diff options
author | John Terpstra <jht@samba.org> | 2007-08-20 22:47:12 +0000 |
---|---|---|
committer | Gerald W. Carter <jerry@samba.org> | 2008-04-23 08:47:36 -0500 |
commit | a7bcf077a471535026e38728320bc9fbe86a2dcf (patch) | |
tree | ec3bed602787aac503f1c413dab5d04cdec59edd /docs/manpages-3/winbindd.8.xml | |
parent | 8a6db516f3d04b012a4b09e5f4f8dc0f9f872c92 (diff) | |
download | samba-a7bcf077a471535026e38728320bc9fbe86a2dcf.tar.gz samba-a7bcf077a471535026e38728320bc9fbe86a2dcf.tar.bz2 samba-a7bcf077a471535026e38728320bc9fbe86a2dcf.zip |
Cleanup trailing whitespace.
(This used to be commit 232e5e548ec2219944c3002dda355b377a1ea711)
Diffstat (limited to 'docs/manpages-3/winbindd.8.xml')
-rw-r--r-- | docs/manpages-3/winbindd.8.xml | 206 |
1 files changed, 103 insertions, 103 deletions
diff --git a/docs/manpages-3/winbindd.8.xml b/docs/manpages-3/winbindd.8.xml index d377a3f5f0..0749b295aa 100644 --- a/docs/manpages-3/winbindd.8.xml +++ b/docs/manpages-3/winbindd.8.xml @@ -10,7 +10,7 @@ <refnamediv> <refname>winbindd</refname> - <refpurpose>Name Service Switch daemon for resolving names + <refpurpose>Name Service Switch daemon for resolving names from NT servers</refpurpose> </refnamediv> @@ -33,7 +33,7 @@ <para>This program is part of the <citerefentry><refentrytitle>samba</refentrytitle> <manvolnum>7</manvolnum></citerefentry> suite.</para> - <para><command>winbindd</command> is a daemon that provides + <para><command>winbindd</command> is a daemon that provides a number of services to the Name Service Switch capability found in most modern C libraries, to arbitary applications via PAM and <command>ntlm_auth</command> and to Samba itself.</para> @@ -46,24 +46,24 @@ <smbconfoption name="idmap gid"/> parameters are not required. (This is known as `netlogon proxy only mode'.)</para> - <para> The Name Service Switch allows user - and system information to be obtained from different databases - services such as NIS or DNS. The exact behaviour can be configured - throught the <filename>/etc/nsswitch.conf</filename> file. - Users and groups are allocated as they are resolved to a range - of user and group ids specified by the administrator of the + <para> The Name Service Switch allows user + and system information to be obtained from different databases + services such as NIS or DNS. The exact behaviour can be configured + throught the <filename>/etc/nsswitch.conf</filename> file. + Users and groups are allocated as they are resolved to a range + of user and group ids specified by the administrator of the Samba system.</para> - <para>The service provided by <command>winbindd</command> is called `winbind' and - can be used to resolve user and group information from a + <para>The service provided by <command>winbindd</command> is called `winbind' and + can be used to resolve user and group information from a Windows NT server. The service can also provide authentication services via an associated PAM module. </para> - + <para> The <filename>pam_winbind</filename> module supports the <parameter>auth</parameter>, <parameter>account</parameter> and <parameter>password</parameter> - module-types. It should be noted that the + module-types. It should be noted that the <parameter>account</parameter> module simply performs a getpwnam() to verify that the system can obtain a uid for the user, as the domain controller has already performed access control. If the @@ -71,15 +71,15 @@ installed, or an alternate source of names configured, this should always succeed. </para> - <para>The following nsswitch databases are implemented by + <para>The following nsswitch databases are implemented by the winbindd service: </para> <variablelist> <varlistentry> <term>hosts</term> <listitem><para>This feature is only available on IRIX. - User information traditionally stored in - the <filename>hosts(5)</filename> file and used by + User information traditionally stored in + the <filename>hosts(5)</filename> file and used by <command>gethostbyname(3)</command> functions. Names are resolved through the WINS server or by broadcast. </para></listitem> @@ -87,30 +87,30 @@ <varlistentry> <term>passwd</term> - <listitem><para>User information traditionally stored in - the <filename>passwd(5)</filename> file and used by + <listitem><para>User information traditionally stored in + the <filename>passwd(5)</filename> file and used by <command>getpwent(3)</command> functions. </para></listitem> </varlistentry> <varlistentry> <term>group</term> - <listitem><para>Group information traditionally stored in - the <filename>group(5)</filename> file and used by + <listitem><para>Group information traditionally stored in + the <filename>group(5)</filename> file and used by <command>getgrent(3)</command> functions. </para></listitem> </varlistentry> </variablelist> <para>For example, the following simple configuration in the - <filename>/etc/nsswitch.conf</filename> file can be used to initially + <filename>/etc/nsswitch.conf</filename> file can be used to initially resolve user and group information from <filename>/etc/passwd - </filename> and <filename>/etc/group</filename> and then from the + </filename> and <filename>/etc/group</filename> and then from the Windows NT server. <programlisting> passwd: files winbind group: files winbind ## only available on IRIX; Linux users should us libnss_wins.so hosts: files dns winbind -</programlisting></para> +</programlisting></para> <para>The following simple configuration in the <filename>/etc/nsswitch.conf</filename> file can be used to initially @@ -154,9 +154,9 @@ hosts: files wins <varlistentry> <term>-i</term> - <listitem><para>Tells <command>winbindd</command> to not - become a daemon and detach from the current terminal. This - option is used by developers when interactive debugging + <listitem><para>Tells <command>winbindd</command> to not + become a daemon and detach from the current terminal. This + option is used by developers when interactive debugging of <command>winbindd</command> is required. <command>winbindd</command> also logs to standard output, as if the <command>-S</command> parameter had been given. @@ -165,20 +165,20 @@ hosts: files wins <varlistentry> <term>-n</term> - <listitem><para>Disable caching. This means winbindd will - always have to wait for a response from the domain controller - before it can respond to a client and this thus makes things - slower. The results will however be more accurate, since - results from the cache might not be up-to-date. This + <listitem><para>Disable caching. This means winbindd will + always have to wait for a response from the domain controller + before it can respond to a client and this thus makes things + slower. The results will however be more accurate, since + results from the cache might not be up-to-date. This might also temporarily hang winbindd if the DC doesn't respond. </para></listitem> </varlistentry> <varlistentry> <term>-Y</term> - <listitem><para>Single daemon mode. This means winbindd will run - as a single process (the mode of operation in Samba 2.2). Winbindd's - default behavior is to launch a child process that is responsible for + <listitem><para>Single daemon mode. This means winbindd will run + as a single process (the mode of operation in Samba 2.2). Winbindd's + default behavior is to launch a child process that is responsible for updating expired cache entries. </para></listitem> </varlistentry> @@ -190,24 +190,24 @@ hosts: files wins <refsect1> <title>NAME AND ID RESOLUTION</title> - <para>Users and groups on a Windows NT server are assigned - a security id (SID) which is globally unique when the - user or group is created. To convert the Windows NT user or group - into a unix user or group, a mapping between SIDs and unix user + <para>Users and groups on a Windows NT server are assigned + a security id (SID) which is globally unique when the + user or group is created. To convert the Windows NT user or group + into a unix user or group, a mapping between SIDs and unix user and group ids is required. This is one of the jobs that <command> winbindd</command> performs. </para> - <para>As winbindd users and groups are resolved from a server, user + <para>As winbindd users and groups are resolved from a server, user and group ids are allocated from a specified range. This - is done on a first come, first served basis, although all existing - users and groups will be mapped as soon as a client performs a user - or group enumeration command. The allocated unix ids are stored + is done on a first come, first served basis, although all existing + users and groups will be mapped as soon as a client performs a user + or group enumeration command. The allocated unix ids are stored in a database and will be remembered. </para> - <para>WARNING: The SID to unix id database is the only location - where the user and group mappings are stored by winbindd. If this - store is deleted or corrupted, there is no way for winbindd to - determine which user and group ids correspond to Windows NT user + <para>WARNING: The SID to unix id database is the only location + where the user and group mappings are stored by winbindd. If this + store is deleted or corrupted, there is no way for winbindd to + determine which user and group ids correspond to Windows NT user and group rids. </para> <para>See the <smbconfoption><name>idmap @@ -221,10 +221,10 @@ hosts: files wins <refsect1> <title>CONFIGURATION</title> - <para>Configuration of the <command>winbindd</command> daemon + <para>Configuration of the <command>winbindd</command> daemon is done through configuration parameters in the <citerefentry> <refentrytitle>smb.conf</refentrytitle><manvolnum>5</manvolnum> - </citerefentry> file. All parameters should be specified in the + </citerefentry> file. All parameters should be specified in the [global] section of smb.conf. </para> <itemizedlist> @@ -262,18 +262,18 @@ hosts: files wins <title>EXAMPLE SETUP</title> <para> - To setup winbindd for user and group lookups plus - authentication from a domain controller use something like the + To setup winbindd for user and group lookups plus + authentication from a domain controller use something like the following setup. This was tested on an early Red Hat Linux box. </para> - <para>In <filename>/etc/nsswitch.conf</filename> put the + <para>In <filename>/etc/nsswitch.conf</filename> put the following: <programlisting> passwd: files winbind group: files winbind </programlisting> - </para> + </para> <para>In <filename>/etc/pam.d/*</filename> replace the <parameter> auth</parameter> lines with something like this: @@ -285,7 +285,7 @@ auth required /lib/security/pam_unix.so \ use_first_pass shadow nullok </programlisting> </para> - + <note><para> The PAM module pam_unix has recently replaced the module pam_pwdb. Some Linux systems use the module pam_unix2 in place of pam_unix. @@ -294,21 +294,21 @@ auth required /lib/security/pam_unix.so \ <para>Note in particular the use of the <parameter>sufficient </parameter> keyword and the <parameter>use_first_pass</parameter> keyword. </para> - <para>Now replace the account lines with this: </para> - + <para>Now replace the account lines with this: </para> + <para><command>account required /lib/security/pam_winbind.so </command></para> - - <para>The next step is to join the domain. To do that use the + + <para>The next step is to join the domain. To do that use the <command>net</command> program like this: </para> - + <para><command>net join -S PDC -U Administrator</command></para> - + <para>The username after the <parameter>-U</parameter> can be any Domain user that has administrator privileges on the machine. Substitute the name or IP of your PDC for "PDC".</para> - <para>Next copy <filename>libnss_winbind.so</filename> to + <para>Next copy <filename>libnss_winbind.so</filename> to <filename>/lib</filename> and <filename>pam_winbind.so </filename> to <filename>/lib/security</filename>. A symbolic link needs to be made from <filename>/lib/libnss_winbind.so</filename> to @@ -317,7 +317,7 @@ auth required /lib/security/pam_unix.so \ <filename>/lib/libnss_winbind.so.1</filename>.</para> <para>Finally, setup a <citerefentry><refentrytitle>smb.conf</refentrytitle> - <manvolnum>5</manvolnum></citerefentry> containing directives like the + <manvolnum>5</manvolnum></citerefentry> containing directives like the following: <programlisting> [global] @@ -331,12 +331,12 @@ auth required /lib/security/pam_unix.so \ security = domain password server = * </programlisting></para> - - <para>Now start winbindd and you should find that your user and - group database is expanded to include your NT users and groups, - and that you can login to your unix box as a domain user, using - the DOMAIN+user syntax for the username. You may wish to use the + + <para>Now start winbindd and you should find that your user and + group database is expanded to include your NT users and groups, + and that you can login to your unix box as a domain user, using + the DOMAIN+user syntax for the username. You may wish to use the commands <command>getent passwd</command> and <command>getent group </command> to confirm the correct operation of winbindd.</para> </refsect1> @@ -345,24 +345,24 @@ auth required /lib/security/pam_unix.so \ <refsect1> <title>NOTES</title> - <para>The following notes are useful when configuring and + <para>The following notes are useful when configuring and running <command>winbindd</command>: </para> <para><citerefentry><refentrytitle>nmbd</refentrytitle> - <manvolnum>8</manvolnum></citerefentry> must be running on the local machine + <manvolnum>8</manvolnum></citerefentry> must be running on the local machine for <command>winbindd</command> to work. </para> - <para>PAM is really easy to misconfigure. Make sure you know what - you are doing when modifying PAM configuration files. It is possible + <para>PAM is really easy to misconfigure. Make sure you know what + you are doing when modifying PAM configuration files. It is possible to set up PAM such that you can no longer log into your system. </para> - - <para>If more than one UNIX machine is running <command>winbindd</command>, - then in general the user and groups ids allocated by winbindd will not - be the same. The user and group ids will only be valid for the local + + <para>If more than one UNIX machine is running <command>winbindd</command>, + then in general the user and groups ids allocated by winbindd will not + be the same. The user and group ids will only be valid for the local machine, unless a shared <smbconfoption><name>idmap backend</name></smbconfoption> is configured.</para> - <para>If the the Windows NT SID to UNIX user and group id mapping + <para>If the the Windows NT SID to UNIX user and group id mapping file is damaged or destroyed then the mappings will be lost. </para> </refsect1> @@ -370,27 +370,27 @@ auth required /lib/security/pam_unix.so \ <refsect1> <title>SIGNALS</title> - <para>The following signals can be used to manipulate the + <para>The following signals can be used to manipulate the <command>winbindd</command> daemon. </para> <variablelist> <varlistentry> <term>SIGHUP</term> <listitem><para>Reload the <citerefentry><refentrytitle>smb.conf</refentrytitle> - <manvolnum>5</manvolnum></citerefentry> file and - apply any parameter changes to the running - version of winbindd. This signal also clears any cached - user and group information. The list of other domains trusted + <manvolnum>5</manvolnum></citerefentry> file and + apply any parameter changes to the running + version of winbindd. This signal also clears any cached + user and group information. The list of other domains trusted by winbindd is also reloaded. </para></listitem> </varlistentry> <varlistentry> <term>SIGUSR2</term> <listitem><para>The SIGUSR2 signal will cause <command> - winbindd</command> to write status information to the winbind + winbindd</command> to write status information to the winbind log file.</para> - <para>Log files are stored in the filename specified by the + <para>Log files are stored in the filename specified by the log file parameter.</para></listitem> </varlistentry> </variablelist> @@ -405,29 +405,29 @@ auth required /lib/security/pam_unix.so \ <listitem><para>Name service switch configuration file.</para> </listitem> </varlistentry> - + <varlistentry> <term>/tmp/.winbindd/pipe</term> - <listitem><para>The UNIX pipe over which clients communicate with - the <command>winbindd</command> program. For security reasons, the - winbind client will only attempt to connect to the winbindd daemon + <listitem><para>The UNIX pipe over which clients communicate with + the <command>winbindd</command> program. For security reasons, the + winbind client will only attempt to connect to the winbindd daemon if both the <filename>/tmp/.winbindd</filename> directory - and <filename>/tmp/.winbindd/pipe</filename> file are owned by + and <filename>/tmp/.winbindd/pipe</filename> file are owned by root. </para></listitem> </varlistentry> <varlistentry> <term>$LOCKDIR/winbindd_privileged/pipe</term> - <listitem><para>The UNIX pipe over which 'privileged' clients - communicate with the <command>winbindd</command> program. For security - reasons, access to some winbindd functions - like those needed by + <listitem><para>The UNIX pipe over which 'privileged' clients + communicate with the <command>winbindd</command> program. For security + reasons, access to some winbindd functions - like those needed by the <command>ntlm_auth</command> utility - is restricted. By default, only users in the 'root' group will get this access, however the administrator may change the group permissions on $LOCKDIR/winbindd_privileged to allow programs like 'squid' to use ntlm_auth. - Note that the winbind client will only attempt to connect to the winbindd daemon + Note that the winbind client will only attempt to connect to the winbindd daemon if both the <filename>$LOCKDIR/winbindd_privileged</filename> directory - and <filename>$LOCKDIR/winbindd_privileged/pipe</filename> file are owned by + and <filename>$LOCKDIR/winbindd_privileged/pipe</filename> file are owned by root. </para></listitem> </varlistentry> @@ -436,16 +436,16 @@ auth required /lib/security/pam_unix.so \ <listitem><para>Implementation of name service switch library. </para></listitem> </varlistentry> - + <varlistentry> <term>$LOCKDIR/winbindd_idmap.tdb</term> - <listitem><para>Storage for the Windows NT rid to UNIX user/group - id mapping. The lock directory is specified when Samba is initially + <listitem><para>Storage for the Windows NT rid to UNIX user/group + id mapping. The lock directory is specified when Samba is initially compiled using the <parameter>--with-lockdir</parameter> option. This directory is by default <filename>/usr/local/samba/var/locks </filename>. </para></listitem> </varlistentry> - + <varlistentry> <term>$LOCKDIR/winbindd_cache.tdb</term> <listitem><para>Storage for cached user and group information. @@ -464,7 +464,7 @@ auth required /lib/security/pam_unix.so \ <refsect1> <title>SEE ALSO</title> - + <para><filename>nsswitch.conf(5)</filename>, <citerefentry> <refentrytitle>samba</refentrytitle> <manvolnum>7</manvolnum></citerefentry>, <citerefentry> @@ -480,16 +480,16 @@ auth required /lib/security/pam_unix.so \ <refsect1> <title>AUTHOR</title> - - <para>The original Samba software and related utilities + + <para>The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed - by the Samba Team as an Open Source project similar + by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.</para> - - <para><command>wbinfo</command> and <command>winbindd</command> were + + <para><command>wbinfo</command> and <command>winbindd</command> were written by Tim Potter.</para> - - <para>The conversion to DocBook for Samba 2.2 was done + + <para>The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.</para> </refsect1> |