diff options
Diffstat (limited to 'docs/Samba-Guide/SBE-AddingUNIXClients.xml')
| -rw-r--r-- | docs/Samba-Guide/SBE-AddingUNIXClients.xml | 152 |
1 files changed, 148 insertions, 4 deletions
diff --git a/docs/Samba-Guide/SBE-AddingUNIXClients.xml b/docs/Samba-Guide/SBE-AddingUNIXClients.xml index c7656f8b58..f0f476585a 100644 --- a/docs/Samba-Guide/SBE-AddingUNIXClients.xml +++ b/docs/Samba-Guide/SBE-AddingUNIXClients.xml @@ -644,10 +644,63 @@ ou: idmap </indexterm> The system is ready to join the Domain. Execute the following: <screen> -&rootprompt; net rpc join -U root%not24et +&rootprompt; net rpc join -U root%not24get Joined domain MEGANET2. </screen> This indicates that the Domain join succeeded. + </para> + + <para> + Failure to join the domain could be caused by any number of vaiables. The most common + causes of failure to join are: + </para> + + <para> + <itemizedlist> + <listitem><para>Broken resolution of netbios names to the respective IP address.</para></listitem> + <listitem><para>Incorrect username and password credentials.</para></listitem> + <listitem><para>The NT4 <parameter>restrict anonymous</parameter> is set to exclude anonymous + connections.</para></listitem> + </itemizedlist> + </para> + + <para> + The connection setup can be diagnosed by executing: +<screen> +&rootprompt; net rpc join -S 'pdc-name' -U administrator%password -d 5 +</screen> + <indexterm><primary>failed</primary></indexterm> + <indexterm><primary>failed join</primary></indexterm> + <indexterm><primary>rejected</primary></indexterm> + <indexterm><primary>restrict anonymous</primary></indexterm> + Note: Use 'root' for UNIX/Linux and Samba, use 'Administrator' for Windows NT4/200X. If the cause of + the failure appears to be related to a rejected or failed 'NT_SESSION_SETUP*' or an error message that + says 'NT_STATUS_ACCESS_DENIED' immediately check the Windows registry setting that controls the + <constant>restrict anonymous</constant> setting. Set this to the value 0 so that an anonymous connection + can be sustained, then try again. + </para> + + <para> + It is possible (perhaps even recommended) to use the following to validate the ability to connect + to an NT4 PDC/BDC: +<screen> +&rootprompt; net rpc info -S 'pdc-name' -U Administrator%not24get +Domain Name: MEGANET2 +Domain SID: S-1-5-21-422319763-4138913805-7168186429 +Sequence number: 1519909596 +Num users: 7003 +Num domain groups: 821 +Num local groups: 8 + +&rootprompt; net rpc testjoin -S 'pdc-name' -U Administrator%not24get +Join to 'MEGANET2' is OK +</screen> + If for any reason the following response is obtained to the last command above it is time to + call in the Networking Super-Snooper task force (i.e.: Start debugging): +<screen> +NT_STATUS_ACCESS_DENIED +Join to 'MEGANET2' failed. +</screen> </para></step> <step><para> @@ -658,7 +711,7 @@ Joined domain MEGANET2. <screen> &rootprompt; wbinfo --set-auth-user=Administrator%not24get </screen> -- The configuration is now ready to obtain ADS Domain user and group information. + The configuration is now ready to obtain ADS Domain user and group information. </para></step> <step><para> @@ -1038,6 +1091,97 @@ aliases: files </sect2> + <sect2 id="dcwonss"> + <title>NT4/Samba Domain with Samba Domain Member Server - Without NSS Support</title> + + <para> + No matter how many UNIX/Linux administrators there may be who believe that a UNIX operating + system that does not have NSS and PAM support to be outdated and antique, the fact is there + are still many such systems in use today. Samba can be used without NSS support, but this + does limit it to the use of local user and group accounts only. + </para> + + <para> + The following steps may be followed to implement Samba with support for local accounts. + In this configuration Samba is made a domain member server. All incoming connections + to the Samba server will cause the look-up of the incoming user name. If the account + is found, it is used. If the account is not found, one will be automatically created + on the local machine so that it can then be used for all access controls. + </para> + + <procedure> + <title>Configuration Using Local Accounts Only</title> + + <step><para> + Using your favorite text editor, create the &smb.conf; file so it has the contents + shown in <link linkend="ch0-NT4DSCM"/>. + </para></step> + + <step> + <para><indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm> + The system is ready to join the Domain. Execute the following: +<screen> +net rpc join -U root%not24et +Joined domain MEGANET2. +</screen> + This indicates that the Domain join succeed. + </para></step> + + <step><para> + Be sure to run all three Samba daemons: <command>smbd, nmbd, winbindd</command>. + </para></step> + + <step><para> + The Samba member server of a Windows NT4 Domain is ready for use. + </para></step> + </procedure> + +<smbconfexample id="ch0-NT4DSCM"> +<title>Samba Domain Member Server &smb.conf; File for NT4 Domain</title> +<smbconfcomment>Global parameters</smbconfcomment> +<smbconfsection name="[global]"/> +<smbconfoption name="unix charset">LOCALE</smbconfoption> +<smbconfoption name="workgroup">MEGANET3</smbconfoption> +<smbconfoption name="netbios name">BSDBOX</smbconfoption> +<smbconfoption name="security">DOMAIN</smbconfoption> +<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption> +<smbconfoption name="log level">1</smbconfoption> +<smbconfoption name="syslog">0</smbconfoption> +<smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption> +<smbconfoption name="add machine script">/usr/sbin/useradd -M '%u'</smbconfoption> +<smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption> +<smbconfoption name="winbind enable local accounts">Yes</smbconfoption> +<smbconfoption name="log file">/var/log/samba/%m</smbconfoption> +<smbconfoption name="max log size">0</smbconfoption> +<smbconfoption name="smb ports">139 445</smbconfoption> +<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption> +<smbconfoption name="printcap name">CUPS</smbconfoption> +<smbconfoption name="wins server">192.168.2.1</smbconfoption> +<smbconfoption name="printer admin">root</smbconfoption> +<smbconfoption name="hosts allow">192.168.2., 192.168.3., 127.</smbconfoption> +<smbconfoption name="printing">cups</smbconfoption> + +<smbconfsection name="[homes]"/> +<smbconfoption name="comment">Home Directories</smbconfoption> +<smbconfoption name="valid users">%S</smbconfoption> +<smbconfoption name="read only">No</smbconfoption> +<smbconfoption name="browseable">No</smbconfoption> + +<smbconfsection name="[printers]"/> +<smbconfoption name="comment">SMB Print Spool</smbconfoption> +<smbconfoption name="path">/var/spool/samba</smbconfoption> +<smbconfoption name="guest ok">Yes</smbconfoption> +<smbconfoption name="printable">Yes</smbconfoption> +<smbconfoption name="browseable">No</smbconfoption> + +<smbconfsection name="[print$]"/> +<smbconfoption name="comment">Printer Drivers</smbconfoption> +<smbconfoption name="path">/var/lib/samba/drivers</smbconfoption> +<smbconfoption name="admin users">root, Administrator</smbconfoption> +<smbconfoption name="write list">root</smbconfoption> +</smbconfexample> + </sect2> + <sect2 id="adssdm"> <title>Active Directory Domain with Samba Domain Member Server</title> @@ -1864,8 +2008,8 @@ administrator:x:1000:1013:Administrator:/home/BE/administrator:/bin/bash <indexterm><primary>realm</primary></indexterm> In the case of an NT4 or Samba-3 style Domain the <parameter>realm</parameter> is not used and the command used to join the domain is: <command>net rpc join</command>. The above example also demonstrates - advanced error reporting techniques that are documented in <link linkend="dbglvl">the chapter called - Reporting Bugs</link>. + advanced error reporting techniques that are documented in the chapter called Reporting Bugs in the + book <quote>The Official Samba-3 HOWTO and Reference Guide</quote> (TOSHARG). </para> <para> |