summaryrefslogtreecommitdiff
path: root/docs/manpages-3/winbindd.8.xml
diff options
context:
space:
mode:
authorJohn Terpstra <jht@samba.org>2007-08-20 22:47:12 +0000
committerGerald W. Carter <jerry@samba.org>2008-04-23 08:47:36 -0500
commita7bcf077a471535026e38728320bc9fbe86a2dcf (patch)
treeec3bed602787aac503f1c413dab5d04cdec59edd /docs/manpages-3/winbindd.8.xml
parent8a6db516f3d04b012a4b09e5f4f8dc0f9f872c92 (diff)
downloadsamba-a7bcf077a471535026e38728320bc9fbe86a2dcf.tar.gz
samba-a7bcf077a471535026e38728320bc9fbe86a2dcf.tar.bz2
samba-a7bcf077a471535026e38728320bc9fbe86a2dcf.zip
Cleanup trailing whitespace.
(This used to be commit 232e5e548ec2219944c3002dda355b377a1ea711)
Diffstat (limited to 'docs/manpages-3/winbindd.8.xml')
-rw-r--r--docs/manpages-3/winbindd.8.xml206
1 files changed, 103 insertions, 103 deletions
diff --git a/docs/manpages-3/winbindd.8.xml b/docs/manpages-3/winbindd.8.xml
index d377a3f5f0..0749b295aa 100644
--- a/docs/manpages-3/winbindd.8.xml
+++ b/docs/manpages-3/winbindd.8.xml
@@ -10,7 +10,7 @@
<refnamediv>
<refname>winbindd</refname>
- <refpurpose>Name Service Switch daemon for resolving names
+ <refpurpose>Name Service Switch daemon for resolving names
from NT servers</refpurpose>
</refnamediv>
@@ -33,7 +33,7 @@
<para>This program is part of the <citerefentry><refentrytitle>samba</refentrytitle>
<manvolnum>7</manvolnum></citerefentry> suite.</para>
- <para><command>winbindd</command> is a daemon that provides
+ <para><command>winbindd</command> is a daemon that provides
a number of services to the Name Service Switch capability found
in most modern C libraries, to arbitary applications via PAM
and <command>ntlm_auth</command> and to Samba itself.</para>
@@ -46,24 +46,24 @@
<smbconfoption name="idmap gid"/>
parameters are not required. (This is known as `netlogon proxy only mode'.)</para>
- <para> The Name Service Switch allows user
- and system information to be obtained from different databases
- services such as NIS or DNS. The exact behaviour can be configured
- throught the <filename>/etc/nsswitch.conf</filename> file.
- Users and groups are allocated as they are resolved to a range
- of user and group ids specified by the administrator of the
+ <para> The Name Service Switch allows user
+ and system information to be obtained from different databases
+ services such as NIS or DNS. The exact behaviour can be configured
+ throught the <filename>/etc/nsswitch.conf</filename> file.
+ Users and groups are allocated as they are resolved to a range
+ of user and group ids specified by the administrator of the
Samba system.</para>
- <para>The service provided by <command>winbindd</command> is called `winbind' and
- can be used to resolve user and group information from a
+ <para>The service provided by <command>winbindd</command> is called `winbind' and
+ can be used to resolve user and group information from a
Windows NT server. The service can also provide authentication
services via an associated PAM module. </para>
-
+
<para>
The <filename>pam_winbind</filename> module supports the
<parameter>auth</parameter>, <parameter>account</parameter>
and <parameter>password</parameter>
- module-types. It should be noted that the
+ module-types. It should be noted that the
<parameter>account</parameter> module simply performs a getpwnam() to verify that
the system can obtain a uid for the user, as the domain
controller has already performed access control. If the
@@ -71,15 +71,15 @@
installed, or an alternate source of names configured, this should always succeed.
</para>
- <para>The following nsswitch databases are implemented by
+ <para>The following nsswitch databases are implemented by
the winbindd service: </para>
<variablelist>
<varlistentry>
<term>hosts</term>
<listitem><para>This feature is only available on IRIX.
- User information traditionally stored in
- the <filename>hosts(5)</filename> file and used by
+ User information traditionally stored in
+ the <filename>hosts(5)</filename> file and used by
<command>gethostbyname(3)</command> functions. Names are
resolved through the WINS server or by broadcast.
</para></listitem>
@@ -87,30 +87,30 @@
<varlistentry>
<term>passwd</term>
- <listitem><para>User information traditionally stored in
- the <filename>passwd(5)</filename> file and used by
+ <listitem><para>User information traditionally stored in
+ the <filename>passwd(5)</filename> file and used by
<command>getpwent(3)</command> functions. </para></listitem>
</varlistentry>
<varlistentry>
<term>group</term>
- <listitem><para>Group information traditionally stored in
- the <filename>group(5)</filename> file and used by
+ <listitem><para>Group information traditionally stored in
+ the <filename>group(5)</filename> file and used by
<command>getgrent(3)</command> functions. </para></listitem>
</varlistentry>
</variablelist>
<para>For example, the following simple configuration in the
- <filename>/etc/nsswitch.conf</filename> file can be used to initially
+ <filename>/etc/nsswitch.conf</filename> file can be used to initially
resolve user and group information from <filename>/etc/passwd
- </filename> and <filename>/etc/group</filename> and then from the
+ </filename> and <filename>/etc/group</filename> and then from the
Windows NT server.
<programlisting>
passwd: files winbind
group: files winbind
## only available on IRIX; Linux users should us libnss_wins.so
hosts: files dns winbind
-</programlisting></para>
+</programlisting></para>
<para>The following simple configuration in the
<filename>/etc/nsswitch.conf</filename> file can be used to initially
@@ -154,9 +154,9 @@ hosts: files wins
<varlistentry>
<term>-i</term>
- <listitem><para>Tells <command>winbindd</command> to not
- become a daemon and detach from the current terminal. This
- option is used by developers when interactive debugging
+ <listitem><para>Tells <command>winbindd</command> to not
+ become a daemon and detach from the current terminal. This
+ option is used by developers when interactive debugging
of <command>winbindd</command> is required.
<command>winbindd</command> also logs to standard output,
as if the <command>-S</command> parameter had been given.
@@ -165,20 +165,20 @@ hosts: files wins
<varlistentry>
<term>-n</term>
- <listitem><para>Disable caching. This means winbindd will
- always have to wait for a response from the domain controller
- before it can respond to a client and this thus makes things
- slower. The results will however be more accurate, since
- results from the cache might not be up-to-date. This
+ <listitem><para>Disable caching. This means winbindd will
+ always have to wait for a response from the domain controller
+ before it can respond to a client and this thus makes things
+ slower. The results will however be more accurate, since
+ results from the cache might not be up-to-date. This
might also temporarily hang winbindd if the DC doesn't respond.
</para></listitem>
</varlistentry>
<varlistentry>
<term>-Y</term>
- <listitem><para>Single daemon mode. This means winbindd will run
- as a single process (the mode of operation in Samba 2.2). Winbindd's
- default behavior is to launch a child process that is responsible for
+ <listitem><para>Single daemon mode. This means winbindd will run
+ as a single process (the mode of operation in Samba 2.2). Winbindd's
+ default behavior is to launch a child process that is responsible for
updating expired cache entries.
</para></listitem>
</varlistentry>
@@ -190,24 +190,24 @@ hosts: files wins
<refsect1>
<title>NAME AND ID RESOLUTION</title>
- <para>Users and groups on a Windows NT server are assigned
- a security id (SID) which is globally unique when the
- user or group is created. To convert the Windows NT user or group
- into a unix user or group, a mapping between SIDs and unix user
+ <para>Users and groups on a Windows NT server are assigned
+ a security id (SID) which is globally unique when the
+ user or group is created. To convert the Windows NT user or group
+ into a unix user or group, a mapping between SIDs and unix user
and group ids is required. This is one of the jobs that <command>
winbindd</command> performs. </para>
- <para>As winbindd users and groups are resolved from a server, user
+ <para>As winbindd users and groups are resolved from a server, user
and group ids are allocated from a specified range. This
- is done on a first come, first served basis, although all existing
- users and groups will be mapped as soon as a client performs a user
- or group enumeration command. The allocated unix ids are stored
+ is done on a first come, first served basis, although all existing
+ users and groups will be mapped as soon as a client performs a user
+ or group enumeration command. The allocated unix ids are stored
in a database and will be remembered. </para>
- <para>WARNING: The SID to unix id database is the only location
- where the user and group mappings are stored by winbindd. If this
- store is deleted or corrupted, there is no way for winbindd to
- determine which user and group ids correspond to Windows NT user
+ <para>WARNING: The SID to unix id database is the only location
+ where the user and group mappings are stored by winbindd. If this
+ store is deleted or corrupted, there is no way for winbindd to
+ determine which user and group ids correspond to Windows NT user
and group rids. </para>
<para>See the <smbconfoption><name>idmap
@@ -221,10 +221,10 @@ hosts: files wins
<refsect1>
<title>CONFIGURATION</title>
- <para>Configuration of the <command>winbindd</command> daemon
+ <para>Configuration of the <command>winbindd</command> daemon
is done through configuration parameters in the <citerefentry>
<refentrytitle>smb.conf</refentrytitle><manvolnum>5</manvolnum>
- </citerefentry> file. All parameters should be specified in the
+ </citerefentry> file. All parameters should be specified in the
[global] section of smb.conf. </para>
<itemizedlist>
@@ -262,18 +262,18 @@ hosts: files wins
<title>EXAMPLE SETUP</title>
<para>
- To setup winbindd for user and group lookups plus
- authentication from a domain controller use something like the
+ To setup winbindd for user and group lookups plus
+ authentication from a domain controller use something like the
following setup. This was tested on an early Red Hat Linux box.
</para>
- <para>In <filename>/etc/nsswitch.conf</filename> put the
+ <para>In <filename>/etc/nsswitch.conf</filename> put the
following:
<programlisting>
passwd: files winbind
group: files winbind
</programlisting>
- </para>
+ </para>
<para>In <filename>/etc/pam.d/*</filename> replace the <parameter>
auth</parameter> lines with something like this:
@@ -285,7 +285,7 @@ auth required /lib/security/pam_unix.so \
use_first_pass shadow nullok
</programlisting>
</para>
-
+
<note><para>
The PAM module pam_unix has recently replaced the module pam_pwdb.
Some Linux systems use the module pam_unix2 in place of pam_unix.
@@ -294,21 +294,21 @@ auth required /lib/security/pam_unix.so \
<para>Note in particular the use of the <parameter>sufficient
</parameter> keyword and the <parameter>use_first_pass</parameter> keyword. </para>
- <para>Now replace the account lines with this: </para>
-
+ <para>Now replace the account lines with this: </para>
+
<para><command>account required /lib/security/pam_winbind.so
</command></para>
-
- <para>The next step is to join the domain. To do that use the
+
+ <para>The next step is to join the domain. To do that use the
<command>net</command> program like this: </para>
-
+
<para><command>net join -S PDC -U Administrator</command></para>
-
+
<para>The username after the <parameter>-U</parameter> can be any
Domain user that has administrator privileges on the machine.
Substitute the name or IP of your PDC for "PDC".</para>
- <para>Next copy <filename>libnss_winbind.so</filename> to
+ <para>Next copy <filename>libnss_winbind.so</filename> to
<filename>/lib</filename> and <filename>pam_winbind.so
</filename> to <filename>/lib/security</filename>. A symbolic link needs to be
made from <filename>/lib/libnss_winbind.so</filename> to
@@ -317,7 +317,7 @@ auth required /lib/security/pam_unix.so \
<filename>/lib/libnss_winbind.so.1</filename>.</para>
<para>Finally, setup a <citerefentry><refentrytitle>smb.conf</refentrytitle>
- <manvolnum>5</manvolnum></citerefentry> containing directives like the
+ <manvolnum>5</manvolnum></citerefentry> containing directives like the
following:
<programlisting>
[global]
@@ -331,12 +331,12 @@ auth required /lib/security/pam_unix.so \
security = domain
password server = *
</programlisting></para>
-
- <para>Now start winbindd and you should find that your user and
- group database is expanded to include your NT users and groups,
- and that you can login to your unix box as a domain user, using
- the DOMAIN+user syntax for the username. You may wish to use the
+
+ <para>Now start winbindd and you should find that your user and
+ group database is expanded to include your NT users and groups,
+ and that you can login to your unix box as a domain user, using
+ the DOMAIN+user syntax for the username. You may wish to use the
commands <command>getent passwd</command> and <command>getent group
</command> to confirm the correct operation of winbindd.</para>
</refsect1>
@@ -345,24 +345,24 @@ auth required /lib/security/pam_unix.so \
<refsect1>
<title>NOTES</title>
- <para>The following notes are useful when configuring and
+ <para>The following notes are useful when configuring and
running <command>winbindd</command>: </para>
<para><citerefentry><refentrytitle>nmbd</refentrytitle>
- <manvolnum>8</manvolnum></citerefentry> must be running on the local machine
+ <manvolnum>8</manvolnum></citerefentry> must be running on the local machine
for <command>winbindd</command> to work. </para>
- <para>PAM is really easy to misconfigure. Make sure you know what
- you are doing when modifying PAM configuration files. It is possible
+ <para>PAM is really easy to misconfigure. Make sure you know what
+ you are doing when modifying PAM configuration files. It is possible
to set up PAM such that you can no longer log into your system. </para>
-
- <para>If more than one UNIX machine is running <command>winbindd</command>,
- then in general the user and groups ids allocated by winbindd will not
- be the same. The user and group ids will only be valid for the local
+
+ <para>If more than one UNIX machine is running <command>winbindd</command>,
+ then in general the user and groups ids allocated by winbindd will not
+ be the same. The user and group ids will only be valid for the local
machine, unless a shared <smbconfoption><name>idmap
backend</name></smbconfoption> is configured.</para>
- <para>If the the Windows NT SID to UNIX user and group id mapping
+ <para>If the the Windows NT SID to UNIX user and group id mapping
file is damaged or destroyed then the mappings will be lost. </para>
</refsect1>
@@ -370,27 +370,27 @@ auth required /lib/security/pam_unix.so \
<refsect1>
<title>SIGNALS</title>
- <para>The following signals can be used to manipulate the
+ <para>The following signals can be used to manipulate the
<command>winbindd</command> daemon. </para>
<variablelist>
<varlistentry>
<term>SIGHUP</term>
<listitem><para>Reload the <citerefentry><refentrytitle>smb.conf</refentrytitle>
- <manvolnum>5</manvolnum></citerefentry> file and
- apply any parameter changes to the running
- version of winbindd. This signal also clears any cached
- user and group information. The list of other domains trusted
+ <manvolnum>5</manvolnum></citerefentry> file and
+ apply any parameter changes to the running
+ version of winbindd. This signal also clears any cached
+ user and group information. The list of other domains trusted
by winbindd is also reloaded. </para></listitem>
</varlistentry>
<varlistentry>
<term>SIGUSR2</term>
<listitem><para>The SIGUSR2 signal will cause <command>
- winbindd</command> to write status information to the winbind
+ winbindd</command> to write status information to the winbind
log file.</para>
- <para>Log files are stored in the filename specified by the
+ <para>Log files are stored in the filename specified by the
log file parameter.</para></listitem>
</varlistentry>
</variablelist>
@@ -405,29 +405,29 @@ auth required /lib/security/pam_unix.so \
<listitem><para>Name service switch configuration file.</para>
</listitem>
</varlistentry>
-
+
<varlistentry>
<term>/tmp/.winbindd/pipe</term>
- <listitem><para>The UNIX pipe over which clients communicate with
- the <command>winbindd</command> program. For security reasons, the
- winbind client will only attempt to connect to the winbindd daemon
+ <listitem><para>The UNIX pipe over which clients communicate with
+ the <command>winbindd</command> program. For security reasons, the
+ winbind client will only attempt to connect to the winbindd daemon
if both the <filename>/tmp/.winbindd</filename> directory
- and <filename>/tmp/.winbindd/pipe</filename> file are owned by
+ and <filename>/tmp/.winbindd/pipe</filename> file are owned by
root. </para></listitem>
</varlistentry>
<varlistentry>
<term>$LOCKDIR/winbindd_privileged/pipe</term>
- <listitem><para>The UNIX pipe over which 'privileged' clients
- communicate with the <command>winbindd</command> program. For security
- reasons, access to some winbindd functions - like those needed by
+ <listitem><para>The UNIX pipe over which 'privileged' clients
+ communicate with the <command>winbindd</command> program. For security
+ reasons, access to some winbindd functions - like those needed by
the <command>ntlm_auth</command> utility - is restricted. By default,
only users in the 'root' group will get this access, however the administrator
may change the group permissions on $LOCKDIR/winbindd_privileged to allow
programs like 'squid' to use ntlm_auth.
- Note that the winbind client will only attempt to connect to the winbindd daemon
+ Note that the winbind client will only attempt to connect to the winbindd daemon
if both the <filename>$LOCKDIR/winbindd_privileged</filename> directory
- and <filename>$LOCKDIR/winbindd_privileged/pipe</filename> file are owned by
+ and <filename>$LOCKDIR/winbindd_privileged/pipe</filename> file are owned by
root. </para></listitem>
</varlistentry>
@@ -436,16 +436,16 @@ auth required /lib/security/pam_unix.so \
<listitem><para>Implementation of name service switch library.
</para></listitem>
</varlistentry>
-
+
<varlistentry>
<term>$LOCKDIR/winbindd_idmap.tdb</term>
- <listitem><para>Storage for the Windows NT rid to UNIX user/group
- id mapping. The lock directory is specified when Samba is initially
+ <listitem><para>Storage for the Windows NT rid to UNIX user/group
+ id mapping. The lock directory is specified when Samba is initially
compiled using the <parameter>--with-lockdir</parameter> option.
This directory is by default <filename>/usr/local/samba/var/locks
</filename>. </para></listitem>
</varlistentry>
-
+
<varlistentry>
<term>$LOCKDIR/winbindd_cache.tdb</term>
<listitem><para>Storage for cached user and group information.
@@ -464,7 +464,7 @@ auth required /lib/security/pam_unix.so \
<refsect1>
<title>SEE ALSO</title>
-
+
<para><filename>nsswitch.conf(5)</filename>, <citerefentry>
<refentrytitle>samba</refentrytitle>
<manvolnum>7</manvolnum></citerefentry>, <citerefentry>
@@ -480,16 +480,16 @@ auth required /lib/security/pam_unix.so \
<refsect1>
<title>AUTHOR</title>
-
- <para>The original Samba software and related utilities
+
+ <para>The original Samba software and related utilities
were created by Andrew Tridgell. Samba is now developed
- by the Samba Team as an Open Source project similar
+ by the Samba Team as an Open Source project similar
to the way the Linux kernel is developed.</para>
-
- <para><command>wbinfo</command> and <command>winbindd</command> were
+
+ <para><command>wbinfo</command> and <command>winbindd</command> were
written by Tim Potter.</para>
-
- <para>The conversion to DocBook for Samba 2.2 was done
+
+ <para>The conversion to DocBook for Samba 2.2 was done
by Gerald Carter. The conversion to DocBook XML 4.2 for
Samba 3.0 was done by Alexander Bokovoy.</para>
</refsect1>