summaryrefslogtreecommitdiff
path: root/docs/docbook/faq/samba-pdc-faq.sgml
diff options
context:
space:
mode:
Diffstat (limited to 'docs/docbook/faq/samba-pdc-faq.sgml')
-rw-r--r--docs/docbook/faq/samba-pdc-faq.sgml1083
1 files changed, 0 insertions, 1083 deletions
diff --git a/docs/docbook/faq/samba-pdc-faq.sgml b/docs/docbook/faq/samba-pdc-faq.sgml
deleted file mode 100644
index 3dae096f04..0000000000
--- a/docs/docbook/faq/samba-pdc-faq.sgml
+++ /dev/null
@@ -1,1083 +0,0 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
-<book id="samba-pdc-faq">
-
-<title>The Samba 2.2 PDC FAQ</title>
-
-<bookinfo>
- <author>
- <firstname>David</firstname><surname>Bannon</surname>
- <affiliation><orgname>La Trobe University</orgname></affiliation>
- </author>
- <address><email>dbannon@samba.org</email></address>
- <pubdate>November 2000</pubdate>
-</bookinfo>
-
-
-<dedication><title></title>
-
- <para>
- This is the FAQ for Samba 2.2 as an NTDomain controller.
- This document is derived from the origional FAQ that was built and
- maintained by Gerald Carter from the early days of Samba NTDomain development
- up until recently. It is now being updated as significent changes are
- made to 2.2.0.
- </para>
-
- <para>
- Please note it does not apply to the SAMBA_TNG nor the HEAD branch.
- </para>
-
- <para>
- Also available is a Samba 2.2 PDC <ulink url="samba-pdc-howto.html">HOWTO</ulink>
- that takes you, step by step, over the process of setting up a very basic Samba
- 2.2 Primary Domain Controller
- </para>
-
-</dedication>
-
-<toc></toc>
-
-<!-- ================ I N T R O D U C T I O N ==================== -->
-
-
-<chapter>
-
-<title>Introduction</title>
-
-<sect1>
-<title id=stateofplay>State of Play</title>
-
- <para>Much of the related code does work. For example, if an NT is removed from the
- domain and then rejoins, the <filename>Create a Computer Account in the Domain</> dialog
- will let you reset the smbpasswd. That is you don't need to do it from
- the unix box. However, at the present, you do need to have root as an
- administrator and use the root user name and password.</para>
-
- <para><command>Policies</command> do work on a W2K machine. MS says that recent
- builds of W2K dont observe an NT policy but it appears it does in 'legacy'
- mode.</para>
-
-</sect1>
-
-<sect1>
-<title>Introduction</title>
-
- <para>
- This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing
- with the 'old HEAD' version of Samba and its NTDomain facilities. It is
- being rewritten by David Bannon (drb) so that it addresses more
- accurately the Samba 2.2.x release.
- </para>
-
- <para>
- This document probably still contains some material that does not apply
- to Samba 2.2 but most (all?) of the really misleading stuff has been
- removed. Some issues are not dealt with or are dealt with badly. Please
- send corrections and additions to <ulink
- url="mailto:D.Bannon@latrobe.edu.au">David Bannon</ulink>.
- </para>
-
- <para>Hopefully, as we all become familiar with the Samba 2.2 as a
- PDC this document will become much more usefull.</para>
-
-</sect1>
-
-</chapter>
-
-<!-- ============== G E N E R A L I N F O R M A T I O N ============== -->
-
-<chapter><title>General Information</>
-
-
-<sect1><title>What can we do ?</title>
-
-<sect2>
-<title>What can Samba 2.2.x Primary Domain Controller (PDC) do ?</title>
-
- <para>
- If you wish to have Samba act as a PDC for Windows NT 4.0/2000 client,
- then you will need to obtain the 2.2.0 version. Release of a stable,
- full featured Samba PDC is currently slated for version 3.0.
- </para>
-
- <para>
- The following is a list of included features currently in
- Samba 2.2:
- </para>
-
- <itemizedlist>
- <listitem><para>The ability to act as a limited PDC for
- Windows NT and W2000 clients. This includes adding NT and
- W2K machines to the domain and authenticating users logging
- into the domain.</para></listitem>
-
- <listitem><para>Domain account can be viewed using the User
- Manager for Domains</para></listitem>
-
- <listitem><para>Viewing/adding/deleting resources on the Samba
- PDC via the Server Manager for Domains from the NT client.
- </para></listitem>
-
- <listitem><para>Windows 95/98/ME clients will allow user
- level security to be set and browsing of domain accounts.
- </para></listitem>
-
- <listitem><para>Machine account password updates.</para></listitem>
-
- <listitem><para>Changing of user passwords from an NT client.
- </para></listitem>
-
- <listitem><para>Partial support for Windows NT username mapping.
- Group name mapping is slated for a later release.</para></listitem>
- </itemizedlist>
-
-
- <para>
- These things are note expected to work in the forseeable future:
- </para>
-
- <itemizedlist>
- <listitem><para>Trust relationships</para></listitem>
- <listitem><para>PDC and BDC integration</para></listitem>
- </itemizedlist>
-</sect2>
-
-<sect2>
-<title>Can I have a Windows 2000 client logon to a Samba
-controlled domain?</title>
-
- <para>
- The 2.2 release branch of Samba supports Windows 2000 domain
- clients in legacy mode, ie as if the PDC is a NTServer, not a
- W2K server.
- </para>
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>CVS</title>
-
- <para>
- CVS is a programme (publically available) that the Samba developers
- use to maintain the central source code. Non developers can get
- access to the source in a read only capacity. Many flavours of unix
- now arrive with cvs installed.</>
-
-<sect2>
-<title>What are the different Samba branches available in CVS ?</title>
-
- <para>You can find out more about obtaining Samba's via anonymous
- CVS from <ulink url="http://pserver.samba.org/samba/cvs.html">
- http://pserver.samba.org/samba/cvs.html</ulink>.
- </para>
-
- <para>
- There are basically four branches to watch at the moment :
- </para>
-
- <variablelist>
- <varlistentry>
- <term>HEAD</term>
- <listitem><para>Samba 3.0 ? This code boasts all the main
- development work in Samba. Due to its developmental
- nature, its not really suitable for production work.
- </para></listitem></varlistentry>
-
- <varlistentry>
- <term>SAMBA_2_0</term>
- <listitem><para>This branch contains the previous stable
- release. At the moment it contains 2.0.8, a version that
- will do some limited PDC stuff. If you are really going to
- do PDC things, you consider 2.2 instead.
- </para></listitem></varlistentry>
-
- <varlistentry>
- <term>SAMBA_2_2</term>
- <listitem><para>The 2.2.x release branch which is a subset
- of the features of the HEAD branch. This document addresses
- only SAMBA_2_2.
- </para></listitem></varlistentry>
-
- <varlistentry>
- <term>SAMBA_TNG</term>
- <listitem><para>This branch is no longer maintained from the Samba
- sites. Please see <ulink url="http://www.samba-tng.org/">
- http://www.samba-tng.org/</ulink>. It has been requested
- that questions about TNG are not posted to the regular Samba
- mailing lists including samba-ntdom and samba-technical.
- </para></listitem></varlistentry>
- </variablelist>
-</sect2>
-
-<sect2>
-<title>What are the CVS commands ?</title>
-
- <para>
- See <ulink url="http://pserver.samba.org/samba/cvs.html">
- http://pserver.samba.org/samba/cvs.html</ulink> for instructions
- on obtaining the SAMBA_2_2 or HEAD cvs code.
- </para>
-</sect2>
-</sect1>
-</chapter>
-
-
-<chapter>
-<title>Establishing Connections</title>
-
-<sect1>
-<title></title>
-
-<sect2>
-<title>How do I get my NT4 or W2000 Workstation to login to the Samba
-controlled Domain?</>
-
- <para>
- There is a comprehensive Samba PDC <ulink
- url="samba-pdc-howto.html">HOWTO</ulink> accessable from the samba web
- site under 'Documentation'. Read it.
- </para>
-</sect2>
-
-<sect2>
-<title>What is a 'machine account' ?</title>
-
- <para>
- Every NT, W2K or Samba machine that joins a Samba controlled
- domain must be known to the Samba PDC. There are two entries
- required, one in (typically) <filename>/etc/passwd</filename>
- and the other in (typically) <filename>/usr/local/samba/private/smbpasswd</filename>.
- Under some circumstances these entries are made
- <link linkend=machineaccounts>manually</link>, the <ulink
- url="samba-pdc-howto.html">HOWTO</ulink>
- discusses ways of creating them automatically.</para>
-</sect2>
-
-
-<sect2>
-<title>"The machine account for this computer either does not
-exist or is not accessable."</>
-
- <para>
- When I try to join the domain I get the message "The machine account
- for this computer either does not exist or is not accessable". Whats
- wrong ?
- </para>
-
- <para>
- This problem is caused by the PDC not having a suitable machine account.
- If you are using the <command>add user script =</> method to create
- accounts then this would indicate that it has not worked. Ensure the domain
- admin user system is working.
- </para>
-
- <para>
- Alternatively if you are creating account entries manually then they
- have not been created correctly. Make sure that you have the entry
- correct for the machine account in smbpasswd file on the Samba PDC.
- If you added the account using an editor rather than using the smbpasswd
- utility, make sure that the account name is the machine netbios name
- with a '$' appended to it ( ie. computer_name$ ). There must be an entry
- in both /etc/passwd and the smbpasswd file. Some people have reported
- that inconsistent subnet masks between the Samba server and the NT
- client have caused this problem. Make sure that these are consistent
- for both client and server.
- </para>
-</sect2>
-
-<sect2>
-<title id=machineaccounts>How do I create machine accounts manually ?</title>
-
- <para>
- This was the only option until recently, now in version 2.2 better
- means are available. You might still need to do it manually for a
- couple of reasons. A machine account consists of two entries (assuming
- a standard install and /etc/passwd use), one in /etc/passwd and the
- other in /usr/local/samba/private/smbpasswd. The /etc/passwd
- entry will list the machine name with a $ appended, won't have a
- passwd, will have a null shell and no home directory. For example
- a machine called 'doppy' would have an /etc/passwd entry like this :</para>
-
- <para>
- <command>doppy$:x:505:501:NTMachine:/dev/null:/bin/false</command>
- </para>
-
- <para>
- On a linux system for example, you would typically add it like
- this :
- </para>
-
- <para>
- <command>adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n
- doppy$</command>
- </para>
-
- <para>
- Then you need to add that entry to smbpasswd, assuming you have a suitable
- path to the <command>smbpasswd</> programme, do this :
- </para>
-
- <para>
- <command>smbpasswd -a -m doppy$</command>
- </para>
-
- <para>
- The entry will be created with a well known password, so any machine that
- says its doppy could join the domain as long as it gets in first. So
- don't create the accounts any earlier than you need them.
- </para>
-</sect2>
-
-<sect2>
-<title>I cannot include a '$' in a machine name.</title>
-
- <para>
- A 'machine name' in (typically) <filename>/etc/passwd</> consists
- of the machine name with a '$' appended. FreeBSD (and other BSD
- systems ?) won't create a user with a '$' in their name.
- </para>
-
- <para>
- The problem is only in the program used to make the entry, once
- made, it works perfectly. So create a user without the '$' and
- use <command>vipw</> to edit the entry, adding the '$'. Or create
- the whole entry with vipw if you like, make sure you use a
- unique uid !</para>
-</sect2>
-
-<sect2>
-<title id=alreadyhaveconnection>I get told "You already have a connection to the Domain...."
-when creating a machine account.</title>
-
- <para>
- This happens if you try to create a machine account from the
- machine itself and use a user name that does not work (for whatever
- reason) and then try another (possibly valid) user name.
- Exit out of the network applet to close the initial connection
- and try again.
- </para>
-
- <para>
- Further, if the machine is a already a 'member of a workgroup' that
- is the same name as the domain you are joining (bad idea) you will
- get this message. Change the workgroup name to something else, it
- does not matter what, reboot, and try again.</para>
-</sect2>
-
-<sect2>
-<title>I get told "Cannot join domain, the credentials supplied
-conflict with an existing set.."</title>
-
- <para>
- This is the same basic problem as mentioned above, <link
- linkend=alreadyhaveconnection> "You already have a connection..."</link>
- </para>
-</sect2>
-
-<sect2>
-<title>"The system can not log you on (C000019B)...."</title>
-
- <para>I joined the domain successfully but after upgrading
- to a newer version of the Samba code I get the message, "The system
- can not log you on (C000019B), Please try a gain or consult your
- system administrator" when attempting to logon.
- </para>
-
- <para>
- This occurs when the domain SID stored in private/WORKGROUP.SID is
- changed. For example, you remove the file and smbd automatically
- creates a new one. Or you are swapping back and forth between
- versions 2.0.7, TNG and the HEAD branch code (not recommended). The
- only way to correct the problem is to restore the original domain
- SID or remove the domain client from the domain and rejoin.
- </para>
-</sect2>
-
-</sect1>
-
-</chapter>
-
-
-<!-- ============ U S E R A C C O U N T M A N A G M E N T ============= -->
-
-<chapter>
-<title>User Account Management</title>
-
-<sect1>
-<title>Domain Admins</title>
-
-<sect2>
-<title>How do I configure an account as a domain administrator?</title>
-
- <para>
- See the NTDom <ulink url="samba-pdc-howto.html">HowTo</ulink>.
- </para>
-</sect2>
-</sect1>
-
-<sect1>
-<title>Profiles</title>
-
-<sect2>
-<title>Why is it bad to set "logon path = \\%N\%U\profile" in
-smb.conf?</title>
-
- <para>
- Sometimes Windows clients will maintain a connection to
- the \\homes\ ( or [%U] ) share even after the user has logged out.
- Consider the following scenario.
- </para>
-
- <itemizedlist>
- <listitem><para> user1 logs into the Windows NT machine.
- Therefore the [homes] share is set to \\server\user1.
- </para></listitem>
-
- <listitem><para> user1 works for a while and then logs
- out. </para></listitem>
-
- <listitem><para> user2 logs into the same Windows NT
- machine.</para></listitem>
- </itemizedlist>
-
- <para>
- However, since the NT box has maintained a connection to [homes]
- which was previously set to \\server\user1, when the operating system
- attempts to get the profile and if it can read users1's profile, will
- get it otherwise it will return an error. You get the picture.
- </para>
-
- <para>
- A better solution is to use a separate [profiles] share and
- set the "logon path = \\%N\profiles\%U"
- </para>
-</sect2>
-
-
-<sect2>
-<title>Why are all the users listed in the "domain admin users" using the
-same profile?</title>
-
- <para>
- You are using a very very old development version of Samba.
- Upgrade.
- </para>
-</sect2>
-
-
-
-<sect2>
-<title>The roaming profiles do not seem to be updating on the
-server.</title>
-
- <para>
- There can be several reasons for this.
- </para>
-
- <para>
- Make sure that the time on the client and the PDC are synchronized. You
- can accomplish this by executing a <command>net time \\server /set /yes</command>
- replacing server with the name of your PDC (or another synchronized SMB server).
- See <link linkend="SettingTime"> about Setting Time</link>
- </para>
-
- <para>
- Make sure that the "logon path" is writeable by the user and make sure
- that the connection to the logon path location is by the current user.
- Sometimes Windows client do not drop the connection immediately upon
- logoff.
- </para>
-
- <para>
- Some people have reported that the logon path location should
- also be browseable. I (GC) have yet to emperically verify this,
- but you can try.</para>
-</sect2>
-</sect1>
-
-<sect1><title>Policies</title>
-
-<sect2>
-<title>What are 'Policies' ?.</title>
-
- <para>
- When a user logs onto the domain via a client machine, the PDC
- sends the client machine a list of things contained in the
- 'policy' (if it exists). This list may do things like suppress
- a splach screen, format the dates the way you like them or perhaps
- remove locally stored profiles.
- </para>
-
- <para>
- On a samba PDC this list is obtained from a file called
- <filename>ntconfig.pol</filename> and located in the [netlogon]
- share. The file is created with a policy editor and must be readable
- by anyone and writeable by only root. See <link linkend=policyeditor>
- below</link> for how to get a suitable editor.
- </para>
-</sect2>
-
-<sect2>
-<title>I can't get system policies to work.</title>
-
- <para>
- There are two possible reasons for system policies not
- functioning correctly. Make sure that you have the following
- parameters set in smb.conf
- </para>
-
- <para><programlisting>
- [netlogon]
- ....
- locking = no
- public = no
- browseable = yes
- ....
- </programlisting></para>
-
- <para>
- A policy file must be in the [netlogon] share and must be
- readable by everyone and writeable by only root. The file
- must be created by an NTServer <link linkend=policyeditor>Policy
- Editor</link>.
- </para>
-
- <para>
- Last time I (drb) looked in the source, it was looking for
- <filename>ntconfig.pol</filename> first then several other
- combinations of upper and lower case. People have reported
- success using <filename>NTconfig.pol</filename>, <filename>NTconfig.POL</filename>
- and <filename>ntconfig.pol</filename>. These are the case settings that
- I (GC) use with the filename <filename>ntconfig.pol</filename>:
- </para>
-
- <para><programlisting>
- case sensitive = no
- case preserve = yes
- short preserve case = no
- default case = yes
- </programlisting></para>
-
-</sect2>
-
-<sect2>
-<title id=policyeditor>What about Windows NT Policy Editor ?</title>
-
- <para>
- To create or edit <filename>ntconfig.pol</filename> you must use
- the NT Server Policy Editor, <command>poledit.exe</command> which
- is included with NT Server but <emphasis>not NT Workstation</emphasis>.
- There is a Policy Editor on a NTws
- but it is not suitable for creating <emphasis>Domain Policies</emphasis>.
- Further, although the Windows 95
- Policy Editor can be installed on an NT Workstation/Server, it will not
- work with NT policies because the registry key that are set by the policy templates.
- However, the files from the NT Server will run happily enough on an NTws.
- You need <filename>poledit.exe, common.adm</> and <filename>winnt.adm</>. It is convenient
- to put the two *.adm files in <filename>c:\winnt\inf</> which is where
- the binary will look for them unless told otherwise. Note also that that
- directory is 'hidden'.
- </para>
-
- <para>The Windows NT policy editor is also included with the
- Service Pack 3 (and later) for Windows NT 4.0. Extract the files using
- <command>servicepackname /x</command>, ie thats <command>Nt4sp6ai.exe
- /x</command> for service pack 6a. The policy editor, <command>poledt.exe</command> and the
- associated template files (*.adm) should
- be extracted as well. It is also possible to downloaded the policy template
- files for Office97 and get a copy of the policy editor. Another possible
- location is with the Zero Administration Kit available for download from Microsoft.
- </para>
-</sect2>
-
-
-<sect2>
-<title>Can Win95 do Policies ?</title>
-
- <para>
- Install the group policy handler for Win9x to pick up group
- policies. Look on the Win98 CD in <filename>\tools\reskit\netadmin\poledit</filename>.
- Install group policies on a Win9x client by double-clicking
- <filename>grouppol.inf</filename>. Log off and on again a couple of
- times and see if Win98 picks up group policies. Unfortunately this needs
- to be done on every Win9x machine that uses group policies....
- </para>
-
- <para>
- If group policies don't work one reports suggests getting the updated
- (read: working) grouppol.dll for Windows 9x. The group list is grabbed
- from /etc/group.
- </para>
-
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>Passwords</title>
-
-<sect2>
-<title>What is password sync and should I use it ?</title>
-
- <para>
- NTws users can change their domain password by pressing Ctrl-Alt-Del
- and choosing 'Change Password'. By default however, this does not change the unix password
- (typically in <filename>/etc/passwd</filename> or <filename>/etc/shadow</filename>).
- In lots of situations thats OK, for example :
- </para>
-
- <itemizedlist>
- <listitem><para>The server is only accessible to the user via
- samba.</para></listitem>
-
- <listitem><para>Pam_smb or similar is installed so other applications
- still refer to the samba password.</para></listitem>
- </itemizedlist>
-
- <para>
- But sometimes you really do need to maintain two seperate password
- databases and there are good reasons to keep then in sync. Trying
- to explain to users that they need to change their passwords in two
- seperate places or use two seperate passwords is not fun.
- </para>
-
- <para>
- However do understand that setting up password sync is not without
- problems either. The chief difficulty is the interface between Samba
- and the <command>passwd</command> command, it can be a fiddle to set
- up and if the password the user has entered fails, the resulting errors
- are ambiguously reported and the user is confused. Further, you need
- to take steps to ensure that users only ever change their passwords
- via samba (or use <command>smbpasswd</command>), otherwise they will
- only be changing the unix password.</para>
-
-
-</sect2>
-
-<sect2>
-<title>How do I get remote password (unix and SMB) changing working ?</title>
-
- <para>
- Have a practice changing a user's password (as root) to see
- what discussion takes place and change the text in the 'passwd chat'
- line below as necessary. The line as shown works for recent RH Linux
- but most other systems seem to like to do something different. The '*' is
- a wild card and will match anything (or nothing).
- </para>
-
- <para>
- Add these lines to smb.conf under [Global]
- </para>
-
- <para><programlisting>
-
- unix password sync = true
- passwd program = /usr/bin/passwd %u
- passwd chat = *password* %n\n *password* %n\n *successful*
- </programlisting></para>
-
- <para>
- As mentioned above, the change to the unix password happens as root,
- not as the user, as is indicated in ~/smbd/chgpasswd.c If
- you are using NIS, the Samba server must be running on the NIS
- master machine.
- </para>
-</sect2>
-
-</sect1>
-
-</chapter>
-
-<!-- =================== M I S C E L L A N E O U S ================= -->
-
-<chapter>
-<title>Miscellaneous</title>
-
-<sect1>
-<title></title>
-
-<sect2>
-<title>What editor can I use in DOS/Windows that won't
-mess with my unix EOF</title>
-
- <para>There are a number of Windows or DOS based editors that will
- understand, and leave intact, the unix eof (as opposed to a DOS CL/LF).
- List members suggested :
- </para>
-
- <itemizedlist>
- <listitem><para>UltraEdit at <ulink url="http://www.ultraedit.com">www.ultraedit.com</ulink></para></listitem>
-
- <listitem><para>VI for windows at <ulink url="http://home.snafu.de/ramo/WinViEn.htm">
- home.snafu.de/ramo/WinViEn.htm</ulink></para></listitem>
-
- <listitem><para>The author prefers PFE at <ulink url="http://www.lancs.ac.uk/people/cpaap/pfe/">
- www.lancs.ac.uk/people/cpaap/pfe/</ulink> but its no longer being developed...</para></listitem>
- </itemizedlist>
-</sect2>
-
-
-
-
-<sect2>
-<title>How do I get 'User Manager' and 'Server Manager'</title>
-
- <para>
- Since I don't need to buy an NT Server CD now, how do I get
- the 'User Manager for Domains', the 'Server Manager' ?
- </para>
-
- <para>
- Microsoft distributes a version of
- these tools called nexus for installation on Windows 95 systems. The
- tools set includes
- </para>
-
- <itemizedlist>
- <listitem><para>Server Manager</para></listitem>
-
- <listitem><para>User Manager for Domains</para></listitem>
-
- <listitem><para>Event Viewer</para></listitem>
- </itemizedlist>
-
- <para>
- Click here to download the archived file <ulink
- url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</ulink>
- </para>
-
- <para>
- The Windows NT 4.0 version of the 'User Manager for
- Domains' and 'Server Manager' are available from Microsoft via ftp
- from <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</ulink>
- </para>
-</sect2>
-
-
-<sect2><title id="SettingTime">The time setting from a Samba server does not work.</title>
- <para>If it works OK when you log on as Domain Admin then the problem is that ordinary users
- don't have permission to change the time. (The system is running with their permission
- at logon time.) This is not a Samba problem, you will have the same problem where ever
- you connect. You can give 'everyone' permission to change the time from the User Manager.
- </para>
-
- <para>Anyone know what the registry settings are so this could be done with a Policy ?</para>
-</sect2>
-
-<sect2><title>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</>
- <para>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS."
- in the logs. What do I need to do?</para>
-
- <para>You are using one of the old development versions. Upgrade.
- (The message is unimportant, was a reminder to a developer)</para>
-
-</sect2>
-
-<sect2><title>How do I get my samba server to become a member ( not PDC ) of an NT domain?</title>
-
-
- <para>
- Please refer to the <ulink url="DOMAIN_MEMBER.html">Domain Member
- HOWTO</ulink> for more information on this.
- </para>
-
-</sect2>
-</sect1>
-</chapter>
-
-
-<!-- ======== T R O U B L E S H O O T I N G and B U G R E P O R T I N G ======== -->
-
-
-
-<chapter><title>Troubleshooting and Bug Reporting</title>
-
-<sect1><title>Diagnostic tools</title>
-
-<sect2><title>What are some diagnostics tools I can use to debug the domain logon process and where can I
- find them? </title>
-
- <para>
- One of the best diagnostic tools for debugging problems is Samba itself.
- You can use the -d option for both smbd and nmbd to specifiy what
- 'debug level' at which to run. See the man pages on smbd, nmbd and
- smb.conf for more information on debugging options. The debug
- level can range from 1 (the default) to 10 (100 for debugging passwords).
- </para>
-
- <para>
- Another helpful method of debugging is to compile samba using the
- <command>gcc -g </command> flag. This will include debug
- information in the binaries and allow you to attch gdb to the
- running smbd / nmbd process. In order to attach gdb to an smbd
- process for an NT workstation, first get the workstation to make the
- connection. Pressing ctrl-alt-delete and going down to the domain box
- is sufficient (at least, on the first time you join the domain) to
- generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation
- maintains an open connection, and therefore there will be an smbd
- process running (assuming that you haven't set a really short smbd
- idle timeout) So, in between pressing ctrl alt delete, and actually
- typing in your password, you can gdb attach and continue.
- </para>
-
- <para>
- Some usefull samba commands worth investigating:
- </para>
-
- <itemizedlist>
- <listitem><para>testparam | more</para></listitem>
- <listitem><para>smbclient -L //{netbios name of server}</para></listitem>
- </itemizedlist>
-
- <para>
- An SMB enabled version of tcpdump is available from
- <ulink url="http://www.tcpdump.org/">http://www.tcpdump.org/</ulink>.
- Ethereal, another good packet sniffer for UNIX and Win32
- hosts, can be downloaded from <ulink
- url="http://www.ethereal.com/">http://www.ethereal.com</ulink>.
- </para>
-
- <para>
- For tracing things on the Microsoft Windows NT, Network Monitor
- (aka. netmon) is available on the Microsoft Developer Network CD's,
- the Windows NT Server install CD and the SMS CD's. The version of
- netmon that ships with SMS allows for dumping packets between any two
- computers (ie. placing the network interface in promiscuous mode).
- The version on the NT Server install CD will only allow monitoring
- of network traffic directed to the local NT box and broadcasts on the
- local subnet. Be aware that Ethereal can read and write netmon
- formatted files.
- </para>
-
-</sect2>
-
-<sect2>
-<title>How do I install 'Network Monitor' on an NT Workstation
-or a Windows 9x box?</title>
-
- <para>
- Installing netmon on an NT workstation requires a couple
- of steps. The following are for installing Netmon V4.00.349, which comes
- with Microsoft Windows NT Server 4.0, on Microsoft Windows NT
- Workstation 4.0. The process should be similar for other version of
- Windows NT / Netmon. You will need both the Microsoft Windows
- NT Server 4.0 Install CD and the Workstation 4.0 Install CD.
- </para>
-
- <para>
- Initially you will need to install 'Network Monitor Tools and Agent'
- on the NT Server. To do this
- </para>
-
- <itemizedlist>
- <listitem><para>Goto Start - Settings - Control Panel -
- Network - Services - Add </para></listitem>
-
- <listitem><para>Select the 'Network Monitor Tools and Agent' and
- click on 'OK'.</para></listitem>
-
- <listitem><para>Click 'OK' on the Network Control Panel.
- </para></listitem>
-
- <listitem><para>Insert the Windows NT Server 4.0 install CD
- when prompted.</para></listitem>
- </itemizedlist>
-
- <para>
- At this point the Netmon files should exist in
- <filename>%SYSTEMROOT%\System32\netmon\*.*</filename>.
- Two subdirectories exist as well, <filename>parsers\</filename>
- which contains the necessary DLL's for parsing the netmon packet
- dump, and <filename>captures\</filename>.
- </para>
-
- <para>
- In order to install the Netmon tools on an NT Workstation, you will
- first need to install the 'Network Monitor Agent' from the Workstation
- install CD.
- </para>
-
- <itemizedlist>
- <listitem><para>Goto Start - Settings - Control Panel -
- Network - Services - Add</para></listitem>
-
- <listitem><para>Select the 'Network Monitor Agent' and click
- on 'OK'.</para></listitem>
-
- <listitem><para>Click 'OK' on the Network Control Panel.
- </para></listitem>
-
- <listitem><para>Insert the Windows NT Workstation 4.0 install
- CD when prompted.</para></listitem>
- </itemizedlist>
-
-
- <para>
- Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.*
- to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set
- permissions as you deem appropriate for your site. You will need
- administrative rights on the NT box to run netmon.
- </para>
-
- <para>
- To install Netmon on a Windows 9x box install the network monitor agent
- from the Windows 9x CD (\admin\nettools\netmon). There is a readme
- file located with the netmon driver files on the CD if you need
- information on how to do this. Copy the files from a working
- Netmon installation.
- </para>
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>What other help can I get ? </title>
-
- <para>
- There are many sources of information available in the form
- of mailing lists, RFC's and documentation. The docs that come
- with the samba distribution contain very good explanations of
- general SMB topics such as browsing.</para>
-
-<sect2>
-<title id=urls>URLs and similar</title>
-
-
- <itemizedlist>
-
- <listitem><para>Home of Samba site <ulink url="http://samba.org">
- http://samba.org</ulink>. We have a mirror near you !</para></listitem>
-
- <listitem><para> The <emphasis role=strong>Development</emphasis> document
- on the Samba mirrors might mention your problem. If so,
- it might mean that the developers are working on it.</para></listitem>
-
- <listitem><para> Ignacio Coupeau has a very comprehesive look at LDAP with Samba at
- <ulink url="http://www.unav.es/cti/ldap-smb-howto.html">
- http://www.unav.es/cti/ldap-smb-howto.html</ulink>
- Be a little carefull however, I suspect that it does not specificly
- address samba 2.2.x. The HEAD pre-2.1 may possibly be the best
- stream to look at.</para></listitem>
-
- <listitem><para> Lars Kneschke's site covers <ulink url="http://www.samba-tng.org">
- Samba-TNG</ulink> at
- <ulink url="http://www.kneschke.de/projekte/samba_tng">
- http://www.kneschke.de/projekte/samba_tng</ulink>, but again, a
- lot of it does not apply to the main stream Samba.</para></listitem>
-
- <listitem><para>See how Scott Merrill simulates a BDC behaviour at
- <ulink url="http://www.skippy.net/linux/smb-howto.html">
- http://www.skippy.net/linux/smb-howto.html</>. </para></listitem>
-
- <listitem><para>Although 2.0.7 has almost had its day as a PDC, I (drb) will
- keep the 2.0.7 PDC pages at <ulink url="http://bioserve.latrobe.edu.au/samba">
- http://bioserve.latrobe.edu.au/samba</ulink> going for a while yet.</para></listitem>
-
- <listitem><para>Misc links to CIFS information
- <ulink url="http://samba.org/cifs/">http://samba.org/cifs/</ulink></para></listitem>
-
- <listitem><para>NT Domains for Unix <ulink url="http://mailhost.cb1.com/~lkcl/ntdom/">
- http://mailhost.cb1.com/~lkcl/ntdom/</ulink></para></listitem>
-
- <listitem><para>FTP site for older SMB specs:
- <ulink url="ftp://ftp.microsoft.com/developr/drg/CIFS/">
- ftp://ftp.microsoft.com/developr/drg/CIFS/</ulink></para></listitem>
-
- </itemizedlist>
-
-
- <para>
- You should also refer to the MS archives at
- <ulink url="ftp://ftp.microsoft.com/developr/drg/CIFS/">ftp://ftp.microsoft.com/developr/drg/CIFS/"</ulink>
- </para>
-
-</sect2>
-
-
-<sect2>
-<title>How do I get help from the mailing lists ?</title>
-
- <para> There are a number of Samba related mailing lists. Go to <ulink url=
- "http://samba.org">http://samba.org</ulink>, click on your nearest mirror
- and then click on <command>Support</> and then click on <command>
- Samba related mailing lists</>.</para>
-
- <para>For questions relating to Samba TNG go to
- <ulink url="http://www.samba-tng.org/">http://www.samba-tng.org/</ulink>
- It has been requested that you don't post questions about Samba-TNG to the
- main stream Samba lists.</para>
-
-<itemizedlist><title>If you post a message to one of the lists please
- observe the following guide lines :</title>
-
- <listitem><para> Always remember that the developers are volunteers, they are
- not paid and they never guarantee to produce a particular feature at
- a particular time. Any time lines are 'best guess' and nothing more.
- </para></listitem>
-
- <listitem><para> Always mention what version of samba you are using and what
- operating system its running under. You should probably list the
- relevant sections of your smb.conf file, at least the options
- in [global] that affect PDC support.</para></listitem>
-
- <listitem><para>In addition to the version, if you obtained Samba via
- CVS mention the date when you last checked it out.</para></listitem>
-
- <listitem><para> Try and make your question clear and brief, lots of long,
- convoluted questions get deleted before they are completely read !
- Don't post html encoded messages (if you can select colour or font
- size its html).</para></listitem>
-
- <listitem><para> If you run one of those niffy 'I'm on holidays' things when
- you are away, make sure its configured to not answer mailing lists.
- </para></listitem>
-
- <listitem><para> Don't cross post. Work out which is the best list to post to
- and see what happens, ie don't post to both samba-ntdom and samba-technical.
- Many people active on the lists subscribe to more
- than one list and get annoyed to see the same message two or more times.
- Often someone will see a message and thinking it would be better dealt
- with on another, will forward it on for you.</para></listitem>
-
- <listitem><para>You might include <emphasis>partial</emphasis>
- log files written at a debug level set to as much as 20.
- Please don't send the entire log but enough to give the context of the
- error messages.</para></listitem>
-
- <listitem><para>(Possibly) If you have a complete netmon trace ( from the opening of
- the pipe to the error ) you can send the *.CAP file as well.</para></listitem>
-
- <listitem><para>Please think carefully before attaching a document to an email.
- Consider pasting the relevant parts into the body of the message. The samba
- mailing lists go to a huge number of people, do they all need a copy of your
- smb.conf in their attach directory ?</para></listitem>
-
-</itemizedlist>
-</sect2>
-
-
-<sect2>
-<title>How do I get off the mailing lists ?</title>
-
- <para>To have your name removed from a samba mailing list, go to the
- same place you went to to get on it. Go to <ulink url=
- "http://lists.samba.org/">http://lists.samba.org</ulink>, click
- on your nearest mirror and then click on <command>Support</> and
- then click on <command> Samba related mailing lists</>. Or perhaps see
- <ulink url="http://lists.samba.org/mailman/roster/samba-ntdom">here</ulink></para>
-
- <para>
- Please don't post messages to the list asking to be removed, you will just
- be refered to the above address (unless that process failed in some way...)
- </para>
-</sect2>
-
-</sect1>
-
-</chapter>
-
-
-
-
-</book>