summaryrefslogtreecommitdiff
path: root/docs/docbook/projdoc/winbind.xml
diff options
context:
space:
mode:
authorGerald Carter <jerry@samba.org>2003-07-16 05:34:56 +0000
committerGerald Carter <jerry@samba.org>2003-07-16 05:34:56 +0000
commit4a090ba06a54f5da179ac02bb307cc03d08831bf (patch)
treeed652ef36be7f16682c358816334f969a22f1c27 /docs/docbook/projdoc/winbind.xml
parent95fe82670032a3a43571b46d7bbf2c26bc8cdcd9 (diff)
downloadsamba-4a090ba06a54f5da179ac02bb307cc03d08831bf.tar.gz
samba-4a090ba06a54f5da179ac02bb307cc03d08831bf.tar.bz2
samba-4a090ba06a54f5da179ac02bb307cc03d08831bf.zip
trying to get HEAD building again. If you want the code
prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE (This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad)
Diffstat (limited to 'docs/docbook/projdoc/winbind.xml')
-rw-r--r--docs/docbook/projdoc/winbind.xml167
1 files changed, 83 insertions, 84 deletions
diff --git a/docs/docbook/projdoc/winbind.xml b/docs/docbook/projdoc/winbind.xml
index cb6a56687d..524f05ffa2 100644
--- a/docs/docbook/projdoc/winbind.xml
+++ b/docs/docbook/projdoc/winbind.xml
@@ -6,11 +6,10 @@
<firstname>Tim</firstname><surname>Potter</surname>
<affiliation>
<orgname>Samba Team</orgname>
- <address><email>tpot@linuxcare.com.au</email></address>
+ <address><email>tpot@samba.org</email></address>
</affiliation>
</author>
&author.tridge;
- &author.jht;
<author>
<firstname>Naag</firstname><surname>Mummaneni</surname>
<affiliation>
@@ -18,14 +17,15 @@
</affiliation>
</author>
&author.jelmer;
+ &author.jht;
</authorgroup>
<pubdate>27 June 2002</pubdate>
</chapterinfo>
-<title>Unified Logons between Windows NT and UNIX using Winbind</title>
+<title>Integrated Logon Support using Winbind</title>
<sect1>
- <title>Abstract</title>
+ <title>Features and Benefits</title>
<para>Integration of UNIX and Microsoft Windows NT through
a unified logon has been considered a "holy grail" in heterogeneous
@@ -223,7 +223,9 @@
of that service should be tried and in what order. If the passwd
config line is:</para>
- <para><command>passwd: files example</command></para>
+ <para><programlisting>
+passwd: files example
+ </programlisting></para>
<para>then the C library will first load a module called
<filename>/lib/libnss_files.so</filename> followed by
@@ -337,8 +339,8 @@ the winbind services which come with SAMBA 3.0.
<title>Introduction</title>
<para>
-This HOWTO describes the procedures used to get winbind up and
-running on my RedHat 7.1 system. Winbind is capable of providing access
+This section describes the procedures used to get winbind up and
+running on a RedHat 7.1 system. Winbind is capable of providing access
and authentication control for Windows Domain users through an NT
or Win2K PDC for 'regular' services, such as telnet a nd ftp, as
well for SAMBA services.
@@ -386,7 +388,7 @@ somewhat to fit the way your distribution works.
<title>Requirements</title>
<para>
-If you have a samba configuration file that you are currently
+If you have a Samba configuration file that you are currently
using... <emphasis>BACK IT UP!</emphasis> If your system already uses PAM,
<emphasis>back up the <filename>/etc/pam.d</filename> directory
contents!</emphasis> If you haven't already made a boot disk,
@@ -394,8 +396,8 @@ contents!</emphasis> If you haven't already made a boot disk,
</para>
<para>
-Messing with the pam configuration files can make it nearly impossible
-to log in to yourmachine. That's why you want to be able to boot back
+Messing with the PAM configuration files can make it nearly impossible
+to log in to your machine. That's why you want to be able to boot back
into your machine in single user mode and restore your
<filename>/etc/pam.d</filename> back to the original state they were in if
you get frustrated with the way things are going. ;-)
@@ -428,17 +430,15 @@ install the development packages in <filename>pam-devel-0.74-22</filename>.
<para>
Before starting, it is probably best to kill off all the SAMBA
-related daemons running on your server. Kill off all <command>smbd</command>,
-<command>nmbd</command>, and <command>winbindd</command> processes that may
+related daemons running on your server. Kill off all &smbd;,
+&nmbd;, and &winbindd; processes that may
be running. To use PAM, you will want to make sure that you have the
standard PAM package (for RedHat) which supplies the <filename>/etc/pam.d</filename>
directory structure, including the pam modules are used by pam-aware
services, several pam libraries, and the <filename>/usr/doc</filename>
and <filename>/usr/man</filename> entries for pam. Winbind built better
in SAMBA if the pam-devel package was also installed. This package includes
-the header files needed to compile pam-aware applications. For instance,
-my RedHat system has both <filename>pam-0.74-22</filename> and
-<filename>pam-devel-0.74-22</filename> RPMs installed.
+the header files needed to compile pam-aware applications.
</para>
<sect3>
@@ -450,14 +450,14 @@ The first three steps may not be necessary depending upon
whether or not you have previously built the Samba binaries.
</para>
-<para><programlisting>
-<prompt>root#</prompt> <command>autoconf</command>
-<prompt>root#</prompt> <command>make clean</command>
-<prompt>root#</prompt> <command>rm config.cache</command>
-<prompt>root#</prompt> <command>./configure</command>
-<prompt>root#</prompt> <command>make</command>
-<prompt>root#</prompt> <command>make install</command>
-</programlisting></para>
+<para><screen>
+&rootprompt;<command>autoconf</command>
+&rootprompt;<command>make clean</command>
+&rootprompt;<command>rm config.cache</command>
+&rootprompt;<command>./configure</command>
+&rootprompt;<command>make</command>
+&rootprompt;<command>make install</command>
+</screen></para>
<para>
@@ -473,12 +473,14 @@ It will also build the winbindd executable and libraries.
winbind libraries on Linux and Solaris</title>
<para>
-The libraries needed to run the <command>winbindd</command> daemon
+The libraries needed to run the &winbindd; daemon
through nsswitch need to be copied to their proper locations, so
</para>
<para>
-<prompt>root#</prompt> <command>cp ../samba/source/nsswitch/libnss_winbind.so /lib</command>
+<screen>
+&rootprompt;<userinput>cp ../samba/source/nsswitch/libnss_winbind.so /lib</userinput>
+</screen>
</para>
<para>
@@ -486,19 +488,19 @@ I also found it necessary to make the following symbolic link:
</para>
<para>
-<prompt>root#</prompt> <command>ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2</command>
+&rootprompt; <userinput>ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2</userinput>
</para>
-<para>And, in the case of Sun solaris:</para>
-<para>
-<prompt>root#</prompt> <userinput>ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1</userinput>
-<prompt>root#</prompt> <userinput>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1</userinput>
-<prompt>root#</prompt> <userinput>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2</userinput>
-</para>
+<para>And, in the case of Sun Solaris:</para>
+<screen>
+&rootprompt;<userinput>ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1</userinput>
+&rootprompt;<userinput>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1</userinput>
+&rootprompt;<userinput>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2</userinput>
+</screen>
<para>
Now, as root you need to edit <filename>/etc/nsswitch.conf</filename> to
-allow user and group entries to be visible from the <command>winbindd</command>
+allow user and group entries to be visible from the &winbindd;
daemon. My <filename>/etc/nsswitch.conf</filename> file look like
this after editing:
</para>
@@ -517,7 +519,7 @@ is faster (and you don't need to reboot) if you do it manually:
</para>
<para>
-<prompt>root#</prompt> <command>/sbin/ldconfig -v | grep winbind</command>
+&rootprompt;<userinput>/sbin/ldconfig -v | grep winbind</userinput>
</para>
<para>
@@ -566,11 +568,11 @@ url="http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixbman/baseadmn/ia
<para>
Several parameters are needed in the smb.conf file to control
-the behavior of <command>winbindd</command>. Configure
-<filename>smb.conf</filename> These are described in more detail in
+the behavior of &winbindd;. Configure
+&smb.conf; These are described in more detail in
the <citerefentry><refentrytitle>winbindd</refentrytitle>
<manvolnum>8</manvolnum></citerefentry> man page. My
-<filename>smb.conf</filename> file was modified to
+&smb.conf; file was modified to
include the following entries in the [global] section:
</para>
@@ -580,9 +582,9 @@ include the following entries in the [global] section:
# separate domain and username with '+', like DOMAIN+username
<ulink url="winbindd.8.html#WINBINDSEPARATOR">winbind separator</ulink> = +
# use uids from 10000 to 20000 for domain users
- <ulink url="winbindd.8.html#WINBINDUID">winbind uid</ulink> = 10000-20000
+ <ulink url="winbindd.8.html#WINBINDUID">idmap uid</ulink> = 10000-20000
# use gids from 10000 to 20000 for domain groups
- <ulink url="winbindd.8.html#WINBINDGID">winbind gid</ulink> = 10000-20000
+ <ulink url="winbindd.8.html#WINBINDGID">idmap gid</ulink> = 10000-20000
# allow enumeration of winbind users and groups
<ulink url="winbindd.8.html#WINBINDENUMUSERS">winbind enum users</ulink> = yes
<ulink url="winbindd.8.html#WINBINDENUMGROUP">winbind enum groups</ulink> = yes
@@ -606,7 +608,7 @@ a domain user who has administrative privileges in the domain.
<para>
-<prompt>root#</prompt> <command>/usr/local/samba/bin/net join -S PDC -U Administrator</command>
+&rootprompt;<userinput>/usr/local/samba/bin/net join -S PDC -U Administrator</userinput>
</para>
@@ -631,7 +633,7 @@ command as root:
</para>
<para>
-<prompt>root#</prompt> <command>/usr/local/samba/bin/winbindd</command>
+&rootprompt;<userinput>/usr/local/samba/bin/winbindd</userinput>
</para>
<para>
@@ -640,11 +642,11 @@ run as 2 processes. The first will answer all requests from the cache,
thus making responses to clients faster. The other will
update the cache for the query that the first has just responded.
Advantage of this is that responses stay accurate and are faster.
-You can enable dual daemon mode by adding '-B' to the commandline:
+You can enable dual daemon mode by adding <option>-B</option> to the commandline:
</para>
<para>
-<prompt>root#</prompt> <command>/usr/local/samba/bin/winbindd -B</command>
+&rootprompt;<userinput>/usr/local/samba/bin/winbindd -B</userinput>
</para>
<para>
@@ -653,14 +655,14 @@ is really running...
</para>
<para>
-<prompt>root#</prompt> <command>ps -ae | grep winbindd</command>
+&rootprompt;<userinput>ps -ae | grep winbindd</userinput>
</para>
<para>
This command should produce output like this, if the daemon is running
</para>
-<para>
+<screen>
3025 ? 00:00:00 winbindd
-</para>
+</screen>
<para>
Now... for the real test, try to get some information about the
@@ -668,7 +670,7 @@ users on your PDC
</para>
<para>
-<prompt>root#</prompt> <command>/usr/local/samba/bin/wbinfo -u</command>
+&rootprompt;<userinput>/usr/local/samba/bin/wbinfo -u</userinput>
</para>
<para>
@@ -676,14 +678,14 @@ This should echo back a list of users on your Windows users on
your PDC. For example, I get the following response:
</para>
-<para><programlisting>
+<para><screen>
CEO+Administrator
CEO+burdell
CEO+Guest
CEO+jt-ad
CEO+krbtgt
CEO+TsInternetUser
-</programlisting></para>
+</screen></para>
<para>
Obviously, I have named my domain 'CEO' and my <parameter>winbind
@@ -695,8 +697,8 @@ You can do the same sort of thing to get group information from
the PDC:
</para>
-<para><programlisting>
-<prompt>root#</prompt> <command>/usr/local/samba/bin/wbinfo -g</command>
+<para><screen>
+&rootprompt;<userinput>/usr/local/samba/bin/wbinfo -g</userinput>
CEO+Domain Admins
CEO+Domain Users
CEO+Domain Guests
@@ -706,7 +708,7 @@ the PDC:
CEO+Schema Admins
CEO+Enterprise Admins
CEO+Group Policy Creator Owners
-</programlisting></para>
+</screen></para>
<para>
The function 'getent' can now be used to get unified
@@ -715,7 +717,7 @@ Try the following command:
</para>
<para>
-<prompt>root#</prompt> <command>getent passwd</command>
+&rootprompt;<userinput>getent passwd</userinput>
</para>
<para>
@@ -729,7 +731,7 @@ The same thing can be done for groups with the command
</para>
<para>
-<prompt>root#</prompt> <command>getent group</command>
+&rootprompt;<userinput>getent group</userinput>
</para>
</sect3>
@@ -742,14 +744,13 @@ The same thing can be done for groups with the command
<title>Linux</title>
<para>
-The <command>winbindd</command> daemon needs to start up after the
-<command>smbd</command> and <command>nmbd</command> daemons are running.
+The &winbindd; daemon needs to start up after the
+&smbd; and &nmbd; daemons are running.
To accomplish this task, you need to modify the startup scripts of your system.
They are located at <filename>/etc/init.d/smb</filename> in RedHat and
<filename>/etc/init.d/samba</filename> in Debian.
script to add commands to invoke this daemon in the proper sequence. My
-startup script starts up <command>smbd</command>,
-<command>nmbd</command>, and <command>winbindd</command> from the
+startup script starts up &smbd;, &nmbd;, and &winbindd; from the
<filename>/usr/local/samba/bin</filename> directory directly. The 'start'
function in the script looks like this:
</para>
@@ -822,9 +823,9 @@ stop() {
<sect4>
<title>Solaris</title>
-<para>Winbind doesn't work on solaris 9, see the <link linkend="winbind-solaris9">Portability</link> chapter for details.</para>
+<para>Winbind doesn't work on Solaris 9, see the <link linkend="winbind-solaris9">Portability</link> chapter for details.</para>
-<para>On solaris, you need to modify the
+<para>On Solaris, you need to modify the
<filename>/etc/init.d/samba.server</filename> startup script. It usually
only starts smbd and nmbd but should now start winbindd too. If you
have samba installed in <filename>/usr/local/samba/bin</filename>,
@@ -898,8 +899,7 @@ in the script above with:
<sect4>
<title>Restarting</title>
<para>
-If you restart the <command>smbd</command>, <command>nmbd</command>,
-and <command>winbindd</command> daemons at this point, you
+If you restart the &smbd;, &nmbd;, and &winbindd; daemons at this point, you
should be able to connect to the samba server as a domain member just as
if you were a local user.
</para>
@@ -924,7 +924,7 @@ by invoking the command
</para>
<para>
-<prompt>root#</prompt> <command>make nsswitch/pam_winbind.so</command>
+&rootprompt;<userinput>make nsswitch/pam_winbind.so</userinput>
</para>
<para>
@@ -936,7 +936,7 @@ modules reside in <filename>/usr/lib/security</filename>.
</para>
<para>
-<prompt>root#</prompt> <command>cp ../samba/source/nsswitch/pam_winbind.so /lib/security</command>
+&rootprompt;<userinput>cp ../samba/source/nsswitch/pam_winbind.so /lib/security</userinput>
</para>
<sect4>
@@ -944,7 +944,7 @@ modules reside in <filename>/usr/lib/security</filename>.
<para>
The <filename>/etc/pam.d/samba</filename> file does not need to be changed. I
-just left this fileas it was:
+just left this file as it was:
</para>
@@ -981,8 +981,8 @@ For ftp services to work properly, you will also need to either
have individual directories for the domain users already present on
the server, or change the home directory template to a general
directory for all domain users. These can be easily set using
-the <filename>smb.conf</filename> global entry
-<command>template homedir</command>.
+the &smb.conf; global entry
+<parameter>template homedir</parameter>.
</para>
<para>
@@ -1022,8 +1022,8 @@ same way. It now looks like this:
</programlisting></para>
<para>
-In this case, I added the <command>auth sufficient /lib/security/pam_winbind.so</command>
-lines as before, but also added the <command>required pam_securetty.so</command>
+In this case, I added the <programlisting>auth sufficient /lib/security/pam_winbind.so</programlisting>
+lines as before, but also added the <programlisting>required pam_securetty.so</programlisting>
above it, to disallow root logins over the network. I also added a
<command>sufficient /lib/security/pam_unix.so use_first_pass</command>
line after the <command>winbind.so</command> line to get rid of annoying
@@ -1124,7 +1124,19 @@ configured in the pam.conf.
</sect1>
<sect1>
- <title>Limitations</title>
+<title>Conclusion</title>
+
+ <para>The winbind system, through the use of the Name Service
+ Switch, Pluggable Authentication Modules, and appropriate
+ Microsoft RPC calls have allowed us to provide seamless
+ integration of Microsoft Windows NT domain users on a
+ UNIX system. The result is a great reduction in the administrative
+ cost of running a mixed UNIX and NT network.</para>
+
+</sect1>
+
+<sect1>
+<title>Common Errors</title>
<para>Winbind has a number of limitations in its current
released version that we hope to overcome in future
@@ -1137,7 +1149,7 @@ configured in the pam.conf.
we require the C library of the target operating system to
support the Name Service Switch and Pluggable Authentication
Modules systems. This is becoming more common as NSS and
- PAM gain support among UNIX vendors.</para></listitem>
+ PAM gain support among UNIX vendors.</para></listitem>
<listitem><para>The mappings of Windows NT RIDs to UNIX ids
is not made algorithmically and depends on the order in which
@@ -1153,17 +1165,4 @@ configured in the pam.conf.
</itemizedlist>
</sect1>
-
-<sect1>
- <title>Conclusion</title>
-
- <para>The winbind system, through the use of the Name Service
- Switch, Pluggable Authentication Modules, and appropriate
- Microsoft RPC calls have allowed us to provide seamless
- integration of Microsoft Windows NT domain users on a
- UNIX system. The result is a great reduction in the administrative
- cost of running a mixed UNIX and NT network.</para>
-
-</sect1>
-
</chapter>