This commit was manufactured by cvs2svn to create branch 'SAMBA_3_0'.(This used to be commit 6cd4d3f39a1258d51c022c99c73a7341b0ff94a5)

4 files changed, 2603 insertions, 0 deletions

diff --git a/docs/docbook/projdoc/CUPS-printing.sgml b/docs/docbook/projdoc/CUPS-printing.sgml
new file mode 100644
index 0000000000..a932127d94
--- /dev/null
+++ b/docs/docbook/projdoc/CUPS-printing.sgml
@@ -0,0 +1,1357 @@
+<chapter id="CUPS-printing">
+
+
+<chapterinfo>
+	<author>
+		<firstname>John H</firstname><surname>Terpstra</surname>
+		<affiliation>
+			<orgname>Samba Team</orgname>
+			<address>
+				<email>jht@samba.org</email>
+			</address>
+		</affiliation>
+	</author>
+	<author>
+		<firstname>Kurt</firstname><surname>Pfeifle</surname>
+		<affiliation>
+			<address><email>kpfeifle@danka.de</email></address>
+		</affiliation>
+	</author>
+	<pubdate> (25 March 2003) </pubdate>
+</chapterinfo>
+
+<title>CUPS Printing Support</title>
+
+<sect1>
+<title>Introduction</title>
+	
+<para>
+The Common Unix Print System (CUPS) has become very popular, but to many it is
+a very mystical tool. There is a great deal of uncertainty regarding CUPS and how
+it works. The result is seen in a large number of posting on the samba mailing lists
+expressing frustration when MS Windows printers appear not to work with a CUPS
+backr-end.
+/para>
+
+<para>
+This is a good time to point out how CUPS can be used and what it does. CUPS is more
+than just a print spooling system - it is a complete printer management system that
+complies with HTTP and IPP protocols. It can be managed remotely via a web browser
+and it can print using http and ipp protocols.
+</para>
+
+<para>
+CUPS allows to creation of RAW printers (ie: NO file format translation) as well as
+SMART printers (ie: CUPS does file format conversion as required for the printer). In
+many ways this gives CUPS similar capabilities to the MS Windows print monitoring
+system. Of course, if you are a CUPS advocate, you would agrue that CUPS is better!
+In any case, let us now move on to explore how one may configure CUPS for interfacing
+with MS Windows print clients via Samba.
+</para>
+
+</sect1>
+
+<sect1>
+<title>CUPS - RAW Print Through  Mode</title>
+
+<para>
+When CUPS printers are configured for RAW print-through mode operation it is the
+responsibility of the Samba client to fully render the print job (file) in a format
+that is suitable for direct delivery to the printer. In this case CUPS will NOT
+do any print file format conversion work.
+</para>
+
+<para>
+The CUPS files that need to be correctly set for RAW mode printers to work are:
+
+<itemizedlist>
+	<listitem><para><filename>/etc/cups/mime.types</filename><para></listitem>
+	<listitem><para><filename>/etc/cups/mime.convs</filename><para></listitem>
+</itemizedlist>
+
+Both contain entries that must be uncommented to allow <emphasis>RAW</emphasis> mode
+operation.
+</para>
+
+<para>
+Firstly, to enable CUPS based printing from Samba the following options must be
+enabled in your smb.conf file [globals] section:
+
+<itemizedlist>
+	<listitem><para>printing = CUPS</para></listitem>
+
+	<listitem><para>printcap = CUPS</para></listitem>
+</itemizedlist>
+
+When these parameters are specified the print directives in smb.conf (as well as in
+samba itself) will be ignored because samba will directly interface with CUPS through
+it's application program interface (API) - so long as Samba has been compiled with
+CUPS library (libcups) support. If samba has NOT been compiled with CUPS support then
+printing will use the System V AT&amp;T command set with the <emphasis>-oraw</emphasis> 
+option automatically passing through.
+</para>
+
+<para>
+Cupsomatic (an enhanced printing utility that is part of some CUPS implementations) 
+on the Samba/CUPS server does *not* add any features if a file is really
+printed "raw".  However, if you have loaded the driver for the Windows client from
+the CUPS server, using the "cupsaddsmb" utility, and if this driver is one using
+a "Foomatic" PPD, the PJL header in question is already added on the Windows client,
+at the time when the driver initially generated the PostScript data and CUPS in true
+"-oraw" manner doesn't remove this PJL header and passes the file "as is" to its
+printer communication backend.
+</para>
+
+<note><para>NOTE: editing in the "mime.convs" and the "mime.types" file does not *enforce*
+"raw" printing, it only *allows* it.</para></note>
+
+<para>
+Print files that arrive from MS Windows printing are "auto-typed" by CUPS. This aids
+the process of determining proper treatment while in the print queue system.
+
+<itemizedlist>
+	<listitem><para>
+	Files generated by PCL drivers and directed at PCK printers get auto-typed as
+	<filename>application/octet-stream</filename>. Unknown file format types also
+	get auto-typed with this tag.
+	</para></listitem>
+
+	<listitem><para>
+	Files generated by a Postscript driver and directed at a Postscript printer
+	are auto-typed depending on the auto-detected most suitable MIME type as:
+
+	<itemizedlist>
+		<listitem><para>* application/postscript</para></listitem>
+		<listitem><para>* application/vnd.cups-postscript</para></listitem>
+	</itemizedlist>
+	</para>
+</itemizedlist>
+</para>
+
+
+<para>
+"application/postscript" first goes thru the "pstops" filter (where the page counting
+and accounting takes place). The outcome will be of MIME type
+"application/vnd.cups-postscript". The pstopsfilter reads and uses information from
+the PPD and inserts user-provided options into the PostScript file. As a consequence,
+the filtered file could possibly have an unwanted PJL header.
+</para>
+
+<para>
+"application/postscript" will be all files with a ".ps", ".ai", ".eps" suffix or which
+have as their first character string one of "%!" or "<04>%".
+</para>
+
+<para>
+"application/vnd.cups-postscript" will files which contain the string
+"LANGUAGE=POSTSCRIPT" (or similar variations with different capitalization) in the
+first 512 bytes, and also contain the "PJL super escape code" in the first 128 bytes
+("<1B>%-12345X"). Very likely, most PostScript files generated on Windows using a CUPS
+or other PPD, will have to be auto-typed as "vnd.cups-postscript".  A file produced
+with a "Generic PostScript driver" will just be tagged "application/postscript".
+</para>
+
+<para>
+Once the file is in "application/vnd.cups-postscript" format, either "pstoraster"
+or "cupsomatic" will take over (depending on the printer configuration, as
+determined by the PPD in use).
+</para>
+
+<note><para>
+A printer queue with *no* PPD associated to it is a "raw" printer and all files
+will go directly there as received by the spooler. The exeptions are file types
+"application/octet-stream" which need "passthrough feature" enabled.
+"Raw" queues don't do any filtering at all, they hand the file directly to the
+CUPS backend. This backend is responsible for the sending of the data to the device
+(as in the "device URI" notation as lpd://, socket://, smb://, ipp://, http://,
+parallel:/, serial:/, usb:/ etc.)
+</para></note>
+
+<note><para>
+"cupsomatic"/Foomatic are *not* native CUPS drivers and they don't ship with CUPS.
+They are a Third Party add-on, developed at Linuxprinting.org.  As such, they are
+a brilliant hack to make all models (driven by Ghostscript drivers/filters in
+traditional spoolers) also work via CUPS, with the same (good or bad!) quality
+as in these other spoolers. "cupsomatic" is only a vehicle to execute a ghostscript
+commandline at that stage in the CUPS filtering chain, where "normally" the native
+CUPS "pstoraster" filter would kick in.  cupsomatic by-passes pstoraster, "kidnaps"
+the printfile from CUPS away and re-directs it to go through Ghostscipt. CUPS accepts this,
+because the associated CUPS-O-Matic-/Foomatic-PPD specifies:
+</para>
+
+<programlisting>
+   *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"
+</programlisting>
+
+<para>
+This line persuades CUPS to hand the file to cupsomatic, once it has successfully
+converted it to the MIME type "application/vnd.cups-postscript". This conversion will not
+happen for Jobs arriving from Windows which are auto-typed "application/octet-stream",
+with the according changes in "/etc/cups/mime.types" in place.
+</para></note>
+
+<para>
+CUPS is widely configurable and flexible, even regarding its filtering mechanism.
+Another workaround in some situations would be to have
+in "/etc/cups/mime.types" entries as follows:
+</para>
+
+<programlisting>
+   application/postscript           application/vnd.cups-raw  0  -
+   application/vnd.cups-postscript  application/vnd.cups-raw  0  -
+</programlisting>
+
+<para>
+This would prevent all Postscript files from being filtered (rather, they will go
+thru the virtual "nullfilter" denoted with "-"). This could only be useful for
+PS printers. If you want to print PS code on non-PS printers an entry as follows
+could be useful:
+</para>
+
+<programlisting>
+   */*           application/vnd.cups-raw  0  -
+</programlisting>
+
+<para>
+and would effectively send *all* files to the backend without further processing.
+</para>
+
+<para>
+Lastly, you could have the following entry:
+</para>
+
+<programlisting>
+   application/vnd.cups-postscript  application/vnd.cups-raw  0  my_PJL_stripping_filter
+</programlisting>
+
+<para>
+You will need to write a "my_PJL_stripping_filter" (could be a shellscript) that
+parses the PostScript and removes the unwanted PJL. This would need to conform to
+CUPS filter design (mainly, receive and pass the parameters printername, job-id,
+username, jobtitle, copies, print options and possibly the filename). It would
+be installed as world executable into "/usr/lib/cups/filters/" and will be called
+by CUPS if it encounters a MIME type "application/vnd.cups-postscript".
+</para>
+
+<para>
+CUPS can handle "-o job-hold-until=indefinite". This keeps the job in the queue
+"on hold". It will only be printed upon manual release by the printer operator.
+This is a requirement in many "central reproduction departments", where a few
+operators manage the jobs of hundreds of users on some big machine, where no
+user is allowed to have direct access. (The operators often need to load the
+proper paper type before running the 10.000 page job requested by marketing
+for the mailing, etc.).
+</para>
+
+</sect1>
+
+<sect1>
+<title>The CUPS Filter Chains</title>
+
+<para>
+The following diagrams reveal how CUPS handles print jobs.
+</para>
+
+<programlisting>
+#########################################################################
+#
+# CUPS in and of itself has this (general) filter chain (CAPITAL
+# letters are FILE-FORMATS or MIME types, other are filters (this is
+# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#     <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstoraster   # as shipped with CUPS, independent from any Ghostscipt
+#      |           # installation on the system
+#      |  (= "postscipt interpreter")
+#      |
+#      V
+# APPLICATION/VND.CUPS-RASTER
+#      |
+#      |
+#      V
+#     rasterto<replaceable>something</replaceable>  (f.e. Gimp-Print filters may be plugged in here)
+#      |   (= "raster driver")
+#      |
+#      V
+# SOMETHING-DEVICE-SPECIFIC
+#      |
+#      |
+#      V
+#     backend
+#
+#
+# ESP PrintPro has some enhanced "rasterto<replaceable>something</replaceable>" filters as compared to
+# CUPS, and also a somewhat improved "pstoraster" filter.
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+#########################################################################
+</programlisting>
+
+<programlisting>
+#########################################################################
+#
+# This is how "cupsomatic" comes into play:
+# =========================================
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#    <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#    pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
+#      |                                          |
+#      |                                          V
+#      V                                         cupsomatic
+#    pstoraster                                  (constructs complicated
+#      |  (= "postscipt interpreter")            Ghostscript commandline
+#      |                                         to let the file be
+#      V                                         processed by a
+# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=<replaceable>s.th.</replaceable>"
+#      |                                         call...)
+#      |                                          |
+#      V                                          |
+#    rasterto<replaceable>something</replaceable>                          V
+#      |    (= "raster driver")     +-------------------------+
+#      |                            | Ghostscript at work.... |
+#      V                            |                         |
+# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
+#      |                                          |
+#      |                                          |
+#      V                                          |
+#    backend &gt;------------------------------------+
+#      |
+#      |
+#      V
+#    THE PRINTER
+#
+#
+# Note, that cupsomatic "kidnaps" the printfile after the
+# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it through
+# the CUPS-external, systemwide Ghostscript installation, bypassing the
+# "pstoraster" filter (therefor also bypassing the CUPS-raster-drivers
+# "rasterto<replaceable>something</replaceable>", and hands the rasterized file directly to the CUPS
+# backend...
+#
+# cupsomatic is not made by the CUPS developers. It is an independent
+# contribution to printing development, made by people from
+# Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+#########################################################################
+</programlisting>
+
+<programlisting>
+#########################################################################
+#
+# And this is how it works for ESP PrintPro from 4.3:
+# ===================================================
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#     <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT
+#      |
+#      |
+#      V
+#     gsrip
+#      |  (= "postscipt interpreter")
+#      |
+#      V
+# APPLICATION/VND.CUPS-RASTER
+#      |
+#      |
+#      V
+#     rasterto<replaceable>something</replaceable>  (f.e. Gimp-Print filters may be plugged in here)
+#      |   (= "raster driver")
+#      |
+#      V
+# SOMETHING-DEVICE-SPECIFIC
+#      |
+#      |
+#      V
+#     backend
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+#########################################################################
+</programlisting>
+
+<programlisting>
+#########################################################################
+#
+# This is how "cupsomatic" would come into play with ESP PrintPro:
+# ================================================================
+#
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#    <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#    pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
+#      |                                          |
+#      |                                          V
+#      V                                         cupsomatic
+#    gsrip                                       (constructs complicated
+#      |  (= "postscipt interpreter")            Ghostscript commandline
+#      |                                         to let the file be
+#      V                                         processed by a
+# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=<replaceable>s.th.</replaceable>"
+#      |                                         call...)
+#      |                                          |
+#      V                                          |
+#    rasterto<replaceable>something</replaceable>                          V
+#      |   (= "raster driver")      +-------------------------+
+#      |                            | Ghostscript at work.... |
+#      V                            |                         |
+# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
+#      |                                          |
+#      |                                          |
+#      V                                          |
+#    backend &gt;------------------------------------+
+#      |
+#      |
+#      V
+#    THE PRINTER
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+#########################################################################
+</programlisting>
+
+<programlisting>
+#########################################################################
+#
+# And this is how it works for CUPS from 1.1.15:
+# ==============================================
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#     <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+#                                     |
+#                  +------------------v------------------------------+
+#                  | Ghostscript                                     |
+#                  | at work...                                      |
+#                  | (with                                           |
+#                  | "-sDEVICE=cups")                                |
+#                  |                                                 |
+#                  |         (= "postscipt interpreter")             |
+#                  |                                                 |
+#                  +------------------v------------------------------+
+#                                     |
+#                                     |
+# APPLICATION/VND.CUPS-RASTER &gt;-------+
+#      |
+#      |
+#      V
+#     rasterto<replaceable>something</replaceable>
+#      |   (= "raster driver")
+#      |
+#      V
+# SOMETHING-DEVICE-SPECIFIC
+#      |
+#      |
+#      V
+#     backend
+#
+#
+# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to
+#       Ghostscript. GNU Ghostscript needs to be patched to handle the
+#       CUPS requirement; ESP Ghostscript has this builtin. In any case,
+#       "gs -h" needs to show up a "cups" device. pstoraster is now a
+#       calling an appropriate "gs -sDEVICE=cups..." commandline to do
+#       the job. It will output "application/vnd.cup-raster", which will
+#       be finally processed by a CUPS raster driver "rasterto<replaceable>something</replaceable>"
+#       Note the difference to "cupsomatic", which will *not* output
+#       CUPS-raster, but a final version of the printfile, ready to be
+#       sent to the printer. cupsomatic also doesn't use the "cups"
+#       devicemode in Ghostscript, but one of the classical devicemodes....
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+#########################################################################
+</programlisting>
+
+<programlisting>
+#########################################################################
+#
+# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
+# ========================================================================
+#
+# <replaceable>SOMETHNG</replaceable>-FILEFORMAT
+#      |
+#      |
+#      V
+#     <replaceable>something</replaceable>tops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+#                                     |
+#                  +------------------v------------------------------+
+#                  | Ghostscript        . Ghostscript at work....    |
+#                  | at work...         . (with "-sDEVICE=           |
+#                  | (with              .            <replaceable>s.th.</replaceable>"        |
+#                  | "-sDEVICE=cups")   .                            |
+#                  |                    .                            |
+#                  | (CUPS standard)    .      (cupsomatic)          |
+#                  |                    .                            |
+#                  |          (= "postscript interpreter")           |
+#                  |                    .                            |
+#                  +------------------v--------------v---------------+
+#                                     |              |
+#                                     |              |
+# APPLICATION/VND.CUPS-RASTER &gt;-------+              |
+#      |                                             |
+#      |                                             |
+#      V                                             |
+#     rasterto<replaceable>something</replaceable>                            |
+#      |   (= "raster driver")                       |
+#      |                                             |
+#      V                                             |
+# SOMETHING-DEVICE-SPECIFIC &gt;------------------------+
+#      |
+#      |
+#      V
+#     backend
+#
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rasterto<replaceable>something</replaceable> is noted.
+#
+##########################################################################
+</programlisting>
+
+</sect1>
+
+
+<sect1>
+<title>CUPS Print Drivers and Devices</title>
+
+<para>
+CUPS ships with good support for HP LaserJet type printers. You can install
+the driver as follows:
+
+<itemizedlist>
+	<listitem><para>
+	lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
+	</para></listitem>
+</itemizedlist>
+
+(The "-m" switch will retrieve the "laserjet.ppd" from the standard repository
+for not-yet-installed-PPDs, which CUPS typically stores in 
+<filename>/usr/share/cups/model</filename>. Alternatively, you may use
+"-P /absolute/filesystem/path/to/where/there/is/PPD/your.ppd").
+</para>
+
+<sect2>
+<title>Further printing steps</title>
+
+<para>
+Always also consult the database on linuxprinting.org for all recommendations
+about which driver is best used for each printer:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/printer_list.cgi">http://www.linuxprinting.org/printer_list.cgi</ulink></para>
+
+<para>
+There select your model and click on "Show". You'll arrive at a page listing
+all drivers working with your model. There will always be *one* 
+<emphasis>recommended</emphasis> one. Try this one first. In your case
+("HP LaserJet 4 Plus"), you'll arrive here:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/show_printer.cgi?recnum=75104">http://www.linuxprinting.org/show_printer.cgi?recnum=75104</ulink></para>
+
+<para>
+The recommended driver is "ljet4". It has a link to the page for the ljet4
+driver too:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/show_driver.cgi?driver=ljet4">http://www.linuxprinting.org/show_driver.cgi?driver=ljet4</ulink>
+
+<para>
+On the driver's page, you'll find important and detailed info about how to use
+that driver within the various available spoolers. You can generate a PPD for
+CUPS. The PPD contains all the info about how to use your model and the driver;
+this is, once installed, working transparently for the user -- you'll only
+need to choose resolution, paper size etc. from the web-based menu or from
+the print dialog GUI or from the commandline...
+</para>
+
+<para>
+On the driver's page, choose to use the "PPD-O-Matic" online PPD generator
+program. Select your model and click "Generate PPD file". When you safe the
+appearing ASCII text file, don't use "cut'n'past" (as it could possiblly corrupt
+line endings and tabs), but use "Save as..." in your browser's menu. Save it
+at "/some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"
+</para>
+
+<para>
+Then install the printer:
+</para>
+<para><programlisting>
+    "lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P /some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"
+</programlisting></para>
+
+<para>
+Note, that for all the "Foomatic-PPDs" from Linuxprinting.org, you also need
+a special "CUPS filter" named "cupsomatic". Get the latest version of
+"cupsomatic" from:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/cupsomatic">http://www.linuxprinting.org/cupsomatic</ulink></para>
+
+<para>
+This needs to be copied to <filename>/usr/lib/cups/filter/cupsomatic</filename>
+and be made world executable. This filter is needed to read and act upon the
+specially encoded Foomatic comments, embedded in the printfile, which in turn
+are used to construct (transparently for you, the user) the complicated
+ghostscript command line needed for your printer/driver combo.
+</para>
+
+<para>
+You can have a look at all the options for the Ghostscript commandline supported
+by your printer and the ljet4 driver by going to the section "Execution details",
+selecting your model (Laserjet 4 Plus) and clicking on "Show execution details".
+This will bring up this web page:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/execution.cgi?driver=ljet4&amp;printer=75104&amp;.submit=Show+execution+details">http://www.linuxprinting.org/execution.cgi?driver=ljet4&amp;printer=75104&amp;.submit=Show+execution+details</ulink></para>
+
+<para>
+The ingenious thing is that the database is kept current. If there
+is a bug fix and an improvement somewhere in the database, you will
+always get the most current and stable and feature-rich driver by following
+the steps described above.
+</para>
+
+<note><para>
+Till Kamppeter from MandrakeSoft is doing an excellent job here that too few
+people are aware of. (So if you use it often, please send him a note showing
+your appreciation).</para></note>
+
+<para>
+The latest and greatest improvement now is support for "custom page sizes"
+for all those printers which support it.
+</para>
+
+<para>
+"cupsomatic" is documented here:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/cups-doc.html">http://www.linuxprinting.org/cups-doc.html</ulink></para>
+
+<para>
+More printing tutorial info may be found here:
+</para>
+
+<para><ulink url="http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/">http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/</ulink></para>
+
+<para>
+Note, that *all* the Foomatic drivers listed on Linuxprinting.org (now
+approaching the "all-time high" number of 1.000 for the supported models)
+are using a special filtering chain involving Ghostscript, as described
+in this document.
+</para>
+
+<para>
+Summary - You need:
+</para>
+
+<para>
+<simplelist>
+
+	<member>A "foomatic+<replaceable>something</replaceable>" PPD is not enough to print with CUPS (but it is *one* important component)</member>
+	<member>The "cupsomatic" filter script (Perl) in <filename>/usr/lib/cups/filters/</filename></member>
+	<member>Perl to make cupsomatic run</member>
+	<member>Ghostscript (because it is called and controlled by the PPD/cupsomatic combo in a way to fit your printermodel/driver combo.</member>
+	<member>Ghostscript *must*, depending on the driver/model, contain support for a certain "device" (as shown by "gs -h")</member>
+</simplelist>
+
+<para>
+In the case of the "hpijs" driver, you need a Ghostscript version, which
+has "ijs" amongst its supported devices in "gs -h". In the case of
+"hpijs+foomatic", a valid ghostscript commandline would be reading like this:
+</para>
+
+<para><programlisting>
+       gs -q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=ijs       \
+             -sIjsServer=hpijs<replaceable>PageSize</replaceable> -dDuplex=<replaceable>Duplex</replaceable> <replaceable>Model</replaceable>        \
+             -r<replaceable>Resolution</replaceable>,PS:MediaPosition=<replaceable>InputSlot</replaceable> -dIjsUseOutputFD \
+             -sOutputFile=- -
+</programlisting></para>
+
+<note><para>
+Note, that with CUPS and the "hpijs+foomatic" PPD (plus Perl and cupsomatic)
+you don't need to remember this. You can choose the available print options
+thru a GUI print command (like "glp" from ESP's commercially supported
+PrintPro software, or KDE's "kprinter", or GNOME's "gtklp" or the independent
+"xpp") or the CUPS web interface via human-readable drop-down selection
+menus.
+</para></note>
+
+<para>
+If you use "ESP Ghostscript" (also under the GPL, provided by Easy Software
+Products, the makers of CUPS, downloadable from
+<ulink url="http://www.cups.org/software.html">http://www.cups.org/software.html</ulink>,
+co-maintained by the developers of linuxprinting.org), you are guaranteed to
+have in use the most uptodate, bug-fixed, enhanced and stable version of a Free
+Ghostscript. It contains support for ~300 devices, whereas plain vanilla
+GNU Ghostscript 7.05 only has ~200.
+</para>
+
+<para>
+If you print only one CUPS test page, from the web interface and when you try to
+print a windows test page, it acts like the job was never sent:
+
+<simplelist>
+	<member>Can you print "standard" jobs from the CUPS machine?</member>
+	<member>Are the jobs from Windows visible in the Web interface on CUPS (http://localhost:631/)?</member>
+	<member><emphasis>Most important:</emphasis> What kind of printer driver are you using on the Windows clients?</member>
+</simplelist>
+
+You can try to get a more detailed debugging info by setting "LogLevel debug" in
+<filename>/etc/cups/cupsd.conf</filename>, re-start cupsd and investigate <filename>/var/log/cups/error_log</filename>
+for the whereabouts of your Windows-originating printjobs:
+</para>
+
+<simplelist>
+	<member>what does the "auto-typing" line say? which is the "MIME type" CUPS thinks is arriving from the Windows clients?</member>
+	<member>are there "filter" available for this MIME type?</member>
+	<member>are there "filter rules" defined in "/etc/cups/mime.convs" for this MIME type?</member>
+</simplelist>
+
+</sect1>
+
+
+<sect1>
+<title>Limiting the number of pages users can print</title>
+
+<para>
+The feature you want is dependent on the real print subsystem you're using.
+Samba's part is always to receive the job files from the clients (filtered
+*or* unfiltered) and hand it over to this printing subsystem.
+</para>
+
+<para>
+Of course one could "hack" things with one's own scripts.
+</para>
+
+<para>
+But there is CUPS (Common Unix Printing System). CUPS supports "quotas".
+Quotas can be based on sizes of jobs or on the number of pages or both,
+and are spanning any time period you want.
+</para>
+
+<para>
+This is an example command how root would set a print quota in CUPS,
+assuming an existing printer named "quotaprinter":
+</para>
+
+<programlisting>
+  lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100
+</programlisting>
+
+<para>
+This would limit every single user to print 100 pages or 1024 KB of
+data (whichever comes first) within the last 604.800 seconds ( = 1 week).
+</para>
+
+<para>
+For CUPS to count correctly, the printfile needs to pass the CUPS "pstops" filter,
+otherwise it uses a "dummy" count of "1". Some printfiles don't pass it
+(eg: image files) but then those are mostly 1 page jobs anyway. This also means,
+proprietary drivers for the target printer running on the client computers and
+CUPS/Samba then spooling these files as "raw" (i.e. leaving them untouched, not
+filtering them), will be counted as "1-pagers" too!
+</para>
+
+<para>
+You need to send PostScript from the clients (i.e. run a PostScript driver there)
+for having the chance to get accounting done. If the printer is a non-PostScript model,
+you need to let CUPS do the job to convert the file to a print-ready format for the
+target printer. This will be working for currently ~1.000 different printer models, see
+</para>
+
+<programlisting>
+     http://www.linuxprinting.org/printer_list.cgi
+</programlisting>
+
+<para>
+Before CUPS-1.1.16 your only option was to use the Adobe PostScript
+Driver on the Windows clients. The output of this driver was not always
+passed thru the "pstops" filter on the CUPS/Samba side, and therefor was
+not counted correctly (the reason is that it often --- depending on the
+"PPD" being used --- did write a "PJL"-header in front of the real
+PostScript which made CUPS to skip the pstops and go directy to
+the "pstoraster" stage).
+</para>
+
+<para>
+From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver
+for Windows NT/2K/XP clients" (it is tagged in the download area of
+http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package).
+It is *not* working for Win9x/ME clients. But it:
+</para>
+
+<simplelist>
+	<member>>it guarantees to not write an PJL-header</member>
+	<member>it guarantees to still read and support all PJL-options named in the driver PPD with its own means</member>
+	<member>it guarantees the file going thru the "pstops" filter on the CUPS/Samba server</member>
+	<member>it guarantees to page-count correctly the printfile</member>
+</simplelist>
+
+<para>
+You can read more about the setup of this combination in the
+manpage for "cupsaddsmb" (only present with CUPS installed, only
+current with CUPS 1.1.16).
+</para>
+
+<para>
+These are the items CUPS logs in the "page_log" for every single *page* of a job:
+</para>
+
+<para><programlisting>
+	* Printer name
+	* User name
+	* Job ID
+	* Time of printing
+	* the page number
+	* the number of copies
+	* a billing info string (optional)
+</programlisting></para>
+
+<para>
+Here is an extract of my CUPS server's page_log file to illustrate
+the format and included items:
+</para>
+
+<para><programlisting>
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 1 2  #marketing
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 2 2  #marketing
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 3 2  #marketing
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 4 2  #marketing
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 5 2  #marketing
+	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 6 2  #marketing
+</programlisting></para>
+
+<para>
+This was Job ID "40", printed on "infotec_IS2027" by user "kurt", a 6-page job
+printed in 2 copies and billed to "#marketing"...
+</para>
+
+<para>
+What flaws or shortcomings are there?
+</para>
+
+<simplelist>
+	<member>the ones named above</member>
+
+	<member>
+	CUPS really counts the job pages being *processsed in software*
+	(going thru the "RIP") rather than the physical sheets successfully
+	leaving the printing device -- if there is a jam while printing
+	the 5th sheet out of 1000 and the job is aborted by the printer,
+	the "page count" will still show the figure of 1000 for that job
+	</member>
+
+	<member>
+	all quotas are the same for all users (no flexibility to give the
+	boss a higher quota than the clerk) no support for groups
+	</member>
+
+	<member>
+	no means to read out the current balance or "used-up" number of current quota
+	</member>
+
+	<member>
+	a user having used up 99 sheets of 100 quota will still be able to send and print a 1.000 sheet job
+	</member>
+
+	<member>
+	a user being denied a job because of a filled-up quota doesn't get a meaningful
+	error message from CUPS other than "client-error-not-possible".
+	</member>
+</simplelist>
+
+<para>
+But this is the best system out there currently. And there are
+huge improvements under development:
+</para>
+
+<simplelist>
+	<member>page counting will go into the "backends" (these talk
+	directly to the printer and will increase the count in sync with the
+	 actual printing process  -- a jam at the 5th sheet will lead to a stop in the counting)</member>
+
+	<member>quotas will be handled more flexibly</member>
+
+	<member>probably there will be support for users to inquire their "accounts" in advance</member>
+
+	<member>probably there will be support for some other tools around this topic</member>
+</simplelist>
+
+<para>
+Other than the current stage of the CUPS development, I don't
+know any other ready-to-use tool which you could consider.
+</para>
+
+<para>
+You can download the driver files from
+<ulink url="http://www.cups.org/software.html">http://www.cups.org/software.html</ulink>.
+It is a separate package from the CUPS base software files, tagged as "CUPS 1.1.16
+Windows NT/2k/XP Printer Driver for SAMBA (tar.gz, 192k)". The filename to
+download is "cups-samba-1.1.16.tar.gz". Upon untar-/unzip-ping it will reveal
+the files:
+</para>
+
+<para>
+<programlisting>
+   cups-samba.install
+   cups-samba.license
+   cups-samba.readme
+   cups-samba.remove
+   cups-samba.ss
+</programlisting>
+</para>
+
+<para>
+These have been packaged with the ESP meta packager software "EPM". The
+*.install and *.remove files are simple shell script, which untars the
+*.ss (which is nothing else than a tar-archive) and puts its contents
+into <filename>/usr/share/cups/drivers/</filename>. Its contents are 3 files:
+</para>
+
+<para>
+<programlisting>
+   cupsdrvr.dll
+   cupsui.dll
+   cups.hlp
+</programlisting>
+</para>
+
+<note><para>
+ATTENTION: due to a bug one CUPS release puts the <filename>cups.hlp</filename>
+into <filename>/usr/share/drivers/</filename> instead of
+<filename>/usr/share/cups/drivers/</filename>. To work around this, copy/move
+the file after running the "./cups-samba.install" script manually to the right place:
+</para>
+
+<para>
+<programlisting>
+      cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
+</programlisting>
+</para>
+</note>
+
+<note>
+<para>
+This new CUPS PostScript driver is currently binary-only, but free
+no source code is provided (yet). The reason is this: it has
+been developed with the help of the Microsoft Driver Developer Kit (DDK)
+and compiled with Microsoft Visual Studio 6. It is not clear to the driver
+developers if they are allowed to distribute the whole of the source code
+as Free Software. However, they will likely release the "diff" in source
+code under the GPL, so anybody with a license of Visual Studio and a DDK
+will be able to compile for him/herself.
+</para>
+
+<para>
+Once you have run the install script (and possibly manually moved the
+"cups.hlp" file to "/usr/share/cups/drivers/"), the driver is ready to be
+put into Samba's [print$] share (which often maps to "/etc/samba/drivers/"
+and contains a subdir tree with WIN40 and W32X86 branches), by running
+"cupsaddsmb" (see also "man cupsaddsmb" for CUPS 1.1.16). [Don't forget to
+put root into the smbpasswd file by running "smbpasswd" should you run
+this whole procedure for the first time.] Once the driver files are in the
+[print$] share, they are ready to be downloaded and installed by the
+Win NT/2k/XP clients.
+</para></note>
+
+
+<note><para>
+NOTE 1: Win 9x/ME clients won't work with this driver. For these you'd
+still need to use the ADOBE*.* drivers as previously.
+</para></note>
+
+<note><para>
+NOTE 2: It is not harming if you've still the ADOBE*.* driver files from
+previous installations in the "/usr/share/cups/drivers/" directory.
+The new cupsaddsmb (from 1.1.16) will automatically use the
+"newest" installed driver (which here then is the CUPS drivers).
+</para></note>
+
+<note><para>
+NOTE 3: Should your Win clients have had the old ADOBE*.* files and the
+Adobe PostScript drivers installed, the download and installation
+of the new CUPS PostScript driver for Windows NT/2k/XP will fail
+at first.
+</para>
+<para>
+It is not enough to "delete" the printer (as the driver files
+will still be kept by the clients and re-used if you try to
+re-install the printer). To really get rid of the Adobe driver
+files on the clients, open the "Printers" folder (possibly via
+"Start --> Settings --> Control Panel --> Printers"), right-click
+onto the folder background and select "Server Properties". A
+new dialog opens; select the "Drivers" tab; on the list select
+the driver you want to delete and click on the "Delete" button.
+(This will only work if there is no single printer left which
+uses that particular driver -- you need to "delete" all printers
+using this driver in the "Printers" folder first.)
+</para>
+</note>
+
+<note><para>
+Once you have successfully downloaded the CUPS PostScript driver
+to a client, you can easily switch all printers to this one
+by proceeding as described elsewhere in the "Samba HOWTO
+Collection" to change a driver for an existing printer.
+</para></note>
+
+<para>
+What are the benefits with the "CUPS PostScript driver for Windows NT/2k/XP"
+as compared to the Adobe drivers?
+</para>
+       
+<para>
+<itemizedlist>
+	<listitem><para>
+	no hassle with the Adobe EULA
+	</para></listitem>
+
+	<listitem><para>
+	no hassle with the question "where do I get the ADOBE*.* driver files from?"
+	</para></listitem>
+
+	<listitem><para>
+	the Adobe drivers (depending on the printer PPD associated with them)
+	often put a PJL header in front of the core PostScript part of the print
+	file (thus the file starts with "<replaceable>1B</replaceable>%-12345X" or "<replaceable>escape</replaceable>%-12345X"
+	instead of "%!PS"). This leads to the CUPS daemon autotyping the
+	arriving file as a print-ready file, not requiring a pass thru the
+	"pstops" filter (to speak more technical, it is not regarded as the
+	generic MIME type "application/postscript", but as the more special
+	MIME type "application/cups.vnd-postscript"), which therefore also
+	leads to the page accounting in "/var/log/cups/page_log" not receiving
+	the exact mumber of pages; instead the dummy page number of "1" is
+	logged in a standard setup)
+	</para></listitem>
+
+	<listitem><para>
+	the Adobe driver has more options to "mis-configure" the PostScript
+	generated by it (like setting it inadvertedly to "Optimize for Speed",
+	instead of "Optimize for Portability", which could lead to CUPS being
+	unable to process it)
+	</para></listitem>
+
+	<listitem><para>
+	the CUPS PostScript driver output sent by Windows clients to the CUPS
+	server will be guaranteed to be auto-typed as generic MIME type
+	"application/postscript", thusly passing thru the CUPS "pstops" filter
+	and logging the correct number of pages in the page_log for accounting
+	and quota purposes
+	</para></listitem>
+
+	<listitem><para>
+	the CUPS PostScript driver supports the sending of additional print
+	options by the Win NT/2k/XP clients, such as naming the CUPS standard
+	banner pages (or the custom ones, should they be installed at the time
+	of driver download), using the CUPS "page-label" option, setting a
+	job-priority and setting the scheduled time of printing (with the option
+	to support additional useful IPP job attributes in the future).
+	</para></listitem>
+
+	<listitem><para>
+	the CUPS PostScript driver supports the inclusion of the new
+	"*cupsJobTicket" comments at the beginnig of the PostScript file (which
+	could be used in the future for all sort of beneficial extensions on
+	the CUPS side, but which will not disturb any other application as those
+	will regard it as a comment and simply ignore it).
+	</para></listitem>
+
+	<listitem><para>
+	the CUPS PostScript driver will be the heart of the fully fledged CUPS
+	IPP client for Windows NT/2k/XP to be released soon (probably alongside
+	the first Beta release for CUPS 1.2).
+	</para></listitem>
+
+</itemizedlist>
+</para>
+</sect1>
+
+<sect1>
+<title>Advanced Postscript Printing from MS Windows</title>
+
+<para>
+Let the Windows Clients use a PostScript driver to deliver poistscript to
+the samba print server (just like any Linux or Unix Client would also use
+PostScript to send to the server)
+</para>
+
+<para>
+Make the Unix printing subsystem to which Samba sends the job convert the
+incoming PostScript files to the native print format of the target printers
+(would be PCL if you have an HP printer)
+</para>
+
+<para>
+Now if you are afraid that this would just mean using a *Generic* PostScript
+driver for the clients that has no Simplex/Duplex selection, and no paper tray
+choice, but you need them to be able to set up print jobs, with all the bells
+and whistles of your printers:-
+</para>
+
+<simplelist>
+	<member>Not possible with traditional spooling systems</member>
+
+	<member>
+	But perfectly supported by CUPS (which uses "PPD" files to
+	describe how to control the print options for PostScript and
+	non-PostScript devices alike...
+	</member>
+</simplelist>
+
+<para>
+CUPS PPDs are working perfectly on Windows clients who use Adobe PostScript
+drivers (or the new CUPS PostScript driver for Windows NT/2K/XP). Clients can use
+them to setup the job to their liking and CUPS will use the received job options
+to make the (PCL-, ESC/P- or PostScript-) printer behave as required.
+</para>
+
+<para>
+If you want to have the additional benefit of page count logging and accounting
+then the CUPS PostScript driver is the best choice (better than the Adobe one).
+</para>
+
+<para>
+If you want to make the drivers downloadable for the clients then "cupsaddsmb" is
+your friend. It will setup the [print$] share on the Samba host to be ready to serve
+the clients for a "point and print" driver installation.
+</para>
+
+<warning>
+<para>What strings are attached?</para></warning>
+
+<para>
+There are some. But, given the sheer CPU power you can buy nowadays,
+these can be overcome easily. The strings:
+</para>
+
+<para>
+Well, if the CUPS/Samba side will have to print to many printers serving many users,
+you probably will need to set up a second server (which can do automatic load balancing
+with the first one, plus a degree of fail-over mechanism). Converting the incoming
+PostScript jobs, "interpreting" them for non-PostScript printers, amounts to the work
+of a "RIP" (Raster Image Processor) done in software. This requires more CPU and RAM
+than for the mere "raw spooling" task your current setup is solving. It all depends
+on the avarage and peak printing load the server should be able to handle.
+</para>
+
+</sect1>
+
+<sect1>
+<title>Auto-Deletion of CUPS spool files</title>
+
+<para>
+Samba print files pass thru two "spool" directories. One the incoming directory
+managed by Samba, (set eg: in the "path = /var/spool/samba" directive in the [printers]
+section of "smb.conf"). Second is the spool directory of your UNIX print subsystem.
+For CUPS it is normally "/var/spool/cups/", as set by the cupsd.conf directive
+"RequestRoot /var/spool/cups".
+</para>
+
+<para>
+I am not sure, which one of your directories keeps the files.  From what you say,
+it is most likely the Samba part.
+</para>
+
+<para>
+For the CUPS part, you may want to consult:
+</para>
+
+<programlisting>
+   http://localhost:631/sam.html#PreserveJobFiles and
+   http://localhost:631/sam.html#PreserveJobHistory and
+   http://localhost:631/sam.html#MaxJobs
+</programlisting>
+
+<para>
+There are the settings described for your CUPS daemon, which could lead to completed
+job files not being deleted.
+</para>
+
+<para>
+"PreserveJobHistory Yes" -- keeps some details of jobs in
+cupsd's mind (well it keeps the "c12345", "c12346" etc. files
+in the CUPS spool directory, which do a similar job as the
+old-fashioned BSD-LPD control files). This is set to "Yes"
+as a default.
+</para>
+
+<para>
+"PreserveJobFiles Yes" -- keeps the job files themselves in
+cupsd's mind (well it keeps the "d12345", "d12346" etc. files
+in the CUPS spool directory...). This is set to "No" as the
+CUPS default.
+</para>
+
+<para>
+"MaxJobs 500" -- this directive controls the maximum number
+of jobs that are kept in memory. Once the number of jobs
+reaches the limit, the oldest completed job is automatically
+purged from the system to make room for the new one. If all
+of the known jobs are still pending or active then the new
+job will be rejected. Setting the maximum to 0 disables this
+functionality. The default setting is 0.
+</para>
+
+<para>
+(There are also additional settings for "MaxJobsPerUser" and
+"MaxJobsPerPrinter"...)
+</para>
+
+<para>
+For everything to work as announced, you need to have three things:
+</para>
+
+<simplelist>
+
+	<member>
+	a Samba-smbd which is compiled against "libcups" (Check on Linux by running "ldd `which smbd`")
+	</member>
+
+	<member>
+	a Samba-smb.conf setting of "printing = cups"
+	</member>
+
+	<member>
+	another Samba-smb.conf setting of "printcap = cups"
+	</member>
+
+</simplelist>
+
+<note><para>
+Note, that in this case all other manually set printing-related
+commands (like "print command", "lpq command", "lprm command",
+"lppause command" or "lpresume command") are ignored and they
+should normally have no influence what-so-ever on your printing.
+</para></note>
+
+<para>
+If you want to do things manually, replace the "printing = cups"
+by "printing = bsd". Then your manually set commands may work
+(haven't tested this), and a "print command = lp -d %P %s; rm %s"
+may do what you need.
+</para>
+
+<para>
+You forgot to mention the CUPS version you're using. If you did
+set things up as described in the man pages, then the Samba
+spool files should be deleted. Otherwise it may be a bug. On
+the CUPS side, you can control the behaviour as described
+above.
+</para>
+
+<para>
+If you have more problems, post the output of these commands:
+</para>
+
+<para>
+<programlisting>
+   grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
+   grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
+</programlisting>
+</para>
+
+<para>
+(adapt paths as needed). These commands sanitize the files
+and cut out the empty lines and lines with comments, providing
+the "naked settings" in a compact way.
+</para>
+</sect1>
+</chapter>
diff --git a/docs/docbook/projdoc/ServerType.sgml b/docs/docbook/projdoc/ServerType.sgml
new file mode 100644
index 0000000000..41b1c0ed2f
--- /dev/null
+++ b/docs/docbook/projdoc/ServerType.sgml
@@ -0,0 +1,141 @@
+<chapter id="ServerType">
+<chapterinfo>
+        <author>
+                <firstname>John H</firstname><surname>Terpstra</surname>
+                <affiliation>
+                        <orgname>Samba Team</orgname>
+                        <address><email>jht@samba.org</email></address>
+                </affiliation>
+        </author>
+</chapterinfo>
+
+<title>Nomenclature of Server Types</title>
+
+<para>Adminstrators of Microsoft networks often refer to there being three
+different type of servers:</para>
+
+<itemizedlist>
+	<listitem><para>Stand Alone Server</para></listitem>
+	<listitem><para>Domain Member Server</para></listitem>
+	<listitem><para>Domain Controller</para>
+		<itemizedlist>
+			<listitem><para>Primary Domain Controller</para></listitem>
+			<listitem><para>Backup Domain Controller</para></listitem>
+			<listitem><para>ADS Domain Controller</para></listitem>
+		</itemizedlist>
+	</listitem>
+</itemizedlist>
+
+<para>A network administrator who is familiar with these terms and who
+wishes to migrate to or use Samba will want to know what these terms mean
+within a Samba context.</para>
+
+<sect1>
+<title>Stand Alone Server</title>
+
+<para>
+The term <emphasis>stand alone server</emphasis> means that the server
+will provide local authentication and access control for all resources
+that are available from it. In general this means that there will be a
+local user database. In more technical terms, it means that resources
+on the machine will either be made available in either SHARE mode or in
+USER mode. SHARE mode and USER mode security are documented under
+discussions regarding "security mode". The smb.conf configuration parameters
+that control security mode are: "security = user" and "security = share".
+</para>
+
+<para>
+Samba tends to blur the distinction a little in respect of what is
+a stand alone server. This is because the authentication database may be
+local or on a remote server, even if from the samba protocol perspective
+the samba server is NOT a member of a domain security context.
+</para>
+
+<para>
+Through the use of PAM (Pluggable Authentication Modules) and nsswitch
+(the name service switcher) the source of authentication may reside on 
+another server. We would be inclined to call this the authentication server.
+This means that the samba server may use the local Unix/Linux system
+password database (/etc/passwd or /etc/shadow), may use a local smbpasswd
+file (/etc/samba/smbpasswd or /usr/local/samba/lib/private/smbpasswd), or
+may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB
+server for authentication.
+</para>
+
+</sect1>
+
+<sect1>
+<title>Domain Member Server</title>
+
+<para>
+This mode of server operation involves the samba machine being made a member
+of a domain security context. This means by definition that all user authentication
+will be done from a centrally defined authentication regime. The authentication
+regime may come from an NT3/4 style (old domain technology) server, or it may be
+provided from an Active Directory server (ADS) running on MS Windows 2000 or later.
+>/para>
+
+<para><emphasis>
+Of course it should be clear that the authentication back end itself could be from any
+distributed directory architecture server that is supported by Samba. This can be
+LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory Server, etc.
+</emphasis></para>
+
+<para>
+Please refer to the section on Howto configure Samba as a Primary Domain Controller
+and for more information regarding how to create a domain machine account for a
+domain member server as well as for information regading how to enable the samba
+domain member machine to join the domain and to be fully trusted by it.
+</para>
+
+</sect1>
+
+<sect1>
+<title>Domain Controller</title>
+
+<para>
+Over the years public perceptions of what Domain Control really is has taken on an
+almost mystical nature. Before we branch into a brief overview of what Domain Control
+is the following types of controller are known:
+</para>
+
+<sect2>
+<title>Domain Controller Types</title>
+
+<simplelist>
+	<member>Primary Domain Controller</member>
+	<member>Backup Domain Controller</member>
+	<member>ADS Domain Controller</member>
+</simplelist>
+
+<para>
+The <emphasis>Primary Domain Controller</emphasis> or PDC plays an important role in the MS 
+Windows NT3 and NT4 Domain Control architecture, but not in the manner that so many
+expect. The PDC seeds the Domain Control database (a part of the Windows registry) and
+it plays a key part in synchronisation of the domain authentication database. 
+</para>
+
+<para>
+New to Samba-3.0.0 is the ability to use a back-end file that holds the same type of data as
+the NT4 style SAM (Security Account Manager) database (one of the registry files).
+The samba-3.0.0 SAM can be specified via the smb.conf file parameter "passwd backend" and
+valid options include <emphasis> smbpasswd tdbsam ldapsam nisplussam plugin unixsam</emphasis>.
+The smbpasswd, tdbsam and ldapsam options can have a "_nua" suffix to indicate that No Unix
+Accounts need to be created. In other words, the Samba SAM will be independant of Unix/Linux
+system accounts, provided a uid range is defined from which SAM accounts can be created.
+</para>
+
+<para>
+The <emphasis>Backup Domain Controller</emphasis> or BDC plays a key role in servicing network
+authentication requests. The BDC is biased to answer logon requests so that on a network segment
+that has a BDC and a PDC the BDC will be most likely to service network logon requests. The PDC will
+answer network logon requests when the BDC is too busy (high load). A BDC can be promoted to
+a PDC. If the PDC is on line at the time that the BDC is promoted to PDC the previous PDC is
+automatically demoted to a BDC.
+</para>
+
+<para>
+At this time Samba is NOT capable of acting as an <emphasis>ADS Domain Controller</emphasis>.
+
+</sect2>
+</sect1>
diff --git a/docs/docbook/projdoc/passdb.sgml b/docs/docbook/projdoc/passdb.sgml
new file mode 100644
index 0000000000..fa2d75bd34
--- /dev/null
+++ b/docs/docbook/projdoc/passdb.sgml
@@ -0,0 +1,1012 @@
+<chapter id="passdb">
+<chapterinfo>
+	<author>
+		<firstname>Jelmer</firstname><surname>Vernooij</surname>
+		<affiliation>
+			<orgname>The Samba Team</orgname>
+			<address><email>jelmer@samba.org</email></address>
+		</affiliation>
+	</author>
+	<author>
+		<firstname>Gerald (Jerry)</firstname><surname>Carter</surname>
+		<affiliation>
+			<orgname>Samba Team</orgname>
+			<address><email>jerry@samba.org</email></address>
+		</affiliation>
+	</author>
+	<author>
+		<firstname>Olivier (lem)</firstname><surname>Lemaire</surname>
+		<affiliation>
+			<orgname>IDEALX</orgname>
+			<address><email>olem@IDEALX.org</email></address>
+		</affiliation>
+	</author>
+	<author>
+		<firstname>Jeremy</firstname><surname>Allison</surname>
+		<affiliation>
+			<orgname>Samba Team</orgname>
+			<address>
+				<email>jra@samba.org</email>
+			</address>
+		</affiliation>
+	</author>
+	<author>
+		<firstname>John H</firstname><surname>Terpstra</surname>
+		<affiliation>
+			<orgname>Samba Team</orgname>
+			<address>
+				<email>jht@samba.org</email>
+			</address>
+		</affiliation>
+	</author>
+	
+	<pubdate>February 2003</pubdate>
+</chapterinfo>
+
+<title>User information database</title>
+
+<sect1>
+	<title>Introduction</title>
+
+	<para>Old windows clients send plain text passwords over the wire. 
+	Samba can check these passwords by crypting them and comparing them 
+	to the hash stored in the unix user database.
+	</para>
+	
+	<para>
+	Newer windows clients send encrypted passwords (so-called 
+	Lanman and NT hashes) over 
+	the wire, instead of plain text passwords. The newest clients 
+	will only send encrypted passwords and refuse to send plain text 
+	passwords, unless their registry is tweaked.
+	</para>
+
+	<para>These passwords can't be converted to unix style encrypted 
+	passwords. Because of that you can't use the standard unix 
+	user database, and you have to store the Lanman and NT hashes 
+	somewhere else. </para>
+	
+	<para>Next to a differently encrypted passwords, 
+	windows also stores certain data for each user 
+	that is not stored in a unix user database, e.g. 
+	workstations the user may logon from, the location where his/her 
+	profile is stored, etc.
+	Samba retrieves and stores this information using a "passdb backend".
+	Commonly
+	available backends are LDAP, plain text file, MySQL and nisplus.
+	For more information, see the documentation about the 
+	<command>passdb backend = </command> parameter.
+	</para>
+</sect1>
+
+<sect1>
+	<title>Important Notes About Security</title>
+	
+	<para>The unix and SMB password encryption techniques seem similar 
+	on the surface. This similarity is, however, only skin deep. The unix 
+	scheme typically sends clear text passwords over the network when 
+	logging in. This is bad. The SMB encryption scheme never sends the 
+	cleartext password over the network but it does store the 16 byte 
+	hashed values on disk. This is also bad. Why? Because the 16 byte hashed 
+	values are a "password equivalent". You cannot derive the user's 
+	password from them, but they could potentially be used in a modified 
+	client to gain access to a server. This would require considerable 
+	technical knowledge on behalf of the attacker but is perfectly possible. 
+	You should thus treat the data stored in whatever 
+	passdb backend you use (smbpasswd file, ldap, mysql) as though it contained the 
+	cleartext passwords of all your users. Its contents must be kept 
+	secret, and the file should be protected accordingly.</para>
+	
+	<para>Ideally we would like a password scheme which neither requires 
+	plain text passwords on the net or on disk. Unfortunately this 
+	is not available as Samba is stuck with being compatible with 
+	other SMB systems (WinNT, WfWg, Win95 etc). </para>
+
+	<warning>
+		<para>Note that Windows NT 4.0 Service pack 3 changed the 
+		default for permissible authentication so that plaintext 
+		passwords are <emphasis>never</emphasis> sent over the wire. 
+		The solution to this is either to switch to encrypted passwords 
+		with Samba or edit the Windows NT registry to re-enable plaintext 
+		passwords. See the document WinNT.txt for details on how to do 
+		this.</para>
+		
+		<para>Other Microsoft operating systems which also exhibit 
+		this behavior includes</para>
+		
+		<para> These versions of MS Windows do not support full domain
+		security protocols, although they may log onto a domain environment.
+		Of these Only MS Windows XP Home does NOT support domain logons.</para>
+
+		<simplelist>
+			<member>MS DOS Network client 3.0 with 
+			the basic network redirector installed</member>
+			
+			<member>Windows 95 with the network redirector 
+			update installed</member>
+			
+			<member>Windows 98 [se]</member>
+
+			<member>Windows Me</member>
+
+			<member>Windows XP Home</member>
+		</simplelist>
+
+		<para> The following versions of MS Windows fully support domain
+		security protocols.</para>
+
+		<simplelist>
+			<member>Windows NT 3.5x</member>
+
+			<member>Windows NT 4.0</member>
+			
+			<member>Windows 2000 Professional</member>
+
+			<member>Windows 200x Server/Advanced Server</member>
+
+			<member>Windows XP Professional</member>
+		</simplelist>
+		
+		<para><emphasis>Note :</emphasis>All current release of 
+		Microsoft SMB/CIFS clients support authentication via the
+		SMB Challenge/Response mechanism described here.  Enabling
+		clear text authentication does not disable the ability
+		of the client to participate in encrypted authentication.</para>
+
+
+		<para>MS Windows clients will cache the encrypted password alone.
+		Even when plain text passwords are re-enabled, through the appropriate
+		registry change, the plain text password is NEVER cached. This means that
+		in the event that a network connections should become disconnected (broken)
+		only the cached (encrypted) password will be sent to the resource server
+		to affect a auto-reconnect. If the resource server does not support encrypted
+		passwords the auto-reconnect will fail. <emphasis>USE OF ENCRYPTED PASSWORDS
+		IS STRONGLY ADVISED.</emphasis></para>
+	</warning>
+
+	<sect2>
+		<title>Advantages of SMB Encryption</title>
+
+		<simplelist>
+			<member>Plain text passwords are not passed across 
+			the network. Someone using a network sniffer cannot just 
+			record passwords going to the SMB server.</member>
+		 
+			<member>WinNT doesn't like talking to a server 
+			that SM not support encrypted passwords. It will refuse 
+			to browse the server if the server is also in user level 
+			security mode. It will insist on prompting the user for the 
+			password on each connection, which is very annoying. The
+			only things you can do to stop this is to use SMB encryption.
+			</member>
+
+			<member>Encrypted password support allows auto-matic share
+			(resource) reconnects.</member>
+		</simplelist>
+	</sect2>
+
+
+	<sect2>
+		<title>Advantages of non-encrypted passwords</title>
+
+		<simplelist>
+			<member>Plain text passwords are not kept 
+			on disk, and are NOT cached in memory. </member>
+			
+			<member>Uses same password file as other unix 
+			services such as login and ftp</member>
+			
+			<member>Use of other services (such as telnet and ftp) which
+			send plain text passwords over the net, so sending them for SMB
+			isn't such a big deal.</member>
+		</simplelist>
+	</sect2>
+</sect1>
+
+
+<sect1>
+	<title>The smbpasswd Command</title>
+	
+	<para>The smbpasswd utility is a utility similar to the 
+	<command>passwd</command> or <command>yppasswd</command> programs.
+	It maintains the two 32 byte password fields in the passdb backend. </para>
+
+	<para><command>smbpasswd</command> works in a client-server mode 
+	where it contacts the local smbd to change the user's password on its 
+	behalf. This has enormous benefits - as follows.</para>
+
+	<para><command>smbpasswd</command> has the capability 
+	to change passwords on Windows NT servers (this only works when 
+	the request is sent to the NT Primary Domain Controller if you 
+	are changing an NT Domain user's password).</para>
+	
+	<para>To run smbpasswd as a normal user just type :</para>
+	
+	<para><prompt>$ </prompt><userinput>smbpasswd</userinput></para>
+	<para><prompt>Old SMB password: </prompt><userinput>&lt;type old value here - 
+	or hit return if there was no old password&gt;</userinput></para>
+	<para><prompt>New SMB Password: </prompt><userinput>&lt;type new value&gt;
+	</userinput></para>
+	<para><prompt>Repeat New SMB Password: </prompt><userinput>&lt;re-type new value
+	</userinput></para>
+	
+	<para>If the old value does not match the current value stored for 
+	that user, or the two new values do not match each other, then the 
+	password will not be changed.</para>
+	
+	<para>If invoked by an ordinary user it will only allow the user 
+	to change his or her own Samba password.</para>
+	
+	<para>If run by the root user smbpasswd may take an optional 
+	argument, specifying the user name whose SMB password you wish to 
+	change.  Note that when run as root smbpasswd does not prompt for 
+	or check the old password value, thus allowing root to set passwords 
+	for users who have forgotten their passwords.</para>
+	
+	<para><command>smbpasswd</command> is designed to work in the same way 
+	and be familiar to UNIX users who use the <command>passwd</command> or 
+	<command>yppasswd</command> commands.</para>
+
+	<para>For more details on using <command>smbpasswd</command> refer 
+	to the man page which will always be the definitive reference.</para>
+</sect1>
+
+<!--
+<sect1>
+<title>The <command>pdbedit</command> command</title>
+FIXME
+</sect1>
+-->
+
+<sect1>
+<title>Plain text</title>
+<para>
+Older versions of samba retrieved user information from the unix user database 
+and eventually some other fields from the file <filename>/etc/samba/smbpasswd</filename>
+or <filename>/etc/smbpasswd</filename>. When password encryption is disabled, no 
+data is stored at all.
+</para>
+</sect1>
+
+<sect1>
+<title>TDB</title>
+<para>Samba can also store the user data in a "TDB" (Trivial Database). Using this backend 
+doesn't require any additional configuration. This backend is recommended for new installations who 
+don't require LDAP.
+</para>
+</sect1>
+
+<sect1>
+<title>LDAP</title>
+
+<sect2>
+<title>Introduction</title>
+
+<para>
+This document describes how to use an LDAP directory for storing Samba user
+account information traditionally stored in the smbpasswd(5) file.  It is
+assumed that the reader already has a basic understanding of LDAP concepts
+and has a working directory server already installed.  For more information
+on LDAP architectures and Directories, please refer to the following sites.
+</para>
+
+<itemizedlist>
+	<listitem><para>OpenLDAP - <ulink url="http://www.openldap.org/">http://www.openldap.org/</ulink></para></listitem>
+	<listitem><para>iPlanet Directory Server - <ulink url="http://iplanet.netscape.com/directory">http://iplanet.netscape.com/directory</ulink></para></listitem>
+</itemizedlist>
+
+<para>
+Note that <ulink url="http://www.ora.com/">O'Reilly Publishing</ulink> is working on
+a guide to LDAP for System Administrators which has a planned release date of
+early summer, 2002.
+</para>
+
+<para>
+Two additional Samba resources which may prove to be helpful are
+</para>
+
+<itemizedlist>
+	<listitem><para>The <ulink url="http://www.unav.es/cti/ldap-smb/ldap-smb-3-howto.html">Samba-PDC-LDAP-HOWTO</ulink>
+	maintained by Ignacio Coupeau.</para></listitem>
+
+	<listitem><para>The NT migration scripts from <ulink url="http://samba.idealx.org/">IDEALX</ulink> that are
+	geared to manage users and group in such a Samba-LDAP Domain Controller configuration.
+	</para></listitem>
+</itemizedlist>
+
+</sect2>
+
+<sect2>
+<title>Introduction</title>
+
+<para>
+Traditionally, when configuring <ulink url="smb.conf.5.html#ENCRYPTPASSWORDS">"encrypt
+passwords = yes"</ulink> in Samba's <filename>smb.conf</filename> file, user account
+information such as username, LM/NT password hashes, password change times, and account
+flags have been stored in the <filename>smbpasswd(5)</filename> file.  There are several
+disadvantages to this approach for sites with very large numbers of users (counted
+in the thousands).
+</para>
+
+<itemizedlist>
+<listitem><para>
+The first is that all lookups must be performed sequentially.  Given that
+there are approximately two lookups per domain logon (one for a normal
+session connection such as when mapping a network drive or printer), this
+is a performance bottleneck for lareg sites.  What is needed is an indexed approach
+such as is used in databases.
+</para></listitem>
+
+<listitem><para>
+The second problem is that administrators who desired to replicate a
+smbpasswd file to more than one Samba server were left to use external
+tools such as <command>rsync(1)</command> and <command>ssh(1)</command>
+and wrote custom, in-house scripts.
+</para></listitem>
+
+<listitem><para>
+And finally, the amount of information which is stored in an
+smbpasswd entry leaves no room for additional attributes such as
+a home directory, password expiration time, or even a Relative
+Identified (RID).
+</para></listitem>
+</itemizedlist>
+
+<para>
+As a result of these defeciencies, a more robust means of storing user attributes
+used by smbd was developed.  The API which defines access to user accounts
+is commonly referred to as the samdb interface (previously this was called the passdb
+API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support
+for a samdb backend (e.g. <parameter>--with-ldapsam</parameter> or
+<parameter>--with-tdbsam</parameter>) requires compile time support.
+</para>
+
+<para>
+When compiling Samba to include the <parameter>--with-ldapsam</parameter> autoconf
+option, smbd (and associated tools) will store and lookup user accounts in
+an LDAP directory.  In reality, this is very easy to understand.  If you are
+comfortable with using an smbpasswd file, simply replace "smbpasswd" with
+"LDAP directory" in all the documentation.
+</para>
+
+<para>
+There are a few points to stress about what the <parameter>--with-ldapsam</parameter>
+does not provide.  The LDAP support referred to in the this documentation does not
+include:
+</para>
+
+<itemizedlist>
+	<listitem><para>A means of retrieving user account information from
+	an Windows 2000 Active Directory server.</para></listitem>
+	<listitem><para>A means of replacing /etc/passwd.</para></listitem>
+</itemizedlist>
+
+<para>
+The second item can be accomplished by using LDAP NSS and PAM modules.  LGPL
+versions of these libraries can be obtained from PADL Software
+(<ulink url="http://www.padl.com/">http://www.padl.com/</ulink>).  However,
+the details of configuring these packages are beyond the scope of this document.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Supported LDAP Servers</title>
+
+<para>
+The LDAP samdb code in 2.2.3 (and later) has been developed and tested
+using the OpenLDAP 2.0 server and client libraries. 
+The same code should be able to work with Netscape's Directory Server
+and client SDK. However, due to lack of testing so far, there are bound
+to be compile errors and bugs.  These should not be hard to fix.
+If you are so inclined, please be sure to forward all patches to
+<ulink url="samba-patches@samba.org">samba-patches@samba.org</ulink> and
+<ulink url="jerry@samba.org">jerry@samba.org</ulink>.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Schema and Relationship to the RFC 2307 posixAccount</title>
+
+
+<para>
+Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in
+<filename>examples/LDAP/samba.schema</filename>.  The sambaAccount objectclass is given here:
+</para>
+
+<para><programlisting>
+objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL
+     DESC 'Samba Account'
+     MUST ( uid $ rid )
+     MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
+            logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
+            displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
+            description $ userWorkstations $ primaryGroupID $ domain ))
+</programlisting></para>
+
+<para>
+The samba.schema file has been formatted for OpenLDAP 2.0.  The OID's are
+owned by the Samba Team and as such is legal to be openly published.
+If you translate the schema to be used with Netscape DS, please
+submit the modified schema file as a patch to <ulink
+url="jerry@samba.org">jerry@samba.org</ulink>
+</para>
+
+<para>
+Just as the smbpasswd file is mean to store information which supplements a
+user's <filename>/etc/passwd</filename> entry, so is the sambaAccount object
+meant to supplement the UNIX user account information.  A sambaAccount is a
+<constant>STRUCTURAL</constant> objectclass so it can be stored individually
+in the directory.  However, there are several fields (e.g. uid) which overlap
+with the posixAccount objectclass outlined in RFC2307.  This is by design.
+</para>
+
+<!--olem: we should perhaps have a note about shadowAccounts too as many
+systems use them, isn'it ? -->
+
+<para>
+In order to store all user account information (UNIX and Samba) in the directory,
+it is necessary to use the sambaAccount and posixAccount objectclasses in
+combination.  However, smbd will still obtain the user's UNIX account
+information via the standard C library calls (e.g. getpwnam(), et. al.).
+This means that the Samba server must also have the LDAP NSS library installed
+and functioning correctly.  This division of information makes it possible to
+store all Samba account information in LDAP, but still maintain UNIX account
+information in NIS while the network is transitioning to a full LDAP infrastructure.
+</para>
+</sect2>
+
+<sect2>
+<title>Configuring Samba with LDAP</title>
+
+
+<sect3>
+<title>OpenLDAP configuration</title>
+
+<para>
+To include support for the sambaAccount object in an OpenLDAP directory
+server, first copy the samba.schema file to slapd's configuration directory.
+</para>
+
+<para>
+<prompt>root# </prompt><command>cp samba.schema /etc/openldap/schema/</command>
+</para>
+
+<para>
+Next, include the <filename>samba.schema</filename> file in <filename>slapd.conf</filename>.
+The sambaAccount object contains two attributes which depend upon other schema
+files.  The 'uid' attribute is defined in <filename>cosine.schema</filename> and
+the 'displayName' attribute is defined in the <filename>inetorgperson.schema</filename>
+file.  Both of these must be included before the <filename>samba.schema</filename> file.
+</para>
+
+<para><programlisting>
+## /etc/openldap/slapd.conf
+
+## schema files (core.schema is required by default)
+include	           /etc/openldap/schema/core.schema
+
+## needed for sambaAccount
+include            /etc/openldap/schema/cosine.schema
+include            /etc/openldap/schema/inetorgperson.schema
+include            /etc/openldap/schema/samba.schema
+
+## uncomment this line if you want to support the RFC2307 (NIS) schema
+## include         /etc/openldap/schema/nis.schema
+
+....
+</programlisting></para>
+
+<para>
+It is recommended that you maintain some indices on some of the most usefull attributes,
+like in the following example, to speed up searches made on sambaAccount objectclasses
+(and possibly posixAccount and posixGroup as well).
+</para>
+<para><programlisting>
+# Indices to maintain
+## required by OpenLDAP 2.0
+index objectclass   eq
+
+## support pb_getsampwnam()
+index uid           pres,eq
+## support pdb_getsambapwrid()
+index rid           eq
+
+## uncomment these if you are storing posixAccount and
+## posixGroup entries in the directory as well
+##index uidNumber     eq
+##index gidNumber     eq
+##index cn            eq
+##index memberUid     eq
+</programlisting></para>
+</sect3>
+
+
+<sect3>
+<title>Configuring Samba</title>
+<!--lem: <title>smb.conf LDAP parameters</title> -->
+
+<para>
+The following parameters are available in smb.conf only with <parameter>--with-ldapsam</parameter>
+was included with compiling Samba.
+</para>
+
+<itemizedlist>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPSSL">ldap ssl</ulink></para></listitem>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPSERVER">ldap server</ulink></para></listitem>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPADMINDN">ldap admin dn</ulink></para></listitem>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPSUFFIX">ldap suffix</ulink></para></listitem>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPFILTER">ldap filter</ulink></para></listitem>
+	<listitem><para><ulink url="smb.conf.5.html#LDAPPORT">ldap port</ulink></para></listitem>
+</itemizedlist>
+
+<para>
+These are described in the <ulink url="smb.conf.5.html">smb.conf(5)</ulink> man
+page and so will not be repeated here.  However, a sample smb.conf file for
+use with an LDAP directory could appear as
+</para>
+
+<para><programlisting>
+## /usr/local/samba/lib/smb.conf
+[global]
+     security = user
+     encrypt passwords = yes
+
+     netbios name = TASHTEGO
+     workgroup = NARNIA
+
+     # ldap related parameters
+
+     # define the DN to use when binding to the directory servers
+     # The password for this DN is not stored in smb.conf.  Rather it
+     # must be set by using 'smbpasswd -w <replaceable>secretpw</replaceable>' to store the
+     # passphrase in the secrets.tdb file.  If the "ldap admin dn" values
+     # changes, this password will need to be reset.
+     ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
+
+     #  specify the LDAP server's hostname (defaults to locahost)
+     ldap server = ahab.samba.org
+
+     # Define the SSL option when connecting to the directory
+     # ('off', 'start tls', or 'on' (default))
+     ldap ssl = start tls
+
+     # define the port to use in the LDAP session (defaults to 636 when
+     # "ldap ssl = on")
+     ldap port = 389
+
+     # specify the base DN to use when searching the directory
+     ldap suffix = "ou=people,dc=samba,dc=org"
+
+     # generally the default ldap search filter is ok
+     # ldap filter = "(&amp;(uid=%u)(objectclass=sambaAccount))"
+</programlisting></para>
+
+
+</sect3>
+</sect2>
+
+
+<sect2>
+<title>Accounts and Groups management</title>
+
+<para>
+As users accounts are managed thru the sambaAccount objectclass, you should
+modify you existing administration tools to deal with sambaAccount attributes.
+</para>
+
+<para>
+Machines accounts are managed with the sambaAccount objectclass, just
+like users accounts. However, it's up to you to stored thoses accounts
+in a different tree of you LDAP namespace: you should use
+"ou=Groups,dc=plainjoe,dc=org" to store groups and
+"ou=People,dc=plainjoe,dc=org" to store users. Just configure your
+NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration
+file).
+</para>
+
+<para>
+In Samba release 3.0, the group management system is based on posix
+groups. This means that Samba make usage of the posixGroup objectclass.
+For now, there is no NT-like group system management (global and local
+groups).
+</para>
+
+</sect2>
+
+<sect2>
+<title>Security and sambaAccount</title>
+
+
+<para>
+There are two important points to remember when discussing the security
+of sambaAccount entries in the directory.
+</para>
+
+<itemizedlist>
+	<listitem><para><emphasis>Never</emphasis> retrieve the lmPassword or
+	ntPassword attribute values over an unencrypted LDAP session.</para></listitem>
+	<listitem><para><emphasis>Never</emphasis> allow non-admin users to
+	view the lmPassword or ntPassword attribute values.</para></listitem>
+</itemizedlist>
+
+<para>
+These password hashes are clear text equivalents and can be used to impersonate
+the user without deriving the original clear text strings.  For more information
+on the details of LM/NT password hashes, refer to the <ulink
+url="ENCRYPTION.html">ENCRYPTION chapter</ulink> of the Samba-HOWTO-Collection.
+</para>
+
+<para>
+To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults
+to require an encrypted session (<command>ldap ssl = on</command>) using
+the default port of 636
+when contacting the directory server.  When using an OpenLDAP 2.0 server, it
+is possible to use the use the StartTLS LDAP extended  operation in the place of
+LDAPS.  In either case, you are strongly discouraged to disable this security
+(<command>ldap ssl = off</command>).
+</para>
+
+<para>
+Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS
+extended operation.  However, the OpenLDAP library still provides support for
+the older method of securing communication between clients and servers.
+</para>
+
+<para>
+The second security precaution is to prevent non-administrative users from
+harvesting password hashes from the directory.  This can be done using the
+following ACL in <filename>slapd.conf</filename>:
+</para>
+
+<para><programlisting>
+## allow the "ldap admin dn" access, but deny everyone else
+access to attrs=lmPassword,ntPassword
+     by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write
+     by * none
+</programlisting></para>
+
+
+</sect2>
+
+
+
+<sect2>
+<title>LDAP specials attributes for sambaAccounts</title>
+
+<para>
+The sambaAccount objectclass is composed of the following attributes:
+</para>
+
+<itemizedlist>
+
+	<listitem><para><constant>lmPassword</constant>: the LANMAN password 16-byte hash stored as a character
+	representation of a hexidecimal string.</para></listitem>
+
+	<listitem><para><constant>ntPassword</constant>: the NT password hash 16-byte stored as a character
+	representation of a hexidecimal string.</para></listitem>
+
+	<listitem><para><constant>pwdLastSet</constant>: The integer time in seconds since 1970 when the
+	<constant>lmPassword</constant> and <constant>ntPassword</constant> attributes were last set.
+	</para></listitem>
+
+	<listitem><para><constant>acctFlags</constant>: string of 11 characters surrounded by square brackets []
+	representing account flags such as U (user), W(workstation), X(no password expiration), and
+	D(disabled).</para></listitem>
+
+	<listitem><para><constant>logonTime</constant>: Integer value currently unused</para></listitem>
+
+	<listitem><para><constant>logoffTime</constant>: Integer value currently unused</para></listitem>
+
+	<listitem><para><constant>kickoffTime</constant>: Integer value currently unused</para></listitem>
+
+	<listitem><para><constant>pwdCanChange</constant>: Integer value currently unused</para></listitem>
+
+	<listitem><para><constant>pwdMustChange</constant>: Integer value currently unused</para></listitem>
+
+	<listitem><para><constant>homeDrive</constant>: specifies the drive letter to which to map the
+	UNC path specified by homeDirectory. The drive letter must be specified in the form "X:"
+	where X is the letter of the drive to map. Refer to the "logon drive" parameter in the
+	smb.conf(5) man page for more information.</para></listitem>
+
+	<listitem><para><constant>scriptPath</constant>: The scriptPath property specifies the path of
+	the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path
+	is relative to the netlogon share.  Refer to the "logon script" parameter in the
+	smb.conf(5) man page for more information.</para></listitem>
+
+	<listitem><para><constant>profilePath</constant>: specifies a path to the user's profile.
+	This value can be a null string, a local absolute path, or a UNC path.  Refer to the
+	"logon path" parameter in the smb.conf(5) man page for more information.</para></listitem>
+
+	<listitem><para><constant>smbHome</constant>: The homeDirectory property specifies the path of
+	the home directory for the user. The string can be null. If homeDrive is set and specifies
+	a drive letter, homeDirectory should be a UNC path. The path must be a network
+	UNC path of the form \\server\share\directory. This value can be a null string.
+	Refer to the "logon home" parameter in the smb.conf(5) man page for more information.
+	</para></listitem>
+
+	<listitem><para><constant>userWorkstation</constant>: character string value currently unused.
+	</para></listitem>
+
+	<listitem><para><constant>rid</constant>: the integer representation of the user's relative identifier
+	(RID).</para></listitem>
+
+	<listitem><para><constant>primaryGroupID</constant>: the relative identifier (RID) of the primary group
+	of the user.</para></listitem>
+
+</itemizedlist>
+
+<para>
+The majority of these parameters are only used when Samba is acting as a PDC of
+a domain (refer to the <ulink url="Samba-PDC-HOWTO.html">Samba-PDC-HOWTO</ulink> for details on
+how to configure Samba as a Primary Domain Controller). The following four attributes
+are only stored with the sambaAccount entry if the values are non-default values:
+</para>
+
+<itemizedlist>
+	<listitem><para>smbHome</para></listitem>
+	<listitem><para>scriptPath</para></listitem>
+	<listitem><para>logonPath</para></listitem>
+	<listitem><para>homeDrive</para></listitem>
+</itemizedlist>
+
+<para>
+These attributes are only stored with the sambaAccount entry if
+the values are non-default values.  For example, assume TASHTEGO has now been
+configured as a PDC and that <command>logon home = \\%L\%u</command> was defined in
+its <filename>smb.conf</filename> file. When a user named "becky" logons to the domain,
+the <parameter>logon home</parameter> string is expanded to \\TASHTEGO\becky.
+If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org",
+this value is used.  However, if this attribute does not exist, then the value
+of the <parameter>logon home</parameter> parameter is used in its place.  Samba
+will only write the attribute value to the directory entry is the value is
+something other than the default (e.g. \\MOBY\becky).
+</para>
+
+
+</sect2>
+
+
+
+<sect2>
+<title>Example LDIF Entries for a sambaAccount</title>
+
+
+<para>
+The following is a working LDIF with the inclusion of the posixAccount objectclass:
+</para>
+
+<para><programlisting>
+dn: uid=guest2, ou=people,dc=plainjoe,dc=org
+ntPassword: 878D8014606CDA29677A44EFA1353FC7
+pwdMustChange: 2147483647
+primaryGroupID: 1201
+lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+pwdLastSet: 1010179124
+logonTime: 0
+objectClass: sambaAccount
+uid: guest2
+kickoffTime: 2147483647
+acctFlags: [UX         ]
+logoffTime: 2147483647
+rid: 19006
+pwdCanChange: 0
+</programlisting></para>
+
+<para>
+The following is an LDIF entry for using both the sambaAccount and
+posixAccount objectclasses:
+</para>
+
+<para><programlisting>
+dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
+logonTime: 0
+displayName: Gerald Carter
+lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+primaryGroupID: 1201
+objectClass: posixAccount
+objectClass: sambaAccount
+acctFlags: [UX         ]
+userPassword: {crypt}BpM2ej8Rkzogo
+uid: gcarter
+uidNumber: 9000
+cn: Gerald Carter
+loginShell: /bin/bash
+logoffTime: 2147483647
+gidNumber: 100
+kickoffTime: 2147483647
+pwdLastSet: 1010179230
+rid: 19000
+homeDirectory: /home/tashtego/gcarter
+pwdCanChange: 0
+pwdMustChange: 2147483647
+ntPassword: 878D8014606CDA29677A44EFA1353FC7
+</programlisting></para>
+
+</sect2>
+</sect1>
+
+<sect1>
+<title>MySQL</title>
+
+<sect2>
+<title>Building</title>
+
+<para>To build the plugin, run <command>make bin/pdb_mysql.so</command>
+in the <filename>source/</filename> directory of samba distribution. 
+</para>
+
+<para>Next, copy pdb_mysql.so to any location you want. I 
+strongly recommend installing it in $PREFIX/lib or /usr/lib/samba/</para>
+
+</sect2>
+
+<sect2>
+<title>Creating the database</title>
+
+<para>
+You either can set up your own table and specify the field names to pdb_mysql (see below
+for the column names) or use the default table. The file <filename>examples/pdb/mysql/mysql.dump</filename> 
+contains the correct queries to create the required tables. Use the command :
+
+<command>mysql -u<replaceable>username</replaceable> -h<replaceable>hostname</replaceable> -p<replaceable>password</replaceable> <replaceable>databasename</replaceable> < <filename>/path/to/samba/examples/pdb/mysql/mysql.dump</filename></command>
+
+</para>
+</sect2>
+
+<sect2>
+<title>Configuring</title>
+
+<para>This plugin lacks some good documentation, but here is some short info:</para>
+
+<para>Add a the following to the <command>passdb backend</command> variable in your <filename>smb.conf</filename>:
+<programlisting>
+passdb backend = [other-plugins] plugin:/location/to/pdb_mysql.so:identifier [other-plugins]
+</programlisting>
+</para>
+
+<para>The identifier can be any string you like, as long as it doesn't collide with 
+the identifiers of other plugins or other instances of pdb_mysql. If you 
+specify multiple pdb_mysql.so entries in 'passdb backend', you also need to 
+use different identifiers!
+</para>
+
+<para>
+Additional options can be given thru the smb.conf file in the [global] section.
+</para>
+
+<para><programlisting>
+identifier:mysql host                     - host name, defaults to 'localhost'
+identifier:mysql password
+identifier:mysql user                     - defaults to 'samba'
+identifier:mysql database                 - defaults to 'samba'
+identifier:mysql port                     - defaults to 3306
+identifier:table                          - Name of the table containing users
+</programlisting></para>
+
+<warning>
+<para>
+Since the password for the mysql user is stored in the 
+smb.conf file, you should make the the smb.conf file 
+readable only to the user that runs samba. This is considered a security 
+bug and will be fixed soon.
+</para>
+</warning>
+
+<para>Names of the columns in this table(I've added column types those columns should have first):</para>
+
+<para><programlisting>
+identifier:logon time column             - int(9)
+identifier:logoff time column            - int(9)
+identifier:kickoff time column           - int(9)
+identifier:pass last set time column     - int(9)
+identifier:pass can change time column   - int(9)
+identifier:pass must change time column  - int(9)
+identifier:username column               - varchar(255) - unix username
+identifier:domain column                 - varchar(255) - NT domain user is part of
+identifier:nt username column            - varchar(255) - NT username
+identifier:fullname column            - varchar(255) - Full name of user
+identifier:home dir column               - varchar(255) - Unix homedir path
+identifier:dir drive column              - varchar(2) - Directory drive path (eg: 'H:')
+identifier:logon script column           - varchar(255) - Batch file to run on client side when logging on
+identifier:profile path column           - varchar(255) - Path of profile
+identifier:acct desc column              - varchar(255) - Some ASCII NT user data
+identifier:workstations column           - varchar(255) - Workstations user can logon to (or NULL for all)
+identifier:unknown string column         - varchar(255) - unknown string
+identifier:munged dial column            - varchar(255) - ?
+identifier:uid column                    - int(9) - Unix user ID (uid)
+identifier:gid column                    - int(9) - Unix user group (gid)
+identifier:user sid column               - varchar(255) - NT user SID
+identifier:group sid column              - varchar(255) - NT group ID
+identifier:lanman pass column            - varchar(255) - encrypted lanman password
+identifier:nt pass column                - varchar(255) - encrypted nt passwd
+identifier:plain pass column             - varchar(255) - plaintext password
+identifier:acct control column           - int(9) - nt user data
+identifier:unknown 3 column              - int(9) - unknown
+identifier:logon divs column             - int(9) - ?
+identifier:hours len column              - int(9) - ?
+identifier:unknown 5 column              - int(9) - unknown
+identifier:unknown 6 column              - int(9) - unknown
+</programlisting></para>
+
+<para>
+Eventually, you can put a colon (:) after the name of each column, which 
+should specify the column to update when updating the table. You can also
+specify nothing behind the colon - then the data from the field will not be 
+updated. 
+</para>
+
+</sect2>
+
+<sect2>
+<title>Using plaintext passwords or encrypted password</title>
+
+<para>
+I strongly discourage the use of plaintext passwords, however, you can use them:
+</para>
+
+<para>
+If you would like to use plaintext passwords, set 'identifier:lanman pass column' and 'identifier:nt pass column' to 'NULL' (without the quotes) and 'identifier:plain pass column' to the name of the column containing the plaintext passwords. 
+</para>
+
+<para>
+If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Getting non-column data from the table</title>
+
+<para>
+It is possible to have not all data in the database and making some 'constant'.
+</para>
+
+<para>
+For example, you can set 'identifier:fullname column' to : 
+<command>CONCAT(First_name,' ',Sur_name)</command>
+</para>
+
+<para>
+Or, set 'identifier:workstations column' to :
+<command>NULL</command></para>
+
+<para>See the MySQL documentation for more language constructs.</para>
+
+</sect2>
+</sect1>
+
+<sect1>
+<title>Passdb XML plugin</title>
+
+<sect2>
+<title>Building</title>
+
+<para>This module requires libxml2 to be installed.</para>
+
+<para>To build pdb_xml, run: <command>make bin/pdb_xml.so</command> in 
+the directory <filename>source/</filename>. </para>
+
+</sect2>
+
+<sect2>
+<title>Usage</title>
+
+<para>The usage of pdb_xml is pretty straightforward. To export data, use:
+
+<command>pdbedit -e plugin:/usr/lib/samba/pdb_xml.so:filename</command>
+
+(where filename is the name of the file to put the data in)
+</para>
+
+<para>
+To import data, use:
+<command>pdbedit -i plugin:/usr/lib/samba/pdb_xml.so:filename -e current-pdb</command>
+
+Where filename is the name to read the data from and current-pdb to put it in.
+</para>
+</sect2>
+</sect1>
+
+</chapter>
diff --git a/docs/docbook/projdoc/unicode.sgml b/docs/docbook/projdoc/unicode.sgml
new file mode 100644
index 0000000000..7d8f0a03be
--- /dev/null
+++ b/docs/docbook/projdoc/unicode.sgml
@@ -0,0 +1,93 @@
+<chapter id="unicode">
+<chapterinfo>
+	<author>
+		<firstname>Jelmer</firstname><surname>Vernooij</surname>
+		<affiliation>
+			<orgname>Samba Team</orgname>
+			<address><email>jelmer@samba.org</email></address>
+		</affiliation>
+	</author>
+	<pubdate>25 March 2003</pubdate>
+</chapterinfo>
+
+<title>Unicode/Charsets</title>
+
+<sect1>
+<title>What are charsets and unicode?</title>
+
+<para>
+Computers communicate in numbers. In texts, each number will be 
+translated to a corresponding letter. The meaning that will be assigned 
+to a certain number depends on the <emphasis>character set(charset)
+</emphasis> that is used. 
+A charset can be seen as a table that is used to translate numbers to 
+letters. Not all computers use the same charset (there are charsets 
+with German umlauts, Japanese characters, etc). Usually a charset contains 
+256 characters, which means that storing a character with it takes 
+exactly one byte. </para>
+
+<para>
+There are also charsets that support even more characters, 
+but those need twice(or even more) as much storage space. These 
+charsets can contain <command>256 * 256 = 65536</command> characters, which
+is more then all possible characters one could think of. They are called 
+multibyte charsets (because they use more then one byte to 
+store one character). 
+</para>
+
+<para>
+A standardised multibyte charset is unicode, info available at 
+<ulink url="http://www.unicode.org/">www.unicode.org</ulink>. 
+Big advantage of using a multibyte charset is that you only need one; no 
+need to make sure two computers use the same charset when they are 
+communicating.
+</para>
+
+<para>Old windows clients used to use single-byte charsets, named 
+'codepages' by microsoft. However, there is no support for 
+negotiating the charset to be used in the smb protocol. Thus, you 
+have to make sure you are using the same charset when talking to an old client.
+Newer clients (Windows NT, 2K, XP) talk unicode over the wire.
+</para>
+</sect1>
+
+<sect1>
+<title>Samba and charsets</title>
+
+<para>
+As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, 
+samba knows of three kinds of character sets: 
+</para>
+
+<variablelist>
+	<varlistentry>
+		<term>unix charset</term>
+		<listitem><para>
+		This is the charset used internally by your operating system. 
+		The default is <emphasis>ASCII</emphasis>, which is fine for most 
+		systems.
+		</para></listitem>
+	</varlistentry>
+
+	<varlistentry>
+		<term>display charset</term>
+		<listitem><para>This is the charset samba will use to print messages
+		on your screen. It should generally be the same as the <command>unix charset</command>.
+		</para></listitem>
+	</varlistentry>
+
+	<varlistentry>
+		<term>dos charset</term>
+		<listitem><para>This is the charset samba uses when communicating with 
+		DOS and Windows 9x clients. It will talk unicode to all newer clients.
+		The default depends on the charsets you have installed on your system.
+		Run <command>testparm -v | grep "dos charset"</command> to see 
+		what the default is on your system. 
+		</para></listitem>
+	</varlistentry>
+</variablelist>
+
+<para>
+
+</sect1>
+</chapter>