+	    <primary>Windows 2000 ACLs</primary>
+	  </indexterm><indexterm>
+	    <primary>Posix ACLs</primary>
+	  </indexterm><indexterm>
+	    <primary>side effects</primary>
+	  </indexterm>
+	Samba must translate Windows 2000 ACLs to UNIX POSIX ACLs. This has some interesting side effects because
+	there is not a one-to-one equivalence between them. The as-close-as-possible ACLs match means
+	that some transactions are not possible from MS Windows clients. One of these is to reset the ownership
+	of directories and files. If you want to reset ownership, this must be done from a UNIX/Linux login.
+	</para>
+
+	<para>
+	There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation,
+	either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface.
+	</para>
+
+	<sect3>
+	<title>Using the MMC Computer Management Interface</title>
+
+	<procedure>
+		<step><para>
+		From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 
+		account (on Samba domains, this is usually the account called <constant>root</constant>).
+		</para></step>
+
+		<step><para>
+		Click 
+		<menuchoice>
+			<guimenu>Start</guimenu>
+			<guimenuitem>Settings</guimenuitem>
+			<guimenuitem>Control Panel</guimenuitem>
+			<guimenuitem>Administrative Tools</guimenuitem>
+			<guimenuitem>Computer Management</guimenuitem>
+		</menuchoice>.
+		</para></step>
+
+		<step><para>
+		In the left panel,
+		<menuchoice>
+			<guimenu>[Right mouse menu item] Computer Management (Local)</guimenu>
+			<guimenuitem>Connect to another computer ...</guimenuitem>
+			<guimenuitem>Browse...</guimenuitem>
+			<guimenuitem>Advanced</guimenuitem>
+			<guimenuitem>Find Now</guimenuitem>
+		</menuchoice>. In the lower panel, click on the name of the server you wish to
+		administer. Click <menuchoice>
+				<guimenu>OK</guimenu>
+				<guimenuitem>OK</guimenuitem>
+				<guimenuitem>OK</guimenuitem>
+		</menuchoice>.
+		In the left panel, the entry <guimenu>Computer Management (Local)</guimenu> should now reflect
+		the change made. For example, if the server you are administering is called <constant>FRODO</constant>,
+		the Computer Management entry should now say: <guimenu>Computer Management (FRODO)</guimenu>.
+		</para></step>
+
+		<step><para>
+		In the left panel, click <menuchoice>
+			<guimenu>Computer Management (FRODO)</guimenu>
+			<guimenuitem>[+] Shared Folders</guimenuitem>
+			<guimenuitem>Shares</guimenuitem>
+		</menuchoice>.
+		</para></step>
+
+	    <step><para><indexterm>
+		  <primary>Security</primary>
+		</indexterm><indexterm>
+		  <primary>Properties</primary>
+		</indexterm><indexterm>
+		  <primary>Permissions</primary>
+		</indexterm><indexterm>
+		  <primary>Samba Domain server</primary>
+		</indexterm>
+		In the right panel, double-click on the share on which you wish to set/edit ACLs. This
+		brings up the Properties panel. Click the <guimenu>Security</guimenu> tab. It is best
+		to edit ACLs using the <constant>Advanced</constant> editing features. Click the 
+		<guimenu>Advanced</guimenu> button. This opens a panel that has four tabs. Only the 
+		functionality under the <constant>Permissions</constant> tab can be utilized with respect 
+		to a Samba domain server.
+		</para></step>
+
+	    <step><para><indexterm>
+		  <primary>access control</primary>
+		</indexterm><indexterm>
+		  <primary>permitted group</primary>
+		</indexterm>
+		You may now edit/add/remove access control settings. Be very careful. Many problems have been
+		created by people who decided that everyone should be rejected but one particular group should
+		have full control. This is a catch-22 situation because members of that particular group also
+		belong to the group <constant>Everyone</constant>, which therefore overrules any permissions
+		set for the permitted group.
+		</para></step>
+
+		<step><para>
+		When you are done with editing, close all panels by clicking through the <guimenu>OK</guimenu>
+		buttons until the last panel closes.
+		</para></step>
+	</procedure>
+	
+	</sect3>
+
+	<sect3>
+	<title>Using MS Windows Explorer (File Manager)</title>
+
+	<para>
+	The following alternative method may be used from a Windows workstation. In this example we work
+	with a domain called <constant>MEGANET</constant>, a server called <constant>MASSIVE</constant>, and a
+	share called <constant>Apps</constant>. The underlying UNIX/Linux share point for this share is
+	<filename>/data/apps</filename>.
+	</para>
+
+	<procedure>
+		<step><para>
+		Click <menuchoice>
+			<guimenu>Start</guimenu>
+			<guimenuitem>[right-click] My Computer</guimenuitem>
+			<guimenuitem>Explore</guimenuitem>
+			<guimenuitem>[left panel] [+] My Network Places</guimenuitem>
+			<guimenuitem>[+] Entire Network</guimenuitem>
+			<guimenuitem>[+] Microsoft Windows Network</guimenuitem>
+			<guimenuitem>[+] Meganet</guimenuitem>
+			<guimenuitem>[+] Massive</guimenuitem>
+			<guimenuitem>[right-click] Apps</guimenuitem>
+			<guimenuitem>Properties</guimenuitem>
+			<guimenuitem>Security</guimenuitem>
+			<guimenuitem>Advanced</guimenuitem>
+		</menuchoice>. This opens a panel that has four tabs. Only the functionality under the 
+		<constant>Permissions</constant> tab can be utilized for a Samba domain server.
+		</para></step>
+
+	    <step><para><indexterm>
+		  <primary>full control</primary>
+		</indexterm><indexterm>
+		  <primary>over-rule</primary>
+		</indexterm>
+                You may now edit/add/remove access control settings. Be very careful. Many problems have been
+                created by people who decided that everyone should be rejected but one particular group should
+                have full control. This is a catch-22 situation because members of that particular group also
+                belong to the group <constant>Everyone</constant>, which therefore overrules any permissions
+                set for the permitted group.
+                </para></step>
+
+                <step><para>
+                When you are done with editing, close all panels by clicking through the <guimenu>OK</guimenu>
+                buttons until the last panel closes.
+                </para></step>
+	</procedure>
+
+	</sect3>
+
+	<sect3>
+	<title>Setting Posix ACLs in UNIX/Linux</title>
+
+	  <para><indexterm>
+	      <primary>desired security setting</primary>
+	    </indexterm><indexterm>
+	      <primary>shared resource</primary>
+	    </indexterm>
+	Yet another alternative method for setting desired security settings on the shared resource files and
+	directories can be achieved by logging into UNIX/Linux and setting POSIX ACLs directly using command-line
+	tools. Here is an example session on the same resource as in the immediately preceding example on a SUSE 9
+	Linux system:
+	</para>
+
+	<procedure>
+		<step><para>
+		Log into the Linux system as the user <constant>root</constant>.
+		</para></step>
+
+		<step><para>
+		Change directory to the location of the exported (shared) Windows file share (Apps), which is in
+		the directory <filename>/data</filename>. Execute the following:
+<screen>
+&rootprompt; cd /data
+</screen>
+		Retrieve the existing POSIX ACLs entry by executing:
+<screen>
+&rootprompt; getfacl apps
+# file: apps
+# owner: root
+# group: root
+user::rwx
+group::rwx
+other::r-x
+</screen>
+		</para></step>
+
+	    <step><para><indexterm>
+		  <primary>recursively</primary>
+		</indexterm>
+		You want to add permission for <constant>AppsMgrs</constant> to enable them to
+		manage the applications (apps) share. It is important to set the ACL recursively
+		so that the AppsMgrs have this capability throughout the directory tree that is 
+		being shared. This is done using the <constant>-R</constant> option as shown.
+		Execute the following:
+<screen>
+&rootprompt; setfacl -m -R group:AppsMgrs:rwx /data/apps
+</screen>
+		Because setting an ACL does not provide a response, you immediately validate the command executed
+		as follows:
+<screen>
+&rootprompt; getfacl /data/apps
+# file: apps
+# owner: root
+# group: root
+user::rwx
+group::rwx
+group:AppsMgrs:rwx
+mask::rwx
+other::r-x
+</screen>
+		This confirms that the change of POSIX ACL permissions has been effective.
+		</para></step>
+
+	    <step><para><indexterm>
+		  <primary>setfacl</primary>
+		</indexterm><indexterm>
+		  <primary>getfacl</primary>
+		</indexterm><indexterm>
+		  <primary>directory tree</primary>
+		</indexterm><indexterm>
+		  <primary>Windows ACLs</primary>
+		</indexterm><indexterm>
+		  <primary>inheritance</primary>
+		</indexterm>
+		It is highly recommended that you read the online manual page for the <command>setfacl</command>
+		and <command>getfacl</command> commands. This provides information regarding how to set/read the default
+		ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent
+		of setting <constant>inheritance</constant> properties.
+		</para></step>
+	</procedure>
+
+	</sect3>
+
+	</sect2>
+
+	<sect2>
+		<title>Key Points Learned</title>
+
+		<para>
+		The mish-mash of issues were thrown together into one chapter because it seemed like a good idea.
+		Looking back, this chapter could be broken into two, but it's too late now. It has been done.
+		The highlights covered are as follows:
+		</para>
+
+		<itemizedlist>
+	  <listitem><para><indexterm>
+		<primary>Winbind</primary>
+	      </indexterm><indexterm>
+		<primary>Active Directory</primary>
+	      </indexterm><indexterm>
+		<primary>password change</primary>
+	      </indexterm><indexterm>
+		<primary>logon hours</primary>
+	      </indexterm>
+			Winbind honors and does not override account controls set in Active Directory.
+			This means that password change, logon hours, and so on, are (or soon will be) enforced
+			by Samba winbind. At this time, an out-of-hours login is denied and password
+			change is enforced. At this time, if logon hours expire, the user is not forcibly
+			logged off. That may be implemented at some later date.
+			</para></listitem>
+
+	  <listitem><para><indexterm>
+		<primary>Sign'n'seal</primary>
+	      </indexterm><indexterm>
+		<primary>schannel</primary>
+	      </indexterm>
+			Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential
+			problems acknowledged by Microsoft as having been fixed but reported by some as still
+			possibly an open issue.
+			</para></listitem>
+
+	  <listitem><para><indexterm>
+		<primary>Kerberos</primary>
+	      </indexterm><indexterm>
+		<primary>OpenLDAP</primary>
+	      </indexterm><indexterm>
+		<primary>Active Directory</primary>
+	      </indexterm><indexterm>
+		<primary>inter-operability</primary>
+	      </indexterm>
+			The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft
+			Active Directory. The possibility to do this is not planned in the current Samba-3
+			roadmap. Samba-3 does aim to provide further improvements in interoperability so that
+			UNIX/Linux systems may be fully integrated into Active Directory domains.
+			</para></listitem>
+
+			<listitem><para>
+			This chapter reviewed mechanisms by which Samba servers may be kept secure. Each of
+			the four key methodologies was reviewed with specific reference to example deployment
+			techniques.
+			</para></listitem>
+		</itemizedlist>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Questions and Answers</title>
+
+	<para>
+	</para>
+
+	<qandaset defaultlabel="chap10qa" type="number">
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>Sign'n'seal</primary>
+	      </indexterm><indexterm>
+		<primary>registry hacks</primary>
+	      </indexterm>
+		Does Samba-3 require the <constant>Sign'n'seal</constant> registry hacks needed by Samba-2?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>schannel</primary>
+	      </indexterm><indexterm>
+		<primary>Sign'n'seal</primary>
+	      </indexterm><indexterm>
+		<primary>registry change</primary>
+	      </indexterm>
+		No. Samba-3 fully supports <constant>Sign'n'seal</constant> as well as <constant>schannel</constant>
+		operation. The registry change should not be applied when Samba-3 is used as a domain controller.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Does Samba-3 support Active Directory?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>Active Directory</primary>
+	      </indexterm>
+		Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not
+		provide Active Directory services. It cannot be used to replace a Microsoft Active Directory
+		server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit,
+		and it can function as an Active Directory domain member server.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>mixed-mode</primary>
+	      </indexterm>
+		When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was
+		necessary with Samba-2?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>native</primary>
+	      </indexterm>
+		No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x
+		Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation,
+		because Samba-3 can join a native Windows 2003 Server ADS domain.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>share level access controls</primary>
+	      </indexterm>
+		Is it safe to set share-level access controls in Samba?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Yes. Share-level access controls have been supported since early versions of Samba-2. This is
+		very mature technology. Not enough sites make use of this powerful capability, neither on
+		Windows server or with Samba servers.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>share ACLs</primary>
+	      </indexterm>
+		Is it mandatory to set share ACLs to get a secure Samba-3 server?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>file system security</primary>
+	      </indexterm><indexterm>
+		<primary>Windows 200x ACLs</primary>
+	      </indexterm><indexterm>
+		<primary>share definition controls</primary>
+	      </indexterm><indexterm>
+		<primary>share level ACL</primary>
+	      </indexterm><indexterm>
+		<primary>security</primary>
+	      </indexterm>
+		No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides 
+		means of securing shares through share definition controls in the &smb.conf; file. The additional
+		support for share-level ACLs is like frosting on the cake. It adds to security but is not essential
+		to it.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>valid users</primary>
+	      </indexterm>
+		The <parameter>valid users</parameter> did not work on the <smbconfsection name="[homes]"/>.
+		Has this functionality been restored yet?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>meta-service</primary>
+	      </indexterm>
+		Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard
+		on the <smbconfsection name="[homes]"/> meta-service. The correct way to specify this is:
+		<smbconfoption name="valid users">%S</smbconfoption>.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>force user</primary>
+	      </indexterm><indexterm>
+		<primary>force group</primary>
+	      </indexterm><indexterm>
+		<primary>bias</primary>
+	      </indexterm>
+		Is the bias against use of the <parameter>force user</parameter> and <parameter>force group</parameter>
+		really warranted?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>performance</primary>
+	      </indexterm>
+		There is no bias. There is a determination to recommend the right tool for the task at hand.
+		After all, it is better than putting users through performance problems, isn't it?
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		The example given for file and directory access control forces all files to be owned by one
+		particular user. I do not like that. Is there any way I can see who created the file?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>SUID</primary>
+	      </indexterm>
+		Sure. You do not have to set the SUID bit on the directory. Simply execute the following command
+		to permit file ownership to be retained by the user who created it:
+<screen>
+&rootprompt; find /usr/data/finance -type d -exec chmod g+s {}\;
+</screen>
+		Note that this required no more than removing the <constant>u</constant> argument so that the
+		SUID bit is not set for the owner.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>Computer Management</primary>
+	      </indexterm>
+		In the book, <quote>The Official Samba-3 HOWTO and Reference Guide</quote>, you recommended use
+		of the Windows NT4 Server Manager (part of the <filename>SRVTOOLS.EXE</filename>) utility. Why
+		have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>MMC</primary>
+	      </indexterm><indexterm>
+		<primary>SRVTOOLS.EXE</primary>
+	      </indexterm>
+		Either tool can be used with equal effect. There is no benefit of one over the other, except that
+		the MMC utility is present on all Windows 200x/XP systems and does not require additional software
+		to be downloaded and installed. Note that if you want to manage user and group accounts in your
+		Samba-controlled domain, the only tool that permits that is the NT4 Domain User Manager, which
+		is provided as part of the <filename>SRVTOOLS.EXE</filename> utility.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>valid users</primary>
+	      </indexterm><indexterm>
+		<primary>Active Directory</primary>
+	      </indexterm><indexterm>
+		<primary>Domain Member server</primary>
+	      </indexterm>
+		I tried to set <parameter>valid users = @Engineers</parameter>, but it does not work. My Samba
+		server is an Active Directory domain member server. Has this been fixed now?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The use of this parameter has always required the full specification of the domain account, for
+		example, <parameter>valid users = @"MEGANET2\Domain Admins"</parameter>.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	</qandaset>
+
+</sect1>
+
+</chapter>
+
diff --git a/docs/Samba3-ByExample/SBE-MakingHappyUsers.xml b/docs/Samba3-ByExample/SBE-MakingHappyUsers.xml
new file mode 100644
index 0000000000..f5cf133a60
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-MakingHappyUsers.xml
@@ -0,0 +1,4399 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="happy">
+  <title>Making Happy Users</title>
+
+	<para>
+	It is said that <quote>a day that is without troubles is not fulfilling.  Rather, give 
+	me a day of troubles well handled so that I can be content with my achievements.</quote>
+	</para>
+
+	<para>
+	In the world of computer networks, problems are as varied as the people who create them
+	or experience them. The design of the network implemented in <link linkend="Big500users"/>
+	may create problems for some network users. The following lists some of the problems that
+	may occur:
+	</para>
+
+	<indexterm><primary>PDC</primary></indexterm>
+	<indexterm><primary>network bandwidth</primary><secondary>utilization</secondary></indexterm>
+	<indexterm><primary>BDC</primary></indexterm>
+	<indexterm><primary>user account</primary></indexterm>
+	<indexterm><primary>PDC/BDC ratio</primary></indexterm>
+<caution><para>
+A significant number of network administrators have responded to the guidance given
+here. It should be noted that there are sites that have a single PDC for many hundreds of
+concurrent network clients. Network bandwidth, network bandwidth utilization, and server load
+are among the factors that determine the maximum number of Windows clients that
+can be served by a single domain controller (PDC or BDC) on a network segment. It is possible
+to operate with only a single PDC over a routed network. What is possible is not necessarily
+<emphasis>best practice</emphasis>. When Windows client network logons begin to fail with
+the message that the domain controller cannot be found or that the user account cannot
+be found (when you know it exists), that may be an indication that the domain controller is
+overloaded or network bandwidth is overloaded. The guidance given for PDC/BDC ratio to Windows
+clients is conservative and if followed will minimize problems &smbmdash; but it is not absolute.
+</para></caution>
+
+	<variablelist>
+		<varlistentry>
+		<term>Users experiencing difficulty logging onto the network</term>
+		<listitem><para>
+		<indexterm><primary>network</primary><secondary>logon</secondary></indexterm>
+		<indexterm><primary>multiple domain controllers</primary></indexterm>
+		When a Windows client logs onto the network, many data packets are exchanged
+		between the client and the server that is providing the network logon services.
+		Each request between the client and the server must complete within a specific
+		time limit. This is one of the primary factors that govern the installation of
+		multiple domain controllers (usually called secondary or backup controllers).
+		As a rough rule, there should be one such backup controller for every
+		30 to 150 clients. The actual limits are determined by network operational
+		characteristics. 
+		</para>
+
+		<para>
+		If the domain controller provides only network logon services
+		and all file and print activity is handled by domain member servers, one domain	
+		controller per 150 clients on a single network segment may suffice. In any
+		case, it is highly recommended to have a minimum of one domain controller (PDC or BDC)
+		per network segment. It is better to have at least one BDC on the network
+		segment that has a PDC. If the domain controller is also used as a file and
+		print server, the number of clients it can service reliably is reduced,
+		and a common rule is not to exceed 30 machines (Windows workstations plus
+		domain member servers) per domain controller.
+		</para></listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Slow logons and log-offs</term>
+		<listitem><para>
+		<indexterm><primary>slow logon</primary></indexterm>
+		Slow logons and log-offs may be caused by many factors that include:
+
+			<itemizedlist>
+				<listitem><para>
+				<indexterm><primary>NetBIOS</primary><secondary>name resolution</secondary><tertiary>delays</tertiary></indexterm>
+				<indexterm><primary>WINS</primary><secondary>server</secondary></indexterm>
+				Excessive delays in the resolution of a NetBIOS name to its IP
+				address. This may be observed when an overloaded domain controller 
+				is also the WINS server. Another cause may be the failure to use
+				a WINS server (this assumes that there is a single network segment).
+				</para></listitem>
+
+				<listitem><para>
+				<indexterm><primary>traffic collisions</primary></indexterm>
+				<indexterm><primary>HUB</primary></indexterm>
+				<indexterm><primary>ethernet switch</primary></indexterm>
+				Network traffic collisions due to overloading of the network
+				segment. One short-term workaround to this may be to replace
+				network HUBs with Ethernet switches.
+				</para></listitem>
+
+				<listitem><para>
+				<indexterm><primary>networking hardware</primary><secondary>defective</secondary></indexterm>
+				Defective networking hardware. Over the past few years, we have seen
+				on the Samba mailing list a significant increase in the number of
+				problems that were traced to a defective network interface controller,
+				a defective HUB or Ethernet switch, or defective cabling. In most cases,
+				it was the erratic nature of the problem that ultimately pointed to
+				the cause of the problem.
+				</para></listitem>
+
+				<listitem><para>
+				<indexterm><primary>profile</primary><secondary>roaming</secondary></indexterm>
+				<indexterm><primary>MS Outlook</primary><secondary>PST file</secondary></indexterm>
+				Excessively large roaming profiles. This type of problem is typically
+				the result of poor user education as well as poor network management.
+				It can be avoided by users not storing huge quantities of email in
+				MS Outlook PST files as well as by not storing files on the desktop.
+				These are old bad habits that require much discipline and vigilance
+				on the part of network management.
+				</para></listitem>
+
+				<listitem><para>
+				<indexterm><primary>WebClient</primary></indexterm>
+				You should verify that the Windows XP WebClient service is not running.
+				The use of the WebClient service has been implicated in many Windows
+				networking-related problems.
+				</para></listitem>
+			</itemizedlist>
+			</para></listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Loss of access to network drives and printer resources</term>
+		<listitem><para>
+		Loss of access to network resources during client operation may be caused by a number
+		of factors, including:
+		</para>
+
+			<itemizedlist>
+				<listitem><para>
+				<indexterm><primary>network</primary><secondary>overload</secondary></indexterm>
+				Network overload (typically indicated by a high network collision rate)
+				</para></listitem>
+
+				<listitem><para>
+				Server overload
+				</para></listitem>
+
+				<listitem><para>
+				<indexterm><primary>network</primary><secondary>timeout</secondary></indexterm>
+				Timeout causing the client to close a connection that is in use but has
+				been latent (no traffic) for some time (5 minutes or more)
+				</para></listitem>
+
+				<listitem><para>
+				<indexterm><primary>network hardware</primary><secondary>defective</secondary></indexterm>
+				Defective networking hardware
+				</para></listitem>
+			</itemizedlist>
+
+		<para>
+		<indexterm><primary>data</primary><secondary>corruption</secondary></indexterm>
+		No matter what the cause, a sudden loss of access to network resources can
+		result in BSOD (blue screen of death) situations that necessitate rebooting of the client
+		workstation. In the case of a mild problem, retrying to access the network drive of the printer
+		may restore operations, but in any case this is a serious problem that may lead to the next
+		problem, data corruption.
+		</para></listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Potential data corruption</term>
+		<listitem><para>
+		<indexterm><primary>data</primary><secondary>corruption</secondary></indexterm>
+		Data corruption is one of the most serious problems. It leads to uncertainty, anger, and 
+		frustration, and generally precipitates immediate corrective demands. Management response
+		to this type of problem may be rational, as well as highly irrational. There have been
+		cases where management has fired network staff for permitting this situation to occur without 
+		immediate correction. There have been situations where perfectly functional hardware was thrown 
+		out and replaced, only to find the problem caused by a low-cost network hardware item. There 
+		have been cases where server operating systems were replaced, or where Samba was updated, 
+		only to later isolate the problem due to defective client software.
+		</para></listitem>
+		</varlistentry>
+	</variablelist>
+
+	<para>
+	In this chapter, you can work through a number of measures that significantly arm you to
+	anticipate and combat network performance issues. You can work through complex and thorny
+	methods to improve the reliability of your network environment, but be warned that all such steps
+	demand the price of complexity.
+	</para>
+
+<sect1>
+<title>Regarding LDAP Directories and Windows Computer Accounts</title>
+
+	<para>
+	<indexterm><primary>LDAP</primary><secondary>directory</secondary></indexterm>
+	Computer (machine) accounts can be placed wherever you like in an LDAP directory subject to some 
+	constraints that are described in this section.
+	</para>
+
+	<para>
+	<indexterm><primary>POSIX</primary></indexterm>
+	<indexterm><primary>SambaSAMAccount</primary></indexterm>
+	<indexterm><primary>machine account</primary></indexterm>
+	<indexterm><primary>trust account</primary></indexterm>
+	The POSIX and SambaSAMAccount components of computer (machine) accounts are both used by Samba. 
+	That is, machine  accounts are treated inside Samba in the same way that Windows NT4/200X treats 
+	them. A user account and a machine account are indistinguishable from each other, except that
+	the machine account ends in a $ character, as do trust accounts.
+	</para>
+
+	<para>
+	<indexterm><primary>account</primary></indexterm>
+	<indexterm><primary>UID</primary></indexterm>
+	The need for Windows user, group, machine, trust, and other such accounts to be tied to a valid UNIX UID
+	is a design decision that was made a long way back in the history of Samba development. It is 
+	unlikely that this decision will be reversed or changed during the remaining life of the 
+	Samba-3.x series. 
+	</para>
+
+	<para>
+	<indexterm><primary>SID</primary></indexterm>
+	<indexterm><primary>NSS</primary></indexterm>
+	The resolution of a UID from the Windows SID is achieved within Samba through a mechanism that
+	must refer back to the host operating system on which Samba is running. The name service
+	switch (NSS) is the preferred mechanism that shields applications (like Samba) from the
+	need to know everything about every host OS it runs on.
+	</para>
+
+	<para>
+	Samba asks the host OS to provide a UID via the <quote>passwd</quote>, <quote>shadow</quote>
+	and <quote>group</quote> facilities in the NSS control (configuration) file. The best tool
+	for achieving this is left up to the UNIX administrator to determine. It is not imposed by
+	Samba. Samba provides winbindd together with its support libraries as one method. It is
+	possible to do this via LDAP, and for that Samba provides the appropriate hooks so that
+	all account entities can be located in an LDAP directory.
+	</para>
+
+	<para>
+	<indexterm><primary>nss_ldap</primary></indexterm>
+	For many the weapon of choice is to use the PADL nss_ldap utility. This utility must
+	be configured so that computer accounts can be resolved to a POSIX/UNIX account UID. That
+	is fundamentally an LDAP design question.  The information provided on the Samba list and
+	in the documentation is directed at providing working examples only. The design
+	of an LDAP directory is a complex subject that is beyond the scope of this documentation.
+	</para>
+
+</sect1>
+
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>
+	You just opened an email from Christine that reads:
+	</para>
+
+	<para>
+	Good morning,
+	<blockquote><attribution>Christine</attribution><para>
+	A few months ago we sat down to design the network. We discussed the challenges ahead and we all
+	agreed to compromise our design to keep it simple. We knew there would be problems, but anticipated
+	that we would have some time to resolve any issues that might be encountered.
+	</para>
+
+	<para>
+	As you now know, we started off on the wrong foot. We have a lot of unhappy users. One of them
+	resigned yesterday afternoon because she was under duress to complete some critical projects. She
+	suffered a blue screen of death situation just as she was finishing four hours of intensive work, all
+	of which was lost. She has a unique requirement that involves storing large files on her desktop.
+	Mary's desktop profile is nearly 1 GB in size. As a result of her desktop configuration, it
+	takes her nearly 15 minutes just to log onto her workstation. But that is not enough. Because all
+	network logon traffic passes over the network links between our buildings, logging on may take
+	three or four attempts due to blue screen problems associated with network timeouts.
+	</para>
+
+	<para>
+	A few of us worked to help her out of trouble. We convinced her to stay and promised to fully 
+	resolve the difficulties she is facing. We have no choice. We must implement LDAP and set hard 
+	limits on what our users can do with their desktops. Otherwise, we face staff losses 
+	that can surely do harm to our growth as well as to staff morale. I am sure we can better deal 
+	with the consequences of what we know we must do than we can with the unrest we have now.
+	</para>
+
+	<para>
+	Stan and I have discussed the current situation. We are resolved to help our users and protect
+	the well being of Abmas. Please acknowledge this advice with consent to proceed as required to
+	regain control of our vital IT operations.
+	</para></blockquote>
+	</para>
+
+	<para>
+	<indexterm><primary>compromise</primary></indexterm>	
+	<indexterm><primary>network</primary><secondary>multi-segment</secondary></indexterm>
+	Every compromise has consequences. Having a large routed (i.e., multisegment) network with only a
+	single domain controller is a poor design that has obvious operational effects that may
+	frustrate users. Here is your reply:
+	</para>
+
+	<blockquote><attribution>Bob</attribution><para>
+	Christine, Your diligence and attention to detail are much valued. Stan and I fully support your
+	proposals to resolve the issues. I am confident that your plans fully realized will significantly
+	boost staff morale. Please go ahead with your plans. If you have any problems, please let me know.
+	Please let Stan know what the estimated cost will be so I can approve the expense. Do not wait
+	for approval; I appreciate the urgency.
+	</para></blockquote>
+
+	<sect2>
+		<title>Assignment Tasks</title>
+
+		<para>
+		The priority of assigned tasks in this chapter is:
+		</para>
+
+		<orderedlist>
+			<listitem><para>
+			<indexterm><primary>Backup Domain Controller</primary><see>BDC</see></indexterm>
+			<indexterm><primary>BDC</primary></indexterm>
+			<indexterm><primary>tdbsam</primary></indexterm>
+			<indexterm><primary>LDAP</primary></indexterm><indexterm><primary>migration</primary></indexterm>
+			Implement Backup Domain Controllers (BDCs) in each building. This involves
+			a change from a <emphasis>tdbsam</emphasis> backend that was used in the previous
+			chapter to an LDAP-based backend.
+			</para>
+
+			<para>
+			You can implement a single central LDAP server for this purpose.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>logon time</primary></indexterm>
+			<indexterm><primary>network share</primary></indexterm>
+			<indexterm><primary>default profile</primary></indexterm>
+			<indexterm><primary>profile</primary><secondary>default</secondary></indexterm>
+			Rectify the problem of excessive logon times. This involves redirection of
+			folders to network shares as well as modification of all user desktops to
+			exclude the redirected folders from being loaded at login time. You can also
+			create a new default profile that can be used for all new users.
+			</para></listitem>
+		</orderedlist>
+
+		<para>
+		<indexterm><primary>disk image</primary></indexterm>
+		You configure a new MS Windows XP Professional workstation disk image that you roll out
+		to all desktop users. The instructions you have created are followed on a staging machine
+		from which all changes can be carefully tested before inflicting them on your network users.
+		</para>
+
+		<para>
+		<indexterm><primary>CUPS</primary></indexterm>
+		This is the last network example in which specific mention of printing is made. The example
+		again makes use of the CUPS printing system.
+		</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Dissection and Discussion</title>
+
+	<para>
+	<indexterm><primary>BDC</primary></indexterm>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>OpenLDAP</primary></indexterm>
+	The implementation of Samba BDCs necessitates the installation and configuration of LDAP.
+	For this site, you use OpenLDAP, the open source software LDAP server platform. Commercial
+	LDAP servers in current use with Samba-3 include:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		<indexterm><primary>eDirectory</primary></indexterm>
+		Novell <ulink url="http://www.novell.com/products/edirectory/">eDirectory</ulink>
+		is being successfully used by some sites. Information on how to use eDirectory can be
+		obtained from the Samba mailing lists or from Novell.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>Tivoli Directory Server</primary></indexterm>
+		IBM <ulink url="http://www-306.ibm.com/software/tivoli/products/directory-server/">Tivoli 
+		Directory Server</ulink> can be used to provide the Samba LDAP backend. Example schema 
+		files are provided in the Samba source code tarball under the directory 
+		<filename>~samba/example/LDAP.</filename>
+		</para></listitem> 
+
+		<listitem><para>
+		<indexterm><primary>Sun ONE Identity Server</primary></indexterm>
+		Sun <ulink url="http://www.sun.com/software/sunone/identity/index.html">ONE Identity 
+		Server product suite</ulink> provides an LDAP server that can be used for Samba.
+		Example schema files are provided in the Samba source code tarball under the directory
+		<filename>~samba/example/LDAP.</filename>
+		</para></listitem>
+	</itemizedlist>
+
+	<para>
+	A word of caution is fully in order. OpenLDAP is purely an LDAP server, and unlike commercial
+	offerings, it requires that you manually edit the server configuration files and manually
+	initialize the LDAP directory database. OpenLDAP itself has only command-line tools to
+	help you to get OpenLDAP and Samba-3 running as required, albeit with some learning curve challenges.
+	</para>
+
+	<para>
+	<indexterm><primary>Active Directory</primary></indexterm>
+	For most sites, the deployment of Microsoft Active Directory from the shrink-wrapped installation is quite
+	adequate. If you are migrating from Microsoft Active Directory, be warned that OpenLDAP does not include
+	GUI-based directory management tools. Even a simple task such as adding users to the OpenLDAP database 
+	requires an understanding of what you are doing, why you are doing it, and the tools that you must use.
+	</para>
+
+	<para>
+	<indexterm><primary>Identity Management</primary></indexterm>
+	<indexterm><primary>high availability</primary></indexterm>
+	<indexterm><primary>directory</primary><secondary>replication</secondary></indexterm>
+	<indexterm><primary>directory</primary><secondary>synchronization</secondary></indexterm>
+	<indexterm><primary>performance</primary></indexterm>
+	<indexterm><primary>directory</primary><secondary>management</secondary></indexterm>
+	<indexterm><primary>directory</primary><secondary>schema</secondary></indexterm>
+	When installed and configured, an OpenLDAP Identity Management backend for Samba functions well. 
+	High availability operation may be obtained through directory replication/synchronization and 
+	master/slave server configurations. OpenLDAP is a mature platform to host the organizational 
+	directory infrastructure that can include all UNIX accounts, directories for electronic mail, and much more. 
+	The price paid through learning how to design an LDAP directory schema in implementation and configuration 
+	of management tools is well rewarded by performance and flexibility and the freedom to manage directory
+	contents with greater ability to back up, restore, and modify the directory than is generally possible
+	with Microsoft Active Directory.
+	</para>
+
+	<para>
+	<indexterm><primary>comparison</primary><secondary>Active Directory &amp; OpenLDAP</secondary></indexterm>
+	<indexterm><primary>ADAM</primary></indexterm>
+	<indexterm><primary>Active Directory</primary></indexterm>
+	<indexterm><primary>OpenLDAP</primary></indexterm>
+	A comparison of OpenLDAP with Microsoft Active Directory does not do justice to either. OpenLDAP is an LDAP directory
+	tool-set. Microsoft Active Directory Server is an implementation of an LDAP server that is largely preconfigured
+	for a specific task orientation. It comes with a set of administrative tools that is entirely customized
+	for the purpose of running MS Windows applications that include file and print services, Microsoft Exchange
+	server, Microsoft SQL server, and more. The complexity of OpenLDAP is highly valued by the UNIX administrator
+	who wants to build a custom directory solution. Microsoft provides an application called 
+	<ulink url="http://www.microsoft.com/windowsserver2003/adam/default.mspx">
+	MS ADAM</ulink> that provides more generic LDAP services, yet it does not have the vanilla-like services
+	of OpenLDAP.
+	</para>
+
+	<para>
+	<indexterm><primary>directory</primary><secondary>schema</secondary></indexterm>
+	<indexterm><primary>passdb backend</primary></indexterm>
+	You may wish to consider outsourcing the development of your OpenLDAP directory to an expert, particularly
+	if you find the challenge of learning about LDAP directories, schemas, configuration, and management
+	tools and the creation of shell and Perl scripts a bit
+	challenging. OpenLDAP can be easily customized, though it includes
+	many ready-to-use schemas. Samba-3 provides an OpenLDAP schema file
+	that is required for use as a passdb backend.
+	</para>
+
+	<para>
+	<indexterm><primary>interoperability</primary></indexterm>
+	For those who are willing to brave the process of installing and configuring LDAP and Samba-3 interoperability,
+	there are a few nice Web-based tools that may help you to manage your users and groups more effectively.
+	The Web-based tools you might like to consider include the
+	<ulink url="http://lam.sourceforge.net/">LDAP Account Manager</ulink> (LAM) and the Webmin-based
+	<ulink url="http://www.webmin.com">Webmin</ulink> Idealx
+	<ulink url="http://webmin.idealx.org/index.en.html">CGI tools</ulink>.
+	</para>
+
+	<para>
+	Some additional LDAP tools should be mentioned. Every so often a Samba user reports using one of 
+	these, so it may be useful to them: 
+	<ulink url="http://biot.com/gq">GQ</ulink>, a GTK-based LDAP browser; 
+	LDAP <ulink url="http://www.iit.edu/~gawojar/ldap/">Browser/Editor</ulink> 
+	<ulink url="http://www.jxplorer.org/">; JXplorer</ulink> (by Computer Associates);
+	and <ulink url="http://phpldapadmin.sourceforge.net/">phpLDAPadmin</ulink>.
+	</para>
+
+	<note><para>
+	The following prescriptive guidance is not an LDAP tutorial. The LDAP implementation expressly uses minimal
+	security controls. No form of secure LDAP communications is attempted. The LDAP configuration information provided
+	is considered to consist of the barest essentials only. You are strongly encouraged to learn more about
+	LDAP before attempting to deploy it in a business-critical environment.
+	</para></note>
+
+	<para>
+	Information to help you get started with OpenLDAP is available from the
+	<ulink url="http://www.openldap.org/pub/">OpenLDAP web site</ulink>. Many people have found the book
+	<ulink url="http://www.booksense.com/product/info.jsp?isbn=1565924916"><emphasis>LDAP System Administration</emphasis>,</ulink>
+	by Jerry Carter quite useful.
+	</para>
+
+	<para>
+	<indexterm><primary>BDC</primary></indexterm>
+	<indexterm><primary>network</primary><secondary>segment</secondary></indexterm>
+	<indexterm><primary>performance</primary></indexterm>
+	<indexterm><primary>network</primary><secondary>wide-area</secondary></indexterm>
+	Mary's problems are due to two factors. First, the absence of a domain controller on the local network is the
+	main cause of the errors that result in blue screen crashes. Second, Mary has a large profile that must
+	be loaded over the WAN connection. The addition of BDCs on each network segment significantly
+	improves overall network performance for most users, but it is not enough. You must gain control over
+	user desktops, and this must be done in a way that wins their support and does not cause further loss of
+	staff morale. The following procedures solve this problem.
+	</para>
+
+	<para>
+	<indexterm><primary>smart printing</primary></indexterm>
+	There is also an opportunity to implement smart printing features. You add this to the Samba configuration
+	so that future printer changes can be managed without need to change desktop configurations.
+	</para>
+
+	<para>
+	You add the ability to automatically download new printer drivers, even if they are not installed 
+	in the default desktop profile. Only one example of printing configuration is given. It is assumed that
+	you can extrapolate the principles and use them to install all printers that may be needed.
+	</para>
+
+	<sect2>
+	<title>Technical Issues</title>
+
+	<para>
+	<indexterm><primary>identity</primary><secondary>management</secondary></indexterm>
+	<indexterm><primary>directory</primary><secondary>server</secondary></indexterm>
+	<indexterm><primary>Posix</primary></indexterm>
+	The solution provided is a minimal approach to getting OpenLDAP running as an identity management directory
+	server for UNIX system accounts as well as for Samba. From the OpenLDAP perspective, UNIX system
+	accounts are stored POSIX schema extensions. Samba provides its own schema to permit storage of account 
+	attributes Samba needs. Samba-3 can use the LDAP backend to store:
+	</para>
+	
+	<itemizedlist>
+		<listitem><para>Windows Networking User Accounts</para></listitem>
+		<listitem><para>Windows NT Group Accounts</para></listitem>
+		<listitem><para>Mapping Information between UNIX Groups and Windows NT Groups</para></listitem>
+		<listitem><para>ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)</para></listitem>
+	</itemizedlist>
+
+	<para>
+	<indexterm><primary>UNIX accounts</primary></indexterm>
+	<indexterm><primary>Windows accounts</primary></indexterm>
+	<indexterm><primary>PADL LDAP tools</primary></indexterm>
+	<indexterm><primary>/etc/group</primary></indexterm>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>name service switch</primary><see>NSS</see></indexterm>
+	<indexterm><primary>NSS</primary></indexterm>
+	<indexterm><primary>UID</primary></indexterm>
+	<indexterm><primary>nss_ldap</primary></indexterm>
+	The use of LDAP with Samba-3 makes it necessary to store UNIX accounts as well as Windows Networking
+	accounts in the LDAP backend. This implies the need to use the 
+	<ulink url="http://www.padl.com/Contents/OpenSourceSoftware.html">PADL LDAP tools</ulink>. The resolution 
+	of the UNIX group name to its GID must be enabled from either the <filename>/etc/group</filename> 
+	or from the LDAP backend. This requires the use of the PADL <filename>nss_ldap</filename> tool-set
+	that integrates with the NSS. The same requirements exist for resolution
+	of the UNIX username to the UID. The relationships are demonstrated in <link linkend="sbehap-LDAPdiag"/>.
+	</para>
+
+	<image id="sbehap-LDAPdiag">
+		<imagedescription>The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</imagedescription>
+		<imagefile scale="50">UNIX-Samba-and-LDAP</imagefile>
+	</image>
+
+	<para>
+	<indexterm><primary>security</primary></indexterm>
+	<indexterm><primary>LDAP</primary><secondary>secure</secondary></indexterm>
+	You configure OpenLDAP so that it is operational. Before deploying the OpenLDAP, you really
+	ought to learn how to configure secure communications over LDAP so that site security is not
+	at risk. This is not covered in the following guidance.
+	</para>
+
+	<para>
+	<indexterm><primary>PDC</primary></indexterm>
+	<indexterm><primary>LDAP Interchange Format</primary><see>LDIF</see></indexterm>
+	<indexterm><primary>LDIF</primary></indexterm>
+	<indexterm><primary>secrets.tdb</primary></indexterm>
+	When OpenLDAP has been made operative, you configure the PDC called <constant>MASSIVE</constant>.
+	You initialize the Samba <filename>secrets.tdb<subscript></subscript></filename> file. Then you
+	create the LDAP Interchange Format (LDIF) file from which the LDAP database can be initialized.
+	You need to decide how best to create user and group accounts. A few hints are, of course, provided.
+	You can also find on the enclosed CD-ROM, in the <filename>Chap06</filename> directory, a few tools
+	that help to manage user and group configuration.
+	</para>
+
+	<para>
+	<indexterm><primary>folder redirection</primary></indexterm>
+	<indexterm><primary>default profile</primary></indexterm>
+	<indexterm><primary>roaming profile</primary></indexterm>
+	In order to effect folder redirection and to add robustness to the implementation,
+	create a network default profile. All network users workstations are configured to use
+	the new profile. Roaming profiles will automatically be deleted from the workstation
+	when the user logs off.
+	</para>
+
+	<para>
+	<indexterm><primary>mandatory profile</primary></indexterm>
+	The profile is configured so that users cannot change the appearance
+	of their desktop. This is known as a mandatory profile. You make certain that users
+	are able to use their computers efficiently.
+	</para>
+
+	<para>
+	<indexterm><primary>logon script</primary></indexterm>
+	A network logon script is used to deliver flexible but consistent network drive
+	connections.
+	</para>
+
+		<sect3 id="sbehap-ppc">
+		<title>Addition of Machines to the Domain</title>
+
+		<para>
+		<indexterm><primary></primary></indexterm>
+		<indexterm><primary></primary></indexterm>
+		<indexterm><primary></primary></indexterm>
+		<indexterm><primary></primary></indexterm>
+		Samba versions prior to 3.0.11 necessitated the use of a domain administrator account
+		that maps to the UNIX UID=0. The UNIX operating system permits only the <constant>root</constant>
+		user to add user and group accounts. Samba 3.0.11 introduced a new facility known as
+		<constant>Privileges</constant>, which provides five new privileges that
+		can be assigned to users and/or groups; see Table 5.1.
+		</para>
+
+
+		<table id="sbehap-privs">
+			<title>Current Privilege Capabilities</title>
+			<tgroup cols="2">
+				<colspec align="left"/>
+				<colspec align="left"/>
+				<thead>
+					<row>
+						<entry align="left">Privilege</entry>
+						<entry align="left">Description</entry>
+					</row>
+				</thead>
+				<tbody>
+					<row>
+						<entry><para>SeMachineAccountPrivilege</para></entry>
+						<entry><para>Add machines to domain</para></entry>
+					</row>
+					<row>
+						<entry><para>SePrintOperatorPrivilege</para></entry>
+						<entry><para>Manage printers</para></entry>
+					</row>
+					<row>
+						<entry><para>SeAddUsersPrivilege</para></entry>
+						<entry><para>Add users and groups to the domain</para></entry>
+					</row>
+					<row>
+						<entry><para>SeRemoteShutdownPrivilege</para></entry>
+						<entry><para>Force shutdown from a remote system</para></entry>
+					</row>
+					<row>
+						<entry><para>SeDiskOperatorPrivilege</para></entry>
+						<entry><para>Manage disk share</para></entry>
+					</row>
+				</tbody>
+			</tgroup>
+		</table>
+
+		<para>
+		In this network example use is made of one of the supported privileges purely to demonstrate
+		how any user can now be given the ability to add machines to the domain using a normal user account
+		that has been given the appropriate privileges.
+		</para>
+
+		</sect3>
+
+		<sect3>
+		<title>Roaming Profile Background</title>
+
+		<para>
+		As XP roaming profiles grow, so does the amount of time it takes to log in and out.
+		</para>
+
+		<para>
+		<indexterm><primary>roaming profile</primary></indexterm>
+		<indexterm><primary>HKEY_CURRENT_USER</primary></indexterm>
+		<indexterm><primary>NTUSER.DAT</primary></indexterm>
+		<indexterm><primary>%USERNAME%</primary></indexterm>
+		An XP roaming profile consists of the <constant>HKEY_CURRENT_USER</constant> hive file
+		<filename>NTUSER.DAT</filename> and a number of folders (My Documents, Application Data,
+		Desktop, Start Menu, Templates, NetHood, Favorites, and so on).  When a user logs onto the 
+		network with the default configuration of MS Windows NT/200x/XPP, all this data is 
+		copied to the local machine under the <filename>C:\Documents and Settings\%USERNAME%</filename>
+		directory. While the user is logged in, any changes made to any of these folders or to the
+		<constant>HKEY_CURRENT_USER</constant> branch of the registry are made to the local copy
+		of the profile.  At logout the profile data is copied back to the server. This behavior
+		can be changed through appropriate registry changes and/or through changes to the default
+		user profile. In the latter case, it updates the registry with the values that are set in the
+		profile <filename>NTUSER.DAT</filename>
+		file.
+		</para>
+
+		<para>
+		The first challenge is to reduce the amount of data that must be transferred to and 
+		from the profile server as roaming profiles are processed.  This includes removing 
+		all the shortcuts in the Recent directory, making sure the cache used by the Web browser 
+		is not being dumped into the <filename>Application Data</filename> folder, removing the 
+		Java plug-ins cache (the .jpi_cache directory in the profile), as well as training the 
+		user to not place large files on the desktop and to use his or her mapped home directory
+		instead of the <filename>My Documents</filename> folder for saving documents.
+		</para>
+
+		<para>
+		<indexterm><primary>My Documents</primary></indexterm>
+		Using a folder other than <filename>My Documents</filename> is a nuisance for 
+		some users, since many applications use it by default.
+		</para>
+
+		<para>
+		<indexterm><primary>roaming profiles</primary></indexterm>
+		<indexterm><primary>Local Group Policy</primary></indexterm>
+		<indexterm><primary>NTUSER.DAT</primary></indexterm>
+		The secret to rapid loading of roaming profiles is to prevent unnecessary data from 
+		being copied back and forth, without losing any functionality. This is not difficult; 
+		it can be done by making changes to the Local Group Policy on each client as well 
+		as changing some paths in each user's <filename>NTUSER.DAT</filename> hive.
+		</para>
+
+		<para>
+		<indexterm><primary>Network Default Profile</primary></indexterm>
+		<indexterm><primary>redirected folders</primary></indexterm>
+		Every user profile has its own <filename>NTUSER.DAT</filename> file. This means
+		you need to edit every user's profile, unless a better method can be
+		followed. Fortunately, with the right preparations, this is not difficult.
+		It is possible to remove the <filename>NTUSER.DAT</filename> file from each
+		user's profile. Then just create a Network Default Profile. Of course, it is
+		necessary to copy all files from redirected folders to the network share to which
+		they are redirected.
+		</para>
+
+		</sect3>
+
+		<sect3 id="sbehap-locgrppol">
+		<title>The Local Group Policy</title>
+
+		<para>
+		<indexterm><primary>Group Policy Objects</primary></indexterm>
+		<indexterm><primary>Active Directory</primary></indexterm>
+		<indexterm><primary>PDC</primary></indexterm>
+		<indexterm><primary>Group Policy editor</primary></indexterm>
+		Without an Active Directory PDC, you cannot take full advantage of Group Policy 
+		Objects. However, you can still make changes to the Local Group Policy by using 
+		the Group Policy editor (<command>gpedit.msc</command>).
+		</para>
+
+		<para>
+		The <emphasis>Exclude directories in roaming profile</emphasis> settings can 
+		be found under 
+		<menuchoice>
+			<guimenu>User Configuration</guimenu>
+			<guimenuitem>Administrative Templates</guimenuitem>
+			<guimenuitem>System</guimenuitem>
+			<guimenuitem>User Profiles</guimenuitem>
+		</menuchoice>. 
+		By default this setting contains
+		<quote>Local Settings; Temporary Internet Files; History; Temp</quote>.
+		</para>
+
+		<para>
+		Simply add the folders you do not wish to be copied back and forth to this 
+		semicolon-separated list. Note that this change must be made on all clients 
+		that are using roaming profiles.
+		</para>
+
+		</sect3>
+
+		<sect3>
+		<title>Profile Changes</title>
+
+		<para>
+		<indexterm><primary>NTUSER.DAT</primary></indexterm>
+		<indexterm><primary>%USERNAME%</primary></indexterm>
+		There are two changes that should be done to each user's profile. Move each of 
+		the directories that you have excluded from being copied back and forth out of 
+		the usual profile path. Modify each user's <filename>NTUSER.DAT</filename> file 
+		to point to the new paths that are shared over the network instead of to the default
+		path (<filename>C:\Documents and Settings\%USERNAME%</filename>).
+		</para>
+
+		<para>
+		<indexterm><primary>Default User</primary></indexterm>
+		<indexterm><primary>regedt32</primary></indexterm>
+		The above modifies existing user profiles. So that newly created profiles have 
+		these settings, you need to modify the <filename>NTUSER.DAT</filename> in 
+		the <filename>C:\Documents and Settings\Default User</filename> folder on each 
+		client machine, changing the same registry keys.  You could do this by copying 
+		<filename>NTUSER.DAT</filename> to a Linux box and using <command>regedt32</command>.
+		The basic method is described under <link linkend="redirfold"/>.
+		</para>
+
+		</sect3>
+
+		<sect3>
+		<title>Using a Network Default User Profile</title>
+
+		<para>
+		<indexterm><primary>NETLOGON</primary></indexterm>
+		<indexterm><primary>NTUSER.DAT</primary></indexterm>
+		If you are using Samba as your PDC, you should create a file share called 
+		<constant>NETLOGON</constant> and within that create a directory called 
+		<filename>Default User</filename>, which is a copy of the desired default user 
+		configuration (including a copy of <filename>NTUSER.DAT</filename>).
+		If this share exists and the <filename>Default User</filename> folder exists, 
+		the first login from a new account pulls its configuration from it.
+		See also <ulink url="http://isg.ee.ethz.ch/tools/realmen/det/skel.en.html">
+		the Real Men Don't Click</ulink> Web site.
+		</para>
+
+		</sect3>
+
+		<sect3>
+		<title>Installation of Printer Driver Auto-Download</title>
+
+		<para>
+		<indexterm><primary>printing</primary><secondary>dumb</secondary></indexterm>
+		<indexterm><primary>dumb printing</primary></indexterm>
+		<indexterm><primary>Raw Print Through</primary></indexterm>
+		The subject of printing is quite topical. Printing problems run second place to name
+		resolution issues today. So far in this book, you have experienced only what is generally
+		known as <quote>dumb</quote> printing. Dumb printing is the arrangement by which all drivers
+		are manually installed on each client and the printing subsystems perform no filtering
+		or intelligent processing. Dumb printing is easily understood. It usually works without
+		many problems, but it has its limitations also. Dumb printing is better known as
+		<command>Raw-Print-Through</command> printing.
+		</para>
+
+		<para>
+		<indexterm><primary>printing</primary><secondary>drag-and-drop</secondary></indexterm>
+		<indexterm><primary>printing</primary><secondary>point-n-click</secondary></indexterm>
+		Samba permits the configuration of <command>smart</command> printing using the Microsoft
+		Windows point-and-click (also called drag-and-drop) printing. What this provides is
+		essentially the ability to print to any printer. If the local client does not yet have a
+		driver installed, the driver is automatically downloaded from the Samba server and
+		installed on the client. Drag-and-drop printing is neat; it means the user never needs
+		to fuss with driver installation, and that is a <trademark>Good Thing,</trademark>
+		isn't it?
+		</para>
+
+		<para>
+		There is a further layer of print job processing that is known as <command>intelligent</command>
+		printing that automatically senses the file format of data submitted for printing and
+		then invokes a suitable print filter to convert the incoming data stream into a format
+		suited to the printer to which the job is dispatched.
+		</para>
+
+		<para>
+		<indexterm><primary>CUPS</primary></indexterm>
+		<indexterm><primary>Easy Software Products</primary></indexterm>
+		<indexterm><primary>Postscript</primary></indexterm>
+		The CUPS printing subsystem is capable of intelligent printing. It has the capacity to
+		detect the data format and apply a print filter. This means that it is feasible to install
+		on all Windows clients a single printer driver for use with all printers that are routed
+		through CUPS. The most sensible driver to use is one for a PostScript printer. Fortunately,
+		<ulink url="http://www.easysw.com">Easy Software Products</ulink>, the authors of CUPS, have
+		released a PostScript printing driver for Windows. It can be installed into the Samba
+		printing backend so that it automatically downloads to the client when needed. 
+		</para>
+
+		<para>
+		This means that so long as there is a CUPS driver for the printer, all printing from Windows 
+		software can use PostScript, no matter what the actual printer language for the physical 
+		device is. It also means that the administrator can swap out a printer with a totally 
+		different type of device without ever needing to change a client workstation driver.
+		</para>
+
+		<para>
+		This book is about Samba-3, so you can confine the printing style to just the smart
+		style of installation. Those interested in further information regarding intelligent
+		printing should review documentation on the Easy Software Products Web site.
+		</para>
+
+		</sect3>
+
+		<sect3 id="sbeavoid">
+		<title>Avoiding Failures: Solving Problems Before They Happen</title>
+
+		<para>
+		It has often been said that there are three types of people in the world: those who
+		have sharp minds and those who forget things. Please do not ask what the third group
+		is like! Well, it seems that many of us have company in the second group. There must
+		be a good explanation why so many network administrators fail to solve apparently
+		simple problems efficiently and effectively.
+		</para>
+
+		<para>
+		Here are some diagnostic guidelines that can be referred to when things go wrong:
+		</para>
+
+		<sect4>
+		<title>Preliminary Advice: Dangers Can Be Avoided</title>
+
+		<para>
+		The best advice regarding how to mend a broken leg is <quote>Never break a leg!</quote>
+		</para>
+
+		<para>
+		<indexterm><primary>LDAP</primary></indexterm>
+		Newcomers to Samba and LDAP seem to struggle a great deal at first.  If you want advice
+		regarding the best way to remedy LDAP and Samba problems: <quote>Avoid them like the plague!</quote>
+		</para>
+
+		<para>
+		If you are now asking yourself how problems can be avoided, the best advice is to start
+		out your learning experience with a <emphasis>known-good configuration.</emphasis> After
+		you have seen a fully working solution, a good way to learn is to make slow and progressive
+		changes that cause things to break, then observe carefully how and why things ceased to work.
+		</para>
+
+		<para>
+		The examples in this chapter (also in the book as a whole) are known to work. That means
+		that they could serve as the kick-off point for your journey through fields of knowledge.
+		Use this resource carefully; we hope it serves you well.
+		</para>
+
+		<warning><para>
+		Do not be lulled into thinking that you can easily adopt the examples in this
+		book and adapt them without first working through the examples provided. A little
+		thing overlooked can cause untold pain and may permanently tarnish your experience.
+		</para></warning>
+
+		</sect4>
+
+		<sect4>
+		<title>The Name Service Caching Daemon</title>
+
+		<para>
+		The name service caching daemon (nscd) is a primary cause of difficulties with name
+		resolution, particularly where <command>winbind</command> is used. Winbind does its
+		own caching, thus nscd causes double caching which can lead to peculiar problems during
+		debugging. As a rule, it is a good idea to turn off the name service caching daemon.
+		</para>
+
+		<para>
+		Operation of the name service caching daemon is controlled by the 
+		<filename>/etc/nscd.conf</filename> file. Typical contents of this file are as follows:
+<screen>
+# /etc/nscd.conf
+# An example Name Service Cache config file.  This file is needed by nscd.
+# Legal entries are:
+#       logfile                 &lt;file&gt;
+#       debug-level             &lt;level&gt;
+#       threads                 &lt;threads to use&gt;
+#       server-user             &lt;user to run server as instead of root&gt;
+#               server-user is ignored if nscd is started with -S parameters
+#       stat-user               &lt;user who is allowed to request statistics&gt;
+#       reload-count            unlimited|&lt;number&gt;
+#
+#       enable-cache            &lt;service&gt; &lt;yes|no&gt;
+#       positive-time-to-live   &lt;service&gt; &lt;time in seconds&gt;
+#       negative-time-to-live   &lt;service&gt; &lt;time in seconds&gt;
+#       suggested-size          &lt;service&gt; &lt;prime number&gt;
+#       check-files             &lt;service&gt; &lt;yes|no&gt;
+#       persistent              &lt;service&gt; &lt;yes|no&gt;
+#       shared                  &lt;service&gt; &lt;yes|no&gt;
+# Currently supported cache names (services): passwd, group, hosts
+#       logfile                 /var/log/nscd.log
+#       threads                 6
+#       server-user             nobody
+#       stat-user               somebody
+        debug-level             0
+#       reload-count            5
+        enable-cache            passwd          yes
+        positive-time-to-live   passwd          600
+        negative-time-to-live   passwd          20
+        suggested-size          passwd          211
+        check-files             passwd          yes
+        persistent              passwd          yes
+        shared                  passwd          yes
+        enable-cache            group           yes
+        positive-time-to-live   group           3600
+        negative-time-to-live   group           60
+        suggested-size          group           211
+        check-files             group           yes
+        persistent              group           yes
+        shared                  group           yes
+# !!!!!WARNING!!!!! Host cache is insecure!!! The mechanism in nscd to
+# cache hosts will cause your local system to not be able to trust
+# forward/reverse lookup checks. DO NOT USE THIS if your system relies on
+# this sort of security mechanism. Use a caching DNS server instead.
+        enable-cache            hosts           no
+        positive-time-to-live   hosts           3600
+        negative-time-to-live   hosts           20
+        suggested-size          hosts           211
+        check-files             hosts           yes
+        persistent              hosts           yes
+        shared                  hosts           yes
+</screen>
+	It is feasible to comment out the <constant>passwd</constant> and <constant>group</constant>
+	entries so they will not be cached. Alternatively, it is often simpler to just disable the
+	<command>nscd</command> service by executing (on Novell SUSE Linux):
+<screen>
+&rootprompt; chkconfig nscd off
+&rootprompt; rcnscd off
+</screen>
+		</para>
+
+		</sect4>
+
+		<sect4>
+		<title>Debugging LDAP</title>
+
+		<para>
+		<indexterm><primary>/etc/openldap/slapd.conf</primary></indexterm>
+		<indexterm><primary>loglevel</primary></indexterm>
+		<indexterm><primary>slapd</primary></indexterm>
+		In the example <filename>/etc/openldap/slapd.conf</filename> control file
+		(see <link linkend="sbehap-dbconf"/>) there is an entry for <constant>loglevel	256</constant>.
+		To enable logging via the syslog infrastructure, it is necessary to uncomment this parameter
+		and restart <command>slapd</command>.
+		</para>
+
+		<para>
+		<indexterm><primary>/etc/syslog.conf</primary></indexterm>
+		<indexterm><primary>/var/log/ldaplogs</primary></indexterm>
+		LDAP log information can be directed into a file that is separate from the normal system
+		log files by changing the <filename>/etc/syslog.conf</filename> file so it has the following
+		contents:
+<screen>
+# Some foreign boot scripts require local7
+#
+local0,local1.*                 -/var/log/localmessages
+local2,local3.*                 -/var/log/localmessages
+local5.*                        -/var/log/localmessages
+local6,local7.*                 -/var/log/localmessages
+local4.*                        -/var/log/ldaplogs
+</screen>
+		In this case, all LDAP-related logs will be directed to the file
+		<filename>/var/log/ldaplogs</filename>. This makes it easy to track LDAP errors.
+		The snippet provides a simple example of usage that can be modified to suit
+		local site needs. The configuration used later in this chapter reflects such
+		customization with the intent that LDAP log files will be stored at a location
+		that meets local site needs and wishes more fully.
+		</para>
+
+		</sect4>
+
+		<sect4>
+		<title>Debugging NSS_LDAP</title>
+
+		<para>
+		The basic mechanism for diagnosing problems with the nss_ldap utility involves adding to the
+		<filename>/etc/ldap.conf</filename> file the following parameters:
+<screen>
+debug 256
+logdir /data/logs
+</screen>
+		Create the log directory as follows:
+<screen>
+&rootprompt; mkdir /data/logs
+</screen>
+		</para>
+
+		<para>
+		The diagnostic process should follow these steps:
+		</para>
+
+		<procedure>
+		<title>NSS_LDAP Diagnostic Steps</title>
+
+			<step><para>
+			Verify the <constant>nss_base_passwd, nss_base_shadow, nss_base_group</constant> entries
+			in the <filename>/etc/ldap.conf</filename> file and compare them closely with the directory
+			tree location that was chosen when the directory was first created.
+			</para>
+
+			<para>
+			One way this can be done is by executing:
+<screen>
+&rootprompt; slapcat | grep Group | grep dn
+dn: ou=Groups,dc=abmas,dc=biz
+dn: cn=Domain Admins,ou=Groups,dc=abmas,dc=biz
+dn: cn=Domain Users,ou=Groups,dc=abmas,dc=biz
+dn: cn=Domain Guests,ou=Groups,dc=abmas,dc=biz
+dn: cn=Domain Computers,ou=Groups,dc=abmas,dc=biz
+dn: cn=Administrators,ou=Groups,dc=abmas,dc=biz
+dn: cn=Print Operators,ou=Groups,dc=abmas,dc=biz
+dn: cn=Backup Operators,ou=Groups,dc=abmas,dc=biz
+dn: cn=Replicators,ou=Groups,dc=abmas,dc=biz
+</screen>
+			The first line is the DIT entry point for the container for POSIX groups. The correct entry
+			for the <filename>/etc/ldap.conf</filename> for the <constant>nss_base_group</constant>
+			parameter therefore is the distinguished name (dn) as applied here:
+<screen>
+nss_base_group ou=Groups,dc=abmas,dc=biz?one
+</screen>
+			The same process may be followed to determine the appropriate dn for user accounts.
+			If the container for computer accounts is not the same as that for users (see the &smb.conf;
+			file entry for <constant>ldap machine suffix</constant>), it may be necessary to set the 
+			following DIT dn in the <filename>/etc/ldap.conf</filename> file:
+<screen>
+nss_base_passwd dc=abmas,dc=biz?sub
+</screen>
+			This instructs LDAP to search for machine as well as user entries from the top of the DIT
+			down. This is inefficient, but at least should work. Note: It is possible to specify multiple
+			<constant>nss_base_passwd</constant> entries in the <filename>/etc/ldap.conf</filename> file; they
+			will be evaluated sequentially. Let us consider an example of use where the following DIT
+			has been implemented:
+			</para>
+
+			<para>
+			<itemizedlist>
+			<listitem><para>All user accounts are stored under the DIT: ou=Users,dc=abmas,dc=biz</para></listitem>
+			<listitem><para>All user login accounts are under the DIT: ou=People,ou-Users,dc=abmas,dc=biz</para></listitem>
+			<listitem><para>All computer accounts are under the DIT: ou=Computers,ou=Users,dc=abmas,dc=biz</para></listitem>
+			</itemizedlist>
+			</para>
+
+			<para>
+			The appropriate multiple entry for the <constant>nss_base_passwd</constant> directive
+			in the <filename>/etc/ldap.conf</filename> file may be:
+<screen>
+nss_base_passwd ou=People,ou=Users,dc=abmas,dc=org?one
+nss_base_passwd ou=Computers,ou=Users,dc=abmas,dc=org?one
+</screen>
+			</para></step>
+
+			<step><para>
+			Perform lookups such as:
+<screen>
+&rootprompt; getent passwd
+</screen>
+			Each such lookup will create an entry in the <filename>/data/log</filename> directory
+			for each such process executed. The contents of each file created in this directory
+			may provide a hint as to the cause of the a problem that is under investigation. 
+			</para></step>
+
+			<step><para>
+			For additional diagnostic information, check the contents of the <filename>/var/log/messages</filename>
+			to see what error messages are being generated as a result of the LDAP lookups. Here is an example of
+			a successful lookup:
+<screen>
+slapd[12164]: conn=0 fd=10 ACCEPT from IP=127.0.0.1:33539
+(IP=0.0.0.0:389)
+slapd[12164]: conn=0 op=0 BIND dn="" method=128
+slapd[12164]: conn=0 op=0 RESULT tag=97 err=0 text=
+slapd[12164]: conn=0 op=1 SRCH base="" scope=0 deref=0
+filter="(objectClass=*)"
+slapd[12164]: conn=0 op=1 SEARCH RESULT tag=101 err=0
+nentries=1 text=
+slapd[12164]: conn=0 op=2 UNBIND
+slapd[12164]: conn=0 fd=10 closed
+slapd[12164]: conn=1 fd=10 ACCEPT from
+IP=127.0.0.1:33540 (IP=0.0.0.0:389)
+slapd[12164]: conn=1 op=0 BIND
+dn="cn=Manager,dc=abmas,dc=biz" method=128
+slapd[12164]: conn=1 op=0 BIND
+dn="cn=Manager,dc=abmas,dc=biz" mech=SIMPLE ssf=0
+slapd[12164]: conn=1 op=0 RESULT tag=97 err=0 text=
+slapd[12164]: conn=1 op=1 SRCH
+base="ou=People,dc=abmas,dc=biz" scope=1 deref=0
+filter="(objectClass=posixAccount)"
+slapd[12164]: conn=1 op=1 SRCH attr=uid userPassword
+uidNumber gidNumber cn
+homeDirectory loginShell gecos description objectClass
+slapd[12164]: conn=1 op=1 SEARCH RESULT tag=101 err=0
+nentries=2 text=
+slapd[12164]: conn=1 fd=10 closed
+
+</screen>
+			</para></step>
+
+			<step><para>
+			Check that the bindpw entry in the <filename>/etc/ldap.conf</filename> or in the
+			<filename>/etc/ldap.secrets</filename> file is correct, as specified in the
+			<filename>/etc/openldap/slapd.conf</filename> file.
+			</para></step>
+
+		</procedure>
+
+		</sect4>
+
+		<sect4>
+		<title>Debugging Samba</title>
+
+		<para>
+		The following parameters in the &smb.conf; file can be useful in tracking down Samba-related problems:
+<screen>
+[global]
+	...
+	log level = 5
+	log file = /var/log/samba/%m.log
+	max log size = 0
+	...
+</screen>
+		This will result in the creation of a separate log file for every client from which connections
+		are made. The log file will be quite verbose and will grow continually. Do not forget to
+		change these lines to the following when debugging has been completed:
+<screen>
+[global]
+	...
+	log level = 1
+	log file = /var/log/samba/%m.log
+	max log size = 50
+	...
+</screen>
+		</para>
+
+		<para>
+		The log file can be analyzed by executing:
+<screen>
+&rootprompt; cd /var/log/samba
+&rootprompt; grep -v "^\[200" machine_name.log
+</screen>
+		</para>
+
+		<para>
+		Search for hints of what may have failed by looking for the words <emphasis>fail</emphasis>
+		and <emphasis>error</emphasis>.
+		</para>
+
+		</sect4>
+
+		<sect4>
+		<title>Debugging on the Windows Client</title>
+
+		<para>
+		MS Windows 2000 Professional and Windows  XP Professional clients can be configured
+		to create a netlogon.log file that can be very helpful in diagnosing network logon problems. Search
+		the Microsoft knowledge base for detailed instructions. The techniques vary a little with each
+		version of MS Windows.
+		</para>
+
+		</sect4>
+
+		</sect3>
+
+	</sect2>
+
+
+	<sect2>
+		<title>Political Issues</title>
+
+		<para>
+		MS Windows network users are generally very sensitive to limits that may be imposed when 
+		confronted with locked-down workstation configurations. The challenge you face must 
+		be promoted as a choice between reliable, fast network operation and a constant flux 	
+		of problems that result in user irritation.
+		</para>
+
+	</sect2>
+
+	<sect2>
+		<title>Installation Checklist</title>
+
+	<para>
+	You are starting a complex project. Even though you went through the installation of a complex
+	network in <link linkend="Big500users"/>, this network is a bigger challenge because of the
+	large number of complex applications that must be configured before the first few steps
+	can be validated. Take stock of what you are about to undertake, prepare yourself, and
+	frequently review the steps ahead while making at least a mental note of what has already
+	been completed. The following task list may help you to keep track of the task items
+	that are covered:
+	</para>
+
+
+	<itemizedlist>
+		<listitem><para>Samba-3 PDC Server Configuration</para>
+			<orderedlist>
+				<listitem><para>DHCP and DNS servers</para></listitem>
+				<listitem><para>OpenLDAP server</para></listitem>
+				<listitem><para>PAM and NSS client tools</para></listitem>
+				<listitem><para>Samba-3 PDC</para></listitem>
+				<listitem><para>Idealx smbldap scripts</para></listitem>
+				<listitem><para>LDAP initialization</para></listitem>
+				<listitem><para>Create user and group accounts</para></listitem>
+				<listitem><para>Printers</para></listitem>
+				<listitem><para>Share point directory roots</para></listitem>
+				<listitem><para>Profile directories</para></listitem>
+				<listitem><para>Logon scripts</para></listitem>
+				<listitem><para>Configuration of user rights and privileges</para></listitem>
+			</orderedlist>
+		</listitem>
+		<listitem><para>Samba-3 BDC Server Configuration</para>
+			<orderedlist>
+				<listitem><para>DHCP and DNS servers</para></listitem>
+				<listitem><para>PAM and NSS client tools</para></listitem>
+				<listitem><para>Printers</para></listitem>
+				<listitem><para>Share point directory roots</para></listitem>
+				<listitem><para>Profiles directories</para></listitem>
+			</orderedlist>
+		</listitem>
+		<listitem><para>Windows XP Client Configuration</para>
+			<orderedlist>
+				<listitem><para>Default profile folder redirection</para></listitem>
+				<listitem><para>MS Outlook PST file relocation</para></listitem>
+				<listitem><para>Delete roaming profile on logout</para></listitem>
+				<listitem><para>Upload printer drivers to Samba servers</para></listitem>
+				<listitem><para>Install software</para></listitem>
+				<listitem><para>Creation of roll-out images</para></listitem>
+			</orderedlist>
+		</listitem>
+	</itemizedlist>
+
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Samba Server Implementation</title>
+
+	<para>
+	<indexterm><primary>file servers</primary></indexterm>
+	<indexterm><primary>BDC</primary></indexterm>
+	The network design shown in <link linkend="chap6net"/> is not comprehensive. It is assumed
+	that you will install additional file servers and possibly additional BDCs.
+	</para>
+
+	<image id="chap6net">
+		<imagedescription>Network Topology &smbmdash; 500 User Network Using ldapsam passdb backend</imagedescription>
+		<imagefile scale="50">chap6-net</imagefile>
+	</image>
+
+	<para>
+	<indexterm><primary>SUSE Linux</primary></indexterm>
+	<indexterm><primary>Red Hat Linux</primary></indexterm>
+	All configuration files and locations are shown for SUSE Linux 9.2 and are equally valid for SUSE
+	Linux Enterprise Server 9. The file locations for Red Hat Linux are similar. You may need to
+	adjust the locations for your particular Linux system distribution/implementation.
+	</para>
+
+<note><para>
+The following information applies to Samba-3.0.20 when used with the Idealx smbldap-tools
+scripts version 0.9.0. If using a different version of Samba or of the smbldap-tools tarball,
+please verify that the versions you are about to use are matching. The smbldap-tools package
+uses counter-entries in the LDAP directory to avoid duplication of the UIDs and GIDs that are
+issued for POSIX accounts. The LDAP rdn under which this information is stored are called
+<constant>uidNumber</constant> and <constant>gidNumber</constant> respectively. These may be
+located in any convenient part of the directory information tree (DIT). In the examples that
+follow they have been located under <constant>dn=sambaDomainName=MEGANET2,dc=abmas,dc=org</constant>.
+They could just as well be located under the rdn <constant>cn=NextFreeUnixId</constant>.
+</para></note>
+
+	<para>
+	The steps in the process involve changes from the network configuration shown in
+	<link linkend="Big500users"/>.  Before implementing the following steps, you must
+	have completed the network implementation shown in that chapter. If you are starting
+	with newly installed Linux servers, you must complete the steps shown in
+	<link linkend="ch5-dnshcp-setup"/> before commencing at <link linkend="ldapsetup"/>.
+	</para>
+
+	<sect2 id="ldapsetup">
+	<title>OpenLDAP Server Configuration</title>
+
+	<para>
+	<indexterm><primary>nss_ldap</primary></indexterm>
+	<indexterm><primary>pam_ldap</primary></indexterm>
+	<indexterm><primary>openldap</primary></indexterm>
+	Confirm that the packages shown in <link linkend="oldapreq"/> are installed on your system.
+	</para>
+
+	<table id="oldapreq">
+		<title>Required OpenLDAP Linux Packages</title>
+		<tgroup cols="3">
+			<colspec align="left"/>
+			<colspec align="left"/>
+			<colspec align="left"/>
+			<thead>
+				<row>
+					<entry align="center">SUSE Linux 8.x</entry>
+					<entry align="center">SUSE Linux 9.x</entry>
+					<entry align="center">Red Hat Linux</entry>
+				</row>
+			</thead>
+			<tbody>
+				<row>
+					<entry>nss_ldap</entry>
+					<entry>nss_ldap</entry>
+					<entry>nss_ldap</entry>
+				</row>
+				<row>
+					<entry>pam_ldap</entry>
+					<entry>pam_ldap</entry>
+					<entry>pam_ldap</entry>
+				</row>
+				<row>
+					<entry>openldap2</entry>
+					<entry>openldap2</entry>
+					<entry>openldap</entry>
+				</row>
+				<row>
+					<entry>openldap2-client</entry>
+					<entry>openldap2-client</entry>
+					<entry></entry>
+				</row>
+			</tbody>
+		</tgroup>
+	</table>
+
+	<para>
+	Samba-3 and OpenLDAP will have a degree of interdependence that is unavoidable. The method
+	for bootstrapping the LDAP and Samba-3 configuration is relatively straightforward. If you
+	follow these guidelines, the resulting system should work fine.
+	</para>
+
+	<procedure>
+	<title>OpenLDAP Server Configuration Steps</title>
+
+		<step><para>
+		<indexterm><primary>/etc/openldap/slapd.conf</primary></indexterm>
+		Install the file shown in <link linkend="sbehap-slapdconf"/> in the directory
+		<filename>/etc/openldap</filename>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/data/ldap</primary></indexterm>
+		<indexterm><primary>group account</primary></indexterm>
+		<indexterm><primary>user account</primary></indexterm>
+		Remove all files from the directory <filename>/data/ldap</filename>, making certain that
+		the directory exists with permissions:
+<screen>
+&rootprompt; ls -al /data | grep ldap
+drwx------   2 ldap    ldap       48 Dec 15 22:11 ldap
+</screen>
+		This may require you to add a user and a group account for LDAP if they do not exist.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>DB_CONFIG</primary></indexterm>
+		Install the file shown in <link linkend="sbehap-dbconf"/> in the directory
+		<filename>/data/ldap</filename>. In the event that this file is added after <constant>ldap</constant>
+		has been started, it is possible to cause the new settings to take effect by shutting down
+		the <constant>LDAP</constant> server, executing the <command>db_recover</command> command inside the
+		<filename>/data/ldap</filename> directory, and then restarting the <constant>LDAP</constant> server.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>syslog</primary></indexterm>
+		Performance logging can be enabled and should preferably be sent to a file on
+		a file system that is large enough to handle significantly sized logs. To enable
+		the logging at a verbose level to permit detailed analysis, uncomment the entry in
+		the <filename>/etc/openldap/slapd.conf</filename> shown as <quote>loglevel 256</quote>.
+		</para>
+
+		<para>
+		Edit the <filename>/etc/syslog.conf</filename> file to add the following at the end
+		of the file:
+<screen>
+local4.*        -/data/ldap/log/openldap.log
+</screen>
+		Note: The path <filename>/data/ldap/log</filename> should be set at a location
+		that is convenient and that can store a large volume of data.
+		</para></step>
+
+	</procedure>
+
+<example id="sbehap-dbconf">
+<title>LDAP DB_CONFIG File</title>
+<screen>
+set_cachesize           0 150000000 1
+set_lg_regionmax        262144
+set_lg_bsize            2097152
+#set_lg_dir             /var/log/bdb
+set_flags               DB_LOG_AUTOREMOVE
+</screen>
+</example>
+
+<example id="sbehap-slapdconf">
+<title>LDAP Master Configuration File &smbmdash; <filename>/etc/openldap/slapd.conf</filename> Part A</title>
+<screen>
+include		/etc/openldap/schema/core.schema
+include		/etc/openldap/schema/cosine.schema
+include		/etc/openldap/schema/inetorgperson.schema
+include		/etc/openldap/schema/nis.schema
+include		/etc/openldap/schema/samba3.schema
+
+pidfile		/var/run/slapd/slapd.pid
+argsfile	/var/run/slapd/slapd.args
+
+access to dn.base=""
+		by self write
+		by * auth
+
+access to attr=userPassword
+		by self write
+		by * auth
+
+access to attr=shadowLastChange
+		by self write
+		by * read
+
+access to *
+                by * read
+                by anonymous auth
+
+#loglevel	256
+
+schemacheck 	on
+idletimeout	30
+backend		bdb
+database	bdb
+checkpoint      1024 5
+cachesize       10000
+
+suffix		"dc=abmas,dc=biz"
+rootdn		"cn=Manager,dc=abmas,dc=biz"
+
+# rootpw = not24get
+rootpw          {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
+
+directory	/data/ldap
+</screen>
+</example>
+
+<example id="sbehap-slapdconf2">
+<title>LDAP Master Configuration File &smbmdash; <filename>/etc/openldap/slapd.conf</filename> Part B</title>
+<screen>
+# Indices to maintain
+index objectClass           eq
+index cn                    pres,sub,eq
+index sn                    pres,sub,eq
+index uid                   pres,sub,eq
+index displayName           pres,sub,eq
+index uidNumber             eq
+index gidNumber             eq
+index memberUID             eq
+index sambaSID              eq
+index sambaPrimaryGroupSID  eq
+index sambaDomainName       eq
+index default               sub
+</screen>
+</example>
+
+	</sect2>
+
+	<sect2 id="sbehap-PAM-NSS">
+	<title>PAM and NSS Client Configuration</title>
+
+	<para>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>NSS</primary></indexterm>
+	<indexterm><primary>PAM</primary></indexterm>
+	The steps that follow involve configuration of LDAP, NSS LDAP-based resolution of users and
+	groups. Also, so that LDAP-based accounts can log onto the system, the steps ahead configure
+	the Pluggable Authentication Modules (PAM) to permit LDAP-based authentication.
+	</para>
+
+	<para>
+	<indexterm><primary>Pluggable Authentication Modules</primary><see>PAM</see></indexterm>
+	<indexterm><primary>pam_unix2.so</primary></indexterm>
+	Since you have chosen to put UNIX user and group accounts into the LDAP database, it is likely
+	that you may want to use them for UNIX system (Linux) local machine logons. This necessitates
+	correct configuration of PAM. The <command>pam_ldap</command> open source package provides the
+	PAM modules that most people would use. On SUSE Linux systems, the <command>pam_unix2.so</command>
+	module also has the ability to redirect authentication requests through LDAP.
+	</para>
+
+	<para>
+	<indexterm><primary>YaST</primary></indexterm>
+	<indexterm><primary>SUSE Linux</primary></indexterm>
+	<indexterm><primary>Red Hat Linux</primary></indexterm>
+	<indexterm><primary>authconfig</primary></indexterm>
+	You have chosen to configure these services by directly editing the system files, but of course, you
+	know that this configuration can be done using system tools provided by the Linux system vendor.
+	SUSE Linux has a facility in YaST (the system admin tool) through <menuchoice><guimenu>yast</guimenu>
+	<guimenuitem>system</guimenuitem><guimenuitem>ldap-client</guimenuitem></menuchoice> that permits
+	configuration of SUSE Linux as an LDAP client. Red Hat Linux provides the <command>authconfig</command>
+	tool for this.
+	</para>
+
+	<procedure>
+	<title>PAM and NSS Client Configuration Steps</title>
+
+		<step><para>
+		<indexterm><primary>/lib/libnss_ldap.so.2</primary></indexterm>
+		<indexterm><primary>/etc/ldap.conf</primary></indexterm>
+		<indexterm><primary>nss_ldap</primary></indexterm>
+		Execute the following command to find where the <filename>nss_ldap</filename> module
+		expects to find its control file:
+<screen>
+&rootprompt; strings /lib/libnss_ldap.so.2 | grep conf
+</screen>
+		The preferred and usual location is <filename>/etc/ldap.conf</filename>.
+		</para></step>
+
+		<step><para>
+		On the server <constant>MASSIVE</constant>, install the file shown in 
+		<link linkend="sbehap-nss01"/> into the path that was obtained from the step above.
+		On the servers called <constant>BLDG1</constant> and <constant>BLDG2</constant>, install the file shown in
+		<link linkend="sbehap-nss02"/> into the path that was obtained from the step above.
+		</para></step>
+
+<example id="sbehap-nss01">
+<title>Configuration File for NSS LDAP Support &smbmdash; <filename>/etc/ldap.conf</filename></title>
+<screen>
+host 127.0.0.1
+
+base dc=abmas,dc=biz
+
+binddn cn=Manager,dc=abmas,dc=biz
+bindpw not24get
+
+timelimit 50
+bind_timelimit 50
+bind_policy hard
+
+idle_timelimit 3600
+
+pam_password exop
+
+nss_base_passwd ou=People,dc=abmas,dc=biz?one
+nss_base_shadow ou=People,dc=abmas,dc=biz?one
+nss_base_group  ou=Groups,dc=abmas,dc=biz?one
+
+ssl off
+</screen>
+</example>
+
+<example id="sbehap-nss02">
+<title>Configuration File for NSS LDAP Clients Support &smbmdash; <filename>/etc/ldap.conf</filename></title>
+<screen>
+host 172.16.0.1
+
+base dc=abmas,dc=biz
+
+binddn cn=Manager,dc=abmas,dc=biz
+bindpw not24get
+
+timelimit 50
+bind_timelimit 50
+bind_policy hard
+
+idle_timelimit 3600
+
+pam_password exop
+
+nss_base_passwd ou=People,dc=abmas,dc=biz?one
+nss_base_shadow ou=People,dc=abmas,dc=biz?one
+nss_base_group  ou=Groups,dc=abmas,dc=biz?one
+
+ssl off
+</screen>
+</example>
+
+		<step><para>
+		<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+		Edit the NSS control file (<filename>/etc/nsswitch.conf</filename>) so that the lines that
+		control user and group resolution will obtain information from the normal system files as
+		well as from <command>ldap</command>:
+<screen>
+passwd: files ldap
+shadow: files ldap
+group:  files ldap
+hosts:  files dns wins
+</screen>
+		Later, when the LDAP database has been initialized and user and group accounts have been
+		added, you can validate resolution of the LDAP resolver process. The inclusion of 
+		WINS-based hostname resolution is deliberate so that all MS Windows client hostnames can be 
+		resolved to their IP addresses, whether or not they are DHCP clients.
+		</para>
+
+		<note><para>
+		Some Linux systems (Novell SUSE Linux in particular) add entries to the <filename>nsswitch.conf</filename>
+		file that may cause operational problems with the configuration methods adopted in this book. It is
+		advisable to comment out the entries <constant>passwd_compat</constant> and <constant>group_compat</constant>
+		where they are found in this file.
+		</para></note>
+
+		<para>
+		Even at the risk of overstating the issue, incorrect and inappropriate configuration of the
+		<filename>nsswitch.conf</filename> file is a significant cause of operational problems with LDAP.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>pam_unix2.so</primary><secondary>use_ldap</secondary></indexterm>
+		For PAM LDAP configuration on this SUSE Linux 9.0 system, the simplest solution is to edit the following
+		files in the <filename>/etc/pam.d</filename> directory: <command>login</command>, <command>password</command>,
+		<command>samba</command>, <command>sshd</command>.  In each file, locate every entry that has the
+		<command>pam_unix2.so</command> entry and add to the line the entry <command>use_ldap</command> as shown
+		for the <command>login</command> module in this example:
+<screen>
+#%PAM-1.0
+auth      requisite  pam_unix2.so   nullok use_ldap #set_secrpc
+auth      required   pam_securetty.so
+auth      required   pam_nologin.so
+#auth     required   pam_homecheck.so
+auth      required   pam_env.so
+auth      required   pam_mail.so
+account   required   pam_unix2.so   use_ldap
+password  required   pam_pwcheck.s  nullok
+password  required   pam_unix2.so   nullok use_first_pass \
+                                    use_authtok use_ldap
+session   required   pam_unix2.so   none use_ldap # debug or trace
+session   required   pam_limits.so
+</screen>
+		</para>
+
+		<para>
+		<indexterm><primary>pam_ldap.so</primary></indexterm>
+		On other Linux systems that do not have an LDAP-enabled <command>pam_unix2.so</command> module,
+		you must edit these files by adding the <command>pam_ldap.so</command> modules as shown here:
+<screen>
+#%PAM-1.0
+auth     required    pam_securetty.so
+auth     required    pam_nologin.so
+auth     sufficient  pam_ldap.so
+auth     required    pam_unix2.so   nullok try_first_pass #set_secrpc
+account  sufficient  pam_ldap.so
+account  required    pam_unix2.so
+password required    pam_pwcheck.so nullok
+password required    pam_ldap.so    use_first_pass use_authtok
+password required    pam_unix2.so   nullok use_first_pass use_authtok
+session  required    pam_unix2.so   none # debug or trace
+session  required    pam_limits.so
+session  required    pam_env.so
+session  optional    pam_mail.so
+</screen>
+		This example does have the LDAP-enabled <command>pam_unix2.so</command>, but simply
+		demonstrates the use of the <command>pam_ldap.so</command> module. You can use either
+		implementation, but if the <command>pam_unix2.so</command> on your system supports
+		LDAP, you probably want to use it rather than add an additional module.
+		</para></step>
+
+	</procedure>
+
+	</sect2>
+
+	<sect2 id="sbehap-massive">
+	<title>Samba-3 PDC Configuration</title>
+
+	<para>
+	<indexterm><primary>Samba RPM Packages</primary></indexterm>
+	Verify that the Samba-3.0.20 (or later) packages are installed on each SUSE Linux server 
+	before following the steps below. If Samba-3.0.20 (or later) is not installed, you have the
+	choice to either build your own or obtain the packages from a dependable source.
+	Packages for SUSE Linux 8.x, 9.x, and SUSE Linux Enterprise Server 9, as well as for 
+	Red Hat Fedora Core and Red Hat Enterprise Linux Server 3 and 4, are included on the CD-ROM that
+	is included with this book.
+	</para>
+
+	<procedure>
+	<title>Configuration of PDC Called <constant>MASSIVE</constant></title>
+
+		<step><para>
+		Install the files in <link linkend="sbehap-massive-smbconfa"/>, 
+		<link linkend="sbehap-massive-smbconfb"/>, <link linkend="sbehap-shareconfa"/>, 
+		and <link linkend="sbehap-shareconfb"/> into the <filename>/etc/samba/</filename> 
+		directory. The three files should be added together to form the &smb.conf; 
+		master file. It is a good practice to call this file something like
+		<filename>smb.conf.master</filename> and then to perform all file edits
+		on the master file. The operational &smb.conf; is then generated as shown in
+		the next step.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>testparm</primary></indexterm>
+		Create and verify the contents of the &smb.conf; file that is generated by:
+<screen>
+&rootprompt; testparm -s smb.conf.master &gt; smb.conf
+</screen>
+		Immediately follow this with the following:
+<screen>
+&rootprompt; testparm
+</screen>
+		The output that is created should be free from errors, as shown here:
+
+<screen>
+Load smb config files from /etc/samba/smb.conf
+Processing section "[accounts]"
+Processing section "[service]"
+Processing section "[pidata]"
+Processing section "[homes]"
+Processing section "[printers]"
+Processing section "[apps]"
+Processing section "[netlogon]"
+Processing section "[profiles]"
+Processing section "[profdata]"
+Processing section "[print$]"
+Loaded services file OK.
+Server role: ROLE_DOMAIN_PDC
+Press enter to see a dump of your service definitions
+</screen>
+		</para></step>
+		
+		<step><para>
+		Delete all runtime files from prior Samba operation by executing (for SUSE
+		Linux):
+<screen>
+&rootprompt; rm /etc/samba/*tdb
+&rootprompt; rm /var/lib/samba/*tdb
+&rootprompt; rm /var/lib/samba/*dat
+&rootprompt; rm /var/log/samba/*
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>secrets.tdb</primary></indexterm>
+		<indexterm><primary>smbpasswd</primary></indexterm>
+		Samba-3 communicates with the LDAP server. The password that it uses to
+		authenticate to the LDAP server must be stored in the <filename>secrets.tdb</filename>
+		file. Execute the following to create the new <filename>secrets.tdb</filename> files
+		and store the password for the LDAP Manager:
+<screen>
+&rootprompt; smbpasswd -w not24get
+</screen>
+		The expected output from this command is:
+<screen>
+Setting stored password for "cn=Manager,dc=abmas,dc=biz" in secrets.tdb
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>smbd</primary></indexterm>
+		<indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm>
+		Samba-3 generates a Windows Security Identifier (SID) only when <command>smbd</command>
+		has been started. For this reason, you start Samba. After a few seconds delay,
+		execute:
+<screen>
+&rootprompt; smbclient -L localhost -U%
+&rootprompt; net getlocalsid
+</screen>
+		A report such as the following means that the domain SID has not yet
+		been written to the <filename>secrets.tdb</filename> or to the LDAP backend:
+<screen>
+[2005/03/03 23:19:34, 0] lib/smbldap.c:smbldap_connect_system(852)
+  failed to bind to server ldap://massive.abmas.biz
+with dn="cn=Manager,dc=abmas,dc=biz" Error: Can't contact LDAP server
+        (unknown)
+[2005/03/03 23:19:48, 0] lib/smbldap.c:smbldap_search_suffix(1169)
+  smbldap_search_suffix: Problem during the LDAP search:
+        (unknown) (Timed out)
+</screen>
+		The attempt to read the SID will cause and attempted bind to the LDAP server. Because the LDAP server
+		is not running, this operation will fail by way of a timeout, as shown previously. This is
+		normal output; do not worry about this error message.  When the domain has been created and
+		written to the <filename>secrets.tdb</filename> file, the output should look like this:
+<screen>
+SID for domain MASSIVE is: S-1-5-21-3504140859-1010554828-2431957765
+</screen>
+		If, after a short delay (a few seconds), the domain SID has still not been written to 
+		the <filename>secrets.tdb</filename> file, it is necessary to investigate what 
+		may be misconfigured. In this case, carefully check the &smb.conf; file for typographical 
+		errors (the most common problem).  The use of the <command>testparm</command> is highly 
+		recommended to validate the contents of this file.
+		</para></step>
+
+		<step><para>
+		When a positive domain SID has been reported, stop Samba.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>NFS server</primary></indexterm>
+		<indexterm><primary>/etc/exports</primary></indexterm>
+		<indexterm><primary>BDC</primary></indexterm>
+		<indexterm><primary>rsync</primary></indexterm>
+		Configure the NFS server for your Linux system. So you can complete the steps that
+		follow, enter into the <filename>/etc/exports</filename> the following entry:
+<screen>
+/home   *(rw,root_squash,sync)
+</screen>
+		This permits the user home directories to be used on the BDC servers for testing
+		purposes. You, of course, decide what is the best way for your site to distribute
+		data drives, and you create suitable backup and restore procedures for Abmas
+		I'd strongly recommend that for normal operation the BDC is completely independent 
+		of the PDC. rsync is a useful tool here, as it resembles the NT replication service quite 
+		closely. If you do use NFS, do not forget to start the NFS server as follows:
+<screen>
+&rootprompt; rcnfsserver start
+</screen>
+		</para></step>
+	</procedure>
+
+	<para>
+	Your Samba-3 PDC is now ready to communicate with the LDAP password backend. Let's get on with
+	configuration of the LDAP server.
+	</para>
+
+<smbconfexample id="sbehap-massive-smbconfa">
+<title>LDAP Based &smb.conf; File, Server: MASSIVE &smbmdash; global Section: Part A</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+	<smbconfoption name="unix charset">LOCALE</smbconfoption>
+	<smbconfoption name="workgroup">MEGANET2</smbconfoption>
+	<smbconfoption name="netbios name">MASSIVE</smbconfoption>
+	<smbconfoption name="interfaces">eth1, lo</smbconfoption>
+	<smbconfoption name="bind interfaces only">Yes</smbconfoption>
+	<smbconfoption name="passdb backend">ldapsam:ldap://massive.abmas.biz</smbconfoption>
+	<smbconfoption name="enable privileges">Yes</smbconfoption>
+	<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+	<smbconfoption name="log level">1</smbconfoption>
+	<smbconfoption name="syslog">0</smbconfoption>
+	<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+	<smbconfoption name="max log size">50</smbconfoption>
+	<smbconfoption name="smb ports">139 445</smbconfoption>
+	<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+	<smbconfoption name="time server">Yes</smbconfoption>
+	<smbconfoption name="printcap name">CUPS</smbconfoption>
+	<smbconfoption name="show add printer wizard">No</smbconfoption>
+	<smbconfoption name="add user script">/opt/IDEALX/sbin/smbldap-useradd -m "%u"</smbconfoption>
+	<smbconfoption name="delete user script">/opt/IDEALX/sbin/smbldap-userdel "%u"</smbconfoption>
+	<smbconfoption name="add group script">/opt/IDEALX/sbin/smbldap-groupadd -p "%g"</smbconfoption>
+	<smbconfoption name="delete group script">/opt/IDEALX/sbin/smbldap-groupdel "%g"</smbconfoption>
+	<smbconfoption name="add user to group script">/opt/IDEALX/sbin/</smbconfoption>
+<member><parameter>smbldap-groupmod -m "%u" "%g"</parameter></member>
+	<smbconfoption name="delete user from group script">/opt/IDEALX/sbin/</smbconfoption>
+<member><parameter>smbldap-groupmod -x "%u" "%g"</parameter></member>
+	<smbconfoption name="set primary group script">/opt/IDEALX/sbin/</smbconfoption>
+<member><parameter>smbldap-usermod -g "%g" "%u"</parameter></member>
+	<smbconfoption name="add machine script">/opt/IDEALX/sbin/smbldap-useradd -w "%u"</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="sbehap-massive-smbconfb">
+<title>LDAP Based &smb.conf; File, Server: MASSIVE &smbmdash; global Section: Part B</title>
+	<smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
+	<smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption>
+	<smbconfoption name="logon drive">X:</smbconfoption>
+	<smbconfoption name="domain logons">Yes</smbconfoption>
+	<smbconfoption name="preferred master">Yes</smbconfoption>
+	<smbconfoption name="wins support">Yes</smbconfoption>
+	<smbconfoption name="ldap suffix">dc=abmas,dc=biz</smbconfoption>
+	<smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
+	<smbconfoption name="ldap user suffix">ou=People</smbconfoption>
+	<smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
+	<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
+	<smbconfoption name="ldap admin dn">cn=Manager,dc=abmas,dc=biz</smbconfoption>
+	<smbconfoption name="idmap backend">ldap:ldap://massive.abmas.biz</smbconfoption>
+	<smbconfoption name="idmap uid">10000-20000</smbconfoption>
+	<smbconfoption name="idmap gid">10000-20000</smbconfoption>
+	<smbconfoption name="map acl inherit">Yes</smbconfoption>
+	<smbconfoption name="printing">cups</smbconfoption>
+	<smbconfoption name="printer admin">root, chrisr</smbconfoption>
+</smbconfexample>
+
+	</sect2>
+
+
+	<sect2 id="sbeidealx">
+	<title>Install and Configure Idealx smbldap-tools Scripts</title>
+
+	<para>
+	<indexterm><primary>Idealx</primary><secondary>smbldap-tools</secondary></indexterm>
+	The Idealx scripts, or equivalent, are necessary to permit Samba-3 to manage accounts
+	on the LDAP server. You have chosen the Idealx scripts because they are the best-known
+	LDAP configuration scripts. The use of these scripts will help avoid the necessity
+	to create custom scripts. It is easy to download them from the Idealx
+	<ulink url="http://samba.idealx.org/index.en.html">Web site</ulink>. The tarball may
+	be directly <ulink url="http://samba.idealx.org/dist/smbldap-tools-0.9.0.tgz">downloaded</ulink>
+	from this site also. Alternatively, you may obtain the 
+	<ulink url="http://samba.idealx.org/dist/smbldap-tools-0.9.0-1.src.rpm">smbldap-tools-0.9.0-1.src.rpm</ulink>
+	file that may be used to build an installable RPM package for your Linux system.
+	</para>
+
+<note><para>
+The smbldap-tools scripts can be installed in any convenient directory of your choice, in which case you must
+change the path to them in your &smb.conf; file on the PDC (<constant>MASSIVE</constant>).
+</para></note>
+
+	<para>
+	The smbldap-tools are located in <filename>/opt/IDEALX/sbin</filename>.
+	The scripts are not needed on BDC machines because all LDAP updates are handled by
+	the PDC alone.
+	</para>
+
+	<sect3>
+	<title>Installation of smbldap-tools from the Tarball</title>
+
+	<para>
+	To perform a manual installation of the smbldap-tools scripts, the following procedure may be used:
+	</para>
+
+	<procedure id="idealxscript">
+	<title>Unpacking and Installation Steps for the <constant>smbldap-tools</constant> Tarball</title>
+
+		<step><para>
+		Create the <filename>/opt/IDEALX/sbin</filename> directory, and set its permissions
+		and ownership as shown here:
+<screen>
+&rootprompt; mkdir -p /opt/IDEALX/sbin
+&rootprompt; chown root:root /opt/IDEALX/sbin
+&rootprompt; chmod 755 /opt/IDEALX/sbin
+&rootprompt; mkdir -p /etc/smbldap-tools
+&rootprompt; chown root:root /etc/smbldap-tools
+&rootprompt; chmod 755 /etc/smbldap-tools
+</screen>
+		</para></step>
+
+		<step><para>
+		If you wish to use the downloaded tarball, unpack the smbldap-tools in a suitable temporary location.
+		Change into either the directory extracted from the tarball or the smbldap-tools
+		directory in your <filename>/usr/share/doc/packages</filename> directory tree.
+		</para></step>
+
+		<step><para>
+		Copy all the <filename>smbldap-*</filename> and the <filename>configure.pl</filename> files into the 
+		<filename>/opt/IDEALX/sbin</filename> directory, as shown here:
+<screen>
+&rootprompt; cd smbldap-tools-0.9.0/
+&rootprompt; cp smbldap-* configure.pl *pm /opt/IDEALX/sbin/
+&rootprompt; cp smbldap*conf /etc/smbldap-tools/
+&rootprompt; chmod 750 /opt/IDEALX/sbin/smbldap-*
+&rootprompt; chmod 750 /opt/IDEALX/sbin/configure.pl
+&rootprompt; chmod 640 /etc/smbldap-tools/smbldap.conf
+&rootprompt; chmod 600 /etc/smbldap-tools/smbldap_bind.conf
+</screen>
+		</para></step>
+
+		<step><para>
+		The smbldap-tools scripts master control file must now be configured.
+		Change to the <filename>/opt/IDEALX/sbin</filename> directory, then edit the
+		<filename>smbldap_tools.pm</filename> to affect the changes
+		shown here:
+<screen>
+...
+# ugly funcs using global variables and spawning openldap clients
+
+my $smbldap_conf="/etc/smbldap-tools/smbldap.conf";
+my $smbldap_bind_conf="/etc/smbldap-tools/smbldap_bind.conf";
+...
+</screen>
+		</para></step>
+
+		<step><para>
+		To complete the configuration of the smbldap-tools, set the permissions and ownership
+		by executing the following commands:
+<screen>
+&rootprompt; chown root:root /opt/IDEALX/sbin/* 
+&rootprompt; chmod 755 /opt/IDEALX/sbin/smbldap-*
+&rootprompt; chmod 640 /opt/IDEALX/sbin/smb*pm 
+</screen>
+		The smbldap-tools scripts are now ready for the configuration step outlined in
+		<link linkend="smbldap-init"/>.
+		</para></step>
+
+	</procedure>
+
+	</sect3>
+
+	<sect3>
+	<title>Installing smbldap-tools from the RPM Package</title>
+
+	<para>
+	In the event that you have elected to use the RPM package provided by Idealx, download the
+	source RPM <filename>smbldap-tools-0.9.0-1.src.rpm</filename>, then follow this procedure:
+	</para>
+
+	<procedure>
+	<title>Installation Steps for <constant>smbldap-tools</constant> RPM's</title>
+
+		<step><para>
+		Install the source RPM that has been downloaded as follows:
+<screen>
+&rootprompt; rpm -i smbldap-tools-0.9.0-1.src.rpm
+</screen>
+		</para></step>
+
+		<step><para>
+		Change into the directory in which the SPEC files are located. On SUSE Linux:
+<screen>
+&rootprompt; cd /usr/src/packages/SPECS
+</screen>
+		On Red Hat Linux systems:
+<screen>
+&rootprompt; cd /usr/src/redhat/SPECS
+</screen>
+		</para></step>
+
+		<step><para>
+		Edit the <filename>smbldap-tools.spec</filename> file to change the value of the
+		<constant>_sysconfig</constant> macro as shown here:
+<screen>
+%define _prefix /opt/IDEALX
+%define _sysconfdir /etc
+</screen>
+		Note: Any suitable directory can be specified.
+		</para></step>
+
+		<step><para>
+		Build the package by executing:
+<screen>
+&rootprompt; rpmbuild -ba -v smbldap-tools.spec
+</screen>
+		A build process that has completed without error will place the installable binary
+		files in the directory <filename>../RPMS/noarch</filename>.
+		</para></step>
+
+		<step><para>
+		Install the binary package by executing:
+<screen>
+&rootprompt; rpm -Uvh ../RPMS/noarch/smbldap-tools-0.9.0-1.noarch.rpm
+</screen>
+		</para></step>
+
+	</procedure>
+
+	<para>
+	The Idealx scripts should now be ready for configuration using the steps outlined in
+	<link linkend="smbldap-init">Configuration of smbldap-tools</link>.
+	</para>
+
+	</sect3>
+
+	<sect3 id="smbldap-init">
+	<title>Configuration of smbldap-tools</title>
+
+	<para>
+	Prior to use, the smbldap-tools must be configured to match the settings in the &smb.conf; file
+	and to match the settings in the <filename>/etc/openldap/slapd.conf</filename> file. The assumption
+	is made that the &smb.conf; file has correct contents. The following procedure ensures that
+	this is completed correctly:
+	</para>
+
+	<para>
+	The smbldap-tools require that the NetBIOS name (machine name) of the Samba server be included
+	in the &smb.conf; file.
+	</para>
+
+	<procedure>
+	<title>Configuration Steps for <constant>smbldap-tools</constant> to Enable Use</title>
+
+		<step><para>
+		Change into the directory that contains the <filename>configure.pl</filename> script.
+<screen>
+&rootprompt; cd /opt/IDEALX/sbin
+</screen>
+		</para></step>
+
+		<step><para>
+		Execute the <filename>configure.pl</filename> script as follows:
+<screen>
+&rootprompt; ./configure.pl
+</screen>
+		The interactive use of this script for the PDC is demonstrated here:
+<screen>
+&rootprompt; /opt/IDEALX/sbin/configure.pl 
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+       smbldap-tools script configuration
+       -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+Before starting, check
+ . if your samba controller is up and running.
+ . if the domain SID is defined (you can get it with the 'net getlocalsid')
+
+ . you can leave the configuration using the Crtl-c key combination
+ . empty value can be set with the "." character
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+Looking for configuration files...
+
+Samba Config File Location [/etc/samba/smb.conf] > 
+smbldap Config file Location (global parameters)
+                              [/etc/opt/IDEALX/smbldap-tools/smbldap.conf] > 
+smbldap Config file Location (bind parameters) 
+                         [/etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf] > 
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+Let's start configuring the smbldap-tools scripts ...
+
+. workgroup name: name of the domain Samba act as a PDC
+  workgroup name [MEGANET2] > 
+. netbios name: netbios name of the samba controller
+  netbios name [MASSIVE] > 
+. logon drive: local path to which the home directory will 
+                                be connected (for NT Workstations). Ex: 'H:'
+  logon drive [H:] > 
+. logon home: home directory location (for Win95/98 or NT Workstation).
+  (use %U as username) Ex:'\\MASSIVE\%U'
+  logon home (press the "." character if you don't want homeDirectory) 
+                                                   [\\MASSIVE\%U] > \\%L\%U
+. logon path: directory where roaming profiles are stored. 
+                                                  Ex:'\\MASSIVE\profiles\%U'
+  logon path (press the "." character if you don't want roaming profile) 
+                                                       [\\%L\profiles\%U] > 
+. home directory prefix (use %U as username) [/home/%U] > /data/users/%U
+. default users' homeDirectory mode [700] > 
+. default user netlogon script (use %U as username) [scripts\logon.bat] > 
+  default password validation time (time in days) [45] > 900
+. ldap suffix [dc=terpstra-world,dc=org] > 
+. ldap group suffix [ou=Groups] > 
+. ldap user suffix [ou=People,ou=Users] > 
+. ldap machine suffix [ou=Computers,ou=Users] > 
+. Idmap suffix [ou=Idmap] > 
+. sambaUnixIdPooldn: object where you want to store the next uidNumber
+  and gidNumber available for new users and groups
+  sambaUnixIdPooldn object (relative to ${suffix}) 
+                                               [sambaDomainName=MEGANET2] > 
+. ldap master server: IP adress or DNS name of the 
+                                             master (writable) ldap server
+  ldap master server [merlin.terpstra-world.org] > 
+. ldap master port [389] > 
+. ldap master bind dn [cn=Manager,dc=terpstra-world,dc=org] > 
+. ldap master bind password [] > 
+. ldap slave server: IP adress or DNS name of the slave ldap server: 
+                                                can also be the master one
+  ldap slave server [merlin.terpstra-world.org] > 
+. ldap slave port [389] > 
+. ldap slave bind dn [cn=Manager,dc=terpstra-world,dc=org] > 
+. ldap slave bind password [] > 
+. ldap tls support (1/0) [0] > 
+. SID for domain MEGANET2: SID of the domain 
+                          (can be obtained with 'net getlocalsid MASSIVE')
+  SID for domain MEGANET2 [S-1-5-21-3504140859-1010554828-2431957765] > 
+. unix password encryption: encryption used for unix passwords
+  unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > MD5
+. default user gidNumber [513] > 
+. default computer gidNumber [515] > 
+. default login shell [/bin/bash] > 
+. default domain name to append to mail adress [] > terpstra-world.org
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+backup old configuration files:
+  /etc/opt/IDEALX/smbldap-tools/smbldap.conf->
+                            /etc/opt/IDEALX/smbldap-tools/smbldap.conf.old
+  /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf->
+                       /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf.old
+writing new configuration file:
+  /etc/opt/IDEALX/smbldap-tools/smbldap.conf done.
+  /etc/opt/IDEALX/smbldap-tools/smbldap_bind.conf done.
+</screen>
+		Since a slave LDAP server has not been configured, it is necessary to specify the IP
+		address of the master LDAP server for both the master and the slave configuration
+		prompts.
+		</para></step>
+
+		<step><para>
+		Change to the directory that contains the <filename>smbldap.conf</filename> file,
+		then verify its contents.
+		</para></step>
+
+	</procedure>
+
+	<para>
+	The smbldap-tools are now ready for use.
+	</para>
+
+	</sect3>
+
+	</sect2>
+
+	<sect2>
+	<title>LDAP Initialization and Creation of User and Group Accounts</title>
+
+	<para>
+	The LDAP database must be populated with well-known Windows domain user accounts and domain group 
+	accounts before Samba can be used. The following procedures step you through the process.
+	</para>
+
+	<para>
+	At this time, Samba-3 requires that on a PDC all UNIX (POSIX) group accounts that are
+	mapped (linked) to Windows domain group accounts must be in the LDAP database. It does not
+	hurt to have UNIX user and group accounts in both the system files as well as in the LDAP
+	database. From a UNIX system perspective, the NSS resolver checks system files before
+	referring to LDAP. If the UNIX system can resolve (find) an account in the system file, it
+	does not need to ask LDAP.
+	</para>
+
+	<para>
+	Addition of an account to the LDAP backend can be done in two ways:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		<indexterm><primary>NIS</primary></indexterm>
+		<indexterm><primary>/etc/passwd</primary></indexterm>
+		<indexterm><primary>Posix accounts</primary></indexterm>
+		<indexterm><primary>pdbedit</primary></indexterm>
+		<indexterm><primary>SambaSamAccount</primary></indexterm>
+		<indexterm><primary>PosixAccount</primary></indexterm>
+		If you always have a user account in the <filename>/etc/passwd</filename> on every 
+		server or in a NIS(+) backend, it is not necessary to add POSIX accounts for them in 
+		LDAP. In this case, you can add Windows domain user accounts using the 
+		<command>pdbedit</command> utility. Use of this tool from the command line adds the 
+		SambaSamAccount entry for the user, but does not add the PosixAccount entry for the user.
+		</para>
+
+		<para>
+		This is the least desirable method because when LDAP is used as the passwd backend Samba
+		expects the POSIX account to be in LDAP also. It is possible to use the PADL account
+		migration tool to migrate all system accounts from either the <filename>/etc/passwd</filename>
+		files, or from NIS, to LDAP.
+		</para></listitem>
+
+		<listitem><para>
+		If you decide that it is probably a good idea to add both the PosixAccount attributes
+		as well as the SambaSamAccount attributes for each user, then a suitable script is needed.
+		In the example system you are installing in this exercise, you are making use of the
+		Idealx smbldap-tools scripts. A copy of these tools, preconfigured for this system,
+		is included on the enclosed CD-ROM under <filename>Chap06/Tools.</filename>
+		</para></listitem>
+	</itemizedlist>
+
+	<para>
+	<indexterm><primary>Idealx</primary><secondary>smbldap-tools</secondary></indexterm>
+	If you wish to have more control over how the LDAP database is initialized or 
+	if you don't want to use the Idealx smbldap-tools, you should refer to 
+	<link linkend="appendix"/>, <link linkend="altldapcfg"/>.
+	</para>
+
+	<para>
+	<indexterm><primary>smbldap-populate</primary></indexterm>
+	The following steps initialize the LDAP database, and then you can add user and group
+	accounts that Samba can use. You use the <command>smbldap-populate</command> to
+	seed the LDAP database. You then manually add the accounts shown in <link linkend="sbehap-bigacct"/>. 
+	The list of users does not cover all 500 network users; it provides examples only.
+	</para>
+
+	<note><para>
+	<indexterm><primary>LDAP</primary><secondary>database</secondary></indexterm>
+	<indexterm><primary>directory</primary><secondary>People container</secondary></indexterm>
+	<indexterm><primary>directory</primary><secondary>Computers container</secondary></indexterm>
+	In the following examples, as the LDAP database is initialized, we do create a container
+	for Computer (machine) accounts. In the Samba-3 &smb.conf; files, specific use is made
+	of the People container, not the Computers container, for domain member accounts. This is not a
+	mistake; it is a deliberate action that is necessitated by the fact that the resolution of 
+	a machine (computer) account to a UID is done via NSS. The only way this can be handled is
+	using the NSS (<filename>/etc/nsswitch.conf</filename>) entry for <constant>passwd</constant>,
+	which is resolved using the <filename>nss_ldap</filename> library. The configuration file for
+	the <filename>nss_ldap</filename> library is the file <filename>/etc/ldap.conf</filename> that
+	provides only one possible LDAP search command that is specified by the entry called
+	<constant>nss_base_passwd</constant>. This means that the search path must take into account
+	the directory structure so that the LDAP search will commence at a level that is above
+	both the Computers container and the Users (or People) container. If this is done, it is
+	necessary to use a search that will descend the directory tree so that the machine account
+	can be found. Alternatively, by placing all machine accounts in the People container, we
+	are able to sidestep this limitation. This is the simpler solution that has been adopted
+	in this chapter.
+	</para></note>
+
+
+	<table id="sbehap-bigacct">
+		<title>Abmas Network Users and Groups</title>
+		<tgroup cols="4">
+			<colspec align="left"/>
+			<colspec align="left"/>
+			<colspec align="left"/>
+			<colspec align="left"/>
+			<thead>
+				<row>
+					<entry align="center">Account Name</entry>
+					<entry align="center">Type</entry>
+					<entry align="center">ID</entry>
+					<entry align="center">Password</entry>
+				</row>
+			</thead>
+			<tbody>
+				<row>
+					<entry>Robert Jordan</entry>
+					<entry>User</entry>
+					<entry>bobj</entry>
+					<entry>n3v3r2l8</entry>
+				</row>
+				<row>
+					<entry>Stanley Soroka</entry>
+					<entry>User</entry>
+					<entry>stans</entry>
+					<entry>impl13dst4r</entry>
+				</row>
+				<row>
+					<entry>Christine Roberson</entry>
+					<entry>User</entry>
+					<entry>chrisr</entry>
+					<entry>S9n0nw4ll</entry>
+				</row>
+				<row>
+					<entry>Mary Vortexis</entry>
+					<entry>User</entry>
+					<entry>maryv</entry>
+					<entry>kw13t0n3</entry>
+				</row>
+				<row>
+					<entry>Accounts</entry>
+					<entry>Group</entry>
+					<entry>Accounts</entry>
+					<entry></entry>
+				</row>
+				<row>
+					<entry>Finances</entry>
+					<entry>Group</entry>
+					<entry>Finances</entry>
+					<entry></entry>
+				</row>
+				<row>
+					<entry>Insurance</entry>
+					<entry>Group</entry>
+					<entry>PIOps</entry>
+					<entry></entry>
+				</row>
+			</tbody>
+		</tgroup>
+	</table>
+
+	<procedure id="creatacc">
+	<title>LDAP Directory Initialization Steps</title>
+
+		<step><para>
+		Start the LDAP server by executing:
+<screen>
+&rootprompt; rcldap start
+Starting ldap-server                           done
+</screen>
+		</para></step>
+
+		<step><para>
+		Change to the <filename>/opt/IDEALX/sbin</filename> directory.
+		</para></step>
+
+		<step><para>
+		Execute the script that will populate the LDAP database as shown here:
+<screen>
+&rootprompt; ./smbldap-populate -a root -k 0 -m 0
+</screen>
+		The expected output from this is:
+<screen>
+Using workgroup name from smb.conf: sambaDomainName=MEGANET2
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+=> Warning: you must update smbldap.conf configuration file to :
+=> sambaUnixIdPooldn parameter must be set
+	to "sambaDomainName=MEGANET2,dc=abmas,dc=biz"
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+Using builtin directory structure
+adding new entry: dc=abmas,dc=biz
+adding new entry: ou=People,dc=abmas,dc=biz
+adding new entry: ou=Groups,dc=abmas,dc=biz
+entry ou=People,dc=abmas,dc=biz already exist.
+adding new entry: ou=Idmap,dc=abmas,dc=biz
+adding new entry: sambaDomainName=MEGANET2,dc=abmas,dc=biz
+adding new entry: uid=root,ou=People,dc=abmas,dc=biz
+adding new entry: uid=nobody,ou=People,dc=abmas,dc=biz
+adding new entry: cn=Domain Admins,ou=Groups,dc=abmas,dc=biz
+adding new entry: cn=Domain Users,ou=Groups,dc=abmas,dc=biz
+adding new entry: cn=Domain Guests,ou=Groups,dc=abmas,dc=biz
+adding new entry: cn=Domain Computers,ou=Groups,dc=abmas,dc=biz
+adding new entry: cn=Administrators,ou=Groups,dc=abmas,dc=biz
+adding new entry: cn=Print Operators,ou=Groups,dc=abmas,dc=biz
+adding new entry: cn=Backup Operators,ou=Groups,dc=abmas,dc=biz
+adding new entry: cn=Replicators,ou=Groups,dc=abmas,dc=biz
+</screen>
+		</para></step>
+
+		<step><para>
+		Edit the <filename>/etc/smbldap-tools/smbldap.conf</filename> file so that the following
+		information is changed from:
+<screen>
+# Where to store next uidNumber and gidNumber available
+sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"
+</screen>
+		to read, after modification:
+<screen>
+# Where to store next uidNumber and gidNumber available
+#sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"
+sambaUnixIdPooldn="sambaDomainName=MEGANET2,dc=abmas,dc=biz"
+</screen>
+		</para></step>
+
+		<step><para>
+		It is necessary to restart the LDAP server as shown here:
+<screen>
+&rootprompt; rcldap restart
+Shutting down ldap-server                            done
+Starting ldap-server                                 done
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>slapcat</primary></indexterm>
+		So that we can use a global IDMAP repository, the LDAP directory must have a container object for IDMAP data. 
+		There are several ways you can check that your LDAP database is able to receive IDMAP information. One of 
+		the simplest is to execute:
+<screen>
+&rootprompt; slapcat | grep -i idmap
+dn: ou=Idmap,dc=abmas,dc=biz
+ou: idmap
+</screen>
+		<indexterm> <primary>ldapadd</primary></indexterm>
+	        If the execution of this command does not return IDMAP entries, you need to create an LDIF
+		template file (see <link linkend="sbehap-ldifadd"/>). You can add the required entries using 
+		the following command:
+<screen>
+&rootprompt; ldapadd -x -D "cn=Manager,dc=abmas,dc=biz" \
+		-w not24get &lt; /etc/openldap/idmap.LDIF
+</screen>
+		Samba automatically populates this LDAP directory container when it needs to.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>slapcat</primary></indexterm>
+		It looks like all has gone well, as expected. Let's confirm that this is the case
+		by running a few tests. First we check the contents of the database directly
+		by running <command>slapcat</command> as follows (the output has been cut down):
+<screen>
+&rootprompt; slapcat
+dn: dc=abmas,dc=biz
+objectClass: dcObject
+objectClass: organization
+dc: abmas
+o: abmas
+structuralObjectClass: organization
+entryUUID: 5ab02bf6-c536-1027-9d29-b1f32350fb43
+creatorsName: cn=Manager,dc=abmas,dc=biz
+createTimestamp: 20031217234200Z
+entryCSN: 2003121723:42:00Z#0x0001#0#0000
+modifiersName: cn=Manager,dc=abmas,dc=biz
+modifyTimestamp: 20031217234200Z
+...
+dn: cn=Domain Computers,ou=Groups,dc=abmas,dc=biz
+objectClass: posixGroup
+objectClass: sambaGroupMapping
+gidNumber: 553
+cn: Domain Computers
+description: Netbios Domain Computers accounts
+sambaSID: S-1-5-21-3504140859-1010554828-2431957765-553
+sambaGroupType: 2
+displayName: Domain Computers
+structuralObjectClass: posixGroup
+entryUUID: 5e0a41d8-c536-1027-9d3b-b1f32350fb43
+creatorsName: cn=Manager,dc=abmas,dc=biz
+createTimestamp: 20031217234206Z
+entryCSN: 2003121723:42:06Z#0x0002#0#0000
+modifiersName: cn=Manager,dc=abmas,dc=biz
+modifyTimestamp: 20031217234206Z
+</screen>
+		This looks good so far.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>ldapsearch</primary></indexterm>
+		The next step is to prove that the LDAP server is running and responds to a
+		search request. Execute the following as shown (output has been cut to save space):
+<screen>
+&rootprompt; ldapsearch -x -b "dc=abmas,dc=biz" "(ObjectClass=*)"
+# extended LDIF
+#
+# LDAPv3
+# base &lt;dc=abmas,dc=biz&gt; with scope sub
+# filter: (ObjectClass=*)
+# requesting: ALL
+#
+
+# abmas.biz
+dn: dc=abmas,dc=biz
+objectClass: dcObject
+objectClass: organization
+dc: abmas
+o: abmas
+
+# People, abmas.biz
+dn: ou=People,dc=abmas,dc=biz
+objectClass: organizationalUnit
+ou: People
+...
+# Domain Computers, Groups, abmas.biz
+dn: cn=Domain Computers,ou=Groups,dc=abmas,dc=biz
+objectClass: posixGroup
+objectClass: sambaGroupMapping
+gidNumber: 553
+cn: Domain Computers
+description: Netbios Domain Computers accounts
+sambaSID: S-1-5-21-3504140859-1010554828-2431957765-553
+sambaGroupType: 2
+displayName: Domain Computers
+
+# search result
+search: 2
+result: 0 Success
+
+# numResponses: 20
+# numEntries: 19
+</screen>
+		Good. It is all working just fine.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>getent</primary></indexterm>
+		You must now make certain that the NSS resolver can interrogate LDAP also.
+		Execute the following commands:
+<screen>
+&rootprompt; getent passwd | grep root
+root:x:998:512:Netbios Domain Administrator:/home:/bin/false
+
+&rootprompt; getent group | grep Domain
+Domain Admins:x:512:root
+Domain Users:x:513:
+Domain Guests:x:514:
+Domain Computers:x:553:
+</screen>
+		<indexterm><primary>nss_ldap</primary></indexterm>
+		This demonstrates that the <command>nss_ldap</command> library is functioning
+		as it should. If these two steps fail to produce this information, refer to
+		<link linkend="sbeavoid"/> for diagnostic procedures that can be followed to
+		isolate the cause of the problem. Proceed to the next step only when the previous steps
+		have been successfully completed.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>smbldap-useradd</primary></indexterm>
+		<indexterm><primary>smbldap-passwd</primary></indexterm>
+		<indexterm><primary>smbpasswd</primary></indexterm>
+		Our database is now ready for the addition of network users. For each user for
+		whom an account must be created, execute the following:
+<screen>
+&rootprompt; ./smbldap-useradd -m -a <constant>username</constant>
+&rootprompt; ./smbldap-passwd <constant>username</constant>
+Changing password for <constant>username</constant>
+New password : XXXXXXXX
+Retype new password : XXXXXXXX
+
+&rootprompt; smbpasswd <constant>username</constant>
+New SMB password: XXXXXXXX
+Retype new SMB password: XXXXXXXX
+</screen>
+		where <constant>username</constant> is the login ID for each user.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>getent</primary></indexterm>
+		Now verify that the UNIX (POSIX) accounts can be resolved via NSS by executing the
+		following:
+<screen>
+&rootprompt; getent passwd
+root:x:0:0:root:/root:/bin/bash
+bin:x:1:1:bin:/bin:/bin/bash
+...
+root:x:0:512:Netbios Domain Administrator:/home:/bin/false
+nobody:x:999:514:nobody:/dev/null:/bin/false
+bobj:x:1000:513:System User:/home/bobj:/bin/bash
+stans:x:1001:513:System User:/home/stans:/bin/bash
+chrisr:x:1002:513:System User:/home/chrisr:/bin/bash
+maryv:x:1003:513:System User:/home/maryv:/bin/bash
+</screen>
+		This demonstrates that user account resolution via LDAP is working.
+		</para></step>
+
+		<step><para>
+		This step will determine whether or not identity resolution is working correctly.
+		Do not procede is this step fails, rather find the cause of the failure. The
+		<command>id</command> command may be used to validate your configuration so far,
+		as shown here:
+<screen>
+&rootprompt; id chrisr
+uid=1002(chrisr) gid=513(Domain Users) groups=513(Domain Users)
+</screen>
+		This confirms that the UNIX (POSIX) user account information can be resolved from LDAP
+		by system tools that make a getentpw() system call.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>smbldap-usermod</primary></indexterm>
+		The root account must have UID=0; if not, this means that operations conducted from
+		a Windows client using tools such as the Domain User Manager fails under UNIX because
+		the management of user and group accounts requires that the UID=0. Additionally, it is
+		a good idea to make certain that no matter how root account credentials are resolved,
+		the home directory and shell are valid. You decide to effect this immediately
+		as demonstrated here:
+<screen>
+&rootprompt; cd /opt/IDEALX/sbin
+&rootprompt; ./smbldap-usermod -u 0 -d /root -s /bin/bash root
+</screen>
+		</para></step>
+
+		<step><para>
+		Verify that the changes just made to the <constant>root</constant> account were
+		accepted by executing:
+<screen>
+&rootprompt; getent passwd | grep root
+root:x:0:0:root:/root:/bin/bash
+root:x:0:512:Netbios Domain Administrator:/root:/bin/bash
+</screen>
+		This demonstrates that the changes were accepted.
+		</para></step>
+
+		<step><para>
+		Make certain that a home directory has been created for every user by listing the
+		directories in <filename>/home</filename> as follows:
+<screen>
+&rootprompt; ls -al /home
+drwxr-xr-x   8 root   root         176 Dec 17 18:50 ./
+drwxr-xr-x  21 root   root         560 Dec 15 22:19 ../
+drwx------   7 bobj   Domain Users     568 Dec 17 01:16 bobj/
+drwx------   7 chrisr Domain Users     568 Dec 17 01:19 chrisr/
+drwx------   7 maryv  Domain Users     568 Dec 17 01:27 maryv/
+drwx------   7 stans  Domain Users     568 Dec 17 01:43 stans/
+</screen>
+		This is precisely what we want to see.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>ldapsam</primary></indexterm>
+		<indexterm><primary>pdbedit</primary></indexterm>
+		The final validation step involves making certain that Samba-3 can obtain the user
+		accounts from the LDAP ldapsam passwd backend. Execute the following command as shown:
+<screen>
+&rootprompt; pdbedit -Lv chrisr
+Unix username:        chrisr
+NT username:          chrisr
+Account Flags:        [U          ]
+User SID:             S-1-5-21-3504140859-1010554828-2431957765-3004
+Primary Group SID:    S-1-5-21-3504140859-1010554828-2431957765-513
+Full Name:            System User
+Home Directory:       \\MASSIVE\homes
+HomeDir Drive:        H:
+Logon Script:         scripts\login.cmd
+Profile Path:         \\MASSIVE\profiles\chrisr
+Domain:               MEGANET2
+Account desc:         System User
+Workstations:
+Munged dial:
+Logon time:           0
+Logoff time:          Mon, 18 Jan 2038 20:14:07 GMT
+Kickoff time:         Mon, 18 Jan 2038 20:14:07 GMT
+Password last set:    Wed, 17 Dec 2003 17:17:40 GMT
+Password can change:  Wed, 17 Dec 2003 17:17:40 GMT
+Password must change: Mon, 18 Jan 2038 20:14:07 GMT
+Last bad password   : 0
+Bad password count  : 0
+Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
+</screen>
+		This looks good. Of course, you fully expected that it would all work, didn't you?
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>smbldap-groupadd</primary></indexterm>
+		Now you add the group accounts that are used on the Abmas network. Execute
+		the following exactly as shown:
+<screen>
+&rootprompt; ./smbldap-groupadd -a Accounts
+&rootprompt; ./smbldap-groupadd -a Finances
+&rootprompt; ./smbldap-groupadd -a PIOps
+</screen>
+		The addition of groups does not involve keyboard interaction, so the lack of console
+		output is of no concern.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>getent</primary></indexterm>
+		You really do want to confirm that UNIX group resolution from LDAP is functioning 
+		as it should. Let's do this as shown here:
+<screen>
+&rootprompt; getent group
+...
+Domain Admins:x:512:root
+Domain Users:x:513:bobj,stans,chrisr,maryv
+Domain Guests:x:514:
+...
+Accounts:x:1000:
+Finances:x:1001:
+PIOps:x:1002:
+</screen>
+		The well-known special accounts (Domain Admins, Domain Users, Domain Guests), as well
+		as our own site-specific group accounts, are correctly listed. This is looking good.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>net</primary><secondary>groupmap</secondary><tertiary>list</tertiary></indexterm>
+		The final step we need to validate is that Samba can see all the Windows domain groups
+		and that they are correctly mapped to the respective UNIX group account. To do this,
+		just execute the following command:
+<screen>
+&rootprompt; net groupmap list
+Domain Admins (S-1-5-21-3504140859-...-2431957765-512) -> Domain Admins
+Domain Users (S-1-5-21-3504140859-...-2431957765-513) -> Domain Users
+Domain Guests (S-1-5-21-3504140859-...-2431957765-514) -> Domain Guests
+...
+Accounts (S-1-5-21-3504140859-1010554828-2431957765-3001) -> Accounts
+Finances (S-1-5-21-3504140859-1010554828-2431957765-3003) -> Finances
+PIOps (S-1-5-21-3504140859-1010554828-2431957765-3005) -> PIOps
+</screen>
+		This is looking good. Congratulations &smbmdash; it works! Note that in the above output
+		the lines were shortened by replacing the middle value (1010554828) of the SID with the 
+		ellipsis (...).
+		</para></step>
+
+		<step><para>
+		The server you have so carefully built is now ready for another important step. You 
+		start the Samba-3 server and validate its operation. Execute the following to render all 
+		the processes needed fully operative so that, on system reboot, they are automatically 
+		started:
+<screen>
+&rootprompt; chkconfig named on
+&rootprompt; chkconfig dhcpd on
+&rootprompt; chkconfig ldap on
+&rootprompt; chkconfig nmb on
+&rootprompt; chkconfig smb on
+&rootprompt; chkconfig winbind on
+&rootprompt; rcnmb start
+&rootprompt; rcsmb start
+&rootprompt; rcwinbind start
+</screen>
+		</para></step>
+
+		<step><para>
+		The next step might seem a little odd at this point, but take note that you are about to
+		start <command>winbindd</command>, which must be able to authenticate to the PDC via the
+		localhost interface with the <command>smbd</command> process. This account can be
+		easily created by joining the PDC to the domain by executing the following command:
+<screen>
+&rootprompt; net rpc join -S MASSIVE -U root%not24get
+</screen>
+		Note: Before executing this command on the PDC, both <command>nmbd</command> and
+		<command>smbd</command> must be started so that the <command>net</command> command
+		can communicate with <command>smbd</command>. The expected output is as follows:
+<screen>
+Joined domain MEGANET2.
+</screen>
+		This indicates that the domain security account for the PDC has been correctly created.
+		</para></step>
+
+		<step><para>
+		At this time it is necessary to restart <command>winbindd</command> so that it can
+		correctly authenticate to the PDC. The following command achieves that:
+<screen>
+&rootprompt; rcwinbind restart
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>smbclient</primary></indexterm>
+		You may now check Samba-3 operation as follows:
+<screen>
+&rootprompt; smbclient -L massive -U%
+
+        Sharename      Type      Comment
+        ---------      ----      -------
+        IPC$           IPC       IPC Service (Samba 3.0.20)
+        accounts       Disk      Accounting Files
+        service        Disk      Financial Services Files
+        pidata         Disk      Property Insurance Files
+        apps           Disk      Application Files
+        netlogon       Disk      Network Logon Service
+        profiles       Disk      Profile Share
+        profdata       Disk      Profile Data Share
+        ADMIN$         IPC       IPC Service (Samba 3.0.20)
+
+        Server               Comment
+        ---------            -------
+        MASSIVE              Samba 3.0.20
+
+        Workgroup            Master
+        ---------            -------
+        MEGANET2             MASSIVE
+</screen>
+	This shows that an anonymous connection is working.
+		</para></step>
+
+		<step><para>
+		For your finale, let's try an authenticated connection:
+<screen>
+&rootprompt; smbclient //massive/bobj -Ubobj%n3v3r2l8
+smb: \> dir
+  .                    D        0  Wed Dec 17 01:16:19 2003
+  ..                   D        0  Wed Dec 17 19:04:42 2003
+  bin                  D        0  Tue Sep  2 04:00:57 2003
+  Documents            D        0  Sun Nov 30 07:28:20 2003
+  public_html          D        0  Sun Nov 30 07:28:20 2003
+  .urlview             H      311  Fri Jul  7 06:55:35 2000
+  .dvipsrc             H      208  Fri Nov 17 11:22:02 1995
+
+          57681 blocks of size 524288. 57128 blocks available
+smb: \> q
+</screen>
+		Well done. All is working fine.
+		</para></step>
+	</procedure>
+
+	<para>
+	The server <constant>MASSIVE</constant> is now configured, and it is time to move onto the next task.
+	</para>
+
+	</sect2>
+
+	<sect2 id="sbehap-ptrcfg">
+	<title>Printer Configuration</title>
+
+	<para>
+	<indexterm><primary>CUPS</primary></indexterm>
+	The configuration for Samba-3 to enable CUPS raw-print-through printing has already been
+	taken care of in the &smb.conf; file. The only preparation needed for <constant>smart</constant>
+	printing to be possible involves creation of the directories in which Samba-3 stores
+	Windows printing driver files.
+	</para>
+
+	<procedure>
+	<title>Printer Configuration Steps</title>
+
+                <step><para>
+                Configure all network-attached printers to have a fixed IP address.
+                </para></step>
+
+                <step><para>
+                Create an entry in the DNS database on the server <constant>MASSIVE</constant>
+                in both the forward lookup database for the zone <constant>abmas.biz.hosts</constant>
+                and in the reverse lookup database for the network segment that the printer is to
+                be located in. Example configuration files for similar zones were presented in <link linkend="secure"/>,
+                <link linkend="abmasbiz"/> and in <link linkend="eth2zone"/>.
+                </para></step>
+
+                <step><para>
+                Follow the instructions in the printer manufacturers' manuals to permit printing
+                to port 9100.  Use any other port the manufacturer specifies for direct mode,
+                raw printing.  This allows the CUPS spooler to print using raw mode protocols.
+                <indexterm><primary>CUPS</primary></indexterm>
+                <indexterm><primary>raw printing</primary></indexterm>
+                </para></step>
+
+		<step><para>
+		<indexterm><primary>lpadmin</primary></indexterm>
+                <indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm>
+                Only on the server to which the printer is attached, configure the CUPS Print
+                Queues as follows:
+<screen>
+&rootprompt; lpadmin -p <parameter>printque</parameter>
+	 -v socket://<parameter>printer-name</parameter>.abmas.biz:9100 -E
+</screen>
+                <indexterm><primary>print filter</primary></indexterm>
+                This step creates the necessary print queue to use no assigned print filter. This
+                is ideal for raw printing, that is, printing without use of filters.
+                The name <parameter>printque</parameter> is the name you have assigned for
+                the particular printer.
+                </para></step>
+
+                <step><para>
+                Print queues may not be enabled at creation. Make certain that the queues
+                you have just created are enabled by executing the following:
+<screen>
+&rootprompt; /usr/bin/enable <parameter>printque</parameter>
+</screen>
+                </para></step>
+
+                <step><para>
+                Even though your print queue may be enabled, it is still possible that it
+                may not accept print jobs. A print queue will service incoming printing
+                requests only when configured to do so. Ensure that your print queue is
+                set to accept incoming jobs by executing the following commands:
+<screen>
+&rootprompt; /usr/bin/accept <parameter>printque</parameter>
+</screen>
+                </para></step>
+
+		<step><para>
+                <indexterm><primary>mime type</primary></indexterm>
+                <indexterm><primary>/etc/mime.convs</primary></indexterm>
+                <indexterm><primary>application/octet-stream</primary></indexterm>
+                Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
+<screen>
+application/octet-stream     application/vnd.cups-raw      0     -
+</screen>
+		</para></step>
+
+		 <step><para>
+		 <indexterm><primary>/etc/mime.types</primary></indexterm>
+		 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
+<screen>
+application/octet-stream
+</screen>
+	        </para></step>
+
+	        <step><para>
+	        Refer to the CUPS printing manual for instructions regarding how to configure
+	        CUPS so that print queues that reside on CUPS servers on remote networks
+	        route print jobs to the print server that owns that queue. The default setting
+	        on your CUPS server may automatically discover remotely installed printers and
+	        may permit this functionality without requiring specific configuration.
+	        </para></step>
+
+		<step><para>
+		The following action creates the necessary directory subsystem. Follow these 
+		steps to printing heaven:
+<screen>
+&rootprompt; mkdir -p /var/lib/samba/drivers/{W32ALPHA,W32MIPS,W32X86,WIN40}
+&rootprompt; chown -R root:root /var/lib/samba/drivers
+&rootprompt; chmod -R ug=rwx,o=rx /var/lib/samba/drivers
+</screen>
+		</para></step>
+
+	</procedure>
+
+	</sect2>
+
+</sect1>
+
+<sect1 id="sbehap-bldg1">
+	<title>Samba-3 BDC Configuration</title>
+
+	<procedure>
+	<title>Configuration of BDC Called: <constant>BLDG1</constant></title>
+
+		<step><para>
+		Install the files in <link linkend="sbehap-bldg1-smbconf"/>,
+		<link linkend="sbehap-shareconfa"/>, and <link linkend="sbehap-shareconfb"/>
+		into the <filename>/etc/samba/</filename> directory. The three files
+		should be added together to form the &smb.conf; file.
+		</para></step>
+
+		<step><para>
+		Verify the &smb.conf; file as in step 2 of <link
+	      linkend="sbehap-massive"/>.
+		</para></step>
+
+		<step><para>
+		Carefully follow the steps outlined in <link linkend="sbehap-PAM-NSS"/>, taking
+		particular note to install the correct <filename>ldap.conf</filename>.
+		</para></step>
+
+		<step><para>
+		Verify that the NSS resolver is working. You may need to cycle the run level
+		to 1 and back to 5 before the NSS LDAP resolver functions. Follow these
+		commands:
+<screen>
+&rootprompt; init 1
+</screen>
+		After the run level has been achieved, you are prompted to provide the
+		<constant>root</constant> password. Log on, and then execute:
+<screen>
+&rootprompt; init 5
+</screen>
+		When the normal logon prompt appears, log into the system as <constant>root</constant>
+		and then execute these commands:
+<screen>
+&rootprompt; getent passwd
+root:x:0:0:root:/root:/bin/bash
+bin:x:1:1:bin:/bin:/bin/bash
+daemon:x:2:2:Daemon:/sbin:/bin/bash
+lp:x:4:7:Printing daemon:/var/spool/lpd:/bin/bash
+mail:x:8:12:Mailer daemon:/var/spool/clientmqueue:/bin/false
+...
+root:x:0:512:Netbios Domain Administrator:/root:/bin/bash
+nobody:x:999:514:nobody:/dev/null:/bin/false
+bobj:x:1000:513:System User:/home/bobj:/bin/bash
+stans:x:1001:513:System User:/home/stans:/bin/bash
+chrisr:x:1002:513:System User:/home/chrisr:/bin/bash
+maryv:x:1003:513:System User:/home/maryv:/bin/bash
+vaioboss$:x:1005:553:vaioboss$:/dev/null:/bin/false
+bldg1$:x:1006:553:bldg1$:/dev/null:/bin/false
+</screen>
+		This is the correct output. If the accounts that have UIDs above 512 are not shown, there is a problem.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>getent</primary></indexterm>
+		The next step in the verification process involves testing the operation of UNIX group
+		resolution via the NSS LDAP resolver. Execute these commands:
+<screen>
+&rootprompt; getent group
+root:x:0:
+bin:x:1:daemon
+daemon:x:2:
+sys:x:3:
+...
+Domain Admins:x:512:root
+Domain Users:x:513:bobj,stans,chrisr,maryv,jht
+Domain Guests:x:514:
+Administrators:x:544:
+Users:x:545:
+Guests:x:546:nobody
+Power Users:x:547:
+Account Operators:x:548:
+Server Operators:x:549:
+Print Operators:x:550:
+Backup Operators:x:551:
+Replicator:x:552:
+Domain Computers:x:553:
+Accounts:x:1000:
+Finances:x:1001:
+PIOps:x:1002:
+</screen>
+		This is also the correct and desired output, because it demonstrates that the LDAP client
+		is able to communicate correctly with the LDAP server (<constant>MASSIVE</constant>).
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>smbpasswd</primary></indexterm>
+		You must now set the LDAP administrative password into the Samba-3 <filename>secrets.tdb</filename>
+		file by executing this command:
+<screen>
+&rootprompt; smbpasswd -w not24get
+Setting stored password for "cn=Manager,dc=abmas,dc=biz" in secrets.tdb
+</screen>
+		</para></step>
+
+		<step><para>
+		Now you must obtain the domain SID from the PDC and store it into the
+		<filename>secrets.tdb</filename> file also. This step is not necessary with an LDAP
+		passdb backend because Samba-3 obtains the domain SID from the 
+		sambaDomain object it automatically stores in the LDAP backend. It does not hurt to
+		add the SID to the <filename>secrets.tdb</filename>, and if you wish to do so, this 
+		command can achieve that:
+<screen>
+&rootprompt; net rpc getsid MEGANET2
+Storing SID S-1-5-21-3504140859-1010554828-2431957765 \
+                           for Domain MEGANET2 in secrets.tdb
+</screen>
+		When configuring a Samba-3 BDC that has an LDAP backend, there is no need to take
+		any special action to join it to the domain. However, winbind communicates with the
+		domain controller that is running on the localhost and must be able to authenticate,
+		thus requiring that the BDC should be joined to the domain. The process of joining
+		the domain creates the necessary authentication accounts.
+		</para></step>
+
+		<step><para>
+		To join the Samba BDC to the domain, execute the following:
+<screen>
+&rootprompt; net rpc join -U root%not24get
+Joined domain MEGANET2.
+</screen>
+		This indicates that the domain security account for the BDC has been correctly created.
+		</para></step>
+
+		<step><para>
+		<indexterm>
+			<primary>pdbedit</primary>
+		</indexterm>
+		Verify that user and group account resolution works via Samba-3 tools as follows:
+<screen>
+&rootprompt; pdbedit -L
+root:0:root
+nobody:65534:nobody
+bobj:1000:System User
+stans:1001:System User
+chrisr:1002:System User
+maryv:1003:System User
+bldg1$:1006:bldg1$
+
+&rootprompt; net groupmap list
+Domain Admins (S-1-5-21-3504140859-...-2431957765-512) -> Domain Admins
+Domain Users (S-1-5-21-3504140859-...-2431957765-513) -> Domain Users
+Domain Guests (S-1-5-21-3504140859-...-2431957765-514) -> Domain Guests
+Administrators (S-1-5-21-3504140859-...-2431957765-544) -> Administrators
+...
+Accounts (S-1-5-21-3504140859-1010554828-2431957765-3001) -> Accounts
+Finances (S-1-5-21-3504140859-1010554828-2431957765-3003) -> Finances
+PIOps (S-1-5-21-3504140859-1010554828-2431957765-3005) -> PIOps
+</screen>
+		These results show that all things are in order.
+		</para></step>
+
+                <step><para>
+                The server you have so carefully built is now ready for another important step. Now
+                start the Samba-3 server and validate its operation. Execute the following to render all
+                the processes needed fully operative so that, upon system reboot, they are automatically
+                started:
+<screen>
+&rootprompt; chkconfig named on
+&rootprompt; chkconfig dhcpd on
+&rootprompt; chkconfig nmb on
+&rootprompt; chkconfig smb on
+&rootprompt; chkconfig winbind on
+&rootprompt; rcnmb start
+&rootprompt; rcsmb start
+&rootprompt; rcwinbind start
+</screen>
+		Samba-3 should now be running and is ready for a quick test. But not quite yet!
+                </para></step>
+
+		<step><para>
+		Your new <constant>BLDG1, BLDG2</constant> servers do not have home directories for users.
+		To rectify this using the SUSE yast2 utility or by manually editing the <filename>/etc/fstab</filename>
+		file, add a mount entry to mount the <constant>home</constant> directory that has been exported
+		from the <constant>MASSIVE</constant> server. Mount this resource before proceeding. An alternate
+		approach could be to create local home directories for users who are to use these machines.
+		This is a choice that you, as system administrator, must make. The following entry in the
+		<filename>/etc/fstab</filename> file suffices for now:
+<screen>
+massive.abmas.biz:/home  /home  nfs     rw 0 0
+</screen>
+		To mount this resource, execute:
+<screen>
+&rootprompt; mount -a
+</screen>
+		Verify that the home directory has been mounted as follows:
+<screen>
+&rootprompt; df | grep home
+massive:/home         29532988    283388  29249600   1% /home
+</screen>
+		</para></step>
+
+		<step><para>
+		Implement a quick check using one of the users that is in the LDAP database. Here you go:
+<screen>
+&rootprompt; smbclient //bldg1/bobj -Ubobj%n3v3r2l8
+smb: \> dir
+  .                    D        0  Wed Dec 17 01:16:19 2003
+  ..                   D        0  Wed Dec 17 19:04:42 2003
+  bin                  D        0  Tue Sep  2 04:00:57 2003
+  Documents            D        0  Sun Nov 30 07:28:20 2003
+  public_html          D        0  Sun Nov 30 07:28:20 2003
+  .urlview             H      311  Fri Jul  7 06:55:35 2000
+  .dvipsrc             H      208  Fri Nov 17 11:22:02 1995
+
+          57681 blocks of size 524288. 57128 blocks available
+smb: \> q
+</screen>
+		</para></step>
+
+	</procedure>
+
+	<para>
+	Now that the first BDC (<constant>BDLG1</constant>) has been configured it is time to build 
+	and configure the second BDC server (<constant>BLDG2</constant>) as follows:
+	</para>
+
+	<procedure id="sbehap-bldg2">
+	<title>Configuration of BDC Called <constant>BLDG2</constant></title>
+
+		<step><para>
+		Install the files in <link linkend="sbehap-bldg2-smbconf"/>,
+		<link linkend="sbehap-shareconfa"/>, and <link linkend="sbehap-shareconfb"/>
+		into the <filename>/etc/samba/</filename> directory. The three files
+		should be added together to form the &smb.conf; file.
+		</para></step>
+
+		<step><para>
+		Follow carefully the steps shown in <link linkend="sbehap-bldg1"/>, starting at step 2.
+		</para></step>
+
+	</procedure>
+
+<smbconfexample id="sbehap-bldg1-smbconf">
+<title>LDAP Based &smb.conf; File, Server: BLDG1</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+	<smbconfoption name="unix charset">LOCALE</smbconfoption>
+	<smbconfoption name="workgroup">MEGANET2</smbconfoption>
+	<smbconfoption name="netbios name">BLDG1</smbconfoption>
+	<smbconfoption name="passdb backend">ldapsam:ldap://massive.abmas.biz</smbconfoption>
+	<smbconfoption name="enable privileges">Yes</smbconfoption>
+	<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+	<smbconfoption name="log level">1</smbconfoption>
+	<smbconfoption name="syslog">0</smbconfoption>
+	<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+	<smbconfoption name="max log size">50</smbconfoption>
+	<smbconfoption name="smb ports">139 445</smbconfoption>
+	<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+	<smbconfoption name="printcap name">CUPS</smbconfoption>
+	<smbconfoption name="show add printer wizard">No</smbconfoption>
+	<smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
+	<smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption>
+	<smbconfoption name="logon drive">X:</smbconfoption>
+	<smbconfoption name="domain logons">Yes</smbconfoption>
+	<smbconfoption name="domain master">No</smbconfoption>
+	<smbconfoption name="wins server">172.16.0.1</smbconfoption>
+	<smbconfoption name="ldap suffix">dc=abmas,dc=biz</smbconfoption>
+	<smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
+	<smbconfoption name="ldap user suffix">ou=People</smbconfoption>
+	<smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
+	<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
+	<smbconfoption name="ldap admin dn">cn=Manager,dc=abmas,dc=biz</smbconfoption>
+	<smbconfoption name="idmap backend">ldap:ldap://massive.abmas.biz</smbconfoption>
+	<smbconfoption name="idmap uid">10000-20000</smbconfoption>
+	<smbconfoption name="idmap gid">10000-20000</smbconfoption>
+	<smbconfoption name="printing">cups</smbconfoption>
+	<smbconfoption name="printer admin">root, chrisr</smbconfoption>
+</smbconfexample>
+
+
+<smbconfexample id="sbehap-bldg2-smbconf">
+<title>LDAP Based &smb.conf; File, Server: BLDG2</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+	<smbconfoption name="unix charset">LOCALE</smbconfoption>
+	<smbconfoption name="workgroup">MEGANET2</smbconfoption>
+	<smbconfoption name="netbios name">BLDG2</smbconfoption>
+	<smbconfoption name="passdb backend">ldapsam:ldap://massive.abmas.biz</smbconfoption>
+	<smbconfoption name="enable privileges">Yes</smbconfoption>
+	<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+	<smbconfoption name="log level">1</smbconfoption>
+	<smbconfoption name="syslog">0</smbconfoption>
+	<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+	<smbconfoption name="max log size">50</smbconfoption>
+	<smbconfoption name="smb ports">139 445</smbconfoption>
+	<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+	<smbconfoption name="printcap name">CUPS</smbconfoption>
+	<smbconfoption name="show add printer wizard">No</smbconfoption>
+	<smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
+	<smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption>
+	<smbconfoption name="logon drive">X:</smbconfoption>
+	<smbconfoption name="domain logons">Yes</smbconfoption>
+	<smbconfoption name="domain master">No</smbconfoption>
+	<smbconfoption name="wins server">172.16.0.1</smbconfoption>
+	<smbconfoption name="ldap suffix">dc=abmas,dc=biz</smbconfoption>
+	<smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
+	<smbconfoption name="ldap user suffix">ou=People</smbconfoption>
+	<smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
+	<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
+	<smbconfoption name="ldap admin dn">cn=Manager,dc=abmas,dc=biz</smbconfoption>
+	<smbconfoption name="idmap backend">ldap:ldap://massive.abmas.biz</smbconfoption>
+	<smbconfoption name="idmap uid">10000-20000</smbconfoption>
+	<smbconfoption name="idmap gid">10000-20000</smbconfoption>
+	<smbconfoption name="printing">cups</smbconfoption>
+	<smbconfoption name="printer admin">root, chrisr</smbconfoption>
+</smbconfexample>
+
+
+<smbconfexample id="sbehap-shareconfa">
+<title>LDAP Based &smb.conf; File, Shares Section &smbmdash; Part A</title>
+<smbconfsection name="[accounts]"/>
+	<smbconfoption name="comment">Accounting Files</smbconfoption>
+	<smbconfoption name="path">/data/accounts</smbconfoption>
+	<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[service]"/>
+	<smbconfoption name="comment">Financial Services Files</smbconfoption>
+	<smbconfoption name="path">/data/service</smbconfoption>
+	<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[pidata]"/>
+	<smbconfoption name="comment">Property Insurance Files</smbconfoption>
+	<smbconfoption name="path">/data/pidata</smbconfoption>
+	<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[homes]"/>
+	<smbconfoption name="comment">Home Directories</smbconfoption>
+	<smbconfoption name="valid users">%S</smbconfoption>
+	<smbconfoption name="read only">No</smbconfoption>
+	<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+	<smbconfoption name="comment">SMB Print Spool</smbconfoption>
+	<smbconfoption name="path">/var/spool/samba</smbconfoption>
+	<smbconfoption name="guest ok">Yes</smbconfoption>
+	<smbconfoption name="printable">Yes</smbconfoption>
+	<smbconfoption name="browseable">No</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="sbehap-shareconfb">
+<title>LDAP Based &smb.conf; File, Shares Section &smbmdash; Part B</title>
+<smbconfsection name="[apps]"/>
+	<smbconfoption name="comment">Application Files</smbconfoption>
+	<smbconfoption name="path">/apps</smbconfoption>
+	<smbconfoption name="admin users">bjordan</smbconfoption>
+	<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[netlogon]"/>
+	<smbconfoption name="comment">Network Logon Service</smbconfoption>
+	<smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
+	<smbconfoption name="guest ok">Yes</smbconfoption>
+	<smbconfoption name="locking">No</smbconfoption>
+
+<smbconfsection name="[profiles]"/>
+	<smbconfoption name="comment">Profile Share</smbconfoption>
+	<smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
+	<smbconfoption name="read only">No</smbconfoption>
+	<smbconfoption name="profile acls">Yes</smbconfoption>
+
+<smbconfsection name="[profdata]"/>
+	<smbconfoption name="comment">Profile Data Share</smbconfoption>
+	<smbconfoption name="path">/var/lib/samba/profdata</smbconfoption>
+	<smbconfoption name="read only">No</smbconfoption>
+	<smbconfoption name="profile acls">Yes</smbconfoption>
+
+<smbconfsection name="[print$]"/>
+	<smbconfoption name="comment">Printer Drivers</smbconfoption>
+	<smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
+	<smbconfoption name="browseable">yes</smbconfoption>
+	<smbconfoption name="guest ok">no</smbconfoption>
+	<smbconfoption name="read only">yes</smbconfoption>
+	<smbconfoption name="write list">root, chrisr</smbconfoption>
+</smbconfexample>
+
+<example id="sbehap-ldifadd">
+<title>LDIF IDMAP Add-On Load File &smbmdash; File: /etc/openldap/idmap.LDIF</title>
+<screen>
+dn: ou=Idmap,dc=abmas,dc=biz
+objectClass: organizationalUnit
+ou: idmap
+structuralObjectClass: organizationalUnit
+</screen>
+</example>
+
+</sect1>
+
+<sect1>
+	<title>Miscellaneous Server Preparation Tasks</title>
+
+	<para>
+	My father would say, <quote>Dinner is not over until the dishes have been done.</quote>
+	The makings of a great network environment take a lot of effort and attention to detail.
+	So far, you have completed most of the complex (and to many administrators, the interesting
+	part of server configuration) steps, but remember to tie it all together. Here are
+	a few more steps that must be completed so that your network runs like a well-rehearsed
+	orchestra.
+	</para>
+
+	<sect2>
+	<title>Configuring Directory Share Point Roots</title>
+
+	<para>
+	In your &smb.conf; file, you have specified Windows shares. Each has a <parameter>path</parameter>
+	parameter. Even though it is obvious to all, one of the common Samba networking problems is
+	caused by forgetting to verify that every such share root directory actually exists and that it
+	has the necessary permissions and ownership.
+	</para>
+
+	<para>
+	Here is an example, but remember to create the directory needed for every share:
+<screen>
+&rootprompt; mkdir -p /data/{accounts,finsvcs,piops}
+&rootprompt; mkdir -p /apps
+&rootprompt; chown -R root:root /data
+&rootprompt; chown -R root:root /apps
+&rootprompt; chown -R bobj:Accounts /data/accounts
+&rootprompt; chown -R bobj:Finances /data/finsvcs
+&rootprompt; chown -R bobj:PIOps /data/pidata
+&rootprompt; chmod -R ug+rwxs,o-rwx /data
+&rootprompt; chmod -R ug+rwx,o+rx-w /apps
+</screen>
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Configuring Profile Directories</title>
+
+	<para>
+	You made a conscious decision to do everything it would take to improve network client
+	performance. One of your decisions was to implement folder redirection. This means that Windows
+	user desktop profiles are now made up of two components: a dynamically loaded part and a set of file
+	network folders.
+	</para>
+
+	<para>
+	For this arrangement to work, every user needs a directory structure for the network folder
+	portion of his or her profile as shown here:
+<screen>
+&rootprompt; mkdir -p /var/lib/samba/profdata
+&rootprompt; chown root:root /var/lib/samba/profdata
+&rootprompt; chmod 755 /var/lib/samba/profdata
+
+# Per user structure
+&rootprompt; cd /var/lib/samba/profdata
+&rootprompt; mkdir -p <emphasis>username</emphasis>
+&rootprompt; for i in InternetFiles Cookies History AppData \
+                      LocalSettings MyPictures MyDocuments Recent
+&rootprompt; do
+&rootprompt; mkdir <emphasis>username</emphasis>/$i
+&rootprompt; done
+&rootprompt; chown -R <emphasis>username</emphasis>:Domain\ Users <emphasis>username</emphasis>
+&rootprompt; chmod -R 750 <emphasis>username</emphasis>
+</screen>
+	</para>
+
+	<para>
+	<indexterm><primary>roaming profile</primary></indexterm>
+	<indexterm><primary>mandatory profile</primary></indexterm>
+	You have three options insofar as the dynamically loaded portion of the roaming profile
+	is concerned: 
+	</para>
+
+	<itemizedlist>
+		<listitem><para>You may permit the user to obtain a default profile.</para></listitem>
+		<listitem><para>You can create a mandatory profile.</para></listitem>
+		<listitem><para>You can create a group profile (which is almost always a mandatory profile).</para></listitem>
+	</itemizedlist>
+
+	<para>
+	Mandatory profiles cannot be overwritten by a user. The change from a user profile to a mandatory
+	profile is effected by renaming the <filename>NTUSER.DAT</filename> to <filename>NTUSER.MAN</filename>,
+	that is, just by changing the filename extension.
+	</para>
+
+	<para>
+	<indexterm><primary>SRVTOOLS.EXE</primary></indexterm>
+	<indexterm><primary>Domain User Manager</primary></indexterm>
+	The location of the profile that a user can obtain is set in the user's account in the LDAP passdb backend.
+	You can manage this using the Idealx smbldap-tools or using the 
+	<ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">Windows NT4 Domain User Manager</ulink>.
+	</para>
+
+	<para>
+	It may not be obvious that you must ensure that the root directory for the user's profile exists
+	and has the needed permissions. Use the following commands to create this directory:
+<screen>
+&rootprompt; mkdir -p /var/lib/samba/profiles/<emphasis>username</emphasis>
+&rootprompt; chown <emphasis>username</emphasis>:Domain\ Users
+	    /var/lib/samba/profiles/<emphasis>username</emphasis>
+&rootprompt; chmod 700  /var/lib/samba/profiles/<emphasis>username</emphasis>
+</screen>
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Preparation of Logon Scripts</title>
+
+	<para>
+	<indexterm><primary>logon script</primary></indexterm>
+	The use of a logon script with Windows XP Professional is an option that every site should consider.
+	Unless you have locked down the desktop so the user cannot change anything, there is risk that
+	a vital network drive setting may be broken or that printer connections may be lost. Logon scripts
+	can help to restore persistent network folder (drive) and printer connections in a predictable
+	manner. One situation in which such breakage may occur in particular is when a mobile PC (notebook)
+	user attaches to another company's network that forces environment changes that are alien to your
+	network.
+	</para>
+
+	<para>
+	If you decide to use network logon scripts, by reference to the &smb.conf; files for the domain
+	controllers, you see that the path to the share point for the <constant>NETLOGON</constant>
+	share defined is <filename>/var/lib/samba/netlogon</filename>. The path defined for the logon
+	script inside that share is <filename>scripts\logon.bat</filename>. This means that as a Windows
+	NT/200x/XP client logs onto the network, it tries to obtain the file <filename>logon.bat</filename>
+	from the fully qualified path <filename>/var/lib/samba/netlogon/scripts</filename>. This fully
+	qualified path should therefore exist whether you install the <filename>logon.bat</filename>.
+	</para>
+
+	<para>
+	You can, of course, create the fully qualified path by executing:
+<screen>
+&rootprompt; mkdir -p /var/lib/samba/netlogon/scripts
+</screen>
+	</para>
+
+	<para>
+	You should research the options for logon script implementation by referring to <emphasis>TOSHARG</emphasis>, Chapter 24,
+	Section 24.4. A quick Web search will bring up a host of options. One of the most popular logon
+	facilities in use today is called <ulink url="http://www.kixtart.org">KiXtart</ulink>.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Assigning User Rights and Privileges</title>
+
+	<para>
+	The ability to perform tasks such as joining Windows clients to the domain can be assigned to
+	normal user accounts. By default, only the domain administrator account (<constant>root</constant> on UNIX
+	systems because it has UID=0) can add accounts. New to Samba 3.0.11 is the ability to grant
+	this privilege in a very limited fashion to particular accounts.
+	</para>
+
+	<para>
+	By default, even Samba-3.0.11 does not grant any rights even to the <constant>Domain Admins</constant>
+	group. Here we grant this group all privileges.
+	</para>
+
+	<para>
+	Samba limits privileges on a per-server basis. This is a deliberate limitation so that users who
+	are granted rights can be restricted to particular machines. It is left to the network administrator
+	to determine which rights should be provided and to whom.
+	</para>
+
+	<procedure>
+	<title>Steps for Assignment of User Rights and Privileges</title>
+
+		<step><para>
+		Log onto the PDC as the <constant>root</constant> account.
+		</para></step>
+
+		<step><para>
+		Execute the following command to grant the <constant>Domain Admins</constant> group all
+		rights and privileges:
+<screen>
+&rootprompt; net -S MASSIVE  -U root%not24get rpc rights grant \
+        "MEGANET2\Domain Admins" SeMachineAccountPrivilege \
+	SePrintOperatorPrivilege SeAddUsersPrivilege \
+	SeDiskOperatorPrivilege SeRemoteShutdownPrivilege
+Successfully granted rights.
+</screen>
+		Repeat this step on each domain controller, in each case substituting the name of the server
+		(e.g., BLDG1, BLDG2) in place of the PDC called MASSIVE.
+		</para></step>
+
+		<step><para>
+		In this step the privilege will be granted to Bob Jordan (bobj) to add Windows workstations
+		to the domain. Execute the following only on the PDC. It is not necessary to do this on
+		BDCs or on DMS machines because machine accounts are only ever added by the PDC:
+<screen>
+&rootprompt; net -S MASSIVE  -U root%not24get rpc rights grant \
+             "MEGANET2\bobj" SeMachineAccountPrivilege
+Successfully granted rights.
+</screen>
+		</para></step>
+
+		<step><para>
+		Verify that privilege assignments have been correctly applied by executing:
+<screen>
+net rpc rights list accounts -Uroot%not24get
+MEGANET2\bobj
+SeMachineAccountPrivilege
+
+S-0-0
+No privileges assigned
+
+BUILTIN\Print Operators
+No privileges assigned
+
+BUILTIN\Account Operators
+No privileges assigned
+
+BUILTIN\Backup Operators
+No privileges assigned
+
+BUILTIN\Server Operators
+No privileges assigned
+
+BUILTIN\Administrators
+No privileges assigned
+
+Everyone
+No privileges assigned
+
+MEGANET2\Domain Admins
+SeMachineAccountPrivilege
+SePrintOperatorPrivilege
+SeAddUsersPrivilege
+SeRemoteShutdownPrivilege
+SeDiskOperatorPrivilege
+</screen>
+		</para></step>
+
+	</procedure>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Windows Client Configuration</title>
+
+	<para>
+	<indexterm><primary>NETLOGON</primary></indexterm>
+	In the next few sections, you can configure a new Windows XP Professional disk image on a staging
+	machine. You will configure all software, printer settings, profile and policy handling, and desktop
+	default profile settings on this system. When it is complete, you copy the contents of the
+	<filename>C:\Documents and Settings\Default User</filename> directory to a directory with the same
+	name in the <constant>NETLOGON</constant> share on the domain controllers.
+	</para>
+
+	<para>
+	Much can be learned from the Microsoft Support site regarding how best to set up shared profiles.
+	One knowledge-base article in particular stands out:
+	"<ulink url="http://support.microsoft.com/default.aspx?scid=kb;EN-US;168475">How to Create a 
+	Base Profile for All Users."</ulink>
+
+	</para>
+
+	<sect2 id="redirfold">
+	<title>Configuration of Default Profile with Folder Redirection</title>
+
+	<para>
+	<indexterm><primary>folder redirection</primary></indexterm>
+	Log onto the Windows XP Professional workstation as the local <constant>Administrator</constant>.
+	It is necessary to expose folders that are generally hidden to provide access to the
+	<constant>Default User</constant> folder.
+	</para>
+
+	<procedure>
+	<title>Expose Hidden Folders</title>
+
+		<step><para>
+		Launch the Windows Explorer by clicking
+			<menuchoice>
+                                <guimenu>Start</guimenu>
+                                <guimenuitem>My Computer</guimenuitem>
+                                <guimenuitem>Tools</guimenuitem>
+                                <guimenuitem>Folder Options</guimenuitem>
+                                <guimenuitem>View Tab</guimenuitem>
+                        </menuchoice>.
+		Select <guilabel>Show hidden files and folders</guilabel>,
+		and click <guibutton>OK</guibutton>.  Exit Windows Explorer.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>regedt32</primary></indexterm>
+		Launch the Registry Editor. Click 
+		<menuchoice>
+			<guimenu>Start</guimenu>
+			<guimenuitem>Run</guimenuitem>
+		</menuchoice>. Key in <command>regedt32</command>, and click
+		<guibutton>OK</guibutton>.
+		</para></step>
+
+	</procedure>
+
+	<para>
+	</para>
+
+	<procedure id="sbehap-rdrfldr">
+	<title>Redirect Folders in Default System User Profile</title>
+
+		<step><para>
+		<indexterm><primary>HKEY_LOCAL_MACHINE</primary></indexterm>
+		<indexterm><primary>Default User</primary></indexterm>
+		Give focus to <constant>HKEY_LOCAL_MACHINE</constant> hive entry in the left panel.
+		Click <menuchoice>
+			<guimenu>File</guimenu>
+			<guimenuitem>Load Hive...</guimenuitem>
+			<guimenuitem>Documents and Settings</guimenuitem>
+			<guimenuitem>Default User</guimenuitem>
+			<guimenuitem>NTUSER</guimenuitem>
+			<guimenuitem>Open</guimenuitem>
+		      </menuchoice>. In the dialog box that opens, enter the key name
+		<constant>Default</constant> and click <guibutton>OK</guibutton>.
+		</para></step>
+
+		<step><para>
+		Browse inside the newly loaded Default folder to:
+<screen>
+HKEY_LOCAL_MACHINE\Default\Software\Microsoft\Windows\
+                     CurrentVersion\Explorer\User Shell Folders\
+</screen>
+		The right panel reveals the contents as shown in <link linkend="XP-screen001"/>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>%USERPROFILE%</primary></indexterm>
+		<indexterm><primary>%LOGONSERVER%</primary></indexterm>
+		You edit hive keys. Acceptable values to replace the 
+		<constant>%USERPROFILE%</constant> variable includes:
+
+		<itemizedlist>
+			<listitem><para>A drive letter such as <constant>U:</constant></para></listitem>
+			<listitem><para>A direct network path such as
+				<constant>\\MASSIVE\profdata</constant></para></listitem>
+			<listitem><para>A network redirection (UNC name) that contains a macro such as </para>
+				<para><constant>%LOGONSERVER%\profdata\</constant></para></listitem>
+		</itemizedlist>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>registry keys</primary></indexterm>
+		Set the registry keys as shown in <link linkend="proffold"/>. Your implementation makes the assumption
+		that users have statically located machines. Notebook computers (mobile users) need to be
+		accommodated using local profiles. This is not an uncommon assumption.
+		</para></step>
+
+		<step><para>
+		Click back to the root of the loaded hive <constant>Default</constant>.
+		Click <menuchoice><guimenu>File</guimenu><guimenuitem>Unload Hive...</guimenuitem>
+		<guimenuitem>Yes</guimenuitem></menuchoice>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>Registry Editor</primary></indexterm>
+		Click <menuchoice><guimenu>File</guimenu><guimenuitem>Exit</guimenuitem></menuchoice>. This exits the
+		Registry Editor.
+		</para></step>
+
+		<step><para>
+		Now follow the procedure given in <link linkend="sbehap-locgrppol"/>. Make sure that each folder you
+		have redirected is in the exclusion list.
+		</para></step>
+
+		<step><para>
+		You are now ready to copy<footnote><para>
+			There is an alternate method by which a default user profile can be added to the
+			<constant>NETLOGON</constant> share. This facility in the Windows System tool 
+			permits profiles to be exported. The export target may be a particular user or 
+			group profile share point or else the <constant>NETLOGON</constant> share. 
+			In this case, the profile directory must be named <constant>Default User</constant>.
+			</para></footnote> 
+		the Default User profile to the Samba domain controllers. Launch Microsoft Windows Explorer,
+		and use it to copy the full contents of the directory <filename>Default User</filename> that
+		is in the <filename>C:\Documents and Settings</filename> to the root directory of the
+		<constant>NETLOGON</constant> share. If the <constant>NETLOGON</constant> share has the defined
+		UNIX path of <filename>/var/lib/samba/netlogon</filename>, when the copy is complete there must
+		be a directory in there called <filename>Default User</filename>.
+		</para></step>
+
+	</procedure>
+
+	<para>
+	Before punching out new desktop images for the client workstations, it is perhaps a good idea that
+	desktop behavior should be returned to the original Microsoft settings. The following steps achieve
+	that ojective:
+	</para>
+
+	<procedure>
+	<title>Reset Folder Display to Original Behavior</title>
+
+		<step><para>
+		To launch the Windows Explorer, click
+			<menuchoice>
+                                <guimenu>Start</guimenu>
+                                <guimenuitem>My Computer</guimenuitem>
+                                <guimenuitem>Tools</guimenuitem>
+                                <guimenuitem>Folder Options</guimenuitem>
+                                <guimenuitem>View Tab</guimenuitem>
+                        </menuchoice>.
+		Deselect <guilabel>Show hidden files and folders</guilabel>, and click <guibutton>OK</guibutton>.
+		Exit Windows Explorer.
+		</para></step>
+
+	</procedure>
+
+	<image id="XP-screen001">
+		<imagedescription>Windows XP Professional &smbmdash; User Shared Folders</imagedescription>
+		<imagefile scale="65">XP-screen001</imagefile>
+	</image>
+
+<table id="proffold">
+	<title>Default Profile Redirections</title>
+	<tgroup cols="2">
+		<colspec align="left"/>
+		<colspec align="left"/>
+		<thead>
+			<row>
+				<entry>Registry Key</entry>
+				<entry>Redirected Value</entry>
+			</row>
+		</thead>
+		<tbody>
+			<row>
+				<entry>Cache</entry>
+				<entry>%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</entry>
+			</row>
+			<row>
+				<entry>Cookies</entry>
+				<entry>%LOGONSERVER%\profdata\%USERNAME%\Cookies</entry>
+			</row>
+			<row>
+				<entry>History</entry>
+				<entry>%LOGONSERVER%\profdata\%USERNAME%\History</entry>
+			</row>
+			<row>
+				<entry>Local AppData</entry>
+				<entry>%LOGONSERVER%\profdata\%USERNAME%\AppData</entry>
+			</row>
+			<row>
+				<entry>Local Settings</entry>
+				<entry>%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</entry>
+			</row>
+			<row>
+				<entry>My Pictures</entry>
+				<entry>%LOGONSERVER%\profdata\%USERNAME%\MyPictures</entry>
+			</row>
+			<row>
+				<entry>Personal</entry>
+				<entry>%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</entry>
+			</row>
+			<row>
+				<entry>Recent</entry>
+				<entry>%LOGONSERVER%\profdata\%USERNAME%\Recent</entry>
+			</row>
+		</tbody>
+	</tgroup>
+</table>
+
+	</sect2>
+
+	<sect2>
+	<title>Configuration of MS Outlook to Relocate PST File</title>
+
+	<para>
+	<indexterm><primary>Outlook</primary><secondary>PST</secondary></indexterm>
+	Microsoft Outlook can store a Personal Storage file, generally known as a PST file.
+	It is the nature of email storage that this file grows, at times quite rapidly.
+	So that users' email is available to them at every workstation they may log onto,
+	it is common practice in well-controlled sites to redirect the PST folder to the
+	users' home directory. Follow these steps for each user who wishes to do this.
+	</para>
+
+	<note><para>
+	It is presumed that Outlook Express has been configured for use.
+	</para></note>
+
+	<para>
+	Launch Outlook Express 6. Click
+	<menuchoice>
+		<guimenu>Tools</guimenu>
+		<guimenuitem>Options</guimenuitem>
+		<guimenuitem>Maintenance</guimenuitem>
+		<guimenuitem>Store Folder</guimenuitem>
+		<guimenuitem>Change</guimenuitem>
+	</menuchoice>.
+	</para>
+
+	<para>
+	Follow the on-screen prompts to relocate the PST file to the desired location.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Configure Delete Cached Profiles on Logout</title>
+
+	<para>
+	Configure the Windows XP Professional client to auto-delete roaming profiles on logout:
+	</para>
+
+	<para>
+	<indexterm><primary>MMC</primary></indexterm>
+	Click 
+	<menuchoice>
+		<guimenu>Start</guimenu>
+		<guimenuitem>Run</guimenuitem>
+	</menuchoice>. In the dialog box, enter <command>MMC</command> and click <guibutton>OK</guibutton>.
+	</para>
+
+	<para>
+	Follow these steps to set the default behavior of the staging machine so that all roaming
+	profiles are deleted as network users log out of the system. Click
+	<menuchoice>
+		<guimenu>File</guimenu>
+		<guimenuitem>Add/Remove Snap-in</guimenuitem>
+		<guimenuitem>Add</guimenuitem>
+		<guimenuitem>Group Policy</guimenuitem>
+		<guimenuitem>Add</guimenuitem>
+		<guimenuitem>Finish</guimenuitem>
+		<guimenuitem>Close</guimenuitem>
+		<guimenuitem>OK</guimenuitem>
+	</menuchoice>. 
+	</para>
+
+	<para>
+	<indexterm><primary>Microsoft Management Console</primary><see>MMC</see></indexterm>
+	The Microsoft Management Console now shows the <guimenu>Group Policy</guimenu>
+	utility that enables you to set the policies needed. In the left panel, click
+	<menuchoice>
+		<guimenuitem>Local Computer Policy</guimenuitem>
+		<guimenuitem>Administrative Templates</guimenuitem>
+		<guimenuitem>System</guimenuitem>
+		<guimenuitem>User Profiles</guimenuitem>
+	</menuchoice>. In the right panel, set the properties shown here by double-clicking on each
+	item as shown:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>Do not check for user ownership of Roaming Profile Folders = Enabled</para></listitem>
+		<listitem><para>Delete cached copies of roaming profiles = Enabled</para></listitem>
+	</itemizedlist>
+
+	<para>
+	Close the Microsoft Management Console. The settings take immediate effect and persist onto all image copies
+	made of this system to deploy the new standard desktop system.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Uploading Printer Drivers to Samba Servers</title>
+
+	<para>
+	<indexterm><primary>printing</primary><secondary>drag-and-drop</secondary></indexterm>
+	Users want to be able to use network printers. You have a vested interest in making
+	it easy for them to print. You have chosen to install the printer drivers onto the Samba
+	servers and to enable point-and-click (drag-and-drop) printing. This process results in
+	Samba being able to automatically provide the Windows client with the driver necessary to
+	print to the printer chosen. The following procedure must be followed for every network
+	printer:
+	</para>
+
+	<procedure>
+	<title>Steps to Install Printer Drivers on the Samba Servers</title>
+
+		<step><para>
+		Join your Windows XP Professional workstation (the staging machine) to the 
+		<constant>MEGANET2</constant> domain. If you are not sure of the procedure, 
+		follow the guidance given in Appendix A, <link linkend="domjoin"/>.
+		</para></step>
+
+		<step><para>
+		After the machine has rebooted, log onto the workstation as the domain
+		<constant>root</constant> (this is the Administrator account for the 
+		operating system that is the host platform for this implementation of Samba.
+		</para></step>
+
+		<step><para>
+		Launch MS Windows Explorer. Navigate in the left panel. Click
+		<menuchoice>
+			<guimenu>My Network Places</guimenu>
+			<guimenuitem>Entire Network</guimenuitem>
+			<guimenuitem>Microsoft Windows Network</guimenuitem>
+			<guimenuitem>Meganet2</guimenuitem>
+			<guimenuitem>Massive</guimenuitem>
+		</menuchoice>. Click on <guimenu>Massive</guimenu>
+			<guimenu>Printers and Faxes</guimenu>.
+		</para></step>
+
+		<step><para>
+		Identify a printer that is shown in the right panel. Let us assume the printer is called 
+		<constant>ps01-color</constant>. Right-click on the <guimenu>ps01-color</guimenu> icon
+		and select the <guimenu>Properties</guimenu> entry. This opens a dialog box that indicates
+		that <quote>The printer driver is not installed on this computer. Some printer properties
+		will not be accessible unless you install the printer driver. Do you want to install the
+		driver now?</quote> It is important at this point you answer <guimenu>No</guimenu>.
+		</para></step>
+
+		<step><para>
+		The printer properties panel for the <guimenu>ps01-color</guimenu> printer on the server 
+		<constant>MASSIVE</constant> is displayed. Click the <guimenu>Advanced</guimenu> tab.
+		Note that the box labeled <guimenu>Driver</guimenu> is empty. Click the <guimenu>New Driver</guimenu>
+		button that is next to the <guimenu>Driver</guimenu> box. This launches the <quote>Add Printer Wizard</quote>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>Add Printer Wizard</primary><secondary>APW</secondary></indexterm>
+		<indexterm><primary>APW</primary></indexterm>
+		The <quote>Add Printer Driver Wizard on <constant>MASSIVE</constant></quote> panel 
+		is now presented. Click <guimenu>Next</guimenu> to continue. From the left panel, select the 
+		printer manufacturer. In your case, you are adding a driver for a printer manufactured by 
+		Lexmark. In the right panel, select the printer (Lexmark Optra Color 40 PS). Click 
+		<guimenu>Next</guimenu>, and then <guimenu>Finish</guimenu> to commence driver upload. A 
+		progress bar appears and instructs you as each file is being uploaded and that it is being 
+		directed at the network server <constant>\\massive\ps01-color</constant>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>printers</primary><secondary>Advanced</secondary></indexterm>
+		<indexterm><primary>printers</primary><secondary>Properties</secondary></indexterm>
+		<indexterm><primary>printers</primary><secondary>Sharing</secondary></indexterm>
+		<indexterm><primary>printers</primary><secondary>General</secondary></indexterm>
+		<indexterm><primary>printers</primary><secondary>Security</secondary></indexterm>
+		<indexterm><primary>AD printer publishing</primary></indexterm>
+		The driver upload completes in anywhere from a few seconds to a few minutes. When it completes,
+		you are returned to the <guimenu>Advanced</guimenu> tab in the <guimenu>Properties</guimenu> panel. 
+		You can set the Location (under the <guimenu>General</guimenu> tab) and Security settings (under 
+		the <guimenu>Security</guimenu> tab). Under the <guimenu>Sharing</guimenu> tab it is possible to
+		load additional printer drivers; there is also a check-box in this tab called <quote>List in the
+		directory</quote>. When this box is checked, the printer will be published in Active Directory
+		(Applicable to Active Directory use only.)
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>printers</primary><secondary>Default Settings</secondary></indexterm>
+		Click <guimenu>OK</guimenu>. It will take a minute or so to upload the settings to the server. 
+		You are now returned to the <guimenu>Printers and Faxes on Massive</guimenu> monitor.
+		Right-click on the printer, click <menuchoice><guimenu>Properties</guimenu> 
+		<guimenuitem>Device Settings</guimenuitem> </menuchoice>.  Now change the settings to suit 
+		your requirements. BE CERTAIN TO CHANGE AT LEAST ONE SETTING and apply the changes even if 
+		you need to reverse the changes back to their original settings. 
+		</para></step>
+
+		<step><para>
+		This is necessary so that the printer settings are initialized in the Samba printers
+		database. Click <guimenu>Apply</guimenu> to commit your settings. Revert any settings you changed
+		just to initialize the Samba printers database entry for this printer. If you need to revert a setting,
+		click <guimenu>Apply</guimenu> again.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>Print Test Page</primary></indexterm>
+		Verify that all printer settings are at the desired configuration. When you are satisfied that they are,
+		click the <guimenu>General</guimenu> tab. Now click the <guimenu>Print Test Page</guimenu> button.
+		A test page should print. Verify that it has printed correctly. Then click <guimenu>OK</guimenu>
+		in the panel that is newly presented. Click <guimenu>OK</guimenu> on the <guimenu>ps01-color on 
+		massive Properties</guimenu> panel.
+		</para></step>
+
+		<step><para>
+		You must repeat this process for all network printers (i.e., for every printer on each server).
+		When you have finished uploading drivers to all printers, close all applications. The next task
+		is to install software your users require to do their work.
+		</para></step>
+
+	</procedure>
+
+	</sect2>
+
+	<sect2>
+	<title>Software Installation</title>
+
+	<para>
+	Your network has both fixed desktop workstations as well as notebook computers. As a general rule, it is
+	a good idea to not tamper with the operating system that is provided by the notebook computer manufacturer.
+	Notebooks require special handling that is beyond the scope of this chapter.
+	</para>
+
+	<para>
+	For desktop systems, the installation of software onto administratively centralized application servers
+	make a lot of sense. This means that you can manage software maintenance from a central
+	perspective and that only minimal application stubware needs to be installed onto the desktop
+	systems. You should proceed with software installation and default configuration as far as is humanly
+	possible and so long as it makes sense to do so. Make certain to thoroughly test and validate every aspect
+	of software operations and configuration.
+	</para>
+
+	<para>
+	When you believe that the overall configuration is complete, be sure to create a shared group profile
+	and migrate that to the Samba server for later reuse when creating custom mandatory profiles, just in
+	case a user may have specific needs you had not anticipated.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Roll-out Image Creation</title>
+
+	<para>
+	The final steps before preparing the distribution Norton Ghost image file you might follow are:
+	</para>
+
+	<blockquote><para>
+	Unjoin the domain &smbmdash; Each workstation requires a unique name and must be independently
+	joined into domain membership.
+	</para></blockquote>
+
+	<blockquote><para>
+	Defragment the hard disk &smbmdash; While not obvious to the uninitiated, defragmentation results
+	in better performance and often significantly reduces the size of the compressed disk image. That
+	also means it will take less time to deploy the image onto 500 workstations.
+	</para></blockquote>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Key Points Learned</title>
+
+	<para>
+	This chapter introduced many new concepts. Is it a sad fact that the example presented deliberately
+	avoided any consideration of security. Security does not just happen; you must design it into your total
+	network. Security begins with a systems design and implementation that anticipates hostile behavior from
+	users both inside and outside the organization. Hostile and malicious intruders do not respect barriers;
+	they accept them as challenges. For that reason, if not simply from a desire to establish safe networking
+	practices, you must not deploy the design presented in this book in an environment where there is risk
+	of compromise.
+	</para>
+
+	<para>
+	<indexterm><primary>Access Control Lists</primary><see>ACLs</see></indexterm>
+	<indexterm><primary>ACLs</primary></indexterm>
+	As a minimum, the LDAP server must be protected by way of Access Control Lists (ACLs), and it must be
+	configured to use secure protocols for all communications over the network. Of course, secure networking
+	does not result just from systems design and implementation but involves constant user education
+	training and, above all, disciplined attention to detail and constant searching for signs of unfriendly
+	or alien activities. Security is itself a topic for a whole book. Please do consult appropriate sources.
+	Jerry Carter's book <ulink url="http://www.booksense.com/product/info.jsp&amp;isbn=1565924916">
+	<emphasis>LDAP System Administration</emphasis></ulink> is a good place to start reading about OpenLDAP
+	as well as security considerations.
+	</para>
+
+	<para>
+	The substance of this chapter that has been deserving of particular attention includes:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		Implementation of an OpenLDAP-based passwd backend, necessary to support distributed
+		domain control.
+		</para></listitem>
+
+		<listitem><para>
+		Implementation of Samba primary and secondary domain controllers with a common LDAP backend
+		for user and group accounts that is shared with the UNIX system through the PADL nss_ldap and
+		pam_ldap tool-sets.
+		</para></listitem>
+
+		<listitem><para>
+		Use of the Idealx smbldap-tools scripts for UNIX (POSIX) account management as well as
+		to manage Samba Windows user and group accounts.
+		</para></listitem>
+
+		<listitem><para>
+		The basics of implementation of Group Policy controls for Windows network clients.
+		</para></listitem>
+
+		<listitem><para>
+		Control over roaming profiles, with particular focus on folder redirection to network drives.
+		</para></listitem>
+
+		<listitem><para>
+		Use of the CUPS printing system together with Samba-based printer driver auto-download.
+		</para></listitem>
+	</itemizedlist>
+
+</sect1>
+
+
+<sect1>
+	<title>Questions and Answers</title>
+
+	<para>
+	Well, here we are at the end of this chapter and we have only ten questions to help you to
+	remember so much. There are bound to be some sticky issues here.
+	</para>
+
+	<qandaset defaultlabel="chap06qa">
+	<qandaentry>
+	<question>
+
+		<para>
+		Why did you not cover secure practices? Isn't it rather irresponsible to instruct
+		network administrators to implement insecure solutions?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Let's get this right. This is a book about Samba, not about OpenLDAP and secure
+		communication protocols for subjects other than Samba. Earlier on, you note,
+		that the dynamic DNS and DHCP solutions also used no protective secure communications
+		protocols. The reason for this is simple: There are so many ways of implementing
+		secure protocols that this book would have been even larger and more complex.
+		</para>
+
+		<para>
+		The solutions presented here all work (at least they did for me). Network administrators
+		have the interest and the need to be better trained and instructed in secure networking
+		practices and ought to implement safe systems. I made the decision, right or wrong,
+		to keep this material as simple as possible. The intent of this book is to demonstrate
+		a working solution and not to discuss too many peripheral issues.
+		</para>
+
+		<para>
+		This book makes little mention of backup techniques. Does that mean that I am recommending
+		that you should implement a network without provision for data recovery and for disaster
+		management? Back to our focus: The deployment of Samba has been clearly demonstrated.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		You have focused much on SUSE Linux and little on the market leader, Red Hat. Do
+		you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant
+		to the Linux I might be using?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Both Red Hat Linux and SUSE Linux comply with the Linux Standards Base specifications
+		for a standard Linux distribution. The differences are marginal. Surely you know
+		your Linux platform, and you do have access to administration manuals for it. This
+		book is not a Linux tutorial; it is a Samba tutorial. Let's keep the focus on
+		the Samba part of the book; all the other bits are peripheral (but important) to
+		creation of a total network solution. 
+		</para>
+
+		<para>
+		What I find interesting is the attention reviewers give to Linux installation and to
+		the look and feel of the desktop, but does that make for a great server? In this book,
+		I have paid particular attention to the details of creating a whole solution framework.
+		I have not tightened every nut and bolt, but I have touched on all the issues you
+		need to be familiar with. Over the years many people have approached me wanting to
+		know the details of exactly how to implement a DHCP and dynamic DNS server with Samba
+		and WINS. In this chapter, it is plain to see what needs to be configured to provide
+		transparent interoperability. Likewise for CUPS and Samba interoperation. These are
+		key stumbling areas for many people.
+		</para>
+
+		<para>
+		At every critical junction, I have provided comparative guidance for both SUSE and
+		Red Hat Linux. Both manufacturers have done a great job in furthering the cause
+		of open source software. I favor neither and respect both. I like particular
+		features of both products (companies also). No bias in presentation is intended.
+		Oh, before I forget, I particularly like Debian Linux; that is my favorite playground.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		You did not use SWAT to configure Samba. Is there something wrong with it?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		That is a good question. As it is, the &smb.conf; file configurations are presented
+		in as direct a format as possible. Adding SWAT into the equation would have complicated
+		matters. I sought simplicity of implementation. The fact is that I did use SWAT to
+		create the files in the first place.
+		</para>
+
+		<para>
+		There are people in the Linux and open source community who feel that SWAT is dangerous
+		and insecure. Many will not touch it with a barge-pole. By not introducing SWAT, I
+		hope to have brought their interests on board. SWAT is well covered is <emphasis>TOSHARG</emphasis>.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		You have exposed a well-used password <emphasis>not24get</emphasis>. Is that
+		not irresponsible? 
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Well, I had to use a password of some sort. At least this one has been consistently
+		used throughout. I guess you can figure out that in a real deployment it would make 
+		sense to use a more secure and original password.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		The Idealx smbldap-tools create many domain group accounts that are not used. Is that
+		a good thing?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		I took this up with Idealx and found them most willing to change that in the next version.
+		Let's give Idealx some credit for the contribution they have made. I appreciate their work
+		and, besides, it does no harm to create accounts that are not now used &smbmdash; at some time 
+		Samba may well use them.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Can I use LDAP just for Samba accounts and not for UNIX system accounts?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Yes, you can do that for user accounts only. Samba requires there to be a POSIX (UNIX)
+		group account for every Windows domain group account. But if you put your users into
+		the system password account, how do you plan to keep all domain controller system
+		password files in sync? I think that having everything in LDAP makes a lot of sense
+		for the UNIX administrator who is still learning the craft and is migrating from MS Windows.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why are the Windows domain RID portions not the same as the UNIX UID?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Samba uses a well-known public algorithm for assigning RIDs from UIDs and GIDs.
+		This algorithm ought to ensure that there will be no clashes with well-known RIDs.
+		Well-known RIDs have special significance to MS Windows clients. The automatic
+		assignment used the calculation: RID = UID x 2 + 1000. Of course, Samba does
+		permit you to override that to some extent. See the &smb.conf; man page entry
+		for <parameter>algorithmic rid base</parameter>.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Printer configuration examples all show printing to the HP port 9100. Does this
+		mean that I must have HP printers for these solutions to work?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		No. You can use any type of printer and must use the interfacing protocol supported
+		by the printer. Many networks use LPR/LPD print servers to which are attached
+		PCL printers, inkjet printers, plotters, and so on. At home I use a USB-attached
+		inkjet printer. Use the appropriate device URI (Universal Resource Interface)
+		argument to the <constant>lpadmin -v</constant> option that is right for your
+		printer.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Is folder redirection dangerous? I've heard that you can lose your data that way.
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The only loss of data I know of that involved folder redirection was caused by
+		manual misuse of the redirection tool. The administrator redirected a folder to
+		a network drive and said he wanted to migrate (move) the data over. Then he 
+		changed his mind, so he moved the folder back to the roaming profile. This time,
+		he declined to move the data because he thought it was still in the local profile
+		folder. That was not the case, so by declining to move the data back, he wiped out
+		the data. You cannot hold the tool responsible for that. Caveat emptor still applies.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Is it really necessary to set a local Group Policy to exclude the redirected
+		folders from the roaming profile?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Yes. If you do not do this, the data will still be copied from the network folder
+		(share) to the local cached copy of the profile.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	</qandaset>
+
+</sect1>
+
+</chapter>
diff --git a/docs/Samba3-ByExample/SBE-MigrateNT4Samba3.xml b/docs/Samba3-ByExample/SBE-MigrateNT4Samba3.xml
new file mode 100644
index 0000000000..ffeba2254e
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-MigrateNT4Samba3.xml
@@ -0,0 +1,1778 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="ntmigration">
+  <title>Migrating NT4 Domain to Samba-3</title>
+
+	<para>
+	Ever since Microsoft announced that it was discontinuing support for Windows
+	NT4, Samba users started to ask for detailed instructions on how to migrate
+	from NT4 to Samba-3. This chapter provides background information that should
+	meet these needs.
+	</para>
+
+	<para>
+	One wonders how many NT4 systems will be left in service by the time you read this
+	book though.
+	</para>
+
+<sect1>
+	<title>Introduction</title>
+
+      <para><indexterm>
+	  <primary>migration</primary>
+	</indexterm>
+	Network administrators who want to migrate off a Windows NT4 environment know
+	one thing with certainty. They feel that NT4 has been abandoned, and they want
+	to update. The desire to get off NT4 and to not adopt Windows 200x and Active
+	Directory is driven by a mixture of concerns over complexity, cost, fear of
+	failure, and much more.
+	</para>
+
+	<para>
+	<indexterm><primary>group policies</primary></indexterm>
+	<indexterm><primary>accounts</primary><secondary>user</secondary></indexterm>
+	<indexterm><primary>accounts</primary><secondary>group</secondary></indexterm>
+	<indexterm><primary>accounts</primary><secondary>machine</secondary></indexterm>
+	The migration from NT4 to Samba-3 can involve a number of factors, including
+	migration of data to another server, migration of network environment controls
+	such as group policies, and migration of the users, groups, and machine
+	accounts.
+	</para>
+
+	<para>
+	<indexterm><primary>accounts</primary><secondary>Domain</secondary></indexterm>
+	It should be pointed out now that it is possible to migrate some systems from
+	a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly
+	not possible in every case. It is possible to just migrate the domain accounts
+	to Samba-3 and then to switch machines, but as a hands-off transition, this is more
+	the exception than the rule. Most systems require some tweaking after
+	migration before an environment that is acceptable for immediate use
+	is obtained.
+	</para>
+
+	<sect2>
+	<title>Assignment Tasks</title>
+
+	<para>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>ldapsam</primary></indexterm>
+	<indexterm><primary>passdb backend</primary></indexterm>
+	You are about to migrate an MS Windows NT4 domain accounts database to
+	a Samba-3 server. The Samba-3 server is using a 
+	<parameter>passdb backend</parameter> based on LDAP. The 
+	<constant>ldapsam</constant> is ideal because an LDAP backend can be distributed
+	for use with BDCs &smbmdash; generally essential for larger networks.
+	</para>
+
+	<para>
+	Your objective is to document the process of migrating user and group accounts
+	from several NT4 domains into a single Samba-3 LDAP backend database.
+	</para>
+
+	</sect2>
+</sect1>
+
+<sect1>
+	<title>Dissection and Discussion</title>
+
+	<para>
+	<indexterm><primary>snap-shot</primary></indexterm>
+	<indexterm><primary>NT4 registry</primary></indexterm>
+	<indexterm><primary>registry</primary><secondary>keys</secondary><tertiary>SAM</tertiary></indexterm>
+	<indexterm><primary>registry</primary><secondary>keys</secondary><tertiary>SECURITY</tertiary></indexterm>
+	<indexterm><primary>SAM</primary></indexterm>
+	<indexterm><primary>Security Account Manager</primary><see>SAM</see></indexterm>
+	The migration process takes a snapshot of information that is stored in the
+	Windows NT4 registry-based accounts database. That information resides in
+	the Security Account Manager (SAM) portion of the NT4 registry under keys called
+	<constant>SAM</constant> and <constant>SECURITY</constant>.
+	</para>
+
+	<warning><para>
+	<indexterm><primary>crippled</primary></indexterm>
+	<indexterm><primary>inoperative</primary></indexterm>
+	The Windows NT4 registry keys called <constant>SAM</constant> and <constant>SECURITY</constant>
+	are protected so that you cannot view the contents. If you change the security setting
+	to reveal the contents under these hive keys, your Windows NT4 domain is crippled. Do not
+	do this unless you are willing to render your domain controller inoperative.
+	</para></warning>
+
+	<para>
+	<indexterm><primary>migration</primary><secondary>objectives</secondary></indexterm>
+	<indexterm><primary>disruptive</primary></indexterm>
+	Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are.
+	While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server,
+	that may not be a good idea from an administration perspective. Since the process involves going
+	through a certain amount of disruptive activity anyhow, why not take this opportunity to
+	review the structure of the network, how Windows clients are controlled and how they
+	interact with the network environment.
+	</para>
+
+	<para>
+	<indexterm><primary>network</primary><secondary>logon scripts</secondary></indexterm>
+	<indexterm><primary>profiles share</primary></indexterm>
+	<indexterm><primary>security descriptors</primary></indexterm>
+	MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed
+	have done little to keep the NT4 server environment up to date with more recent Windows releases, 
+	particularly Windows XP Professional. The migration provides opportunity to revise and update 
+	roaming profile deployment as well as folder redirection. Given that you must port the 
+	greater network configuration of this from the old NT4 server to the new Samba-3 server.
+	Do not forget to validate the security descriptors in the profiles share as well as network logon
+	scripts. Feedback from sites that are migrating to Samba-3 suggests that many are using this
+	as a good time to update desktop systems also. In all, the extra effort should constitute no
+	real disruption to users, but rather, with due diligence and care, should make their network experience
+	a much happier one.
+	</para>
+
+	<sect2>
+	<title>Technical Issues</title>
+
+	<para>
+	<indexterm><primary>strategic</primary></indexterm>
+	<indexterm><primary>active directory</primary></indexterm>
+	Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic
+	element. Many sites have asked for instructions regarding merging of multiple NT4
+	domains into one Samba-3 LDAP database. It seems that this is viewed as a significant
+	added value compared with the alternative of migration to Windows Server 200x and Active
+	Directory. The diagram in <link linkend="ch8-migration"/> illustrates the effect of migration
+	from a Windows NT4 domain to a Samba domain.
+	</para>
+
+	<image id="ch8-migration">
+		<imagedescription>Schematic Explaining the <command>net rpc vampire</command> Process</imagedescription>
+		<imagefile scale="55">ch8-migration</imagefile>
+	</image>
+
+	<para>
+	<indexterm><primary>merge</primary></indexterm>
+	<indexterm><primary>passdb.tdb</primary></indexterm>
+	If you want to merge multiple NT4 domain account databases into one Samba domain,
+	you must now dump the contents of the first migration and edit it as appropriate. Now clean
+	out (remove) the tdbsam backend file (<filename>passdb.tdb</filename>) or the LDAP database
+	files. You must start each migration with a new database into which you merge your NT4 
+	domains.
+	</para>
+
+	<para><indexterm>
+	<primary>dump</primary>
+	</indexterm>
+	At this point, you are ready to perform the second migration, following the same steps as
+	for the first. In other words, dump the database, edit it, and then you may merge the
+	dump for the first and second migrations.
+	</para>
+
+	<para><indexterm>
+	<primary>LDAP</primary>
+	</indexterm><indexterm>
+	<primary>migrate</primary>
+	</indexterm><indexterm>
+	<primary>Domain SID</primary>
+	</indexterm>
+	You must be careful. If you choose to migrate to an LDAP backend, your dump file
+	now contains the full account information, including the domain SID. The domain SID for each 
+	of the two NT4 domains will be different. You must choose one and change the domain 
+	portion of the account SIDs so that all are the same.
+	</para>
+
+	<para>
+	<indexterm><primary>passdb.tdb</primary></indexterm>
+	<indexterm><primary>/etc/passwd</primary></indexterm>
+	<indexterm><primary>merged</primary></indexterm>
+	<indexterm><primary>logon script</primary></indexterm>
+	<indexterm><primary>logon hours</primary></indexterm>
+	<indexterm><primary>logon machines</primary></indexterm>
+	<indexterm><primary>profile path</primary></indexterm>
+	<indexterm><primary>smbpasswd</primary></indexterm>
+	<indexterm><primary>tdbsam</primary></indexterm>
+	<indexterm><primary>LDAP backend</primary></indexterm>
+	<indexterm><primary>export</primary></indexterm>
+	<indexterm><primary>import</primary></indexterm>
+	If you choose to use a tdbsam (<filename>passdb.tdb</filename>) backend file, your best choice
+	is to use <command>pdbedit</command> to export the contents of the tdbsam file into an
+	smbpasswd data file. This automatically strips out all domain-specific information,
+	such as logon hours, logon machines, logon script, profile path, as well as the domain SID.
+	The resulting file can be easily merged with other migration attempts (each of which must start
+	with a clean file). It should also be noted that all users who end up in the merged smbpasswd
+	file must have an account in <filename>/etc/passwd</filename>. The resulting smbpasswd file
+	may be exported or imported into either a tdbsam (<filename>passdb.tdb</filename>) or
+	an LDAP backend.
+	</para>
+
+	<image id="NT4DUM">
+		<imagedescription>View of Accounts in NT4 Domain User Manager</imagedescription>
+		<imagefile scale="50">UserMgrNT4</imagefile>
+	</image>
+
+</sect2>
+
+
+<sect2>
+	<title>Political Issues</title>
+
+	<para>
+	The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3
+	domain may be seen by those who had power over them as a loss of prestige or a loss of
+	power. The imposition of a single domain may even be seen as a threat. So in migrating and
+	merging account databases, be consciously aware of the political fall-out in which you
+	may find yourself entangled when key staff feel a loss of prestige.
+	</para>
+
+	<para>
+	The best advice that can be given to those who set out to merge NT4 domains into a single
+	Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers
+	greater network interoperability and manageability.
+	</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Implementation</title>
+
+	<para>
+	From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations
+	to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX
+	server. If you contemplate doing this, please note that the steps that follow in this
+	chapter assume familiarity with the information that has been previously covered in this
+	book. You are particularly encouraged to be familiar with <link linkend="secure"/>,
+	<link linkend="Big500users"/> and <link linkend="happy"/>.
+	</para>
+
+	<para>
+	We present here the steps and example output for two NT4 to Samba-3 domain migrations. The
+	first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the
+	scripts you specify in the &smb.conf; file for the <parameter>add user script</parameter>
+	collection of parameters are used to effect the addition of accounts into the passdb backend.
+	</para>
+
+	<para>
+	Before proceeding to NT4 migration using either a tdbsam or ldapsam, it is most strongly recommended to
+	review <link linkend="ch5-dnshcp-setup"/> for DNS and DHCP configuration. The importance of correctly
+	functioning name resolution must be recognized. This applies equally for both hostname and NetBIOS names
+	(machine names, computer names, domain names, workgroup names &smbmdash; ALL names!).
+	</para>
+
+	<para>
+	The migration process involves the following steps:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		Prepare the target Samba-3 server. This involves configuring Samba-3 for
+		migration to either a tdbsam or an ldapsam backend.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>uppercase</primary></indexterm>
+		<indexterm><primary>Posix</primary></indexterm>
+		<indexterm><primary>lower-case</primary></indexterm>
+		Clean up the source NT4 PDC. Delete all accounts that need not be migrated.
+		Delete all files that should not be migrated. Where possible, change NT group
+		names so there are no spaces or uppercase characters. This is important if
+		the target UNIX host insists on POSIX-compliant all lowercase user and group
+		names.
+		</para></listitem>
+
+		<listitem><para>
+		Step through the migration process.
+		</para></listitem>
+
+		<listitem><para><indexterm><primary>PDC</primary></indexterm>
+		Remove the NT4 PDC from the network.
+		</para></listitem>
+
+		<listitem><para>
+		Upgrade the Samba-3 server from a BDC to a PDC, and validate all account
+		information.
+		</para></listitem>
+	</itemizedlist>
+
+	<para>
+	It may help to use the above outline as a pre-migration checklist.
+	</para>
+
+	<sect2>
+	<title>NT4 Migration Using LDAP Backend</title>
+
+	<para>
+	In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about
+	to be migrated are shown in <link linkend="NT4DUM"/>. In this example use is made of the
+	smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend.
+	Four scripts are essential to the migration process. Other scripts will be required
+	for daily management, but these are not critical to migration. The critical scripts are dependant
+	on which passdb backend is being used. Refer to <link linkend="ch8-vampire"/> to see which scripts
+	must be provided so that the migration process can complete.
+	</para>
+
+	<para>
+	Verify that you have correctly specified in the &smb.conf; file the scripts and arguments 
+	that should be passed to them before attempting to perform the account migration. Note also
+	that the deletion scripts must be commented out during migration. These should be uncommented
+	following successful migration of the NT4 Domain accounts.
+	</para>
+
+	<warning><para>
+	Under absolutely no circumstances should the Samba daemons be started until instructed to do so.
+	Delete the <filename>/etc/samba/secrets.tdb</filename> file and all Samba control tdb files
+	before commencing the following configuration steps.
+	</para></warning>
+
+	<table id="ch8-vampire">
+		<title>Samba &smb.conf; Scripts Essential to Samba Operation</title>
+		<tgroup cols="3">
+			<colspec align="left"/>
+			<colspec align="center"/>
+			<colspec align="center"/>
+			<thead>
+				<row>
+					<entry>Entity</entry>
+					<entry>ldapsam Script</entry>
+					<entry>tdbsam Script</entry>
+				</row>
+			</thead>
+			<tbody>
+				<row>
+					<entry>Add User Accounts</entry>
+					<entry>smbldap-useradd</entry>
+					<entry>useradd</entry>
+				</row>
+				<row>
+					<entry>Delete User Accounts</entry>
+					<entry>smbldap-userdel</entry>
+					<entry>userdel</entry>
+				</row>
+				<row>
+					<entry>Add Group Accounts</entry>
+					<entry>smbldap-groupadd</entry>
+					<entry>groupadd</entry>
+				</row>
+				<row>
+					<entry>Delete Group Accounts</entry>
+					<entry>smbldap-groupdel</entry>
+					<entry>groupdel</entry>
+				</row>
+				<row>
+					<entry>Add User to Group</entry>
+					<entry>smbldap-groupmod</entry>
+					<entry>usermod (See Note)</entry>
+				</row>
+				<row>
+					<entry>Add Machine Accounts</entry>
+					<entry>smbldap-useradd</entry>
+					<entry>useradd</entry>
+				</row>
+			</tbody>
+		</tgroup>
+	</table>
+
+	<note><para>
+	<indexterm><primary>usermod</primary></indexterm>
+	<indexterm><primary>groupmem</primary></indexterm>
+	<indexterm><primary>smbldap-tools</primary></indexterm>
+	The UNIX/Linux <command>usermod</command> utility does not permit simple user addition to (or deletion
+	of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this
+	capability, you must create your own tool to do this. Alternately, you can search the Web
+	to locate a utility called <command>groupmem</command> (by George Kraft) that provides this functionality.
+	The <command>groupmem</command> utility was contributed to the shadow package but has not surfaced
+	in the formal commands provided by Linux distributions (March 2004).
+	</para></note>
+
+	<note><para>
+	<indexterm><primary>tdbdump</primary></indexterm>
+	The <command>tdbdump</command> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your
+	Linux distribution, you will need to build this yourself or else forgo its use.
+	</para></note>
+
+	<para>
+	<indexterm><primary>User Manager</primary></indexterm>
+	Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains.
+	</para>
+
+	<procedure>
+	<title>User Migration Steps</title>
+
+		<step><para>
+		Configure the Samba &smb.conf; file to create a BDC. An example configuration is
+		given in <link linkend="sbent4smb"/>.
+		The delete scripts are commented out so that during the process of migration
+		no account information can be deleted.
+		</para></step>
+
+<smbconfexample id="sbent4smb">
+<title>NT4 Migration Samba-3 Server <filename>smb.conf</filename> &smbmdash; Part: A</title>
+<smbconfsection name="[global]"/>
+        <smbconfoption name="workgroup">DAMNATION</smbconfoption>
+        <smbconfoption name="netbios name">MERLIN</smbconfoption>
+        <smbconfoption name="passdb backend">ldapsam:ldap://localhost</smbconfoption>
+        <smbconfoption name="log level">1</smbconfoption>
+        <smbconfoption name="syslog">0</smbconfoption>
+        <smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+        <smbconfoption name="max log size">0</smbconfoption>
+        <smbconfoption name="smb ports">139 445</smbconfoption>
+        <smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+        <smbconfoption name="add user script">/opt/IDEALX/sbin/smbldap-useradd -m '%u'</smbconfoption>
+        <smbconfoption name="#delete user script">/opt/IDEALX/sbin/smbldap-userdel '%u'</smbconfoption>
+        <smbconfoption name="add group script">/opt/IDEALX/sbin/smbldap-groupadd '%g'</smbconfoption>
+        <smbconfoption name="#delete group script">/opt/IDEALX/sbin/smbldap-groupdel '%g'</smbconfoption>
+        <smbconfoption name="add user to group script">/opt/IDEALX/sbin/</smbconfoption>
+<member><parameter>smbldap-groupmod -m '%u' '%g'</parameter></member>
+        <smbconfoption name="#delete user from group script">/opt/IDEALX/</smbconfoption>
+<member><parameter>sbin/smbldap-groupmod -x '%u' '%g'</parameter></member>
+        <smbconfoption name="set primary group script">/opt/IDEALX/</smbconfoption>
+<member><parameter>sbin/smbldap-usermod -g '%g' '%u'</parameter></member>
+        <smbconfoption name="add machine script">/opt/IDEALX/sbin/</smbconfoption>
+<member><parameter>smbldap-useradd -w '%u'</parameter></member>
+        <smbconfoption name="logon script">scripts\logon.cmd</smbconfoption>
+        <smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption>
+        <smbconfoption name="logon home">\\%L\%U</smbconfoption>
+        <smbconfoption name="logon drive">X:</smbconfoption>
+        <smbconfoption name="domain logons">Yes</smbconfoption>
+        <smbconfoption name="domain master">No</smbconfoption>
+        <smbconfoption name="#wins support">Yes</smbconfoption>
+        <smbconfoption name="wins server">192.168.123.124</smbconfoption>
+        <smbconfoption name="ldap admin dn">cn=Manager,dc=terpstra-world,dc=org</smbconfoption>
+        <smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
+        <smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
+        <smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
+        <smbconfoption name="ldap passwd sync">Yes</smbconfoption>
+        <smbconfoption name="ldap suffix">dc=terpstra-world,dc=org</smbconfoption>
+        <smbconfoption name="ldap ssl">no</smbconfoption>
+        <smbconfoption name="ldap timeout">20</smbconfoption>
+        <smbconfoption name="ldap user suffix">ou=People</smbconfoption>
+        <smbconfoption name="idmap backend">ldap:ldap://localhost</smbconfoption>
+        <smbconfoption name="idmap uid">15000-20000</smbconfoption>
+        <smbconfoption name="idmap gid">15000-20000</smbconfoption>
+        <smbconfoption name="winbind nested groups">Yes</smbconfoption>
+        <smbconfoption name="ea support">Yes</smbconfoption>
+        <smbconfoption name="map acl inherit">Yes</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="sbent4smb2">
+<title>NT4 Migration Samba-3 Server <filename>smb.conf</filename> &smbmdash; Part: B</title>
+<smbconfsection name="[apps]"/>
+        <smbconfoption name="comment">Application Data</smbconfoption>
+        <smbconfoption name="path">/data/home/apps</smbconfoption>
+		<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[homes]"/>
+        <smbconfoption name="comment">Home Directories</smbconfoption>
+        <smbconfoption name="path">/home/users/%U/Documents</smbconfoption>
+        <smbconfoption name="valid users">%S</smbconfoption>
+        <smbconfoption name="read only">No</smbconfoption>
+        <smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+        <smbconfoption name="comment">SMB Print Spool</smbconfoption>
+        <smbconfoption name="path">/var/spool/samba</smbconfoption>
+        <smbconfoption name="guest ok">Yes</smbconfoption>
+        <smbconfoption name="printable">Yes</smbconfoption>
+        <smbconfoption name="use client driver">No</smbconfoption>
+        <smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[netlogon]"/>
+        <smbconfoption name="comment">Network Logon Service</smbconfoption>
+        <smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
+        <smbconfoption name="guest ok">Yes</smbconfoption>
+        <smbconfoption name="locking">No</smbconfoption>
+
+<smbconfsection name="[profiles]"/>
+        <smbconfoption name="comment">Profile Share</smbconfoption>
+        <smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
+        <smbconfoption name="read only">No</smbconfoption>
+        <smbconfoption name="profile acls">Yes</smbconfoption>
+
+<smbconfsection name="[profdata]"/>
+        <smbconfoption name="comment">Profile Data Share</smbconfoption>
+        <smbconfoption name="path">/var/lib/samba/profdata</smbconfoption>
+        <smbconfoption name="read only">No</smbconfoption>
+        <smbconfoption name="profile acls">Yes</smbconfoption>
+
+<smbconfsection name="[print$]"/>
+        <smbconfoption name="comment">Printer Drivers</smbconfoption>
+        <smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
+</smbconfexample>
+
+		<step><para>
+		<indexterm><primary>slapd.conf</primary></indexterm>
+		Configure OpenLDAP in preparation for the migration. An example
+		<filename>sladp.conf</filename> file is shown in <link linkend="sbentslapd"/>.
+		The <constant>rootpw</constant> value is an encrypted password string that can
+		be obtained by executing the <command>slappasswd</command> command.
+		</para></step>
+
+<example id="sbentslapd">
+<title>NT4 Migration LDAP Server Configuration File: <filename>/etc/openldap/slapd.conf</filename> &smbmdash; Part A</title>
+<screen>
+include         /etc/openldap/schema/core.schema
+include         /etc/openldap/schema/cosine.schema
+include         /etc/openldap/schema/inetorgperson.schema
+include         /etc/openldap/schema/nis.schema
+include         /etc/openldap/schema/samba3.schema
+
+pidfile         /var/run/slapd/slapd.pid
+argsfile        /var/run/slapd/slapd.args
+
+access to dn.base=""
+                by self write
+                by * auth
+
+access to attr=userPassword
+                by self write
+                by * auth
+
+access to attr=shadowLastChange
+                by self write
+                by * read
+
+access to *
+                by * read
+                by anonymous auth
+</screen>
+</example>
+
+<example id="sbentslapd2">
+<title>NT4 Migration LDAP Server Configuration File: <filename>/etc/openldap/slapd.conf</filename> &smbmdash; Part B</title>
+<screen>
+#loglevel       256
+
+#schemacheck     on
+idletimeout     30
+#backend         bdb
+database        bdb
+checkpoint      1024 5
+cachesize       10000
+
+suffix          "dc=terpstra-world,dc=org"
+rootdn          "cn=Manager,dc=terpstra-world,dc=org"
+
+# rootpw = not24get
+rootpw          {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
+
+directory       /var/lib/ldap
+
+# Indices to maintain
+index objectClass           eq
+index cn                    pres,sub,eq
+index sn                    pres,sub,eq
+index uid                   pres,sub,eq
+index displayName           pres,sub,eq
+index uidNumber             eq
+index gidNumber             eq
+index memberUID             eq
+index sambaSID              eq
+index sambaPrimaryGroupSID  eq
+index sambaDomainName       eq
+index default               sub
+</screen>
+</example>
+
+		<step><para>
+		<indexterm><primary>nss_ldap</primary></indexterm>
+		<indexterm><primary>/etc/ldap.conf</primary></indexterm>
+		Install the PADL <command>nss_ldap</command> tool set, then configure the <filename>/etc/ldap.conf</filename>
+		as shown in <link linkend="sbrntldapconf"/>.
+		</para></step>
+
+<example id="sbrntldapconf">
+<title>NT4 Migration NSS LDAP File: <filename>/etc/ldap.conf</filename></title>
+<screen>
+host    127.0.0.1
+
+base    dc=terpstra-world,dc=org
+
+ldap_version    3
+
+binddn cn=Manager,dc=terpstra-world,dc=org
+bindpw not24get
+
+pam_password exop
+
+nss_base_passwd         ou=People,dc=terpstra-world,dc=org?one
+nss_base_shadow         ou=People,dc=terpstra-world,dc=org?one
+nss_base_group          ou=Groups,dc=terpstra-world,dc=org?one
+
+ssl off
+</screen>
+</example>
+
+		<step><para>
+		<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+		Edit the <filename>/etc/nsswitch.conf</filename> file so it has the entries shown
+		in <link linkend="sbentnss"/>. Note that the LDAP entries have been commented out.
+		This is deliberate. If these entries are active (not commented out), and the
+		<filename>/etc/ldap.conf</filename> file has been configured, when the LDAP server
+		is started, the process of starting the LDAP server will cause LDAP lookups. This
+		causes the LDAP server <command>slapd</command> to hang because it finds port 389
+		open and therefore cannot gain exclusive control of it. By commenting these entries
+		out, it is possible to avoid this gridlock situation and thus the overall
+		installation and configuration will progress more smoothly.
+		</para></step>
+
+<example id="sbentnss">
+<title>NT4 Migration NSS Control File: <filename>/etc/nsswitch.conf</filename> (Stage:1)</title>
+<screen>
+passwd:         files #ldap
+shadow:         files #ldap
+group:          files #ldap
+
+hosts:          files dns wins
+networks:       files dns
+
+services:       files
+protocols:      files
+rpc:            files
+ethers:         files
+netmasks:       files
+netgroup:       files
+publickey:      files
+
+bootparams:     files
+automount:      files nis
+aliases:        files
+#passwd_compat: ldap       #Not needed.
+#group_compat:  ldap      #Not needed.
+</screen>
+</example>
+
+		<step><para>
+		Validate the the target NT4 PDC name is being correctly resolved to its IP address by
+		executing the following:
+<screen>
+&rootprompt; ping transgression
+PING transgression.terpstra-world.org (192.168.1.5) 56(84) bytes of data.
+64 bytes from (192.168.1.5): icmp_seq=1 ttl=128 time=0.159 ms
+64 bytes from (192.168.1.5): icmp_seq=2 ttl=128 time=0.192 ms
+64 bytes from (192.168.1.5): icmp_seq=3 ttl=128 time=0.141 ms
+
+--- transgression.terpstra-world.org ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2000ms
+rtt min/avg/max/mdev = 0.141/0.164/0.192/0.021 ms
+</screen>
+		Do not proceed to the next step if this step fails. It is imperative that the name of the PDC
+		can be resolved to its IP address. If this is broken, fix it.
+		</para></step>
+
+		<step><para>
+		Pull the domain SID from the NT4 domain that is being migrated as follows:
+<screen>
+&rootprompt; net rpc getsid -S TRANGRESSION -U Administrator%not24get
+Storing SID S-1-5-21-1385457007-882775198-1210191635 \
+                     for Domain DAMNATION in secrets.tdb
+</screen>
+		</para>
+
+		<para>
+		Another way to obtain the domain SID from the target NT4 domain that is being
+		migrated to Samba-3 is by executing the following:
+<screen>
+&rootprompt; net rpc info -S TRANSGRESSION
+</screen>
+		If this method is used, do not forget to store the SID obtained into the
+		<filename>secrets.tdb</filename> file. This can be done by executing:
+<screen>
+&rootprompt; net setlocalsid S-1-5-21-1385457007-882775198-1210191635
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>Idealx</primary></indexterm>
+		<indexterm><primary>configure.pl</primary></indexterm>
+		<indexterm><primary>/opt/IDEALX/sbin</primary></indexterm>
+		<indexterm><primary>smbldap-tools</primary></indexterm>
+		Install the Idealx <command>smbldap-tools</command> software package, following
+		the instructions given in <link linkend="sbeidealx"/>. The resulting perl scripts
+		should be located in the <filename>/opt/IDEALX/sbin</filename> directory.
+		Change into that location, or wherever the scripts have been installed. Execute the
+		<filename>configure.pl</filename> script to configure the Idealx package for use.
+		Note: Use the domain SID obtained from the step above. The following is
+		an example configuration session:
+<screen>
+merlin:/opt/IDEALX/sbin # ./configure.pl
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+       smbldap-tools script configuration
+       -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+Before starting, check
+ . if your samba controller is up and running.
+ . if the domain SID is defined (you can get it with the 'net getlocalsid')
+
+ . you can leave the configuration using the Crtl-c key combination
+ . empty value can be set with the "." character
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+Looking for configuration files...
+
+Samba Config File Location [/etc/samba/smb.conf] &gt;
+smbldap Config file Location (global parameters)
+           [/etc/smbldap-tools/smbldap.conf] &gt;
+smbldap Config file Location (bind parameters)
+      [/etc/smbldap-tools/smbldap_bind.conf] &gt;
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+Let's start configuring the smbldap-tools scripts ...
+
+. workgroup name: name of the domain Samba act as a PDC
+  workgroup name [DAMNATION] &gt;
+. netbios name: netbios name of the samba controller
+  netbios name [MERLIN] &gt;
+. logon drive: local path to which the home directory
+         will be connected (for NT Workstations). Ex: 'H:'
+  logon drive [X:] &gt; H:
+. logon home: home directory location (for Win95/98 or NT Workstation).
+  (use %U as username) Ex:'\\MERLIN\home\%U'
+  logon home (leave blank if you don't want homeDirectory)
+                                     [\\MERLIN\home\%U] &gt; \\%L\%U
+. logon path: directory where roaming profiles are stored.
+                                     Ex:'\\MERLIN\profiles\%U'
+  logon path (leave blank if you don't want roaming profile)
+                            [\\MERLIN\profiles\%U] &gt; \\%L\profiles\%U
+. home directory prefix (use %U as username) [/home/%U] > /home/users/%U
+. default user netlogon script (use %U as username) 
+                               [%U.cmd] &gt; scripts\logon.cmd
+  default password validation time (time in days) [45] > 180
+. ldap suffix [dc=terpstra-world,dc=org] &gt;
+. ldap group suffix [ou=Groups] &gt;
+. ldap user suffix [ou=People] &gt;
+. ldap machine suffix [ou=People] &gt;
+. Idmap suffix [ou=Idmap] &gt;
+. sambaUnixIdPooldn: object where you want to store the next uidNumber
+  and gidNumber available for new users and groups
+  sambaUnixIdPooldn object (relative to ${suffix}) 
+                      [cn=NextFreeUnixId] &gt; sambaDomainName=DAMNATION
+. ldap master server: 
+              IP address or DNS name of the master (writable) ldap server
+  ldap master server [] &gt; 127.0.0.1
+. ldap master port [389] &gt;
+. ldap master bind dn [cn=Manager,dc=terpstra-world,dc=org] &gt;
+. ldap master bind password [] &gt;
+. ldap slave server: IP address or DNS name of the slave ldap server:
+                                         can also be the master one
+  ldap slave server [] &gt; 127.0.0.1
+. ldap slave port [389] &gt;
+. ldap slave bind dn [cn=Manager,dc=terpstra-world,dc=org] &gt;
+. ldap slave bind password [] &gt;
+. ldap tls support (1/0) [0] &gt;
+. SID for domain DAMNATION: SID of the domain 
+                         (can be obtained with 'net getlocalsid MERLIN')
+  SID for domain DAMNATION []
+        &gt; S-1-5-21-1385457007-882775198-1210191635
+. unix password encryption: encryption used for unix passwords
+  unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] &gt; MD5
+. default user gidNumber [513] &gt;
+. default computer gidNumber [515] &gt;
+. default login shell [/bin/bash] &gt;
+. default domain name to append to mail address [] &gt; terpstra-world.org
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+backup old configuration files:
+  /etc/smbldap-tools/smbldap.conf-&gt;
+                              /etc/smbldap-tools/smbldap.conf.old
+  /etc/smbldap-tools/smbldap_bind.conf-&gt;
+                              /etc/smbldap-tools/smbldap_bind.conf.old
+writing new configuration file:
+  /etc/smbldap-tools/smbldap.conf done.
+  /etc/smbldap-tools/smbldap_bind.conf done.
+</screen>
+		<indexterm><primary>sambaDomainName</primary></indexterm>
+		Note that the NT4 domain SID that was previously obtained was entered above. Also,
+		the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is
+		the location into which the Idealx smbldap-tools store the next available UID/GID
+		information. It is also where Samba stores domain specific information such as the
+		next RID, the SID, and so on.
+		</para></step>
+
+		<step><para>
+		Start the LDAP server using the system interface script. On Novell SLES9
+		this is done as shown here:
+<screen>
+&rootprompt; rcldap start
+</screen>
+		</para></step>
+
+		<step><para>
+		Edit the <filename>/etc/nsswitch.conf</filename> file so it has the entries shown in
+		<link linkend="sbentnss2"/>. Note that the LDAP entries have now been uncommented.
+		</para></step>
+
+<example id="sbentnss2">
+<title>NT4 Migration NSS Control File: <filename>/etc/nsswitch.conf</filename> (Stage:2)</title>
+<screen>
+passwd:         files ldap
+shadow:         files ldap
+group:          files ldap
+
+hosts:          files dns wins
+networks:       files dns
+
+services:       files
+protocols:      files
+rpc:            files
+ethers:         files
+netmasks:       files
+netgroup:       files
+publickey:      files
+
+bootparams:     files
+automount:      files nis
+aliases:        files
+#passwd_compat: ldap       #Not needed.
+#group_compat:  ldap      #Not needed.
+</screen>
+</example>
+
+		<step><para>
+		The LDAP management password must be installed into the <filename>secrets.tdb</filename>
+		file as follows:
+<screen>
+&rootprompt; smbpasswd -w not24get
+Setting stored password for 
+            "cn=Manager,dc=terpstra-world,dc=org" in secrets.tdb
+</screen>
+		</para></step>
+
+		<step><para>
+		Populate the LDAP directory as shown here:
+<screen>
+&rootprompt; /opt/IDEALX/sbin/smbldap-populate -a root -k 0 -m 0
+Using workgroup name from sambaUnixIdPooldn (smbldap.conf):
+                          sambaDomainName=DAMNATION
+Using builtin directory structure
+adding new entry: dc=terpstra-world,dc=org
+adding new entry: ou=People,dc=terpstra-world,dc=org
+adding new entry: ou=Groups,dc=terpstra-world,dc=org
+entry ou=People,dc=terpstra-world,dc=org already exist.
+adding new entry: ou=Idmap,dc=terpstra-world,dc=org
+adding new entry: sambaDomainName=DAMNATION,dc=terpstra-world,dc=org
+adding new entry: uid=root,ou=People,dc=terpstra-world,dc=org
+adding new entry: uid=nobody,ou=People,dc=terpstra-world,dc=org
+adding new entry: cn=Domain Admins,ou=Groups,dc=terpstra-world,dc=org
+adding new entry: cn=Domain Users,ou=Groups,dc=terpstra-world,dc=org
+adding new entry: cn=Domain Guests,ou=Groups,dc=terpstra-world,dc=org
+adding new entry: cn=Domain Computers,ou=Groups,dc=terpstra-world,dc=org
+adding new entry: cn=Administrators,ou=Groups,dc=terpstra-world,dc=org
+adding new entry: cn=Print Operators,ou=Groups,dc=terpstra-world,dc=org
+adding new entry: cn=Backup Operators,ou=Groups,dc=terpstra-world,dc=org
+adding new entry: cn=Replicators,ou=Groups,dc=terpstra-world,dc=org
+</screen>
+		The script tries to add the ou=People container twice, hence the error message.
+		This is expected behavior.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>Novell SUSE SLES 9</primary></indexterm>
+		Restart the LDAP server following initialization of the LDAP directory. Execute the
+		system control script provided on your system. The following steps can be used on
+		Novell SUSE SLES 9:
+<screen>
+&rootprompt; rcldap restart
+&rootprompt; chkconfig ldap on
+</screen>
+		</para></step>
+
+		<step><para>
+		Verify that the new user accounts that have been added to the LDAP directory can be
+		resolved as follows:
+<screen>
+&rootprompt; getent passwd
+...
+nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
+man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
+news:x:9:13:News system:/etc/news:/bin/bash
+uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
++::0:0:::
+root:x:0:0:Netbios Domain Administrator:/home/users/root:/bin/false
+nobody:x:999:514:nobody:/dev/null:/bin/false
+</screen>
+		Now repeat this for the group accounts as shown here:
+<screen>
+&rootprompt; getent group
+...
+nobody:x:65533:
+nogroup:x:65534:nobody
+users:x:100:
++::0:
+Domain Admins:x:512:root
+Domain Users:x:513:
+Domain Guests:x:514:
+Domain Computers:x:515:
+Administrators:x:544:
+Print Operators:x:550:
+Backup Operators:x:551:
+Replicators:x:552:
+</screen>
+		In both cases the LDAP accounts follow the <quote>+::0:</quote> entry.
+		</para></step>
+
+		<step><para>
+		Now it is time to join the Samba BDC to the target NT4 domain that is being
+		migrated to Samba-3 by executing the following:
+<screen>
+&rootprompt; net rpc join -S TRANSGRESSION -U Administrator%not24get
+merlin:/opt/IDEALX/sbin # net rpc join -S TRANSGRESSION \
+                         -U Administrator%not24get
+Joined domain DAMNATION.
+</screen>
+		</para></step>
+
+		<step><para>
+		Set the new domain administrator (root) password for both UNIX and Windows as shown here:
+<screen>
+&rootprompt; /opt/IDEALX/sbin/smbldap-passwd root
+Changing password for root
+New password : ********
+Retype new password : ********
+</screen>
+		Note: During account migration, the Windows Administrator account will not be migrated
+		to the Samba server.
+		</para></step>
+
+		<step><para>
+		Now validate that these accounts can be resolved using Samba's tools as
+		shown here for user accounts:
+<screen>
+&rootprompt; pdbedit -Lw
+root:0:84B0D8E14D158FF8417EAF50CFAC29C3:
+        AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[U          ]:LCT-425F6467:
+nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:
+        NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:[NU         ]:LCT-00000000:
+</screen>
+		Now complete the following step to validate that group account mappings have
+		been correctly set:
+<screen>
+&rootprompt; net groupmap list
+Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512)
+                                            -&gt; Domain Admins
+Domain Users (S-1-5-21-1385457007-882775198-1210191635-513) 
+                                             -&gt; Domain Users
+Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514) 
+                                            -&gt; Domain Guests
+Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515) 
+                                          -&gt; Domain Computers
+Administrators (S-1-5-32-544) -&gt; Administrators
+Print Operators (S-1-5-32-550) -&gt; Print Operators
+Backup Operators (S-1-5-32-551) -&gt; Backup Operators
+Replicators (S-1-5-32-552) -> Replicators
+</screen>
+		These are the expected results for a correctly configured system.
+		</para></step>
+
+		<step><para>
+		Commence migration as shown here:
+<screen>
+&rootprompt; net rpc vampire -S TRANSGRESSION \
+       -U Administrator%not24get &gt; /tmp/vampire.log 2&gt;1
+</screen>
+		Check the vampire log to confirm that only expected errors have been
+		reported. See <link linkend="sbevam1"/>.
+		</para></step>
+
+		<step><para>
+		The migration of user accounts can be quickly validated as follows:
+<screen>
+&rootprompt; pdbedit -Lw
+root:0:84B0D8E14D158FF8417EAF50CFAC29C3:...
+nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:...
+Administrator:0:84B0D8E14D158FF8417EAF50CFAC29C3:...
+Guest:1:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:...
+TRANSGRESSION$:2:CC044B748CEE294CE76B6B0D1B86C1A8:...
+IUSR_TRANSGRESSION:3:64046AC81B056C375F9537FC409085F8:...
+MIDEARTH$:4:E93186E5819706D2AAD3B435B51404EE:...
+atrickhoffer:5:DC08CFE0C12B2867352502E32A407F23:...
+barryf:6:B829BCDE01FF24376E45D5F10408CFBD:...
+fsellerby:7:6A97CBEBE8F9826B417EAF50CFAC29C3:...
+gdaison:8:48F6A8C8A900024351DA8C2061C5F1D3:...
+hrambotham:9:7330D9EA0964465EAAD3B435B51404EE:...
+jrhapsody:10:ACBA7D207E2BA35D9BD41A26B01626BD:...
+maryk:11:293B5A4CA41F6CA1A7D80430B8342B73:...
+jacko:12:8E8982D86BD037C364BBD09A598E07AD:...
+bridge:13:0D2CA7D2BE67FE2193BE3A377C968336:...
+sharpec:14:8841A75CAC19D2855D8B73B1F4D430F8:...
+jimbo:15:6E8BDC904FD9EC5C17306D272A9441BB:...
+dhenwick:16:D1694A03C33584BDAAD3B435B51404EE:...
+dork:17:69E2D19E69A593D5AAD3B435B51404EE:...
+blue:18:E355EBF9559979FEAAD3B435B51404EE:...
+billw:19:EE35C3481CF7F7DB484448BC86A641A5:...
+rfreshmill:20:7EC033B58661B60CAAD3B435B51404EE:...
+MAGGOT$:21:A3B9334765AD30F7AAD3B435B51404EE:...
+TRENTWARE$:22:1D92C8DD5E7F0DDF93BE3A377C968336:...
+MORTON$:23:89342E69DCA9D3F8AAD3B435B51404EE:...
+NARM$:24:2B93E2D1D25448BDAAD3B435B51404EE:...
+LAPDOG$:25:14AA535885120943AAD3B435B51404EE:...
+SCAVENGER$:26:B6288EB6D147B56F8963805A19B0ED49:...
+merlin$:27:820C50523F368C54AB9D85AE603AD09D:...
+</screen>
+		</para></step>
+
+		<step><para>
+		The mapping of UNIX and Windows groups can be validated as show here:
+<screen>
+&rootprompt; net groupmap list
+Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512)
+                                                     -&gt; Domain Admins
+Domain Users (S-1-5-21-1385457007-882775198-1210191635-513)
+                                                      -&gt; Domain Users
+Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514)
+                                                     -&gt; Domain Guests
+Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515)
+                                                   -&gt; Domain Computers
+Administrators (S-1-5-32-544) -&gt; Administrators
+Print Operators (S-1-5-32-550) -&gt; Print Operators
+Backup Operators (S-1-5-32-551) -&gt; Backup Operators
+Replicator (S-1-5-32-552) -&gt; Replicators
+Engineers (S-1-5-21-1385457007-882775198-1210191635-1020) -&gt; Engineers
+Marketoids (S-1-5-21-1385457007-882775198-1210191635-1022) -&gt; Marketoids
+Gnomes (S-1-5-21-1385457007-882775198-1210191635-1023) -&gt; Gnomes
+Catalyst (S-1-5-21-1385457007-882775198-1210191635-1024) -&gt; Catalyst
+Recieving (S-1-5-21-1385457007-882775198-1210191635-1025) -&gt; Recieving
+Rubberboot (S-1-5-21-1385457007-882775198-1210191635-1026) -&gt; Rubberboot
+Sales (S-1-5-21-1385457007-882775198-1210191635-1027) -&gt; Sales
+Accounting (S-1-5-21-1385457007-882775198-1210191635-1028) -&gt; Accounting
+Shipping (S-1-5-21-1385457007-882775198-1210191635-1029) -&gt; Shipping
+Account Operators (S-1-5-32-548) -&gt; Account Operators
+Guests (S-1-5-32-546) -&gt; Guests
+Server Operators (S-1-5-32-549) -&gt; Server Operators
+Users (S-1-5-32-545) -&gt; Users
+</screen>
+		It is of vital importance that the domain SID portions of all group
+		accounts are identical.
+		</para></step>
+
+		<step><para>
+		The final responsibility in the migration process is to create identical
+		shares and printing resources on the new Samba-3 server, copy all data
+		across, set up privileges, and set share and file/directory access controls.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>domain master</primary></indexterm>
+		<indexterm><primary>PDC</primary></indexterm>
+		Edit the &smb.conf; file to  reset the parameter 
+		<smbconfoption name="domain master">Yes</smbconfoption> so that
+		the Samba server functions as a PDC for the purpose of migration.
+		Also, uncomment the deletion scripts so they will now be fully functional,
+		enable the <parameter>wins support = yes</parameter> parameter and
+		comment out the <parameter>wins server</parameter>. Validate the configuration
+		with the <command>testparm</command> utility as shown here:
+<screen>
+&rootprompt; testparm
+Load smb config files from /etc/samba/smb.conf
+Processing section "[apps]"
+Processing section "[media]"
+Processing section "[homes]"
+Processing section "[printers]"
+Processing section "[netlogon]"
+Processing section "[profiles]"
+Processing section "[profdata]"
+Processing section "[print$]"
+Loaded services file OK.
+Server role: ROLE_DOMAIN_PDC
+Press enter to see a dump of your service definitions
+</screen>
+                </para></step>
+
+		<step><para>
+		Now shut down the old NT4 PDC. Only when the old NT4 PDC and all
+		NT4 BDCs have been shut down can the Samba-3 PDC be started.
+		</para></step>
+
+		<step><para>
+		All workstations should function as they did with the old NT4 PDC. All
+		interdomain trust accounts should remain in place and fully functional.
+		All machine accounts and user logon accounts should also function correctly.
+		</para></step>
+
+		<step><para>
+		The configuration of Samba-3 BDC servers can be accomplished now or at any
+		convenient time in the future. Please refer to the carefully detailed process
+		for doing so is outlined in <link linkend="sbehap-bldg1"/>.
+		</para></step>
+
+	</procedure>
+
+	<sect3 id="sbevam1">
+	<title>Migration Log Validation</title>
+
+	<para>
+	The following <filename>vampire.log</filename> file is typical of a valid migration.
+<screen>
+adding user Administrator to group Domain Admins
+adding user atrickhoffer to group Engineers
+adding user dhenwick to group Engineers
+adding user dork to group Engineers
+adding user rfreshmill to group Marketoids
+adding user jacko to group Gnomes
+adding user jimbo to group Gnomes
+adding user maryk to group Gnomes
+adding user gdaison to group Gnomes
+adding user dhenwick to group Catalyst
+adding user jacko to group Catalyst
+adding user jacko to group Recieving
+adding user blue to group Recieving
+adding user hrambotham to group Rubberboot
+adding user billw to group Sales
+adding user bridge to group Sales
+adding user jrhapsody to group Sales
+adding user maryk to group Sales
+adding user rfreshmill to group Sales
+adding user fsellerby to group Sales
+adding user sharpec to group Sales
+adding user jimbo to group Accounting
+adding user gdaison to group Accounting
+adding user jacko to group Shipping
+adding user blue to group Shipping
+Fetching DOMAIN database
+Creating unix group: 'Engineers'
+Creating unix group: 'Marketoids'
+Creating unix group: 'Gnomes'
+Creating unix group: 'Catalyst'
+Creating unix group: 'Recieving'
+Creating unix group: 'Rubberboot'
+Creating unix group: 'Sales'
+Creating unix group: 'Accounting'
+Creating unix group: 'Shipping'
+Creating account: Administrator
+Creating account: Guest
+Creating account: TRANSGRESSION$
+Creating account: IUSR_TRANSGRESSION
+Creating account: MIDEARTH$
+Creating account: atrickhoffer
+Creating account: barryf
+Creating account: fsellerby
+Creating account: gdaison
+Creating account: hrambotham
+Creating account: jrhapsody
+Creating account: maryk
+Creating account: jacko
+Creating account: bridge
+Creating account: sharpec
+Creating account: jimbo
+Creating account: dhenwick
+Creating account: dork
+Creating account: blue
+Creating account: billw
+Creating account: rfreshmill
+Creating account: MAGGOT$
+Creating account: TRENTWARE$
+Creating account: MORTON$
+Creating account: NARM$
+Creating account: LAPDOG$
+Creating account: SCAVENGER$
+Creating account: merlin$
+Group members of Domain Admins: Administrator,
+Group members of Domain Users: Administrator(primary),
+TRANSGRESSION$(primary),IUSR_TRANSGRESSION(primary),
+MIDEARTH$(primary),atrickhoffer(primary),barryf(primary),
+fsellerby(primary),gdaison(primary),hrambotham(primary),
+jrhapsody(primary),maryk(primary),jacko(primary),bridge(primary),
+sharpec(primary),jimbo(primary),dhenwick(primary),dork(primary),
+blue(primary),billw(primary),rfreshmill(primary),MAGGOT$(primary),
+TRENTWARE$(primary),MORTON$(primary),NARM$(primary),
+LAPDOG$(primary),SCAVENGER$(primary),merlin$(primary),
+Group members of Domain Guests: Guest(primary),
+Group members of Engineers: atrickhoffer,dhenwick,dork,
+Group members of Marketoids: rfreshmill,
+Group members of Gnomes: jacko,jimbo,maryk,gdaison,
+Group members of Catalyst: dhenwick,jacko,
+Group members of Recieving: jacko,blue,
+Group members of Rubberboot: hrambotham,
+Group members of Sales: billw,bridge,jrhapsody,maryk,
+rfreshmill,fsellerby,sharpec,
+Group members of Accounting: jimbo,gdaison,
+Group members of Shipping: jacko,blue,
+Fetching BUILTIN database
+skipping SAM_DOMAIN_INFO delta for 'Builtin' (is not my domain)
+Creating unix group: 'Account Operators'
+Creating unix group: 'Guests'
+Creating unix group: 'Server Operators'
+Creating unix group: 'Users'
+</screen>
+	</para>
+
+	</sect3>
+
+	</sect2>
+
+	<sect2>
+	<title>NT4 Migration Using tdbsam Backend</title>
+
+	<para>
+	In this example, we change the domain name of the NT4 server from
+	<constant>DRUGPREP</constant> to <constant>MEGANET</constant> prior to the use
+	of the vampire (migration) tool. This migration process makes use of Linux system tools
+	(like <command>useradd</command>) to add the accounts that are migrated into the 
+	UNIX/Linux <filename>/etc/passwd</filename> and <filename>/etc/group</filename>
+	databases. These entries must therefore be present, and correct options specified,
+	in your &smb.conf; file, or else the migration does not work as it should.
+	</para>
+
+	<procedure>
+	<title>Migration Steps Using tdbsam</title>
+
+		<step><para>
+		Prepare a Samba-3 server precisely per the instructions shown in <link linkend="Big500users"/>.
+		Set the workgroup name to <constant>MEGANET</constant>.
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>domain master</primary>
+	      </indexterm><indexterm>
+		<primary>BDC</primary>
+	      </indexterm>
+		Edit the &smb.conf; file to temporarily change the parameter 
+		<smbconfoption name="domain master">No</smbconfoption> so
+		the Samba server functions as a BDC for the purpose of migration.
+                </para></step>
+
+		<step><para>
+		Start Samba as you have done previously.
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>net</primary>
+		<secondary>rpc</secondary>
+		<tertiary>join</tertiary>
+	      </indexterm>
+		Join the NT4 Domain as a BDC, as shown here:
+<screen>
+&rootprompt; net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get
+Joined domain MEGANET.
+</screen>
+		</para></step>
+
+		<step><para><indexterm>
+		<primary>net</primary>
+		<secondary>rpc</secondary>
+		<tertiary>vampire</tertiary>
+	      </indexterm>
+		You may vampire the accounts from the NT4 PDC by executing the command, as shown here:
+<screen>
+&rootprompt; net rpc vampire -S oldnt4pdc -U Administrator%not24get
+Fetching DOMAIN database
+SAM_DELTA_DOMAIN_INFO not handled
+Creating unix group: 'Domain Admins'
+Creating unix group: 'Domain Users'
+Creating unix group: 'Domain Guests'
+Creating unix group: 'Engineers'
+Creating unix group: 'Marketoids'
+Creating unix group: 'Account Operators'
+Creating unix group: 'Administrators'
+Creating unix group: 'Backup Operators'
+Creating unix group: 'Guests'
+Creating unix group: 'Print Operators'
+Creating unix group: 'Replicator'
+Creating unix group: 'Server Operators'
+Creating unix group: 'Users'
+Creating account: Administrator
+Creating account: Guest
+Creating account: oldnt4pdc$
+Creating account: jacko
+Creating account: maryk
+Creating account: bridge
+Creating account: sharpec
+Creating account: jimbo
+Creating account: dhenwick
+Creating account: dork
+Creating account: blue
+Creating account: billw
+Creating account: massive$
+Group members of Engineers: Administrator,
+                 sharpec(primary),bridge,billw(primary),dhenwick
+Group members of Marketoids: Administrator,jacko(primary),
+                maryk(primary),jimbo,blue(primary),dork(primary)
+Creating unix group: 'Gnomes'
+Fetching BUILTIN database
+SAM_DELTA_DOMAIN_INFO not handled
+</screen>
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>pdbedit</primary>
+	      </indexterm>
+		At this point, we can validate our migration. Let's look at the accounts
+		in the form in which they are seen in a smbpasswd file. This achieves that:
+<screen>
+&rootprompt; pdbedit -Lw
+Administrator:505:84B0D8E14D158FF8417EAF50CFAC29C3:
+     AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[UX         ]:LCT-3DF7AA9F:
+jimbo:512:6E9A2A51F64A1BD5C187B8085FE1D9DF:
+     CDF7E305E639966E489A0CEFB95EE5E0:[UX         ]:LCT-3E9362BC:
+sharpec:511:E4301A7CD8FDD1EC6BBF9BC19CDF8151:
+     7000255938831D5B948C95C1931534C5:[UX         ]:LCT-3E8B42C4:
+dhenwick:513:DCD8886141E3F892AAD3B435B51404EE:
+     2DB36465949CB938DD98C312EFDC2639:[UX         ]:LCT-3E939F41:
+bridge:510:3FE6873A43101B46417EAF50CFAC29C3:
+     891741F481AF111B4CAA09A94016BD01:[UX         ]:LCT-3E8B4291:
+blue:515:256D41D2559BB3D2AAD3B435B51404EE:
+     9CCADDA4F7D281DD0FAD321478C6F971:[UX         ]:LCT-3E939FDC:
+diamond$:517:6C8E7B64EDCDBC4218B6345447A4454B:
+     3323AC63C666CFAACB60C13F65D54E9A:[S          ]:LCT-00000000:
+oldnt4pdc$:507:3E39430CDCABB5B09ED320D0448AE568:
+     95DBAF885854A919C7C7E671060478B9:[S          ]:LCT-3DF7AA9F:
+Guest:506:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
+     XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[DUX        ]:LCT-3E93A008:
+billw:516:85380CA7C21B6EBE168C8150662AF11B:
+     5D7478508293709937E55FB5FBA14C17:[UX         ]:LCT-3FED7CA1:
+dork:514:78C70DDEC35A35B5AAD3B435B51404EE:
+     0AD886E015AC595EC0AF40E6C9689E1A:[UX         ]:LCT-3E939F9A:
+jacko:508:BC472F3BF9A0A5F63832C92FC614B7D1:
+     0C6822AAF85E86600A40DC73E40D06D5:[UX         ]:LCT-3E8B4242:
+maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C:
+     CF271B744F7A55AFDA277FF88D80C527:[UX         ]:LCT-3E8B4270:
+</screen>
+		</para></step>
+
+		<step><para><indexterm>
+		<primary>pdbedit</primary>
+	      </indexterm>
+		An expanded view of a user account entry shows more of what was
+		obtained from the NT4 PDC:
+<screen>
+sleeth:~ # pdbedit -Lv maryk
+Unix username:        maryk
+NT username:          maryk
+Account Flags:        [UX         ]
+User SID:             S-1-5-21-1988699175-926296742-1295600288-1003
+Primary Group SID:    S-1-5-21-1988699175-926296742-1295600288-1007
+Full Name:            Mary Kathleen
+Home Directory:       \\diamond\maryk
+HomeDir Drive:        X:
+Logon Script:         scripts\logon.bat
+Profile Path:         \\diamond\profiles\maryk
+Domain:               MEGANET
+Account desc:         Peace Maker
+Workstations:
+Munged dial:
+Logon time:           0
+Logoff time:          Mon, 18 Jan 2038 20:14:07 GMT
+Kickoff time:         Mon, 18 Jan 2038 20:14:07 GMT
+Password last set:    Wed, 02 Apr 2003 13:05:04 GMT
+Password can change:  0
+Password must change: Mon, 18 Jan 2038 20:14:07 GMT
+</screen>
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>net</primary>
+		<secondary>group</secondary>
+	      </indexterm>
+		The following command lists the long names of the groups that have been
+		imported (vampired) from the NT4 PDC:
+<screen>
+&rootprompt; net group -l -Uroot%not24get -Smassive
+
+Group name            Comment
+-----------------------------
+Engineers             Snake Oil Engineers
+Marketoids            Untrustworthy Hype Vendors
+Gnomes                Plain Vanilla Garden Gnomes
+Replicator            Supports file replication in a domain
+Guests                Users granted guest access to the computer/domain
+Administrators        Members can fully administer the computer/domain
+Users                 Ordinary users
+</screen>
+		Everything looks well and in order.
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>domain master</primary>
+	      </indexterm><indexterm>
+		<primary>PDC</primary>
+	      </indexterm>
+		Edit the &smb.conf; file to  reset the parameter 
+		<smbconfoption name="domain master">Yes</smbconfoption> so
+		the Samba server functions as a PDC for the purpose of migration.
+                </para></step>
+	</procedure>
+	</sect2>
+
+	<sect2>
+		<title>Key Points Learned</title>
+
+		<para>
+		Migration of an NT4 PDC database to a Samba-3 PDC is possible.
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			An LDAP backend is a suitable vehicle for NT4 migrations.
+			</para></listitem>
+
+			<listitem><para>
+			A tdbsam backend can be used to perform a migration.
+			</para></listitem>
+
+			<listitem><para>
+			Multiple NT4 domains can be merged into a single Samba-3
+			domain.
+			</para></listitem>
+
+			<listitem><para>
+			The net Samba-3 domain most likely requires some
+			administration and updating before going live.
+			</para></listitem>
+		</itemizedlist>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Questions and Answers</title>
+
+	<para>
+	</para>
+
+	<qandaset defaultlabel="chap08qa" type="number">
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>clean database</primary>
+	      </indexterm>
+		Why must I start each migration with a clean database?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>merge</primary>
+	      </indexterm>
+		This is a recommendation that permits the data from each NT4 domain to
+		be kept separate until you are ready to merge them. Also, if you do not start with a clean database,
+		you may find errors due to users or groups from multiple domains having the
+		same name but different SIDs. It is better to permit each migration to complete
+		without undue errors and then to handle the merging of vampired data under
+		proper supervision.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>Domain SID</primary>
+	      </indexterm>
+		Is it possible to set my domain SID to anything I like?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>auto-generated SID</primary>
+	      </indexterm><indexterm>
+		<primary>SID</primary>
+	      </indexterm><indexterm>
+		<primary>Domain SID</primary>
+	      </indexterm>
+		Yes, so long as the SID you create has the same structure as an autogenerated SID.
+		The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where
+		the XXXXXXXXXX can be any number with from 6 to 10 digits. On the other hand, why
+		would you really want to create your own SID? I cannot think of a good reason.
+		You may want to set the SID to one that is already in use somewhere on your network,
+		but that is a little different from straight out creating your own domain SID.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>/etc/passwd</primary>
+	      </indexterm><indexterm>
+		<primary>/etc/group</primary>
+	      </indexterm><indexterm>
+		<primary>tdbsam</primary>
+	      </indexterm><indexterm>
+		<primary>passdb backend</primary>
+	      </indexterm><indexterm>
+		<primary>accounts</primary>
+		<secondary>user</secondary>
+	      </indexterm><indexterm>
+		<primary>accounts</primary>
+		<secondary>group</secondary>
+	      </indexterm><indexterm>
+		<primary>accounts</primary>
+		<secondary>Domain</secondary>
+	      </indexterm>
+		When using a tdbsam passdb backend, why must I have all domain user and group accounts
+		in <filename>/etc/passwd</filename> and <filename>/etc/group</filename>?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>UID</primary>
+	      </indexterm><indexterm>
+		<primary>GID</primary>
+	      </indexterm><indexterm>
+		<primary>smbpasswd</primary>
+	      </indexterm><indexterm>
+		<primary>/etc/passwd</primary>
+	      </indexterm><indexterm>
+		<primary>Posix</primary>
+	      </indexterm><indexterm>
+		<primary>LDAP database</primary>
+	      </indexterm>
+		Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba
+		does not fabricate the UNIX IDs from thin air, but rather requires them to be located
+		in a suitable place. 
+		</para>
+
+		<para>
+		When migrating a <filename>smbpasswd</filename> file to an LDAP backend, the
+		UID of each account is taken together with the account information in the 
+		<filename>/etc/passwd</filename>, and both sets of data are used to create the account
+		entry in the LDAP database. 
+		</para>
+
+		<para>
+		If you elect to create the POSIX account also, the entire UNIX account is copied to the 
+		LDAP backend. The same occurs with NT groups and UNIX groups. At the conclusion of 
+		migration to the LDAP database, the accounts may be removed from the UNIX database files. 
+		In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in 
+		LDAP, require UIDs/GIDs.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>validate</primary>
+	      </indexterm><indexterm>
+		<primary>connectivity</primary>
+	      </indexterm><indexterm>
+		<primary>migration</primary>
+	      </indexterm>
+		Why did you validate connectivity before attempting migration?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Access validation before attempting to migrate NT4 domain accounts helps to pinpoint
+		potential problems that may otherwise affect or impede account migration. I am always
+		mindful of the 4 P's of migration: Planning Prevents Poor Performance.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		How would you merge 10 tdbsam-based domains into an LDAP database?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>risk</primary>
+	      </indexterm><indexterm>
+		<primary>dump</primary>
+	      </indexterm><indexterm>
+		<primary>tdbsam</primary>
+	      </indexterm><indexterm>
+		<primary>Samba Domain</primary>
+	      </indexterm><indexterm>
+		<primary>UID</primary>
+	      </indexterm><indexterm>
+		<primary>GID</primary>
+	      </indexterm><indexterm>
+		<primary>pdbedit</primary>
+	      </indexterm><indexterm>
+		<primary>transfer</primary>
+	      </indexterm><indexterm>
+		<primary>smbpasswd</primary>
+	      </indexterm><indexterm>
+		<primary>LDAP</primary>
+	      </indexterm><indexterm>
+		<primary>tool</primary>
+	      </indexterm>
+		If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of
+		accounts that have the same UNIX identifier (UID/GID). This means that you almost 
+		certainly have to edit a lot of data. It would be easiest to dump each database in smbpasswd
+		file format and then manually edit all records to ensure that each has a unique UID. Each
+		file can then be imported a number of ways. You can use the <command>pdbedit</command> tool
+		to affect a transfer from the smbpasswd file to LDAP, or you can migrate them en masse to
+		tdbsam and then to LDAP. The final choice is yours. Just remember to verify all accounts that
+		you have migrated before handing over access to a user. After all, too many users with a bad
+		migration experience may threaten your career.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>machine accounts</primary>
+	      </indexterm><indexterm>
+		<primary>accounts</primary>
+		<secondary>machine</secondary>
+	      </indexterm>
+		I want to change my domain name after I migrate all accounts from an NT4 domain to a 
+		Samba-3 domain. Does it make any sense to migrate the machine accounts in that case?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>registry</primary>
+	      </indexterm><indexterm>
+		<primary>un-join</primary>
+	      </indexterm><indexterm>
+		<primary>rejoin</primary>
+	      </indexterm><indexterm>
+		<primary>tattooing</primary>
+	      </indexterm>
+		I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries
+		on each Windows NT4 and upward client that have a tattoo of the old domain name. If you
+		unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid
+		this tattooing effect.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>multiple group mappings</primary>
+	      </indexterm>
+		After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>/etc/passwd</primary>
+	      </indexterm><indexterm>
+		<primary>/etc/group</primary>
+	      </indexterm>
+		Samba-3 currently does not implement multiple group membership internally. If you use the Windows 
+		NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group
+		membership is stored in the POSIX groups area. If you use either tdbsam or smbpasswd backend,
+		then multiple group membership is handled through the UNIX groups file. When you dump the user
+		accounts, no group account information is provided. When you edit (change) UIDs and GIDs in each
+		file to which you migrated the NT4 Domain data, do not forget to edit the UNIX <filename>/etc/passwd</filename>
+		and <filename>/etc/group</filename> information also. That is where the multiple group information
+		is most closely at your fingertips.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		How can I reset group membership after loading the account information into the LDAP database?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>SRVTOOLS.EXE</primary>
+	      </indexterm>
+		You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The
+		installation file is called <filename>SRVTOOLS.EXE</filename>.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>group names</primary>
+	      </indexterm>
+		What are the limits or constraints that apply to group names?
+		</para>
+
+	</question>
+	<answer>
+
+	    <para><indexterm>
+		<primary>limit</primary>
+	      </indexterm><indexterm>
+		<primary>shadow-utils</primary>
+	      </indexterm><indexterm>
+		<primary>groupadd</primary>
+	      </indexterm><indexterm>
+		<primary>groupdel</primary>
+	      </indexterm><indexterm>
+		<primary>groupmod</primary>
+	      </indexterm><indexterm>
+		<primary>account names</primary>
+	      </indexterm>
+		A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group
+		name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows 
+		groups can contain upper- and lowercase characters, as well as spaces.
+		Many UNIX system do not permit the use of uppercase characters, and some do not permit the
+		space character either. A number of systems (i.e., Linux) work fine with both uppercase
+		and space characters in group names, but the shadow-utils package that provides the group
+		control functions (<command>groupadd</command>, <command>groupmod</command>, <command>groupdel</command>, and so on) do not permit them.
+		Also, a number of UNIX systems management tools enforce their own particular interpretation
+		of the POSIX standards and likewise do not permit uppercase or space characters in group
+		or user account names. You have to experiment with your system to find what its 
+		peculiarities are.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+	    <para><indexterm>
+		<primary>vampire</primary>
+	      </indexterm>
+		My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3
+		LDAP backend system using the vampire process?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		UNIX UIDs and GIDs on most UNIX systems use an unsigned short or an unsigned integer. Recent Linux
+		kernels support at least a much larger number. On systems that have a 16-bit constraint on UID/GIDs,
+		you would not be able to migrate 323,000 accounts because this number cannot fit into a 16-bit unsigned
+		integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. 
+		Please check this carefully before you attempt to effect a migration using the vampire process.
+		</para>
+
+	    <para><indexterm>
+		<primary>Migration speed</primary>
+	      </indexterm>
+		Migration speed depends much on the processor speed, the network speed, disk I/O capability, and
+		LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP
+		to a second identical system over 1 Gb Ethernet, I was able to migrate around 180 user accounts
+		per minute. Migration would obviously go much faster if LDAP mirroring were turned off during the migration.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	</qandaset>
+
+</sect1>
+
+</chapter>
+
diff --git a/docs/Samba3-ByExample/SBE-MigrateNW4Samba3.xml b/docs/Samba3-ByExample/SBE-MigrateNW4Samba3.xml
new file mode 100644
index 0000000000..fcdf69abbd
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-MigrateNW4Samba3.xml
@@ -0,0 +1,1788 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="nw4migration">
+  <title>Migrating NetWare Server to Samba-3</title>
+
+	<para>
+	<indexterm><primary>Novell</primary></indexterm>
+	<indexterm><primary>SUSE</primary></indexterm>
+	Novell is a company any seasoned IT manager has to admire. It has become increasingly
+	Linux-friendly and is emerging out of a deep regression that almost saw the company
+	disappear into obscurity. Novell's SUSE Linux hosts the NetWare server and it is the
+	platform of choice to which many older NetWare servers are being migrated. 
+	It will be interesting to see what becomes of NetWare over time.
+	Meanwhile, there can be no denying that Novell is a Linux company.
+	</para>
+
+	<para>
+	<indexterm><primary>Red Hat</primary></indexterm>
+	<indexterm><primary>Debian</primary></indexterm>
+	<indexterm><primary>Gentoo</primary></indexterm>
+	<indexterm><primary>Mandrake</primary></indexterm>
+	Whatever flavor of Linux is preferred in your environment, whether Red Hat, Debian,
+	Gentoo, Mandrake, or SUSE (Novell), the information in this chapter should be read with
+	the knowledge that file locations may vary a little; even so, the information
+	in this chapter should provide something of value.
+	</para>
+
+	<para>
+	<indexterm><primary>migration</primary></indexterm>
+	Contributions to this chapter were made by Misty Stanley-Jones, a UNIX administrator of many
+	years who surfaced on the Samba mailing list with a barrage of questions and who
+	regularly helps other administrators to solve thorny Samba migration questions.
+	</para>
+
+	<para>
+	<indexterm><primary>NetWare</primary></indexterm>
+	<indexterm><primary>NLM</primary></indexterm>
+	<indexterm><primary>NetWare</primary></indexterm>
+	<indexterm><primary>Mars_NWE</primary></indexterm>
+	One wonders how many NetWare servers remain in active service. Many are being migrated
+	to Samba on Linux. Red Hat Linux, SUSE Linux 9.x, and SUSE Linux Enterprise Server 9 are
+	ideal target platforms to which a NetWare server may be migrated. The migration method
+	of choice is much dependent on the tools that the administrator finds most natural to use.
+	The old-hand NetWare guru will likely want to use tools like the NetWare NLM for
+	<command>rsync</command> to migrate files from the NetWare server to the Samba server.
+	The UNIX administrator might prefer tools that are part of the Mars_NWE (Martin Stovers' NetWare
+	Emulator) open source package. The MS Windows network administrator will likely make use of the
+	NWConv utility that is a part of Windows NT4 Server. Whatever your tool of choice,
+	migration will be filled with joyous and challenging moments &smbmdash; though probably not
+	concurrently.
+	</para>
+
+	<para>
+	The priority that Misty faced was one of migration of the data files off the NetWare 4.11
+	server and onto a Samba-based Windows file and print server. This chapter does not pretend
+	to document all the different methods that could be used to migrate user and group accounts
+	off a NetWare server. Its focus is on migration of data files.
+	</para>
+
+	<para>
+	This chapter tells its own story, so ride along. Maybe the information presented here
+	will help to smooth over a similar migration challenge in your favorite networking environment.
+	</para>
+
+	<para>
+	File paths have been modified to permit use of RPM packages provided by Novell. In the
+	original documentation contributed by Misty, the Courier-IMAP package had been built
+	directly from the original source tarball.
+	</para>
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>
+	<indexterm><primary>Novell</primary></indexterm>
+	Misty Stanley-Jones was recruited by Abmas to administer a network that had
+	not received much attention for some years and was much in need of a makeover.
+	As a brand-new sysadmin to this company, she inherited a very old Novell file server
+	and came with a determination to change things for the better.
+	</para>
+
+	<para>
+	A site survey turned up the following details for the old NetWare server:
+	</para>
+
+	<simplelist>
+		<member><para>200 MHz MMX processor</para></member>
+		<member><para>512K RAM</para></member>
+		<member><para>24 GB disk space in RAID1</para></member>
+		<member><para>Novell 4.11 patched to service pack 7</para></member>
+		<member><para>60+ users</para></member>
+		<member><para>7 network-attached printers</para></member>
+	</simplelist>
+
+	<para>
+	The company had outgrown this server several years before and was dealing with
+	severe growing pains. Some of the problems experienced were:
+	</para>
+		
+	<itemizedlist>
+		<listitem>
+			<para>Very slow performance</para>
+		</listitem>
+		<listitem>
+			<para>Available storage hovering around the 5% range</para>
+			<itemizedlist>
+				<listitem>
+					<para>Extremely slow print spooling.</para>
+				</listitem>
+				<listitem>
+					<para>
+					Users storing information on their local hard
+					drives, causing backup integrity problems
+					</para>
+				</listitem>
+			</itemizedlist>
+		</listitem>
+	  </itemizedlist>
+
+	<para>
+	<indexterm><primary>payroll</primary></indexterm>
+	At one point disk space had filled up to 100 percent, causing the payroll database
+	to become corrupt. This caused the accounting department to be down for over
+	a week and necessitated deployment of another file server. The replacement
+	server was created with very poor security and design considerations from
+	a discarded desktop PC.
+	</para>
+
+	<sect2>
+		<title>Assignment Tasks</title>
+
+	<para>
+	Misty has provided this summary of her migration experience in the hope
+	that it will help someone to avoid the challenges she faced. Perhaps her
+	configuration files and background will accelerate your learning as you
+	grapple with a similar migration challenge. Let there be no confusion,
+	the information presented in this chapter is provided to demonstrate
+	how Misty dealt with a particular NetWare migration requirement, and
+	it provides an overall approach to the implementation of a Samba-3
+	environment that is significantly divergent from that presented in
+	<link linkend="happy"/>.
+	</para>
+
+	<para>
+	The complete removal of all site-specific information in order to produce	
+	a generic migration solution would rob this chapter of its character.
+	It should be recognized, therefore, that the examples given require
+	significant adaptation to suit local needs and thus
+	there are some gaps in the example files. That is not Misty's fault;it
+	is the result of treatment given to her files in an attempt to make
+	the overall information more useful to you.
+	</para>
+
+	<para>
+	<indexterm><primary>cost-benefit</primary></indexterm>
+	After management reviewed a cost-benefit report as well as an estimated
+	time-to-completion, approval was given proceed with the solution proposed.
+	The server was built from purchased components. The total project cost
+	was $3,000. A brief description of the configuration follows:
+	</para>
+
+	<simplelist>
+		<member>
+			<para>3.0 GHz P4 Processor</para>
+		</member>
+		<member>
+			<para>1 GB RAM</para>
+		</member>
+		<member>
+			<para>120 GB SATA operating system drive</para>
+		</member>
+		<member>
+			<para>4 x 80 GB SATA data drives (RAID5 240 GB capacity)</para>
+		</member>
+		<member>
+			<para>2 x 80 GB SATA removable drives for online backup</para>
+		</member>
+		<member>
+			<para>A DLT drive for asynchronous offline backup</para>
+		</member>
+		<member>
+			<para>SUSE Linux Professional 9.1</para>
+		</member>
+	</simplelist>
+
+	<para>
+	The new system has operated for 6 months without problems. Over the past months
+	much attention has been focused on cleaning up desktops and user profiles.
+	</para>
+
+	</sect2>
+</sect1>
+
+<sect1>
+	<title>Dissection and Discussion</title>
+
+	<para>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>e-Directory</primary></indexterm>
+	<indexterm><primary>authentication</primary></indexterm>
+	<indexterm><primary>identity management</primary></indexterm>
+	A decision to use LDAP was made even though I knew nothing about LDAP except that
+	I had been reading the book <quote>LDAP System Administration,</quote> by Gerald Carter.
+	LDAP seemed to provide some of the functionality of Novell's e-Directory Services
+	and would provide centralized authentication and identity management.
+	</para>
+
+	<para>
+	<indexterm><primary>database</primary></indexterm>
+	<indexterm><primary>RPM</primary></indexterm>
+	<indexterm><primary>tree</primary></indexterm>
+	Building the LDAP database took a while and a lot of trial and error. Following
+	the guidance I obtained from <quote>LDAP System 
+	Administration,</quote> I installed OpenLDAP (from RPM; later I compiled
+	a more current version from source) and built my initial LDAP tree.
+	</para>
+
+	<sect2>
+	<title>Technical Issues</title>
+
+	<para>
+	<indexterm><primary>white-pages</primary></indexterm>
+	<indexterm><primary>inetOrgPerson</primary></indexterm>
+	<indexterm><primary>OpenLDAP</primary></indexterm>
+	<indexterm><primary>/etc/passwd</primary></indexterm>
+	<indexterm><primary>/etc/shadow</primary></indexterm>
+	<indexterm><primary>LDIF</primary></indexterm>
+	<indexterm><primary>IMAP</primary></indexterm>
+	<indexterm><primary>POP3</primary></indexterm>
+	<indexterm><primary>SMTP</primary></indexterm>
+	The first challenge was to create a company white pages, followed by manually
+	entering everything from the printed company directory. This used only the inetOrgPerson
+	object class from the OpenLDAP schemas. The next step was to write a shell script that
+	would look at the <filename>/etc/passwd</filename> and <filename>/etc/shadow</filename>
+	files on our mail server and create an LDIF file from which the information could be
+	imported into LDAP. This would allow use of LDAP for Linux authentication, IMAP, POP3,
+	and SMTP.
+	</para>
+
+	<para>
+	Because a decision was made to use Courier-IMAP the schema <quote>authldap.schema</quote>
+	from the Courier-IMAP source, tarball is necessary to resolve Courier-specific LDAP directory
+	needs. Where the Courier-IMAP file provided by SUSE is used, this file is named
+	<filename>courier.schema</filename>.
+	</para>
+
+	<para>
+	Looking back, it would have been much easier to populate the LDAP directory using a convenient
+	tool such as <command>phpLDAPAdmin</command> from the outset. An excessive amount of time was
+	spent trying to generate LDIF files that could be parsed using the <command>ldapmodify</command>
+	so that necessary changes could be written to the directory. This was a learning experience!
+	</para>
+
+	<para>
+	An attempt was made to use the PADL POSIX account migration scripts, but I gave up trying to
+	make them work. Instead, even though it is most inelegant, I wrote a simple script that did
+	what I needed. It is enclosed as a simple example to demonstrate that you do not need to be
+	a guru to make light of otherwise painful repetition. This file is listed in <link linkend="sbeamg"/>.
+	</para>
+
+<example id="sbeamg">
+<title>A Rough Tool to Create an LDIF File from the System Account Files</title>
+<screen>
+#!/bin/bash
+
+cat /etc/passwd | while read l; do
+  uid=`echo $l | cut -d : -f 1`
+  uidNumber=`echo $l | cut -d : -f 3`
+  gidNumber=`echo $1 | cut -d : -f 4`
+  gecos=`echo $l | cut -d : -f 5`
+  homeDirectory=`echo $l | cut -d : -f 6`
+  loginShell=`echo $l | cut -d : -f 6`
+  userPassword=`cat /etc/shadow | grep $uid | cut -d : -f 2`
+
+  echo "dn: cn=$gecos,ou=people,dc=mycompany,dc=com"
+  echo "objectClass: account"
+  echo "objectClass: posixAccount"
+  echo "cn: $gecos"
+  echo "uid: $uid"
+  echo "uidNumber: $uidNumber"
+  echo "gidNumber: $gidNumber"
+  echo "homeDirectory: $homeDirectory"
+  echo "loginShell: $loginShell"
+  echo "userPassword: $userPassword"
+done
+</screen>
+</example>
+
+	<note><para>
+	
+	The PADL MigrationTools are recommended for migration of the UNIX account information into
+	the LDAP directory. The tools consist of a set of Perl scripts for migration of users, groups,
+	aliases, hosts, netgroups, networks, protocols, PRCs, and services from the existing ASCII text
+	files (or from a name service such as NIS). This too set can be obtained from the <ulink url=
+	"http://www.padl.com">PADL Web site</ulink>.
+	</para></note>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Implementation</title>
+
+	<para>
+	</para>
+
+	<sect2>
+	<title>NetWare Migration Using LDAP Backend</title>
+
+	<para>
+	The following software must be installed on the SUSE Linux Enterprise Server to perform
+	this migration:
+	</para>
+
+	<simplelist>
+		<member><para>courier-imap</para></member>
+		<member><para>courier-imap-ldap</para></member>
+		<member><para>nss_ldap</para></member>
+		<member><para>openldap2-client</para></member>
+		<member><para>openldap2-devel (only for Samba compilation)</para></member>
+		<member><para>openldap2</para></member>
+		<member><para>pam_ldap</para></member>
+		<member><para>samba-3.0.20 or later</para></member>
+		<member><para>samba-client-3.0.20 or later</para></member>
+		<member><para>samba-winbind-3.0.20 or later</para></member>
+		<member><para>smbldap-tools Version 0.8.8</para></member>
+	</simplelist>
+
+	<para>
+	Each software application must be carefully configured in preparation for migration.
+	The configuration files used at Abmas are provided as a guide and should be modified
+	to meet needs at your site.
+	</para>
+
+	<sect3>
+	<title>LDAP Server Configuration</title>
+
+	<para>
+	The <filename>/etc/openldap/slapd.conf</filename> file Misty used is shown here:
+<programlisting>
+#/etc/openldap/slapd.conf
+#
+# See slapd.conf(5) for details on configuration options.
+# This file should NOT be world readable.
+#
+include   /etc/openldap/schema/core.schema
+include   /etc/openldap/schema/cosine.schema
+include   /etc/openldap/schema/inetorgperson.schema
+include   /etc/openldap/schema/nis.schema
+include   /etc/openldap/schema/samba3.schema
+include   /etc/openldap/schema/dhcp.schema
+include   /etc/openldap/schema/misc.schema
+include   /etc/openldap/schema/idpool.schema
+include   /etc/openldap/schema/eduperson.schema
+include   /etc/openldap/schema/commURI.schema
+include   /etc/openldap/schema/local.schema
+include   /etc/openldap/schema/courier.schema
+
+pidfile   /var/run/slapd/run/slapd.pid
+argsfile  /var/run/slapd/run/slapd.args
+
+replogfile  /data/ldap/log/slapd.replog
+
+# Load dynamic backend modules:
+modulepath  /usr/lib/openldap/modules
+
+#######################################################################
+# Logging parameters
+#######################################################################
+loglevel 256
+
+#######################################################################
+# SASL and TLS options
+#######################################################################
+sasl-host     ldap.corp.abmas.org
+sasl-realm    DIGEST-MD5
+sasl-secprops   none
+TLSCipherSuite HIGH:MEDIUM:+SSLV2
+TLSCertificateFile    /etc/ssl/certs/private/abmas-cert.pem
+TLSCertificateKeyFile /etc/ssl/certs/private/abmas-key.pem
+password-hash   {SSHA}
+defaultsearchbase "dc=abmas,dc=biz"
+
+#######################################################################
+# bdb database definitions
+#######################################################################
+database          bdb
+suffix            "dc=abmas,dc=biz"
+rootdn            "cn=manager,dc=abmas,dc=biz"
+rootpw            {SSHA}gdo/dUvoT4ZJmULz3rUt6A3H/hBEduJ5
+directory         /data/ldap
+mode    0600
+# The following is for BDB to make it flush its data to disk every
+# 500 seconds or 5kb of data
+checkpoint 500 5
+
+## For running slapindex
+#readonly on
+
+## Indexes for often-requested attributes
+index   objectClass             eq
+index   cn                      eq,sub
+index   sn                      eq,sub
+index   uid                     eq,sub
+index   uidNumber               eq
+index   gidNumber               eq
+index   sambaSID                eq
+index   sambaPrimaryGroupSID    eq
+index   sambaDomainName         eq
+index   default                 sub
+cachesize 2000
+
+replica         host=baa.corp.abmas.org:389
+                suffix="dc=abmas,dc=biz"
+                binddn="cn=replica,dc=abmas,dc=biz"
+                credentials=verysecret
+                bindmethod=simple
+                tls=yes
+replica         host=ns.abmas.org:389
+                suffix="dc=abmas,dc=biz"
+                binddn="cn=replica,dc=abmas,dc=biz"
+                credentials=verysecret
+                bindmethod=simple
+                tls=yes
+
+#######################################################################
+# ACL section
+#######################################################################
+## MOST RESTRICTIVE RULES MUST GO FIRST!
+# Admins get access to everything. This way I do not have to rename.
+access to *
+  by group/groupOfUniqueNames/uniqueMember="cn=LDAP
+Administrators,ou=groups,dc=abmas,dc=biz" write
+  by * break
+
+## Users can change their own passwords. 
+access to 
+attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,
+sambaPwdMustChange,sambaPwdCanChange
+  by self write
+  by * auth
+
+## Home contact info restricted to the logged-in user and the HR dept
+access to attrs=hometelephoneNumber,homePostalAddress,
+mobileTelephoneNumber,pagerTelephoneNumber
+  by group/groupOfUniqueNames/uniqueMember="cn=hr_admin,
+ou=groups,dc=abmas,dc=biz" 
+write
+  by self write
+  by * none
+
+## Everyone can read email aliases
+access to dn.sub="ou=Email Aliases,dc=abmas,dc=biz"
+  by * read
+
+## Only admins can manage email aliases
+## If someone is the role occupant of an alias they can change it -- this
+## is accomplished by the "organizationalRole" objectclass and is
+## pretty cool -- like a groupOfUniqueNames but for individual
+## users.
+access to dn.children="ou=Email Aliases,dc=abmas,dc=biz"
+  by dnattr=roleOccupant write
+  by * read
+
+## Admins and HR can add and delete users
+access to dn.sub="ou=people,dc=abmas,dc=biz"
+  by group/groupOfUniqueNames/uniqueMember="cn=hr_admin,
+ou=groups,dc=abmas,dc=biz" 
+write
+  by * read
+
+## Admins and HR can add and delete bizputers
+access to dn.sub="ou=bizputers,dc=abmas,dc=biz"
+  by group/groupOfUniqueNames/uniqueMember="cn=hr_admin,
+ou=groups,dc=abmas,dc=biz" 
+write
+  by * read
+
+## Admins and HR can add and delete groups
+access to dn.sub="ou=groups,dc=abmas,dc=biz"
+  by group/groupOfUniqueNames/uniqueMember="cn=hr_admin,
+ou=groups,dc=abmas,dc=biz" 
+write
+  by * read
+
+## This is used to quickly deactivate any LDAP object only Admins have access.
+access to dn.sub="ou=inactive,dc=abmas,dc=biz"
+  by * none
+
+## This is for programs like Windows Address Book that can 
+## detect the default search base.
+access to attrs=namingcontexts,supportedControl
+  by anonymous =cs
+  by * read
+
+## Default to read-only access
+access to *
+  by dn.base="cn=replica,ou=people,dc=abmas,dc=biz" write
+  by * read
+</programlisting>
+</para>
+
+	<para>
+	<indexterm><primary>/etc/ldap.conf</primary></indexterm>
+	The <filename>/etc/ldap.conf</filename> file used is listed in <link linkend="ch8ldap"/>.
+	</para>
+
+<example id="ch8ldap">
+<title>NSS LDAP Control File &smbmdash; /etc/ldap.conf</title>
+<screen>
+# /etc/ldap.conf
+# This file is present on every *NIX client that authenticates to LDAP.
+# For me, most of the defaults are fine. There is an amazing amount of
+# customization that can be done see the man page for info.
+
+# Your LDAP server. Must be resolvable without using LDAP. The following
+# is for the LDAP server all others use the FQDN of the server
+URI ldap://127.0.0.1
+
+# The distinguished name of the search base.
+base ou=corp,dc=abmas,dc=biz
+
+# The LDAP version to use (defaults to 3 if supported by client library)
+ldap_version 3
+
+# The distinguished name to bind to the server with if the effective
+# user ID is root. Password is stored in /etc/ldap.secret (mode 600)
+rootbinddn cn=Manager,dc=abmas,dc=biz
+
+# Filter to AND with uid=%s
+pam_filter objectclass=posixAccount
+
+# The user ID attribute (defaults to uid)
+pam_login_attribute uid
+
+# Group member attribute
+pam_member_attribute memberUID
+
+# Use the OpenLDAP password change
+# extended operation to update the password.
+pam_password exop
+
+# OpenLDAP SSL mechanism
+# start_tls mechanism uses the normal LDAP port, LDAPS typically 636
+ssl start_tls
+
+tls_cacertfile /etc/ssl/certs/private/abmas-cert.pem
+...
+</screen>
+</example>
+
+	<para>
+	The NSS control file <filename>/etc/nsswitch.conf</filename> has the following contents:
+<screen>
+# /etc/nsswitch.conf
+# This file controls the resolve order for system databases.
+
+# the following two lines obviate the "+" entry in /etc/passwd and /etc/group.
+passwd:   compat ldap
+group:    compat ldap
+# The above are all that I store in LDAP at this point. There are 
+# possibilities to store hosts, services, ethers, and lots of other things.
+</screen>
+	</para>
+
+	<para>
+	<indexterm><primary>PAM</primary></indexterm>
+	<indexterm><primary>NSS</primary></indexterm>
+	In my setup, users authenticate via PAM and NSS using LDAP-based accounts.
+	The configuration file that controls the behavior of the PAM <command>pam_unix2</command>
+	module is shown in <link linkend="sbepu2"/> file.
+	This works out of the box with the configuration files in this chapter. It
+	enables you to have no local accounts for users (it is highly advisable 
+	to have a local account for the root user).  Traps for the unwary include the following:
+	</para>
+
+<example id="sbepu2">
+<title>The PAM Control File <filename>/etc/security/pam_unix2.conf</filename></title>
+<screen>
+# pam_unix2 config file
+#
+# This file contains options for the pam_unix2.so module.
+# It contains a list of options for every type of management group,
+# which will be used for authentication, account management and
+# password management. Not all options will be used from all types of
+# management groups.
+#
+# At first, pam_unix2 will read this file and then uses the local
+# options. Not all options can be set her global.
+#
+# Allowed options are:
+#
+# debug                 (account, auth, password, session)
+# nullok                (auth)
+# md5                   (password / overwrites /etc/default/passwd)
+# bigcrypt              (password / overwrites /etc/default/passwd)
+# blowfish              (password / overwrites /etc/default/passwd)
+# crypt_rounds=XX
+# none                  (session)
+# trace                 (session)
+# call_modules=x,y,z    (account, auth, password)
+#
+#  Example:
+#  auth:        nullok
+#  account:
+#  password:    nullok blowfish crypt_rounds=8
+#  session:     none
+#
+auth: use_ldap
+account: use_ldap
+password: use_ldap
+session: none
+</screen>
+</example>
+
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>authenticate</primary></indexterm>
+	<indexterm><primary>DNS</primary></indexterm>
+	<itemizedlist>
+		<listitem>
+			<para>
+			If your LDAP database goes down, nobody can authenticate except for root.
+			</para>
+		</listitem>
+
+		<listitem>
+			<para>
+			If failover is configured incorrectly, weird behavior can occur. For example, 
+			DNS can fail to resolve.
+			</para>
+		</listitem>
+	</itemizedlist>
+
+	<para>
+	I do have two LDAP slave servers configured. That subject is beyond the scope
+	of this document, and steps for implementing it are well documented.
+	</para>
+
+	<para>
+	The following services authenticate using LDAP:
+	</para>
+	<indexterm><primary>UNIX</primary></indexterm>
+	<indexterm><primary>Postfix</primary></indexterm>
+	<indexterm><primary>Courier-IMAP</primary></indexterm>
+	<simplelist>
+		<member><para>UNIX login/ssh</para></member>
+		<member><para>Postfix (SMTP)</para></member>
+		<member><para>Courier-IMAP/IMAPS/POP3/POP3S</para></member>
+	</simplelist>
+
+	<para>
+	<indexterm><primary>white-pages</primary></indexterm>
+	<indexterm><primary>Windows Address Book</primary></indexterm>
+	Companywide white pages can be searched using an LDAP client
+	such as the one in the Windows Address Book.
+	</para>
+
+	<para>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>smbldap-tools</primary></indexterm>
+	Having gained a solid understanding of LDAP and a relatively workable LDAP tree
+	thus far, it was time to configure Samba. I compiled the latest stable Samba and
+	also installed the latest <command>smbldap-tools</command> from 
+	<ulink url="http://idealx.com">Idealx</ulink>.
+	</para>
+
+	<para>
+	The Samba &smb.conf; file was configured as shown in <link linkend="ch8smbconf"/>.
+	</para>
+
+<smbconfexample id="ch8smbconf">
+<title>Samba Configuration File &smbmdash; smb.conf Part A</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">MEGANET2</smbconfoption>
+<smbconfoption name="netbios name">MASSIVE</smbconfoption>
+<smbconfoption name="server string">Corp File Server</smbconfoption>
+<smbconfoption name="passdb backend">ldapsam:ldap://localhost</smbconfoption>
+<smbconfoption name="pam password change">Yes</smbconfoption>
+<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+<smbconfoption name="log level">1</smbconfoption>
+<smbconfoption name="log file">/data/samba/log/%m.log</smbconfoption>
+<smbconfoption name="name resolve order">wins host bcast</smbconfoption>
+<smbconfoption name="time server">Yes</smbconfoption>
+<smbconfoption name="printcap name">cups</smbconfoption>
+<smbconfoption name="show add printer wizard">No</smbconfoption>
+<smbconfoption name="cups options">Raw</smbconfoption>
+<smbconfoption name="add user script">/opt/IDEALX/sbin/smbldap-useradd -m "%u"</smbconfoption>
+<smbconfoption name="add group script">/opt/IDEALX/sbin/smbldap-groupadd -p "%g"</smbconfoption>
+<smbconfoption name="add user to group script"></smbconfoption>
+<member><parameter>/opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</parameter></member>
+<smbconfoption name="delete user from group script"></smbconfoption>
+<member><parameter>/opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</parameter></member>
+<smbconfoption name="set primary group script"></smbconfoption>
+<member><parameter>/opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</parameter></member>
+<smbconfoption name="add machine script">/usr/local/sbin/smbldap-useradd -w "%m"</smbconfoption>
+<smbconfoption name="logon script">logon.bat</smbconfoption>
+<smbconfoption name="logon path">\\%L\profiles\%U\%a</smbconfoption>
+<smbconfoption name="logon drive">H:</smbconfoption>
+<smbconfoption name="logon home">\\%L\%U</smbconfoption>
+<smbconfoption name="domain logons">Yes</smbconfoption>
+<smbconfoption name="wins support">Yes</smbconfoption>
+<smbconfoption name="ldap admin dn">cn=Manager,dc=abmas,dc=biz</smbconfoption>
+<smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
+<smbconfoption name="ldap idmap suffix">ou=People</smbconfoption>
+<smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
+<smbconfoption name="ldap passwd sync">Yes</smbconfoption>
+<smbconfoption name="ldap suffix">ou=MEGANET2,dc=abmas,dc=biz</smbconfoption>
+<smbconfoption name="ldap ssl">no</smbconfoption>
+<smbconfoption name="ldap user suffix">ou=People</smbconfoption>
+<smbconfoption name="admin users">root, "@Domain Admins"</smbconfoption>
+<smbconfoption name="printer admin">"@Domain Admins"</smbconfoption>
+<smbconfoption name="force printername">Yes</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="ch8smbconf2">
+<title>Samba Configuration File &smbmdash; smb.conf Part B</title>
+<smbconfsection name="[netlogon]"/>
+<smbconfoption name="comment">Network logon service</smbconfoption>
+<smbconfoption name="path">/data/samba/netlogon</smbconfoption>
+<smbconfoption name="write list">"@Domain Admins"</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+
+<smbconfsection name="[profiles]"/>
+<smbconfoption name="comment">Roaming Profile Share</smbconfoption>
+<smbconfoption name="path">/data/samba/profiles/</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="profile acls">Yes</smbconfoption>
+<smbconfoption name="veto files">desktop.ini</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[homes]"/>
+<smbconfoption name="comment">Home Directories</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="create mask">0770</smbconfoption>
+<smbconfoption name="veto files">desktop.ini</smbconfoption>
+<smbconfoption name="hide files">desktop.ini</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[software]"/>
+<smbconfoption name="comment">Software for %a computers</smbconfoption>
+<smbconfoption name="path">/data/samba/shares/software/%a</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+
+<smbconfsection name="[public]"/>
+<smbconfoption name="comment">Public Files</smbconfoption>
+<smbconfoption name="path">/data/samba/shares/public</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+
+<smbconfsection name="[PDF]"/>
+<smbconfoption name="comment">Location of documents printed to PDFCreator printer</smbconfoption>
+<smbconfoption name="path">/data/samba/shares/pdf</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="ch8smbconf3">
+<title>Samba Configuration File &smbmdash; smb.conf Part C</title>
+<smbconfsection name="[EVERYTHING]"/>
+<smbconfoption name="comment">All shares</smbconfoption>
+<smbconfoption name="path">/data/samba</smbconfoption>
+<smbconfoption name="valid users">"@Domain Admins"</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[CDROM]"/>
+<smbconfoption name="comment">CD-ROM on MASSIVE</smbconfoption>
+<smbconfoption name="path">/mnt</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+
+<smbconfsection name="[print$]"/>
+<smbconfoption name="comment">Printer Drivers Share</smbconfoption>
+<smbconfoption name="path">/data/samba/drivers</smbconfoption>
+<smbconfoption name="write list">root</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">All Printers</smbconfoption>
+<smbconfoption name="path">/data/samba/spool</smbconfoption>
+<smbconfoption name="create mask">0644</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[acct_hp8500]"/>
+<smbconfoption name="comment">"Accounting Color Laser Printer"</smbconfoption>
+<smbconfoption name="path">/data/samba/spool/private</smbconfoption>
+<smbconfoption name="valid users">@acct, @acct_admin, @hr, "@Domain Admins",\</smbconfoption>
+<member><parameter>@Receptionist, dwayne, terri, danae, jerry</parameter></member>
+<smbconfoption name="create mask">0644</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="copy">printers</smbconfoption>
+
+<smbconfsection name="[plotter]"/>
+<smbconfoption name="comment">Engineering Plotter</smbconfoption>
+<smbconfoption name="path">/data/samba/spool</smbconfoption>
+<smbconfoption name="create mask">0644</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="use client driver">Yes</smbconfoption>
+<smbconfoption name="copy">printers</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="ch8smbconf4">
+<title>Samba Configuration File &smbmdash; smb.conf Part D</title>
+<smbconfsection name="[APPS]"/>
+<smbconfoption name="path">/data/samba/shares/Apps</smbconfoption>
+<smbconfoption name="force group">"Domain Users"</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[ACCT]"/>
+<smbconfoption name="path">/data/samba/shares/Accounting</smbconfoption>
+<smbconfoption name="valid users">@acct, "@Domain Admins"</smbconfoption>
+<smbconfoption name="force group">acct</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="create mask">0660</smbconfoption>
+<smbconfoption name="directory mask">0770</smbconfoption>
+
+<smbconfsection name="[ACCT_ADMIN]"/>
+<smbconfoption name="path">/data/samba/shares/Acct_Admin</smbconfoption>
+<smbconfoption name="valid users">@�acct_admin�</smbconfoption>
+<smbconfoption name="force group">acct_admin</smbconfoption>
+
+<smbconfsection name="[HR_PR]"/>
+<smbconfoption name="path">/data/samba/shares/HR_PR</smbconfoption>
+<smbconfoption name="valid users">@hr, @acct_admin</smbconfoption>
+<smbconfoption name="force group">hr</smbconfoption>
+
+<smbconfsection name="[ENGR]"/>
+<smbconfoption name="path">/data/samba/shares/Engr</smbconfoption>
+<smbconfoption name="valid users">@engr, @receptionist, @truss, "@Domain Admins", cheri</smbconfoption>
+<smbconfoption name="force group">engr</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="create mask">0770</smbconfoption>
+
+<smbconfsection name="[DATA]"/>
+<smbconfoption name="path">/data/samba/shares/DATA</smbconfoption>
+<smbconfoption name="valid users">@engr, @receptionist, @truss, "@Domain Admins", cheri</smbconfoption>
+<smbconfoption name="force group">engr</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="create mask">0770</smbconfoption>
+<smbconfoption name="copy">engr</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="ch8smbconf5">
+<title>Samba Configuration File &smbmdash; smb.conf Part E</title>
+<smbconfsection name="[X]"/>
+<smbconfoption name="path">/data/samba/shares/X</smbconfoption>
+<smbconfoption name="valid users">@engr, @acct</smbconfoption>
+<smbconfoption name="force group">engr</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="create mask">0770</smbconfoption>
+<smbconfoption name="copy">engr</smbconfoption>
+
+<smbconfsection name="[NETWORK]"/>
+<smbconfoption name="path">/data/samba/shares/network</smbconfoption>
+<smbconfoption name="valid users">"@Domain Users"</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="create mask">0770</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+
+<smbconfsection name="[UTILS]"/>
+<smbconfoption name="path">/data/samba/shares/Utils</smbconfoption>
+<smbconfoption name="write list">"@Domain Admins"</smbconfoption>
+
+<smbconfsection name="[SYS]"/>
+<smbconfoption name="path">/data/samba/shares/SYS</smbconfoption>
+<smbconfoption name="valid users">chad</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+</smbconfexample>
+
+	<para>
+	<indexterm><primary>Qbasic</primary></indexterm>
+	<indexterm><primary>Rbase</primary></indexterm>
+	<indexterm><primary>drive letters</primary></indexterm>
+	Most of these shares are only used by one company group, but they are required
+	because of some ancient Qbasic and Rbase applications were that written expecting
+	their own drive letters.
+	</para>
+
+	<para>
+	<indexterm><primary>rsync</primary></indexterm>
+	<indexterm><primary>rsyncd.conf</primary></indexterm>
+	<indexterm><primary>synchronize</primary></indexterm>
+	Note: During the process of building the new server, I kept data files
+	up to date with the Novell server via use of <command>rsync</command>. 
+	On a separate system (my workstation in fact), which could be rebooted
+	whenever necessary, I set up a mount point to the Novell server via
+	<command>ncpmount</command>. I then created a
+	<filename>rsyncd.conf</filename> to share that mount point out to my
+	new server, and synchronized once an hour. The script I used to synchronize
+	is shown in <link linkend="sbersync"/>. The files exclusion list I used
+	is shown in <link linkend="sbexcld"/>.  The reason I had to have the
+	<command>rsync</command> daemon running on a system that could be
+	rebooted frequently is because <constant>ncpfs</constant>
+	(part of the MARS NetWare Emulation package) has a nasty habit of creating stale
+	mount points that cannot be recovered without a reboot. The reason for hourly
+	synchronization is because some part of the chain was very slow and
+	performance-heavy (whether <command>rsync</command> itself, the network,
+	or the Novell server, I am not sure, but it was probably the Novell server).
+	</para>
+
+<example id="sbersync">
+<title>Rsync Script</title>
+<screen>
+#!/bin/bash
+# Part 1 - rsync the Novell directories to the new server
+echo "#############################################"
+echo "New sync operation starting at `date`"
+if ! pgrep -fl '^rsync\&gt; ; then
+        echo "Good, no rsync is running!"
+  echo "Synchronizing oink to BHPRO"
+        rsync -av --exclude-from=/root/excludes.txt 
+baa.corp:/BHPRO/SYS1/ /data/samba/shares/SYS1
+        retval=$?
+        [ ${retval} = 0 ] &amp;&amp; echo "Sync operation completed at `date`"
+        echo "Fixing permissions"
+        # I had a whole lot more permission-fixing stuff here.  It got
+        # pared down as groups got moved over.  The problem
+        # was that the way I was mounting the directory, everything
+        # was owned by the Novell administrator which translated to
+        # Root.  This is also why I could only do one-way sync because
+        # I could not fix the ACLs on the Novell side.
+        find /data/samba/shares/Engr/ -perm +770 -exec chmod 770 {} \;
+        find /data/samba/shares/Engr/ ! -group engr -exec chgrp engr {} \;
+else
+        # This rsync took ages and ages -- I had it set to run every hour but
+        # I needed a way to prevent it running into itself.
+        echo "Oh no, rsync is already running!"
+echo "#############################################"
+fi
+</screen>
+</example>
+
+<example id="sbexcld">
+<title>Rsync Files Exclusion List &smbmdash; <filename>/root/excludes.txt</filename></title>
+<screen>
+/Acct/
+/Apps/
+/DATA/
+/Engr/*.pc3
+/Engr/plotter
+/Engr/APPOLO/
+/Engr/LIBRARY/
+/Home/Accounting/
+/Home/Angie/
+/Home/AngieY/
+/Home/Brandon/
+/Home/Carl/
+</screen>
+</example>
+
+	<para>
+	After Samba was configured, I initialized the LDAP database. The first
+	thing I had to do was store the LDAP password in the Samba configuration by
+	issuing the command (as root):
+<screen>
+&rootprompt; smbpasswd -w verysecret
+</screen>
+	where <quote>verysecret</quote> is replaced by the LDAP bind password.
+	</para>
+
+<note><para>
+The Idealx smbldap-tools package can be configured using a script called 
+<command>configure.pl</command> that is provided as part of the tool. See <link linkend="happy"/>
+for an example of its use. Many administrators, like Misty, choose to do this manually
+so as to maintain greater awareness of how the tool-chain works and possibly to avoid
+undesirable actions from occurring unnoticed.
+</para></note>
+
+	<para>
+	Now Samba was ready for use and it was time to configure the smbldap-tools. There are two
+	relevant files, which are usually put into the directory
+	<filename>/etc/smbldap-tools</filename>. The main file,
+	<filename>smbldap.conf</filename> is shown in <link linkend="ch8ideal"/>.
+	</para>
+
+<example id="ch8ideal">
+<title>Idealx smbldap-tools Control File &smbmdash; Part A</title>
+<screen>
+#########
+#
+# located in /etc/smbldap-tools/smbldap.conf
+#
+##############################################################################
+#
+# General Configuration
+#
+##############################################################################
+
+# Put your own SID
+# to obtain this number do: net getlocalsid
+SID="S-1-5-21-725326080-1709766072-2910717368"
+
+##############################################################################
+#
+# LDAP Configuration
+#
+##############################################################################
+
+# Notes: to use to dual ldap servers backend for Samba, you must patch
+# Samba with the dual-head patch from IDEALX. If not using this patch
+# just use the same server for slaveLDAP and masterLDAP.
+# Those two servers declarations can also be used when you have
+# . one master LDAP server where all writing operations must be done
+# . one slave LDAP server where all reading operations must be done
+#   (typically a replication directory)
+
+# Ex: slaveLDAP=127.0.0.1
+slaveLDAP="127.0.0.1"
+slavePort="389"
+
+# Master LDAP : needed for write operations
+# Ex: masterLDAP=127.0.0.1
+masterLDAP="127.0.0.1"
+masterPort="389"
+
+# Use TLS for LDAP
+# If set to 1, this option will use start_tls for connection
+# (you should also used the port 389)
+ldapTLS="0"
+
+# How to verify the server's certificate (none, optional or require)
+# see "man Net::LDAP" in start_tls section for more details
+verify=""
+</screen>
+</example>
+
+<example id="ch8ideal2">
+<title>Idealx smbldap-tools Control File &smbmdash; Part B</title>
+<screen>
+# CA certificate
+# see "man Net::LDAP" in start_tls section for more details
+cafile=""
+ certificate to use to connect to the ldap server
+# see "man Net::LDAP" in start_tls section for more details
+clientcert=""
+
+# key certificate to use to connect to the ldap server
+# see "man Net::LDAP" in start_tls section for more details
+clientkey=""
+
+# LDAP Suffix
+# Ex: suffix=dc=IDEALX,dc=ORG
+suffix="ou=MEGANET2,dc=abmas,dc=biz"
+
+# Where are stored Users
+# Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG"
+usersdn="ou=People,${suffix}"
+
+# Where are stored Computers
+# Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG"
+computersdn="ou=People,${suffix}"
+
+# Where are stored Groups
+# Ex groupsdn="ou=Groups,dc=IDEALX,dc=ORG"
+groupsdn="ou=Groups,${suffix}"
+
+# Where are stored Idmap entries (used if samba is a domain member server)
+# Ex groupsdn="ou=Idmap,dc=IDEALX,dc=ORG"
+idmapdn="ou=Idmap,${suffix}"
+
+# Where to store next uidNumber and gidNumber available
+sambaUnixIdPooldn="sambaDomainName=MEGANET2,dc=abmas,dc=biz"
+
+# Default scope Used
+scope="sub"
+</screen>
+</example>
+
+<example id="ch8ideal3">
+<title>Idealx smbldap-tools Control File &smbmdash; Part C</title>
+<screen>
+# Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA)
+hash_encrypt="MD5"
+
+# if hash_encrypt is set to CRYPT, you may set a salt format.
+# default is "%s", but many systems will generate MD5 hashed
+# passwords if you use "$1$%.8s". This parameter is optional!
+crypt_salt_format="%s"
+
+##############################################################################
+#
+# Unix Accounts Configuration
+#
+##############################################################################
+
+# Login defs
+# Default Login Shell
+# Ex: userLoginShell="/bin/bash"
+userLoginShell="/bin/false"
+
+# Home directory
+# Ex: userHome="/home/%U"
+userHome="/home/%U"
+
+# Gecos
+userGecos="Samba User"
+
+# Default User (POSIX and Samba) GID
+defaultUserGid="513"
+
+# Default Computer (Samba) GID
+defaultComputerGid="515"
+
+# Skel dir
+skeletonDir="/etc/skel"
+
+# Default password validation time (time in days) Comment the next line if
+# you don't want password to be enable for defaultMaxPasswordAge days (be
+# careful to the sambaPwdMustChange attribute's value)
+defaultMaxPasswordAge="45"
+</screen>
+</example>
+
+<example id="ch8ideal4">
+<title>Idealx smbldap-tools Control File &smbmdash; Part D</title>
+<screen>
+##############################################################################
+#
+# SAMBA Configuration
+#
+##############################################################################
+
+# The UNC path to home drives location (%U username substitution)
+# Ex: \\My-PDC-netbios-name\homes\%U
+# Just set it to a null string if you want to use the smb.conf 'logon home'
+# directive and/or disable roaming profiles
+userSmbHome=""
+
+# The UNC path to profiles locations (%U username substitution)
+# Ex: \\My-PDC-netbios-name\profiles\%U
+# Just set it to a null string if you want to use the smb.conf 'logon path'
+# directive and/or disable roaming profiles
+userProfile=""
+
+# The default Home Drive Letter mapping
+# (will be automatically mapped at logon time if home directory exist)
+# Ex: H: for H:
+userHomeDrive=""
+
+# The default user netlogon script name (%U username substitution)
+# if not used, will be automatically username.cmd
+# make sure script file is edited under DOS
+# Ex: %U.cmd
+# userScript="startup.cmd" # make sure script file is edited under DOS
+userScript=""
+
+# Domain appended to the users "mail"-attribute
+# when smbldap-useradd -M is used
+mailDomain="abmas.org"
+
+##############################################################################
+#
+# SMBLDAP-TOOLS Configuration (default are ok for a RedHat)
+#
+##############################################################################
+# Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but
+# prefer Crypt::SmbHash library
+with_smbpasswd="0"
+smbpasswd="/usr/bin/smbpasswd"
+</screen>
+</example>
+
+	<para>
+	<indexterm><primary>TLS</primary></indexterm>
+	Note: I chose not to take advantage of the TLS capability of this. 
+	Eventually I may go back and tweak it.  Also, I chose not to take advantage
+	of the master/slave configuration as I heard horror stories that it was
+	unstable.  My slave servers are replicas only.
+	</para>
+
+	<para>
+	The <filename>/etc/smbldap-tools/smbldap_bind.conf</filename> file is shown here:
+<screen>
+# smbldap_bind.conf
+#
+# This file simply tells smbldap-tools how to bind to your LDAP server.
+# It has to be a DN with full write access to the Samba portion of
+# the database.
+
+############################
+# Credential Configuration #
+############################
+# Notes: you can specify two different configurations if you use a
+# master ldap for writing access and a slave ldap server for reading access
+# By default, we will use the same DN (so it will work for standard Samba
+# release)
+slaveDN="cn=Manager,dc=abmas,dc=biz"
+slavePw="verysecret"
+masterDN="cn=Manager,dc=abmas,dc=biz"
+masterPw="verysecret"
+</screen>
+	</para>
+
+	<para>
+	The next step was to run the <command>smbldap-populate</command> command, which populates
+	the LDAP tree with the appropriate default users, groups, and UID and GID pools.
+	It creates a user called Administrator with UID=0 and GID=0 matching the
+	Domain Admins group. This is fine because you can still log on as root to a Windows system,
+	but it will break cached credentials if you need to log on as the administrator
+	to a system that is not on the network.
+	</para>
+
+	<para>
+	After the LDAP database has been preloaded, it is prudent to validate that the
+	information needed is in the LDAP directory. This can be done done by restarting
+	the LDAP server, then performing an LDAP search by executing:
+<screen>
+&rootprompt; ldapsearch -W -x -b "dc=abmas,dc=biz"\
+	 -D "cn=Manager,dc=abmas,dc=biz" \
+	"(Objectclass=*)"
+Enter LDAP Password:
+# extended LDIF
+#
+# LDAPv3
+# base &lt;dc=abmas,dc=biz&gt; with scope sub
+# filter: (ObjectClass=*)
+# requesting: ALL
+#
+
+# abmas.biz
+dn: dc=abmas,dc=biz
+objectClass: dcObject
+objectClass: organization
+o: abmas
+dc: abmas
+
+# People, abmas.biz
+dn: ou=People,dc=abmas,dc=biz
+objectClass: organizationalUnit
+ou: People
+
+# Groups, abmas.biz
+dn: ou=Groups,dc=abmas,dc=biz
+objectClass: organizationalUnit
+ou: Groups
+
+# Idmap, abmas.biz
+dn: ou=Idmap,dc=abmas,dc=biz
+objectClass: organizationalUnit
+ou: Idmap
+...
+</screen>
+	</para>
+
+	<para>
+	<indexterm><primary>Windows</primary></indexterm>
+	<indexterm><primary>POSIX</primary></indexterm>
+	<indexterm><primary>smbldap-groupadd</primary></indexterm>
+	<indexterm><primary>RID</primary></indexterm>
+	<indexterm><primary>sambaGroupMapping</primary></indexterm>
+	With the LDAP directory now initialized, it was time to create the Windows and POSIX
+	(UNIX) group accounts as well as the mappings from Windows groups to UNIX groups.
+	The easiest way to do this was to use <command>smbldap-groupadd</command> command.
+	It creates the group with the posixGroup and sambaGroupMapping attributes, a
+	unique GID, and an automatically determined RID. I learned the hard way not to
+	try to do this by hand.
+	</para>
+
+	<para>
+	<indexterm><primary>group mapping</primary></indexterm>
+	<indexterm><primary>smbldap-groupmod</primary></indexterm>
+	<indexterm><primary>memberUID</primary></indexterm>
+	After I had my group mappings in place, I added users to the groups (the users
+	don't really have to exist yet). I used the <command>smbldap-groupmod</command>
+	command to accomplish this. It can also be done manually by adding memberUID
+	attributes to the group entries in LDAP.
+	</para>
+
+	<para>
+	<indexterm><primary>sambaSamAccount</primary></indexterm>
+	<indexterm><primary>posixAccount</primary></indexterm>
+	<indexterm><primary>smbldap-usermod</primary></indexterm>
+	The most monumental task of all was adding the sambaSamAccount information to each
+	already existent posixAccount entry.  I did it one at a time as I moved people onto
+	the new server, by issuing the command:
+<screen>
+&rootprompt; smbldap-usermod -a -P username
+</screen>
+	<indexterm><primary>NetWare</primary></indexterm>
+	<indexterm><primary>LDIF</primary></indexterm>
+	<indexterm><primary>slapcat</primary></indexterm>
+	I completed that step for every user after asking the person what his or her current
+	NetWare password was. The wiser way to have done it would probably have been to dump the
+	entire database to an LDIF file. This can be done by executing:
+<screen>
+&rootprompt; slapcat &gt; somefile.ldif
+</screen>
+	<indexterm><primary>Perl</primary></indexterm>
+	<indexterm><primary>objectClass</primary></indexterm>
+	Then update the LDIF file created by using a Perl script to parse and add the
+	appropriate attributes and objectClasses to each entry, followed by re-importing
+	the entire database into the LDAP directory. 
+	</para>
+
+	<para>
+	Rebuilding of the LDAP directory can be done as follows:
+<screen>
+&rootprompt; rcldap stop
+&rootprompt; cd /data/ldap
+&rootprompt; rm *bdb _* log*
+&rootprompt; su - ldap -c "slapadd -l somefile.ldif"
+&rootprompt; rcldap start
+</screen>
+	This can be done at any time and for any reason, with no harm to the database.
+	</para>
+
+	<para>
+	I first added a test user, of course. The LDIF for this test user looks like
+	this, to give you an idea:
+<screen>
+# Entry 1: cn=Test User,ou=people,ou=corp,dc=abmas,dc=biz
+dn:cn=Test User,ou=people,ou=corp,dc=abmas,dc=biz
+cn: Test User
+gecos: Test User
+gidNumber: 513
+givenName: Test
+homeDirectory: /home/test.user
+homePhone: 555
+l: Somewhere
+l: ST
+mail: test.user
+o: Corp
+objectClass: top
+objectClass: inetOrgPerson
+objectClass: posixAccount
+objectClass: sambaSamAccount
+postalCode: 12345
+sn: User
+street: 10 Some St.
+uid: test.user
+uidNumber: 1074
+sambaLogonTime: 0
+sambaLogoffTime: 2147483647
+sambaKickoffTime: 2147483647
+sambaPwdCanChange: 0
+displayName: Samba User
+sambaSID: S-1-5-21-725326080-1709766072-2910717368-3148
+sambaLMPassword: 9D29C287C58448F9AAD3B435B51404EE
+sambaAcctFlags: [U]
+sambaNTPassword: D062088E99C95E37D7702287BB35E770
+sambaPwdLastSet: 1102537694
+sambaPwdMustChange: 1106425694
+userPassword: {SSHA}UzFZ2VxRGdwUueLnTGtsTBtnsvMO1oj8
+loginShell: /bin/false
+</screen>
+	</para>
+
+	<para>
+	Then I went over to a spare Windows NT machine and joined it to the MEGANET2 domain.
+	It worked, and the machine's account entry under ou=Computers looks like this:
+<screen>
+dn:uid=w2kengrspare$,ou=Computers,ou=MEGANET2,dc=abmas,dc=biz
+objectClass: top
+objectClass: inetOrgPerson
+objectClass: posixAccount
+objectClass: sambaSamAccount
+cn: w2kengrspare$
+sn: w2kengrspare$
+uid: w2kengrspare$
+uidNumber: 1104
+gidNumber: 515
+homeDirectory: /dev/null
+loginShell: /bin/false
+description: Computer
+gecos: Computer
+sambaSID: S-1-5-21-725326080-1709766072-2910717368-3208
+sambaPrimaryGroupSID: S-1-5-21-725326080-1709766072-2910717368-2031
+displayName: W2KENGRSPARE$
+sambaPwdCanChange: 1103149236
+sambaPwdMustChange: 2147483647
+sambaNTPassword: CA199C45CB6737035DB6D9D9F6CD1834
+sambaPwdLastSet: 1103149236
+sambaAcctFlags: [W          ]
+</screen>
+	</para>
+
+	<para>
+	<indexterm><primary>netlogon</primary></indexterm>
+	So now I could log on with a test user from the machine w2kengrspare. It was all well and
+	good, but that user was in no groups yet and so had pretty boring access.  I fixed that
+	by writing the login script! To write the login script, I used
+	<ulink url="http://www.kixtart.org">Kixtart</ulink> because it will work
+	with every architecture of Windows, has an active and helpful user base, and was both
+	easier to learn and more powerful than the standard netlogon scripts I have seen.
+	I also did not have to do a logon script per user or per group.
+	</para>
+
+	<para>
+	<indexterm><primary>Kixtart</primary></indexterm>
+	I downloaded Kixtart and put the following files in my netlogon share:
+<screen>
+KIX32.EXE
+KX32.dll
+KX95.dll  &lt;-- Not needed unless you are running Win9x clients.
+kx16.dll  &lt;-- Probably not needed unless you are running DOS clients.
+kxrpc.exe &lt;-- Probably useless as it has to run on the server and can
+          only be run on NT.  It's for Windows 95 to become group-aware.
+          We can get around the need.
+</screen>
+	</para>
+
+	<para>
+	<indexterm><primary>logon.kix</primary></indexterm>
+	I then wrote the <filename>logon.kix</filename> file that is shown in
+	<link linkend="ch8kix"/>. I chose to keep it all in one file, but it
+	can be split up and linked via include directives.
+	</para>
+
+<example id="ch8kix">
+<title>Kixtart Control File &smbmdash; File: logon.kix</title>
+<screen>
+; This script just calls the other scripts.
+
+; First we want to get things done for everyone.
+
+; Second, we do first-time login stuff.
+
+; Third, we go through the group-oriented scripts one at a time.
+
+
+; We want to check for group membership here to avoid the overhead of running
+; scripts which don't apply.
+call "\\massive\netlogon\scripts\main.kix"
+call "\\massive\netlogon\scripts\setup.kix"
+IF INGROUP("MEGANET2\ACCT")
+  call "scripts\acct.kix"
+ENDIF
+IF INGROUP("MEGANET2\ENGR","MEGANET2\RECEPTIONIST")
+call "\\massive\netlogon\scripts\engr.kix"
+ENDIF
+IF INGROUP("MEGANET2\FURN")
+  call "\\massive\netlogon\scripts\furn.kix"
+ENDIF
+IF INGROUP("MEGANET2\TRUSS")
+  call "\\massive\netlogon\scripts\truss.kix"
+ENDIF
+</screen>
+</example>
+
+<example id="ch8kix2">
+<title>Kixtart Control File &smbmdash; File: main.kix</title>
+<screen>
+break on
+
+; Choose whether to hide the login window or not
+IF INGROUP("MEGANET2\Domain Admins")
+  USE Z: \\massive\everything
+  SETCONSOLE("show")
+ELSE
+  ; Nobody cares about seeing the login script except admins
+  SETCONSOLE("hide")
+ENDIF
+
+; Delete all previously connected shares
+USE * /delete
+
+SETTITLE("Logging on @USERID to @LDOMAIN at @TIME")
+
+; Set the time on the workstation
+$Timeserver = "\\massive"
+Settime $TimeServer
+
+; Map the home directory
+USE H: @HOMESHR ; connect to user's home share
+IF @ERROR = 0
+
+  H:
+  CD @HOMEDIR ; change directory to user's home directory
+ENDIF
+
+; Everyone gets the N drive
+USE N: \\massive\network
+</screen>
+</example>
+
+<example id="ch8kix3">
+<title>Kixtart Control File &smbmdash; File: setup.kix, Part A</title>
+<screen>
+; My setup.kix is where all of the redirection stuff happens.  Note that with 
+; the use of registry keys, this only happens the first time they log in ,or if 
+; I delete the pertinent registry keys which triggers it to happen again:
+
+; Check to see if we have written the abmas sub-key before
+$RETURNCODE = EXISTKEY("HKEY_CURRENT_USER\abmas")
+IF NOT $RETURNCODE = 0
+; Add key for abmas-specific things on the first login
+  ADDKEY("HKEY_CURRENT_USER\abmas")
+  ; The following key gets deleted at the end of the first login
+  ADDKEY("HKEY_CURRENT_USER\abmas\FIRST_LOGIN")
+ENDIF
+
+; People with laptops need My Documents to be in their profile.  People with
+; desktops can have My Documents redirected to their home directory to avoid
+; long delays with logging out and out-of-sync files.
+
+; Check to see if this is the first login -- doesn't make sense to do this
+; at the very first login
+
+$RETURNCODE = EXISTKEY("HKEY_CURRENT_USER\abmas\FIRST_LOGIN")
+IF NOT $RETURNCODE = 0
+
+; We don't want to do this stuff for people with laptops or people in the FURN
+; group.  (They store their profiles in a different server)
+
+  IF NOT INGROUP("MASSIVE\Laptop","MASSIVE\FURN")
+    $RETURNCODE=EXISTKEY("HKEY_CURRENT_USER\abmas\profile_copied")
+
+; A  crude way to tell what OS our profile is for and copy the "My Documents"
+; to the redirected folder on the server.  It works because the profiles
+; are stored as \\server\profiles\user\architecture
+    IF NOT $RETURNCODE = 0
+      IF EXIST("\\massive\profiles\@userID\WinXP")
+        copy "\\massive\profiles\@userID\WinXP\My Documents\*" 
+"\\massive\@userID\"
+      ENDIF
+      IF EXIST("\\massive\profiles\@userID\Win2K")
+        copy "\\massive\profiles\@userID\Win2K\My Documents\*" 
+"\\massive\@userID\"
+      ENDIF
+      IF EXIST("\\massive\profiles\@userID\WinNT")
+        copy "\\massive\profiles\@userID\WinNT\My Documents\*" 
+"\\massive\@userID\"
+      ENDIF
+</screen>
+</example>
+
+<example id="ch8kix3b">
+<title>Kixtart Control File &smbmdash; File: setup.kix, Part B</title>
+<screen>
+; Now we will write the registry values to redirect the locations of "My 
+Documents"
+; and other folders.
+      ADDKEY("HKEY_CURRENT_USER\abmas\profile_copied")
+      WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
+Windows\CurrentVersion\Explorer\User 
+Shell Folders", "Personal","\\massive\@userID","REG_SZ")
+      WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
+Windows\CurrentVersion\Explorer\User 
+Shell Folders", "My Pictures", "\\massive\@userID\My Pictures", "REG_SZ")
+      IF @PRODUCTTYPE="Windows 2000 Professional" or @PRODUCTTYPE="Windows XP
+Professional"
+      WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
+Windows\CurrentVersion\Explorer\User 
+Shell Folders", "My Videos", "\\massive\@userID\My Videos", "REG_SZ")
+      WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
+Windows\CurrentVersion\Explorer\User 
+Shell Folders", "My Music", "\\massive\@userID\My Music", "REG_SZ")
+      WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
+Windows\CurrentVersion\Explorer\User 
+Shell Folders", "My eBooks", "\\massive\@userID\My eBooks", "REG_SZ")
+      ENDIF
+    ENDIF
+  ENDIF
+
+; Now we will delete the FIRST_LOGIN sub-key that we made before.
+; Note - to run this script again you will want to delete the HKCU\abmas
+; sub-key, log out, and log back in.
+$RETURNVALUE = EXISTKEY("HKEY_CURRENT_USER\abmas\FIRST_LOGIN")
+IF $RETURNVALUE = 0
+  DELKEY("HKEY_CURRENT_USER\abmas\FIRST_LOGIN")
+ENDIF
+</screen>
+</example>
+
+<example id="ch8kix4">
+<title>Kixtart Control File &smbmdash; File: acct.kix</title>
+<screen>
+; And here is one group-oriented script to show what can be
+; done that way: acct.kix:
+
+IF INGROUP("MASSIVE\Acct_Admin","MASSIVE\HR")
+  USE I: \\MEGANET2\HR_PR
+ENDIF
+
+; Set up printer
+$RETURNVALUE = existkey("HKEY_CURRENT_USER\Printers\,,massive,acct_hp8500")
+IF NOT $RETURNVALUE = 0
+  ADDPRINTERCONNECTION("\\massive\acct_hp8500")
+  SETDEFAULTPRINTER("\\massive\acct_hp8500")
+ENDIF
+; Set up drive mappings
+  USE M: \\massive\ACCT
+  IF INGROUP("MEGANET2\ABRA")
+    USE T: \\trussrv\abra
+  ENDIF
+</screen>
+</example>
+
+	<para>
+	As you can see in the script, I redirected the My Documents to the user's home
+	share if he or she were not in the Laptop group. I also added printers on a
+	group-by-group basis, and if applicable I set the group printer. For this to
+	be effective, the print drivers must be installed on the Samba server in the
+	<filename>[print$]</filename> share. Ample documentation exists about how to
+	do that, so it is not covered here.
+	</para>
+
+	<para>
+	I call this script via the logon.bat script in the [netlogon] directory:
+<screen>
+\\corpsrv\netlogon\kix32 \\corpsrv\netlogon\logon.kix /f
+</screen>
+	I only had to fully qualify the paths for Windows 9x, as Windows NT and
+	greater automatically add [NETLOGON] to the path.
+	</para>
+
+	<para>
+	Also of note for Win9x is that the drive mappings and printer setup will not
+	work because they rely on RPC. You merely have to put the appropriate settings
+	into the <filename>c:\autoexec.bat</filename> file or map the drives manually.
+	One option is to check the OS as part of the Kixtart script, and if it
+	is Win9x and is the first login, copy a premade
+	<filename>autoexec.bat</filename> to the <filename>C:</filename> drive. I
+	have only three such machines, and one is going away in the very near future,
+	so it was easier to do it by hand.
+	</para>
+
+	<para>
+	<indexterm><primary>upgrade</primary></indexterm>
+	At this point I was able to add the users. This is the part that really falls
+	into upgrade. I moved the users over one group at a time, starting with the
+	people who used the least amount of resources on the network. With each group
+	that I moved, I first logged on as a standard user in that group and took
+	careful note of the environment, mainly the printers he or she used, the PATH,
+	and what network resources he or she had access to (most importantly, which ones
+	the user actually needed access to).
+	</para>
+
+	<para>
+	I then added the user's SambaSamAccount information as mentioned earlier,
+	and join the computer to the domain. The very first thing I had to do was to
+	copy the user's profile to the new server. This was very important, and I really
+	struggled with the most effective way to do it.  Here is the method that worked
+	for every one of my users on Windows NT, 2000, and XP:
+	</para>
+
+	<procedure>
+		<step><para>
+			Log in as the user on the domain. This creates the local copy
+			of the user's profile and copies it to the server as he or she logs out.
+		</para></step>
+
+		<step><para>
+			Reboot the computer and log in as the local machine administrator.
+		</para></step>
+
+		<step><para>
+			Right-click My Computer, click Properties, and navigate to the
+			user profiles tab (varies per version of Windows).
+		</para></step>
+
+		<step><para>
+			Select the user's local profile <constant>(COMPUTERNAME\username)</constant>,
+			and click the <command>Copy To</command> button.
+		</para></step>
+
+		<step><para>
+			In the next dialog, copy it directly to the profiles share on the
+			Samba server (\\PDCname\profiles\user\&lt;architecture&gt; in my
+			case). You will have had to make a connection to the share as that
+			user (e.g., Windows Explorer type \\PDCname\profiles\username).
+		</para></step>
+
+		<step><para>
+			When the copy is complete (it can take a while) log out, and log back in
+			as the user. All of his or her settings and all contents of My Documents,
+			Favorites, and the registry should have been copied successfully.
+		</para></step>
+
+		<step><para>
+			If it doesn't look right (the dead giveaway is the desktop background),
+			shut down the computer without logging out (power cycle) and try logging
+			in as the user again. If it still doesn't work, repeat the steps above.
+			I only had to ever repeat it once.
+		</para></step>
+
+	</procedure>
+
+	<para>
+	Words to the Wise:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+			If the user was anything other than a standard user on his or her system
+			before, you will save yourself some headaches by giving him or her identical
+			permissions (on the local machine) as his or her domain account <emphasis>before</emphasis>
+			copying the profile over. Do this through the User Administrator
+			in the Control Panel, after joining the computer to the domain and
+			before logging on as that user for the first time. Otherwise the user will
+			have trouble with permissions on his or her registry keys.
+		</para></listitem>
+
+		<listitem><para>
+			If any application was installed for the user only, rather than for
+			the entire system, it will probably not work without being reinstalled.
+		</para></listitem>
+	</itemizedlist>
+
+	<para>
+	After all these steps are accomplished, only cleanup details are left. Make sure user's
+	shortcuts and Network Places point to the appropriate place on the new server, check
+	the important applications to be sure they work as expected and troubleshoot any problems
+	that might arise, and check to be sure the user's printers are present and working. By the
+	way, if there are any network printers installed as system printers (the Novell way),
+	you will need to log in as a local administrator and delete them.
+	</para>
+
+	<para>
+	For my non-laptop systems, I would then log in and out a couple times as the user
+	to be sure that his or her registry settings were modified, and then I was finished.
+	</para>
+
+	<para>
+	Some compatibility issues that cropped up included the following:
+	</para>
+
+	<para>
+	Blackberry client: It did not like having its registry settings moved around
+	and so had to be reinstalled. Also, it needed write permissions to a portion of
+	the hard drive, and I had to give it those manually on the one system where
+	this was an issue.
+	</para>
+
+	<para>
+	CAMedia: Digital camera software for Canon cameras caused all kinds of trouble
+	with the registry. I had to use the Run as service to open the registry of
+	the local user while logged in as the domain user, and give the domain user
+	the appropriate permissions to some registry keys, then export that portion
+	of the registry to a file. Then, as the domain user, I had to import that file
+	into the registry.
+	</para>
+
+	<para>
+	Crystal Reports version 7: More registry problems that were solved by recopying
+	the user's profile.
+	</para>
+
+	<para>
+	Printing from legacy applications: I found out that Novell sends its jobs to
+	the printer in a raw format. CUPS sends them in PostScript by default. I had
+	to make a second printer definition for one printer and tell CUPS specifically
+	to send raw data to the printer, then assign this printer to the LPT port with
+	Kixtart's version of the net use command.
+	</para>
+
+	<para>
+	These were all eventually solved by elbow grease, queries to the Samba mailing
+	list and others, and diligence. The complete migration took about 5 weeks.
+	My userbase is relatively small but includes multiple versions of Windows,
+	multiple Linux member servers, a mechanized saw, a pen plotter, and legacy
+	applications written in Qbasic and R:Base, just to name a few. I actually
+	ended up making some of these applications work better (or work again, as
+	some of them had stopped functioning on the old server) because as part of
+	the process I had to find out how things were supposed to work.
+	</para>
+
+	<para>
+	The one thing I have not been able to get working is a very old database that
+	we had around for reference purposes; it uses Novell's Btrieve engine.
+	</para>
+
+	<para>
+	As the resources compare, I went from 95 percent disk usage to just around 10 percent.
+	I went from a very high load on the server to an average load of between one
+	and two runnable processes on the server. I have improved the security and
+	robustness of the system. I have also implemented
+	<ulink url="http://www.clamav.net">ClamAV</ulink> antivirus software,
+	which scans the entire Samba server for viruses every 2 hours and
+	quarantines them. I have found it much less problematic than our ancient
+	version of Norton Antivirus Corporate Edition, and much more up-to-date.
+	</para>
+
+	<para>
+	In short, my users are much happier now that the new server is running, and that
+	is what is important to me.
+	</para>
+
+	</sect3>
+
+	</sect2>
+
+</sect1>
+
+</chapter>
+
diff --git a/docs/Samba3-ByExample/SBE-SecureOfficeServer.xml b/docs/Samba3-ByExample/SBE-SecureOfficeServer.xml
new file mode 100644
index 0000000000..cc67cd4c39
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-SecureOfficeServer.xml
@@ -0,0 +1,2681 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="secure">
+  <title>Secure Office Networking</title>
+
+	<para>
+	Congratulations, your Samba networking skills are developing nicely. You started out
+	with three simple networks in <link linkend="simple"/>, and then in <link linkend="small"/>
+	you designed and built a network that provides a high degree of flexibility, integrity,
+	and dependability. It was enough for the basic needs each was designed to fulfill. In
+	this chapter you address a more complex set of needs. The solution you explore 
+	introduces you to basic features that are specific to Samba-3.
+	</para>
+
+	<para>
+	You should note that a working and secure solution could be implemented using Samba-2.2.x. 
+	In the exercises presented here, you are gradually using more Samba-3-specific features,
+	so caution is advised for anyone who tries to use Samba-2.2.x with the guidance here given. 
+	To avoid confusion, this book is all about Samba-3. Let's get the exercises in this 
+	chapter underway.
+	</para>
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>
+	You have made Mr. Meany a very happy man. Recently he paid you a fat bonus for work 
+	well done. It is one year since the last network upgrade. You have been quite busy. 
+	Two months ago Mr. Meany gave approval to hire Christine Roberson, who has taken over 
+	general network management. Soon she will provide primary user support. You have
+	demonstrated that you can delegate responsibility and can plan and execute according
+	to that plan. Above all, you have shown Mr. Meany that you are a responsible person.
+	Today is a big day. Mr. Meany called you to his office at 9 a.m. for news you never 
+	expected: You are going to take charge of business operations. Mr. Meany 
+	is retiring and has entrusted the business to your capable hands. 
+	</para>
+
+	<para>
+	Mr. Meany may be retiring from this company, but not from work. He is taking the
+	opportunity to develop Abmas Accounting into a larger and more substantial company.
+	He says that it took him many years to learn that there is no future in just running
+	a business. He now realizes there is great personal satisfaction in the creation of
+	career opportunities for people in the local community. He wants to do more for others,
+	as he is doing for you. Today he spent a lot of time talking about his grand plan
+	for growth, which you will deal with in the chapters ahead.
+	</para>
+
+	<para>
+	Over the past year, the growth projections were exceeded. The network has grown to
+	meet the needs of 130 users. Along with growth, the demand for improved services
+	and better functionality has also developed. You are about to make an interim
+	improvement and then hand over all Help desk and network maintenance to Christine.
+	Christine has professional certifications in Microsoft Windows as well as in Linux;
+	she is a hard worker and quite likable. Christine does not want to manage the department
+	(although she manages well). She gains job satisfaction when left to sort things out.
+	Occasionally she wants to work with you on a challenging problem. When you told her
+	about your move, she almost resigned, although she was reassured that a new manager would
+	be hired to run Information Technology, and she would be responsible only for operations.
+	</para>
+
+	<sect2>
+		<title>Assignment Tasks</title>
+
+		<para>
+		You promised the staff Internet services including Web browsing, electronic mail, virus
+		protection, and a company Web site.  Christine is eager to help turn the vision into 
+		reality. Let's see how close you can get to the promises made.
+		</para>
+
+		<para>
+		The network you are about to deliver will service 130 users today. Within a year,
+		Abmas will aquire another company. Mr. Meany claims that within 2 years there will be
+		well over 500 users on the network. You have bought into the big picture, so prepare 
+		for growth.  You have purchased a new server and will implement a new network infrastructure. 
+		</para>
+
+		<para>
+		You have decided to not recycle old network components. The only items that will be
+		carried forward are notebook computers. You offered staff new notebooks, but not 
+		one person wanted the disruption for what was perceived as a marginal update. 
+		You decided to give everyone, even the notebook user, a new desktop computer.
+		</para>
+
+		<para>
+		You procured a DSL Internet connection that provides 1.5 Mb/sec (bidirectional)
+		and a 10 Mb/sec ethernet port. You registered the domain
+		<constant>abmas.us</constant>, and the Internet Service Provider (ISP) is supplying
+		secondary DNS. Information furnished by your ISP is shown in <link linkend="chap4netid"/>.
+		</para>
+
+		<para>
+		It is of paramount priority that under no circumstances will Samba offer
+		service access from an Internet connection. You are paying an ISP to
+		give, as part of its value-added services, full firewall protection for your
+		connection to the outside world. The only services allowed in from
+		the Internet side are the following destination ports: <constant>http/https (ports 
+		80 and 443), email (port 25), DNS (port 53)</constant>. All Internet traffic
+		will be allowed out after network address translation (NAT). No internal IP addresses
+		are permitted through the NAT filter because complete privacy of internal network
+		operations must be assured.
+		</para>
+
+		<table id="chap4netid">
+			<title>Abmas.US ISP Information</title>
+			<tgroup cols="2">
+				<colspec align="left"/>
+				<colspec align="center"/>
+				<thead>
+					<row>
+						<entry>Parameter</entry>
+						<entry>Value</entry>
+					</row>
+				</thead>
+				<tbody>
+					<row>
+						<entry>Server IP Address</entry>
+						<entry>123.45.67.66</entry>
+					</row>
+					<row>
+						<entry>DSL Device IP Address</entry>
+						<entry>123.45.67.65</entry>
+					</row>
+					<row>
+						<entry>Network Address</entry>
+						<entry>123.45.67.64/30</entry>
+					</row>
+					<row>
+						<entry>Gateway Address</entry>
+						<entry>123.45.54.65</entry>
+					</row>
+					<row>
+						<entry>Primary DNS Server</entry>
+						<entry>123.45.54.65</entry>
+					</row>
+					<row>
+						<entry>Secondary DNS Server</entry>
+						<entry>123.45.54.32</entry>
+					</row>
+					<row>
+						<entry>Forwarding DNS Server</entry>
+						<entry>123.45.12.23</entry>
+					</row>
+				</tbody>
+			</tgroup>
+		</table>
+
+		<image id="ch04net">
+			<imagedescription>Abmas Network Topology &smbmdash; 130 Users</imagedescription>
+			<imagefile scale="65">chap4-net</imagefile>
+		</image>
+
+		<para>
+		Christine recommended that desktop systems should be installed from a single cloned
+		master system that has a minimum of locally installed software and loads all software
+		off a central application server. The benefit of having the central application server
+		is that it allows single-point maintenance of all business applications, a more
+		efficient way to manage software.  She further recommended installation of antivirus 
+		software on workstations as well as on the Samba server. Christine knows the dangers
+		of potential virus infection and insists on a comprehensive approach to detective
+		as well as corrective action to protect network operations.
+		</para>
+
+		<para>
+		A significant concern is the problem of managing company growth. Recently, a number 
+		of users had to share a PC while waiting for new machines to arrive. This presented 
+		some problems with desktop computers and software installation into the new users' 
+		desktop profiles.
+		</para>
+		
+	</sect2>
+</sect1>
+
+<sect1>
+	<title>Dissection and Discussion</title>
+
+	<para>
+	Many of the conclusions you draw here are obvious. Some requirements are not very clear
+	or may simply be your means of drawing the most out of Samba-3. Much can be done more simply
+	than you will demonstrate here, but keep in mind that the network must scale to at least 500
+	users. This means that some functionality will be overdesigned for the current 130-user
+	environment.
+	</para>
+
+	<sect2>
+		<title>Technical Issues</title>
+
+		<para>
+		In this exercise we use a 24-bit subnet mask for the two local networks. This,
+		of course, limits our network to a maximum of 253 usable IP addresses. The network
+		address range chosen is one assigned by RFC1918 for private networks.
+		When the number of users on the network begins to approach the limit of usable
+		addresses, it is a good idea to switch to a network address specified in RFC1918
+		in the 172.16.0.0/16 range. This is done in subsequent chapters.
+		</para>
+
+		<para>
+		<indexterm><primary>tdbsam</primary></indexterm>
+		<indexterm><primary>smbpasswd</primary></indexterm>
+		The high growth rates projected are a good reason to use the <constant>tdbsam</constant>
+		passdb backend. The use of <constant>smbpasswd</constant> for the backend may result in
+		performance problems. The <constant>tdbsam</constant> passdb backend offers features that
+		are not available with the older, flat ASCII-based <constant>smbpasswd</constant> database.
+		</para>
+
+		<para>
+		<indexterm><primary>risk</primary></indexterm>
+		The proposed network design uses a single server to act as an Internet services host for
+		electronic mail, Web serving, remote administrative access via SSH, 
+		Samba-based file and print services. This design is often chosen by sites that feel 	
+		they cannot afford or justify the cost or overhead of having separate servers. It must 
+		be realized that if security of this type of server should ever be violated (compromised), 
+		the whole network and all data is at risk. Many sites continue to choose this type 
+		of solution; therefore, this chapter provides detailed coverage of key implementation 
+		aspects.
+		</para>
+
+		<para>
+		Samba will be configured to specifically not operate on the Ethernet interface that is
+		directly connected to the Internet.
+		</para>
+
+		<para>
+		<indexterm><primary>iptables</primary></indexterm>
+		<indexterm><primary>NAT</primary></indexterm>
+		<indexterm><primary>Network Address Translation</primary><see>NAT</see></indexterm>
+		<indexterm><primary>firewall</primary></indexterm>
+		You know that your ISP is providing full firewall services, but you cannot rely on that.
+		Always assume that human error will occur, so be prepared by using Linux firewall facilities
+		based on <command>iptables</command> to effect NAT. Block all
+		incoming traffic except to permitted well-known ports. You must also allow incoming packets
+		to establish outgoing connections. You will permit all internal outgoing requests.
+		</para>
+
+		<para>
+		The configuration of Web serving, Web proxy services, electronic mail, and the details of
+		generic antivirus handling are beyond the scope of this book and therefore are not
+		covered except insofar as this affects Samba-3.
+		</para>
+
+		<para>
+		<indexterm><primary>login</primary></indexterm>
+		Notebook computers are configured to use a network login when in the office and a
+		local account to log in while away from the office. Users store all work done in
+		transit (away from the office) by using a local share for work files. Standard procedures
+		dictate that on completion of the work that necessitates mobile file access, all
+		work files are moved back to secure storage on the office server. Staff is instructed
+		to not carry on any company notebook computer any files that are not absolutely required.
+		This is a preventative measure to protect client information as well as private business
+		records.
+		</para>
+
+		<para>
+		<indexterm><primary>application server</primary></indexterm>
+		All applications are served from the central server from a share called <constant>apps</constant>.
+		Microsoft Office XP Professional and OpenOffice 1.1.0 will be installed using a network 
+		(or administrative) installation. Accounting and financial management software can also
+		be run only from the central application server. Notebook users are provided with
+		locally installed applications on a need-to-have basis only.
+		</para>
+
+		<para>
+		<indexterm><primary>roaming profiles</primary></indexterm>
+		The introduction of roaming profiles support means that users can move between
+		desktop computer systems without constraint while retaining full access to their data.
+		The desktop travels with them as they move.
+		</para>
+
+		<para>
+		<indexterm><primary>DNS</primary></indexterm>
+		The DNS server implementation must now address both internal and external
+		needs. You forward DNS lookups to your ISP-provided server as well as the 
+		<constant>abmas.us</constant> external secondary DNS server.
+		</para>
+
+		<para>
+		<indexterm><primary>dynamic DNS</primary></indexterm>
+		<indexterm><primary>DDNS</primary><see>dynamic DNS</see></indexterm>
+		<indexterm><primary>DHCP server</primary></indexterm>
+		Compared with the DHCP server configuration in <link linkend="small"/>, <link linkend="dhcp01"/>, the 
+		configuration used in this example has to deal with the presence of an Internet connection.
+		The scope set for it ensures that no DHCP services will be offered on the external
+		connection. All printers are configured as DHCP clients so that the DHCP server assigns
+		the printer a fixed IP address by way of the Ethernet interface (MAC) address. One additional
+		feature of this DHCP server configuration file is the inclusion of parameters to allow dynamic
+		DNS (DDNS) operation.
+		</para>
+
+		<para>
+		This is the first implementation that depends on a correctly functioning DNS server.
+		Comprehensive steps are included to provide for a fully functioning DNS server that also
+		is enabled for DDNS operation. This means that DHCP clients can be autoregistered
+		with the DNS server.
+		</para>
+
+		<para>
+		You are taking the opportunity to manually set the netbios name of the Samba server to
+		a name other than what will be automatically resolved. You are doing this to ensure that
+		the machine has the same NetBIOS name on both network segments.
+		</para>
+
+		<para>
+		As in the previous network configuration, printing in this network configuration uses
+		direct raw printing (i.e., no smart printing and no print driver autodownload to Windows
+		clients). Printer drivers are installed on the Windows client manually. This is not
+		a problem because Christine is to install and configure one single workstation and
+		then clone that configuration, using Norton Ghost, to all workstations. Each machine is
+		identical, so this should pose no problem.
+		</para>
+
+		<sect3>
+		<title>Hardware Requirements</title>
+
+		<para>
+		<indexterm><primary>memory requirements</primary></indexterm>
+		This server runs a considerable number of services. From similarly configured Linux
+		installations, the approximate calculated memory requirements are as shown in
+		<link linkend="ch4memoryest"/>.
+
+<example id="ch4memoryest">
+<title>Estimation of Memory Requirements</title>
+<screen>
+Application  Memory per User    130 Users      500 Users
+   Name        (MBytes)       Total MBytes   Total MBytes
+-----------  ---------------  ------------   ------------
+DHCP              2.5               3              3
+DNS              16.0              16             16
+Samba (nmbd)     16.0              16             16
+Samba (winbind)  16.0              16             16
+Samba (smbd)      4.0             520           2000
+Apache           10.0 (20 User)   200            200
+CUPS              3.5              16             32
+Basic OS        256.0             256            256
+                              -------------- --------------
+    Total:                       1043 MBytes    2539 MBytes
+                              -------------- --------------
+</screen>
+</example>
+		You should add a safety margin of at least 50% to these estimates. The minimum 
+		system memory recommended for initial startup 1 GB, but to permit the system
+		to scale to 500 users, it makes sense to provision the machine with 4 GB memory.
+		An initial configuration with only 1 GB memory would lead to early performance complaints
+		as the system load builds up. Given the low cost of memory, it does not make sense to
+		compromise in this area.
+		</para>
+
+		<para>
+		<indexterm><primary>bandwidth calculations</primary></indexterm>
+		Aggregate input/output loads should be considered for sizing network configuration as 
+		well as disk subsystems. For network bandwidth calculations, one would typically use an
+		estimate of 0.1 MB/sec per user. This suggests that 100-Base-T (approx. 10 MB/sec)
+		would deliver below acceptable capacity for the initial user load. It is therefore a good
+		idea to begin with 1 Gb Ethernet cards for the two internal networks, each attached
+		to a 1 Gb Ethernet switch that provides connectivity to an expandable array of 100-Base-T
+		switched ports.
+		</para>
+
+		<para>
+		<indexterm><primary>network segments</primary></indexterm>
+		<indexterm><primary>RAID</primary></indexterm>
+		Considering the choice of 1 Gb Ethernet interfaces for the two local network segments,
+		the aggregate network I/O capacity will be 2100 Mb/sec (about 230 MB/sec), an I/O
+		demand that would require a fast disk storage I/O capability. Peak disk throughput is 
+		limited by the disk subsystem chosen. It is desirable to provide the maximum 
+		I/O bandwidth affordable. If a low-cost solution must be chosen, 
+		3Ware IDE RAID Controllers are a good choice. These controllers can be fitted into a 
+		64-bit, 66 MHz PCI-X slot. They appear to the operating system as a high-speed SCSI 
+		controller that can operate at the peak of the PCI-X bandwidth (approximately 450 MB/sec).
+		Alternative SCSI-based hardware RAID controllers should also be considered. Alternately,
+		it makes sense to purchase well-known, branded hardware that has appropriate performance
+		specifications. As a minimum, one should attempt to provide a disk subsystem that can
+		deliver I/O rates of at least 100 MB/sec. 
+		</para>
+
+		<para>
+		Disk storage requirements may be calculated as shown in <link linkend="ch4diskest"/>.
+
+<example id="ch4diskest">
+<title>Estimation of Disk Storage Requirements</title>
+<screen>
+Corporate Data: 100 MBytes/user per year
+Email Storage:  500 MBytes/user per year
+Applications:   5000 MBytes
+Safety Buffer:  At least 50%
+
+Given 500 Users and 2 years:
+-----------------------------
+        Corporate Data:  2 x 100 x 500 = 100000 MBytes = 100 GBytes
+        Email Storage:   2 x 500 x 500 = 500000 MBytes = 500 GBytes
+        Applications:                      5000 MBytes =   5 GBytes
+                                       ----------------------------
+                             Total:                      605 GBytes
+             Add 50% buffer                              303 GBytes
+                       Recommended Storage:              908 GBytes
+</screen>
+</example>
+		<indexterm><primary>storage capacity</primary></indexterm>
+		The preferred storage capacity should be approximately 1 Terabyte. Use of RAID level 5
+		with two hot spare drives would require an 8-drive by 200 GB capacity per drive array.
+		</para>
+
+		</sect3>
+
+	</sect2>
+
+
+	<sect2>
+		<title>Political Issues</title>
+
+		<para>
+		Your industry is coming under increasing accountability pressures. Increased paranoia
+		is necessary so you can demonstrate that you have acted with due diligence. You must
+		not trust your Internet connection.
+		</para>
+
+		<para>
+		Apart from permitting more efficient management of business applications through use of
+		an application server, your primary reason for the decision to implement this is that it
+		gives you greater control over software licensing.
+		</para>
+
+		<para>
+		<indexterm><primary>Outlook Express</primary></indexterm>
+		You are well aware that the current configuration results in some performance issues
+		as the size of the desktop profile grows. Given that users use Microsoft Outlook
+		Express, you know that the storage implications of the <constant>.PST</constant> file
+		is something that needs to be addressed later.
+		</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Implementation</title>
+
+	<para>
+	<link linkend="ch04net"/> demonstrates the overall design of the network that you will implement.
+	</para>
+
+	<para>
+	The information presented here assumes that you are already familiar with many basic steps.
+	As this stands, the details provided already extend well beyond just the necessities of
+	Samba configuration. This decision is deliberate to ensure that key determinants
+	of a successful installation are not overlooked. This is the last case that documents
+	the finite minutiae of DHCP and DNS server configuration. Beyond the information provided
+	here, there are many other good reference books on these subjects.
+	</para>
+
+	<para>
+	The &smb.conf; file has the following noteworthy features:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		The NetBIOS name of the Samba server is set to <constant>DIAMOND</constant>.
+		</para></listitem>
+
+		<listitem><para>
+		The Domain name is set to <constant>PROMISES</constant>.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>broadcast messages</primary></indexterm>
+		<indexterm><primary>interfaces</primary></indexterm>
+		<indexterm><primary>bind interfaces only</primary></indexterm>
+		Ethernet interface <constant>eth0</constant> is attached to the Internet connection
+		and is externally exposed. This interface is explicitly not available for Samba to use.
+		Samba listens on this interface for broadcast messages but does not broadcast any
+		information on <constant>eth0</constant>, nor does it accept any connections from it.
+		This is achieved by way of the <parameter>interfaces</parameter> parameter and the
+		<parameter>bind interfaces only</parameter> entry.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>passdb backend</primary></indexterm>
+		<indexterm><primary>tdbsam</primary></indexterm>
+		<indexterm><primary>binary database</primary></indexterm>
+		The <parameter>passdb backend</parameter> parameter specifies the creation and use
+		of the <constant>tdbsam</constant> password backend. This is a binary database that
+		has excellent scalability for a large number of user account entries.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>WINS serving</primary></indexterm>
+		<indexterm><primary>wins support</primary></indexterm>
+		<indexterm><primary>name resolve order</primary></indexterm>
+		WINS serving is enabled by the <smbconfoption name="wins support">Yes</smbconfoption>,
+		and name resolution is set to use it by means of the
+		<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption> entry.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>time server</primary></indexterm>
+		The Samba server is configured for use by Windows clients as a time server.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>CUPS</primary></indexterm>
+		<indexterm><primary>printing</primary></indexterm>
+		<indexterm><primary>printcap name</primary></indexterm>
+		Samba is configured to directly interface with CUPS via the direct internal interface
+		that is provided by CUPS libraries. This is achieved with the 
+		<smbconfoption name="printing">CUPS</smbconfoption> as well as the
+		<smbconfoption name="printcap name">CUPS</smbconfoption> entries.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>user management</primary></indexterm>
+		<indexterm><primary>group management</primary></indexterm>
+		<indexterm><primary>SRVTOOLS.EXE</primary></indexterm>
+		External interface scripts are provided to enable Samba to interface smoothly to
+		essential operating system functions for user and group management. This is important
+		to enable workstations to join the Domain and is also important so that you can use
+		the Windows NT4 Domain User Manager as well as the Domain Server Manager. These tools
+		are provided as part of the <filename>SRVTOOLS.EXE</filename> toolkit that can be 
+		downloaded from the Microsoft FTP
+		<ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">site</ulink>.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>User Mode</primary></indexterm>
+		The &smb.conf; file specifies that the Samba server will operate in (default) <parameter>
+		security = user</parameter> mode<footnote><para>See <emphasis>TOSHARG</emphasis>, Chapter 3.
+		This is necessary so that Samba can act as a Domain Controller (PDC); see
+		<emphasis>TOSHARG</emphasis>, Chapter 4, for additional information.</para></footnote>
+		(User Mode).
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>logon services</primary></indexterm>
+		<indexterm><primary>logon script</primary></indexterm>
+		Domain logon services as well as a Domain logon script are specified. The logon script
+		will be used to add robustness to the overall network configuration.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>roaming profiles</primary></indexterm>
+		<indexterm><primary>logon path</primary></indexterm>
+		<indexterm><primary>profile share</primary></indexterm>
+		Roaming profiles are enabled through the specification of the parameter,
+		<smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption>. The value of this parameter translates the
+		<constant>%L</constant> to the name by which the Samba server is called by the client (for this
+		configuration, it translates to the name <constant>DIAMOND</constant>), and the <constant>%U</constant>
+		will translate to the name of the user within the context of the connection made to the profile share.
+		It is the administrator's responsibility to ensure there is a directory in the root of the
+		profile share for each user. This directory must be owned by the user also. An exception to this
+		requirement is when a profile is created for group use.
+		</para></listitem>
+
+		<listitem><para>
+		<indexterm><primary>virus</primary></indexterm>
+		<indexterm><primary>opportunistic locking</primary></indexterm>
+		Precautionary veto is effected for particular Windows file names that have been targeted by 
+		virus-related activity. Additionally, Microsoft Office files are vetoed from opportunistic locking
+		controls. This should help to prevent lock contention-related file access problems.
+		</para></listitem>
+
+		<listitem><para>
+		Every user has a private home directory on the UNIX/Linux host. This is mapped to
+		a network drive that is the same for all users.
+		</para></listitem>
+
+	</itemizedlist>
+
+	<para>
+	The configuration of the server is the most complex so far. The following steps are used:
+	</para>
+
+	<orderedlist numeration="arabic">
+		<listitem><para>
+		Basic System Configuration
+		</para></listitem>
+
+		<listitem><para>
+		Samba Configuration
+		</para></listitem>
+
+		<listitem><para>
+		DHCP and DNS Server Configuration
+		</para></listitem>
+
+		<listitem><para>
+		Printer Configuration
+		</para></listitem>
+
+		<listitem><para>
+		Process Start-up Configuration
+		</para></listitem>
+
+		<listitem><para>
+		Validation
+		</para></listitem>
+
+		<listitem><para>
+		Application Share Configuration
+		</para></listitem>
+
+		<listitem><para>
+		Windows Client Configuration
+		</para></listitem>
+	</orderedlist>
+
+	<para>
+	The following sections cover each step in logical and defined detail.
+	</para>
+
+	<sect2 id="ch4bsc">
+	<title>Basic System Configuration</title>
+
+	<para>
+	<indexterm><primary>SUSE Enterprise Linux Server</primary></indexterm>
+	The preparation in this section assumes that your SUSE Enterprise Linux Server 8.0 system has been
+	freshly installed. It prepares basic files so that the system is ready for comprehensive
+	operation in line with the network diagram shown in <link linkend="ch04net"/>.
+	</para>
+
+	<procedure>
+	<title>Server Configuration Steps</title>
+
+		<step><para>
+		<indexterm><primary>hostname</primary></indexterm>
+		Using the UNIX/Linux system tools, name the server <constant>server.abmas.us</constant>.
+		Verify that your hostname is correctly set by running:
+<screen>
+&rootprompt; uname -n
+server
+</screen>
+		An alternate method to verify the hostname is:
+<screen>
+&rootprompt; hostname -f
+server.abmas.us
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/hosts</primary></indexterm>
+		<indexterm><primary>localhost</primary></indexterm>
+		Edit your <filename>/etc/hosts</filename> file to include the primary names and addresses
+		of all network interfaces that are on the host server. This is necessary so that during
+		startup the system can resolve all its own names to the IP address prior to
+		startup of the DNS server. An example of entries that should be in the 
+		<filename>/etc/hosts</filename> file is:
+<screen>
+127.0.0.1       localhost
+192.168.1.1     sleeth1.abmas.biz sleeth1 diamond
+192.168.2.1     sleeth2.abmas.biz sleeth2
+123.45.67.66    server.abmas.us server
+</screen>
+		You should check the startup order of your system. If the CUPS print server is started before
+		the DNS server (<command>named</command>), you should also include an entry for the printers
+		in the <filename>/etc/hosts</filename> file, as follows:
+<screen>
+192.168.1.20    qmsa.abmas.biz qmsa
+192.168.1.30    hplj6a.abmas.biz hplj6a
+192.168.2.20    qmsf.abmas.biz qmsf
+192.168.2.30    hplj6f.abmas.biz hplj6f
+</screen>
+		<indexterm><primary>named</primary></indexterm>
+		<indexterm><primary>cupsd</primary></indexterm>
+		<indexterm><primary>daemon</primary></indexterm>
+		The printer entries are not necessary if <command>named</command> is started prior to
+		startup of <command>cupsd</command>, the CUPS daemon.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/rc.d/boot.local</primary></indexterm>
+		<indexterm><primary>IP forwarding</primary></indexterm>
+		<indexterm><primary>/proc/sys/net/ipv4/ip_forward</primary></indexterm>
+		The host server is acting as a router between the two internal network segments as well
+		as for all Internet access. This necessitates that IP forwarding be enabled. This can be
+		achieved by adding to the <filename>/etc/rc.d/boot.local</filename> an entry as follows:
+<screen>
+echo 1 > /proc/sys/net/ipv4/ip_forward
+</screen>
+		To ensure that your kernel is capable of IP forwarding during configuration, you may 
+		wish to execute that command manually also. This setting permits the Linux system to 
+		act as a router.<footnote><para>You may want to do the echo command last and include 
+				"0" in the init scripts, since it opens up your network for a short time.</para></footnote>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>firewall</primary></indexterm>
+		<indexterm><primary>abmas-netfw.sh</primary></indexterm>
+		Installation of a basic firewall and NAT facility is necessary.
+		The following script can be installed in the <filename>/usr/local/sbin</filename>
+		directory. It is executed from the <filename>/etc/rc.d/boot.local</filename> startup
+		script. In your case, this script is called <filename>abmas-netfw.sh</filename>. The
+		script contents are shown in <link linkend="ch4natfw"/>.
+
+<example id="ch4natfw">
+<title>NAT Firewall Configuration Script</title>
+<screen>
+#!/bin/sh
+echo -e "\n\nLoading NAT firewall.\n"
+IPTABLES=/usr/sbin/iptables
+EXTIF="eth0"
+INTIFA="eth1"
+INTIFB="eth2"
+
+/sbin/depmod -a
+/sbin/modprobe -i ip_tables
+/sbin/modprobe -i ip_conntrack
+/sbin/modprobe -i ip_conntrack_ftp
+/sbin/modprobe -i iptable_nat
+/sbin/modprobe -i ip_nat_ftp
+$IPTABLES -P INPUT DROP
+$IPTABLES -F INPUT
+$IPTABLES -P OUTPUT ACCEPT
+$IPTABLES -F OUTPUT
+$IPTABLES -P FORWARD DROP
+$IPTABLES -F FORWARD
+
+$IPTABLES -A INPUT -i lo -j ACCEPT
+$IPTABLES -A INPUT -i $INTIFA -j ACCEPT
+$IPTABLES -A INPUT -i $INTIFB -j ACCEPT
+$IPTABLES -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
+# Enable incoming traffic for: SSH, SMTP, DNS(tcp), HTTP, HTTPS
+for i in 22 25 53 80 443
+do
+        $IPTABLES -A INPUT -i $EXTIF -p tcp --dport $i  -j ACCEPT
+done
+# Allow DNS(udp)
+$IPTABLES -A INPUT -i $EXTIF -p udp -dport 53  -j ACCEPT
+echo "Allow all connections OUT and only existing and specified ones IN"
+$IPTABLES -A FORWARD -i $EXTIF -o $INTIFA -m state \
+                                  --state ESTABLISHED,RELATED -j ACCEPT
+$IPTABLES -A FORWARD -i $EXTIF -o $INTIFB -m state \
+                                  --state ESTABLISHED,RELATED -j ACCEPT
+$IPTABLES -A FORWARD -i $INTIFA -o $EXTIF -j ACCEPT
+$IPTABLES -A FORWARD -i $INTIFB -o $EXTIF -j ACCEPT
+$IPTABLES -A FORWARD -j LOG
+echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF"
+$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
+echo "1" > /proc/sys/net/ipv4/ip_forward
+echo -e "\nNAT firewall done.\n"
+</screen>
+</example>
+		</para></step>
+
+		<step><para>
+		Execute the following to make the script executable:
+<screen>
+&rootprompt; chmod 755 /usr/local/sbin/abmas-natfw.sh
+</screen>
+		You must now edit <filename>/etc/rc.d/boot.local</filename> to add an entry
+		that runs your <command>abmas-natfw.sh</command> script. The following
+		entry works for you:
+<screen>
+#! /bin/sh
+#
+# Copyright (c) 2002 SUSE Linux AG Nuernberg, Germany. 
+# All rights reserved.
+#
+# Author: Werner Fink, 1996
+#         Burchard Steinbild, 1996
+#
+# /etc/init.d/boot.local
+#
+# script with local commands to be executed from init on system startup
+#
+# Here you should add things that should happen directly after booting
+# before we're going to the first run level.
+#
+/usr/local/sbin/abmas-natfw.sh
+</screen>
+		</para></step>
+	</procedure>
+
+	<para>
+	<indexterm><primary>/etc/hosts</primary></indexterm>
+	The server is now ready for Samba configuration. During the validation step, you remove
+	the entry for the Samba server <constant>diamond</constant> from the <filename>/etc/hosts</filename>
+	file. This is done after you are satisfied that DNS-based name resolution is functioning correctly.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Samba Configuration</title>
+
+	<para>
+	When you have completed this section, the Samba server is ready for testing and validation;
+	however, testing and validation have to wait until DHCP, DNS, and printing (CUPS) services have 
+	been configured.
+	</para>
+
+	<procedure>
+	<title>Samba Configuration Steps</title>
+
+		<step><para>
+		Install the Samba-3 binary RPM from the Samba-Team FTP site. Assuming that the binary
+		RPM file is called <filename>samba-3.0.20-1.i386.rpm</filename>, one way to install this
+		file is as follows:
+<screen>
+&rootprompt; rpm -Uvh samba-3.0.20-1.i386.rpm
+</screen>
+		This operation must be performed while logged in as the <command>root</command> user.
+		Successful operation is clearly indicated. If this installation should fail for any reason,
+		refer to the operating system manufacturer's documentation for guidance.
+		</para></step>
+
+		<step><para>
+		Install the &smb.conf; file shown in <link linkend="promisnet"/>, <link linkend="promisnetsvca"/>,
+		and <link linkend="promisnetsvcb"/>. Concatenate (join) all three files to make a single &smb.conf;
+		file. The final, fully qualified path for this file should be <filename>/etc/samba/smb.conf</filename>.
+
+<smbconfexample id="promisnet">
+<title>130 User Network with <emphasis>tdbsam</emphasis> &smbmdash; [globals] Section</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">PROMISES</smbconfoption>
+<smbconfoption name="netbios name">DIAMOND</smbconfoption>
+<smbconfoption name="interfaces">eth1, eth2, lo</smbconfoption>
+<smbconfoption name="bind interfaces only">Yes</smbconfoption>
+<smbconfoption name="passdb backend">tdbsam</smbconfoption>
+<smbconfoption name="pam password change">Yes</smbconfoption>
+<smbconfoption name="passwd program">/usr/bin/passwd %u</smbconfoption>
+<smbconfoption name="passwd chat"> </smbconfoption>
+<member><parameter>*New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</parameter></member>
+<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+<smbconfoption name="unix password sync">Yes</smbconfoption>
+<smbconfoption name="log level">1</smbconfoption>
+<smbconfoption name="syslog">0</smbconfoption>
+<smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
+<smbconfoption name="max log size">50</smbconfoption>
+<smbconfoption name="smb ports">139 445</smbconfoption>
+<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+<smbconfoption name="time server">Yes</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="show add printer wizard">No</smbconfoption>
+<smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption>
+<smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption>
+<smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
+<smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption>
+<smbconfoption name="add user to group script">/usr/sbin/usermod -G '%g' '%u'</smbconfoption>
+<smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false -d /tmp '%u'</smbconfoption>
+<smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
+<smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
+<smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
+<smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption>
+<smbconfoption name="logon drive">X:</smbconfoption>
+<smbconfoption name="logon home">\\%L\%U</smbconfoption>
+<smbconfoption name="domain logons">Yes</smbconfoption>
+<smbconfoption name="preferred master">Yes</smbconfoption>
+<smbconfoption name="wins support">Yes</smbconfoption>
+<smbconfoption name="utmp">Yes</smbconfoption>
+<smbconfoption name="map acl inherit">Yes</smbconfoption>
+<smbconfoption name="printing">cups</smbconfoption>
+<smbconfoption name="cups options">Raw</smbconfoption>
+<smbconfoption name="veto files">/*.eml/*.nws/*.{*}/</smbconfoption>
+<smbconfoption name="veto oplock files">/*.doc/*.xls/*.mdb/</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="promisnetsvca">
+<title>130 User Network with <emphasis>tdbsam</emphasis> &smbmdash; Services Section Part A</title>
+<smbconfsection name="[homes]"/>
+<smbconfoption name="comment">Home Directories</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">SMB Print Spool</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="use client driver">Yes</smbconfoption>
+<smbconfoption name="default devmode">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[netlogon]"/>
+<smbconfoption name="comment">Network Logon Service</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="locking">No</smbconfoption>
+
+<smbconfsection name="[profiles]"/>
+<smbconfoption name="comment">Profile Share</smbconfoption>
+<smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="profile acls">Yes</smbconfoption>
+
+<smbconfsection name="[accounts]"/>
+<smbconfoption name="comment">Accounting Files</smbconfoption>
+<smbconfoption name="path">/data/accounts</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="promisnetsvcb">
+<title>130 User Network with <emphasis>tdbsam</emphasis> &smbmdash; Services Section Part B</title>
+<smbconfsection name="[service]"/>
+<smbconfoption name="comment">Financial Services Files</smbconfoption>
+<smbconfoption name="path">/data/service</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[pidata]"/>
+<smbconfoption name="comment">Property Insurance Files</smbconfoption>
+<smbconfoption name="path">/data/pidata</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[apps]"/>
+<smbconfoption name="comment">Application Files</smbconfoption>
+<smbconfoption name="path">/apps</smbconfoption>
+<smbconfoption name="read only">Yes</smbconfoption>
+<smbconfoption name="admin users">bjordan</smbconfoption>
+</smbconfexample>
+		</para></step>
+
+		<step><para>
+	      <indexterm><primary>administrator</primary></indexterm><indexterm>
+		<primary>smbpasswd</primary>
+	      </indexterm>
+		Add the <constant>root</constant> user to the password backend as follows:
+<screen>
+&rootprompt; smbpasswd -a root
+New SMB password: XXXXXXXX
+Retype new SMB password: XXXXXXXX
+&rootprompt;
+</screen>
+		The <constant>root</constant> account is the UNIX equivalent of the Windows Domain Administrator.
+		This account is essential in the regular maintenance of your Samba server. It must never be
+		deleted. If for any reason the account is deleted, you may not be able to recreate this account
+		without considerable trouble.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>username map</primary></indexterm>
+                Create the username map file to permit the <constant>root</constant> account to be called
+                <constant>Administrator</constant> from the Windows network environment. To do this, create
+                the file <filename>/etc/samba/smbusers</filename> with the following contents:
+<screen>
+####
+# User mapping file
+####
+# File Format
+# -----------
+# Unix_ID = Windows_ID
+#
+# Examples:
+# root = Administrator
+# janes = "Jane Smith"
+# jimbo = Jim Bones
+#
+# Note: If the name contains a space it must be double quoted.
+#       In the example above the name 'jimbo' will be mapped to Windows
+#       user names 'Jim' and 'Bones' because the space was not quoted.
+#######################################################################
+root = Administrator
+####
+# End of File
+####
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>initGrps.sh</primary></indexterm>
+		<indexterm><primary>net</primary><secondary>groupmap</secondary><tertiary>add</tertiary></indexterm>
+		<indexterm><primary>net</primary><secondary>groupmap</secondary><tertiary>modify</tertiary></indexterm>
+		<indexterm><primary>net</primary><secondary>groupmap</secondary><tertiary>list</tertiary></indexterm>
+                Create and map Windows Domain Groups to UNIX groups. A sample script is provided in <link linkend="small"/>,
+                <link linkend="initGrps"/>. Create a file containing this script. We called ours
+                <filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed,
+                and then execute the script. Sample output should be as follows:
+
+<example id="ch4initGrps">
+<title>Script to Map Windows NT Groups to UNIX Groups</title>
+<indexterm><primary>initGrps.sh</primary></indexterm>
+<screen>
+#!/bin/bash
+#
+# initGrps.sh
+#
+
+# Create UNIX groups
+groupadd acctsdep
+groupadd finsrvcs
+
+# Map Windows Domain Groups to UNIX groups
+net groupmap modify ntgroup="Domain Admins"  unixgroup=root
+net groupmap modify ntgroup="Domain Users"   unixgroup=users
+net groupmap modify ntgroup="Domain Guests"  unixgroup=nobody
+
+# Add Functional Domain Groups
+net groupmap add ntgroup="Accounts Dept"  unixgroup=acctsdep type=d
+net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
+net groupmap add ntgroup="Insurance Group"     unixgroup=piops type=d
+
+# Map Windows NT machine local groups to local UNIX groups
+# Mapping of local groups is not necessary and not functional
+# for this installation.
+</screen>
+</example>
+
+<screen>
+&rootprompt; chmod 755 initGrps.sh
+&rootprompt; /etc/samba # ./initGrps.sh
+Updated mapping entry for Domain Admins
+Updated mapping entry for Domain Users
+Updated mapping entry for Domain Guests
+No rid or sid specified, choosing algorithmic mapping
+Successfully added group Accounts Dept to the mapping db
+No rid or sid specified, choosing algorithmic mapping
+Successfully added group Domain Guests to the mapping db
+
+&rootprompt; /etc/samba # net groupmap list | sort
+Account Operators (S-1-5-32-548) -> -1
+Accounts Dept (S-1-5-21-179504-2437109-488451-2003) -> acctsdep
+Administrators (S-1-5-32-544) -> -1
+Backup Operators (S-1-5-32-551) -> -1
+Domain Admins (S-1-5-21-179504-2437109-488451-512) -> root
+Domain Guests (S-1-5-21-179504-2437109-488451-514) -> nobody
+Domain Users (S-1-5-21-179504-2437109-488451-513) -> users
+Financial Services (S-1-5-21-179504-2437109-488451-2005) -> finsrvcs
+Guests (S-1-5-32-546) -> -1
+Power Users (S-1-5-32-547) -> -1
+Print Operators (S-1-5-32-550) -> -1
+Replicators (S-1-5-32-552) -> -1
+System Operators (S-1-5-32-549) -> -1
+Users (S-1-5-32-545) -> -1
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>useradd</primary></indexterm>
+		<indexterm><primary>adduser</primary></indexterm>
+		<indexterm><primary>passwd</primary></indexterm>
+		<indexterm><primary>smbpasswd</primary></indexterm>
+		<indexterm><primary>/etc/passwd</primary></indexterm>
+		<indexterm><primary>password</primary><secondary>backend</secondary></indexterm>
+		<indexterm><primary>user</primary><secondary>management</secondary></indexterm>
+		There is one preparatory step without which you will not have a working Samba 
+		network environment. You must add an account for each network user. 
+                For each user who needs to be given a Windows Domain account, make an entry in the
+                <filename>/etc/passwd</filename> file as well as in the Samba password backend.
+                Use the system tool of your choice to create the UNIX system account, and use the Samba
+                <command>smbpasswd</command> to create a Domain user account.
+                There are a number of tools for user management under UNIX, such as
+                <command>useradd</command>, and <command>adduser</command>, as well as a plethora of custom
+                tools. You also want to create a home directory for each user.
+		You can do this by executing the following steps for each user:
+<screen>
+&rootprompt; useradd -m <parameter>username</parameter>
+&rootprompt; passwd <parameter>username</parameter>
+Changing password for <parameter>username</parameter>.
+New password: XXXXXXXX
+Re-enter new password: XXXXXXXX
+Password changed
+&rootprompt; smbpasswd -a <parameter>username</parameter>
+New SMB password: XXXXXXXX
+Retype new SMB password: XXXXXXXX
+Added user <parameter>username</parameter>.
+</screen>
+		You do of course use a valid user login ID in place of <parameter>username</parameter>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>file system</primary><secondary>access control</secondary></indexterm>
+		<indexterm><primary>file system</primary><secondary>permissions</secondary></indexterm>
+		<indexterm><primary>group membership</primary></indexterm>
+                Using the preferred tool for your UNIX system, add each user to the UNIX groups created
+                previously as necessary. File system access control will be based on UNIX group membership.
+                </para></step>
+
+                <step><para>
+                Create the directory mount point for the disk subsystem that can be mounted to provide
+                data storage for company files. In this case the mount point is indicated in the &smb.conf;
+                file is <filename>/data</filename>. Format the file system as required, and mount the formatted
+                file system partition using appropriate system tools.
+                </para></step>
+
+                <step><para>
+		<indexterm><primary>file system</primary><secondary>permissions</secondary></indexterm>
+                Create the top-level file storage directories for data and applications as follows:
+<screen>
+&rootprompt; mkdir -p /data/{accounts,finsvcs}
+&rootprompt; mkdir -p /apps
+&rootprompt; chown -R root:root /data
+&rootprompt; chown -R root:root /apps
+&rootprompt; chown -R bjordan:accounts /data/accounts
+&rootprompt; chown -R bjordan:finsvcs /data/finsvcs
+&rootprompt; chmod -R ug+rwxs,o-rwx /data
+&rootprompt; chmod -R ug+rwx,o+rx-w /apps
+</screen>
+                Each department is responsible for creating its own directory structure within the departmental
+                share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>.
+                The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>.
+		The <filename>/apps</filename> directory is the root of the <constant>apps</constant> share
+		that provides the application server infrastructure.
+		</para></step>
+
+		<step><para>
+		The &smb.conf; file specifies an infrastructure to support roaming profiles and network
+		logon services. You can now create the file system infrastructure to provide the
+		locations on disk that these services require. Adequate planning is essential,
+		since desktop profiles can grow to be quite large. For planning purposes, a minimum of
+		200 MB of storage should be allowed per user for profile storage. The following
+		commands create the directory infrastructure needed:
+<screen>
+&rootprompt; mkdir -p /var/spool/samba 
+&rootprompt; mkdir -p /var/lib/samba/{netlogon/scripts,profiles}
+&rootprompt; chown -R root:root /var/spool/samba
+&rootprompt; chown -R root:root /var/lib/samba
+&rootprompt; chmod a+rwxt /var/spool/samba
+</screen>
+		For each user account that is created on the system, the following commands should be
+		executed:
+<screen>
+&rootprompt; mkdir /var/lib/samba/profiles/'username'
+&rootprompt; chown 'username':users /var/lib/samba/profiles/'username'
+&rootprompt; chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username'
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>logon scrip</primary></indexterm>
+		<indexterm><primary>unix2dos</primary></indexterm>
+		<indexterm><primary>dos2unix</primary></indexterm>
+		Create a logon script. It is important that each line is correctly terminated with
+		a carriage return and line-feed combination (i.e., DOS encoding). The following procedure
+		works if the right tools (<constant>unix2dos</constant> and <constant>dos2unix</constant>) are installed.
+		First, create a file called <filename>/var/lib/samba/netlogon/scripts/logon.bat.unix</filename>
+		with the following contents:
+<screen>
+net time \\diamond /set /yes
+net use h: /home
+net use p: \\diamond\apps
+</screen>
+		Convert the UNIX file to a DOS file using the <command>unix2dos</command> as shown here:
+<screen>
+&rootprompt; unix2dos &lt; /var/lib/samba/netlogon/scripts/logon.bat.unix \
+	&gt; /var/lib/samba/netlogon/scripts/logon.bat
+</screen>
+		</para></step>
+	</procedure>
+
+	</sect2>
+
+	<sect2 id="ch4dhcpdns">
+	<title>Configuration of DHCP and DNS Servers</title>
+
+	<para>
+	DHCP services are a basic component of the entire network client installation. DNS operation is
+	foundational to Internet access as well as to trouble-free operation of local networking. When
+	you have completed this section, the server should be ready for solid duty operation.
+	</para>
+
+	<procedure>
+	<title>DHCP and DNS Server Configuration Steps</title>
+
+		<step><para>
+		<indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
+		Create a file called <filename>/etc/dhcpd.conf</filename> with the contents as
+		shown in <link linkend="prom-dhcp"/>.
+
+<example id="prom-dhcp">
+<title>DHCP Server Configuration File &smbmdash; <filename>/etc/dhcpd.conf</filename></title>
+<screen>
+# Abmas Accounting Inc.
+default-lease-time 86400;
+max-lease-time 172800;
+default-lease-time 86400;
+option ntp-servers 192.168.1.1;
+option domain-name "abmas.biz";
+option domain-name-servers 192.168.1.1, 192.168.2.1;
+option netbios-name-servers 192.168.1.1, 192.168.2.1;
+option netbios-node-type 8;       ### Node type = Hybrid ###
+ddns-updates on;                  ### Dynamic DNS enabled ###
+ddns-update-style interim;
+
+subnet 192.168.1.0 netmask 255.255.255.0 {
+        range dynamic-bootp 192.168.1.128 192.168.1.254;
+        option subnet-mask 255.255.255.0;
+        option routers 192.168.1.1;
+        allow unknown-clients;
+        host qmsa {
+                hardware ethernet 08:00:46:7a:35:e4;
+                fixed-address 192.168.1.20;
+                }
+        host hplj6a {
+                hardware ethernet 00:03:47:cb:81:e0;
+                fixed-address 192.168.1.30;
+                }
+        }
+subnet 192.168.2.0 netmask 255.255.255.0 {
+        range dynamic-bootp 192.168.2.128 192.168.2.254;
+        option subnet-mask 255.255.255.0;
+        option routers 192.168.2.1;
+        allow unknown-clients;
+        host qmsf {
+                hardware ethernet 01:04:31:db:e1:c0;
+                fixed-address 192.168.1.20;
+        	}
+        host hplj6f {
+                hardware ethernet 00:03:47:cf:83:e2;
+                fixed-address 192.168.2.30;
+                }
+	}
+subnet 127.0.0.0 netmask 255.0.0.0 {
+        }
+subnet 123.45.67.64 netmask 255.255.255.252 {
+        }
+</screen>
+</example>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/named.conf</primary></indexterm>
+		Create a file called <filename>/etc/named.conf</filename> that has the combined contents
+		of the <link linkend="ch4namedcfg"/>, <link linkend="ch4namedvarfwd"/>, and
+		<link linkend="ch4namedvarrev"/> files that are concatenated (merged) in this
+		specific order.
+		</para></step>
+
+		<step><para>
+		Create the files shown in their directories as follows: (John, on this page, the numbered entry comes after the table it's referencing!!!!!)
+
+			<table id="namedrscfiles">
+				<title>DNS (named) Resource Files</title>
+				<tgroup cols="2">
+					<colspec align="left"/>
+					<colspec align="left"/>
+					<thead>
+						<row>
+							<entry>Reference</entry>
+							<entry>File Location</entry>
+						</row>
+					</thead>
+					<tbody>
+						<row>
+							<entry><link linkend="loopback"/></entry>
+							<entry>/var/lib/named/localhost.zone</entry>
+						</row>
+						<row>
+							<entry><link linkend="dnsloopy"/></entry>
+							<entry>/var/lib/named/127.0.0.zone</entry>
+						</row>
+						<row>
+							<entry><link linkend="roothint"/></entry>
+							<entry>/var/lib/named/root.hint</entry>
+						</row>
+						<row>
+							<entry><link linkend="abmasbiz"/></entry>
+							<entry>/var/lib/named/master/abmas.biz.hosts</entry>
+						</row>
+						<row>
+							<entry><link linkend="abmasus"/></entry>
+							<entry>/var/lib/named/abmas.us.hosts</entry>
+						</row>
+						<row>
+							<entry><link linkend="eth1zone"/></entry>
+							<entry>/var/lib/named/192.168.1.0.rev</entry>
+						</row>
+						<row>
+							<entry><link linkend="eth2zone"/></entry>
+							<entry>/var/lib/named/192.168.2.0.rev</entry>
+						</row>
+					</tbody>
+				</tgroup>
+			</table>
+
+<example id="ch4namedcfg">
+<title>DNS Master Configuration File &smbmdash; <filename>/etc/named.conf</filename> Master Section</title>
+<indexterm><primary>/etc/named.conf</primary></indexterm>
+<screen>
+###
+# Abmas Biz DNS Control File
+###
+# Date: November 15, 2003
+###
+options {
+	directory "/var/lib/named";
+	forwarders {
+		123.45.12.23;
+		};
+	forward first;
+	listen-on {
+		mynet;
+		};
+	auth-nxdomain yes;
+	multiple-cnames yes;
+	notify no;
+};
+
+zone "." in {
+	type hint;
+	file "root.hint";
+};
+
+zone "localhost" in {
+	type master;
+	file "localhost.zone";
+};
+
+zone "0.0.127.in-addr.arpa" in {
+	type master;
+	file "127.0.0.zone";
+};
+
+acl mynet {
+	192.168.1.0/24;
+	192.168.2.0/24;
+	127.0.0.1;
+};
+
+acl seconddns {
+	123.45.54.32;
+}
+
+</screen>
+</example>
+
+<example id="ch4namedvarfwd">
+<title>DNS Master Configuration File &smbmdash; <filename>/etc/named.conf</filename> Forward Lookup Definition Section</title>
+<screen>
+zone "abmas.biz" {
+	type master;
+	file "/var/lib/named/master/abmas.biz.hosts";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+	allow-update {
+		mynet;
+	};
+};
+
+zone "abmas.us" {
+	type master;
+	file "/var/lib/named/master/abmas.us.hosts";
+	allow-query {
+		all;
+	};
+	allow-transfer {
+		seconddns;
+	};
+};
+</screen>
+</example>
+
+<example id="ch4namedvarrev">
+<title>DNS Master Configuration File &smbmdash; <filename>/etc/named.conf</filename> Reverse Lookup Definition Section</title>
+<screen>
+zone "1.168.192.in-addr.arpa" {
+	type master;
+	file "/var/lib/named/master/192.168.1.0.rev";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+	allow-update {
+		mynet;
+	};
+};
+
+zone "2.168.192.in-addr.arpa" {
+	type master;
+	file "/var/lib/named/master/192.168.2.0.rev";
+	allow-query {
+		mynet;
+	};
+	allow-transfer {
+		mynet;
+	};
+	allow-update {
+		mynet;
+	};
+};
+</screen>
+</example>
+
+<example id="eth1zone">
+<title>DNS 192.168.1 Reverse Zone File</title>
+<screen>
+$ORIGIN .
+$TTL 38400	; 10 hours 40 minutes
+1.168.192.in-addr.arpa	IN SOA	sleeth.abmas.biz. root.abmas.biz. (
+				2003021825 ; serial
+				10800      ; refresh (3 hours)
+				3600       ; retry (1 hour)
+				604800     ; expire (1 week)
+				38400      ; minimum (10 hours 40 minutes)
+				)
+			NS	sleeth1.abmas.biz.
+$ORIGIN 1.168.192.in-addr.arpa.
+1			PTR	sleeth1.abmas.biz.
+20			PTR	qmsa.abmas.biz.
+30			PTR	hplj6a.abmas.biz.
+</screen>
+</example>
+
+<example id="eth2zone">
+<title>DNS 192.168.2 Reverse Zone File</title>
+<screen>
+$ORIGIN .
+$TTL 38400	; 10 hours 40 minutes
+2.168.192.in-addr.arpa	IN SOA	sleeth.abmas.biz. root.abmas.biz. (
+				2003021825 ; serial
+				10800      ; refresh (3 hours)
+				3600       ; retry (1 hour)
+				604800     ; expire (1 week)
+				38400      ; minimum (10 hours 40 minutes)
+				)
+			NS	sleeth2.abmas.biz.
+$ORIGIN 2.168.192.in-addr.arpa.
+1			PTR	sleeth2.abmas.biz.
+20			PTR	qmsf.abmas.biz.
+30			PTR	hplj6f.abmas.biz.
+</screen>
+</example>
+
+<example id="abmasbiz">
+<title>DNS Abmas.biz Forward Zone File</title>
+<screen>
+$ORIGIN .
+$TTL 38400      ; 10 hours 40 minutes
+abmas.biz       IN SOA  sleeth1.abmas.biz. root.abmas.biz. (
+                                2003021833 ; serial
+                                10800      ; refresh (3 hours)
+                                3600       ; retry (1 hour)
+                                604800     ; expire (1 week)
+                                38400      ; minimum (10 hours 40 minutes)
+                                )
+                        NS      dns.abmas.biz.
+                        MX      10 mail.abmas.biz.
+$ORIGIN abmas.biz.
+sleeth1                 A       192.168.1.1
+sleeth2                 A       192.168.2.1
+qmsa                    A       192.168.1.20
+hplj6a                  A       192.168.1.30
+qmsf                    A       192.168.2.20
+hplj6f                  A       192.168.2.30
+dns                     CNAME   sleeth1
+diamond                 CNAME   sleeth1
+mail                    CNAME   sleeth1
+</screen>
+</example>
+
+<example id="abmasus">
+<title>DNS Abmas.us Forward Zone File</title>
+<screen>
+$ORIGIN .
+$TTL 38400      ; 10 hours 40 minutes
+abmas.us        IN SOA  server.abmas.us. root.abmas.us. (
+                                2003021833 ; serial
+                                10800      ; refresh (3 hours)
+                                3600       ; retry (1 hour)
+                                604800     ; expire (1 week)
+                                38400      ; minimum (10 hours 40 minutes)
+                                )
+                        NS      dns.abmas.us.
+                        NS      dns2.abmas.us.
+                        MX      10 mail.abmas.us.
+$ORIGIN abmas.us.
+server                  A       123.45.67.66
+dns2                    A       123.45.54.32
+gw                      A       123.45.67.65
+www                     CNAME   server
+mail                    CNAME   server
+dns                     CNAME   server
+</screen>
+</example>
+
+		</para></step>
+
+		<step><para>
+	      <indexterm><primary>/etc/resolv.conf</primary></indexterm><indexterm>
+		<primary>name resolution</primary>
+	      </indexterm>
+		All DNS name resolution should be handled locally. To ensure that the server is configured
+		correctly to handle this, edit <filename>/etc/resolv.conf</filename> to have the following
+		content:
+<screen>
+search abmas.us abmas.biz
+nameserver 127.0.0.1
+nameserver 123.45.54.23
+</screen>
+	      <indexterm>
+		<primary>DNS server</primary>
+	      </indexterm>
+		This instructs the name resolver function (when configured correctly) to ask the DNS server
+		that is running locally to resolve names to addresses. In the event that the local name server
+		is not available, ask the name server provided by the ISP. The latter, of course, does not resolve
+		purely local names to IP addresses.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+		The final step is to edit the <filename>/etc/nsswitch.conf</filename> file.
+		This file controls the operation of the various resolver libraries that are part of the Linux
+		Glibc libraries. Edit this file so that it contains the following entries:
+<screen>
+hosts:      files dns wins
+</screen>
+		</para></step>
+	</procedure>
+
+	<para>
+	The basic DHCP and DNS services are now ready for validation testing. Before you can proceed,
+	there are a few more steps along the road. First, configure the print spooling and print
+	processing system.  Then you can configure the server so that all services
+	start automatically on reboot. You must also manually start all services prior to validation testing.
+	</para>
+
+	</sect2>
+
+	<sect2 id="ch4ptrcfg">
+	<title>Printer Configuration</title>
+
+	<para>
+	Network administrators who are new to CUPS based-printing typically experience some difficulty mastering
+	its powerful features. The steps outlined in this section are designed to navigate around the distractions
+	of learning CUPS. Instead of implementing smart features and capabilities, our approach is to use it as a
+	transparent print queue that performs no filtering, and only minimal handling of each print job that is
+	submitted to it. In other words, our configuration turns CUPS into a raw-mode print queue. This means that
+	the correct printer driver must be installed on all clients.
+	</para>
+
+	<procedure>
+	<title>Printer Configuration Steps</title>
+
+		<step><para>
+		Configure each printer to be a DHCP client, carefully following the manufacturer's guidelines.
+		</para></step>
+
+                <step><para>
+                Follow the instructions in the printer manufacturer's manuals to permit printing to port 9100.
+		Use any other port the manufacturer specifies for direct-mode raw printing, and adjust the
+		port as necessary in the following example commands.
+                This allows the CUPS spooler to print using raw mode protocols.
+                <indexterm><primary>CUPS</primary></indexterm>
+                <indexterm><primary>raw printing</primary></indexterm>
+                </para></step>
+
+                <step><para>
+	      <indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm><indexterm>
+		<primary>lpadmin</primary>
+	      </indexterm>
+                Configure the CUPS Print Queues as follows:
+<screen>
+&rootprompt; lpadmin -p qmsa -v socket://qmsa.abmas.biz:9100 -E
+&rootprompt; lpadmin -p hplj6a -v socket://hplj6a.abmas.biz:9100 -E
+&rootprompt; lpadmin -p qmsf -v socket://qmsf.abmas.biz:9100 -E
+&rootprompt; lpadmin -p hplj6f -v socket://hplj6f.abmas.biz:9100 -E
+</screen>
+                <indexterm><primary>print filter</primary></indexterm>
+                This creates the necessary print queues with no assigned print filter.
+                </para></step>
+
+	  <step><para><indexterm>
+		<primary>enable</primary>
+	      </indexterm>
+		Print queues may not be enabled at creation. Use <command>lpc stat</command> to check
+		the status of the print queues and, if necessary, make certain that the queues you have 
+		just created are enabled by executing the following:
+<screen>
+&rootprompt; /usr/bin/enable qmsa
+&rootprompt; /usr/bin/enable hplj6a
+&rootprompt; /usr/bin/enable qmsf
+&rootprompt; /usr/bin/enable hplj6f
+</screen>
+		</para></step>
+
+	  <step><para><indexterm>
+		<primary>accept</primary>
+	      </indexterm>
+		Even though your print queues may be enabled, it is still possible that they
+		are not accepting print jobs. A print queue services incoming printing
+		requests only when configured to do so. Ensure that your print queues are
+		set to accept incoming jobs by executing the following commands:
+<screen>
+&rootprompt; /usr/bin/accept qmsa
+&rootprompt; /usr/bin/accept hplj6a
+&rootprompt; /usr/bin/accept qmsf
+&rootprompt; /usr/bin/accept hplj6f
+</screen>
+		</para></step>
+
+                <step><para>
+                <indexterm><primary>mime type</primary></indexterm>
+                <indexterm><primary>/etc/mime.convs</primary></indexterm>
+                <indexterm><primary>application/octet-stream</primary></indexterm>
+                Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
+<screen>
+application/octet-stream     application/vnd.cups-raw      0     -
+</screen>
+                </para></step>
+
+                <step><para>
+                <indexterm><primary>/etc/mime.types</primary></indexterm>
+                Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
+<screen>
+application/octet-stream
+</screen>
+                </para></step>
+
+		<step><para>
+		Printing drivers are installed on each network client workstation.
+		</para></step>
+	</procedure>
+
+	<para>
+	Note: If the parameter <parameter>cups options = Raw</parameter> is specified in the &smb.conf; file,
+	the last two steps can be omitted with CUPS version 1.1.18, or later.
+	</para>
+
+	<para>
+	The UNIX system print queues have been configured and are ready for validation testing.
+	</para>
+
+	</sect2>
+
+	<sect2 id="procstart">
+	<title>Process Startup Configuration</title>
+
+	<para>
+	<indexterm><primary>chkconfig</primary></indexterm>
+	There are two essential steps to process startup configuration. First, the process
+	must be configured so that it automatically restarts each time the server
+	is rebooted. This step involves use of the <command>chkconfig</command> tool that
+	creates the appropriate symbolic links from the master daemon control file that is
+	located in the <filename>/etc/rc.d</filename> directory, to the <filename>/etc/rc'x'.d</filename>
+	directories. Links are created so that when the system run level is changed, the
+	necessary start or kill script is run.
+	</para>
+
+	<para>
+	<indexterm><primary>/etc/xinetd.d</primary></indexterm>
+	<indexterm><primary>inetd</primary></indexterm>
+	<indexterm><primary>xinetd</primary></indexterm>
+	<indexterm><primary>chkconfig</primary></indexterm>
+	<indexterm><primary>super daemon</primary></indexterm>
+	In the event that a service is not run as a daemon, but via the internetworking
+	super daemon (<command>inetd</command> or <command>xinetd</command>), then the <command>chkconfig</command>
+	tool makes the necessary entries in the <filename>/etc/xinetd.d</filename> directory
+	and sends a hang-up (HUP) signal to the the super daemon, thus forcing it to
+	re-read its control files.
+	</para>
+
+	<para>
+	Last, each service must be started to permit system validation to proceed.
+	</para>
+
+	<procedure>
+                <step><para>
+                Use the standard system tool to configure each service to restart
+                automatically at every system reboot. For example,
+                <indexterm><primary>chkconfig</primary></indexterm>
+<screen>
+&rootprompt; chkconfig dhpc on
+&rootprompt; chkconfig named on
+&rootprompt; chkconfig cups on
+&rootprompt; chkconfig smb on
+</screen>
+		</para></step>
+
+		<step><para>
+                <indexterm><primary>starting dhcpd</primary></indexterm>
+                <indexterm><primary>starting samba</primary></indexterm>
+                <indexterm><primary>starting CUPS</primary></indexterm>
+		Now start each service to permit the system to be validated.
+		Execute each of the following in the sequence shown:
+
+<screen>
+&rootprompt; /etc/rc.d/init.d/dhcp restart
+&rootprompt; /etc/rc.d/init.d/named restart
+&rootprompt; /etc/rc.d/init.d/cups restart
+&rootprompt; /etc/rc.d/init.d/smb restart
+</screen>
+                </para></step>
+	</procedure>
+
+	</sect2>
+
+	<sect2 id="ch4valid">
+	<title>Validation</title>
+
+	<para>
+	<indexterm><primary>validation</primary></indexterm>
+	Complex networking problems are most often caused by simple things that are poorly or incorrectly
+	configured. The validation process adopted here should be followed carefully; it is the result of the
+	experience gained from years of making and correcting the most common mistakes. Shortcuts often lead to basic errors. You should
+	refrain from taking shortcuts, from making basic assumptions, and from not exercising due process
+	and diligence in network validation. By thoroughly testing and validating every step in the process
+	of network installation and configuration, you can save yourself from sleepless nights and restless
+	days. A well debugged network is a foundation for happy network users and network administrators. 
+	Later in this book you learn how to make users happier. For now, it is enough to learn to 
+	validate. Let's get on with it.
+	</para>
+
+		<procedure>
+		<title>Server Validation Steps</title>
+
+			<step><para>
+			<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+			One of the most important facets of Samba configuration is to ensure that
+			name resolution functions correctly. You can check name resolution
+			with a few simple tests. The most basic name resolution is provided from the
+			<filename>/etc/hosts</filename> file. To test its operation, make a
+			temporary edit to the <filename>/etc/nsswitch.conf</filename> file. Using
+			your favorite editor, change the entry for <constant>hosts</constant> to read:
+<screen>
+hosts:     files
+</screen>
+			When you have saved this file, execute the following command:
+<screen>
+&rootprompt; ping diamond
+PING sleeth1.abmas.biz (192.168.1.1) 56(84) bytes of data.
+64 bytes from sleeth1 (192.168.1.1): icmp_seq=1 ttl=64 time=0.131 ms
+64 bytes from sleeth1 (192.168.1.1): icmp_seq=2 ttl=64 time=0.179 ms
+64 bytes from sleeth1 (192.168.1.1): icmp_seq=3 ttl=64 time=0.192 ms
+64 bytes from sleeth1 (192.168.1.1): icmp_seq=4 ttl=64 time=0.191 ms
+
+--- sleeth1.abmas.biz ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3016ms
+rtt min/avg/max/mdev = 0.131/0.173/0.192/0.026 ms
+</screen>
+			This proves that name resolution via the <filename>/etc/hosts</filename> file
+			is working.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+			So far, your installation is going particularly well. In this step we validate
+			DNS server and name resolution operation. Using your favorite UNIX system editor,
+			change the <filename>/etc/nsswitch.conf</filename> file so that the
+			<constant>hosts</constant> entry reads:
+<screen>
+hosts:        dns
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>named</primary></indexterm>
+			Before you test DNS operation, it is a good idea to verify that the DNS server
+			is running by executing the following:
+<screen>
+&rootprompt; ps ax | grep named
+  437 ?        S      0:00 /sbin/syslogd -a /var/lib/named/dev/log
+  524 ?        S      0:00 /usr/sbin/named -t /var/lib/named -u named
+  525 ?        S      0:00 /usr/sbin/named -t /var/lib/named -u named
+  526 ?        S      0:00 /usr/sbin/named -t /var/lib/named -u named
+  529 ?        S      0:00 /usr/sbin/named -t /var/lib/named -u named
+  540 ?        S      0:00 /usr/sbin/named -t /var/lib/named -u named
+ 2552 pts/2    S      0:00 grep named
+</screen>
+			This means that we are ready to check DNS operation. Do so by executing:
+			<indexterm><primary>ping</primary></indexterm>
+<screen>
+&rootprompt; ping diamond
+PING sleeth1.abmas.biz (192.168.1.1) 56(84) bytes of data.
+64 bytes from sleeth1 (192.168.1.1): icmp_seq=1 ttl=64 time=0.156 ms
+64 bytes from sleeth1 (192.168.1.1): icmp_seq=2 ttl=64 time=0.183 ms
+
+--- sleeth1.abmas.biz ping statistics ---
+2 packets transmitted, 2 received, 0% packet loss, time 999ms
+rtt min/avg/max/mdev = 0.156/0.169/0.183/0.018 ms
+</screen>
+			You should take a few more steps to validate DNS server operation, as follows:
+<screen>
+&rootprompt; host -f diamond.abmas.biz
+sleeth1.abmas.biz has address 192.168.1.1
+</screen>
+			<indexterm><primary>/etc/hosts</primary></indexterm>
+			You may now remove the entry called <constant>diamond</constant> from the
+			<filename>/etc/hosts</filename> file. It does not hurt to leave it there,
+			but its removal reduces the number of administrative steps for this name.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+			WINS is a great way to resolve NetBIOS names to their IP address. You can test
+			the operation of WINS by starting <command>nmbd</command> (manually or by way
+			of the Samba startup method shown in <link linkend="procstart"/>). You must edit
+			the <filename>/etc/nsswitch.conf</filename> file so that the <constant>hosts</constant>
+			entry is as follows:
+<screen>
+hosts:        wins
+</screen>
+			The next step is to make certain that Samba is running using <command>ps ax|grep mbd</command>, and then execute the following:
+<screen>
+&rootprompt; ping diamond
+PING diamond (192.168.1.1) 56(84) bytes of data.
+64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.094 ms
+64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.479 ms
+</screen>
+			<indexterm><primary>ping</primary></indexterm>
+			Now that you can relax with the knowledge that all three major forms of name
+			resolution to IP address resolution are working, edit the <filename>/etc/nsswitch.conf</filename>
+			again. This time you add all three forms of name resolution to this file.
+			Your edited entry for <constant>hosts</constant> should now look like this:
+<screen>
+hosts:       files dns wins
+</screen>
+			The system is looking good. Let's move on.
+			</para></step>
+
+			<step><para>
+			It would give you peace of mind to know that the DHCP server is running
+			and available for service. You can validate DHCP services by running:
+
+<screen>
+&rootprompt; ps ax | grep dhcp
+ 2618 ?        S      0:00 /usr/sbin/dhcpd ...
+ 8180 pts/2    S      0:00 grep dhcp
+</screen>
+			This shows that the server is running. The proof of whether or not it is working
+			comes when you try to add the first DHCP client to the network.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>testparm</primary></indexterm>
+			This is a good point at which to start validating Samba operation. You are 
+			content that name resolution is working for basic TCP/IP needs. Let's move on.
+			If your &smb.conf; file has bogus options or parameters, this may cause Samba
+			to refuse to start. The first step should always be to validate the contents
+			of this file by running:
+<screen>
+&rootprompt; testparm -s
+Load smb config files from smb.conf
+Processing section "[homes]"
+Processing section "[printers]"
+Processing section "[netlogon]"
+Processing section "[profiles]"
+Processing section "[accounts]"
+Processing section "[service]"
+Processing section "[apps]"
+Loaded services file OK.
+# Global parameters
+[global]
+    workgroup = PROMISES
+    netbios name = DIAMOND
+    interfaces = eth1, eth2, lo
+    bind interfaces only = Yes
+    passdb backend = tdbsam
+    pam password change = Yes
+    passwd program = /usr/bin/passwd '%u'
+    passwd chat = *New*Password* %n\n \
+             *Re-enter*new*password* %n\n *Password*changed*
+    username map = /etc/samba/smbusers
+    unix password sync = Yes
+    log level = 1
+    syslog = 0
+    log file = /var/log/samba/%m
+    max log size = 50
+    smb ports = 139 445
+    name resolve order = wins bcast hosts
+    time server = Yes
+    printcap name = CUPS
+    show add printer wizard = No
+    add user script = /usr/sbin/useradd -m '%u'
+    delete user script = /usr/sbin/userdel -r '%u'
+    add group script = /usr/sbin/groupadd '%g'
+    delete group script = /usr/sbin/groupdel '%g'
+    add user to group script = /usr/sbin/usermod -G '%g' '%u'
+    add machine script = /usr/sbin/useradd \
+                              -s /bin/false -d /dev/null '%u'
+    shutdown script = /var/lib/samba/scripts/shutdown.sh
+    abort shutdown script = /sbin/shutdown -c
+    logon script = scripts\logon.bat
+    logon path = \\%L\profiles\%U
+    logon drive = X:
+    logon home = \\%L\%U
+    domain logons = Yes
+    preferred master = Yes
+    wins support = Yes
+    utmp = Yes
+    winbind use default domain = Yes
+    map acl inherit = Yes
+    cups options = Raw
+    veto files = /*.eml/*.nws/*.{*}/
+    veto oplock files = /*.doc/*.xls/*.mdb/
+
+[homes]
+    comment = Home Directories
+    valid users = %S
+    read only = No
+    browseable = No
+...
+### Remainder cut to save space ###
+</screen>
+			Clear away all errors before proceeding.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>check samba daemons</primary></indexterm>
+			<indexterm><primary>smbd</primary></indexterm>
+			<indexterm><primary>nmbd</primary></indexterm>
+			<indexterm><primary>winbindd</primary></indexterm>
+			Check that the Samba server is running:
+<screen>
+&rootprompt; ps ax | grep mbd
+14244 ?        S      0:00 /usr/sbin/nmbd -D
+14245 ?        S      0:00 /usr/sbin/nmbd -D
+14290 ?        S      0:00 /usr/sbin/smbd -D
+
+$rootprompt; ps ax | grep winbind
+14293 ?        S     0:00 /usr/sbin/winbindd -B
+14295 ?        S     0:00 /usr/sbin/winbindd -B
+</screen>
+			The <command>winbindd</command> daemon is running in split mode (normal), so there are also
+			two instances<footnote><para>For more information regarding winbindd, see <emphasis>TOSHARG</emphasis>, 
+			Chapter 23, Section 23.3. The single instance of <command>smbd</command> is normal. One additional
+			<command>smbd</command> slave process is spawned for each SMB/CIFS client 
+			connection.</para></footnote> of it.
+			</para></step>
+	
+			<step><para>
+			<indexterm><primary>anonymous
+		  connection</primary></indexterm>
+	      <indexterm>
+		<primary>smbclient</primary>
+	      </indexterm>
+			Check that an anonymous connection can be made to the Samba server:
+<screen>
+&rootprompt; smbclient -L localhost -U%
+
+        Sharename      Type      Comment
+        ---------      ----      -------
+        IPC$           IPC       IPC Service (Samba 3.0.20)
+        netlogon       Disk      Network Logon Service
+        profiles       Disk      Profile Share
+        accounts       Disk      Accounting Files
+        service        Disk      Financial Services Files
+        apps           Disk      Application Files
+        ADMIN$         IPC       IPC Service (Samba 3.0.20)
+        hplj6a         Printer   hplj6a
+        hplj6f         Printer   hplj6f
+        qmsa           Printer   qmsa
+        qmsf           Printer   qmsf
+
+        Server               Comment
+        ---------            -------
+        DIAMOND              Samba 3.0.20
+
+        Workgroup            Master
+        ---------            -------
+        PROMISES             DIAMOND
+</screen>
+			This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
+			of browsing the server from a Windows client to obtain a list of shares on the server.
+			The <constant>-U%</constant> argument means to send a <constant>NULL</constant> username and
+			a <constant>NULL</constant> password.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>dhcp client validation</primary></indexterm>
+			<indexterm><primary>printer validation</primary></indexterm>
+			<indexterm><primary>arp</primary></indexterm>
+			Verify that each printer has the IP address assigned in the DHCP server configuration file.
+			The easiest way to do this is to ping the printer name. Immediately after the ping response
+			has been received, execute <command>arp -a</command> to find the MAC address of the printer
+			that has responded. Now you can compare the IP address and the MAC address of the printer
+			with the configuration information in the <filename>/etc/dhcpd.conf</filename> file. They
+			should, of course, match. For example,
+<screen>
+&rootprompt; ping hplj6
+PING hplj6a (192.168.1.30) 56(84) bytes of data.
+64 bytes from hplj6a (192.168.1.30): icmp_seq=1 ttl=64 time=0.113 ms
+
+&rootprompt; arp -a
+hplj6a (192.168.1.30) at 00:03:47:CB:81:E0 [ether] on eth0
+</screen>
+	      <indexterm>
+		<primary>/etc/dhcpd.conf</primary>
+	      </indexterm>
+			The MAC address <constant>00:03:47:CB:81:E0</constant> matches that specified for the
+			IP address from which the printer has responded and with the entry for it in the
+			<filename>/etc/dhcpd.conf</filename> file. Repeat this for each printer configured.
+			</para></step>
+	
+			<step><para>
+			<indexterm><primary>authenticated connection</primary></indexterm>
+			Make an authenticated connection to the server using the <command>smbclient</command> tool:
+<screen>
+&rootprompt; smbclient //diamond/accounts -U gholmes
+Password: XXXXXXX
+smb: \> dir
+  .                          D        0  Thu Nov 27 15:07:09 2003
+  ..                         D        0  Sat Nov 15 17:40:50 2003
+  zakadmin.exe                   161424  Thu Nov 27 15:06:52 2003
+  zak.exe                       6066384  Thu Nov 27 15:06:52 2003
+  dhcpd.conf                       1256  Thu Nov 27 15:06:52 2003
+  smb.conf                         2131  Thu Nov 27 15:06:52 2003
+  initGrps.sh                A     1089  Thu Nov 27 15:06:52 2003
+  POLICY.EXE                      86542  Thu Nov 27 15:06:52 2003
+
+                55974 blocks of size 65536. 33968 blocks available
+smb: \> q
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>nmap</primary></indexterm>
+			Your new server is connected to an Internet-accessible connection. Before you start
+			your firewall, you should run a port scanner against your system. You should repeat that
+			after the firewall has been started. This helps you understand to what extent the
+			server may be vulnerable to external attack. One way you can do this is by using an
+			external service, such as the <ulink url="http://www.dslreports.com/scan">DSL Reports</ulink> 
+			tools. Alternately, if you can gain root-level access to a remote
+			UNIX/Linux system that has the <command>nmap</command> tool, you can run the following:
+<screen>
+&rootprompt; nmap -v -sT server.abmas.us
+
+Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
+Host server.abmas.us (123.45.67.66) appears to be up ... good.
+Initiating Connect() Scan against server.abmas.us (123.45.67.66)
+Adding open port 6000/tcp
+Adding open port 873/tcp
+Adding open port 445/tcp
+Adding open port 10000/tcp
+Adding open port 901/tcp
+Adding open port 631/tcp
+Adding open port 25/tcp
+Adding open port 111/tcp
+Adding open port 32770/tcp
+Adding open port 3128/tcp
+Adding open port 53/tcp
+Adding open port 80/tcp
+Adding open port 443/tcp
+Adding open port 139/tcp
+Adding open port 22/tcp
+The Connect() Scan took 0 seconds to scan 1601 ports.
+Interesting ports on server.abmas.us (123.45.67.66):
+(The 1587 ports scanned but not shown below are in state: closed)
+Port       State       Service
+22/tcp     open        ssh
+25/tcp     open        smtp
+53/tcp     open        domain
+80/tcp     open        http
+111/tcp    open        sunrpc
+139/tcp    open        netbios-ssn
+443/tcp    open        https
+445/tcp    open        microsoft-ds
+631/tcp    open        ipp
+873/tcp    open        rsync
+901/tcp    open        samba-swat
+3128/tcp   open        squid-http
+6000/tcp   open        X11
+10000/tcp  open        snet-sensor-mgmt
+32770/tcp  open        sometimes-rpc3
+
+Nmap run completed -- 1 IP address (1 host up) scanned in 1 second
+</screen>
+			The above scan was run before the external interface was locked down with the NAT-firewall
+			script you created above. The following results are obtained after the firewall rules
+			have been put into place:
+<screen>
+&rootprompt; nmap -v -sT server.abmas.us
+
+Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
+Host server.abmas.us (123.45.67.66) appears to be up ... good.
+Initiating Connect() Scan against server.abmas.us (123.45.67.66)
+Adding open port 53/tcp
+Adding open port 22/tcp
+The Connect() Scan took 168 seconds to scan 1601 ports.
+Interesting ports on server.abmas.us (123.45.67.66):
+(The 1593 ports scanned but not shown below are in state: filtered)
+Port       State       Service
+22/tcp     open        ssh
+25/tcp     closed      smtp
+53/tcp     open        domain
+80/tcp     closed      http
+443/tcp    closed      https
+
+Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds
+</screen>
+			</para></step>
+	
+		</procedure>
+
+	</sect2>
+
+	<sect2 id="ch4appscfg">
+	<title>Application Share Configuration</title>
+
+	<para>
+	<indexterm><primary>application server</primary></indexterm>
+	<indexterm><primary>administrative installation</primary></indexterm>
+	The use of an application server is a key mechanism by which desktop administration overheads
+	can be reduced. Check the application manual for your software to identify how best to
+	create an administrative installation.
+	</para>
+
+	<para>
+	Some Windows software will only run locally on the desktop computer. Such software
+	is typically not suited for administrative installation. Administratively installed software
+	permits one or more of the following installation choices:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		Install software fully onto a workstation, storing data files on the same workstation.
+		</para></listitem>
+
+		<listitem><para>
+		Install software fully onto a workstation with central network data file storage.
+		</para></listitem>
+
+		<listitem><para>
+		Install software to run off a central application server with data files stored
+		on the local workstation. This is often called a minimum installation, or a
+		network client installation.
+		</para></listitem>
+
+		<listitem><para>
+		Install software to run off a central application server with data files stored
+		on a central network share. This type of installation often prevents storage
+		of work files on the local workstation.
+		</para></listitem>
+	</itemizedlist>
+
+	<para>
+	<indexterm><primary></primary></indexterm>
+	A common application deployed in this environment is an office suite.
+	Enterprise editions of Microsoft Office XP Professional can be administratively installed
+	by launching the installation from a command shell. The command that achieves this is
+	<command>setup /a</command>. It results in a set of prompts through which various
+	installation choices can be made. Refer to the Microsoft Office Resource SDK and Resource
+	Kit for more information regarding this mode of installation of MS Office XP Professional.
+	The full administrative installation of MS Office XP Professional requires approximately
+	650 MB of disk space.
+	</para>
+
+	<para>
+	When the MS Office XP Professional product has been installed to the administrative network
+	share, the product can be installed onto a workstation by executing the normal setup program.
+	The installation process now provides a choice to either perform a minimum installation
+	or a full local installation. A full local installation takes over 100 MB of disk space.
+	A network workstation (minimum) installation requires typically 10 MB to 15 MB of
+	local disk space. In the latter case, when the applications are used, they load over the network.
+	</para>
+
+	<para>
+	<indexterm><primary>Service Packs</primary></indexterm>
+	<indexterm><primary>Microsoft Office</primary></indexterm>
+	Microsoft Office Service Packs can be unpacked to update an administrative share. This makes
+	it possible to update MS Office XP Professional for all users from a single installation
+	of the service pack and generally circumvents the need to run updates on each network
+	Windows client.
+	</para>	
+
+	<para>
+	The default location for MS Office XP Professional data files can be set through registry
+	editing or by way of configuration options inside each Office XP Professional application.
+	</para>
+
+	<para>
+	<indexterm><primary>OpenOffice</primary></indexterm>
+	OpenOffice.Org OpenOffice Version 1.1.0 can be installed locally. It can also
+	be installed to run off a network share. The latter is a most desirable solution for office-bound 
+	network users and for administrative staff alike. It permits quick and easy updates
+	to be rolled out to all users with a minimum of disruption and with maximum flexibility.
+	</para>
+
+	<para>
+	The process for installation of administrative shared OpenOffice involves download of the
+	distribution ZIP file, followed by extraction of the ZIP file into a temporary disk area.
+	When fully extracted using the unzipping tool of your choosing, change into the Windows
+	installation files directory then execute <command>setup -net</command>. You are
+	prompted on screen for the target installation location. This is the administrative
+	share point. The full administrative OpenOffice share takes approximately 150 MB of disk
+	space.
+	</para>
+
+		<sect3>
+		<title>Comments Regarding Software Terms of Use</title>
+			<para>
+			Many single-user products can be installed into an administrative share, but
+			personal versions of products such as Microsoft Office XP Professional do not permit this. 
+			Many people do not like terms of use typical with commercial products, so a few comments
+			regarding software licensing seem important.
+			</para>
+
+			<para>
+			Please do not use an administrative installation of proprietary and commercially licensed 
+			software products to violate the copyright holders' property. All software is licensed,
+			particularly software that is licensed for use free of charge. All software is the property
+			of the copyright holder unless the author and/or copyright holder has explicitly disavowed
+			ownership and has placed the software into the public domain.
+			</para>
+
+			<para>
+			Software that is under the GNU General Public License, like proprietary software, is 
+			licensed in a way that restricts use. For example, if you modify GPL software and then
+			distribute the binary version of your modifications, you must offer to provide the source
+			code as well. This restriction is designed to maintain the momentum
+			of the diffusion of technology and to protect against the withholding of innovations.
+			</para>
+
+			<para>
+			Commercial and proprietary software generally restrict use to those who have paid the
+			license fees and who comply with the licensee's terms of use. Software that is released
+			under the GNU General Public License is restricted to particular terms and conditions
+			also. Whatever the licensing terms may be, if you do not approve of the terms of use,
+			please do not use the software.
+			</para>
+
+			<para>
+			<indexterm><primary>GPL</primary></indexterm>
+			Samba is provided under the terms of the GNU GPL Version 2, a copy of which is provided
+			with the source code.
+			</para>
+		</sect3>
+
+	</sect2>
+
+	<sect2 id="ch4wincfg">
+	<title>Windows Client Configuration</title>
+
+	<para>
+	Christine needs to roll out 130 new desktop systems. There is no doubt that she also needs
+	to reinstall many of the notebook computers that will be recycled for use with the new network 
+	configuration. The smartest way to handle the challenge of the roll-out program is to build
+	a staged system for each type of target machine, and then use an image replication tool such as Norton
+	Ghost (enterprise edition) to replicate the staged machine to its target desktops. The same can
+	be done with notebook computers as long as they are identical or sufficiently similar.
+	</para>
+
+	<procedure id="sbewinclntprep">
+	<title>Windows Client Configuration Procedure</title>
+
+		<step><para>
+		<indexterm><primary>WINS</primary></indexterm>
+		<indexterm><primary>DHCP</primary></indexterm>
+		Install MS Windows XP Professional. During installation, configure the client to use DHCP for 
+		TCP/IP protocol configuration. DHCP configures all Windows clients to use the WINS Server
+		address that has been defined for the local subnet.
+		</para></step>
+
+		<step><para>
+		Join the Windows Domain <constant>PROMISES</constant>. Use the Domain Administrator
+		username <constant>root</constant> and the SMB password you assigned to this account.
+		A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
+		a Windows Domain is given in Appendix A, <link linkend="domjoin"/>. 
+		Reboot the machine as prompted and then log on using the Domain Administrator account
+		(<constant>root</constant>).
+		</para></step>
+
+		<step><para>
+		Verify <constant>DIAMOND</constant> is visible in <guimenu>My Network Places</guimenu>, 
+		that it is possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>,
+		<guimenuitem>apps</guimenuitem>, and <guimenuitem>finsvcs</guimenuitem>, and that it is
+		possible to open each share to reveal its contents.
+		</para></step>
+
+		<step><para>
+		Create a drive mapping to the <constant>apps</constant> share on the server <constant>DIAMOND</constant>.
+		</para></step>
+
+		<step><para>
+		Perform an administrative installation of each application to be used. Select the options
+		that you wish to use. Of course, you can choose to run applications over the network, correct?
+		</para></step>
+
+		<step><para>
+		Now install all applications to be installed locally. Typical tools include Adobe Acrobat,
+		NTP-based time synchronization software, drivers for specific local devices such as fingerprint
+		scanners, and the like. Probably the most significant application for local installation
+		is antivirus software.
+		</para></step>
+
+		<step><para>
+		Now install all four printers onto the staging system. The printers you install
+		include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers. You will
+		also configure identical printers that are located in the financial services department.
+		Install printers on each machine following the steps shown in the Windows client printer
+		preparation procedure below.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>defragmentation</primary></indexterm>
+		When you are satisfied that the staging systems are complete, use the appropriate procedure to
+		remove the client from the domain. Reboot the system and then log on as the local administrator
+		and clean out all temporary files stored on the system. Before shutting down, use the disk
+		defragmentation tool so that the file system is in optimal condition before replication.
+		</para></step>
+
+		<step><para>
+		Boot the workstation using the Norton (Symantec) Ghosting diskette (or CD-ROM) and image the
+		machine to a network share on the server.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>Windows security identifier</primary><see>SID</see></indexterm>
+		<indexterm><primary>SID</primary></indexterm>
+		You may now replicate the image to the target machines using the appropriate Norton Ghost 
+		procedure. Make sure to use the procedure that ensures each machine has a unique
+		Windows security identifier (SID). When the installation of the disk image has completed, boot the PC. 
+		</para></step>
+
+		<step><para>
+		Log on to the machine as the local Administrator (the only option), and join the machine to
+		the Domain, following the procedure set out in Appendix A, <link linkend="domjoin"/>. The system is now 
+		ready for the user to log on, provided you have created a network logon account for that 
+		user, of course.
+		</para></step>
+
+		<step><para>
+		Instruct all users to log on to the workstation using their assigned username and password.
+		</para></step>
+	</procedure>
+
+	<procedure id="sbewinclntptrprep">
+	<title>Windows Client Printer Preparation Procedure</title>
+
+		<step><para>
+		Click <menuchoice>
+			<guimenu>Start</guimenu>
+			<guimenuitem>Settings</guimenuitem>
+			<guimenuitem>Printers</guimenuitem>
+			<guiicon>Add Printer</guiicon>
+			<guibutton>Next</guibutton>
+			</menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
+			Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
+		</para></step>
+
+		<step><para>
+		Click <guibutton>Next</guibutton>. In the
+		<guimenuitem>Manufacturer:</guimenuitem> panel, select <constant>HP</constant>.
+		In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
+		<constant>HP LaserJet 6</constant>. Click <guibutton>Next</guibutton>.
+		</para></step>
+
+		<step><para>
+		In the <guimenuitem>Available ports:</guimenuitem> panel, select
+		<constant>FILE:</constant>. Accept the default printer name by clicking
+		<guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
+		test page?,</quote> click <guimenuitem>No</guimenuitem>. Click
+		<guibutton>Finish</guibutton>.
+		</para></step>
+
+		<step><para>
+		You may be prompted for the name of a file to print to. If so, close the
+		dialog panel. Right-click <menuchoice>
+			<guiicon>HP LaserJet 6</guiicon>
+			<guimenuitem>Properties</guimenuitem>
+			<guisubmenu>Details (Tab)</guisubmenu>
+			<guimenuitem>Add Port</guimenuitem>
+			</menuchoice>.
+		</para></step>
+
+		<step><para>
+		In the <guimenuitem>Network</guimenuitem> panel, enter the name of
+		the print queue on the Samba server as follows: <constant>\\DIAMOND\hplj6a</constant>.
+		Click <menuchoice> 
+			<guibutton>OK</guibutton>
+			<guibutton>OK</guibutton>
+			</menuchoice> to complete the installation.
+		</para></step>
+
+		<step><para>
+		Repeat the printer installation steps above for both HP LaserJet 6 printers
+		as well as for both QMS Magicolor laser printers.
+		</para></step>
+	</procedure>
+
+	</sect2>
+
+	<sect2>
+	<title>Key Points Learned</title>
+
+		<para>
+		How do you feel? You have built a capable network, a truly ambitious project.
+		Future network updates can be handled by
+		your staff. You must be a satisfied manager. Let's review the achievements.
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			A simple firewall has been configured to protect the server in the event that
+			the ISP firewall service should fail.
+			</para></listitem>
+
+			<listitem><para>
+			The Samba configuration uses measures to ensure that only local network users
+			can connect to SMB/CIFS services.
+			</para></listitem>
+
+			<listitem><para>
+			Samba uses the new <constant>tdbsam</constant> passdb backend facility.
+			Considerable complexity was added to Samba functionality.
+			</para></listitem>
+
+			<listitem><para>
+			A DHCP server was configured to implement dynamic DNS (DDNS) updates to the DNS
+			server.
+			</para></listitem>
+
+			<listitem><para>
+			The DNS server was configured to permit DDNS only for local network clients. This
+			server also provides primary DNS services for the company Internet presence.
+			</para></listitem>
+
+			<listitem><para>
+			You introduced an application server as well as the concept of cloning a Windows
+			client in order to effect improved standardization of desktops and to reduce
+			the costs of network management.
+			</para></listitem>
+		</itemizedlist>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Questions and Answers</title>
+
+	<para>
+	</para>
+
+	<qandaset>
+	<qandaentry>
+	<question>
+
+		<para>
+		What is the maximum number of account entries that the <parameter>tdbsam</parameter>
+		passdb backend can handle?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The tdb data structure and support system can handle more entries than the number of
+		accounts that are possible on most UNIX systems. A practical limit would come into
+		play long before a performance boundary would be anticipated. That practical limit
+		is controlled by the nature of Windows networking. There are few Windows file and
+		print servers that can handle more than a few hundred concurrent client connections.
+		The key limiting factors that predicate offloading of services to additional servers
+		are memory capacity, the number of CPUs, network bandwidth, and disk I/O limitations.
+		All of these are readily exhausted by just a few hundred concurrent active users.
+		Such bottlenecks can best be removed by segmentation of the network (distributing
+		network load across multiple networks).
+		</para>
+
+		<para>
+		As the network grows, it becomes necessary to provide additional authentication
+		servers (domain controllers).  The tdbsam is limited to a single machine and cannot
+		be reliably replicated.  This means that practical limits on network design dictate
+		the point at which a distributed passdb backend is required; at this time, there is
+		no real alternative other than ldapsam (LDAP).
+		</para>
+
+		<para>
+		The guideline provided in <emphasis>TOSHARG</emphasis>, Chapter 10, Section 10.1.2,
+		is to limit the number of accounts in the tdbsam backend to 250. This is the point
+		at which most networks tend to want backup domain controllers (BDCs). Samba-3 does
+		not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The
+		limitation of 250 users per tdbsam is predicated only on the need for replication,
+		not on the limits<footnote><para>Bench tests have shown that tdbsam is a very
+		effective database technology.  There is surprisingly little performance loss even
+		with over 4000 users.</para></footnote> of the tdbsam backend itself. 
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Would Samba operate any better if the OS level is set to a value higher than 35?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		No. MS Windows workstations and servers do not use a value higher than 33. Setting this to a value
+		of 35 already assures Samba of precedence over MS Windows products in browser elections. There is
+		no gain to be had from setting this higher.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		At this time, Samba has the capacity to use only Domain Groups mappings. It is possible that at
+		a later date Samba may make use of Windows Local Groups, as well as of the Active Directory special
+		Groups. Proper operation requires Domain Groups to be mapped to valid UNIX groups.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why has a path been specified in the <parameter>IPC$</parameter> share?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		This is done so that in the event that a software bug may permit a client connection to the IPC$ share to
+		obtain access to the file system, it does so at a location that presents least risk. Under normal operation
+		this type of paranoid step should not be necessary. The use of this parameter should not be necessary. 
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why does the &smb.conf; file in this exercise include an entry for <smbconfoption name="smb ports"/>?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The default order by which Samba-3 attempts to communicate with MS Windows clients is via port 445 (the TCP port
+		used by Windows clients when NetBIOS-less SMB over TCP/IP is in use). TCP port 139 is the primary port used for NetBIOS
+		over TCP/IP. In this configuration Windows network operations are predicated around NetBIOS over TCP/IP. By
+		specifying the use of port 139 before port 445, the intent is to reduce unsuccessful service connection attempts.
+		The result of this is improved network performance. Where Samba-3 is installed as an Active Directory Domain
+		member, the default behavior is highly beneficial and should not be changed.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What is the difference between a print queue and a printer?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		A printer is a physical device that is connected either directly to the network or to a computer 
+		via a serial, parallel, or USB connection so that print jobs can be submitted to it to create a 
+		hard copy printout. Network-attached printers that use TCP/IP-based printing generally accept a 
+		single print data stream and block all secondary attempts to dispatch jobs concurrently to the 
+		same device. If many clients were to concurrently print directly via TCP/IP to the same printer, 
+		it would result in a huge amount of network traffic through continually failing connection attempts.
+		</para>
+
+		<para>
+		A print server (like CUPS or LPR/LPD) accepts multiple concurrent input streams or
+		print requests. When the data stream has been fully received, the input stream is closed,
+		and the job is then submitted to a sequential print queue where the job is stored until
+		the printer is ready to receive the job.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Can all MS Windows application software be installed onto an application server share?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Much older Windows software is not compatible with installation to and execution from
+		an application server. Enterprise versions of Microsoft Office XP Professional can
+		be installed to an application server. Retail consumer versions of Microsoft Office XP
+		Professional do not permit installation to an application server share and can be installed
+		and used only to/from a local workstation hard disk.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why use dynamic DNS (DDNS)?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		When DDNS records are updated directly from the DHCP server, it is possible for
+		network clients that are not NetBIOS-enabled, and thus cannot use WINS, to locate
+		Windows clients via DNS.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why would you use WINS as well as DNS-based name resolution?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		WINS is to NetBIOS names as DNS is to fully qualified domain names (FQDN). The FQDN is
+		a name like <quote>myhost.mydomain.tld</quote> where <parameter>tld</parameter>
+		means <constant>top-level domain</constant>. A FQDN is a longhand but easy-to-remember
+		expression that may be up to 1024 characters in length and that represents an IP address. 
+		A NetBIOS name is always 16 characters long. The 16<superscript>th</superscript> character
+		is a name type indicator. A specific name type is registered<footnote><para>
+		See <emphasis>TOSHARG</emphasis>, Chapter 9, for more information.</para></footnote> for each 
+		type of service that is provided by the Windows server or client and that may be registered
+		where a WINS server is in use.
+		</para>
+
+		<para>
+		WINS is a mechanism by which a client may locate the IP Address that corresponds to a
+		NetBIOS name. The WINS server may be queried to obtain the IP Address for a NetBIOS name 
+		that includes a particular registered NetBIOS name type. DNS does not provide a mechanism
+		that permits handling of the NetBIOS name type information.
+		</para>
+
+		<para>
+		DNS provides a mechanism by which TCP/IP clients may locate the IP address of a particular 
+		hostname or service name that has been registered in the DNS database for a particular domain. 
+		A DNS server has limited scope of control and is said to be authoritative for the zone over
+		which it has control.
+		</para>
+
+		<para>
+		Windows 200x Active Directory requires the registration in the DNS zone for the domain it 
+		controls of service locator<footnote><para>See TOSHARG, Chapter 9, Section 9.3.3.</para></footnote> records 
+		that Windows clients and servers will use to locate Kerberos and LDAP services. ADS also 
+		requires the registration of special records that are called global catalog (GC) entries 
+		and site entries by which domain controllers and other essential ADS servers may be located. 
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What are the major benefits of using an application server?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The use of an application server can significantly reduce application update maintenance.
+		By providing a centralized application share, software updates need be applied to only
+		one location for all major applications used. This results in faster update roll-outs and
+		significantly better application usage control.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	</qandaset>
+
+</sect1>
+
+</chapter>
diff --git a/docs/Samba3-ByExample/SBE-SimpleOfficeServer.xml b/docs/Samba3-ByExample/SBE-SimpleOfficeServer.xml
new file mode 100644
index 0000000000..036953b584
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-SimpleOfficeServer.xml
@@ -0,0 +1,1591 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="simple">
+  <title>No-Frills Samba Servers</title>
+
+<?latex \pagenumbering{arabic} ?>
+
+	<para>
+	This is the start of the real journey toward the successful deployment of Samba. For some this chapter
+	is the end of the road because their needs will have been adequately met. For others, this chapter is
+	the beginning of a journey that will take them well past the contents of this book. This book provides
+	example configurations of, for the greater part, complete networking solutions. The intent of this book
+	is to help you to get your Samba installation working with the least amount of pain and aggravation.
+	</para>
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>
+	This chapter lays the groundwork for understanding the basics of Samba operation. 
+	Instead of a bland technical discussion, each principle is demonstrated by way of a 
+	real-world scenario for which a working solution<footnote><para>The examples given mirror those documented
+	in The Official Samba-3 HOWTO and Reference Guide (TOSHARG) Chapter 2, Section 2.3.1. You may gain additional
+	insight from the standalone server configurations covered in TOSHARG, sections 2.3.1.2 through 2.3.1.4.
+	</para></footnote> is fully described.
+	</para>
+
+	<para>
+	The practical exercises take you on a journey through a drafting office, a charity administration
+	office, and an accounting office. You may choose to apply any or all of these exercises to your own environment.
+	</para>
+
+	<para>
+	Every assignment case can be implemented far more creatively, but remember that the solutions you
+	create are designed to demonstrate a particular solution possibility. With experience, you should
+	find much improved solutions compared with those presented here. By the time you complete this book,
+	you should aim to be a Samba expert, so do attempt to find better solutions and try them as you work your
+	way through the examples.
+	</para>
+
+</sect1>
+<sect1>
+	<title>Assignment Tasks</title>
+
+	<para>
+	Each case presented highlights different aspects of Windows networking for which a simple 
+	Samba-based solution can be provided. Each has subtly different requirements taken from real-world cases.
+	The cases are briefly reviewed to cover important points. Instructions are based
+	on the assumption that the official Samba Team RPM package has been installed.
+	</para>
+
+	<para>
+	This chapter has three assignments built around fictitious companies: 
+	</para>
+
+	<para>
+	<itemizedlist>
+		<listitem><para>A drafting office</para></listitem>
+		<listitem><para>A charity administration office</para></listitem>
+		<listitem><para>An accounting office</para></listitem>
+	</itemizedlist>
+	</para>
+
+	<para>
+	Let's get started.
+	</para>
+
+	<sect2>
+	<title>Drafting Office</title>
+
+	<para>
+	Our fictitious company is called <emphasis>Abmas Design, Inc.</emphasis> This is a three-person
+	computer-aided design (CAD) business that often has more work than can be handled. The 
+	business owner hires contract draftspeople from wherever he can. They bring their own 
+	notebook computers into the office. There are four permanent drafting machines. Abmas has a 
+	collection of over 10 years of plans that must be available for all draftsmen to reference. 
+	Abmas hires the services of an experienced network engineer to update the 
+	plans that are stored on a central server one day per month. She knows how to upload 
+	plans from each machine. The files available from the server must remain read-only. 
+	Anyone should be able to access the plans at any time and without barriers or difficulty.
+	</para>
+
+	<para><indexterm><primary>Red Hat</primary></indexterm>
+		<indexterm><primary>Fedora</primary></indexterm>
+	Mr. Bob Jordan has asked you to install the new server as economically as possible. The central
+	server has a Pentium-IV 1.6GHz CPU, 768MB RAM, a 20GB IDE boot drive, a 160GB IDE second disk
+	to store plans, and a 100-base-T Ethernet card. You have already installed Red Hat Fedora CoreX and
+	have upgraded Samba to version 3.0.20 using the RPM package that is provided from the Samba
+	<ulink url="http://www.samba.org">FTP</ulink> sites. (Note: Fedora CoreX indicates your favorite
+	version.)
+	</para>
+
+	<para><indexterm>
+	    <primary>consultant</primary>
+	  </indexterm>
+	The four permanent drafting machines (Microsoft Windows workstations) have attached printers 
+	and plotters that are shared on a peer-to-peer basis by any and all network users. The intent 
+	is to continue to share printers in this manner. The three permanent staff work together with 
+	all contractors to store all new work on one PC. A daily copy is made of the work storage 
+	area to another PC for safekeeping.  When the network consultant arrives, the weekly work 
+	area is copied to the central server and the files are removed from the main weekly storage 
+	machine. The office works best with this arrangement and does not want to change anything. 
+	Old habits are too ingrained.
+	</para>
+
+		<sect3>
+		<title>Dissection and Discussion</title>
+
+		<para>
+		<indexterm><primary>file server</primary><secondary>read-only</secondary></indexterm>
+		The requirements for this server installation demand simplicity. An anonymous read-only
+		file server adequately meets all needs. The network consultant determines how
+		to upload all files from the weekly storage area to the server. This installation should
+		focus only on critical aspects of the installation.
+		</para>
+
+		<para>
+		It is not necessary to have specific users on the server. The site has a method for storing
+		all design files (plans). Each plan is stored in a directory that is named YYYYWW,<footnote><para>
+		This information is given purely as an example of how data may be stored in such a way that it
+		will be easy to locate records at a later date. The example is not meant to imply any instructions
+		that may be construed as essential to the design of the solution; this is something you will almost
+		certainly want to determine for yourself.</para></footnote> where
+		YYYY is the year, and WW is the week of the year. This arrangement allows work to be stored
+		by week of year to preserve the filing technique the site is familiar with.
+		There is also a customer directory that is alphabetically listed. At the top level are 26
+		directories (A-Z), in each is a second-level of directory for the first plus second letters of the name
+		(A-Z); inside each is a directory by the customers' name. Inside each directory is a symbolic
+		link to each design drawing or plan. This way of storing customer data files permits all
+		plans to be located both by customer name and by the date the work was performed, without
+		demanding the disk space that would be needed if a duplicate file copy were to be stored. 
+		The share containing the plans is called <emphasis>Plans</emphasis>.
+		</para>
+
+		</sect3>
+
+		<sect3>
+		<title>Implementation</title>
+
+		<para>
+		It is assumed that the server is fully installed and ready for installation and 
+		configuration of Samba 3.0.20 and any support files needed. All TCP/IP addresses 
+		have been hard-coded. In our case the IP address of the Samba server is 
+		<constant>192.168.1.1</constant> and the netmask is <constant>255.255.255.0</constant>. 
+		The hostname of the server used is <constant>server</constant>.
+		</para>
+
+		<procedure>
+		<title>Samba Server Configuration</title>
+
+			<step><para>
+			Download the Samba-3 RPM packages for Red Hat Fedora Core2 from the Samba
+			<ulink url="http://www.samba.org">FTP servers.</ulink>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>RPM</primary><secondary>install</secondary></indexterm>
+			<indexterm><primary>package</primary></indexterm>
+			Install the RPM package using either the Red Hat Linux preferred GUI
+			tool or the <command>rpm</command>:
+<screen>
+&rootprompt; rpm -Uvh samba-3.0.20-1.i386.rpm
+</screen>
+			</para></step>
+
+			<step><para>
+			Create a mount point for the file system that will be used to store all data files.
+			You can create a directory called <filename>/plans</filename>:
+<screen>
+&rootprompt; mkdir /plans
+&rootprompt; chmod 755 /plans
+</screen>
+			The 755 permissions on this directory (mount point) permit the owner to read, write,
+			and execute, and the group and everyone else to read and execute only.
+			</para>
+
+			<para>
+			<indexterm><primary>file system</primary><secondary>Ext3</secondary></indexterm>
+			Use Red Hat Linux system tools (refer to Red Hat instructions)
+			to format the 160GB hard drive with a suitable file system. An Ext3 file system
+			is suitable. Configure this drive to automatically mount using the <filename>/plans</filename>
+			directory as the mount point.
+			</para></step>
+
+			<step><para>
+			Install the &smb.conf; file shown in <link linkend="draft-smbconf"/> in the
+			<filename>/etc/samba</filename> directory.
+
+<smbconfexample id="draft-smbconf">
+<title>Drafting Office &smb.conf; File</title>
+<smbconfcomment>Global Parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
+<smbconfoption name="security">SHARE</smbconfoption>
+
+<smbconfsection name="[Plans]"/>
+<smbconfoption name="path">/plans</smbconfoption>
+<smbconfoption name="read only">Yes</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+</smbconfexample>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>/etc/hosts</primary></indexterm>
+			Verify that the <filename>/etc/hosts</filename> file contains the following entry:
+<screen>
+192.168.1.1	server
+</screen>
+
+<?latex \newpage ?>
+
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>samba</primary><secondary>starting samba</secondary></indexterm>
+			<indexterm><primary>chkconfig</primary></indexterm>
+			<indexterm><primary>starting samba</primary></indexterm>
+			Use the standard system tool to start Samba and to configure it to restart
+			automatically at every system reboot. For example,
+<screen>
+&rootprompt; chkconfig smb on
+&rootprompt; /etc/rc.d/init.d/smb restart
+</screen>
+			</para></step>
+
+		</procedure>
+
+		<procedure>
+		<title>Windows Client Configuration</title>
+
+			<step><para>
+			Make certain that all clients are set to the same network address range as
+			used for the Samba server. For example, one client might have an IP
+			address 192.168.1.10.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>netmask</primary></indexterm>
+			Ensure that the netmask used on the Windows clients matches that used
+			for the Samba server. All clients must have the same netmask, such as
+			255.255.255.0.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>workgroup</primary></indexterm>
+			Set the workgroup name on all clients to <constant>MIDEARTH</constant>.
+			</para></step>
+
+			<step><para>
+			Verify on each client that the machine called <constant>SERVER</constant>
+			is visible in the <guimenu>Network Neighborhood</guimenu>, that it is
+			possible to connect to it and see the share <guimenuitem>Plans</guimenuitem>,
+			and that it is possible to open that share to reveal its contents.
+			</para></step>
+
+		</procedure>
+
+		</sect3>
+
+		<sect3 id="validate1">
+		<title>Validation</title>
+
+		<para>
+		<indexterm><primary>validation</primary></indexterm>
+		The first priority in validating the new Samba configuration should be to check
+		that Samba answers on the loop-back interface. Then it is time to check that Samba
+		answers its own name correctly. Last, check that a client can connect to the Samba
+		server.
+		</para>
+
+		<procedure>
+			<step><para>
+			<indexterm><primary>smbd</primary></indexterm>
+			<indexterm><primary>daemon</primary></indexterm>
+			<indexterm><primary>smbclient</primary></indexterm>
+			To check the ability to access the <command>smbd</command> daemon
+			services, execute the following:
+<screen>
+&rootprompt; smbclient -L localhost -U%
+        Sharename     Type     Comment
+        ---------     ----     -------
+        Plans         Disk
+        IPC$          IPC      IPC Service (Samba 3.0.20)
+        ADMIN$        IPC      IPC Service (Samba 3.0.20)
+
+        Server             Comment
+        ---------          -------
+        SERVER             Samba 3.0.20
+
+        Workgroup          Master
+        ---------          --------
+        MIDEARTH           SERVER 
+</screen>
+			<indexterm><primary>loopback</primary></indexterm>
+			<indexterm><primary>NULL connection</primary></indexterm>
+			This indicates that Samba is able to respond on the loopback interface to
+			a NULL connection. The <parameter>-U%</parameter> means send an empty
+			username and an empty password. This command should be repeated after
+			Samba has been running for 15 minutes.
+			</para></step>
+
+			<step><para>
+			Now verify that Samba correctly handles being passed a username
+			and password, and that it answers its own name. Execute the following:
+<screen>
+&rootprompt; smbclient -L server -Uroot%password
+</screen>
+			The output should be identical to the previous response. Samba has been
+			configured to ignore all usernames given; instead it uses the
+			<parameter>guest account</parameter> for all connections.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>Windows Explorer</primary></indexterm>
+			<indexterm><primary>Network Neighborhood</primary></indexterm>
+			From the Windows 9x/Me client, launch Windows Explorer: 
+			<menuchoice>
+				<guiicon>[Desktop: right-click] Network Neighborhood</guiicon>
+				<guimenu>Explore</guimenu>
+				<guimenuitem>[Left Panel]  [+] Entire Network</guimenuitem>
+				<guimenuitem>[Left Panel] [+] Server</guimenuitem>
+				<guimenuitem>[Left Panel] [+] Plans</guimenuitem>
+			</menuchoice>. In the right panel you should see the files and directories
+			(folders) that are in the <guiicon>Plans</guiicon> share.
+			</para></step>
+		</procedure>
+
+		</sect3>
+
+	</sect2>
+
+	<sect2>
+	<title>Charity Administration Office</title>
+
+	<para>
+	The fictitious charity organization is called <emphasis>Abmas Vision NL</emphasis>. This office
+	has five networked computers. Staff are all volunteers, staff changes are frequent.
+	Ms. Amy May, the director of operations, wants a no-hassle network. Anyone should be able to
+	use any PC. Only two Windows applications are used: a custom funds tracking and management package
+	that stores all files on the central server and Microsoft Word. The office prepares mail-out
+	letters, invitations, and thank-you notes. All files must be stored in perpetuity.
+	The custom funds tracking and management (FTM) software is configured to use a server named
+	<constant>SERVER</constant>, a share named <constant>FTMFILES</constant>, and a printer queue
+	named <constant>PRINTQ</constant> that uses preprinted stationery, thus demanding a
+	dedicated printer. This printer does not need to be mapped to a local printer on the workstations.
+	</para>
+
+	<para>
+	The FTM software has been in use since the days of Windows 3.11. The software was configured
+	by the vendor who has since gone out of business. The identities of the file
+	server and the printer are hard-coded in a configuration file that was created using a
+	setup tool that the vendor did not provide to Abmas Vision NL or to its predecessors. The
+	company that produced the software is no longer in business. In order to avoid risk of
+	any incompatibilities, the share name and the name of the target print queue must be set
+	precisely as the application expects. In fact, share names and print queue names
+	should be treated as case insensitive (i.e., case does not matter), but Abmas Vision advises
+	that if the share name is not in lowercase, the application claims it cannot find the
+	file share.
+	</para>
+
+	<para>
+	<indexterm><primary>print queue</primary></indexterm>
+	<indexterm><primary>print spooler</primary></indexterm>
+	Printer handling in Samba results in a significant level of confusion. Samba presents to the
+	MS Windows client only a print queue. The Samba <command>smbd</command> process passes a
+	print job sent to it from the Windows client to the native UNIX printing system. The native
+	UNIX printing system (spooler) places the job in a print queue from which it is
+	delivered to the printer. In this book, network diagrams refer to a printer by the name 
+	of the print queue that services that printer. It does not matter what the fully qualified 
+	name (or the hostname) of a network-attached printer is. The UNIX print spooler is configured 
+	to correctly deliver all jobs to the printer.
+	</para>
+
+	<para>
+	This organization has a policy forbidding use of privately owned computers on site as a measure
+	to prevent leakage of confidential information. Only the five PCs owned by Abmas Vision NL are
+	used on this network.
+	</para>
+
+	<para>
+	<indexterm><primary>SUSE Enterprise Linux Server</primary></indexterm>
+	The central server was donated by a local computer store. It is a dual processor Pentium-III
+	server, has 1GB RAM, a 3-Ware IDE RAID Controller that has four 200GB IDE hard drives, and a
+	100-base-T network card. The office has 100-base-T permanent network connections that go to
+	a central hub, and all equipment is new. The five network computers all are equipped with Microsoft
+	Windows Me. Funding is limited, so the server has no operating system on it. You have approval
+	to install Samba on Linux, provided it works without problems. There are two HP LaserJet
+	5 PS printers that are network connected.  The second printer is to be used for general
+	office and letter printing. Your recommendation to allow only the Linux server to print directly
+	to the printers was accepted. You have supplied SUSE Enterprise Linux Server 9 and
+	have upgraded Samba to version 3.0.20.
+	</para>
+
+		<sect3>
+		<title>Dissection and Discussion</title>
+
+		<para>
+		<indexterm><primary>force user</primary></indexterm>
+		<indexterm><primary>nt acl support</primary></indexterm>
+		<indexterm><primary>UID</primary></indexterm>
+		<indexterm><primary>Posix</primary></indexterm>
+		This installation demands simplicity. Frequent turnover of volunteer staff indicates that
+		a network environment that requires users to logon might be problematic. It is suggested that the
+		best solution for this office would be one where the user can log onto any PC with any username
+		and password. Samba can accommodate an office like this by using the <parameter>force user</parameter>
+		parameter in share and printer definitions. Using the <parameter>force user</parameter>
+		parameter ensures that all files are owned by same user identifier (UID) and thus that there
+		will never be a problem with file access due to file access permissions. Additionally, you elect
+		to use the <parameter>nt acl support = No</parameter> option to ensure that
+		access control lists (Posix type) cannot be written to any file or directory. This prevents
+		an inadvertent ACL from overriding actual file permissions.
+		</para>
+
+		<para>
+		<indexterm><primary>SUID</primary></indexterm>
+		<indexterm><primary>SGID</primary></indexterm>
+		<indexterm><primary>security</primary><secondary>share mode</secondary></indexterm>
+		This organization is a prime candidate for Share Mode security. The <parameter>force user</parameter>
+		allows all files to be owned by the same user and group. In addition, it would not hurt to
+		set SUID and set SGID shared directories. This means that all new files that are created, no matter
+		who creates it, are owned by the owner or group of the directory in which they are created.
+		For further information regarding the significance of the SUID/SGID settings, see Appendix A, 
+		<link linkend="ch12-SUIDSGID"/>.
+		</para>
+
+		<para>
+		<indexterm><primary>CUPS</primary></indexterm>
+		<indexterm><primary>printing</primary><secondary>raw</secondary></indexterm>
+		<indexterm><primary>Red Hat Linux</primary></indexterm>
+		<indexterm><primary>SUSE Linux</primary></indexterm>
+		All client workstations print to a print queue on the server. This ensures that print jobs
+		continue to print in the event that a user shuts down the workstation immediately after
+		sending a job to the printer. Today, both Red Hat Linux and SUSE Linux use CUPS-based printing. 
+		Older Linux systems offered a choice between the LPRng printing system or CUPS. It appears, however,
+		that CUPS has become the leading UNIX printing technology.
+		</para>
+
+		<para>
+		<indexterm><primary>print queue</primary></indexterm>
+		The print queues are set up as <constant>Raw</constant> devices, which means that CUPS will 
+		not do intelligent print processing, and vendor-supplied drivers must be installed locally on the 
+		Windows clients.
+		</para>
+
+		<para>
+		The hypothetical software, FTM, is representative of 
+		custom-built software that directly uses a NetBIOS interface. Most such software originated in
+		the days of MS/PC DOS. NetBIOS names are uppercase (and functionally are case insensitive), 
+		so some old software applications would permit only uppercase names to be entered.
+		Some such applications were later ported to MS Windows but retain the uppercase network
+		resource naming conventions because customers are familiar with that. We made the decision
+		to name shares and print queues for this application in uppercase for the same reason.
+		Nothing would break if we were to use lowercase names, but that decision might create a need
+		to retrain staff &smbmdash; something well avoided at this time.
+		</para>
+
+		<para>
+		NetBIOS networking does not print directly to a printer. Instead, all printing is done to a
+		print queue. The print spooling system is responsible for communicating with the physical
+		printer. In this example, therefore, the resource called <constant>PRINTQ</constant>
+		really is just a print queue. The name of the print queue is representative of
+		the device to which the print spooler delivers print jobs.
+		</para>
+
+		</sect3>
+
+		<sect3>
+		<title>Implementation</title>
+
+		<para>
+		It is assumed that the server is fully installed and ready for configuration of
+		Samba 3.0.20 and for necessary support files. All TCP/IP addresses should be hard-coded.
+		In our case, the IP address of the Samba server is 192.168.1.1 and the netmask is
+		255.255.255.0. The hostname of the server used is <constant>server</constant>.
+		The office network is built as shown in <link linkend="charitynet"/>.
+		</para>
+
+		<image id="charitynet">
+			<imagedescription>Charity Administration Office Network</imagedescription>
+			<imagefile scale="80">Charity-Network</imagefile>
+		</image>
+
+<?latex \newpage ?>
+
+		<procedure>
+		<title>Samba Server Configuration</title>
+
+			<step><para>
+			<indexterm><primary>groupadd</primary></indexterm>
+			Create a group account for office file storage:
+<screen>
+&rootprompt; groupadd office
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>useradd</primary></indexterm>
+			<indexterm><primary>passwd</primary></indexterm>
+			Create a user account for office file storage:
+<screen>
+&rootprompt; useradd -m abmas 
+&rootprompt; passwd abmas 
+Changing password for abmas.
+New password: XXXXXXXX
+Re-enter new password: XXXXXXXX
+Password changed
+</screen>
+			where XXXXXXXX is a secret password.
+			</para></step>
+
+				<step><para>
+				Use the 3-Ware IDE RAID Controller firmware utilities to configure the four 200GB
+				drives as a single RAID level 5 drive, with one drive set aside as the hot spare.
+				(Refer to the 3-Ware RAID Controller Manual for the manufacturer's preferred procedure.)
+				The resulting drive has a capacity of approximately 500GB of usable space.
+				</para></step>
+
+				<step><para>
+				<indexterm><primary>permissions</primary></indexterm>
+				Create a mount point for the file system that can be used to store all data files.
+				Create a directory called <filename>/data</filename>:
+<screen>
+&rootprompt; mkdir /data
+&rootprompt; chmod 755 /data
+</screen>
+				The 755 permissions on this directory (mount point) permit the owner to read, write, and execute,
+				and the group and everyone else to read and execute only.
+				</para></step>
+
+				<step><para>
+				Use SUSE Linux system tools (refer to the SUSE Administrators Guide for correct
+				procedures) to format the partition with a suitable file system. The reiserfs file system
+				is suitable. Configure this drive to automount using the <filename>/data</filename>
+				directory as the mount point. It must be mounted before proceeding.
+				</para></step>
+
+				<step><para>
+				Under the directory called <filename>/data</filename>, create two directories
+				named <filename>ftmfiles</filename> and <filename>officefiles</filename>, and set
+				ownership and permissions:
+<screen>
+&rootprompt; mkdir -p /data/{ftmfiles,officefiles/{letters,invitations,misc}}
+&rootprompt; chown -R abmas:office /data
+&rootprompt; chmod -R ug+rwxs,o-w,o+rx /data
+</screen>
+				These demonstrate compound operations. The <command>mkdir</command> command
+ 				creates in one step these directories:
+<programlisting>
+/data/fmtfiles
+/data/officefiles
+/data/officefiles/letters
+/data/officefiles/invitations
+/data/officefiles/misc
+</programlisting>
+				<indexterm><primary>TOSHARG</primary></indexterm>
+				The <command>chown</command> operation sets the owner to the user <constant>abmas</constant>
+				and the group to <constant>office</constant> on all directories just created.  It recursively
+				sets the permissions so that the owner and group have SUID/SGID with read, write, and execute
+				permission, and everyone else has read and execute permission. This means that all files and
+				directories are created with the same owner and group as the directory in which they are
+				created. Any new directories created still have the same owner, group, and permissions as the
+				directory they are in. This should eliminate all permissions-based file access problems.  For
+				more information on this subject, refer to TOSHARG<footnote>The Official Samba-3 HOWTO and
+				Reference Guide, Chapter 15, File, Directory and Share Access Controls.</footnote> or refer
+				to the UNIX man page for the <command>chmod</command> and the <command>chown</command> commands.
+				</para></step>
+
+				<step><para>
+				Install the &smb.conf; file shown in <link linkend="charity-smbconfnew"/> in the
+				<filename>/etc/samba</filename> directory. This newer &smb.conf; file uses user-mode security
+				and is more suited to the mode of operation of Samba-3 than the older share-mode security
+				configuration that was shown in the first edition of this book.
+				</para>
+
+				<para>
+				Note: If you want to use the older-style configuration that uses share-mode security, you
+				can install the file shown in <link linkend="charity-smbconf"/> in the
+				<filename>/etc/samba</filename> directory.
+				</para></step>
+
+				<step><para>
+				<indexterm><primary>smbd</primary></indexterm>
+				We must ensure that the <command>smbd</command> can resolve the name of the Samba
+				server to its IP address. Verify that the <filename>/etc/hosts</filename> file
+				contains the following entry:
+<screen>
+192.168.1.1	server
+</screen>
+				</para></step>
+
+				<step><para>
+				Configure the printers with the IP address as shown in <link linkend="charitynet"/>.
+				Follow the instructions in the manufacturer's manual to permit printing to port 9100
+				so that the CUPS spooler can print using raw mode protocols.
+				</para></step>
+
+				<step><para>
+				<indexterm><primary>lpadmin</primary></indexterm>
+				Configure the CUPS Print Queues:
+<screen>
+&rootprompt; lpadmin -p PRINTQ -v socket://192.168.1.20:9100 -E
+&rootprompt; lpadmin -p hplj5 -v socket://192.168.1.30:9100 -E
+</screen>
+				This creates the necessary print queues with no assigned print filter.
+				</para></step>
+
+				<step><para>
+				<indexterm><primary>mime type</primary></indexterm>
+				<indexterm><primary>/etc/cups/mime.convs</primary></indexterm>
+				<indexterm><primary>application/octet-stream</primary></indexterm>
+				Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
+<screen>
+application/octet-stream     application/vnd.cups-raw      0     -
+</screen>
+				</para></step>
+
+				<step><para>
+				<indexterm><primary>/etc/cups/mime.types</primary></indexterm>
+				Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
+<screen>
+application/octet-stream
+</screen>
+				</para></step>
+
+				<step><para>
+				<indexterm><primary>starting samba</primary></indexterm>
+				Use the standard system tool to start Samba and CUPS to configure them to restart
+				automatically at every system reboot. For example,
+				</para>
+
+				<para>
+				<indexterm><primary>starting samba</primary></indexterm>
+				<indexterm><primary>starting CUPS</primary></indexterm>
+				<indexterm><primary>chkconfig</primary></indexterm>
+<screen>
+&rootprompt; chkconfig smb on
+&rootprompt; chkconfig cups on
+&rootprompt; /etc/rc.d/init.d/smb restart
+&rootprompt; /etc/rc.d/init.d/cups restart
+</screen>
+				</para></step>
+
+			</procedure>
+
+<smbconfexample id="charity-smbconfnew">
+<title>Charity Administration Office &smb.conf; New-style File</title>
+<smbconfcomment>Global Parameters - Newer Configuration</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
+<smbconfoption name="printing">CUPS</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="map to guest">Bad User</smbconfoption>
+<smbconfoption name="show add printer wizard">No</smbconfoption>
+<smbconfoption name="wins support">yes</smbconfoption>
+
+<smbconfsection name="[FTMFILES]"/>
+<smbconfoption name="comment">Funds Tracking &amp; Management Files</smbconfoption>
+<smbconfoption name="path">/data/ftmfiles</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="force user">abmas</smbconfoption>
+<smbconfoption name="force group">office</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="nt acl support">No</smbconfoption>
+
+<smbconfsection name="[office]"/>
+<smbconfoption name="comment">General Office Files</smbconfoption>
+<smbconfoption name="path">/data/officefiles</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="force user">abmas</smbconfoption>
+<smbconfoption name="force group">office</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="nt acl support">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">Print Temporary Spool Configuration</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="use client driver">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="charity-smbconf">
+<title>Charity Administration Office &smb.conf; Old-style File</title>
+<smbconfcomment>Global Parameters - Older Style Configuration</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
+<smbconfoption name="security">SHARE</smbconfoption>
+<smbconfoption name="printing">CUPS</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="disable spoolss">Yes</smbconfoption>
+<smbconfoption name="show add printer wizard">No</smbconfoption>
+<smbconfoption name="wins support">yes</smbconfoption>
+
+<smbconfsection name="[FTMFILES]"/>
+<smbconfoption name="comment">Funds Tracking &amp; Management Files</smbconfoption>
+<smbconfoption name="path">/data/ftmfiles</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="force user">abmas</smbconfoption>
+<smbconfoption name="force group">office</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="nt acl support">No</smbconfoption>
+
+<smbconfsection name="[office]"/>
+<smbconfoption name="comment">General Office Files</smbconfoption>
+<smbconfoption name="path">/data/officefiles</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="force user">abmas</smbconfoption>
+<smbconfoption name="force group">office</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="nt acl support">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">Print Temporary Spool Configuration</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="use client driver">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+</smbconfexample>
+
+			<procedure>
+			<title>Windows Client Configuration</title>
+
+				<step><para>
+				Configure clients to the network settings shown in <link linkend="charitynet"/>.
+				</para></step>
+
+				<step><para>
+				Ensure that the netmask used on the Windows clients matches that used
+				for the Samba server. All clients must have the same netmask, such as
+				<constant>255.255.255.0</constant>.
+				</para></step>
+
+				<step><para>
+				<indexterm><primary>WINS</primary></indexterm>
+				On all Windows clients, set the WINS Server address to <constant>192.168.1.1</constant>,
+				the IP address of the server.
+				</para></step>
+
+				<step><para>
+				Set the workgroup name on all clients to <constant>MIDEARTH</constant>.
+				</para></step>
+
+				<step><para>
+				<indexterm><secondary>logon</secondary></indexterm>
+				Install the <quote>Client for Microsoft Networks.</quote> Ensure that the only option
+				enabled in its properties is the option <quote>Logon and restore network connections.</quote>
+				</para></step>
+
+				<step><para>
+				Click <guibutton>OK</guibutton> when you are prompted to reboot the system. Reboot the
+				system, then log on using any username and password you choose.
+				</para></step>
+
+				<step><para>
+				<indexterm><primary>My Network Places</primary></indexterm>
+				Verify on each client that the machine called <constant>SERVER</constant>
+				is visible in <guimenu>My Network Places</guimenu>, that it is
+				possible to connect to it and see the share <guimenuitem>office</guimenuitem>,
+				and that it is possible to open that share to reveal its contents.
+				</para></step>
+
+				<step><para>
+				<indexterm><primary>password caching</primary></indexterm>
+				<indexterm><primary>regedit</primary></indexterm>
+				Disable password caching on all Windows 9x/Me machines using the registry change file
+				shown in <link linkend="MEreg"/>. Be sure to remove all files that have the
+				<filename>PWL</filename> extension that are in the <filename>C:\WINDOWS</filename>
+				directory.
+<example id="MEreg">
+<title>Windows Me &smbmdash; Registry Edit File: Disable Password Caching</title>
+<screen>
+REGEDIT4
+
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
+	Windows\CurrentVersion\Policies\Network]
+	"DisablePwdCaching"=dword:00000001
+</screen>
+</example>
+				The best way to apply this change is to save the patch in a file called 
+				<filename>ME-dpwc.reg</filename> and then execute:
+<screen>
+C:\WINDOWS: regedit ME-dpwc.reg
+</screen>
+				</para></step>
+
+				<step><para>
+				Instruct all users to log onto the workstation using a name and password of their own
+				choosing. The Samba server has been
+				configured to ignore the username and password given.
+				</para></step>
+
+				<step><para>
+				On each Windows Me workstation, configure a network drive mapping to drive <filename>G:</filename>
+				that redirects to the uniform naming convention (UNC) resource 
+				<filename>\\server\office</filename>. Make this a permanent drive connection:
+				</para>
+					<procedure>
+						<step><para>
+							<menuchoice>
+								Right-click <guimenu>My Network</guimenu>
+								<guimenuitem>Map Network Drive...</guimenuitem>
+							</menuchoice>
+						</para></step>
+
+						<step><para>
+						In the box labeled <quote>Drive:</quote>, type G.
+						</para></step>
+
+						<step><para>
+						In the box labeled <quote>Path:</quote>, enter 
+						<filename>\\server\officefiles</filename>.
+						</para></step>
+
+						<step><para>
+						Click <guimenuitem>Reconnect at logon</guimenuitem>.
+						Click <guibutton>OK</guibutton>.
+						</para></step>
+
+					</procedure>
+				</step>
+
+				<step><para>
+				On each workstation, install the FTM software following the
+				manufacturer's instructions.
+				</para>
+					<procedure>
+					<step><para>
+					During installation, you are prompted for the name of the Windows 98
+					server. Enter the name <constant>SERVER</constant>.
+					</para></step>
+					<step><para>
+					You are prompted for the name of the data share.
+					The prompt defaults to <constant>FTMFILES</constant>. Press enter to accept the default value.
+					</para></step>
+					<step><para>
+					You are now prompted for the print queue name. The default prompt is the name of
+					the server you entered (<constant>SERVER</constant> as follows:
+					<constant>\\SERVER\PRINTQ</constant>). Simply accept the default and press enter to
+					continue. The software now completes the installation.
+					</para></step>
+					</procedure>
+				</step>
+
+				<step><para>
+				Install an office automation software package of the customer's choice. Either Microsoft
+				Office 2003 Standard or OpenOffice 1.1.0 suffices for any functions the office may
+				need to perform. Repeat this on each workstation.
+				</para></step>
+
+				<step><para>
+				Install a printer on each workstation using the following steps:
+				</para>
+
+					<procedure>
+						<step><para>
+						Click <menuchoice>
+							<guimenu>Start</guimenu>
+							<guimenuitem>Settings</guimenuitem>
+							<guimenuitem>Printers</guimenuitem>
+							<guiicon>Add Printer</guiicon>
+							<guibutton>Next</guibutton>
+							</menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
+							Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
+						</para></step>
+
+						<step><para>
+						Click <guibutton>Next</guibutton>. In the Manufacturer: panel, select
+						<constant>HP</constant>. In the Printers: panel, select the printer called
+						<constant>HP LaserJet 5/5M Postscript</constant>. Click <guibutton>Next</guibutton>.
+						</para></step>
+
+						<step><para>
+						In the Available ports: panel, select <constant>FILE:</constant>. Accept the
+						default printer name by clicking <guibutton>Next</guibutton>. When asked,
+						<quote>Would you like to print a test page?</quote>, click
+						<guimenuitem>No</guimenuitem>. Click <guibutton>Finish</guibutton>.
+						</para></step>
+
+						<step><para>
+						You may be prompted for the name of a file to print to. If so, close the
+						dialog panel. Right-click <menuchoice>
+							<guiicon>HP LaserJet 5/5M Postscript</guiicon>
+							<guimenuitem>Properties</guimenuitem>
+							<guisubmenu>Details (Tab)</guisubmenu>
+							<guimenuitem>Add Port</guimenuitem>
+							</menuchoice>.
+						</para></step>
+
+						<step><para>
+						In the Network panel, enter the name of
+						the print queue on the Samba server as follows: <constant>\\SERVER\hplj5</constant>.
+						Click <menuchoice> 
+							<guibutton>OK</guibutton>
+							<guibutton>OK</guibutton>
+							</menuchoice> to complete the installation.
+						</para></step>
+
+						<step><para>
+						It is a good idea to test the functionality of the complete installation before
+						handing the newly configured network over to the Charity Administration Office
+						for production use.
+						</para></step>
+
+					</procedure>
+
+				</step>
+
+			</procedure>
+
+		</sect3>
+
+		<sect3>
+		<title>Validation</title>
+
+		<para>
+		Use the same validation process as was followed in <link linkend="validate1"/>.
+		</para>
+
+		</sect3>
+
+	</sect2>
+
+	<sect2 id="AccountingOffice">
+	<title>Accounting Office</title>
+
+	<para>
+	Abmas Accounting is a 40-year-old family-run business. There are nine permanent
+	computer users. The network clients were upgraded two years ago. All computers run Windows 2000
+	Professional. This year the server will be upgraded from an old Windows NT4 server (actually
+	running Windows NT4 Workstation, which worked fine for fewer than 10 users) that has
+	run in workgroup (standalone) mode, to a new Linux server running Samba.
+	</para>
+
+	<para>
+	The office does not want a Domain Server. Mr. Alan Meany wants to keep the Windows 2000 Professional
+	clients running as workgroup machines so that any staff member can take a machine home and keep 
+	working.  It has worked well so far, and your task is to replace the old server. All users have 
+	their own workstation logon (you configured it that way when the machines were installed). 
+	Mr. Meany wants the new system to operate the same way as the old Windows NT4 server &smbmdash; users 
+	cannot access each others' files, but he can access everyone's files. Each person's work files are 
+	in a separate share on the server. Users log on to their Windows workstation with their username 
+	and enter an assigned password; they do not need to enter a password when accessing their files 
+	on the server.
+	</para>
+
+	<para>
+	<indexterm><primary>Red Hat Linux</primary></indexterm>
+	The new server will run Red Hat Fedora Core2. You should install Samba-3.0.20 and 
+	copy all files from the old system to the new one. The existing Windows NT4 server has a parallel
+	port HP LaserJet 4 printer that is shared by all. The printer driver is installed on each
+	workstation. You must not change anything on the workstations. Mr. Meany gave instructions to
+	replace the server, <quote>but leave everything else alone to avoid staff unrest.</quote>
+	</para>
+
+	<para>
+	You have tried to educate Mr. Meany and found that he has no desire to understand networking.
+	He believes that Windows for Workgroups 3.11 was <quote>the best server Microsoft ever sold
+	</quote> and that Windows NT and 2000 are <quote>too fang-dangled complex!</quote>
+	</para>
+
+		<sect3>
+		<title>Dissection and Discussion</title>
+
+			<para>
+			<indexterm><primary>security</primary><secondary>user mode</secondary></indexterm>
+			The requirements of this network installation are not unusual. The staff are not interested in the
+			details of networking. Passwords are never changed. In this example solution, we demonstrate the use
+			of User Mode security in a simple context. Directories should be set SGID to ensure that members
+			of a common group can access the contents. Each user has his or her own share to which only they
+			can connect. Mr. Meany's share will be a top-level directory above the share point for each employee.
+			Mr. Meany is a member of the same group as his staff and can access their work files.
+			The well-used HP LaserJet 4 is available as a service called <constant>hplj</constant>.
+			</para>
+
+			<para>
+			You have finished configuring the new hardware and have just completed installation of Red Hat 
+			Fedora Core2. Roll up your sleeves and let's get to work.
+			</para>
+
+		</sect3>
+
+		<sect3 id="AcctgNet">
+		<title>Implementation</title>
+
+		<para>
+		The workstations have fixed IP addresses. The old server runs Windows NT4 Workstation, so it 
+		cannot be running as a WINS server. It is best that the new configuration preserves the same
+		configuration. The office does not use Internet access, so security really is not an issue.
+		</para>
+
+		<para>
+		The core information regarding the users, their passwords, the directory share point, and the
+		share name is given in <link linkend="acctingnet"/>. The overall network topology is shown in
+		<link linkend="acctingnet2"/>. All machines have been configured as indicated prior to the
+		start of Samba configuration. The following prescriptive steps may now commence.
+		</para>
+
+		<image id="acctingnet2">
+			<imagedescription>Accounting Office Network Topology</imagedescription>
+			<imagefile scale="85">AccountingNetwork</imagefile>
+		</image>
+
+		<table id="acctingnet">
+			<title>Accounting Office Network Information</title>
+			<tgroup cols="6">
+				<colspec align="left"/>
+				<colspec align="left"/>
+				<colspec align="left"/>
+				<colspec align="left"/>
+				<colspec align="left"/>
+				<colspec align="left"/>
+				<thead>
+					<row>
+						<entry>User</entry>
+						<entry>Login-ID</entry>
+						<entry>Password</entry>
+						<entry>Share Name</entry>
+						<entry>Directory</entry>
+						<entry>Wkst</entry>
+					</row>
+				</thead>
+				<tbody>
+					<row>
+						<entry>Alan Meany</entry>
+						<entry>alan</entry>
+						<entry>alm1961</entry>
+						<entry>alan</entry>
+						<entry>/data</entry>
+						<entry>PC1</entry>
+					</row>
+					<row>
+						<entry>James Meany</entry>
+						<entry>james</entry>
+						<entry>jimm1962</entry>
+						<entry>james</entry>
+						<entry>/data/james</entry>
+						<entry>PC2</entry>
+					</row>
+					<row>
+						<entry>Jeannie Meany</entry>
+						<entry>jeannie</entry>
+						<entry>jema1965</entry>
+						<entry>jeannie</entry>
+						<entry>/data/jeannie</entry>
+						<entry>PC3</entry>
+					</row>
+					<row>
+						<entry>Suzy Millicent</entry>
+						<entry>suzy</entry>
+						<entry>suzy1967</entry>
+						<entry>suzy</entry>
+						<entry>/data/suzy</entry>
+						<entry>PC4</entry>
+					</row>
+					<row>
+						<entry>Ursula Jenning</entry>
+						<entry>ujen</entry>
+						<entry>ujen1974</entry>
+						<entry>ursula</entry>
+						<entry>/data/ursula</entry>
+						<entry>PC5</entry>
+					</row>
+					<row>
+						<entry>Peter Pan</entry>
+						<entry>peter</entry>
+						<entry>pete1984</entry>
+						<entry>peter</entry>
+						<entry>/data/peter</entry>
+						<entry>PC6</entry>
+					</row>
+					<row>
+						<entry>Dale Roland</entry>
+						<entry>dale</entry>
+						<entry>dale1986</entry>
+						<entry>dale</entry>
+						<entry>/data/dale</entry>
+						<entry>PC7</entry>
+					</row>
+					<row>
+						<entry>Bertrand E Paoletti</entry>
+						<entry>eric</entry>
+						<entry>eric1993</entry>
+						<entry>eric</entry>
+						<entry>/data/eric</entry>
+						<entry>PC8</entry>
+					</row>
+					<row>
+						<entry>Russell Lewis</entry>
+						<entry>russ</entry>
+						<entry>russ2001</entry>
+						<entry>russell</entry>
+						<entry>/data/russell</entry>
+						<entry>PC9</entry>
+					</row>
+				</tbody>
+			</tgroup>
+		</table>
+
+<?latex \newpage ?>
+
+		<procedure>
+		<title>Migration from Windows NT4 Workstation System to Samba-3</title>
+
+	    <step><para><indexterm>
+		  <primary>migration</primary>
+		</indexterm>
+			Rename the old server from <constant>CASHPOOL</constant> to <constant>STABLE</constant>
+			by logging onto the console as the <constant>Administrator</constant>. Restart the machine
+			following system prompts.
+			</para></step>
+
+			<step><para>
+			Name the new server <constant>CASHPOOL</constant> using the standard configuration method.
+			Restart the machine following system prompts.
+			</para></step>
+
+			<step><para>
+			Install the latest Samba-3 binary Red Hat Linux RPM that is available from the
+			Samba FTP site.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>group account</primary></indexterm>
+			<indexterm><primary>groupadd</primary></indexterm>
+			Add a group account for the office to use. Execute the following:
+<screen>
+&rootprompt; groupadd accts
+</screen>
+			</para></step>
+
+			<step><para>
+			Install the &smb.conf; file shown<footnote><para>This example uses the 
+			<parameter>smbpasswd</parameter> file in an obtuse way, since the use of 
+			the <parameter>passdb backend</parameter> has not been specified in the &smb.conf; 
+			file. This means that you are depending on correct default behavior.</para></footnote> 
+			in <link linkend="acctconf"/>.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>useradd</primary></indexterm>
+			<indexterm><primary>passwd</primary></indexterm>
+			<indexterm><primary>smbpasswd</primary></indexterm>
+			For each user who uses this system (see <link linkend="acctingnet"/>),
+			execute the following:
+<screen>
+&rootprompt; useradd -m -G accts -c "Name of User" "LoginID"
+&rootprompt; passwd "LoginID"
+Changing password for user "LoginID"
+New Password: XXXXXXXXX	&lt;-- the password from the table
+Retype new password: XXXXXXXXX
+&rootprompt; smbpasswd -a "LoginID"
+New SMB password: XXXXXXXXX &lt;-- the password from the table
+Retype new SMB password: XXXXXXXXX
+Added user "LoginID"
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>data storage</primary></indexterm>
+			Create the directory structure for the file shares by executing the following:
+<screen>
+&rootprompt; mkdir -p /data
+&rootprompt; chown alan /data
+&rootprompt; for i in james suzy ursula peter dale eric jeannie russell
+> do
+> 	mkdir -p /data/$i
+> 	chown $i /data/$i
+> done
+&rootprompt; chgrp -R accts /data
+&rootprompt; chmod -R ug+rwxs,o-r+x /data
+</screen>
+			The data storage structure is now prepared for use.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>lpadmin</primary></indexterm>
+			Configure the CUPS Print Queues:
+<screen>
+&rootprompt; lpadmin -p hplj -v parallel:/dev/lp0 -E
+</screen>
+			This creates the necessary print queues with no assigned print filter.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>mime types</primary></indexterm>
+			<indexterm><primary>/etc/cups/mime.convs</primary></indexterm>
+			Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
+<screen>
+application/octet-stream     application/vnd.cups-raw      0     -
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>/etc/cups/mime.types</primary></indexterm>
+			<indexterm><primary>application/octet-stream</primary></indexterm>
+			Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
+<screen>
+application/octet-stream
+</screen>
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>starting samba</primary></indexterm>
+			Use the standard system tool to start Samba and CUPS to configure them to restart
+			automatically at every system reboot. For example,
+			</para>
+
+			<para>
+			<indexterm><primary>starting samba</primary></indexterm>
+			<indexterm><primary>startingCUPS</primary></indexterm>
+			<indexterm><primary>chkconfig</primary></indexterm>
+<screen>
+&rootprompt; chkconfig smb on
+&rootprompt; chkconfig cups on
+&rootprompt; /etc/rc.d/init.d/smb restart
+&rootprompt; /etc/rc.d/init.d/cups restart
+</screen>
+			</para></step>
+
+			<step><para>
+			On Alan's workstation, use Windows Explorer to migrate the files from the old server
+			to the new server. The new server should appear in the <guimenu>Network Neighborhood</guimenu>
+			with the name of the old server (<constant>CASHPOOL</constant>).
+			</para>
+
+				<procedure>
+
+					<step><para>
+					Log on to Alan's workstation as the user <constant>alan</constant>.
+					</para></step>
+
+					<step><para>
+					Launch a second instance of Windows Explorer and navigate to the share called
+					<guiicon>files</guiicon> on the server called <guimenu>STABLE</guimenu>.
+					</para></step>
+
+					<step><para>
+					Click in the right panel, and press <guimenu>Ctrl-A</guimenu> to select all files and
+					directories. Press <guimenu>Ctrl-C</guimenu> to instruct Windows that you wish to
+					copy all selected items.
+					</para></step>
+
+					<step><para>
+					Launch the Windows Explorer, and navigate to the share called <guiicon>files</guiicon>
+					on the server called <guimenu>CASHPOOL</guimenu>. Click in the right panel, and then press
+					<guimenu>Ctrl-V</guimenu> to commence the copying process.
+					</para></step>
+
+				</procedure>
+			</step>
+
+			<step><para>
+			Verify that the files are being copied correctly from the Windows NT4 machine to the Samba-3 server.
+			This is best done on the Samba-3 server. Check the contents of the directory tree under 
+			<filename>/data</filename> by executing the following command:
+<screen>
+&rootprompt; ls -aR /data
+</screen>
+			Make certain to check the ownership and permissions on all files. If in doubt, execute the following:
+<screen>
+&rootprompt; chown alan /data
+&rootprompt; for i in james suzy ursula peter dale eric jeannie russell
+> do
+> 	chown $i /data/$i
+> done
+&rootprompt; chgrp -R accts /data
+&rootprompt; chmod -R ug+rwxs,o-r+x /data
+</screen>
+			</para></step>
+
+			<step><para>
+			The migration of all data should now be complete. It is time to validate the installation.
+			For this, you should make sure all applications, including printing, work before asking the
+			customer to test drive the new network.
+			</para></step>
+
+		</procedure>
+
+<smbconfexample id="acctconf">
+<title>Accounting Office Network &smb.conf; Old Style Configuration File</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">BILLMORE</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="disable spoolss">Yes</smbconfoption>
+<smbconfoption name="show add printer wizard">No</smbconfoption>
+<smbconfoption name="printing">cups</smbconfoption>
+
+<smbconfsection name="[files]"/>
+<smbconfoption name="comment">Work area files</smbconfoption>
+<smbconfoption name="path">/data/%U</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[master]"/>
+<smbconfoption name="comment">Master work area files</smbconfoption>
+<smbconfoption name="path">/data</smbconfoption>
+<smbconfoption name="valid users">alan</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">Print Temporary Spool Configuration</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="use client driver">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+</smbconfexample>
+
+		</sect3>
+	</sect2>
+</sect1>
+
+<sect1>
+	<title>Questions and Answers</title>
+
+	<para>
+	The following questions and answers draw from the examples in this chapter.
+	Many design decisions are impacted by the configurations chosen. The intent
+	is to expose some of the hidden implications.
+	</para>
+
+	<qandaset defaultlabel="chap02qa">
+	<qandaentry>
+	<question>
+
+		<para>
+		What makes an anonymous Samba server more simple than a non-anonymous Samba server?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		In the anonymous server, the only account used is the <constant>guest</constant> account.
+		In a non-anonymous configuration, it is necessary to add real user accounts to both the
+		UNIX system and to the Samba configuration. Non-anonymous servers require additional
+		administration.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		How is the operation of the parameter <parameter>force user</parameter> different from
+		setting the root directory of the share SUID?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The parameter <parameter>force user</parameter> causes all operations on the share to assume the UID
+		of the forced user. The new default GID that applies is the primary GID of the forced user.
+		This gives all users of this resource the actual privilege of the forced user.
+		</para>
+
+		<para>
+		When a directory is set SUID, the operating system forces files that are written within it
+		to be owned by the owner of the directory. While this happens, the user who is using the share
+		has only the level of privilege he or she is assigned within the operating system context.
+		</para>
+
+		<para>
+		The parameter <parameter>force user</parameter> has potential security implications that go
+		beyond the actual share root directory. Be careful and wary of using this parameter.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		When would you both use the per share parameter <parameter>force user</parameter> and set
+		the share root directory SUID?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		You would use both parameters when it is necessary to guarantee that all share handling operations
+		are conducted as the forced user, while all file and directory creation are done as the SUID
+		directory owner.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What is better about CUPS printing than LPRng printing?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		CUPS is a print spooling system that has integrated remote management facilities, provides completely
+		automated print processing/preprocessing, and can be configured to automatically
+		apply print preprocessing filters to ensure that a print job submitted is correctly rendered for the
+		target printer. CUPS includes an image file RIP that supports printing of image files to 
+		non-PostScript printers. CUPS has lots of bells and whistles and is more like a supercharged MS Windows
+		NT/200x print monitor and processor. Its complexity can be eliminated or turbocharged to suit
+		any fancy.
+		</para>
+
+		<para>
+		The LPRng software is an enhanced, extended, and portable implementation of the Berkeley LPR print 
+		spooler functionality. It provides the same interface and meets RFC1179 requirements. LPRng can be
+		configured to act like CUPS, but it is in principle a replacement for the old Berkeley lpr/lpd
+		spooler. LPRng is generally preferred by those who are familiar with Berkeley lpr/lpd.
+		</para>
+
+		<para>
+		Which spooling system is better is a matter of personal taste. It depends on what you want to do and how you want to
+		do it and manage it. Most modern Linux systems ship with CUPS as the default print management system.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		When should Windows client IP addresses be hard-coded?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		When there are few MS Windows clients, little client change, no mobile users, and users are not
+		inclined to tamper with network settings, it is a safe and convenient matter to hard-code Windows
+		client TCP/IP settings. Given that it is possible to lock down the Windows desktop and remove
+		user ability to access network configuration controls, fixed configuration eliminates the need
+		for a DHCP server. This reduces maintenance overheads and eliminates a possible point of network
+		failure.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Under what circumstances is it best to use a DHCP server?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		In network configurations where there are mobile users, or where Windows client PCs move around
+		(particularly between offices or between subnets), it makes complete sense to control all Windows
+		client configurations using a DHCP server. Additionally, when users do tamper with the network
+		settings, DHCP can be used to normalize all client settings. 
+		</para>
+
+		<para>
+		One underappreciated benefit of using a DHCP server to assign all network client
+		device TCP/IP settings is that it makes it a pain-free process to change network TCP/IP
+		settings, change network addressing, or enhance the ability of client devices to
+		benefit from new network services.
+		</para>
+
+		<para>
+		Another benefit of modern DHCP servers is their ability to register dynamically
+		assigned IP addresses with the DNS server. The benefits of Dynamic DNS (DDNS) are considerable in 
+		a large Windows network environment.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What is the purpose of setting the parameter <parameter>guest ok</parameter> on a share?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		If this parameter is set to yes for a service, then no password is required to connect to the service.
+		Privileges are those of the guest account.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		When would you set the global parameter <parameter>disable spoolss</parameter>?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Setting this parameter to <constant>Yes</constant> disables Samba's support for the SPOOLSS set of 
+		MS-RPCs and yields behavior identical to Samba 2.0.x. Windows NT/2000 clients can downgrade to 
+		using LanMan style printing commands. Windows 9x/Me are unaffected by the parameter. However, this 
+		disables the ability to upload printer drivers to a Samba server via the Windows NT/200x Add Printer 
+		Wizard or by using the NT printer properties dialog window. It also disables the capability of 
+		Windows NT/200x clients to download print drivers from the Samba host on demand. Be extremely careful about 
+		setting this parameter.
+		</para>
+
+		<para>
+		The alternate parameter <parameter>use client driver</parameter> applies only to Windows NT/200x clients. It has no 
+		effect on Windows 95/98/Me clients. When serving a printer to Windows NT/200x clients without first installing a valid 
+		printer driver on the Samba host, the client is required to install a local printer driver. From this point on, 
+		the client treats the printer as a local printer and not a network printer connection. This is much the same behavior 
+		that occurs when <parameter>disable spoolss = yes</parameter>.
+		</para>
+
+		<para>
+		Under normal circumstances, the NT/200x client attempts to open the network printer using MS-RPC. Because the client 
+		considers the printer to be local, it attempts to issue the <parameter>OpenPrinterEx()</parameter> call requesting
+		access rights associated with the logged on user. If the user possesses local administrator rights but not root
+		privilege on the Samba host (often the case), the <parameter>OpenPrinterEx()</parameter> call fails. The result is
+		that the client now displays an <quote>Access Denied; Unable to connect</quote> message in the printer queue window
+		(even though jobs may be printed successfully). This parameter MUST not be enabled on a print share that has a valid
+		print driver installed on the Samba server.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why would you disable password caching on Windows 9x/Me clients?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Windows 9x/Me workstations that are set at default (password caching enabled) store the username and
+		password in files located in the Windows master directory. Such files can be scavenged (read off a client
+		machine) and decrypted, thus revealing the user's access credentials for all systems the user may have accessed.
+		It is most insecure to allow any Windows 9x/Me client to operate with password caching enabled.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		The example of Abmas Accounting uses User Mode security. How does this provide anonymous access?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The example used does not provide anonymous access. Since the clients are all Windows 2000 Professional,
+		and given that users are logging onto their machines, by default the client attempts to connect to
+		a remote server using currently logged in user credentials. By ensuring that the user's login ID and
+		password are the same as those set on the Samba server, access is transparent and does not require
+		separate user authentication.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	</qandaset>
+
+</sect1>
+
+</chapter>
+
diff --git a/docs/Samba3-ByExample/SBE-TheSmallOffice.xml b/docs/Samba3-ByExample/SBE-TheSmallOffice.xml
new file mode 100644
index 0000000000..8cb71820ed
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-TheSmallOffice.xml
@@ -0,0 +1,1256 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="small">
+  <title>Small Office Networking</title>
+
+	<para>
+	<link linkend="simple"/> focused on the basics of simple yet effective
+	network solutions. Network administrators who take pride in their work 
+	(that's most of us, right?) take care to deliver what our users want, 
+	but not too much more. If we make things too complex, we confound our users
+	and increase costs of network ownership. A professional network manager 
+	avoids the temptation to put too much pizazz into the way that the network 
+	operates. Some creativity is helpful, but keep it under control &smbmdash;
+	good advice that the following two scenarios illustrate.
+	</para>
+
+	<para>
+	<indexterm><primary>Netware</primary></indexterm>
+	In one case the network administrator of a mid-sized company spent three
+	months building a new network to replace an old Netware server. What he
+	delivered had all the bells and whistles he could muster. There were a
+	few teething problems during the changeover, nothing serious but a little
+	disruptive all the same. Users were exposed to many changes at once. The
+	network administrator was asked to resign two months after implementing
+	the new system because so many staff complained they had lost time and
+	were not happy with the new network.  Everything was automated, and he
+	delivered more features than any advanced user could think of. He was
+	just too smart for his own good.
+	</para>
+
+	<para>
+	In the case of the other company, a new network manager was appointed
+	to oversee the replacement of a LanTastic network with an MS Windows
+	NT 4.0 network. He had the replacement installed and operational within
+	two weeks. Before installation and changeover, he called a meeting to
+	explain to all users what was going to happen, how it would affect them,
+	and that he would be available 24 hours a day to help them transition.
+	One week after conversion, he held another meeting asking for cooperation
+	in the introduction of a few new features that would help to make life
+	easier. Network users were thrilled with the help he provided. The network
+	he implemented was nowhere near as complex as in the first example, had fewer
+	features, and yet he had happy users. Months later he was still adding
+	new innovations. He always asked the users if a
+	particular feature was what they wanted. He asked his boss for a raise
+	and got it. He often told me, <quote>Always keep a few new tricks up your
+	sleeves for when you need them.</quote> Was he smart? You decide. Let's
+	get on with our next exercise.
+	</para>
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>
+	Abmas Accounting has grown. Mr. Meany likes you and says he knew you
+	were the right person for the job. That's why he asked you to install the
+	new server. The past few months have been hard work. You advised Mr. Meany
+	that it is time for a change. Abmas now has 52 users, having acquired an
+	investment consulting business recently. The new users were added to the
+	network without any problems.
+	</para>
+
+	<para>
+	Some of the Windows clients are nearly past their use-by date. 
+	You found damaged and unusable software on some of the workstations
+	that came with the acquired business and found some machines 
+	in need of both hardware and software maintenance. 
+	</para>
+
+	<sect2>
+		<title>Assignment Tasks</title>
+
+		<para>
+		<indexterm><primary>Windows XP</primary></indexterm>
+		Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure
+		that the business is running efficiently. Many of the new staff want notebook
+		computers.  They visit customer business premises and need to use local network
+		facilities; these users are technically competent. The company uses a
+		business application that requires Windows XP Professional. In short, a complete
+		client upgrade is about to happen. Mr. Meany told you that he is working
+		on another business acquisition and that by the time he retires there will be
+		80 to 100 users.
+		</para>
+
+		<para>
+		Mr. Meany is not concerned about security. He wants to make it easier for
+		staff to do their work. He has hired you to help him appoint a full-time
+		network manager before he retires. Above all, he says he is investing in
+		the ability to grow. He is determined to live his lifelong dream and
+		hand the business over to a bright and capable executive who can make
+		things happen. This means your network design must cope well with
+		growth.
+		</para>
+
+		<para>
+		In a few months, Abmas will require an Internet connection for email and so
+		that staff can easily obtain software updates. Mr. Meany is warming up to
+		the installation of antivirus software but is not yet ready to approve
+		this expense. He told you to spend the money a virus scanner costs
+		on better quality notebook computers for mobile users.
+		</para>
+
+		<para>
+		One of Mr. Meany's golfing partners convinced him to buy new laser
+		printers, one black only, the other a color laser printer. Staff support
+		the need for a color printer so they can present more attractive proposals
+		and reports.
+		</para>
+
+		<para>
+		Mr. Meany also asked if it would be possible for one of the staff to manage
+		user accounts from the Windows desktop. That person will be responsible for
+		basic operations.
+		</para>
+
+	</sect2>
+</sect1>
+
+<sect1>
+	<title>Dissection and Discussion</title>
+
+	<para>
+	What are the key requirements in this business example? A quick review indicates
+	a need for
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		Scalability, from 52 to over 100 users in 12 months
+		</para></listitem>
+
+		<listitem><para>
+		Mobile computing capability
+		<indexterm><primary>mobile computing</primary></indexterm>
+		</para></listitem>
+
+		<listitem><para>
+		Improved reliability and usability
+		</para></listitem>
+
+		<listitem><para>
+		Easier administration
+		</para></listitem>
+	</itemizedlist>
+
+	<para>
+	In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server 
+	(as in <link linkend="AccountingOffice"/>).
+	
+	</para>
+	
+
+	<sect2>
+		<title>Technical Issues</title>
+
+		<para>
+		<indexterm><primary>smbpasswd</primary></indexterm>
+		<indexterm><primary>DHCP</primary></indexterm>
+		<indexterm><primary>DNS</primary></indexterm>
+		<indexterm><primary>WINS</primary></indexterm>
+		<indexterm><primary>Domain</primary></indexterm>
+		It is time to implement a domain security environment. You will use the <constant>
+		smbpasswd</constant> (default) backend. You should implement a DHCP server. There is no need to
+		run DNS at this time, but the system will use WINS. The domain name will be <constant>
+		BILLMORE</constant>. This time, the name of the server will be <constant>SLEETH</constant>.
+		</para>
+
+                <para>
+		All printers will be configured as DHCP clients. The DHCP server will assign 
+		the printer a fixed IP address by way of its Ethernet interface (MAC) address.
+		See <link linkend="dhcp01"/>.
+                </para>
+
+		<note><para>
+		The &smb.conf; file you are creating in this exercise can be used with equal effectiveness
+		with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is
+		possible to start with the installation that you have created here, migrate it
+		to a Samba-3 configuration, and then secure the system further. Configurations following
+		this one utilize features that may not be supported in Samba-2.2.x releases.
+		However, you should note that the examples in each chapter start with the assumption
+		that a fresh new installation is being effected.
+		</para></note>
+
+		<para>
+		Later on, when the Internet connection is implemented, you will add DNS as well as
+		other enhancements. It is important that you plan accordingly.
+		</para>
+
+		<para>
+		<indexterm><primary>Ethernet switch</primary></indexterm>
+		You have split the network into two separate areas. Each has its own Ethernet switch.
+		There are 20 users on the accounting network and 32 users on the financial services
+		network. The server has two network interfaces, one serving each network. The 
+		network printers will be located in a central area. You plan to install the new 
+		printers and keep the old printer in use also.
+		</para>
+
+		<para>
+		You will provide separate file storage areas for each business entity. The old system
+		will go away, accounting files will be handled under a single directory, and files will
+		be stored under customer name, not under a personal work area. Staff will be made
+		responsible for file location, so the old share point must be maintained.
+		</para>
+
+		<para>
+		Given that DNS will not be used, you will configure WINS name resolution for UNIX 
+		hostname name resolution.
+		</para>
+
+		<para>
+		<indexterm><primary>Domain</primary><secondary>groups</secondary></indexterm>
+		<indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
+		It is necessary to map Windows Domain Groups to UNIX groups. It is
+		advisable to also map Windows Local Groups to UNIX groups. Additionally, the two
+		key staff groups in the firm are accounting staff and financial services staff.
+		For these, it is necessary to create UNIX groups as well as Windows Domain Groups.
+		</para>
+
+		<para>
+		In the sample &smb.conf; file, you have configured Samba to call the UNIX
+		<command>groupadd</command> to add group entries. This utility does not permit
+		the addition of group names that contain uppercase characters or spaces. This
+		is considered a bug. The <command>groupadd</command> is part of the
+		<command>shadow-utils</command> open source software package.  A later release
+		of this package may have been patched to resolve this bug.  If your operating
+		platform has this bug, it means that attempts to add a Windows Domain Group that
+		has either a space or uppercase characters in it will fail. See
+		<emphasis>TOSHARG</emphasis>, Chapter 11, Section 11.3.1, Example 11.1, for
+		more information.
+		</para>
+
+		<para>
+		<indexterm><primary>CUPS</primary></indexterm>
+		Vendor-supplied printer drivers will be installed on each client. The CUPS print
+		spooler on the UNIX host will be operated in <constant>raw</constant> mode.
+		</para>
+
+	</sect2>
+
+	<sect2>
+		<title>Political Issues</title>
+
+		<para>
+		Mr. Meany is an old-school manager. He sets the rules and wants to see compliance.
+		He is willing to spend money on things he believes are of value. You need more
+		time to convince him of real priorities.
+		</para>
+
+		<para>
+		Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be
+		supplied with antivirus software? Above all, demonstrate good purchase value and remember
+		to make your users happy.
+		</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Implementation</title>
+
+	<para>
+	<indexterm><primary>migration</primary></indexterm>
+	In this example, the assumption is made that this server is being configured from a clean start.
+	The alternate approach could be to demonstrate the migration of the system that is documented
+	in <link linkend="AcctgNet"/> to meet the new requirements. The decision to treat this case, as with
+	future examples, as a new installation is based on the premise that you can determine
+	the migration steps from the information provided in <link linkend="ntmigration"/>.
+	Additionally, a fresh installation makes the example easier to follow.
+	</para>
+
+	<para>
+	<indexterm><primary>group membership</primary></indexterm>
+	Each user will be given a home directory on the UNIX system, which will be available as a private
+	share. Two additional shares will be created, one for the accounting department and the other for
+	the financial services department. Network users will be given access to these shares by way
+	of group membership.
+	</para>
+
+	<para>
+	<indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
+	UNIX group membership is the primary mechanism by which Windows Domain users will be granted
+	rights and privileges within the Windows environment.
+	</para>
+
+	<para>
+	<indexterm><primary>sticky bit</primary></indexterm>
+	The user <command>alanm</command> will be made the owner of all files. This will be preserved
+	by setting the sticky bit (set UID/GID) on the top-level directories.
+	</para>
+
+	<image id="acct2net">
+		<imagedescription>Abmas Accounting &smbmdash; 52-User Network Topology</imagedescription>
+		<imagefile scale="100">acct2net</imagefile>
+	</image>
+
+	<procedure>
+	<title>Server Installation Steps</title>
+
+		<step><para>
+		Using UNIX/Linux system tools, name the server <constant>sleeth</constant>.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/hosts</primary></indexterm>
+		Place an entry for the machine <constant>sleeth</constant> in the <filename>/etc/hosts</filename>.
+		The printers are network attached, so there should be entries for the
+		network printers also. An example <filename>/etc/hosts</filename> file is shown here:
+<screen>
+192.168.1.1     sleeth sleeth1
+192.168.2.1     sleeth2
+192.168.1.10    hplj6
+192.168.1.11    hplj4
+192.168.2.10    qms
+</screen>
+		</para></step>
+
+		<step><para>
+		Install the Samba-3 binary RPM from the Samba-Team FTP site.
+		</para></step>
+
+		<step><para>
+		Install the ISC DHCP server using the UNIX/Linux system tools available to you.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/rc.d/rc.local</primary></indexterm>
+		<indexterm><primary>IP forwarding</primary></indexterm>
+		<indexterm><primary>router</primary></indexterm>
+		<indexterm><primary>/proc/sys/net/ipv4/ip_forward</primary></indexterm>
+		Because Samba will be operating over two network interfaces and clients on each side
+		may want to be able to reach clients on the other side, it is imperative that IP forwarding
+		is enabled. Use the system tool of your choice to enable IP forwarding. In the
+		absence of such a tool on the Linux system, add to the <filename>/etc/rc.d/rc.local</filename>
+		file an entry as follows:
+<screen>
+echo 1 > /proc/sys/net/ipv4/ip_forward
+</screen>
+		This causes the Linux kernel to forward IP packets so that it acts as a router.
+		</para></step>
+
+		<step><para>
+		Install the &smb.conf; file as shown in <link linkend="acct2conf"/> and 
+		<link linkend="acct3conf"/>. Combine these two examples to form a single
+		<filename>/etc/samba/smb.conf</filename> file.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>smbpasswd</primary></indexterm>
+		Add the user <command>root</command> to the Samba password backend:
+<screen>
+&rootprompt; smbpasswd -a root
+New SMB password: XXXXXXX
+Retype new SMB password: XXXXXXX
+&rootprompt;
+</screen>
+		<indexterm><primary>administrator</primary></indexterm>
+		This is the Windows Domain Administrator password. Never delete this account from
+		the password backend after Windows Domain Groups have been initialized. If you delete
+		this account, your system is crippled. You cannot restore this account,
+		and your Samba server can no longer be administered.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>username map</primary></indexterm>
+		Create the username map file to permit the <constant>root</constant> account to be called 
+		<constant>Administrator</constant> from the Windows network environment. To do this, create
+		the file <filename>/etc/samba/smbusers</filename> with the following contents:
+<screen>
+####
+# User mapping file
+####
+# File Format
+# -----------
+# Unix_ID = Windows_ID
+#
+# Examples:
+# root = Administrator
+# janes = "Jane Smith"
+# jimbo = Jim Bones
+#
+# Note: If the name contains a space it must be double quoted.
+#       In the example above the name 'jimbo' will be mapped to Windows
+#       user names 'Jim' and 'Bones' because the space was not quoted.
+#######################################################################
+root = Administrator
+####
+# End of File
+####
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>initGrps.sh</primary></indexterm>
+		Create and map Windows Domain Groups to UNIX groups. A sample script is provided in
+		<link linkend="initGrps"/>. Create a file containing this script. We called ours 
+		<filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed,
+		and then execute the script. Sample output should be as follows:
+
+<example id="initGrps">
+<title>Script to Map Windows NT Groups to UNIX Groups</title>
+<indexterm><primary>initGrps.sh</primary></indexterm>
+<screen>
+#!/bin/bash
+#
+# initGrps.sh
+#
+
+# Create UNIX groups
+groupadd acctsdep
+groupadd finsrvcs
+
+# Map Windows Domain Groups to UNIX groups
+net groupmap modify ntgroup="Domain Admins"  unixgroup=root
+net groupmap modify ntgroup="Domain Users"   unixgroup=users
+net groupmap modify ntgroup="Domain Guests"  unixgroup=nobody
+
+# Add Functional Domain Groups
+net groupmap add ntgroup="Accounts Dept"  unixgroup=acctsdep type=d
+net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
+</screen>
+</example>
+
+<screen>
+&rootprompt; chmod 755 initGrps.sh
+&rootprompt; cd /etc/samba 
+&rootprompt; ./initGrps.sh
+Updated mapping entry for Domain Admins
+Updated mapping entry for Domain Users
+Updated mapping entry for Domain Guests
+No rid or sid specified, choosing algorithmic mapping
+Successfully added group Accounts Dept to the mapping db
+No rid or sid specified, choosing algorithmic mapping
+Successfully added group Domain Guests to the mapping db
+
+&rootprompt; cd /etc/samba 
+&rootprompt; net groupmap list | sort
+Account Operators (S-1-5-32-548) -> -1
+Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep
+Administrators (S-1-5-32-544) -> -1
+Backup Operators (S-1-5-32-551) -> -1
+Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root
+Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody
+Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users
+Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs
+Guests (S-1-5-32-546) -> -1
+Power Users (S-1-5-32-547) -> -1
+Print Operators (S-1-5-32-550) -> -1
+Replicators (S-1-5-32-552) -> -1
+System Operators (S-1-5-32-549) -> -1
+Users (S-1-5-32-545) -> -1
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/passwd</primary></indexterm>
+		<indexterm><primary>password</primary><secondary>backend</secondary></indexterm>
+		<indexterm><primary>smbpasswd</primary></indexterm>
+		For each user who needs to be given a Windows Domain account, make an entry in the
+		<filename>/etc/passwd</filename> file as well as in the Samba password backend.
+		Use the system tool of your choice to create the UNIX system accounts, and use the Samba
+		<command>smbpasswd</command> program to create the Domain user accounts.
+		</para>
+
+		<para>
+		<indexterm><primary>useradd</primary></indexterm>
+		<indexterm><primary>adduser</primary></indexterm>
+		<indexterm><primary>user</primary><secondary>management</secondary></indexterm>
+		There are a number of tools for user management under UNIX, such as
+		<command>useradd</command> and <command>adduser</command>, as well as a plethora of custom
+		tools. With the tool of your choice, create a home directory for each user.
+		</para></step>
+
+		<step><para>
+		Using the preferred tool for your UNIX system, add each user to the UNIX groups created
+		previously, as necessary. File system access control will be based on UNIX group membership.
+		</para></step>
+
+		<step><para>
+		Create the directory mount point for the disk subsystem that is mounted to provide
+		data storage for company files. In this case the mount point is indicated in the &smb.conf;
+		file is <filename>/data</filename>. Format the file system as required, mount the formatted
+		file system partition using <command>mount</command>, 
+		and make the appropriate changes in <filename>/etc/fstab</filename>.
+		</para></step>
+
+		<step><para>
+		Create the top-level file storage directories are follows:
+<screen>
+&rootprompt; mkdir -p /data/{accounts,finsvcs}
+&rootprompt; chown -R root:root /data
+&rootprompt; chown -R alanm:accounts /data/accounts
+&rootprompt; chown -R alanm:finsvcs /data/finsvcs
+&rootprompt; chmod -R ug+rwx,o+rx-w /data
+</screen>
+		Each department is responsible for creating its own directory structure within its
+		share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>.
+		The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>.
+		</para></step>
+
+		<step><para>
+		Configure the printers with the IP addresses as shown in <link linkend="acct2net"/>.
+		Follow the instructions in the manufacturers' manuals to permit printing to port 9100.
+		This allows the CUPS spooler to print using raw mode protocols.
+		<indexterm><primary>CUPS</primary></indexterm>
+		<indexterm><primary>raw printing</primary></indexterm>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm>
+		<indexterm><primary>lpadmin</primary></indexterm>
+		Configure the CUPS Print Queues as follows:
+<screen>
+&rootprompt; lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E
+&rootprompt; lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E
+&rootprompt; lpadmin -p qms -v socket://192.168.2.10:9100 -E
+</screen>
+		<indexterm><primary>print filter</primary></indexterm>
+		This creates the necessary print queues with no assigned print filter.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>mime type</primary></indexterm>
+		<indexterm><primary>/etc/mime.convs</primary></indexterm>
+		<indexterm><primary>application/octet-stream</primary></indexterm>
+		Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
+<screen>
+application/octet-stream     application/vnd.cups-raw      0     -
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>/etc/mime.types</primary></indexterm>
+		Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
+<screen>
+application/octet-stream
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>DHCP Server</primary></indexterm>
+		Using your favorite system editor, create an <filename>/etc/dhcpd.conf</filename> with the
+		contents as shown in <link linkend="dhcp01"/>.
+<example id="dhcp01">
+<title>Abmas Accounting DHCP Server Configuration File &smbmdash; <filename>/etc/dhcpd.conf</filename></title>
+<indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
+<screen>
+default-lease-time 86400;
+max-lease-time 172800;
+default-lease-time 86400;
+
+option ntp-servers 192.168.1.1;
+option domain-name "abmas.biz";
+option domain-name-servers 192.168.1.1, 192.168.2.1;
+option netbios-name-servers 192.168.1.1, 192.168.2.1;
+option netbios-node-type 8;
+### NOTE ###
+# netbios-node-type=8 means set clients to Hybrid Mode
+#   so they will use Unicast communication with the WINS
+#   server and thus reduce the level of UDP broadcast
+#   traffic by up to 90%.
+############
+
+subnet 192.168.1.0 netmask 255.255.255.0 {
+	range dynamic-bootp 192.168.1.128 192.168.1.254;
+	option subnet-mask 255.255.255.0;
+	option routers 192.168.1.1;
+	allow unknown-clients;
+	host hplj4 {
+		hardware ethernet 08:00:46:7a:35:e4;
+		fixed-address 192.168.1.10;
+		}
+	host hplj6 {
+		hardware ethernet 00:03:47:cb:81:e0;
+		fixed-address 192.168.1.11;
+		}
+	}
+subnet 192.168.2.0 netmask 255.255.255.0 {
+	range dynamic-bootp 192.168.2.128 192.168.2.254;
+	option subnet-mask 255.255.255.0;
+	option routers 192.168.2.1;
+	allow unknown-clients;
+	host qms {
+		hardware ethernet 01:04:31:db:e1:c0;
+		fixed-address 192.168.1.10;
+		}
+	}
+subnet 127.0.0.0 netmask 255.0.0.0 {
+	}
+</screen>
+</example>
+		</para></step>
+
+
+		<step><para>
+		Use the standard system tool to start Samba and CUPS and configure them to start
+		automatically at every system reboot. For example,
+		</para>
+
+		<para>
+		<indexterm><primary>chkconfig</primary></indexterm>
+		<indexterm><primary>starting dhcpd</primary></indexterm>
+		<indexterm><primary>starting samba</primary></indexterm>
+		<indexterm><primary>starting CUPS</primary></indexterm>
+		<indexterm><primary>chkconfig</primary></indexterm>
+<screen>
+&rootprompt; chkconfig dhcp on
+&rootprompt; chkconfig smb on
+&rootprompt; chkconfig cups on
+&rootprompt; /etc/rc.d/init.d/dhcp restart
+&rootprompt; /etc/rc.d/init.d/smb restart
+&rootprompt; /etc/rc.d/init.d/cups restart
+</screen>
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>name service switch</primary></indexterm>
+		<indexterm><primary>NSS</primary><see>same service switch</see></indexterm>
+		<indexterm><primary>DNS</primary></indexterm>
+		<indexterm><primary>DNS server</primary></indexterm>
+		<indexterm><primary>WINS</primary></indexterm>
+		<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
+		Configure the name service switch (NSS) to handle WINS-based name resolution.
+		Since this system does not use a DNS server, it is safe to remove this option from
+		the NSS configuration. Edit the <filename>/etc/nsswitch.conf</filename> file so that
+		the <constant>hosts:</constant> entry looks like this:
+<screen>
+hosts:	files wins
+</screen>
+		</para></step>
+
+	</procedure>
+
+<smbconfexample id="acct2conf">
+<title>Accounting Office Network &smb.conf; File &smbmdash; [globals] Section</title>
+<smbconfcomment>Global parameters</smbconfcomment>
+<smbconfsection name="[global]"/>
+<smbconfoption name="workgroup">BILLMORE</smbconfoption>
+<smbconfoption name="passwd chat"> </smbconfoption>
+<member><parameter>*New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</parameter></member>
+<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
+<smbconfoption name="syslog">0</smbconfoption>
+<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
+<smbconfoption name="printcap name">CUPS</smbconfoption>
+<smbconfoption name="show add printer wizard">No</smbconfoption>
+<smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption>
+<smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption>
+<smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
+<smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption>
+<smbconfoption name="add user to group script">/usr/sbin/usermod -G '%g' '%u'</smbconfoption>
+<smbconfoption name="add machine script"> </smbconfoption>
+<member><parameter>/usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</parameter></member>
+<smbconfoption name="logon script">scripts\login.bat</smbconfoption>
+<smbconfoption name="logon path"> </smbconfoption>
+<smbconfoption name="logon drive">X:</smbconfoption>
+<smbconfoption name="domain logons">Yes</smbconfoption>
+<smbconfoption name="preferred master">Yes</smbconfoption>
+<smbconfoption name="wins support">Yes</smbconfoption>
+<smbconfoption name="printing">CUPS</smbconfoption>
+</smbconfexample>
+
+<smbconfexample id="acct3conf">
+<title>Accounting Office Network &smb.conf; File &smbmdash; Services and Shares Section</title>
+<smbconfsection name="[homes]"/>
+<smbconfoption name="comment">Home Directories</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[printers]"/>
+<smbconfoption name="comment">SMB Print Spool</smbconfoption>
+<smbconfoption name="path">/var/spool/samba</smbconfoption>
+<smbconfoption name="printable">Yes</smbconfoption>
+<smbconfoption name="guest ok">Yes</smbconfoption>
+<smbconfoption name="use client driver">Yes</smbconfoption>
+<smbconfoption name="browseable">No</smbconfoption>
+
+<smbconfsection name="[netlogon]"/>
+<smbconfoption name="comment">Network Logon Service</smbconfoption>
+<smbconfoption name="path">/data/%U</smbconfoption>
+<smbconfoption name="valid users">%S</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[accounts]"/>
+<smbconfoption name="comment">Accounting Files</smbconfoption>
+<smbconfoption name="path">/data/accounts</smbconfoption>
+<smbconfoption name="valid users">%G</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+
+<smbconfsection name="[finsvcs]"/>
+<smbconfoption name="comment">Financial Service Files</smbconfoption>
+<smbconfoption name="path">/data/finsvcs</smbconfoption>
+<smbconfoption name="valid users">%G</smbconfoption>
+<smbconfoption name="read only">No</smbconfoption>
+</smbconfexample>
+
+		<sect2>
+		<title>Validation</title>
+
+		<para>
+		Does everything function as it ought? That is the key question at this point.
+		Here are some simple steps to validate your Samba server configuration.
+		</para>
+
+		<procedure>
+		<title>Validation Steps</title>
+
+			<step><para>
+			<indexterm><primary>testparm</primary></indexterm>
+			If your &smb.conf; file has bogus options or parameters, this may cause Samba
+			to refuse to start. The first step should always be to validate the contents
+			of this file by running:
+<screen>
+&rootprompt; testparm -s
+Load smb config files from smb.conf
+Processing section "[homes]"
+Processing section "[printers]"
+Processing section "[netlogon]"
+Processing section "[accounts]"
+Processing section "[service]"
+Loaded services file OK.
+# Global parameters
+[global]
+        workgroup = BILLMORE
+        passwd chat = *New*Password* \
+		%n\n *Re-enter*new*password* %n\n *Password*changed*
+        username map = /etc/samba/smbusers
+        syslog = 0
+        name resolve order = wins bcast hosts
+        printcap name = CUPS
+        show add printer wizard = No
+        add user script = /usr/sbin/useradd -m '%u'
+        delete user script = /usr/sbin/userdel -r '%u'
+        add group script = /usr/sbin/groupadd '%g'
+        delete group script = /usr/sbin/groupdel '%g'
+        add user to group script = /usr/sbin/usermod -G '%g' '%u'
+        add machine script = /usr/sbin/useradd 
+				-s /bin/false -d /var/lib/nobody '%u'
+        logon script = scripts\logon.bat
+        logon path =
+        logon drive = X:
+        domain logons = Yes
+        preferred master = Yes
+        wins support = Yes
+...
+### Remainder cut to save space ###
+</screen>
+			The inclusion of an invalid parameter (say one called dogbert) would generate an
+			error as follows:
+<screen>
+Unknown parameter encountered: "dogbert"
+Ignoring unknown parameter "dogbert"
+</screen>
+			Clear away all errors before proceeding, and start or restart samba as necessary.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>check samba daemons</primary></indexterm>
+			<indexterm><primary>nmbd</primary></indexterm>
+			<indexterm><primary>smbd</primary></indexterm>
+			<indexterm><primary>winbindd</primary></indexterm>
+			Check that the Samba server is running:
+<screen>
+&rootprompt; ps ax | grep mbd
+14244 ?        S      0:00 /usr/sbin/nmbd -D
+14245 ?        S      0:00 /usr/sbin/nmbd -D
+14290 ?        S      0:00 /usr/sbin/smbd -D
+
+$rootprompt; ps ax | grep winbind
+14293 ?        S     0:00 /usr/sbin/winbindd -B
+14295 ?        S     0:00 /usr/sbin/winbindd -B
+</screen>
+			The <command>winbindd</command> daemon is running in split mode (normal), so there are also
+			two instances of it. For more information regarding <command>winbindd</command>, see <emphasis>TOSHARG</emphasis>,
+			Chapter 23, Section 23.3. The single instance of <command>smbd</command> is normal.
+			</para></step>
+	
+			<step><para>
+			<indexterm><primary>anonymous connection</primary></indexterm>
+			Check that an anonymous connection can be made to the Samba server:
+<screen>
+&rootprompt; smbclient -L localhost -U%
+
+        Sharename      Type      Comment
+        ---------      ----      -------
+        netlogon       Disk      Network Logon Service
+        accounts       Disk      Accounting Files
+        finsvcs        Disk      Financial Service Files
+        IPC$           IPC       IPC Service (Samba3)
+        ADMIN$         IPC       IPC Service (Samba3)
+        hplj4          Printer   Hewlett-Packard LaserJet 4
+        hplj6          Printer   Hewlett-Packard LaserJet 6
+        qms            Printer   QMS Magicolor Laser Printer XXXX
+
+        Server               Comment
+        ---------            -------
+        SLEETH               Samba 3.0.20
+
+        Workgroup            Master
+        ---------            -------
+        BILLMORE             SLEETH
+</screen>
+			This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
+			of browsing the server from a Windows client to obtain a list of shares on the server.
+			The <constant>-U%</constant> argument means to send a <constant>NULL</constant> username and
+			a <constant>NULL</constant> password.
+			</para></step>
+
+			<step><para>
+			<indexterm><primary>dhcp client validation</primary></indexterm>
+			<indexterm><primary>printer validation</primary></indexterm>
+			<indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
+			Verify that the printers have the IP addresses assigned in the DHCP server configuration file.
+			The easiest way to do this is to ping the printer name. Immediately after the ping response
+			has been received, execute <command>arp -a</command> to find the MAC address of the printer
+			that has responded. Now you can compare the IP address and the MAC address of the printer
+			with the configuration information in the <filename>/etc/dhcpd.conf</filename> file. They
+			should, of course, match. For example,
+<screen>
+&rootprompt; ping hplj4
+PING hplj4 (192.168.1.11) 56(84) bytes of data.
+64 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms
+
+&rootprompt; arp -a
+hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0
+</screen>
+			The MAC address <constant>08:00:46:7A:35:E4</constant> matches that specified for the
+			IP address from which the printer has responded and the entry for it in the
+			<filename>/etc/dhcpd.conf</filename> file.
+			</para></step>
+	
+			<step><para>
+			<indexterm><primary>authenticated connection</primary></indexterm>
+			Make an authenticated connection to the server using the <command>smbclient</command> tool:
+<screen>
+&rootprompt; smbclient //sleeth/accounts -U alanm
+Password: XXXXXXX
+smb: \&gt; dir
+  .                          D        0  Sun Nov  9 01:28:34 2003
+  ..                         D        0  Sat Aug 16 17:24:26 2003
+  .mc                       DH        0  Sat Nov  8 21:57:38 2003
+  .qt                       DH        0  Fri Sep  5 00:48:25 2003
+  SMB                        D        0  Sun Oct 19 23:04:30 2003
+  Documents                  D        0  Sat Nov  1 00:31:51 2003
+  xpsp1a_en_x86.exe           131170400  Sun Nov  2 01:25:44 2003
+
+           65387 blocks of size 65536. 28590 blocks available
+smb: \> q
+</screen>
+			</para></step>
+	
+		</procedure>
+
+		</sect2>
+
+
+	<procedure>
+	<title>Windows XP Professional Client Configuration</title>
+
+		<step><para>
+		Configure clients to the network settings shown in <link linkend="acct2net"/>.
+		All clients use DHCP for TCP/IP protocol stack configuration.
+		<indexterm><primary>WINS</primary></indexterm>
+		<indexterm><primary>DHCP</primary></indexterm>
+		DHCP configures all Windows clients to use the WINS Server address <constant>192.168.1.1</constant>.
+		</para></step>
+
+		<step><para>
+		Join the Windows Domain called <constant>BILLMORE</constant>. Use the Domain Administrator
+		username <constant>root</constant> and the SMB password you assigned to this account.
+		A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
+		a Windows Domain is given in Appendix A, <link linkend="domjoin"/>. 
+		Reboot the machine as prompted and then log on using a Domain User account.
+		</para></step>
+
+		<step><para>
+		Verify on each client that the machine called <constant>SLEETH</constant>
+		is visible in <guimenu>My Network Places</guimenu>, that it is
+		possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>
+		 and <guimenuitem>finsvcs</guimenuitem>,
+		and that it is possible to open that share to reveal its contents.
+		</para></step>
+
+		<step><para>
+		Instruct all users to log onto the workstation using their assigned username and password.
+		</para></step>
+
+		<step><para>
+		Install a printer on each using the following steps:
+		</para>
+
+			<procedure>
+				<step><para>
+				Click <menuchoice>
+					<guimenu>Start</guimenu>
+					<guimenuitem>Settings</guimenuitem>
+					<guimenuitem>Printers</guimenuitem>
+					<guiicon>Add Printer</guiicon>
+					<guibutton>Next</guibutton>
+					</menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
+					Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
+				</para></step>
+
+				<step><para>
+				Click <guibutton>Next</guibutton>. In the
+				<guimenuitem>Manufacturer:</guimenuitem> panel, select <constant>HP</constant>.
+				In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
+				<constant>HP LaserJet 4</constant>. Click <guibutton>Next</guibutton>.
+				</para></step>
+
+				<step><para>
+				In the <guimenuitem>Available ports:</guimenuitem> panel, select
+				<constant>FILE:</constant>. Accept the default printer name by clicking
+				<guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
+				test page?</quote>, click <guimenuitem>No</guimenuitem>. Click
+				<guibutton>Finish</guibutton>.
+				</para></step>
+
+				<step><para>
+				You may be prompted for the name of a file to print to. If so, close the
+				dialog panel. Right-click <menuchoice>
+					<guiicon>HP LaserJet 4</guiicon>
+					<guimenuitem>Properties</guimenuitem>
+					<guisubmenu>Details (Tab)</guisubmenu>
+					<guimenuitem>Add Port</guimenuitem>
+					</menuchoice>.
+				</para></step>
+
+				<step><para>
+				In the <guimenuitem>Network</guimenuitem> panel, enter the name of
+				the print queue on the Samba server as follows: <constant>\\SERVER\hplj4</constant>.
+				Click <menuchoice> 
+					<guibutton>OK</guibutton>
+					<guibutton>OK</guibutton>
+					</menuchoice> to complete the installation.
+				</para></step>
+
+				<step><para>
+				Repeat the printer installation steps above for the HP LaserJet 6 printer
+				as well as for the QMS Magicolor XXXX laser printer.
+				</para></step>
+			</procedure>
+		</step>
+	</procedure>
+
+	<sect2>
+	<title>Notebook Computers: A Special Case</title>
+
+	<para>
+	As a network administrator, you already know how to create local machine accounts for Windows 200x/XP
+	Professional systems. This is the preferred solution to provide continuity of work for notebook users
+	so that absence from the office network environment does not become a barrier to productivity.
+	</para>
+
+	<para>
+	By creating a local machine account that has the same username and password as you create for that
+	user in the Windows Domain environment, the user can log onto the machine locally and still
+	transparently access network resources as if logged onto the domain itself. There are some trade-offs
+	that mean that as the network is more tightly secured, it becomes necessary to modify Windows client
+	configuration somewhat.
+	</para>
+
+	</sect2>
+
+	<sect2>
+		<title>Key Points Learned</title>
+
+		<para>
+		In this network design and implementation exercise, you created a Windows NT4-style Domain
+		Controller using Samba-3.0.20. Following these guidelines, you experienced
+		and implemented several important aspects of Windows networking. In the next chapter,
+		you build on the experience. These are the highlights from this chapter:
+		</para>
+
+		<itemizedlist>
+			<listitem><para>
+			<indexterm><primary>DHCP</primary></indexterm>
+			You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary
+			network configuration settings from this server.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>Domain Controller</primary></indexterm>
+			You created a Windows Domain Controller. You were able to use the network logon service
+			and successfully joined Windows 200x/XP Professional clients to the Domain.
+			</para></listitem>
+
+			<listitem><para>
+			<indexterm><primary>CUPS</primary></indexterm>
+			You created raw print queues in the CUPS printing system. You maintained a simple
+			printing system so that all users can share centrally managed printers. You installed
+			native printer drivers on the Windows clients.
+			</para></listitem>
+
+			<listitem><para>
+			You experienced the benefits of centrally managed user accounts on the server.
+			</para></listitem>
+
+			<listitem><para>
+			You offered Mobile notebook users a solution that allows them to continue to work
+			while away from the office and not connected to the corporate network.
+			</para></listitem>
+		</itemizedlist>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+	<title>Questions and Answers</title>
+
+	<para>
+	Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that
+	may help.
+	</para>
+
+	<qandaset>
+	<qandaentry>
+	<question>
+
+		<para>
+		What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		First and foremost, portability. It means that notebook users can move between
+		the Abmas office and client offices (so long as they, too, use DHCP) without having to manually
+		reconfigure their machines. It also means that when they work from their home environments
+		either using DHCP assigned addressing or when using dial-up networking, settings such as
+		default routes and DNS server addresses that apply only to the Abmas office environment do
+		not interfere with remote operations. This is an extremely important feature of DHCP.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Are there any DHCP server configuration parameters in the <filename>/etc/dhcpd.conf</filename>
+		that should be noted in particular?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Yes. The configuration you created automatically provides each client with the IP address
+		of your WINS server. It also configures the client to preferentially register NetBIOS names
+		with the WINS server, and then instructs the client to first query the WINS server when a
+		NetBIOS machine name needs to be resolved to an IP Address. This configuration
+		results in far lower UDP broadcast traffic than would be the case if WINS was not used.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Is it possible to create a Windows Domain account that is specifically called <constant>Administrator</constant>?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		You can surely create a Windows Domain account called <constant>Administrator</constant>. It is also
+		possible to map that account so that it has the effective UNIX UID of 0. This way it isn't
+		necessary to use the <parameter>username map</parameter> facility to map this account to the UNIX
+		account called <constant>root</constant>.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why is it necessary to give the Windows Domain <constant>Administrator</constant> a UNIX UID of 0?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The Windows Domain <constant>Administrator</constant> account is the most privileged account that
+		exists on the Windows platform. This user can change any setting, add, delete, or modify user
+		accounts, and completely reconfigure the system. The equivalent to this account in the UNIX
+		environment is the <constant>root</constant> account. If you want to permit the Windows Domain
+		Administrator to manage accounts as well as permissions, privileges, and security
+		settings within the Domain and on the Samba server, equivalent rights must be assigned. This is
+		achieved with the <constant>root</constant> UID equal to 0.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
+		<constant>root</constant> access. How can we do this?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Users who are members of the <constant>Domain Admins</constant> group can add machines to the
+		Domain. This group is mapped to the UNIX group account called <constant>root</constant>
+		(or the equivalent <constant>wheel</constant> on some UNIX systems) that has a GID of 0.
+		This must be the primary GID of the account of the user who is a member of the Windows <constant>
+		Domain Admins</constant> account.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		Why must I map Windows Domain Groups to UNIX groups?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
+		has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are
+		<guimenu>Domain Guests</guimenu>, <guimenu>Domain Users</guimenu>, and <guimenu>Domain Admins</guimenu>.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		I deleted my <constant>root</constant> account and now I cannot add it back! What can I do?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		This is a nasty problem. Fortunately, there is a solution. 
+		</para>
+
+		<procedure>
+			<step><para>
+			Back up your existing configuration files in case you need to restore them.
+			</para></step>
+
+			<step><para>
+			Rename the <filename>group_mapping.tdb</filename> file. 
+			</para></step>
+
+			<step><para>
+			Use the <command>smbpasswd</command> to add the root account.
+			</para></step>
+
+			<step><para>
+			Restore the <filename>group_mapping.tdb</filename> file.
+			</para></step>
+		</procedure>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		When I run <command>net groupmap list</command>, it reports a group called <guimenu>Administrators</guimenu>
+		as well as <guimenu>Domain Admins</guimenu>. What is the difference between them?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		The group called <guimenu>Administrators</guimenu> is representative of the same account that would be
+		present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain 
+		Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This
+		may change at some later date. These accounts are provided only so that security objects are correctly shown.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		What is the effect of changing the name of a Samba server or of changing the Domain name?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		If you elect to change the name of the Samba server, on restarting <command>smbd</command>,
+		Windows security identifiers are changed. In the case of a standalone server or a Domain Member server,
+		the machine SID is changed. This may break Domain membership. In the case of a change of the Domain name
+		(Workgroup name), the Domain SID is changed. This affects all Domain memberships.
+		</para>
+
+		<para>
+		If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective
+		SID before the change is made. You can back up the SID using the <command>net getlocalsid</command> (Samba-3)
+		or the <command>smbpasswd</command> (Samba-2.2.x). To change the SID, you use the same tool. Be sure
+		to check the man page for this command for detailed instructions regarding the steps involved.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	<qandaentry>
+	<question>
+
+		<para>
+		How can I manage user accounts from my Windows XP Professional workstation?
+		</para>
+
+	</question>
+	<answer>
+
+		<para>
+		Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot
+		be managed using tools present on a Windows XP Professional installation. You may download from the
+		Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use
+		it. This package extracts the tools: <command>User Manager for Domains</command>, <command>Server Manager</command>, and <command>Event
+		Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba-3
+		Domain user and group accounts. Of course, you do need to be logged on as the <constant>Administrator</constant>
+		for the Samba-3 Domain. It may help to log on as the <constant>root</constant> account.
+		</para>
+
+	</answer>
+	</qandaentry>
+
+	</qandaset>
+
+</sect1>
+
+</chapter>
+
diff --git a/docs/Samba3-ByExample/SBE-UpgradingSamba.xml b/docs/Samba3-ByExample/SBE-UpgradingSamba.xml
new file mode 100644
index 0000000000..1bc1f1f7ed
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-UpgradingSamba.xml
@@ -0,0 +1,1311 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<chapter id="upgrades">
+<title>Updating Samba-3</title>
+
+<para>
+<indexterm><primary>migrate</primary></indexterm>
+<indexterm><primary>install</primary></indexterm>
+It was a little difficult to select an appropriate title for this chapter.
+From email messages on the Samba mailing lists it is clear that many people
+consider the updating and upgrading of Samba to be a migration matter. Others
+talk about migrating Samba servers when in fact the issue at hand is one of
+installing a new Samba server to replace an older existing Samba server.
+</para>
+
+<para>
+<indexterm><primary>smbpasswd</primary></indexterm>
+<indexterm><primary>passdb backend</primary></indexterm>
+There has also been much talk about migration of Samba-3 from an smbpasswd
+passdb backend to the use of the tdbsam or ldapsam facilities that are new
+to Samba-3.
+</para>
+
+<para>
+Clearly, there is not a great deal of clarity in the terminology that various
+people apply to these modes by which Samba servers are updated. This is further 
+highlighted by an email posting that included the following neat remark:
+</para>
+
+<blockquote><para>
+<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>vampire</tertiary></indexterm>
+I like the <quote>net rpc vampire</quote> on NT4, but that to my surprise does
+not seem to work against a Samba PDC and, if addressed in the Samba to Samba
+context in either book, I could not find it.
+</para></blockquote>
+
+<para>
+<indexterm><primary>contributions</primary></indexterm>
+So in response to the significant request for these situations to be better 
+documented, this chapter has now been added. User contributions and documentation
+of real-world experiences are a most welcome addition to this chapter.
+</para>
+
+<sect1>
+<title>Introduction</title>
+
+<para>
+<indexterm><primary>update</primary></indexterm>
+<indexterm><primary>upgrade</primary></indexterm>
+<indexterm><primary>frustration</primary></indexterm>
+A Windows network administrator explained in an email what changes he was
+planning to make and followed with the question: <quote>Anyone done this
+before?</quote> Many of us have upgraded and updated Samba without incident.
+Others have experienced much pain and user frustration. So it is to be hoped
+that the notes in this chapter will make a positive difference by assuring
+that someone will be saved a lot of discomfort.
+</para>
+
+<para>
+Before anyone commences an upgrade or an update of Samba, the one cardinal
+rule that must be observed is: Backup all Samba configuration files in
+case it is necessary to revert to the old version. Even if you do not like
+this precautionary step, users will punish an administrator who
+fails to take adequate steps to avoid situations that may inflict lost
+productivity on them.
+</para>
+
+<warning><para>
+<indexterm><primary>configuration files</primary></indexterm>
+<indexterm><primary>down-grade</primary></indexterm>
+Samba makes it possible to upgrade and update configuration files, but it
+is not possible to downgrade the configuration files. Please ensure that
+all configuration and control files are backed up to permit a down-grade
+in the rare event that this may be necessary.
+</para></warning>
+
+
+<para>
+<indexterm><primary>adequate precautions</primary></indexterm>
+<indexterm><primary>precaution</primary></indexterm>
+It is prudent also to backup all data files on the server before attempting
+to perform a major upgrade. Many administrators have experienced the consequences
+of failure to take adequate precautions. So what is adequate? That is simple!
+If data is lost during an upgrade or update and it can not be restored,
+the precautions taken were inadequate. If a backup was not needed, but was available,
+caution was on the side of the victor.
+</para>
+
+	<sect2>
+	<title>Cautions and Notes</title>
+
+	<para>
+	Someone once said, <quote>It is good to be sorry, but better never to need to be!</quote>
+	These are wise words of advice to those contemplating a Samba upgrade or update.
+	</para>
+
+	<para>
+	<indexterm><primary>update</primary></indexterm>
+	<indexterm><primary>upgrade</primary></indexterm>
+	<indexterm><primary>generation</primary></indexterm>
+	This is as good a time as any to define the terms <constant>upgrade</constant> and
+	<constant>update</constant>. The term <constant>upgrade</constant> refers to
+	the installation of a version of Samba that is a whole generation or more ahead of
+	that which is installed. Generations are indicated by the first digit of the version
+	number. So far Samba has been released in generations 1.x, 2.x, 3.x, and currently 4.0
+	is in development.
+	</para>
+
+	<para>
+	<indexterm><primary>generation</primary></indexterm>
+	The term <constant>update</constant> refers to a minor version number installation
+	in place of one of the same generation. For example, updating from Samba 3.0.10 to 3.0.14
+	is an update. The move from Samba 2.0.7 to 3.0.14 is an upgrade.
+	</para>
+
+	<para>
+	<indexterm><primary>functional differences</primary></indexterm>
+	While the use of these terms is an exercise in semantics, what needs to be realized
+	is that there are major functional differences between a Samba 2.x release and a Samba
+	3.0.x release. Such differences may require a significantly different approach to
+	solving the same networking challenge and generally require careful review of the
+	latest documentation to identify precisely how the new installation may need to be
+	modified to preserve prior functionality.
+	</para>
+
+	<para>
+	There is an old axiom that says, <quote>The greater the volume of the documentation,
+	the greater the risk that noone will read it, but where there is no documentation,
+	noone can read it!</quote> While true, some documentation is an evil necessity.
+	It is hoped that this update to the documentation will avoid both extremes.
+	</para>
+
+	<sect3>
+	<title>Security Identifiers (SIDs)</title>
+
+	<para>
+	<indexterm><primary>Windows</primary><secondary>NT</secondary></indexterm>
+	<indexterm><primary>OS/2</primary></indexterm>
+	<indexterm><primary>DOS</primary></indexterm>
+	<indexterm><primary>SID</primary></indexterm>
+	<indexterm><primary>networking</primary><secondary>client</secondary></indexterm>
+	<indexterm><primary>security</primary><secondary>identifier</secondary></indexterm>
+	Before the days of Windows NT and OS/2, every Windows and DOS networking client
+	that used the SMB protocols was an entirely autonomous entity. There was no concept
+	of a security identifier for a machine or a user outside of the username, the
+	machine name, and the workgroup name. In actual fact, these were not security identifiers
+	in the same context as the way that the SID is used since the development of
+	Windows NT 3.10.
+	</para>
+
+	<para>
+	<indexterm><primary>SessionSetUpAndX</primary></indexterm>
+	<indexterm><primary>SMB</primary></indexterm>
+	<indexterm><primary>CIFS</primary></indexterm>
+	<indexterm><primary>SID</primary></indexterm>
+	<indexterm><primary>username</primary></indexterm>
+	<indexterm><primary>Windows</primary><secondary>client</secondary></indexterm>
+	Versions of Samba prior to 1.9 did not make use of a SID. Instead they make exclusive use
+	of the username that is embedded in the SessionSetUpAndX component of the connection
+	setup process between a Windows client and an SMB/CIFS server. 
+	</para>
+
+	<para>
+	<indexterm><primary>MACHINE.SID</primary></indexterm>
+	<indexterm><primary>rpc</primary></indexterm>
+	<indexterm><primary>security</primary></indexterm>
+	Around November 1997 support was added to Samba-1.9 to handle the Windows security
+	RPC-based protocols that implemented support for Samba to store a machine SID. This
+	information was stored in a file called <filename>MACHINE.SID.</filename>
+	</para>
+
+	<para>
+	<indexterm><primary>machine</primary></indexterm>
+	<indexterm><primary>SID</primary></indexterm>
+	<indexterm><primary>secrets.tdb</primary></indexterm>
+	Within the lifetime of the early Samba 2.x series, the machine SID information was
+	relocated into a tdb file called <filename>secrets.tdb</filename>, which is where
+	it is still located in Samba 3.0.x along with other information that pertains to the
+	local machine and its role within a domain security context.
+	</para>
+
+	<para>
+	<indexterm><primary>server</primary><secondary>stand-alone</secondary></indexterm>
+	<indexterm><primary>server</primary><secondary>domain member</secondary></indexterm>
+	<indexterm><primary>DMS</primary></indexterm>
+	<indexterm><primary>SAS</primary></indexterm>
+	There are two types of SID, those pertaining to the machine itself and the domain to
+	which it may belong, and those pertaining to users and groups within the security
+	context of the local machine, in the case of standalone servers (SAS) and domain member
+	servers (DMS).
+	</para>
+
+	<para>
+	<indexterm><primary>smbd</primary></indexterm>
+	<indexterm><primary>workgroup</primary></indexterm>
+	<indexterm><primary>hostname</primary></indexterm>
+	<indexterm><primary>daemon</primary></indexterm>
+	<indexterm><primary>SID</primary></indexterm>
+	<indexterm><primary>secrets.tdb</primary></indexterm>
+	When the Samba <command>smbd</command> daemon is first started, if the <filename>secrets.tdb</filename>
+	file does not exist, it is created at the first client connection attempt. If this file does
+	exist, <command>smbd</command> checks that there is a machine SID (if it is a domain controller,
+	it searches for the domain SID). If <command>smbd</command> does not find one for the current
+	name of the machine or for the current name of the workgroup, a new SID will be generated and
+	then written to the <filename>secrets.tdb</filename> file. The SID is generated in a nondeterminative
+	manner. This means that each time it is generated for a particular combination of machine name
+	(hostname) and domain name (workgroup), it will be different.
+	</para>
+
+	<para>
+	<indexterm><primary>ACL</primary></indexterm>
+	The SID is the key used by MS Windows networking for all networking operations. This means
+	that when the machine or domain SID changes, all security-encoded objects such as profiles
+	and ACLs may become unusable.
+	</para>
+
+	<note><para>
+	It is of paramount importance that the machine and domain SID be backed up so that in
+	the event of a change of hostname (machine name) or domain name (workgroup) the SID can
+	be restored to its previous value.
+	</para></note>
+
+	<para>
+	<indexterm><primary>domain controller</primary></indexterm>
+	<indexterm><primary>PDC</primary></indexterm>
+	<indexterm><primary>BDC</primary></indexterm>
+	<indexterm><primary>domain SID</primary></indexterm>
+	<indexterm><primary>hostname</primary></indexterm>
+	<indexterm><primary>computer name</primary></indexterm>
+	<indexterm><primary>netbios name</primary></indexterm>
+	<indexterm><primary>stand-alone server</primary></indexterm>
+	<indexterm><primary>SAS</primary></indexterm>
+	<indexterm><primary>SID</primary></indexterm>
+	In Samba-3 on a domain controller (PDC or BDC), the domain name controls the domain
+	SID. On all prior versions the hostname (computer name, or NetBIOS name) controlled
+	the SID. On a standalone server the hostname still controls the SID.
+	</para>
+
+	<para>
+	<indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm>
+	<indexterm><primary>net</primary><secondary>setlocalsid</secondary></indexterm>
+	The local machine SID can be backed up using this procedure (Samba-3):
+<screen>
+&rootprompt; net getlocalsid > /etc/samba/my-local-SID
+</screen>
+	The contents of the file <filename>/etc/samba/my-local-SID</filename> will be:
+<screen>
+SID for domain FRODO is: S-1-5-21-726309263-4128913605-1168186429
+</screen>
+	This SID can be restored by executing:
+<screen>
+&rootprompt; net setlocalsid S-1-5-21-726309263-4128913605-1168186429
+</screen>
+	</para>
+
+	<para>
+	Samba 1.9.x stored the machine SID in the the file <filename>/etc/MACHINE.SID</filename>
+	from which it could be recovered and stored into the <filename>secrets.tdb</filename> file
+	using the procedure shown above.
+	</para>
+
+	<para>
+	Where the <filename>secrets.tdb</filename> file exists and a version of Samba 2.x or later
+	has been used, there is no specific need to go through this update process. Samba-3 has the
+	ability to read the older tdb file and to perform an in-situ update to the latest tdb format.
+	This is not a reversible process &smbmdash; it is a one-way upgrade.
+	</para>
+
+	<para>
+	<indexterm><primary>smbpasswd</primary></indexterm>
+	In the course of the Samba 2.0.x series the <command>smbpasswd</command> was modified to
+	permit the domain SID to be captured to the <filename>secrets.tdb</filename> file by executing:
+<screen>
+&rootprompt; smbpasswd -S PDC -Uadministrator%password
+</screen>
+	</para>
+
+	<para>
+	The release of the Samba 2.2.x series permitted the SID to be obtained by executing:
+<screen>
+&rootprompt; smbpasswd -S PDC -Uadministrator%password
+</screen>
+	from which the SID could be copied to a file and then written to the Samba-2.2.x
+	<filename>secrets.tdb</filename> file by executing:
+<screen>
+&rootprompt; smbpasswd -W S-1-5-21-726309263-4128913605-1168186429
+</screen>
+	</para>
+
+	<para>
+	<indexterm><primary>rpcclient</primary></indexterm>
+	<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>info</tertiary></indexterm>
+	Domain security information, which includes the domain SID, can be obtained from Samba-2.2.x
+	systems by executing:
+<screen>
+&rootprompt; rpcclient lsaquery -Uroot%password
+</screen>
+	This can also be done with Samba-3 by executing:
+<screen>
+&rootprompt; net rpc info -Uroot%password
+Domain Name: MIDEARTH
+Domain SID: S-1-5-21-726309263-4128913605-1168186429
+Sequence number: 1113415916
+Num users: 4237
+Num domain groups: 86
+Num local groups: 0
+</screen>
+	It is a very good practice to store this SID information in a safely kept file, just in
+	case it is ever needed at a later date.
+	</para>
+
+	<para>
+	<indexterm><primary>passdb backend</primary></indexterm>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>SID</primary></indexterm>
+	Take note that the domain SID is used extensively in Samba. Where LDAP is used for the
+	<parameter>passdb backend</parameter>, all user, group, and trust accounts are encoded
+	with the domain SID. This means that if the domain SID changes for any reason, the entire
+	Samba environment can become broken and require extensive corrective action if the 
+	original SID cannot be restored. Fortunately, it can be recovered from a dump of the
+	LDAP database. A dump of the LDAP directory database can be obtained by executing:
+<screen>
+&rootprompt; slapcat -v -l filename.ldif
+</screen>
+	</para>
+
+	<para>
+	<indexterm><primary>SID</primary></indexterm>
+	<indexterm><primary>profiles</primary></indexterm>
+	<indexterm><primary>RPM</primary></indexterm>
+	When the domain SID has changed, roaming profiles cease to be functional. The recovery
+	of roaming profiles necessitates resetting of the domain portion of the user SID
+	that owns the profile. This is encoded in the <filename>NTUser.DAT</filename> and can be
+	updated using the Samba <command>profiles</command> utility. Please be aware that not all
+	Linux distributions of the Samba RPMs include this essential utility. Please do not
+	complain to the Samba Team if this utility is missing; that issue that must be
+	addressed to the creator of the RPM package. The Samba Team do their best to make
+	available all the tools needed to manage a Samba-based Windows networking environment.
+	</para>
+
+	</sect3>
+
+	<sect3>
+	<title>Change of hostname</title>
+
+	<para>
+	<indexterm><primary>netbios</primary><secondary>machine  name</secondary></indexterm>
+	<indexterm><primary>netbios name</primary></indexterm>
+	Samba uses two methods by which the primary NetBIOS machine name (also known as a computer
+	name or the hostname) may be determined: If the &smb.conf; file contains a
+	<parameter>netbios name</parameter> entry, its value will be used directly. In the absence
+	of such an entry, the UNIX system hostname will be used.
+	</para>
+
+	<para>
+	Many sites have become victims of lost Samba functionality because the UNIX system
+	hostname was changed for one reason or another. Such a change will cause a new machine
+	SID to be generated. If this happens on a domain controller, it will also change the
+	domain SID. These SIDs can be updated (restored) using the procedure outlined previously.
+	</para>
+
+	<note><para>
+	Do NOT change the hostname or the <parameter>netbios name</parameter>. If this
+	is changed, be sure to reset the machine SID to the original setting. Otherwise
+	there may be serious interoperability and/or operational problems.
+	</para></note>
+
+	</sect3>
+
+	<sect3>
+	<title>Change of Workgroup (Domain) Name</title>
+
+	<para>
+	<indexterm><primary>workgroup</primary></indexterm>
+	The domain name of a Samba server is identical to the workgroup name and is
+	set in the &smb.conf; file using the <parameter>workgroup</parameter> parameter.
+	This has been consistent throughout the history of Samba and across all versions.
+	</para>
+
+	<para>
+	<indexterm><primary>SID</primary></indexterm>
+	Be aware that when the workgroup name is changed, a new SID will be generated.
+	The old domain SID can be reset using the procedure outlined earlier in this chapter.
+	</para>
+
+	</sect3>
+
+	<sect3 id="sbeug1">
+	<title>Location of config files</title>
+
+	<para>
+	The Samba-Team has maintained a constant default location for all Samba control files
+	throughout the life of the project. People who have produced binary packages of Samba
+	have varied the location of the Samba control files. This has led to some confusion
+	for network administrators.
+	</para>
+
+	<para>
+	<indexterm><primary>directory</primary></indexterm>
+	The Samba 1.9.x &smb.conf; file may be found either in the <filename>/etc</filename>
+	directory or in <filename>/usr/local/samba/lib</filename>.
+	</para>
+
+	<para>
+	During the life of the Samba 2.x release, the &smb.conf; file was relocated
+	on Linux systems to the <filename>/etc/samba</filename> directory where it
+	remains located also for Samba 3.0.x installations.
+	</para>
+
+	<para>
+	<indexterm><primary>secrets.tdb</primary></indexterm>
+	Samba 2.x introduced the <filename>secrets.tdb</filename> file that is also stored in the
+	<filename>/etc/samba</filename> directory, or in the <filename>/usr/local/samba/lib</filename>
+	directory subsystem.
+	</para>
+
+	<para>
+	<indexterm><primary>smbd</primary></indexterm>
+	The location at which <command>smbd</command> expects to find all configuration and control
+	files is determined at the time of compilation of Samba. For versions of Samba prior to
+	3.0, one way to find the expected location of these files is to execute:
+<screen>
+&rootprompt; strings /usr/sbin/smbd | grep conf
+&rootprompt; strings /usr/sbin/smbd | grep secret
+&rootprompt; strings /usr/sbin/smbd | grep smbpasswd
+</screen>
+	Note: The <command>smbd</command> executable may be located in the path
+	<filename>/usr/local/samba/sbin</filename>.
+	</para>
+
+	<para>
+	<indexterm><primary>compile-time</primary></indexterm>
+	Samba-3 provides a neat new way to track the location of all control files as well as to
+	find the compile-time options used as the Samba package was built. Here  is how the dark
+	secrets of the internals of the location of control files within Samba executables can
+	be uncovered:
+<screen>
+&rootprompt; smbd -b | less
+Build environment:
+   Built by:    root@frodo
+   Built on:    Mon Apr 11 20:23:27 MDT 2005
+   Built using: gcc
+   Build host:  Linux frodo 2.6...
+   SRCDIR:      /usr/src/packages/BUILD/samba-3.0.20/source
+   BUILDDIR:    /usr/src/packages/BUILD/samba-3.0.20/source
+
+Paths:
+   SBINDIR: /usr/sbin
+   BINDIR: /usr/bin
+   SWATDIR: /usr/share/samba/swat
+   CONFIGFILE: /etc/samba/smb.conf
+   LOGFILEBASE: /var/log/samba
+   LMHOSTSFILE: /etc/samba/lmhosts
+   LIBDIR: /usr/lib/samba
+   SHLIBEXT: so
+   LOCKDIR: /var/lib/samba
+   PIDDIR: /var/run/samba
+   SMB_PASSWD_FILE: /etc/samba/smbpasswd
+   PRIVATE_DIR: /etc/samba
+ ... 
+</screen>
+	</para>
+
+	<para>
+	<indexterm><primary></primary></indexterm>
+	It is important that both the &smb.conf; file and the <filename>secrets.tdb</filename>
+	be backed up before attempting any upgrade. The <filename>secrets.tdb</filename> file
+	is version-encoded, and therefore a newer version may not work with an older version
+	of Samba. A backup means that it is always possible to revert a failed or problematic
+	upgrade.
+	</para>
+
+	</sect3>
+
+	<sect3>
+	<title>International Language Support</title>
+
+	<para>
+	<indexterm><primary>unicode</primary></indexterm>
+	<indexterm><primary>character set</primary></indexterm>
+	<indexterm><primary>codepage</primary></indexterm>
+	<indexterm><primary>internationalization</primary></indexterm>
+	Samba-2.x had no support for Unicode; instead, all national language character-set support in file names
+	was done using particular locale codepage mapping techniques. Samba-3 supports Unicode in file names, thus
+	providing true internationalization support.
+	</para>
+
+	<para>
+	<indexterm><primary>8-bit</primary></indexterm>
+	Non-English users whose national language character set has special characters and who upgrade naively will 
+	find that many files that have the special characters in the file name will see them garbled and jumbled up.
+	This typically happens with umlauts and accents because these characters were particular to the codepage
+	that was in use with Samba-2.x using an 8-bit encoding scheme.
+	</para>
+
+	<para>
+	<indexterm><primary>UTF-8</primary></indexterm>
+	Files that are created with Samba-3 will use UTF-8 encoding. Should the file system ever end up with a
+	mix of codepage (unix charset)-encoded file names and UTF-8-encoded file names, the mess will take some
+	effort to set straight.
+	</para>
+
+	<para>
+	<indexterm><primary>convmv</primary></indexterm>
+	A very helpful tool is available from Bjorn Jacke's <ulink url="http://j3e.de/linux/convmv/">convmv</ulink>
+	work. Convmv is a tool that can be used to convert file and directory names from one encoding method to
+	another. The most common use for this tool is to convert locale-encoded files to UTF-8 Unicode encoding.
+	</para>
+
+	</sect3>
+
+	<sect3>
+	<title>Updates and Changes in Idealx smbldap-tools</title>
+
+	<para>
+	The smbldap-tools have been maturing rapidly over the past year. With maturation comes change.
+	The location of the <filename>smbldap.conf</filename> and the <filename>smbldap_bind.conf</filename>
+	configuration files have been moved from the directory <filename>/etc/smbldap-tools</filename> to
+	the new location of <filename>/etc/opt/IDEALX/smblda-tools</filename> directory.
+	</para>
+
+	<para>
+	The smbldap-tools maintains an entry in the LDAP directory in which it stores the next
+	values that should be used for UID and GID allocation for POSIX accounts that are created
+	using this tool. The DIT location of these values has changed recently. The original
+	<constant>sambaUnixIdPooldn object</constant> entity was stored in a directory entry (DIT object)
+	called <constant>NextFreeUnixId</constant>, this has been changed to the DIT object
+	<constant>sambaDomainName</constant>. Anyone who updates from an older version to the
+	current release should note that the information stored under <constant>NextFreeUnixId</constant>
+	must now be relocated to the DIT object <constant>sambaDomainName</constant>.
+	</para>
+
+	</sect3>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+<title>Upgrading from Samba 1.x and 2.x to Samba-3</title>
+
+<para>
+Sites that are being upgraded from Samba-2 (or earlier versions) to Samba-3
+may experience little difficulty or may require a lot of effort, depending
+on the complexity of the configuration. Samba-1.9.x upgrades to Samba-3 will
+generally be simple and straightforward, although no upgrade should be
+attempted without proper planning and preparation.
+</para>
+
+<para>
+There are two basic modes of use of Samba versions prior to Samba-3. The first
+does not use LDAP, the other does. Samba-1.9.x did not provide LDAP support.
+Samba-2.x could be compiled with LDAP support.
+</para>
+
+	<sect2 id="sbeug2">
+	<title>Samba 1.9.x and 2.x Versions Without LDAP</title>
+
+	<para>
+	Where it is necessary to upgrade an old Samba installation to Samba-3,
+	the following procedure can be followed:
+	</para>
+
+	<procedure>
+	<title>Upgrading from a Pre-Samba-3 Version</title>
+
+		<step><para>
+		<indexterm><primary>winbindd</primary></indexterm>
+		<indexterm><primary>smbd</primary></indexterm>
+		<indexterm><primary>nmbd</primary></indexterm>
+		Stop Samba. This can be done using the appropriate system tool
+		that is particular for each operating system or by executing the
+		<command>kill</command> command on <command>smbd</command>,
+		<command>nmbd</command>, and <command>winbindd</command>.
+		</para></step>
+
+		<step><para>
+		Find the location of the Samba &smb.conf; file and back it up to a
+		safe location.
+		</para></step>
+
+		<step><para>
+		Find the location of the <filename>smbpasswd</filename> file and
+		back it up to a safe location.
+		</para></step>
+
+		<step><para>
+		Find the location of the <filename>secrets.tdb</filename> file and
+		back it up to a safe location.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>lock directory</primary></indexterm>
+		<indexterm><primary>/usr/local/samba/var/locks</primary></indexterm>
+		<indexterm><primary>/var/cache/samba</primary></indexterm>
+		<indexterm><primary>/var/lib/samba</primary></indexterm>
+		Find the location of the lock directory. This is the directory
+		in which Samba stores all its tdb control files. The default
+		location used by the Samba Team is in
+		<filename>/usr/local/samba/var/locks</filename> directory,
+		but on Linux systems the old location was under the
+		<filename>/var/cache/samba</filename> directory. However, the
+		Linux Standards Base specified location is now under the
+		<filename>/var/lib/samba</filename> directory. Copy all the
+		tdb files to a safe location.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>RPM</primary></indexterm>
+		It is now safe to upgrade the Samba installation. On Linux systems
+		it is not necessary to remove the Samba RPMs because a simple
+		upgrade installation will automatically remove the old files.
+		</para>
+
+		<para>
+		On systems that do not support a reliable package management system
+		it is advisable either to delete the Samba old installation or to
+		move it out of the way by renaming the directories that contain the
+		Samba binary files.
+		</para></step>
+
+		<step><para>
+		When the Samba upgrade has been installed, the first step that should
+		be completed is to identify the new target locations for the control
+		files. Follow the steps shown in <link linkend="sbeug1"/> to locate
+		the correct directories to which each control file must be moved.
+		</para></step>
+
+		<step><para>
+		Do not change the hostname.
+		</para></step>
+
+		<step><para>
+		Do not change the workgroup name.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>testparm</primary></indexterm>
+		Execute the <command>testparm</command> to validate the &smb.conf; file.
+		This process will flag any parameters that are no longer supported.
+		It will also flag configuration settings that may be in conflict.
+		</para>
+
+		<para>
+		One solution that may be used to clean up and to update the &smb.conf;
+		file involves renaming it to <filename>smb.conf.master</filename> and 
+		then executing the following:
+<screen>
+&rootprompt; cd /etc/samba
+&rootprompt; testparm -s smb.conf.master &gt; smb.conf
+</screen>
+	<indexterm><primary>stripped</primary></indexterm>
+		The resulting &smb.conf; file will be stripped of all comments
+		and of all nonconforming configuration settings.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>winbindd</primary></indexterm>
+		It is now safe to start Samba using the appropriate system tool.
+		Alternately, it is possible to just execute <command>nmbd</command>,
+		<command>smbd</command>, and <command>winbindd</command> for the command
+		line while logged in as the root user.
+		</para></step>
+
+	</procedure>
+
+	</sect2>
+
+	<sect2>
+	<title>Applicable to All Samba 2.x to Samba-3 Upgrades</title>
+
+	<para>
+	<indexterm><primary>PDC</primary></indexterm>
+	<indexterm><primary>domain controller</primary></indexterm>
+	<indexterm><primary>inter-domain</primary></indexterm>
+	Samba 2.x servers that were running as a domain controller (PDC)
+	require changes to the configuration of the scripting interface
+	tools that Samba uses to perform OS updates for
+	users, groups, and trust accounts (machines and interdomain).
+	</para>
+
+	<para>
+	<indexterm><primary>parameters</primary></indexterm>
+	The following parameters are new to Samba-3 and should be correctly configured.
+	Please refer to <link linkend="secure"/> through <link linkend="2000users"/>
+	in this book for examples of use of the new parameters shown here:
+	<indexterm><primary>add group script</primary></indexterm>
+	<indexterm><primary>add machine script</primary></indexterm>
+	<indexterm><primary>add user to group script</primary></indexterm>
+	<indexterm><primary>delete group script</primary></indexterm>
+	<indexterm><primary>delete user from group script</primary></indexterm>
+	<indexterm><primary>set primary group script</primary></indexterm>
+	<indexterm><primary>passdb backend</primary></indexterm>
+	</para>
+
+	<para>
+	<simplelist>
+		<member><para>add group script</para></member>
+		<member><para>add machine script</para></member>
+		<member><para>add user to group script</para></member>
+		<member><para>delete group script</para></member>
+		<member><para>delete user from group script</para></member>
+		<member><para>passdb backend</para></member>
+		<member><para>set primary group script</para></member>
+		</simplelist>
+	</para>
+
+	<para>
+	<indexterm><primary>add machine script</primary></indexterm>
+	<indexterm><primary>add user script</primary></indexterm>
+	The <parameter>add machine script</parameter> functionality was previously
+	handled by the <parameter>add user script</parameter>, which in Samba-3 is
+	used exclusively to add user accounts.
+	</para>
+
+	<para>
+	<indexterm><primary>passdb backend</primary></indexterm>
+	<indexterm><primary>smbpasswd</primary></indexterm>
+	<indexterm><primary>tdbsam</primary></indexterm>
+	<indexterm><primary>useradd</primary></indexterm>
+	<indexterm><primary>usermod</primary></indexterm>
+	<indexterm><primary>userdel</primary></indexterm>
+	<indexterm><primary>groupadd</primary></indexterm>
+	<indexterm><primary>groupmod</primary></indexterm>
+	<indexterm><primary>groupdel</primary></indexterm>
+	Where the <parameter>passdb backend</parameter> used is either <constant>smbpasswd</constant>
+	(the default) or the new <constant>tdbsam</constant>, the system interface scripts
+	are typically used. These involve use of OS tools such as <command>useradd</command>,
+	<command>usermod</command>, <command>userdel</command>, <command>groupadd</command>,
+	<command>groupmod</command>, <command>groupdel</command>, and so on.
+	</para>
+
+	<para>
+	<indexterm><primary>passdb backend</primary></indexterm>
+	<indexterm><primary>LDAP</primary></indexterm>
+	<indexterm><primary>Idealx</primary></indexterm>
+	Where the <parameter>passdb backend</parameter> makes use of an LDAP directory,
+	it is necessary either to use the <constant>smbldap-tools</constant> provided
+	by Idealx or to use an alternate toolset provided by a third
+	party or else home-crafted to manage the LDAP directory accounts.
+	</para>
+
+	</sect2>
+
+	<sect2>
+	<title>Samba-2.x with LDAP Support</title>
+
+	<para>
+	Samba version 2.x could be compiled for use either with or without LDAP.
+	The LDAP control settings in the &smb.conf; file in this old version are
+	completely different (and less complete) than they are with Samba-3. This
+	means that after migrating the control files, it is necessary to reconfigure
+	the LDAP settings entirely.
+	</para>
+
+	<para>
+	Follow the procedure outlined in <link linkend="sbeug2"/> to affect a migration
+	of all files to the correct locations.
+	</para>
+
+	<para>
+	<indexterm><primary>schema</primary></indexterm>
+	<indexterm><primary>WHATSNEW.txt</primary></indexterm>
+	The Samba SAM schema required for Samba-3 is significantly different from that
+	used with Samba 2.x. This means that the LDAP directory must be updated
+	using the procedure outlined in the Samba WHATSNEW.txt file that accompanies
+	all releases of Samba-3. This information is repeated here directly from this
+	file:
+<screen>
+This is an extract from the Samba-3.0.x WHATSNEW.txt file:
+==========================================================
+Changes in Behavior
+-------------------
+
+The following issues are known changes in behavior between Samba 2.2 and
+Samba 3.0 that may affect certain installations of Samba.
+
+  1)  When operating as a member of a Windows domain, Samba 2.2 would
+      map any users authenticated by the remote DC to the 'guest account'
+      if a uid could not be obtained via the getpwnam() call.  Samba 3.0
+      rejects the connection as NT_STATUS_LOGON_FAILURE.  There is no
+      current work around to re-establish the 2.2 behavior.
+
+  2)  When adding machines to a Samba 2.2 controlled domain, the
+      'add user script' was used to create the UNIX identity of the
+      machine trust account.  Samba 3.0 introduces a new 'add machine
+      script' that must be specified for this purpose.  Samba 3.0 will
+      not fall back to using the 'add user script' in the absence of
+      an 'add machine script'
+
+######################################################################
+Passdb Backends and Authentication
+##################################
+
+There have been a few new changes that Samba administrators should be
+aware of when moving to Samba 3.0.
+
+  1) encrypted passwords have been enabled by default in order to
+     inter-operate better with out-of-the-box Windows client
+     installations.  This does mean that either (a) a samba account
+     must be created for each user, or (b) 'encrypt passwords = no'
+     must be explicitly defined in smb.conf.
+
+  2) Inclusion of new 'security = ads' option for integration
+     with an Active Directory domain using the native Windows
+     Kerberos 5 and LDAP protocols.
+
+     MIT kerberos 1.3.1 supports the ARCFOUR-HMAC-MD5 encryption
+     type which is necessary for servers on which the
+     administrator password has not been changed, or kerberos-enabled
+     SMB connections to servers that require Kerberos SMB signing.
+     Besides this one difference, either MIT or Heimdal Kerberos
+     distributions are usable by Samba 3.0.
+
+
+Samba 3.0 also includes the possibility of setting up chains
+of authentication methods (auth methods) and account storage
+backends (passdb backend).  Please refer to the smb.conf(5)
+man page for details.  While both parameters assume sane default
+values, it is likely that you will need to understand what the
+values actually mean in order to ensure Samba operates correctly.
+
+The recommended passdb backends at this time are
+
+  * smbpasswd - 2.2 compatible flat file format
+  * tdbsam - attribute rich database intended as an smbpasswd
+    replacement for stand alone servers
+  * ldapsam - attribute rich account storage and retrieval
+    backend utilizing an LDAP directory.
+  * ldapsam_compat - a 2.2 backward compatible LDAP account
+    backend
+
+Certain functions of the smbpasswd(8) tool have been split between the
+new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8)
+utility.  See the respective man pages for details.
+
+######################################################################
+LDAP
+####
+
+This section outlines the new features affecting Samba / LDAP
+integration.
+
+New Schema
+----------
+
+A new object class (sambaSamAccount) has been introduced to replace
+the old sambaAccount.  This change aids us in the renaming of
+attributes to prevent clashes with attributes from other vendors.
+There is a conversion script (examples/LDAP/convertSambaAccount) to
+modify and LDIF file to the new schema.
+
+Example:
+
+  $ ldapsearch .... -b "ou=people,dc=..." &gt; sambaAcct.ldif
+  $ convertSambaAccount --sid=&lt;Domain SID&gt; \
+    --input=sambaAcct.ldif --output=sambaSamAcct.ldif \
+    --changetype=[modify|add]
+
+The &lt;DOM SID&gt; can be obtained by running 'net getlocalsid
+&lt;DOMAINNAME&gt;' on the Samba PDC as root.  The changetype determines
+the format of the generated LDIF output--either create new entries
+or modify existing entries.
+
+The old sambaAccount schema may still be used by specifying the
+"ldapsam_compat" passdb backend.  However, the sambaAccount and
+associated attributes have been moved to the historical section of
+the schema file and must be uncommented before use if needed.
+The 2.2 object class declaration for a sambaAccount has not changed
+in the 3.0 samba.schema file.
+
+Other new object classes and their uses include:
+
+  * sambaDomain - domain information used to allocate rids
+    for users and groups as necessary.  The attributes are added
+    in 'ldap suffix' directory entry automatically if
+    an idmap uid/gid range has been set and the 'ldapsam'
+    passdb backend has been selected.
+
+  * sambaGroupMapping - an object representing the
+    relationship between a posixGroup and a Windows
+    group/SID.  These entries are stored in the 'ldap
+    group suffix' and managed by the 'net groupmap' command.
+
+  * sambaUnixIdPool - created in the 'ldap idmap suffix' entry
+    automatically and contains the next available 'idmap uid' and
+    'idmap gid'
+
+  * sambaIdmapEntry - object storing a mapping between a
+    SID and a UNIX uid/gid.  These objects are created by the
+    idmap_ldap module as needed.
+
+  * sambaSidEntry - object representing a SID alone, as a Structural
+    class on which to build the sambaIdmapEntry.
+
+
+New Suffix for Searching
+------------------------
+
+The following new smb.conf parameters have been added to aid in directing
+certain LDAP queries when 'passdb backend = ldapsam://...' has been
+specified.
+
+  * ldap suffix         - used to search for user and computer accounts
+  * ldap user suffix    - used to store user accounts
+  * ldap machine suffix - used to store machine trust accounts
+  * ldap group suffix   - location of posixGroup/sambaGroupMapping entries
+  * ldap idmap suffix   - location of sambaIdmapEntry objects
+
+If an 'ldap suffix' is defined, it will be appended to all of the
+remaining sub-suffix parameters.  In this case, the order of the suffix
+listings in smb.conf is important.  Always place the 'ldap suffix' first
+in the list.
+
+Due to a limitation in Samba's smb.conf parsing, you should not surround
+the DN's with quotation marks.
+</screen>
+	</para>
+
+	</sect2>
+
+</sect1>
+
+<sect1>
+<title>Updating a Samba-3 Installation</title>
+
+<para>
+The key concern in this section is to deal with the changes that have been
+affected in Samba-3 between the Samba-3.0.0 release and the current update.
+Network administrators have expressed concerns over the steps that should be
+taken to update Samba-3 versions.
+</para>
+
+<para>
+<indexterm><primary>control files</primary></indexterm>
+The information in <link linkend="sbeug1"/> would not be necessary if every
+person who has ever produced Samba executable (binary) files could agree on
+the preferred location of the &smb.conf; file and other Samba control files.
+Clearly, such agreement is further away than a pipedream.
+</para>
+
+<para>
+<indexterm><primary>vendors</primary></indexterm>
+Vendors and packagers who produce Samba binary installable packages do not,
+as a rule, use the default paths used by the Samba-Team for the location of
+the binary files, the &smb.conf; file, and the Samba control files (tdb's
+as well as files such as <filename>secrets.tdb</filename>). This means that
+the network or UNIX administrator who sets out to build the Samba executable
+files from the Samba tarball must take particular care. Failure to take care
+will result in both the original vendor's version of Samba remaining installed
+and the new version being installed in the default location used
+by the Samba-Team. This can lead to confusion and to much lost time as the
+uninformed administrator deals with apparent failure of the update to take
+effect.
+</para>
+
+<para>
+<indexterm><primary>packages</primary></indexterm>
+The best advice for those lacking in code compilation experience is to use
+only vendor (or Samba-Team) provided binary packages. The Samba packages
+that are provided by the Samba-Team are generally built to use file paths
+that are compatible with the original OS vendor's practices.
+</para>
+
+<para>
+<indexterm><primary>binary package</primary></indexterm>
+<indexterm><primary>binary files</primary></indexterm>
+If you are not sure whether a binary package complies with the OS
+vendor's practices, it is better to ask the package maintainer via
+email than to waste much time dealing with the nuances.
+Alternately, just diagnose the paths specified by the binary files following
+the procedure outlined above.
+</para>
+
+	<sect2>
+	<title>Samba-3 to Samba-3 Updates on the Same Server</title>
+
+	<para>
+	The guidance in this section deals with updates to an existing
+	Samba-3 server installation.
+	</para>
+
+	<sect3>
+	<title>Updating from Samba Versions Earlier than 3.0.5</title>
+
+	<para>
+	With the provision that the binary Samba-3 package has been built
+	with the same path and feature settings as the existing Samba-3
+	package that is being updated, an update of Samba-3 versions 3.0.0
+	through 3.0.4 can be updated to 3.0.5 without loss of functionality
+	and without need to change either the &smb.conf; file or, where
+	used, the LDAP schema.
+	</para>
+
+	</sect3>
+
+	<sect3>
+	<title>Updating from Samba Versions between 3.0.6 and 3.0.10</title>
+
+	<para>
+	<indexterm><primary>schema</primary></indexterm>
+	<indexterm><primary>LDAP</primary><secondary>schema</secondary></indexterm>
+	When updating versions of Samba-3 prior to 3.0.6 to 3.0.6 through 3.0.10,
+	it is necessary only to update the LDAP schema (where LDAP is used).
+	Always use the LDAP schema file that is shipped with the latest Samba-3
+	update.
+	</para>
+
+	<para>
+	<indexterm><primary>ldapsam</primary></indexterm>
+	<indexterm><primary>tdbsam</primary></indexterm>
+	<indexterm><primary>passdb backend</primary></indexterm>
+	Samba-3.0.6 introduced the ability to remember the last <emphasis>n</emphasis> number
+	of passwords a user has used. This information will work only with
+	the <constant>tdbsam</constant> and <constant>ldapsam</constant>
+	<parameter>passdb backend</parameter> facilities.
+	</para>
+
+	<para>
+	After updating the LDAP schema, do not forget to re-index the LDAP database.
+	</para>
+
+	</sect3>
+
+	<sect3>
+	<title>Updating from Samba Versions after 3.0.6 to a Current Release</title>
+
+	<para>
+	<indexterm><primary>winbindd</primary></indexterm>
+	Samba-3.0.8 introduced changes in how the <parameter>username map</parameter>
+	behaves. It also included a change in behavior of <command>winbindd</command>.
+	Please refer to the man page for &smb.conf; before implementing any update
+	from versions prior to 3.0.8 to a current version.
+	</para>
+
+	<para>
+	<indexterm><primary>privileges</primary></indexterm>
+	In Samba-3.0.11 a new privileges interface was implemented. Please
+	refer to <link linkend="sbehap-ppc"/> for information regarding this new
+	feature. It is not necessary to implement the privileges interface, but it
+	is one that has been requested for several years and thus may be of interest
+	at your site.
+	</para>
+
+	<para>
+	In Samba-3.0.11 there were some functional changes to the <parameter>ldap user
+	suffix</parameter> and to the <parameter>ldap machine suffix</parameter> behaviors.
+	The following information has been extracted from the WHATSNEW.txt file from this
+	release:
+<screen>
+============
+LDAP Changes
+============
+
+If "ldap user suffix" or "ldap machine suffix" are defined in
+smb.conf, all user-accounts must reside below the user suffix,
+and all machine and inter-domain trust-accounts must be located
+below the machine suffix.  Previous Samba releases would fall
+back to searching the 'ldap suffix' in some cases.
+</screen>
+	</para>
+
+	</sect3>
+	</sect2>
+
+	<sect2>
+	<title>Migrating Samba-3 to a New Server</title>
+
+	<para>
+	The two most likely candidates for replacement of a server are
+	domain member servers and domain controllers. Each needs to be
+	handled slightly differently.
+	</para>
+
+	<sect3>
+	<title>Replacing a Domain Member Server</title>
+
+	<para>
+	<indexterm><primary>DMS</primary></indexterm>
+	Replacement of a domain member server should be done
+	using the same procedure as outlined in <link linkend="unixclients"/>.
+	</para>
+
+	<para>
+	Usually the new server will be introduced with a temporary name. After
+	the old server data has been migrated to the new server, it is customary
+	that the new server be renamed to that of the old server. This will
+	change its SID and will necessitate rejoining to the domain.
+	</para>
+
+	<para>
+	<indexterm><primary>smbd</primary></indexterm>
+	<indexterm><primary>nmbd</primary></indexterm>
+	<indexterm><primary>winbindd</primary></indexterm>
+	<indexterm><primary>wins.dat</primary></indexterm>
+	<indexterm><primary>browse.dat</primary></indexterm>
+	<indexterm><primary>resolution</primary></indexterm>
+	Following a change of hostname (NetBIOS name) it is a good idea on all servers
+	to shut down the Samba <command>smbd</command>, <command>nmbd</command>, and
+	<command>winbindd</command> services, delete the <filename>wins.dat</filename>
+	and <filename>browse.dat</filename> files, then restart Samba. This will ensure
+	that the old name and IP address information is no longer able to interfere with
+	name to IP address resolution.  If this is not done, there can be temporary name
+	resolution problems. These problems usually clear within 45 minutes of a name
+	change, but can persist for a longer period of time.
+	</para>
+
+	<para>
+	<indexterm><primary>DMS</primary></indexterm>
+	<indexterm><primary>/etc/passwd</primary></indexterm>
+	<indexterm><primary>/etc/shadow</primary></indexterm>
+	<indexterm><primary>/etc/group</primary></indexterm>
+	If the old domain member server had local accounts, it is necessary to create
+	on the new domain member server the same accounts with the same UID and GID
+	for each account. Where the <parameter>passdb backend</parameter> database
+	is stored in the <constant>smbpasswd</constant> or in the
+	<constant>tdbsam</constant> format, the user and group account information
+	for UNIX accounts that match the Samba accounts will reside in the system
+	<filename>/etc/passwd</filename>, <filename>/etc/shadow</filename>, and
+	<filename>/etc/group</filename> files. In this case, be sure to copy these
+	account entries to the new target server.
+	</para>
+
+	<para>
+	<indexterm><primary>nss_ldap</primary></indexterm>
+	Where the user accounts for both UNIX and Samba are stored in LDAP, the new
+	target server must be configured to use the <command>nss_ldap</command> tool set.
+	This will automatically ensure that the appropriate user entities are
+	available on the new server.
+	</para>
+
+	</sect3>
+
+	<sect3>
+	<title>Replacing a Domain Controller</title>
+
+	<para>
+	<indexterm><primary>domain</primary><secondary>controller</secondary></indexterm>
+	In the past, people who replaced a Windows NT4 domain controller typically
+	installed a new server, created printers and file shares on it, then migrate across
+	all data that was destined to reside on it. The same can of course be done with
+	Samba.
+	</para>
+
+	<para>
+	From recent mailing list postings it would seem that some administrators
+	have the intent to just replace the old Samba server with a new one with
+	the same name as the old one. In this case, simply follow the same process
+	as for upgrading a Samba 2.x system and do the following:
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		Where UNIX (POSIX) user and group accounts are stored in the system
+		<filename>/etc/passwd</filename>, <filename>/etc/shadow</filename>, and 
+		<filename>/etc/group</filename> files, be sure to add the same accounts
+		with identical UID and GID values for each user.
+		</para>
+
+		<para>
+		Where LDAP is used, if the new system is intended to be the LDAP server,
+		migrate it across by configuring the LDAP server 
+		(<filename>/etc/openldap/slapd.conf</filename>). The directory can
+		be populated either initially by setting this LDAP server up as a slave or
+		by dumping the data from the old LDAP server using the <command>slapcat</command>
+		command and then reloading the same data into the new LDAP server using the
+		<command>slapadd</command> command. Do not forget to install and configure
+		the <command>nss_ldap</command> tool and the <filename>/etc/nsswitch.conf</filename>
+		(as shown in <link linkend="happy"/>).
+		</para></listitem>
+
+		<listitem><para>
+		Copy the &smb.conf; file from the old server to the new server into the correct
+		location as indicated previously in this chapter.
+		</para></listitem>
+
+		<listitem><para>
+		Copy the <filename>secrets.tdb</filename> file, the <filename>smbpasswd</filename>
+		file (if it is used), the <filename>/etc/samba/passdb.tdb</filename> file (only
+		used by the <constant>tdbsam</constant> backend), and all the tdb control files
+		from the old system to the correct location on the new system.
+		</para></listitem>
+
+		<listitem><para>
+		Before starting the Samba daemons, verify that the hostname of the new server
+		is identical to that of the old one. Note: The IP address can be different
+		from that of the old server.
+		</para></listitem>
+
+		<listitem><para>
+		Copy all files from the old server to the new server, taking precaution to
+		preserve all file ownership and permissions as well as any POSIX ACLs that
+		may have been created on the old server.
+		</para></listitem>
+	</itemizedlist>
+
+	<para>
+	When replacing a Samba domain controller (PDC or BDC) that uses LDAP, the new server
+	need simply be configured to use the LDAP directory, and for the rest it should just
+	work. The domain SID is obtained from the LDAP directory as part of the first connect
+	to the LDAP directory server.
+	</para>
+
+	<para>
+	All Samba servers, other than one that uses LDAP, depend on the tdb files, and
+	particularly on the <filename>secrets.tdb</filename> file. So long as the tdb files are
+	all in place, the &smb.conf; file is preserved, and either the hostname is identical
+	or the <parameter>netbios name</parameter> is set to the original server name, Samba
+	should correctly pick up the original SID and preserve all other settings. It is
+	sound advice to validate this before turning the system over to users.
+	</para>
+
+	</sect3>
+
+	</sect2>
+
+	<sect2>
+	<title>Migration of Samba Accounts to Active Directory</title>
+
+	<para>
+	Yes, it works. The Windows ADMT tool can be used to migrate Samba accounts
+	to MS Active Directory.  There are a few pitfalls to be aware of:
+	</para>
+
+	<procedure>
+	<title>Migration to Active Directory</title>
+
+		<step><para>
+		Administrator password must be THE SAME on the Samba server,
+		the 2003 ADS, and the local Administrator account on the workstations. 
+		Perhaps this goes without saying, but there needs to be an account
+		called <constant>Administrator</constant> in your Samba domain, with 
+		full administrative (root) rights to that domain.
+		</para></step>
+
+		<step><para>
+		In the Advanced/DNS section of the TCP/IP settings on your Windows 
+		workstations, make sure the <parameter>DNS suffix for this 
+		connection</parameter> field is blank. 
+		</para></step>
+
+		<step><para>
+		Because you are migrating from Samba, user passwords cannot be 
+		migrated. You'll have to reset everyone's passwords. (If you were 
+		migrating from NT4 to ADS, you could migrate passwords as well.)
+		</para>
+
+		<para>
+		To date this has not been attempted with roaming profile support;
+		it has been documented as working with local profiles.
+		</para></step>
+
+		<step><para>
+		Disable the Windows Firewall on all workstations. Otherwise, 
+		workstations won't be migrated to the new domain.
+		</para></step>
+
+		<step><para>
+		<indexterm><primary>ADMT</primary></indexterm>
+		When migrating machines, always test first (using ADMT's test mode) 
+		and satisfy all errors before committing the migration. Note that the 
+		test will always fail, because the machine will not have been actually 
+		migrated. You'll need to interpret the errors to know whether the 
+		failure was due to a problem or simply to the fact that it was just 
+		a test.
+		</para></step>
+
+	</procedure>
+
+
+	<para>
+	<indexterm><primary>ADMT</primary></indexterm>
+	There are some significant benefits of using the ADMT, besides just 
+	migrating user accounts. ADMT can be found on the Windows 2003 CD.
+	</para>
+
+	<itemizedlist>
+		<listitem><para>
+		You can migrate workstations remotely. You can specify that SIDs 
+		be simply added instead of replaced, giving you the option of joining a 
+		workstation back to the old domain if something goes awry. The 
+		workstations will be joined to the new domain.
+		</para></listitem>
+
+		<listitem><para>
+		Not only are user accounts migrated from the old domain to the new 
+		domain, but ACLs on the workstations are migrated as well. Like SIDs, 
+		ACLs can be added instead of replaced.
+		</para></listitem>
+
+		<listitem><para>
+		Locally stored user profiles on workstations are migrated as well, 
+		presenting almost no disruption to the user. Saved passwords will be 
+		lost, just as when you administratively reset the password in Windows ADS.
+		</para></listitem>
+
+		<listitem><para>
+		The ADMT lets you test all operations before actually performing the 
+		migration. Accounts and workstations can be migrated individually or in 
+		batches. User accounts can be safely migrated all at once (since no 
+		changes are made on the original domain). It is recommended to migrate only one 
+		or two workstations as a test before committing them all.
+		</para></listitem>
+
+	</itemizedlist>
+
+	</sect2>
+
+</sect1>
+
+</chapter>
diff --git a/docs/Samba3-ByExample/SBE-acknowledgements.xml b/docs/Samba3-ByExample/SBE-acknowledgements.xml
new file mode 100644
index 0000000000..2d02ed3795
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-acknowledgements.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE preface PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+
+<preface lang="en-US">
+<title>Acknowledgments</title>
+
+	<para>
+	<emphasis>Samba-3 by Example</emphasis> would not have been written except
+	as a result of feedback provided by reviewers of the book <emphasis>The
+	Official Samba-3 HOWTO and Reference Guide.</emphasis> I hope this book
+	more than answers the challenge and fills the void that was brought to
+	my attention.
+	</para>
+
+	<para>
+	I am deeply indebted to a large group of diligent people. Space prevents 
+	me from listing all of them, but a few stand out as worthy of mention.
+	Jelmer Vernooij made the notable contribution of building the XML production
+	environment and thereby made possible the typesetting of this book.
+	</para>
+
+	<para>
+	Samba would not have come into existence if Andrew Tridgell had not taken
+	the first steps. He continues to lead the project. Under the shadow of his
+	mantle are some great guys who never give up and are always ready to help.
+	Thank you to: Jeremy Allison, Jerry Carter, Andrew Bartlett, Jelmer Vernooij,
+	Alexander Bokovoy, Volker Lendecke, and other team members who answered my 
+	continuous stream of questions &smbmdash; all of which resulted in improved content 
+	in this book.
+	</para>
+
+	<para>
+	My heartfelt thanks go out also to a small set of reviewers (alphabetically 
+	listed) who gave substantial feedback and significant suggestions for improvement:
+	Roland Gruber, Luke Howard, Jon Johnston, Alan Munter, Tarjei Huse, Mike MacIsaac,
+	Scott Mann, Ed Riddle, Santos Soler, Mark Taylor, and Jérôme Tournier.
+	</para>
+
+	<para>
+	My appreciation is extended to a team of over 30 additional reviewers who
+	helped me to find my way around dark corners.
+	</para>
+
+	<para>
+	Particular mention is due to Lyndell, Amos and Melissa who gave me the 
+	latitude necessary to spend nearly a entire year writing Samba documentation.
+	</para>
+
+</preface>
diff --git a/docs/Samba3-ByExample/SBE-foreword.xml b/docs/Samba3-ByExample/SBE-foreword.xml
new file mode 100644
index 0000000000..d90aead066
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-foreword.xml
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE preface PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+
+<preface lang="en-US">
+<title>Foreword</title>
+
+<sect1><title>By John M. Weathersby, OSSI</title>
+<blockquote>
+<attribution>
+Executive Director, Open Source Software Institute
+</attribution>
+
+<para>
+The Open Source Software Institute (OSSI) is comprised of representatives from a broad spectrum of business and
+non-business organizations that share a common interest in the promotion of development and implementation
+of open-source software solutions globally, and in particular within the United States of America.
+</para>
+
+<para>
+The OSSI has global affiliations with like-minded organizations. Our affiliate in the United Kingdom is the
+Open Source Consortium. Both the OSSI and the OSC share a common objective to expand the use of open-source
+software in federal, state, and municipal government agencies; and in academic institutions. We represent
+businesses that provide professional support services that answer the needs of our target organizational
+information technology consumers in an effective and cost-efficient manner.
+</para>
+
+<para>
+Open source software has matured greatly over the past 5 years with the result that an increasing number of
+people who hold key decision-making positions want to know how the business model works. They
+want to understand how problems get resolved, how questions get answered, and how the development model
+is sustained. Information and Communications Technology directors in defense organizations, and in other
+government agencies that deal with sensitive information, want to become familiar with development road-maps
+and, in particular, seek to evaluate the track record of the main-stream open-source project teams.
+</para>
+
+<para>
+Wherever the OSSI gains entrance to new opportunities we find that Microsoft Windows technologies are the 
+benchmark against which open-source software solutions are measured. Two open-source software projects
+are key to our ability to present a structured and convincing proposition that there are alternatives
+to the incumbent proprietary means of meeting information technology needs. They are the Apache Web Server
+and Samba.
+</para>
+
+<para>
+Just as the Apache Web Server is the standard in web serving technology, Samba is the definitive standard
+for providing interoperability with UNIX systems and other non-Microsoft operating system platforms. Both
+open-source applications have a truly remarkable track record that extends well over a decade. Both have
+demonstrated the unique capacity to innovate and maintain a level of development that has not only kept
+pace with demands, but, in many areas, each project has also proven to be an industry leader.
+</para>
+
+<para>
+One of the areas in which the Samba project has demonstrated key leadership is in documentation. The OSSI
+was delighted when we saw the Samba Team, and John H. Terpstra in particular, release two amazingly
+well-written books to help Samba software users deploy, maintain, and troubleshoot Windows networking
+installations. We were concerned that, given the large volume of documentation, the challenge to maintain
+it and keep it current might prove difficult.
+</para>
+
+<para>
+This second edition of the book, <quote>Samba-3 by Example</quote>, barely one year following the release
+of the first edition, has removed all concerns and is proof that open-source solutions are a compelling choice.
+The first edition was released shortly following the release of Samba version 3.0 itself, and has become
+the authoritative instrument for training and for guiding deployment.
+</para>
+
+<para>
+I am personally aware of how much effort has gone into this second edition. John Terpstra has worked with
+government bodies and with large organizations that have deployed Samba-3 since it was released. He also
+worked to ensure that this book gained community following. He asked those who have worked at the coalface
+of large and small organizations alike, to contribute their experiences. He has captured that in this book
+and has succeeded yet again. His recipe is persistence, intuition, and a high level of respect for the people
+who use Samba.
+</para>
+
+<para>
+This book is the first source you should turn to before you deploy Samba and as you are mastering its
+deployment. I am proud and excited to be associated in a small way with such a useful tool. This book has
+reached maturity that is demonstrated by reiteration that every step in deployment must be validated.
+This book makes it easy to succeed, and difficult to fail, to gain a stable network environment.
+</para>
+
+<para>
+I recommend this book for use by all IT managers and network administrators.
+</para>
+
+</blockquote>
+
+</sect1>
+
+</preface>
diff --git a/docs/Samba3-ByExample/SBE-front-matter.xml b/docs/Samba3-ByExample/SBE-front-matter.xml
new file mode 100644
index 0000000000..1afd6cd14b
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-front-matter.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE preface PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+
+<preface lang="en-US">
+<title>Front Matter</title>
+
+	<para>
+	Just a place holder.
+	</para>
+
+</preface>
diff --git a/docs/Samba3-ByExample/SBE-glossary.xml b/docs/Samba3-ByExample/SBE-glossary.xml
new file mode 100644
index 0000000000..1066d253c7
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-glossary.xml
@@ -0,0 +1,258 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE glossary PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<glossary>
+	<title>Glossary</title>
+
+	<glossentry>
+		<glossterm>Access Control List</glossterm>
+		<acronym>ACL</acronym>
+		<glossdef><para>
+		A detailed list of permissions granted to users or groups with respect to file and network
+		resource access.
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+                <glossterm>Active Directory Service</glossterm>
+		<acronym>ADS</acronym>
+		<glossdef><para>
+		A service unique to Microsoft Windows 200x servers that provides a centrally managed
+		directory for management of user identities and computer objects, as well as the
+		permissions each user or computer may be granted to access distributed network resources.
+		ADS uses Kerberos-based authentication and LDAP over Kerberos for directory access.
+		</para></glossdef>
+        </glossentry>
+
+	<glossentry>
+		<glossterm>Common Internet File System</glossterm>
+		<acronym>CIFS</acronym>
+		<glossdef><para>
+		The new name for SMB. Microsoft renamed the SMB protocol to CIFS during
+		the Internet hype in the 1990s. At about the time that the SMB protocol was renamed
+		to CIFS, an additional dialect of the SMB protocol was in development. The need for the
+		deployment of the NetBIOS layer was also removed, thus paving the way for use of the SMB
+		protocol natively over TCP/IP (known as NetBIOS-less SMB or <quote>naked</quote> TCP
+		transport).
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>Common UNIX Printing System</glossterm>
+		<acronym>CUPS</acronym>
+		<glossdef><para>
+		A recent implementation of a high-capability printing system for UNIX developed by
+		<ulink url="http://www.easysw.com/">Easy Software Inc.</ulink>. The design objective
+		of CUPS was to provide a rich print processing system that has built-in intelligence
+		that is capable of correctly rendering (processing) a file that is submitted for
+		printing even if it was formatted for an entirely different printer.
+		</para>
+		</glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>Domain Master Browser</glossterm>
+		<acronym>DMB</acronym>
+		<glossdef><para>
+		The Domain Master Browser maintains a list of all the servers that 
+		have announced their services within a given workgroup or NT domain.
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+                <glossterm>Domain Name Service</glossterm>
+		<acronym>DNS</acronym>
+		<glossdef><para>
+		A protocol by which computer hostnames may be resolved to the matching IP address/es.
+		DNS is implemented by the Berkeley Internet Name Daemon. There exists a recent version
+		of DNS that allows dynamic name registration by network clients or by a DHCP server.
+		This recent protocol is known as dynamic DNS (DDNS).
+		</para></glossdef>
+        </glossentry>
+
+	<glossentry>
+                <glossterm>Dynamic Host Configuration Protocol</glossterm>
+		<acronym>DHCP</acronym>
+		<glossdef><para>
+		A protocol that was based on the BOOTP protocol that may be used to dynamically assign
+		an IP address, from a reserved pool of addresses, to a network client or device.
+		Additionally, DHCP may assign all network configuration settings and may be used to
+		register a computer name and its address with a dynamic DNS server.
+		</para></glossdef>
+        </glossentry>
+
+	<glossentry>
+		<glossterm>Ethereal</glossterm>
+		<acronym>ethereal</acronym>
+		<glossdef><para>
+		A network analyzer, also known as a network sniffer or a protocol analyzer. Ethereal is
+		freely available for UNIX/Linux and Microsoft Windows systems from
+		<ulink url="http://www.ethereal.com">the Ethereal Web site</ulink>.
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>Group IDentifier</glossterm>
+		<acronym>GID</acronym>
+		<glossdef><para>
+		The UNIX system group identifier; on older systems, a 32-bit unsigned integer, and on
+		newer systems, an unsigned 64-bit integer. The GID is used in UNIX-like operating systems
+		for all group-level access control.
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>Key Distribution Center</glossterm>
+		<acronym>KDC</acronym>
+		<glossdef><para>
+		The Kerberos authentication protocol makes use of security keys (also called a ticket)
+		by which access to network resources is controlled. The issuing of Kerberos tickets
+		is effected by a KDC.
+		</para></glossdef>
+	</glossentry>
+
+    <glossentry>
+      <glossterm>Lightweight Directory Access Protocol</glossterm>
+      <acronym>LDAP</acronym>
+      <glossdef>
+	<para>
+	The Lightweight Directory Access Protocol is a technology that
+	  originated from the development of X.500 protocol specifications and
+	  implementations. LDAP was designed as a means of rapidly searching
+	  through X.500 information. Later LDAP was adapted as an engine that
+	  could drive its own directory database. LDAP is not a database per
+	  se; rather it is a technology that enables high-volume search and
+	  locate activity from clients that wish to obtain simply defined
+	  information about a subset of records that are stored in a
+	  database. LDAP does not have a particularly efficient mechanism for
+	  storing records in the database, and it has no concept of transaction
+	  processing nor of mechanisms for preserving data consistency. LDAP is
+	  premised around the notion that the search and read activity far
+	  outweigh any need to add, delete, or modify records. LDAP does
+	  provide a means for replication of the database to keep slave
+	  servers up to date with a master. It also has built-in capability to
+	  handle external references and deferral. 
+	</para></glossdef>
+    </glossentry>
+	
+	<glossentry>
+		<glossterm>Local Master Browser</glossterm>
+		<acronym>LMB</acronym>
+		<glossdef><para>
+		The Local Master Browser maintains a list of all servers that have announced themselves
+		within a given workgroup or NT domain on a particular broadcast isolated subnet.
+		</para></glossdef>
+	</glossentry>
+
+        <glossentry>
+                <glossterm>Media Access Control</glossterm>
+		<acronym>MAC</acronym>
+                <glossdef><para>
+		The hard-coded address of the physical-layer device that is attached to the network.
+		All network interface controllers must have a hard-coded and unique MAC address. The
+		MAC address is 48 bits long.
+                </para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>NetBIOS Extended User Interface</glossterm>
+		<acronym>NetBEUI</acronym>
+		<glossdef><para>
+		Very simple network protocol invented by IBM and Microsoft. It is used to do NetBIOS
+		over Ethernet with low overhead. NetBEUI is a non-routable protocol.
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>Network Address Translation</glossterm>
+                <acronym>NAT</acronym>
+                <glossdef><para>
+		Network address translation is a form of IP address masquerading. It ensures that internal
+		private (RFC1918) network addresses from packets inside the network are rewritten so
+		that TCP/IP packets that leave the server over a public connection are seen to come only
+		from the external network address.
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>Network Basic Input/Output System</glossterm>
+		<acronym>NetBIOS</acronym>
+		<glossdef><para>
+		NetBIOS is a simple application programming interface (API) invented in the 1980s 
+		that allows programs to send data to certain network names. NetBIOS is always run over
+		another network protocol such as IPX/SPX, TCP/IP, or Logical Link Control (LLC).
+		NetBIOS run over LLC is best known as NetBEUI (the NetBIOS Extended User Interface
+		&smbmdash; a complete misnomer!).
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>NetBT</glossterm>
+		<acronym>NBT</acronym>
+		<glossdef><para>
+		Protocol for transporting NetBIOS frames over TCP/IP. Uses ports 137, 138, and 139. 
+		NetBT is a fully routable protocol.
+		</para></glossdef>
+	</glossentry>
+	
+	<glossentry>
+		<glossterm>NT/LanManager Security Support Provider</glossterm>
+		<acronym>NTLMSSP</acronym>
+		<glossdef><para>
+		The NTLM Security Support Provider (NTLMSSP) service in Windows NT4/200x/XP is responsible for
+		handling all NTLM authentication requests. It is the front end for protocols such as SPNEGO,
+		Schannel, and other technologies. The generic protocol family supported by NTLMSSP is known as
+		GSSAPI, the Generic Security Service Application Program Interface specified in RFC2078.
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>Server Message Block</glossterm>
+		<acronym>SMB</acronym>
+		<glossdef><para>
+		SMB was the original name of the protocol spoken by Samba. It was invented in the 1980s
+		by IBM and adopted and extended further by Microsoft. Microsoft renamed the protocol to 
+		CIFS during the Internet hype in the 1990s.
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>The Simple and Protected GSS-API Negotiation</glossterm>
+                <acronym>SPNEGO</acronym>
+                <glossdef><para>
+		The purpose of SPNEGO is to allow a client and server to negotiate a security mechanism for
+		authentication. The protocol is specified in RFC2478 and uses tokens as built via ASN.1 DER.
+		DER refers to Distinguished Encoding Rules. These are a set of common rules for creating
+		binary encodings in a platform-independent manner. Samba has support for SPNEGO.
+                </para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>The Official Samba-3 HOWTO and Reference Guide</glossterm>
+		<acronym>TOSHARG</acronym>
+		<glossdef><para>
+		This book makes repeated reference to <quote>The Official Samba-3 HOWTO and Reference Guide</quote>
+		by John H. Terpstra and Jelmer R. Vernooij. This publication is available from
+		Amazon.com. Publisher: Prentice Hall PTR (October 2003),
+		ISBN: 0131453556.
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>User IDentifier</glossterm>
+		<acronym>UID</acronym>
+		<glossdef><para>
+		The UNIX system user identifier; on older systems, a 32-bit unsigned integer, and on newer systems,
+		an unsigned 64-bit integer. The UID is used in UNIX-like operating systems for all user-level access
+		control.
+		</para></glossdef>
+	</glossentry>
+
+	<glossentry>
+		<glossterm>Universal Naming Convention</glossterm>
+		<acronym>UNC</acronym>
+		<glossdef><para>A syntax for specifying the location of network resources (such as file shares).
+		The UNC syntax was developed in the early days of MS DOS 3.x and is used internally by the SMB protocol.
+		</para></glossdef>
+	</glossentry>
+
+</glossary>
diff --git a/docs/Samba3-ByExample/SBE-inside-cover.xml b/docs/Samba3-ByExample/SBE-inside-cover.xml
new file mode 100644
index 0000000000..492a581cf5
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-inside-cover.xml
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE preface PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<preface lang="en-US">
+<title>About the Cover Artwork</title>
+
+	<para>
+	The cover artwork of this book continues the freedom theme of the first
+	edition of <quote>Samba-3 by Example</quote>. The history of civilization
+	demonstrates the fragile nature of freedom. It can be lost in a moment,
+	and once lost, the cost of recovering liberty can be incredible. The last
+	edition cover featured Alfred the Great who liberated England from the
+	constant assault of Vikings and Norsemen. Events in England that
+	that finally liberated the common people came about in small steps, but
+	the result should not be under-estimated. Today, as always, freedom and
+	liberty are seldom appreciated until they are lost. If we can not quantify
+	what is the value of freedom, we shall be little motivated to protect it.
+	</para>
+
+	<para>
+	<emphasis>Samba-3 by Example Cover Artwork:</emphasis> The British houses
+	of parliament are a symbol of the Westminster system of government. This form
+	of government permits the people to govern themselves at the lowest level, yet
+	it provides for courts of appeal that are designed to protect freedom and to
+	hold back all forces of tyranny. The clock is a pertinent symbol of the
+	importance of time and place.
+	</para>
+
+	<para>
+	The information technology industry is being challenged by the imposition of
+	new laws, hostile litigation, and the imposition of significant constraint 
+	of practice that threatens to remove the freedom to develop and deploy open 
+	source software solutions. Samba is a software solution that epitomizes freedom
+	of choice in network interoperability for Microsoft Windows clients.
+	</para>
+
+	<para>
+	I hope you will take the time needed to deploy it well, and that you may realize
+	the greatest benefits may be obtained. You are free to use it in ways never
+	considered, but in doing so there may be some obstacles. Every obstacle that is
+	overcome adds to the freedom you can enjoy. Use Samba well, and it will serve
+	you well.
+	</para>
+
+</preface>
diff --git a/docs/Samba3-ByExample/SBE-preface.xml b/docs/Samba3-ByExample/SBE-preface.xml
new file mode 100644
index 0000000000..8c99546a6c
--- /dev/null
+++ b/docs/Samba3-ByExample/SBE-preface.xml
@@ -0,0 +1,584 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE preface PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<preface id="preface">
+  <title>Preface</title>
+
+	<para>
+	Network administrators live busy lives. We face distractions and pressures
+	that drive us to seek proven, working case scenarios that can be easily
+	implemented. Often this approach lands us in trouble. There is a 
+	saying that, geometrically speaking, the shortest distance between two 
+	points is a straight line, but practically we find that the quickest 
+	route to a stable network solution is the long way around.
+	</para>
+
+	<para>
+	This book is your means to the straight path. It provides step-by-step,
+	proven, working examples of Samba deployments.  If you want to deploy
+	Samba-3 with the least effort, or if you want to become an expert at deploying
+	Samba-3 without having to search through lots of documentation, this
+	book is the ticket to your destination.
+	</para>
+
+	<para>
+	Samba is software that can be run on a platform other than Microsoft Windows,
+	for example, UNIX, Linux, IBM System 390, OpenVMS, and other operating systems.
+	Samba uses the TCP/IP protocol that is installed on the host server. When
+	correctly configured, it allows that host to interact with a Microsoft Windows
+	client or server as if it is a Windows file and print server. This book
+	will help you to implement Windows-compatible file and print services.
+	</para>
+
+	<para>
+	The examples presented in this book are typical of various businesses and
+	reflect the problems and challenges they face. Care has been taken to preserve
+	attitudes, perceptions, practices, and demands from real network case studies.
+	The maximum benefit may be obtained from this book by working carefully through
+	each exercise. You may be in a hurry to satisfy a specific need, so feel
+	free to locate the example that most closely matches your need, copy it, and
+	innovate as much as you like. Above all, enjoy the process of learning the
+	secrets of MS Windows networking that is truly liberated by Samba.
+	</para>
+
+	<para>
+	The focus of attention in this book is Samba-3. Specific notes are made in
+	respect of how Samba may be made secure. This book does not attempt to provide
+	detailed information regarding secure operation and configuration of peripheral
+	services and applications such as OpenLDAP, DNS and DHCP, the need for which
+	can be met from other resources that are dedicated to the subject.
+	</para>
+
+  <sect1>
+	<title>Why Is This Book Necessary?</title>
+
+	<para>
+	This book is the result of observations and feedback. The feedback from
+	the Samba-HOWTO-Collection has been positive and complimentary. There
+	have been requests for far more worked examples, a
+	<quote>Samba Cookbook,</quote> and for training materials to
+	help kick-start the process of mastering Samba.
+	</para>
+
+	<para>
+	The Samba mailing lists users have asked for sample configuration files
+	that work. It is natural to question one's own ability to correctly
+	configure a complex tool such as Samba until a minimum necessary
+	knowledge level has been attained.
+	</para>
+
+	<para>
+	The Samba-HOWTO-Collection, as do <emphasis>The Official Samba-3 HOWTO and 
+	Reference Guide</emphasis>, document Samba features and functionality in
+	a topical context.  This book takes a completely different approach. It
+	walks through Samba network configurations that are working within particular
+	environmental contexts, providing documented step-by-step implementations.
+	All example case configuration files, scripts, and other tools are provided
+	on the CD-ROM. This book is descriptive, provides detailed diagrams, and
+	makes deployment of Samba-3 a breeze.
+	</para>
+
+	<sect2>
+	<title>Samba 3.0.20 Update Edition</title>
+
+	<para>
+	The Samba 3.0.x series has been remarkably popular. At the time this book first
+	went to print samba-3.0.2 was being released. There have been significant modifications
+	and enhancements between samba-3.0.2 and samba-3.0.14 (the current release) that
+	necessitate this documentation update. This update has the specific intent to
+	refocus this book so that its guidance can be followed for samba-3.0.20
+	and beyond. Further changes are expected as Samba-3 matures further and will 
+	be reflected in future updates.
+	</para>
+
+	<para>
+	The changes shown in <link linkend="pref-new"/> are incorporated in this update:
+	</para>
+
+	<table id="pref-new">
+		<title>Samba Changes &smbmdash; 3.0.2 to 3.0.20</title>
+		<tgroup cols="2">
+			<colspec align="left"/>
+			<colspec align="justify"/>
+			<thead>
+				<row>
+					<entry align="left">
+						<para>
+						New Feature
+						</para>
+					</entry>
+					<entry align="left">
+						<para>
+						Description
+						</para>
+					</entry>
+				</row>
+			</thead>
+			<tbody>
+				<row>
+					<entry>
+						<para>
+						Winbind Case Handling
+						</para>
+					</entry>
+					<entry>
+						<para>
+						User and group names returned by <command>winbindd</command> are now converted to lower case
+						for better consistency. Samba implementations that depend on the case of information returned
+						by winbind (such as %u and %U) must now convert the dependency to expecting lower case values.
+						This affects mail spool files, home directories, valid user lines in the &smb.conf; file, etc.
+						</para>
+					</entry>
+				</row>
+				<row>
+					<entry>
+						<para>
+						Schema Changes
+						</para>
+					</entry>
+					<entry>
+						<para>
+						Addition of code to handle password aging, password uniqueness controls, bad
+						password instances at logon time, have made necessary extensions to the SambaSAM
+						schema. This change affects all sites that use LDAP and means that the directory
+						schema must be updated. 
+						</para>
+					</entry>
+				</row>
+				<row>
+					<entry>
+						<para>
+						Username Map Handling
+						</para>
+					</entry>
+					<entry>
+						<para>
+						Samba-3.0.8 redefined the behavior: Local authentication results in a username map file
+						lookup before authenticating the connection. All authentication via an external domain
+						controller will result in the use of the fully qualified name (i.e.: DOMAIN\username)
+						after the user has been successfully authenticated.
+						</para>
+					</entry>
+				</row>
+				<row>
+					<entry>
+						<para>
+						UNIX extension handling
+						</para>
+					</entry>
+					<entry>
+						<para>
+						Symbolicly linked files and directories on the UNIX host to absolute paths will
+						now be followed. This can be turned off using <quote>wide links = No</quote> in
+						the share stanza in the &smb.conf; file. Turning off <quote>wide links</quote>
+						support will degrade server performance because each path must be checked.
+						</para>
+					</entry>
+				</row>
+				<row>
+					<entry>
+						<para>
+						Privileges Support
+						</para>
+					</entry>
+					<entry>
+						<para>
+						Versions of Samba prior to samba-3.0.11 required the use of the UNIX <constant>root</constant>
+						account from network Windows clients. The new <quote>enable privileges = Yes</quote> capability
+						means that functions such as adding machines to the domain, managing printers, etc. can now
+						be delegated to normal user accounts or to groups of users.
+						</para>
+					</entry>
+				</row>
+			</tbody>
+		</tgroup>
+	</table>
+	</sect2>
+
+  </sect1>
+
+  <sect1>
+  <title>Prerequisites</title>
+
+	<para>
+	This book is not a tutorial on UNIX or Linux administration. UNIX and Linux
+	training is best obtained from books dedicated to the subject. This book
+	assumes that you have at least the basic skill necessary to use these operating
+	systems, and that you can use a basic system editor to edit and configure files.
+	It has been written with the assumption that you have experience with Samba, 
+	have read <emphasis>The Official Samba-3 HOWTO and Reference Guide</emphasis> and
+	the Samba-HOWTO-Collection, or that you have familiarity with Microsoft Windows.
+	</para>
+
+	<para>
+	If you do not have this experience, you can follow the examples in this book but may
+	find yourself at times intimidated by assumptions made. In this situation, you
+	may need to refer to administrative guides or manuals for your operating system
+	platform to find what is the best method to achieve what the text of this book describes.
+	</para>
+
+  </sect1>
+
+  <sect1>
+	<title>Approach</title>
+
+	<para>
+	The first chapter deals with some rather thorny network analysis issues. Do not be
+	put off by this. The information you glean, even without a detailed understanding
+	of network protocol analysis, can help you understand how Windows networking functions.
+	</para>
+
+	<para>
+	Each following chapter of this book opens with the description of a networking solution
+	sought by a hypothetical site. Bob Jordan is a hypothetical decision maker
+	for an imaginary company, <constant>Abmas Biz NL</constant>. We will use the
+	non-existent domain name <constant>abmas.biz</constant>. All <emphasis>facts</emphasis> 
+	presented regarding this company are fictitious and have been drawn from a variety of real 
+	business scenarios over many years. Not one of these reveal the identify of the 
+	real-world company from which the scenario originated.
+	</para>
+
+	<para> 
+	In any case, Mr. Jordan likes to give all his staff nasty little assignments.
+	Stanley Saroka is one of his proteges; Christine Roberson is the network administrator 
+	Bob trusts. Jordan is inclined to treat other departments well because they finance 
+	Abmas IT operations.
+	</para>
+
+	<para>
+	Each chapter presents a summary of the network solution we have chosen to
+	demonstrate together with a rationale to help you to understand the
+	thought process that drove that solution. The chapter then documents in precise
+	detail all configuration files and steps that must be taken to implement the
+	example solution. Anyone wishing to gain serious value from this book will
+	do well to take note of the implications of points made, so watch out for the
+	<emphasis>this means that</emphasis> notations.
+	</para>
+
+	<para>
+	Each chapter has a set of questions and answers to help you to
+	to understand and digest key attributes of the solutions presented.
+	</para>
+
+  </sect1>
+
+  <sect1>
+	<title>Summary of Topics</title>
+
+	<para>
+	The contents of this second edition of <emphasis>Samba-3 by Example</emphasis>
+	have been rearranged based on feedback from purchasers of the first edition.
+	</para>
+
+	<para>
+	Clearly the first edition contained most of what was needed and that was missing
+	from other books that cover this difficult subject. The new arrangement adds
+	additional material to meet consumer requests and includes changes that originated
+	as suggestions for improvement.
+	</para>
+
+	<para>
+	Chapter 1 now dives directly into the heart of the implementation of Windows
+	file and print server networks that use Samba at the heart.
+	</para>
+
+	<variablelist>
+		<varlistentry>
+		<term>Chapter 1 &smbmdash; No Frills Samba Servers</term><listitem>
+		<para>
+		Here you design a solution for three different business scenarios, each for a 
+		company called Abmas. There are two simple networking problems and one slightly 
+		more complex networking challenge. In the first two cases, Abmas has a small 
+		simple office, and they want to replace a Windows 9x peer-to-peer network. The 
+		third example business uses Windows 2000 Professional. This must be simple, 
+		so let's see how far we can get. If successful, Abmas grows quickly and
+		soon needs to replace all servers and workstations.
+		</para>
+
+        	<para><emphasis>TechInfo</emphasis> &smbmdash; This chapter demands:
+			<itemizedlist>
+				<listitem><para>Case 1: The simplest &smb.conf; file that may
+					reasonably be used. Works with Samba-2.x also. This
+					configuration uses Share Mode security. Encrypted
+					passwords are not used, so there is no 
+					<filename>smbpasswd</filename> file.
+					</para></listitem>
+
+				<listitem><para>Case 2: Another simple &smb.conf; file that adds
+					WINS support and printing support. This case deals with
+					a special requirement that demonstrates how to deal with
+					purpose-built software that has a particular requirement
+					for certain share names and printing demands. This
+					configuration uses Share Mode security and also works with
+					Samba-2.x. Encrypted passwords are not used, so there is no
+					<filename>smbpasswd</filename> file.
+					</para></listitem>
+
+				<listitem><para>Case 3: This &smb.conf; configuration uses User Mode
+					security. The file share configuration demonstrates
+					the ability to provide master access to an administrator
+					while restricting all staff to their own work areas.
+					Encrypted passwords are used, so there is an implicit
+					<filename>smbpasswd</filename> file.
+					</para></listitem>
+			</itemizedlist>
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Chapter 2 &smbmdash; Small Office Networking</term><listitem>
+		<para>
+		Abmas is a successful company now. They have 50 network users
+		and want a little more varoom from the network. This is a typical
+		small office and they want better systems to help them to grow. This is
+		your chance to really give advanced users a bit more functionality and usefulness.
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; This &smb.conf; file
+		makes use of encrypted passwords, so there is an <filename>smbpasswd</filename>
+		file. It also demonstrates use of the <parameter>valid users</parameter> and
+		<parameter>valid groups</parameter> to restrict share access. The Windows
+		clients access the server as Domain members. Mobile users log onto
+		the Domain while in the office, but use a local machine account while on the
+		road. The result is an environment that answers mobile computing user needs.
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Chapter 3 &smbmdash; Secure Office Networking</term><listitem>
+		<para>
+		Abmas is growing rapidly now. Money is a little tight, but with 130
+		network users, security has become a concern. They have many new machines
+		to install and the old equipment will be retired. This time they want the
+		new network to scale and grow for at least two years. Start with a sufficient
+		system and allow room for growth. You are now implementing an Internet
+		connection and have a few reservations about user expectations.
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; This &smb.conf; file
+                makes use of encrypted passwords, and you can use a <filename>tdbsam</filename>
+                password backend. Domain logons are introduced. Applications are served from the central
+		server. Roaming profiles are mandated. Access to the server is tightened up
+		so that only domain members can access server resources. Mobile computing
+		needs still are catered to.
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Chapter 4 &smbmdash; The 500 User Office</term><listitem>
+		<para>
+		The two-year projections were met. Congratulations, you are a star.
+		Now Abmas needs to replace the network. Into the existing user base, they
+		need to merge a 280-user company they just acquired. It is time to build a serious
+		network. There are now three buildings on one campus and your assignment is 
+		to keep everyone working while a new network is rolled out. Oh, isn't it nice 
+		to roll out brand new clients and servers! Money is no longer tight, you get 
+		to buy and install what you ask for. You will install routers and a firewall.
+		This is exciting!
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; This &smb.conf; file
+                makes use of encrypted passwords, and a <filename>tdbsam</filename>
+		password backend is used. You are not ready to launch into LDAP yet, so you
+		accept the limitation of having one central Domain Controller with a Domain
+		Member server in two buildings on your campus. A number of clever techniques
+		are used to demonstrate some of the smart options built into Samba.
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Chapter 5 &smbmdash; Making Happy Users</term><listitem>
+		<para>
+		Congratulations again. Abmas is happy with your services and you have been given another raise.
+		Your users are becoming much more capable and are complaining about little
+		things that need to be fixed. Are you up to the task? Mary says it takes her 20 minutes
+		to log onto the network and it is killing her productivity. Email is a bit <emphasis>
+		unreliable</emphasis> &smbmdash; have you been sleeping on the job? We do not discuss the
+		technology of email but when the use of mail clients breaks because of networking
+		problems, you had better get on top of it. It's time for a change.
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; This &smb.conf; file
+                makes use of encrypted passwords; a distributed <filename>ldapsam</filename>
+                password backend is used. Roaming profiles are enabled. Desktop profile controls
+		are introduced. Check out the techniques that can improve the user experience 
+		of network performance. As a special bonus, this chapter documents how to configure
+		smart downloading of printer drivers for drag-and-drop printing support. And, yes,
+		the secret of configuring CUPS is clearly documented. Go for it; this one will
+		tease you, too.
+                </para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Chapter 6 &smbmdash; A Distributed 2000 User Network</term><listitem>
+		<para>
+		Only eight months have passed, and Abmas has acquired another company. You now need to expand
+		the network further. You have to deal with a network that spans several countries.
+		There are three new networks in addition to the original three buildings at the head-office 
+		campus. The head office is in New York and you have branch offices in Washington, Los Angeles, and 
+		London. Your desktop standard is Windows XP Professional. In many ways, everything has changed
+		and yet it must remain the same. Your team is primed for another roll-out. You know there are
+		further challenges ahead.
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; Slave LDAP servers are introduced. Samba is
+		configured to use multiple LDAP backends. This is a brief chapter; it assumes that the
+		technology has been mastered and gets right down to concepts and how to deploy them.
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Chapter 7 &smbmdash; Adding UNIX/Linux Servers and Clients</term><listitem>
+		<para>
+		Well done, Bob, your team has achieved much. Now help Abmas integrate the entire network.
+		You want central control and central support and you need to cut costs. How can you reduce administrative
+		overheads and yet get better control of the network?
+		</para>
+
+		<para>
+		This chapter has been contributed by Mark Taylor <email>mark.taylor@siriusit.co.uk</email>
+		and is based on a live site. For further information regarding this example case, 
+		please contact Mark directly.
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; It is time to consider how to add Samba servers
+		and UNIX and Linux network clients. Users who convert to Linux want to be able to log on
+		using Windows network accounts. You explore nss_ldap, pam_ldap, winbind, and a few neat
+		techniques for taking control. Are you ready for this?
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Chapter 8 &smbmdash; Updating Samba-3</term><listitem>
+		<para>
+		This chapter is the result of repeated requests for better documentation of the steps
+		that must be followed when updating or upgrading a Samba server. It attempts to cover
+		the entire subject in broad-brush but at the same time provides detailed background
+		information that is not covered elsewhere in the Samba documentation.
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; Samba stores a lot of essential network
+		information in a large and growing collection of files. This chapter documents the
+		essentials of where those files may be located and how to find them. It also provide
+		an insight into inter-related matters that affect a Samba installation.
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Chapter 9 &smbmdash; Migrating NT4 Domain to Samba-3</term><listitem>
+		<para>
+		Another six months have <?latex \linebreak ?>
+		 passed. Abmas has acquired yet another company. You will find a
+		way to migrate all users off the old network onto the existing network without loss
+		of passwords and will effect the change-over during one weekend. May the force (and caffeine) be with
+		you, may you keep your back to the wind and may the sun shine on your face.
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; This chapter demonstrates the use of
+		the <command>net rpc migrate</command> facility using an LDAP ldapsam backend, and also
+		using a tdbsam passdb backend. Both are much-asked-for examples of NT4 Domain migration.
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Chapter 10 &smbmdash; Migrating NetWare 4.11 Server to Samba</term><listitem>
+		<para>
+		Misty Stanley-Jones has contributed information that summarizes her experience at migration
+		from a NetWare server to Samba-3.
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; The documentation provided demonstrates
+		how one site migrated from NetWare to Samba. Some alternatives tools are mentioned. These
+		could be used to provide another pathway to a successful migration.
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Chapter 11 &smbmdash; Active Directory, Kerberos and Security</term><listitem>
+		<para>
+		Abmas has acquired another company that has just migrated to running Windows Server 2003 and 
+		Active Directory. One of your staff makes offhand comments that land you in hot water.
+		A network security auditor is hired by the head of the new business and files a damning 
+		report, and you must address the <emphasis>defects</emphasis> reported. You have hired new 
+		network engineers who want to replace Microsoft Active Directory with a pure Kerberos 
+		solution. How will you handle this? 
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; This chapter is your answer. Learn about
+		share access controls, proper use of UNIX/Linux file system access controls, and Windows
+		200x Access Control Lists. Follow these steps to beat the critics.
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+                <term>Chapter 12 &smbmdash; Integrating Additional Services</term><listitem>
+                <para>
+		The battle is almost over, Samba-3 has won the day. Your team are delighted and now you
+		find yourself at yet another cross-roads. Abmas have acquired a snack food business, you
+		made promises you must keep. IT costs must be reduced, you have new resistance, but you
+		will win again. This time you choose to install the Squid proxy server to validate the
+		fact that Samba is far more than just a file and print server. SPNEGO authentication 
+		support means that your Microsoft Windows clients gain transparent proxy access.
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; Samba provides the <command>ntlm_auth</command>
+		module that makes it possible for MS Windows Internet Explorer to connect via the Squid Web
+		and FTP proxy server. You will configure Samba-3 as well as Squid to deliver authenticated
+		access control using the Active Directory Domain user security credentials.
+                </para>
+                </listitem>
+                </varlistentry>
+
+		<varlistentry>
+		<term>Chapter 13 &smbmdash; Performance, Reliability and Availability</term><listitem>
+		<para>
+		Bob, are you sure the new Samba server is up to the load? Your network is serving many
+		users who risk becoming unproductive. What can you do to keep ahead of demand? Can you
+		keep the cost under control also? What can go wrong?
+		</para>
+
+		<para><emphasis>TechInfo</emphasis> &smbmdash; Hot tips that put chili into your
+		network. Avoid name resolution problems, identify potential causes of network collisions,
+		avoid Samba configuration options that will weigh the server down. MS distributed file
+		services to make your network fly and much more. This chapter contains a good deal of 
+		<quote>Did I tell you about this...?</quote> type of hints to help keep your name on the top
+		performers list.
+		</para>
+		</listitem>
+		</varlistentry>
+
+		<varlistentry>
+		<term>Appendix B &smbmdash; Windows Networking Primer</term><listitem>
+		<para>
+		Here we cover practical exercises to help us to understand how MS Windows
+		network protocols function. A network protocol analyzer helps you to
+		appreciate the fact that Windows networking is highly dependent on broadcast
+		messaging. Additionally, you can look into network packets that a Windows
+		client sends to a network server to set up a network connection. On completion,
+		you should have a basic understanding of how network browsing functions and
+		have seen some of the information a Windows client sends to
+		a file and print server to create a connection over which file and print
+		operations may take place.
+		</para>
+		</listitem>
+		</varlistentry>
+
+	</variablelist>
+
+  </sect1>
+
+  <!-- the conventions used in this book -->
+  <xi:include href="conventions.xml" xmlns:xi="http://www.w3.org/2003/XInclude" />
+
+</preface>
+
diff --git a/docs/Samba3-ByExample/conventions.xml b/docs/Samba3-ByExample/conventions.xml
new file mode 100644
index 0000000000..d4bbde8f85
--- /dev/null
+++ b/docs/Samba3-ByExample/conventions.xml
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+
+  <sect1>
+    <title>Conventions Used</title>
+
+    <para>
+    The following notation conventions are used throughout this book:
+    </para>
+
+    <itemizedlist>
+      <listitem>
+	<para>
+	TOSHARG is used as an abbreviation for the book, <quote>The Official Samba-3
+	HOWTO and Reference Guide,</quote> Editors: John H. Terpstra and Jelmer R. Vernooij,
+	Publisher: Prentice Hall, ISBN: 0131453556.
+	</para>
+      </listitem>
+
+      <listitem>
+        <para>
+	Directories and filenames appear in mono-font. For example,
+        <filename>/etc/pam.conf</filename>.
+        </para>
+      </listitem>
+
+      <listitem>
+        <para>
+	Executable names are bolded. For example, <command>smbd</command>.
+	</para>
+      </listitem>
+
+      <listitem>
+        <para>
+	Menu items and buttons appear in bold. For example, click <guibutton>Next</guibutton>.
+        </para>
+      </listitem>
+
+      <listitem>
+        <para>
+	Selecting a menu item is indicated as:
+	<menuchoice>
+		<guimenu>Start</guimenu>
+		<guimenuitem>Control Panel</guimenuitem>
+		<guimenuitem>Administrative Tools</guimenuitem>
+		<guimenuitem>Active Directory Users and Computers</guimenuitem>
+	</menuchoice>
+       </para>
+      </listitem>
+    </itemizedlist>
+
+  </sect1>
+
diff --git a/docs/Samba3-ByExample/gpl.xml b/docs/Samba3-ByExample/gpl.xml
new file mode 100644
index 0000000000..8f3b8b40e4
--- /dev/null
+++ b/docs/Samba3-ByExample/gpl.xml
@@ -0,0 +1,425 @@
+<?xml version="1.0"?>
+<!DOCTYPE appendix PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
+<appendix>
+  <appendixinfo>
+    <title>GNU General Public License</title>
+    <pubdate>Version 2, June 1991</pubdate>
+    <copyright>
+      <year>1989, 1991</year>
+      <holder>Free Software Foundation, Inc.</holder>
+    </copyright>
+    <legalnotice>
+      <para>	
+	<address>Free Software Foundation, Inc. 
+	  <street>59 Temple Place, Suite 330</street>, 
+	  <city>Boston</city>, 
+	  <state>MA</state> 
+	  <postcode>02111-1307</postcode>
+	  <country>USA</country>
+	</address>.
+      </para>
+      <para>	Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+      </para>
+    </legalnotice>
+    <releaseinfo>      Version 2, June 1991</releaseinfo>
+  </appendixinfo>
+  <title>GNU General Public License</title>
+  <sect1>
+    <title>Preamble</title>
+    <para>      The licenses for most software are designed to take away your 
+      freedom to share and change it. By contrast, the GNU General Public License is 
+      intended to guarantee your freedom to share and change 
+      free software - to make sure the software is free for all its users. 
+      This General Public License applies to most of the Free Software 
+      Foundation's software and to any other program whose authors commit 
+      to using it. (Some other Free Software Foundation software is covered 
+      by the GNU Library General Public License instead.) You can apply it 
+      to your programs, too.
+    </para>
+    <para>      When we speak of free software, we are referring to freedom, not price. 
+      Our General Public Licenses are designed to make sure that you have the 
+      freedom to distribute copies of free software (and charge for this 
+      service if you wish), that you receive source code or can get it if you 
+      want it, that you can change the software or use pieces of it in new free 
+      programs; and that you know you can do these things.
+    </para>
+    <para>      To protect your rights, we need to make restrictions that forbid anyone 
+      to deny you these rights or to ask you to surrender the rights. These 
+      restrictions translate to certain responsibilities for you if you distribute 
+      copies of the software, or if you modify it.
+    </para>
+    <para>      For example, if you distribute copies of such a program, whether gratis or 
+      for a fee, you must give the recipients all the rights that you have. You 
+      must make sure that they, too, receive or can get the source code. And you 
+      must show them these terms so they know their rights.
+    </para>
+    <para>      We protect your rights with two steps:
+      <orderedlist>
+	<listitem>
+	  <para>	    copyright the software, and
+	  </para>
+	</listitem>
+	<listitem>
+	  <para>	    offer you this license which gives you legal permission to copy, 
+	    distribute and/or modify the software.
+	  </para>
+	</listitem>
+      </orderedlist>
+    </para>
+    <para>      Also, for each author's protection and ours, we want to make certain that 
+      everyone understands that there is no warranty for this free software. If 
+      the software is modified by someone else and passed on, we want its 
+      recipients to know that what they have is not the original, so that any 
+      problems introduced by others will not reflect on the original authors' 
+      reputations.
+    </para>
+    <para>      Finally, any free program is threatened constantly by software patents. 
+      We wish to avoid the danger that redistributors of a free program will 
+      individually obtain patent licenses, in effect making the program 
+      proprietary. To prevent this, we have made it clear that any patent must be 
+      licensed for everyone's free use or not licensed at all.
+    </para>
+    <para>      The precise terms and conditions for copying, distribution and modification 
+      follow.
+    </para>
+  </sect1>
+  <sect1>
+    <title>TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION</title>
+    <sect2>
+      <title>Section 0</title>
+      <para>	This License applies to any program or other work which contains a notice 
+	placed by the copyright holder saying it may be distributed under the terms 
+	of this General Public License. The "Program", below, refers to any such 
+	program or work, and a 
+	<quote>work based on the Program
+	</quote> means either 
+	the Program or any derivative work under copyright law: that is to say, a 
+	work containing the Program or a portion of it, either verbatim or with 
+	modifications and/or translated into another language. (Hereinafter, translation 
+	is included without limitation in the term 
+	<quote>modification
+	</quote>.) Each licensee is addressed as <quote>you</quote>.
+      </para>
+      <para>	Activities other than copying, distribution and modification are not covered by 
+	this License; they are outside its scope. The act of running the Program is not 
+	restricted, and the output from the Program is covered only if its contents 
+	constitute a work based on the Program (independent of having been made by running 
+	the Program). Whether that is true depends on what the Program does.
+      </para>
+    </sect2>
+    <sect2 id="sect1">
+      <title>Section 1</title>
+      <para>	You may copy and distribute verbatim copies of the Program's source code as you 
+	receive it, in any medium, provided that you conspicuously and appropriately 
+	publish on each copy an appropriate copyright notice and disclaimer of warranty; 
+	keep intact all the notices that refer to this License and to the absence of any 
+	warranty; and give any other recipients of the Program a copy of this License 
+	along with the Program.
+      </para>
+      <para>	You may charge a fee for the physical act of transferring a copy, and you may at 
+	your option offer warranty protection in exchange for a fee.
+      </para>
+    </sect2>
+    <sect2 id="sect2">
+      <title>Section 2</title>
+      <para>	You may modify your copy or copies of the Program or any portion of it, thus 
+	forming a work based on the Program, and copy and distribute such modifications 
+	or work under the terms of 
+	<link linkend="sect1">Section 1
+	</link> above, provided 
+	that you also meet all of these conditions:
+	<orderedlist>
+	  <listitem>
+	    <para>	      You must cause the modified files to carry prominent notices stating that 
+	      you changed the files and the date of any change.
+	    </para>
+	  </listitem>
+	  <listitem>
+	    <para>	      You must cause any work that you distribute or publish, that in whole or 
+	      in part contains or is derived from the Program or any part thereof, to be 
+	      licensed as a whole at no charge to all third parties under the terms of 
+	      this License.
+	    </para>
+	  </listitem>
+	  <listitem>
+	    <para>	      If the modified program normally reads commands interactively when run, you 
+	      must cause it, when started running for such interactive use in the most 
+	      ordinary way, to print or display an announcement including an appropriate 
+	      copyright notice and a notice that there is no warranty (or else, saying 
+	      that you provide a warranty) and that users may redistribute the program 
+	      under these conditions, and telling the user how to view a copy of this 
+	      License. 
+	      <note>
+		<title>Exception:
+		</title>
+		<para>		  If the Program itself is interactive but does not normally print such an 
+		  announcement, your work based on the Program is not required to print an 
+		  announcement.) 
+		</para>
+	      </note>
+	    </para>
+	  </listitem>
+	</orderedlist>
+      </para>
+      <para>	These requirements apply to the modified work as a whole. If identifiable sections 
+	of that work are not derived from the Program, and can be reasonably considered 
+	independent and separate works in themselves, then this License, and its terms, 
+	do not apply to those sections when you distribute them as separate works. But when 
+	you distribute the same sections as part of a whole which is a work based on the 
+	Program, the distribution of the whole must be on the terms of this License, whose 
+	permissions for other licensees extend to the entire whole, and thus to each and 
+	every part regardless of who wrote it.
+      </para>
+      <para>	Thus, it is not the intent of this section to claim rights or contest your rights 
+	to work written entirely by you; rather, the intent is to exercise the right to control 
+	the distribution of derivative or collective works based on the Program.
+      </para>
+      <para>	In addition, mere aggregation of another work not based on the Program with the Program 
+	(or with a work based on the Program) on a volume of a storage or distribution medium 
+	does not bring the other work under the scope of this License.
+      </para>
+    </sect2>
+    <sect2>
+      <title>Section 3
+      </title>
+      <para>	You may copy and distribute the Program (or a work based on it, under 
+	<link linkend="sect2">Section 2
+	</link> in object code or executable form under the terms of 
+	<link linkend="sect1">Sections 1
+	</link> and 
+	<link linkend="sect2">2
+	</link> above provided that you also do one of the following:
+	<orderedlist>
+	  <listitem>
+	    <para>	Accompany it with the complete corresponding machine-readable source code, which 
+	      must be distributed under the terms of Sections 1 and 2 above on a medium 
+	      customarily used for software interchange; or,
+	    </para>
+	  </listitem>
+	  <listitem>
+	    <para>	      Accompany it with a written offer, valid for at least three years, to give any 
+	      third party, for a charge no more than your cost of physically performing source 
+	      distribution, a complete machine-readable copy of the corresponding source code, 
+	      to be distributed under the terms of Sections 1 and 2 above on a medium customarily 
+	      used for software interchange; or,
+	    </para>
+	  </listitem>
+	  <listitem>
+	    <para>	      Accompany it with the information you received as to the offer to distribute 
+	      corresponding source code. (This alternative is allowed only for noncommercial 
+	      distribution and only if you received the program in object code or executable form 
+	      with such an offer, in accord with Subsection b above.)
+	    </para>
+	  </listitem>
+	</orderedlist>
+      </para>
+      <para>	The source code for a work means the preferred form of the work for making modifications 
+	to it. For an executable work, complete source code means all the source code for all modules 
+	it contains, plus any associated interface definition files, plus the scripts used to control 
+	compilation and installation of the executable. However, as a special exception, the source 
+	code distributed need not include anything that is normally distributed (in either source or 
+	binary form) with the major components (compiler, kernel, and so on) of the operating system 
+	on which the executable runs, unless that component itself accompanies the executable.
+      </para>
+      <para>	If distribution of executable or object code is made by offering access to copy from a 
+	designated place, then offering equivalent access to copy the source code from the same place 
+	counts as distribution of the source code, even though third parties are not compelled to 
+	copy the source along with the object code.
+      </para>
+    </sect2>
+    <sect2>
+      <title>Section 4
+      </title>
+      <para>	You may not copy, modify, sublicense, or distribute the Program except as expressly provided 
+	under this License. Any attempt otherwise to copy, modify, sublicense or distribute the 
+	Program is void, and will automatically terminate your rights under this License. However, 
+	parties who have received copies, or rights, from you under this License will not have their 
+	licenses terminated so long as such parties remain in full compliance.
+      </para>
+    </sect2>
+    <sect2>
+      <title>Section 5
+      </title>
+      <para>	You are not required to accept this License, since you have not signed it. However, nothing 
+	else grants you permission to modify or distribute the Program or its derivative works. 
+	These actions are prohibited by law if you do not accept this License. Therefore, by modifying 
+	or distributing the Program (or any work based on the Program), you indicate your acceptance 
+	of this License to do so, and all its terms and conditions for copying, distributing or 
+	modifying the Program or works based on it.
+      </para>
+    </sect2>
+    <sect2>
+      <title>Section 6
+      </title>
+      <para>	Each time you redistribute the Program (or any work based on the Program), the recipient 
+	automatically receives a license from the original licensor to copy, distribute or modify 
+	the Program subject to these terms and conditions. You may not impose any further restrictions 
+	on the recipients' exercise of the rights granted herein. You are not responsible for enforcing 
+	compliance by third parties to this License.
+      </para>
+    </sect2>
+    <sect2>
+      <title>Section 7
+      </title>
+      <para>	If, as a consequence of a court judgment or allegation of patent infringement or for any other 
+	reason (not limited to patent issues), conditions are imposed on you (whether by court order, 
+	agreement or otherwise) that contradict the conditions of this License, they do not excuse you 
+	from the conditions of this License. If you cannot distribute so as to satisfy simultaneously 
+	your obligations under this License and any other pertinent obligations, then as a consequence 
+	you may not distribute the Program at all. For example, if a patent license would not permit 
+	royalty-free redistribution of the Program by all those who receive copies directly or 
+	indirectly through you, then the only way you could satisfy both it and this License would be 
+	to refrain entirely from distribution of the Program.
+      </para>
+      <para>	If any portion of this section is held invalid or unenforceable under any particular circumstance, 
+	the balance of the section is intended to apply and the section as a whole is intended to apply 
+	in other circumstances.
+      </para>
+      <para>	It is not the purpose of this section to induce you to infringe any patents or other property 
+	right claims or to contest validity of any such claims; this section has the sole purpose of 
+	protecting the integrity of the free software distribution system, which is implemented by public 
+	license practices. Many people have made generous contributions to the wide range of software 
+	distributed through that system in reliance on consistent application of that system; it is up 
+	to the author/donor to decide if he or she is willing to distribute software through any other 
+	system and a licensee cannot impose that choice.
+      </para>
+      <para>	This section is intended to make thoroughly clear what is believed to be a consequence of the 
+	rest of this License.
+      </para>
+    </sect2>
+    <sect2>
+      <title>Section 8
+      </title>
+      <para>	If the distribution and/or use of the Program is restricted in certain countries either by patents 
+	or by copyrighted interfaces, the original copyright holder who places the Program under this License 
+	may add an explicit geographical distribution limitation excluding those countries, so that 
+	distribution is permitted only in or among countries not thus excluded. In such case, this License 
+	incorporates the limitation as if written in the body of this License.
+      </para>
+    </sect2>
+    <sect2>
+      <title>Section 9
+      </title>
+      <para>	The Free Software Foundation may publish revised and/or new versions of the General Public License 
+	from time to time. Such new versions will be similar in spirit to the present version, but may differ 
+	in detail to address new problems or concerns.
+      </para>
+      <para>	Each version is given a distinguishing version number. If the Program specifies a version number of 
+	this License which applies to it and "any later version", you have the option of following the terms 
+	and conditions either of that version or of any later version published by the Free Software 
+	Foundation. If the Program does not specify a version number of this License, you may choose any 
+	version ever published by the Free Software Foundation.
+      </para>
+    </sect2>
+    <sect2>
+      <title>Section 10
+      </title>
+      <para>	If you wish to incorporate parts of the Program into other free programs whose distribution 
+	conditions are different, write to the author to ask for permission. For software which is copyrighted 
+	by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions 
+	for this. Our decision will be guided by the two goals of preserving the free status of all 
+	derivatives of our free software and of promoting the sharing and reuse of software generally.
+      </para>
+    </sect2>
+    <sect2>
+<title>NO WARRANTY Section 11
+      </title>
+      <para>	BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT 
+	PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR 
+	OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, 
+	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 
+	PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE 
+	PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+      </para>
+    </sect2>
+    <sect2>
+      <title>Section 12
+      </title>
+      <para>	IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR 
+	ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU 
+	FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 
+	USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED 
+	INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH 
+	ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH 
+	DAMAGES.
+      </para>
+      <para>END OF TERMS AND CONDITIONS
+      </para>
+    </sect2>
+  </sect1>
+  <sect1>
+    <title>How to Apply These Terms to Your New Programs
+    </title>
+    <para>
+      If you develop a new program, and you want it to be of the greatest
+      possible use to the public, the best way to achieve this is to make it
+      free software which everyone can redistribute and change under these terms.
+    </para>
+    <para>
+      To do so, attach the following notices to the program.  It is safest
+      to attach them to the start of each source file to most effectively
+      convey the exclusion of warranty; and each file should have at least
+      the "copyright" line and a pointer to where the full notice is found.
+    </para>
+    <para>
+      &lt;one line to give the program's name and a brief idea of what it does.&gt;
+      Copyright (C) &lt;year&gt;    &lt;name of author&gt;
+    </para>
+    <para>
+      This program is free software; you can redistribute it and/or modify
+      it under the terms of the GNU General Public License as published by
+      the Free Software Foundation; either version 2 of the License, or
+      (at your option) any later version.
+    </para>
+    <para>
+      This program is distributed in the hope that it will be useful,
+      but WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+      GNU General Public License for more details.
+    </para>
+    <para>
+      You should have received a copy of the GNU General Public License
+      along with this program; if not, write to the Free Software
+      Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+    </para>
+    <para>
+      Also add information on how to contact you by electronic and paper mail.
+    </para>
+    <para>
+      If the program is interactive, make it output a short notice like this
+      when it starts in an interactive mode:
+    </para>
+    <para>
+      Gnomovision version 69, Copyright (C) year name of author
+      Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+      This is free software, and you are welcome to redistribute it
+      under certain conditions; type `show c' for details.
+    </para>
+    <para>
+      The hypothetical commands `show w' and `show c' should show the appropriate
+      parts of the General Public License.  Of course, the commands you use may
+      be called something other than `show w' and `show c'; they could even be
+      mouse-clicks or menu items--whatever suits your program.
+    </para>
+    <para>
+      You should also get your employer (if you work as a programmer) or your
+      school, if any, to sign a "copyright disclaimer" for the program, if
+      necessary.  Here is a sample; alter the names:
+    </para>
+    <para>
+      Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+      `Gnomovision' (which makes passes at compilers) written by James Hacker.
+    </para>
+    <para>
+      &lt;signature of Ty Coon&gt;, 1 April 1989
+      Ty Coon, President of Vice
+    </para>
+    <para>
+      This General Public License does not permit incorporating your program into
+      proprietary programs.  If your program is a subroutine library, you may
+      consider it more useful to permit linking proprietary applications with the
+      library.  If this is what you want to do, use the GNU Library General
+      Public License instead of this License.
+    </para>
+  </sect1>
+  </appendix>
diff --git a/docs/Samba3-ByExample/images/AccountingNetwork.dia b/docs/Samba3-ByExample/images/AccountingNetwork.dia
new file mode 100644
index 0000000000..3484dbad75
--- /dev/null
+++ b/docs/Samba3-ByExample/images/AccountingNetwork.dia
diff --git a/docs/Samba3-ByExample/images/Charity-Network.dia b/docs/Samba3-ByExample/images/Charity-Network.dia
new file mode 100644
index 0000000000..ab9c7f5834
--- /dev/null
+++ b/docs/Samba3-ByExample/images/Charity-Network.dia
diff --git a/docs/Samba3-ByExample/images/Domain-WorkgroupAnnouncement.png b/docs/Samba3-ByExample/images/Domain-WorkgroupAnnouncement.png
new file mode 100644
index 0000000000..e65882b2ce
--- /dev/null
+++ b/docs/Samba3-ByExample/images/Domain-WorkgroupAnnouncement.png
diff --git a/docs/Samba3-ByExample/images/HostAnnouncment.png b/docs/Samba3-ByExample/images/HostAnnouncment.png
new file mode 100644
index 0000000000..56f9fb8576
--- /dev/null
+++ b/docs/Samba3-ByExample/images/HostAnnouncment.png
diff --git a/docs/Samba3-ByExample/images/LocalMasterAnnouncement.png b/docs/Samba3-ByExample/images/LocalMasterAnnouncement.png
new file mode 100644
index 0000000000..8b22bc35c5
--- /dev/null
+++ b/docs/Samba3-ByExample/images/LocalMasterAnnouncement.png
diff --git a/docs/Samba3-ByExample/images/NullConnect.png b/docs/Samba3-ByExample/images/NullConnect.png
new file mode 100644
index 0000000000..5320fc6db1
--- /dev/null
+++ b/docs/Samba3-ByExample/images/NullConnect.png
diff --git a/docs/Samba3-ByExample/images/UNIX-Samba-and-LDAP.dia b/docs/Samba3-ByExample/images/UNIX-Samba-and-LDAP.dia
new file mode 100644
index 0000000000..dfd30fc022
--- /dev/null
+++ b/docs/Samba3-ByExample/images/UNIX-Samba-and-LDAP.dia
diff --git a/docs/Samba3-ByExample/images/UserConnect.png b/docs/Samba3-ByExample/images/UserConnect.png
new file mode 100644
index 0000000000..0b9acce15e
--- /dev/null
+++ b/docs/Samba3-ByExample/images/UserConnect.png
diff --git a/docs/Samba3-ByExample/images/UserMgrNT4.png b/docs/Samba3-ByExample/images/UserMgrNT4.png
new file mode 100644
index 0000000000..516c75b4b1
--- /dev/null
+++ b/docs/Samba3-ByExample/images/UserMgrNT4.png
diff --git a/docs/Samba3-ByExample/images/WINREPRESSME-Capture.png b/docs/Samba3-ByExample/images/WINREPRESSME-Capture.png
new file mode 100644
index 0000000000..3b6dc3ae56
--- /dev/null
+++ b/docs/Samba3-ByExample/images/WINREPRESSME-Capture.png
diff --git a/docs/Samba3-ByExample/images/WINREPRESSME-Capture2.png b/docs/Samba3-ByExample/images/WINREPRESSME-Capture2.png
new file mode 100644
index 0000000000..b9b82c2287
--- /dev/null
+++ b/docs/Samba3-ByExample/images/WINREPRESSME-Capture2.png
diff --git a/docs/Samba3-ByExample/images/Windows-ME-WINEPRESSME-Startup-30min-ProtocolStats.png b/docs/Samba3-ByExample/images/Windows-ME-WINEPRESSME-Startup-30min-ProtocolStats.png
new file mode 100644
index 0000000000..6e23d1632a
--- /dev/null
+++ b/docs/Samba3-ByExample/images/Windows-ME-WINEPRESSME-Startup-30min-ProtocolStats.png
diff --git a/docs/Samba3-ByExample/images/Windows-ME-WINEPRESSME-Startup-30min-TraceStats.png b/docs/Samba3-ByExample/images/Windows-ME-WINEPRESSME-Startup-30min-TraceStats.png
new file mode 100644
index 0000000000..f5fd738475
--- /dev/null
+++ b/docs/Samba3-ByExample/images/Windows-ME-WINEPRESSME-Startup-30min-TraceStats.png
diff --git a/docs/Samba3-ByExample/images/WindowsXP-NullConnection.png b/docs/Samba3-ByExample/images/WindowsXP-NullConnection.png
new file mode 100644
index 0000000000..76d1ac2c9a
--- /dev/null
+++ b/docs/Samba3-ByExample/images/WindowsXP-NullConnection.png
diff --git a/docs/Samba3-ByExample/images/WindowsXP-UserConnection.png b/docs/Samba3-ByExample/images/WindowsXP-UserConnection.png
new file mode 100644
index 0000000000..d60fefc659
--- /dev/null
+++ b/docs/Samba3-ByExample/images/WindowsXP-UserConnection.png
diff --git a/docs/Samba3-ByExample/images/XP-screen001.png b/docs/Samba3-ByExample/images/XP-screen001.png
new file mode 100644
index 0000000000..6f0fe58e78
--- /dev/null
+++ b/docs/Samba3-ByExample/images/XP-screen001.png
diff --git a/docs/Samba3-ByExample/images/acct2net.dia b/docs/Samba3-ByExample/images/acct2net.dia
new file mode 100644
index 0000000000..ca1716254b
--- /dev/null
+++ b/docs/Samba3-ByExample/images/acct2net.dia
diff --git a/docs/Samba3-ByExample/images/ch7-dual-additive-LDAP-Ok.dia b/docs/Samba3-ByExample/images/ch7-dual-additive-LDAP-Ok.dia
new file mode 100644
index 0000000000..e6464b9a13
--- /dev/null
+++ b/docs/Samba3-ByExample/images/ch7-dual-additive-LDAP-Ok.dia
diff --git a/docs/Samba3-ByExample/images/ch7-dual-additive-LDAP.dia b/docs/Samba3-ByExample/images/ch7-dual-additive-LDAP.dia
new file mode 100644
index 0000000000..6e1e4979d6
--- /dev/null
+++ b/docs/Samba3-ByExample/images/ch7-dual-additive-LDAP.dia
diff --git a/docs/Samba3-ByExample/images/ch7-fail-overLDAP.dia b/docs/Samba3-ByExample/images/ch7-fail-overLDAP.dia
new file mode 100644
index 0000000000..f676e2adfe
--- /dev/null
+++ b/docs/Samba3-ByExample/images/ch7-fail-overLDAP.dia
diff --git a/docs/Samba3-ByExample/images/ch7-singleLDAP.dia b/docs/Samba3-ByExample/images/ch7-singleLDAP.dia
new file mode 100644
index 0000000000..b03e7d354a
--- /dev/null
+++ b/docs/Samba3-ByExample/images/ch7-singleLDAP.dia
diff --git a/docs/Samba3-ByExample/images/ch8-migration.dia b/docs/Samba3-ByExample/images/ch8-migration.dia
new file mode 100644
index 0000000000..04a513bcf0
--- /dev/null
+++ b/docs/Samba3-ByExample/images/ch8-migration.dia
diff --git a/docs/Samba3-ByExample/images/chap4-net.dia b/docs/Samba3-ByExample/images/chap4-net.dia
new file mode 100644
index 0000000000..e8c56643c7
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap4-net.dia
diff --git a/docs/Samba3-ByExample/images/chap5-net.dia b/docs/Samba3-ByExample/images/chap5-net.dia
new file mode 100644
index 0000000000..f4f77ea064
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap5-net.dia
diff --git a/docs/Samba3-ByExample/images/chap6-net.dia b/docs/Samba3-ByExample/images/chap6-net.dia
new file mode 100644
index 0000000000..aa079a4291
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap6-net.dia
diff --git a/docs/Samba3-ByExample/images/chap7-idresol.dia b/docs/Samba3-ByExample/images/chap7-idresol.dia
new file mode 100644
index 0000000000..349d0588a6
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap7-idresol.dia
diff --git a/docs/Samba3-ByExample/images/chap7-net-A.dia b/docs/Samba3-ByExample/images/chap7-net-A.dia
new file mode 100644
index 0000000000..5286014a83
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap7-net-A.dia
diff --git a/docs/Samba3-ByExample/images/chap7-net-Ar.png b/docs/Samba3-ByExample/images/chap7-net-Ar.png
new file mode 100644
index 0000000000..2f4d80f47b
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap7-net-Ar.png
diff --git a/docs/Samba3-ByExample/images/chap7-net.dia b/docs/Samba3-ByExample/images/chap7-net.dia
new file mode 100644
index 0000000000..a136874e74
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap7-net.dia
diff --git a/docs/Samba3-ByExample/images/chap7-net2-B.dia b/docs/Samba3-ByExample/images/chap7-net2-B.dia
new file mode 100644
index 0000000000..761e41e91a
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap7-net2-B.dia
diff --git a/docs/Samba3-ByExample/images/chap7-net2-Br.png b/docs/Samba3-ByExample/images/chap7-net2-Br.png
new file mode 100644
index 0000000000..a75a47dc5d
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap7-net2-Br.png
diff --git a/docs/Samba3-ByExample/images/chap7-net2.dia b/docs/Samba3-ByExample/images/chap7-net2.dia
new file mode 100644
index 0000000000..653d2b2f69
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap7-net2.dia
diff --git a/docs/Samba3-ByExample/images/chap7-net2r.png b/docs/Samba3-ByExample/images/chap7-net2r.png
new file mode 100644
index 0000000000..194fd3c350
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap7-net2r.png
diff --git a/docs/Samba3-ByExample/images/chap7-netr.png b/docs/Samba3-ByExample/images/chap7-netr.png
new file mode 100644
index 0000000000..bbbbbf1cc7
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap7-netr.png
diff --git a/docs/Samba3-ByExample/images/chap9-ADSDC.dia b/docs/Samba3-ByExample/images/chap9-ADSDC.dia
new file mode 100644
index 0000000000..dd52341d54
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap9-ADSDC.dia
diff --git a/docs/Samba3-ByExample/images/chap9-SambaDC.dia b/docs/Samba3-ByExample/images/chap9-SambaDC.dia
new file mode 100644
index 0000000000..884a4d134a
--- /dev/null
+++ b/docs/Samba3-ByExample/images/chap9-SambaDC.dia
diff --git a/docs/Samba3-ByExample/images/lam-config.png b/docs/Samba3-ByExample/images/lam-config.png
new file mode 100644
index 0000000000..15f989bf37
--- /dev/null
+++ b/docs/Samba3-ByExample/images/lam-config.png
diff --git a/docs/Samba3-ByExample/images/lam-group-members.png b/docs/Samba3-ByExample/images/lam-group-members.png
new file mode 100644
index 0000000000..cab8e42fc7
--- /dev/null
+++ b/docs/Samba3-ByExample/images/lam-group-members.png
diff --git a/docs/Samba3-ByExample/images/lam-groups.png b/docs/Samba3-ByExample/images/lam-groups.png
new file mode 100644
index 0000000000..da17b19a77
--- /dev/null
+++ b/docs/Samba3-ByExample/images/lam-groups.png
diff --git a/docs/Samba3-ByExample/images/lam-hosts.png b/docs/Samba3-ByExample/images/lam-hosts.png
new file mode 100644
index 0000000000..27806eb9ab
--- /dev/null
+++ b/docs/Samba3-ByExample/images/lam-hosts.png
diff --git a/docs/Samba3-ByExample/images/lam-login.png b/docs/Samba3-ByExample/images/lam-login.png
new file mode 100644
index 0000000000..cce500fc43
--- /dev/null
+++ b/docs/Samba3-ByExample/images/lam-login.png
diff --git a/docs/Samba3-ByExample/images/lam-users.png b/docs/Samba3-ByExample/images/lam-users.png
new file mode 100644
index 0000000000..0ca4b437ec
--- /dev/null
+++ b/docs/Samba3-ByExample/images/lam-users.png
diff --git a/docs/Samba3-ByExample/images/openmag.png b/docs/Samba3-ByExample/images/openmag.png
new file mode 100644
index 0000000000..52eca30c35
--- /dev/null
+++ b/docs/Samba3-ByExample/images/openmag.png
diff --git a/docs/Samba3-ByExample/images/wxpp001.png b/docs/Samba3-ByExample/images/wxpp001.png
new file mode 100644
index 0000000000..2e689a17e2
--- /dev/null
+++ b/docs/Samba3-ByExample/images/wxpp001.png
diff --git a/docs/Samba3-ByExample/images/wxpp004.png b/docs/Samba3-ByExample/images/wxpp004.png
new file mode 100644
index 0000000000..656f67942e
--- /dev/null
+++ b/docs/Samba3-ByExample/images/wxpp004.png
diff --git a/docs/Samba3-ByExample/images/wxpp006.png b/docs/Samba3-ByExample/images/wxpp006.png
new file mode 100644
index 0000000000..a20b3ed583
--- /dev/null
+++ b/docs/Samba3-ByExample/images/wxpp006.png
diff --git a/docs/Samba3-ByExample/images/wxpp007.png b/docs/Samba3-ByExample/images/wxpp007.png
new file mode 100644
index 0000000000..cf41352220
--- /dev/null
+++ b/docs/Samba3-ByExample/images/wxpp007.png
diff --git a/docs/Samba3-ByExample/images/wxpp008.png b/docs/Samba3-ByExample/images/wxpp008.png
new file mode 100644
index 0000000000..9958c7c873
--- /dev/null
+++ b/docs/Samba3-ByExample/images/wxpp008.png
diff --git a/docs/Samba3-ByExample/images/wxpp010.png b/docs/Samba3-ByExample/images/wxpp010.png
new file mode 100644
index 0000000000..068a0dfc73
--- /dev/null
+++ b/docs/Samba3-ByExample/images/wxpp010.png
diff --git a/docs/Samba3-ByExample/images/wxpp011.png b/docs/Samba3-ByExample/images/wxpp011.png
new file mode 100644
index 0000000000..0cf88c04a6
--- /dev/null
+++ b/docs/Samba3-ByExample/images/wxpp011.png
diff --git a/docs/Samba3-ByExample/images/wxpp012.png b/docs/Samba3-ByExample/images/wxpp012.png
new file mode 100644
index 0000000000..d89f3b5d31
--- /dev/null
+++ b/docs/Samba3-ByExample/images/wxpp012.png
diff --git a/docs/Samba3-ByExample/images/wxpp013.png b/docs/Samba3-ByExample/images/wxpp013.png
new file mode 100644
index 0000000000..451240ee38
--- /dev/null
+++ b/docs/Samba3-ByExample/images/wxpp013.png
diff --git a/docs/Samba3-ByExample/images/wxpp015.png b/docs/Samba3-ByExample/images/wxpp015.png
new file mode 100644
index 0000000000..12fe2f31b2
--- /dev/null
+++ b/docs/Samba3-ByExample/images/wxpp015.png
diff --git a/docs/Samba3-ByExample/index.xml b/docs/Samba3-ByExample/index.xml
new file mode 100644
index 0000000000..89c17c5873
--- /dev/null
+++ b/docs/Samba3-ByExample/index.xml
@@ -0,0 +1,119 @@
+<?xml version="1.0"?>

+<!DOCTYPE book PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">

+

+<book id="S3bE"

+	xmlns:xi="http://www.w3.org/2003/XInclude">

+	<title>Samba-3 by Example</title>

+	<subtitle>Practical Exercises in Successful Samba Deployment</subtitle>

+	<bookinfo>

+		<authorgroup>

+			<author>&person.jht;</author>

+		</authorgroup>

+		<pubdate>April 12, 2005</pubdate>

+	</bookinfo>

+	<?latex \clearpage ?>

+	<?latex \setcounter{page}{5} ?>

+

+	<xi:include href="SBE-inside-cover.xml"/>

+	<xi:include href="SBE-acknowledgements.xml"/>

+	<xi:include href="SBE-foreword.xml"/>

+	<xi:include href="SBE-preface.xml"/>

+

+	<?latex \cleardoublepage ?>

+

+	<toc/>

+

+	<?latex \cleardoublepage ?>

+

+	<?latex \listofexamples ?>

+

+	<?latex \cleardoublepage ?>

+

+	<lot/>

+

+	<!-- Chapters -->

+

+<part id="ExNetworks">

+<title>Example Network Configurations</title>

+<partintro>

+<title>Example Network Configurations</title>

+

+<?latex \pagenumbering{arabic} ?>

+

+<para>

+This section of <emphasis>Samba-3 by Example</emphasis> provides example network

+configurations that can be copied, or modified as needed, and deployed as-is.

+</para>

+

+<para>

+Best use can be made of this book by finding in this section the network design and

+layout that best approximates your estimated needs. It is recommended that you will

+implement the design pattern exactly as it appears, then after the installation has

+been proven to work make any changes or modifications needed at your site.

+</para>

+

+<para>

+The examples have been tested with Red Hat Fedora Core 2, Novell SUSE Linux Professional

+9.2 and Novell SUSE Linux Enterprise Server (SLES) 9. The principals of implementation

+apply to all Linux and UNIX systems in general, though some system files and tools will 

+be different and the location of some Samba file locations will be different since these 

+are determined by the person who packages Samba for each platform.

+</para>

+

+</partintro>

+	<xi:include href="SBE-SimpleOfficeServer.xml"/>

+	<xi:include href="SBE-TheSmallOffice.xml"/>

+	<xi:include href="SBE-SecureOfficeServer.xml"/>

+	<xi:include href="SBE-500UserNetwork.xml"/>

+	<xi:include href="SBE-MakingHappyUsers.xml"/>

+	<xi:include href="SBE-2000UserNetwork.xml"/>

+</part>

+

+<part id="DMSMig">

+<title>Domain Members, Updating Samba and Migration</title>

+<partintro>

+<title>Domain Members, Updating Samba and Migration</title>

+

+<para>

+This section <emphasis>Samba-3 by Example</emphasis> covers two main topics: How to add

+Samba Domain Member Servers and Samba Domain Member Clients to a Samba domain, the other

+subject is that of how to migrate from and NT4 Domain, a NetWare server, or from an earlier

+Samba version to environments that use the most recent Samba-3 release. 

+</para>

+

+<para>

+Those who are making use of the chapter on Adding UNIX clients and servers running Samba

+to a Samba or a Windows networking domain may also benefit by referring to the book

+<emphasis>The Official Samba-3 HOWTO and Reference Guide.</emphasis>

+</para>

+

+</partintro>

+	<xi:include href="SBE-AddingUNIXClients.xml"/>

+	<xi:include href="SBE-UpgradingSamba.xml"/>

+	<xi:include href="SBE-MigrateNT4Samba3.xml"/>

+	<xi:include href="SBE-MigrateNW4Samba3.xml"/>

+</part>

+

+<part id="RefSection">

+<title>Reference Section</title>

+<partintro>

+<title>Reference Section</title>

+

+<para>

+This section <emphasis>Samba-3 by Example</emphasis> provides important reference material

+that may help you to solve network performance issues, to answer some of the critiques

+published regarding Samba, or just to gain a more broad understanding of how Samba can

+play in a Windows networking world.

+</para>

+

+</partintro>

+	<xi:include href="SBE-KerberosFastStart.xml"/>

+	<xi:include href="SBE-DomainAppsSupport.xml"/>

+	<xi:include href="SBE-HighAvailability.xml"/>

+	<xi:include href="SBE-Appendix1.xml"/>

+	<xi:include href="SBE-Appendix2.xml"/>

+	<xi:include href="http://www.gnu.org/licenses/gpl.xml"/>

+</part>

+	<xi:include href="SBE-glossary.xml"/>

+	<index/>

+</book>