I'm still working on this. More to come.

(This used to be commit cb2172541849c96c9156233da9b34e5e08801ae3)

1 files changed, 170 insertions, 130 deletions

diff --git a/docs/docbook/projdoc/upgrading-to-3.0.xml b/docs/docbook/projdoc/upgrading-to-3.0.xml
index 74af0cbb9e..4461f0fdcb 100644
--- a/docs/docbook/projdoc/upgrading-to-3.0.xml
+++ b/docs/docbook/projdoc/upgrading-to-3.0.xml
@@ -8,83 +8,123 @@
 
 <title>Upgrading from Samba-2.x to Samba-3.0.0</title>
 
+<para>
+This chapter deals exclusively with the differences between Samba-3.0.0 and Samba-2.2.8a.
+It points out where configuration parameters have changed, and provides a simple guide for 
+the move from 2.2.x to 3.0.0.
+</para>
+
+<sect1>
+<title>Quick Migration Guide</title>
+
+<para>
+Samba-3.0.0 default behavior should be approximately the same as Samba-2.2.x.
+The default behavior when the new parameter <smbconfoption><name>passdb backend</name></smbconfoption>
+is not defined in the &smb.conf; file provides the same default behviour as Samba-2.2.x
+with <smbconfoption><name>encrypt passwords</name><value>Yes</value></smbconfoption>, and
+will use the <filename>smbpasswd</filename> database.
+</para>
+
+<para>
+So why say that <emphasis>behavior should be approximately the same as Samba-2.2.x?</emphasis> Because
+Samba-3.0.0 can negotiate new protocols, such as support for native Unicode, that may result in
+differing protocol code paths being taken. The new behavior under such circumstances is not
+exactly the same as the old one. The good news is that the domain and machine SIDs will be
+preserved across the upgrade.
+</para>
+
+<para>
+If the Samba-2.2.x system was using an LDAP backend, and there is no time to update the LDAP
+database, then make sure that <smbconfoption><name>passdb backend</name><value>ldapsam_compat</value></smbconfoption>
+is specified in the &smb.conf; file. For the rest, behavior should remain more or less the same.
+At a later date, when there is time to implement a new Samba-3 compatible LDAP backend, it is possible
+to migrate the old LDAP database to the new one through use of the <command>pdbedit</command>.
+See <link linkend="pdbeditthing"/>.
+</para>
+
+</sect1>
 
 <sect1>
 <title>New Features in Samba-3</title>
 
 <para>
-Major new features:
+The major new features are:
 </para>
 
-<orderedlist>
+<orderedlist numberation="arabic">
 	<listitem><para>
-	Active Directory support. This release is able to join a ADS realm
+	Active Directory support. This release is able to join an ADS realm
 	as a member server and authenticate users using LDAP/kerberos.
 	</para></listitem>
 
 	<listitem><para>
-	Unicode support. Samba will now negotiate UNICODE on the wire and
-	internally there is now a much better infrastructure for multi-byte
-	and UNICODE character sets.
+	Unicode support. Samba will now negotiate unicode on the wire and
+	internally there is a much better infrastructure for multi-byte
+	and unicode character sets.
 	</para></listitem>
 
 	<listitem><para>
 	New authentication system. The internal authentication system has
 	been almost completely rewritten. Most of the changes are internal,
-	but the new auth system is also very configurable.
+	but the new authoring system is also very configurable.
 	</para></listitem>
 
 	<listitem><para>
 	New filename mangling system. The filename mangling system has been
 	completely rewritten. An internal database now stores mangling maps
-	persistently. This needs lots of testing.
+	persistently.
 	</para></listitem>
 
 	<listitem><para>
-	New "net" command. A new "net" command has been added. It is
-	somewhat similar to the "net" command in windows. Eventually we
+	New <quote>net</quote> command. A new <quote>net</quote> command has been added. It is
+	somewhat similar to the <quote>net</quote> command in Windows. Eventually, we
 	plan to replace a bunch of other utilities (such as smbpasswd)
-	with subcommands in "net", at the moment only a few things are
-	implemented.
+	with subcommands in <quote>net</quote>.
 	</para></listitem>
 
 	<listitem><para>
 	Samba now negotiates NT-style status32 codes on the wire. This
-	improves error handling a lot.
+	considerably improves error handling.
 	</para></listitem>
 
 	<listitem><para>
-	Better Windows 2000/XP/2003 printing support including publishing
-	printer attributes in active directory
+	Better Windows 200x/XP printing support including publishing
+	printer attributes in Active Directory.
 	</para></listitem>
 
 	<listitem><para>
-	New loadable RPC modules
+	New loadable RPC modules for passdb backends and character sets.
 	</para></listitem>
 
 	<listitem><para>
-	New dual-daemon winbindd support (-B) for better performance
+	New default dual-daemon winbindd support for better performance.
 	</para></listitem>
 
 	<listitem><para>
 	Support for migrating from a Windows NT 4.0 domain to a Samba
-	domain and maintaining user, group and domain SIDs
+	domain and maintaining user, group and domain SIDs.
 	</para></listitem>
 
 	<listitem><para>
 	Support for establishing trust relationships with Windows NT 4.0
-	domain controllers
+	Domain Controllers.
 	</para></listitem>
 
 	<listitem><para>
 	Initial support for a distributed Winbind architecture using
-	an LDAP directory for storing SID to uid/gid mappings
+	an LDAP directory for storing SID to UID/GID mappings.
 	</para></listitem>
 
 	<listitem><para>
 	Major updates to the Samba documentation tree.
 	</para></listitem>
+
+	<listitem><para>
+	Full support for client and server SMB signing to ensure
+	compatibility with default Windows 2003 security settings.
+	</para></listitem>
 </orderedlist>
+
 <para>
 Plus lots of other improvements!
 </para>
@@ -95,15 +135,15 @@ Plus lots of other improvements!
 <title>Configuration Parameter Changes</title>
 
 <para>
-This section contains a brief listing of changes to smb.conf options
-in the 3.0.0 release.  Please refer to the smb.conf(5) man page for
+This section contains a brief listing of changes to &smb.conf; options
+in the 3.0.0 release. Please refer to the smb.conf(5) man page for
 complete descriptions of new or modified parameters.
 </para>
 
 <sect2>
 <title>Removed Parameters</title>
 
-<para>(order alphabetically):</para>
+<para>(Ordered Alphabetically):</para>
 
 <itemizedlist>
 	<listitem><para>admin log </para></listitem>
@@ -121,6 +161,7 @@ complete descriptions of new or modified parameters.
 	<listitem><para>printer driver file </para></listitem>
 	<listitem><para>printer driver location </para></listitem>
 	<listitem><para>status </para></listitem>
+	<listitem><para>stip dot </para></listitem>
 	<listitem><para>total print jobs </para></listitem>
 	<listitem><para>use rhosts </para></listitem>
 	<listitem><para>valid chars </para></listitem>
@@ -132,16 +173,16 @@ complete descriptions of new or modified parameters.
 <sect2>
 <title>New Parameters</title>
 
-<para>(new parameters have been grouped by function):</para>
+<para>(New parameters have been grouped by function):</para>
 
-<para>Remote management</para>
+<para>Remote Management</para>
 
 <itemizedlist>
 	<listitem><para>abort shutdown script </para></listitem>
 	<listitem><para>shutdown script </para></listitem>
 </itemizedlist>
 
-<para>User and Group Account Management</para>
+<para>User and Group Account Management:</para>
 
 <itemizedlist>
 	<listitem><para>add group script </para></listitem>
@@ -154,15 +195,14 @@ complete descriptions of new or modified parameters.
 	<listitem><para>set primary group script </para></listitem>
 </itemizedlist>
 
-<para>Authentication</para>
+<para>Authentication:</para>
 
 <itemizedlist>
 	<listitem><para>auth methods </para></listitem>
-	<listitem><para>ads server </para></listitem>
 	<listitem><para>realm </para></listitem>
 </itemizedlist>
 
-<para>Protocol Options</para>
+<para>Protocol Options:</para>
 
 <itemizedlist>
 	<listitem><para>client lanman auth </para></listitem>
@@ -174,11 +214,12 @@ complete descriptions of new or modified parameters.
 	<listitem><para>ntlm auth </para></listitem>
 	<listitem><para>paranoid server security </para></listitem>
 	<listitem><para>server schannel </para></listitem>
+	<listitem><para>server signing </para></listitem>
 	<listitem><para>smb ports </para></listitem>
 	<listitem><para>use spnego </para></listitem>
 </itemizedlist>
 
-<para>File Service</para>
+<para>File Service:</para>
 
 <itemizedlist>
 	<listitem><para>get quota command </para></listitem>
@@ -187,38 +228,42 @@ complete descriptions of new or modified parameters.
 	<listitem><para>hostname lookups </para></listitem>
 	<listitem><para>kernel change notify </para></listitem>
 	<listitem><para>mangle prefix </para></listitem>
+	<listitem><para>map acl inherit </para></listitem>
 	<listitem><para>msdfs proxy </para></listitem>
 	<listitem><para>set quota command </para></listitem>
 	<listitem><para>use sendfile </para></listitem>
 	<listitem><para>vfs objects </para></listitem>
 </itemizedlist>
 
-<para>Printing</para>
+<para>Printing:</para>
 
 <itemizedlist>
 	<listitem><para>max reported print jobs </para></listitem>
 </itemizedlist> 
 
 
-<para>UNICODE and Character Sets</para>
+<para>Unicode and Character Sets:</para>
 
 <itemizedlist>
 	<listitem><para>display charset </para></listitem>
 	<listitem><para>dos charset </para></listitem>
 	<listitem><para>unicode </para></listitem>
-	<listitem><para>unix charset </para></listitem>
+	<listitem><para>UNIX charset </para></listitem>
 </itemizedlist>
 
-<para>SID to uid/gid Mappings</para>
+<para>SID to UID/GID Mappings:</para>
 
 <itemizedlist>
 	<listitem><para>idmap backend </para></listitem>
 	<listitem><para>idmap gid </para></listitem>
-	<listitem><para>idmap only </para></listitem>
 	<listitem><para>idmap uid </para></listitem>
+	<listitem><para>winbind enable local accounts </para></listitem>
+	<listitem><para>winbind trusted domains only </para></listitem>
+	<listitem><para>template primary group </para></listitem>
+	<listitem><para>enable rid algorithm </para></listitem>
 </itemizedlist>
 
-<para>LDAP</para>
+<para>LDAP:</para>
 
 <itemizedlist>
 	<listitem><para>ldap delete dn </para></listitem>
@@ -230,7 +275,7 @@ complete descriptions of new or modified parameters.
 	<listitem><para>ldap user suffix </para></listitem>
 </itemizedlist>
 
-<para>General Configuration</para>
+<para>General Configuration:</para>
 
 <itemizedlist>
 	<listitem><para>preload modules </para></listitem>
@@ -240,19 +285,20 @@ complete descriptions of new or modified parameters.
 </sect2>
 
 <sect2>
-<title>Modified Parameters (changes in behavior):</title>
+<title>Modified Parameters (Changes in Behavior):</title>
 
 <itemizedlist>
 	<listitem><para>encrypt passwords (enabled by default) </para></listitem>
-	<listitem><para>mangling method (set to 'hash2' by default) </para></listitem>
+	<listitem><para>mangling method (set to hash2 by default) </para></listitem>
 	<listitem><para>passwd chat </para></listitem>
 	<listitem><para>passwd program </para></listitem>
+	<listitem><para>password server </para></listitem>
 	<listitem><para>restrict anonymous (integer value) </para></listitem>
-	<listitem><para>security (new 'ads' value) </para></listitem>
+	<listitem><para>security (new ads value) </para></listitem>
 	<listitem><para>strict locking (enabled by default) </para></listitem>
 	<listitem><para>winbind cache time (increased to 5 minutes) </para></listitem>
-	<listitem><para>winbind uid (deprecated in favor of 'idmap uid') </para></listitem>
-	<listitem><para>winbind gid (deprecated in favor of 'idmap gid') </para></listitem>
+	<listitem><para>winbind uid (deprecated in favor of idmap uid) </para></listitem>
+	<listitem><para>winbind gid (deprecated in favor of idmap gid) </para></listitem>
 </itemizedlist>
 
 </sect2>
@@ -267,17 +313,21 @@ complete descriptions of new or modified parameters.
 
 	<para>
 	This section contains brief descriptions of any new databases
-	introduced in Samba 3.0.  Please remember to backup your existing
-	${lock directory}/*tdb before upgrading to Samba 3.0.  Samba will
+	introduced in Samba-3. Please remember to backup your existing
+	${lock directory}/*tdb before upgrading to Samba-3. Samba will
 	upgrade databases as they are opened (if necessary), but downgrading
 	from 3.0 to 2.2 is an unsupported path.
 	</para>
 
+	<para>
+	The new tdb files are described in <link linkend="tdbfiledesc"/>.
+	</para>
+
 
-        <table frame='all'><title>TDB File Descriptions</title>
+        <table frame='all' id="tdbfiledesc"><title>TDB File Descriptions</title>
         <tgroup cols='3'>
 			<colspec align="left"/>
-			<colspec align="justify"/>
+			<colspec align="justify" width="1*"/>
 			<colspec align="left"/>
                 <thead>
                 <row>
@@ -299,12 +349,12 @@ complete descriptions of new or modified parameters.
 		</row>
 		<row>
 			<entry>group_mapping</entry>
-			<entry><para>Mapping table from Windows groups/SID to unix groups</para></entry>
+			<entry><para>Mapping table from Windows groups/SID to UNIX groups</para></entry>
 			<entry>yes</entry>
 		</row>
 		<row>
 			<entry>idmap</entry>
-			<entry><para>new ID map table from SIDS to UNIX uids/gids</para></entry>
+			<entry><para>new ID map table from SIDS to UNIX UIDs/GIDs</para></entry>
 			<entry>yes</entry>
 		</row>
 		<row>
@@ -320,14 +370,14 @@ complete descriptions of new or modified parameters.
 		</row>
 		<row>
 			<entry>printing/*.tdb</entry>
-			<entry><para>Cached output from 'lpq command' created on a per print 
+			<entry><para>Cached output from `lpq command' created on a per print 
 				service basis</para></entry>
 			<entry>no</entry>
 		</row>
 		<row>
 
 			<entry>registry</entry>
-			<entry><para>Read-only samba registry skeleton that provides support for
+			<entry><para>Read-only Samba registry skeleton that provides support for
 				exporting various db tables via the winreg RPCs</para></entry>
 			<entry>no</entry>
 		</row>
@@ -341,26 +391,26 @@ complete descriptions of new or modified parameters.
 	<title>Changes in Behavior</title>
 
 	<para>
-	The following issues are known changes in behavior between Samba 2.2 and
-	Samba 3.0 that may affect certain installations of Samba.
+	The following issues are known changes in behavior between Samba-2.2 and
+	Samba-3 that may affect certain installations of Samba.
 	</para>
 
 	<orderedlist>
 		<listitem><para>
-		When operating as a member of a Windows domain, Samba 2.2 would
-		map any users authenticated by the remote DC to the 'guest account'
-		if a uid could not be obtained via the getpwnam() call.  Samba 3.0
-		rejects the connection as NT_STATUS_LOGON_FAILURE.  There is no
-		current work around to re-establish the 2.2 behavior.
+		When operating as a member of a Windows domain, Samba-2.2 would
+		map any users authenticated by the remote DC to the <quote>guest account</quote>
+		if a uid could not be obtained via the getpwnam() call. Samba-3
+		rejects the connection as <?latex \linebreak ?>NT_STATUS_LOGON_FAILURE. There is no
+		current work around to re-establish the Samba-2.2 behavior.
 		</para></listitem>
 
 		<listitem><para>
-		When adding machines to a Samba 2.2 controlled domain, the
-		'add user script' was used to create the UNIX identity of the
-		machine trust account.  Samba 3.0 introduces a new 'add machine
-		script' that must be specified for this purpose.  Samba 3.0 will
-		not fall back to using the 'add user script' in the absence of
-		an 'add machine script'
+		When adding machines to a Samba-2.2 controlled domain, the
+		<quote>add user script</quote> was used to create the UNIX identity of the
+		Machine Trust Account. Samba-3 introduces a new <quote>add machine
+		script</quote> that must be specified for this purpose. Samba-3 will
+		not fall back to using the <quote>add user script</quote> in the absence of
+		an <quote>add machine script</quote>.
 		</para></listitem>
 	</orderedlist>
 
@@ -371,8 +421,7 @@ complete descriptions of new or modified parameters.
 
 	<para>
 	You might experience problems with special characters when communicating with old DOS
-	clients. Codepage support has changed in samba 3.0. Read the chapter
-	<link linkend="unicode">Unicode support</link> for details.
+	clients. Codepage support has changed in Samba-3. Read <link linkend="unicode"/>, for details.
 	</para>
 
 	</sect2>
@@ -382,52 +431,41 @@ complete descriptions of new or modified parameters.
 
 	<para>
 	There have been a few new changes that Samba administrators should be
-	aware of when moving to Samba 3.0.
+	aware of when moving to Samba-3.
 	</para>
 
 	<orderedlist>
 		<listitem><para>
 		Encrypted passwords have been enabled by default in order to
-		inter-operate better with out-of-the-box Windows client
-		installations.  This does mean that either (a) a samba account
-		must be created for each user, or (b) 'encrypt passwords = no'
-		must be explicitly defined in smb.conf.
+		interoperate better with out-of-the-box Windows client
+		installations. This does mean that either (a) a Samba account
+		must be created for each user, or (b) <quote>encrypt passwords = no</quote>
+		must be explicitly defined in &smb.conf;.
 		</para></listitem>
 
 		<listitem><para>
-				Inclusion of new <smbconfoption><name>security</name><value>ads</value></smbconfoption> option for integration
-		with an Active Directory domain using the native Windows
-		Kerberos 5 and LDAP protocols.
+		Inclusion of new <smbconfoption><name>security</name><value>ads</value></smbconfoption> option for integration
+		with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols.
 		</para></listitem>
 	</orderedlist>
 
 	<para>
-	Samba 3.0 also includes the possibility of setting up chains
+	Samba-3 also includes the possibility of setting up chains
 	of authentication methods 
 	(<smbconfoption><name>auth methods</name></smbconfoption>) and account
 	storage backends 
 	(<smbconfoption><name>passdb backend</name></smbconfoption>). 
 	Please refer to the &smb.conf;
-	man page and <link linkend="passdb">the chapter about account information databases</link> for details.  While both parameters assume sane default
+	man page and <link linkend="passdb"/>, for details. While both parameters assume sane default
 	values, it is likely that you will need to understand what the
 	values actually mean in order to ensure Samba operates correctly.
 	</para>
 
 	<para>
-	Certain functions of the smbpasswd(8) tool have been split between the
-	new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8)
-	utility.  See the respective man pages for details.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Charsets</title>
-
-	<para>
-	You might experience problems with special characters when communicating with old DOS
-	clients. Codepage support has changed in samba 3.0. Read the chapter
-	<link linkend="unicode">Unicode support</link> for details.
+<indexterm><primary>pdbedit</primary></indexterm>
+	Certain functions of the <command>smbpasswd</command> tool have been split between the
+	new <command>smbpasswd</command> utility, the <command>net</command> tool and the new <command>pdbedit</command>
+	utility. See the respective man pages for details.
 	</para>
 
 	</sect2>
@@ -436,7 +474,7 @@ complete descriptions of new or modified parameters.
 	<title>LDAP</title>
 
 	<para>
-	This section outlines the new features affecting Samba / LDAP integration.
+	This section outlines the new features effecting Samba/LDAP integration.
 	</para>
 
 		<sect3>
@@ -444,14 +482,14 @@ complete descriptions of new or modified parameters.
 
 		<para>
 		A new object class (sambaSamAccount) has been introduced to replace
-		the old sambaAccount.  This change aids us in the renaming of attributes
-		to prevent clashes with attributes from other vendors.  There is a
-		conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF
+		the old sambaAccount. This change aids us in the renaming of attributes
+		to prevent clashes with attributes from other vendors. There is a
+		conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF
 		file to the new schema.
 		</para>
 
 		<para>
-			Example:
+		Example:
 		</para>
 		<para><screen>
 		&prompt;ldapsearch .... -b "ou=people,dc=..." &gt; old.ldif
@@ -459,17 +497,20 @@ complete descriptions of new or modified parameters.
 		</screen></para>
 
 		<para>
-		The &lt;DOM SID&gt; can be obtained by running 'net getlocalsid &lt;DOMAINNAME&gt;
+		The &lt;DOM SID&gt; can be obtained by running 
+<screen>
+&prompt;<userinput>net getlocalsid &lt;DOMAINNAME&gt;</userinput>
+</screen>
 		on the Samba PDC as root.
 		</para>
 
 		<para>
 		The old sambaAccount schema may still be used by specifying the
-		"ldapsam_compat" passdb backend.  However, the sambaAccount and
+		<parameter>ldapsam_compat</parameter> passdb backend. However, the sambaAccount and
 		associated attributes have been moved to the historical section of
 		the schema file and must be uncommented before use if needed.
-		The 2.2 object class declaration for a sambaAccount has not changed
-		in the 3.0 samba.schema file.
+		The Samba-2.2 object class declaration for a sambaAccount has not changed
+		in the Samba-3 samba.schema file.
 		</para>
 
 		<para>
@@ -478,29 +519,29 @@ complete descriptions of new or modified parameters.
 
 		<itemizedlist>
 			<listitem><para>
-			sambaDomain - domain information used to allocate rids
-			for users and groups as necessary.  The attributes are added
-			in 'ldap suffix' directory entry automatically if
-			an idmap uid/gid range has been set and the 'ldapsam'
+			sambaDomain &smbmdash; domain information used to allocate RIDs
+			for users and groups as necessary. The attributes are added
+			in <quote>ldap suffix</quote> directory entry automatically if
+			an idmap UID/GID range has been set and the <quote>ldapsam</quote>
 			passdb backend has been selected.
 			</para></listitem>
 
 			<listitem><para>
-			sambaGroupMapping - an object representing the
+			sambaGroupMapping &smbmdash; an object representing the
 			relationship between a posixGroup and a Windows
-			group/SID.  These entries are stored in the 'ldap
-			group suffix' and managed by the 'net groupmap' command.
+			group/SID. These entries are stored in the <quote>ldap
+			group suffix</quote> and managed by the <quote>net groupmap</quote> command.
 			</para></listitem>
 
 			<listitem><para>
-			sambaUnixIdPool - created in the 'ldap idmap suffix' entry
-			automatically and contains the next available 'idmap uid' and
-			'idmap gid'
+			sambaUNIXIdPool &smbmdash; created in the <quote>ldap idmap suffix</quote> entry
+			automatically and contains the next available <quote>idmap UID</quote> and
+			<quote>idmap GID</quote>.
 			</para></listitem>
 
 			<listitem><para>
-			sambaIdmapEntry - object storing a mapping between a
-			SID and a UNIX uid/gid.  These objects are created by the
+			sambaIdmapEntry &smbmdash; object storing a mapping between a
+			SID and a UNIX UID/GID. These objects are created by the
 			idmap_ldap module as needed.
 			</para></listitem>
 		</itemizedlist>
@@ -512,55 +553,54 @@ complete descriptions of new or modified parameters.
 
 		<para>
 		The following new smb.conf parameters have been added to aid in directing
-		certain LDAP queries when 'passdb backend = ldapsam://...' has been
+		certain LDAP queries when <parameter>passdb backend = ldapsam://...</parameter> has been
 		specified.
 		</para>
 
 		<itemizedlist>
-			<listitem><para>ldap suffix         - used to search for user and computer accounts</para></listitem>
-			<listitem><para>ldap user suffix    - used to store user accounts</para></listitem>
-			<listitem><para>ldap machine suffix - used to store machine trust accounts</para></listitem>
-			<listitem><para>ldap group suffix   - location of posixGroup/sambaGroupMapping entries</para></listitem>
-			<listitem><para>ldap idmap suffix   - location of sambaIdmapEntry objects</para></listitem>
+			<listitem><para>ldap suffix         &smbmdash; used to search for user and computer accounts.</para></listitem>
+			<listitem><para>ldap user suffix    &smbmdash; used to store user accounts.</para></listitem>
+			<listitem><para>ldap machine suffix &smbmdash; used to store Machine Trust Accounts.</para></listitem>
+			<listitem><para>ldap group suffix   &smbmdash; location of posixGroup/sambaGroupMapping entries.</para></listitem>
+			<listitem><para>ldap idmap suffix   &smbmdash; location of sambaIdmapEntry objects.</para></listitem>
 		</itemizedlist>
 
 		<para>
-		If an 'ldap suffix' is defined, it will be appended to all of the
-		remaining sub-suffix parameters.  In this case, the order of the suffix
-		listings in smb.conf is important.  Always place the 'ldap suffix' first
+		If an <parameter>ldap suffix</parameter> is defined, it will be appended to all of the
+		remaining sub-suffix parameters. In this case, the order of the suffix
+		listings in smb.conf is important. Always place the <parameter>ldap suffix</parameter> first
 		in the list.
 		</para>
 
 		<para>
-		Due to a limitation in Samba's smb.conf parsing, you should not surround
-		the DN's with quotation marks.
+		Due to a limitation in Samba's &smb.conf; parsing, you should not surround
+		the DNs with quotation marks.
 		</para>
 
 		</sect3>
 
 		<sect3>
-		<title>IdMap LDAP support</title>
+		<title>IdMap LDAP Support</title>
 
 		<para>
-		Samba 3.0 supports an ldap backend for the idmap subsystem.  The
-		following options would inform Samba that the idmap table should be
-		stored on the directory server onterose in the "ou=idmap,dc=plainjoe,
-		dc=org" partition.
+		Samba-3 supports an ldap backend for the idmap subsystem. The
+		following options inform Samba that the idmap table should be
+		stored on the directory server onterose in the "ou=idmap,dc=quenya,dc=org" partition.
 		</para>
 
 		<smbconfblock>
 		<smbconfsection>[global]</smbconfsection>
 		<member>...</member>
 		<smbconfoption><name>idmap backend</name><value>ldap:ldap://onterose/</value></smbconfoption>
-		<smbconfoption><name>ldap idmap suffix</name><value>ou=idmap,dc=plainjoe,dc=org</value></smbconfoption>
+		<smbconfoption><name>ldap idmap suffix</name><value>ou=idmap,dc=quenya,dc=org</value></smbconfoption>
 		<smbconfoption><name>idmap uid</name><value>40000-50000</value></smbconfoption>
 		<smbconfoption><name>idmap gid</name><value>40000-50000</value></smbconfoption>
 		</smbconfblock>
 
 		<para>
-		This configuration allows winbind installations on multiple servers to
-		share a uid/gid number space, thus avoiding the interoperability problems
-		with NFS that were present in Samba 2.2.
+		This configuration allows Winbind installations on multiple servers to
+		share a UID/GID number space, thus avoiding the interoperability problems
+		with NFS that were present in Samba-2.2.
 		</para>
 
 		</sect3>