diff options
Diffstat (limited to 'docs/docbook/faq/samba-pdc-faq.sgml')
| -rw-r--r-- | docs/docbook/faq/samba-pdc-faq.sgml | 1083 |
1 files changed, 0 insertions, 1083 deletions
diff --git a/docs/docbook/faq/samba-pdc-faq.sgml b/docs/docbook/faq/samba-pdc-faq.sgml deleted file mode 100644 index 3dae096f04..0000000000 --- a/docs/docbook/faq/samba-pdc-faq.sgml +++ /dev/null @@ -1,1083 +0,0 @@ -<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook V4.1//EN"> -<book id="samba-pdc-faq"> - -<title>The Samba 2.2 PDC FAQ</title> - -<bookinfo> - <author> - <firstname>David</firstname><surname>Bannon</surname> - <affiliation><orgname>La Trobe University</orgname></affiliation> - </author> - <address><email>dbannon@samba.org</email></address> - <pubdate>November 2000</pubdate> -</bookinfo> - - -<dedication><title></title> - - <para> - This is the FAQ for Samba 2.2 as an NTDomain controller. - This document is derived from the origional FAQ that was built and - maintained by Gerald Carter from the early days of Samba NTDomain development - up until recently. It is now being updated as significent changes are - made to 2.2.0. - </para> - - <para> - Please note it does not apply to the SAMBA_TNG nor the HEAD branch. - </para> - - <para> - Also available is a Samba 2.2 PDC <ulink url="samba-pdc-howto.html">HOWTO</ulink> - that takes you, step by step, over the process of setting up a very basic Samba - 2.2 Primary Domain Controller - </para> - -</dedication> - -<toc></toc> - -<!-- ================ I N T R O D U C T I O N ==================== --> - - -<chapter> - -<title>Introduction</title> - -<sect1> -<title id=stateofplay>State of Play</title> - - <para>Much of the related code does work. For example, if an NT is removed from the - domain and then rejoins, the <filename>Create a Computer Account in the Domain</> dialog - will let you reset the smbpasswd. That is you don't need to do it from - the unix box. However, at the present, you do need to have root as an - administrator and use the root user name and password.</para> - - <para><command>Policies</command> do work on a W2K machine. MS says that recent - builds of W2K dont observe an NT policy but it appears it does in 'legacy' - mode.</para> - -</sect1> - -<sect1> -<title>Introduction</title> - - <para> - This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing - with the 'old HEAD' version of Samba and its NTDomain facilities. It is - being rewritten by David Bannon (drb) so that it addresses more - accurately the Samba 2.2.x release. - </para> - - <para> - This document probably still contains some material that does not apply - to Samba 2.2 but most (all?) of the really misleading stuff has been - removed. Some issues are not dealt with or are dealt with badly. Please - send corrections and additions to <ulink - url="mailto:D.Bannon@latrobe.edu.au">David Bannon</ulink>. - </para> - - <para>Hopefully, as we all become familiar with the Samba 2.2 as a - PDC this document will become much more usefull.</para> - -</sect1> - -</chapter> - -<!-- ============== G E N E R A L I N F O R M A T I O N ============== --> - -<chapter><title>General Information</> - - -<sect1><title>What can we do ?</title> - -<sect2> -<title>What can Samba 2.2.x Primary Domain Controller (PDC) do ?</title> - - <para> - If you wish to have Samba act as a PDC for Windows NT 4.0/2000 client, - then you will need to obtain the 2.2.0 version. Release of a stable, - full featured Samba PDC is currently slated for version 3.0. - </para> - - <para> - The following is a list of included features currently in - Samba 2.2: - </para> - - <itemizedlist> - <listitem><para>The ability to act as a limited PDC for - Windows NT and W2000 clients. This includes adding NT and - W2K machines to the domain and authenticating users logging - into the domain.</para></listitem> - - <listitem><para>Domain account can be viewed using the User - Manager for Domains</para></listitem> - - <listitem><para>Viewing/adding/deleting resources on the Samba - PDC via the Server Manager for Domains from the NT client. - </para></listitem> - - <listitem><para>Windows 95/98/ME clients will allow user - level security to be set and browsing of domain accounts. - </para></listitem> - - <listitem><para>Machine account password updates.</para></listitem> - - <listitem><para>Changing of user passwords from an NT client. - </para></listitem> - - <listitem><para>Partial support for Windows NT username mapping. - Group name mapping is slated for a later release.</para></listitem> - </itemizedlist> - - - <para> - These things are note expected to work in the forseeable future: - </para> - - <itemizedlist> - <listitem><para>Trust relationships</para></listitem> - <listitem><para>PDC and BDC integration</para></listitem> - </itemizedlist> -</sect2> - -<sect2> -<title>Can I have a Windows 2000 client logon to a Samba -controlled domain?</title> - - <para> - The 2.2 release branch of Samba supports Windows 2000 domain - clients in legacy mode, ie as if the PDC is a NTServer, not a - W2K server. - </para> -</sect2> - -</sect1> - -<sect1> -<title>CVS</title> - - <para> - CVS is a programme (publically available) that the Samba developers - use to maintain the central source code. Non developers can get - access to the source in a read only capacity. Many flavours of unix - now arrive with cvs installed.</> - -<sect2> -<title>What are the different Samba branches available in CVS ?</title> - - <para>You can find out more about obtaining Samba's via anonymous - CVS from <ulink url="http://pserver.samba.org/samba/cvs.html"> - http://pserver.samba.org/samba/cvs.html</ulink>. - </para> - - <para> - There are basically four branches to watch at the moment : - </para> - - <variablelist> - <varlistentry> - <term>HEAD</term> - <listitem><para>Samba 3.0 ? This code boasts all the main - development work in Samba. Due to its developmental - nature, its not really suitable for production work. - </para></listitem></varlistentry> - - <varlistentry> - <term>SAMBA_2_0</term> - <listitem><para>This branch contains the previous stable - release. At the moment it contains 2.0.8, a version that - will do some limited PDC stuff. If you are really going to - do PDC things, you consider 2.2 instead. - </para></listitem></varlistentry> - - <varlistentry> - <term>SAMBA_2_2</term> - <listitem><para>The 2.2.x release branch which is a subset - of the features of the HEAD branch. This document addresses - only SAMBA_2_2. - </para></listitem></varlistentry> - - <varlistentry> - <term>SAMBA_TNG</term> - <listitem><para>This branch is no longer maintained from the Samba - sites. Please see <ulink url="http://www.samba-tng.org/"> - http://www.samba-tng.org/</ulink>. It has been requested - that questions about TNG are not posted to the regular Samba - mailing lists including samba-ntdom and samba-technical. - </para></listitem></varlistentry> - </variablelist> -</sect2> - -<sect2> -<title>What are the CVS commands ?</title> - - <para> - See <ulink url="http://pserver.samba.org/samba/cvs.html"> - http://pserver.samba.org/samba/cvs.html</ulink> for instructions - on obtaining the SAMBA_2_2 or HEAD cvs code. - </para> -</sect2> -</sect1> -</chapter> - - -<chapter> -<title>Establishing Connections</title> - -<sect1> -<title></title> - -<sect2> -<title>How do I get my NT4 or W2000 Workstation to login to the Samba -controlled Domain?</> - - <para> - There is a comprehensive Samba PDC <ulink - url="samba-pdc-howto.html">HOWTO</ulink> accessable from the samba web - site under 'Documentation'. Read it. - </para> -</sect2> - -<sect2> -<title>What is a 'machine account' ?</title> - - <para> - Every NT, W2K or Samba machine that joins a Samba controlled - domain must be known to the Samba PDC. There are two entries - required, one in (typically) <filename>/etc/passwd</filename> - and the other in (typically) <filename>/usr/local/samba/private/smbpasswd</filename>. - Under some circumstances these entries are made - <link linkend=machineaccounts>manually</link>, the <ulink - url="samba-pdc-howto.html">HOWTO</ulink> - discusses ways of creating them automatically.</para> -</sect2> - - -<sect2> -<title>"The machine account for this computer either does not -exist or is not accessable."</> - - <para> - When I try to join the domain I get the message "The machine account - for this computer either does not exist or is not accessable". Whats - wrong ? - </para> - - <para> - This problem is caused by the PDC not having a suitable machine account. - If you are using the <command>add user script =</> method to create - accounts then this would indicate that it has not worked. Ensure the domain - admin user system is working. - </para> - - <para> - Alternatively if you are creating account entries manually then they - have not been created correctly. Make sure that you have the entry - correct for the machine account in smbpasswd file on the Samba PDC. - If you added the account using an editor rather than using the smbpasswd - utility, make sure that the account name is the machine netbios name - with a '$' appended to it ( ie. computer_name$ ). There must be an entry - in both /etc/passwd and the smbpasswd file. Some people have reported - that inconsistent subnet masks between the Samba server and the NT - client have caused this problem. Make sure that these are consistent - for both client and server. - </para> -</sect2> - -<sect2> -<title id=machineaccounts>How do I create machine accounts manually ?</title> - - <para> - This was the only option until recently, now in version 2.2 better - means are available. You might still need to do it manually for a - couple of reasons. A machine account consists of two entries (assuming - a standard install and /etc/passwd use), one in /etc/passwd and the - other in /usr/local/samba/private/smbpasswd. The /etc/passwd - entry will list the machine name with a $ appended, won't have a - passwd, will have a null shell and no home directory. For example - a machine called 'doppy' would have an /etc/passwd entry like this :</para> - - <para> - <command>doppy$:x:505:501:NTMachine:/dev/null:/bin/false</command> - </para> - - <para> - On a linux system for example, you would typically add it like - this : - </para> - - <para> - <command>adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n - doppy$</command> - </para> - - <para> - Then you need to add that entry to smbpasswd, assuming you have a suitable - path to the <command>smbpasswd</> programme, do this : - </para> - - <para> - <command>smbpasswd -a -m doppy$</command> - </para> - - <para> - The entry will be created with a well known password, so any machine that - says its doppy could join the domain as long as it gets in first. So - don't create the accounts any earlier than you need them. - </para> -</sect2> - -<sect2> -<title>I cannot include a '$' in a machine name.</title> - - <para> - A 'machine name' in (typically) <filename>/etc/passwd</> consists - of the machine name with a '$' appended. FreeBSD (and other BSD - systems ?) won't create a user with a '$' in their name. - </para> - - <para> - The problem is only in the program used to make the entry, once - made, it works perfectly. So create a user without the '$' and - use <command>vipw</> to edit the entry, adding the '$'. Or create - the whole entry with vipw if you like, make sure you use a - unique uid !</para> -</sect2> - -<sect2> -<title id=alreadyhaveconnection>I get told "You already have a connection to the Domain...." -when creating a machine account.</title> - - <para> - This happens if you try to create a machine account from the - machine itself and use a user name that does not work (for whatever - reason) and then try another (possibly valid) user name. - Exit out of the network applet to close the initial connection - and try again. - </para> - - <para> - Further, if the machine is a already a 'member of a workgroup' that - is the same name as the domain you are joining (bad idea) you will - get this message. Change the workgroup name to something else, it - does not matter what, reboot, and try again.</para> -</sect2> - -<sect2> -<title>I get told "Cannot join domain, the credentials supplied -conflict with an existing set.."</title> - - <para> - This is the same basic problem as mentioned above, <link - linkend=alreadyhaveconnection> "You already have a connection..."</link> - </para> -</sect2> - -<sect2> -<title>"The system can not log you on (C000019B)...."</title> - - <para>I joined the domain successfully but after upgrading - to a newer version of the Samba code I get the message, "The system - can not log you on (C000019B), Please try a gain or consult your - system administrator" when attempting to logon. - </para> - - <para> - This occurs when the domain SID stored in private/WORKGROUP.SID is - changed. For example, you remove the file and smbd automatically - creates a new one. Or you are swapping back and forth between - versions 2.0.7, TNG and the HEAD branch code (not recommended). The - only way to correct the problem is to restore the original domain - SID or remove the domain client from the domain and rejoin. - </para> -</sect2> - -</sect1> - -</chapter> - - -<!-- ============ U S E R A C C O U N T M A N A G M E N T ============= --> - -<chapter> -<title>User Account Management</title> - -<sect1> -<title>Domain Admins</title> - -<sect2> -<title>How do I configure an account as a domain administrator?</title> - - <para> - See the NTDom <ulink url="samba-pdc-howto.html">HowTo</ulink>. - </para> -</sect2> -</sect1> - -<sect1> -<title>Profiles</title> - -<sect2> -<title>Why is it bad to set "logon path = \\%N\%U\profile" in -smb.conf?</title> - - <para> - Sometimes Windows clients will maintain a connection to - the \\homes\ ( or [%U] ) share even after the user has logged out. - Consider the following scenario. - </para> - - <itemizedlist> - <listitem><para> user1 logs into the Windows NT machine. - Therefore the [homes] share is set to \\server\user1. - </para></listitem> - - <listitem><para> user1 works for a while and then logs - out. </para></listitem> - - <listitem><para> user2 logs into the same Windows NT - machine.</para></listitem> - </itemizedlist> - - <para> - However, since the NT box has maintained a connection to [homes] - which was previously set to \\server\user1, when the operating system - attempts to get the profile and if it can read users1's profile, will - get it otherwise it will return an error. You get the picture. - </para> - - <para> - A better solution is to use a separate [profiles] share and - set the "logon path = \\%N\profiles\%U" - </para> -</sect2> - - -<sect2> -<title>Why are all the users listed in the "domain admin users" using the -same profile?</title> - - <para> - You are using a very very old development version of Samba. - Upgrade. - </para> -</sect2> - - - -<sect2> -<title>The roaming profiles do not seem to be updating on the -server.</title> - - <para> - There can be several reasons for this. - </para> - - <para> - Make sure that the time on the client and the PDC are synchronized. You - can accomplish this by executing a <command>net time \\server /set /yes</command> - replacing server with the name of your PDC (or another synchronized SMB server). - See <link linkend="SettingTime"> about Setting Time</link> - </para> - - <para> - Make sure that the "logon path" is writeable by the user and make sure - that the connection to the logon path location is by the current user. - Sometimes Windows client do not drop the connection immediately upon - logoff. - </para> - - <para> - Some people have reported that the logon path location should - also be browseable. I (GC) have yet to emperically verify this, - but you can try.</para> -</sect2> -</sect1> - -<sect1><title>Policies</title> - -<sect2> -<title>What are 'Policies' ?.</title> - - <para> - When a user logs onto the domain via a client machine, the PDC - sends the client machine a list of things contained in the - 'policy' (if it exists). This list may do things like suppress - a splach screen, format the dates the way you like them or perhaps - remove locally stored profiles. - </para> - - <para> - On a samba PDC this list is obtained from a file called - <filename>ntconfig.pol</filename> and located in the [netlogon] - share. The file is created with a policy editor and must be readable - by anyone and writeable by only root. See <link linkend=policyeditor> - below</link> for how to get a suitable editor. - </para> -</sect2> - -<sect2> -<title>I can't get system policies to work.</title> - - <para> - There are two possible reasons for system policies not - functioning correctly. Make sure that you have the following - parameters set in smb.conf - </para> - - <para><programlisting> - [netlogon] - .... - locking = no - public = no - browseable = yes - .... - </programlisting></para> - - <para> - A policy file must be in the [netlogon] share and must be - readable by everyone and writeable by only root. The file - must be created by an NTServer <link linkend=policyeditor>Policy - Editor</link>. - </para> - - <para> - Last time I (drb) looked in the source, it was looking for - <filename>ntconfig.pol</filename> first then several other - combinations of upper and lower case. People have reported - success using <filename>NTconfig.pol</filename>, <filename>NTconfig.POL</filename> - and <filename>ntconfig.pol</filename>. These are the case settings that - I (GC) use with the filename <filename>ntconfig.pol</filename>: - </para> - - <para><programlisting> - case sensitive = no - case preserve = yes - short preserve case = no - default case = yes - </programlisting></para> - -</sect2> - -<sect2> -<title id=policyeditor>What about Windows NT Policy Editor ?</title> - - <para> - To create or edit <filename>ntconfig.pol</filename> you must use - the NT Server Policy Editor, <command>poledit.exe</command> which - is included with NT Server but <emphasis>not NT Workstation</emphasis>. - There is a Policy Editor on a NTws - but it is not suitable for creating <emphasis>Domain Policies</emphasis>. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need <filename>poledit.exe, common.adm</> and <filename>winnt.adm</>. It is convenient - to put the two *.adm files in <filename>c:\winnt\inf</> which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. - </para> - - <para>The Windows NT policy editor is also included with the - Service Pack 3 (and later) for Windows NT 4.0. Extract the files using - <command>servicepackname /x</command>, ie thats <command>Nt4sp6ai.exe - /x</command> for service pack 6a. The policy editor, <command>poledt.exe</command> and the - associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. - </para> -</sect2> - - -<sect2> -<title>Can Win95 do Policies ?</title> - - <para> - Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in <filename>\tools\reskit\netadmin\poledit</filename>. - Install group policies on a Win9x client by double-clicking - <filename>grouppol.inf</filename>. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... - </para> - - <para> - If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. - </para> - -</sect2> - -</sect1> - -<sect1> -<title>Passwords</title> - -<sect2> -<title>What is password sync and should I use it ?</title> - - <para> - NTws users can change their domain password by pressing Ctrl-Alt-Del - and choosing 'Change Password'. By default however, this does not change the unix password - (typically in <filename>/etc/passwd</filename> or <filename>/etc/shadow</filename>). - In lots of situations thats OK, for example : - </para> - - <itemizedlist> - <listitem><para>The server is only accessible to the user via - samba.</para></listitem> - - <listitem><para>Pam_smb or similar is installed so other applications - still refer to the samba password.</para></listitem> - </itemizedlist> - - <para> - But sometimes you really do need to maintain two seperate password - databases and there are good reasons to keep then in sync. Trying - to explain to users that they need to change their passwords in two - seperate places or use two seperate passwords is not fun. - </para> - - <para> - However do understand that setting up password sync is not without - problems either. The chief difficulty is the interface between Samba - and the <command>passwd</command> command, it can be a fiddle to set - up and if the password the user has entered fails, the resulting errors - are ambiguously reported and the user is confused. Further, you need - to take steps to ensure that users only ever change their passwords - via samba (or use <command>smbpasswd</command>), otherwise they will - only be changing the unix password.</para> - - -</sect2> - -<sect2> -<title>How do I get remote password (unix and SMB) changing working ?</title> - - <para> - Have a practice changing a user's password (as root) to see - what discussion takes place and change the text in the 'passwd chat' - line below as necessary. The line as shown works for recent RH Linux - but most other systems seem to like to do something different. The '*' is - a wild card and will match anything (or nothing). - </para> - - <para> - Add these lines to smb.conf under [Global] - </para> - - <para><programlisting> - - unix password sync = true - passwd program = /usr/bin/passwd %u - passwd chat = *password* %n\n *password* %n\n *successful* - </programlisting></para> - - <para> - As mentioned above, the change to the unix password happens as root, - not as the user, as is indicated in ~/smbd/chgpasswd.c If - you are using NIS, the Samba server must be running on the NIS - master machine. - </para> -</sect2> - -</sect1> - -</chapter> - -<!-- =================== M I S C E L L A N E O U S ================= --> - -<chapter> -<title>Miscellaneous</title> - -<sect1> -<title></title> - -<sect2> -<title>What editor can I use in DOS/Windows that won't -mess with my unix EOF</title> - - <para>There are a number of Windows or DOS based editors that will - understand, and leave intact, the unix eof (as opposed to a DOS CL/LF). - List members suggested : - </para> - - <itemizedlist> - <listitem><para>UltraEdit at <ulink url="http://www.ultraedit.com">www.ultraedit.com</ulink></para></listitem> - - <listitem><para>VI for windows at <ulink url="http://home.snafu.de/ramo/WinViEn.htm"> - home.snafu.de/ramo/WinViEn.htm</ulink></para></listitem> - - <listitem><para>The author prefers PFE at <ulink url="http://www.lancs.ac.uk/people/cpaap/pfe/"> - www.lancs.ac.uk/people/cpaap/pfe/</ulink> but its no longer being developed...</para></listitem> - </itemizedlist> -</sect2> - - - - -<sect2> -<title>How do I get 'User Manager' and 'Server Manager'</title> - - <para> - Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager' ? - </para> - - <para> - Microsoft distributes a version of - these tools called nexus for installation on Windows 95 systems. The - tools set includes - </para> - - <itemizedlist> - <listitem><para>Server Manager</para></listitem> - - <listitem><para>User Manager for Domains</para></listitem> - - <listitem><para>Event Viewer</para></listitem> - </itemizedlist> - - <para> - Click here to download the archived file <ulink - url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</ulink> - </para> - - <para> - The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</ulink> - </para> -</sect2> - - -<sect2><title id="SettingTime">The time setting from a Samba server does not work.</title> - <para>If it works OK when you log on as Domain Admin then the problem is that ordinary users - don't have permission to change the time. (The system is running with their permission - at logon time.) This is not a Samba problem, you will have the same problem where ever - you connect. You can give 'everyone' permission to change the time from the User Manager. - </para> - - <para>Anyone know what the registry settings are so this could be done with a Policy ?</para> -</sect2> - -<sect2><title>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</> - <para>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS." - in the logs. What do I need to do?</para> - - <para>You are using one of the old development versions. Upgrade. - (The message is unimportant, was a reminder to a developer)</para> - -</sect2> - -<sect2><title>How do I get my samba server to become a member ( not PDC ) of an NT domain?</title> - - - <para> - Please refer to the <ulink url="DOMAIN_MEMBER.html">Domain Member - HOWTO</ulink> for more information on this. - </para> - -</sect2> -</sect1> -</chapter> - - -<!-- ======== T R O U B L E S H O O T I N G and B U G R E P O R T I N G ======== --> - - - -<chapter><title>Troubleshooting and Bug Reporting</title> - -<sect1><title>Diagnostic tools</title> - -<sect2><title>What are some diagnostics tools I can use to debug the domain logon process and where can I - find them? </title> - - <para> - One of the best diagnostic tools for debugging problems is Samba itself. - You can use the -d option for both smbd and nmbd to specifiy what - 'debug level' at which to run. See the man pages on smbd, nmbd and - smb.conf for more information on debugging options. The debug - level can range from 1 (the default) to 10 (100 for debugging passwords). - </para> - - <para> - Another helpful method of debugging is to compile samba using the - <command>gcc -g </command> flag. This will include debug - information in the binaries and allow you to attch gdb to the - running smbd / nmbd process. In order to attach gdb to an smbd - process for an NT workstation, first get the workstation to make the - connection. Pressing ctrl-alt-delete and going down to the domain box - is sufficient (at least, on the first time you join the domain) to - generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation - maintains an open connection, and therefore there will be an smbd - process running (assuming that you haven't set a really short smbd - idle timeout) So, in between pressing ctrl alt delete, and actually - typing in your password, you can gdb attach and continue. - </para> - - <para> - Some usefull samba commands worth investigating: - </para> - - <itemizedlist> - <listitem><para>testparam | more</para></listitem> - <listitem><para>smbclient -L //{netbios name of server}</para></listitem> - </itemizedlist> - - <para> - An SMB enabled version of tcpdump is available from - <ulink url="http://www.tcpdump.org/">http://www.tcpdump.org/</ulink>. - Ethereal, another good packet sniffer for UNIX and Win32 - hosts, can be downloaded from <ulink - url="http://www.ethereal.com/">http://www.ethereal.com</ulink>. - </para> - - <para> - For tracing things on the Microsoft Windows NT, Network Monitor - (aka. netmon) is available on the Microsoft Developer Network CD's, - the Windows NT Server install CD and the SMS CD's. The version of - netmon that ships with SMS allows for dumping packets between any two - computers (ie. placing the network interface in promiscuous mode). - The version on the NT Server install CD will only allow monitoring - of network traffic directed to the local NT box and broadcasts on the - local subnet. Be aware that Ethereal can read and write netmon - formatted files. - </para> - -</sect2> - -<sect2> -<title>How do I install 'Network Monitor' on an NT Workstation -or a Windows 9x box?</title> - - <para> - Installing netmon on an NT workstation requires a couple - of steps. The following are for installing Netmon V4.00.349, which comes - with Microsoft Windows NT Server 4.0, on Microsoft Windows NT - Workstation 4.0. The process should be similar for other version of - Windows NT / Netmon. You will need both the Microsoft Windows - NT Server 4.0 Install CD and the Workstation 4.0 Install CD. - </para> - - <para> - Initially you will need to install 'Network Monitor Tools and Agent' - on the NT Server. To do this - </para> - - <itemizedlist> - <listitem><para>Goto Start - Settings - Control Panel - - Network - Services - Add </para></listitem> - - <listitem><para>Select the 'Network Monitor Tools and Agent' and - click on 'OK'.</para></listitem> - - <listitem><para>Click 'OK' on the Network Control Panel. - </para></listitem> - - <listitem><para>Insert the Windows NT Server 4.0 install CD - when prompted.</para></listitem> - </itemizedlist> - - <para> - At this point the Netmon files should exist in - <filename>%SYSTEMROOT%\System32\netmon\*.*</filename>. - Two subdirectories exist as well, <filename>parsers\</filename> - which contains the necessary DLL's for parsing the netmon packet - dump, and <filename>captures\</filename>. - </para> - - <para> - In order to install the Netmon tools on an NT Workstation, you will - first need to install the 'Network Monitor Agent' from the Workstation - install CD. - </para> - - <itemizedlist> - <listitem><para>Goto Start - Settings - Control Panel - - Network - Services - Add</para></listitem> - - <listitem><para>Select the 'Network Monitor Agent' and click - on 'OK'.</para></listitem> - - <listitem><para>Click 'OK' on the Network Control Panel. - </para></listitem> - - <listitem><para>Insert the Windows NT Workstation 4.0 install - CD when prompted.</para></listitem> - </itemizedlist> - - - <para> - Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* - to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set - permissions as you deem appropriate for your site. You will need - administrative rights on the NT box to run netmon. - </para> - - <para> - To install Netmon on a Windows 9x box install the network monitor agent - from the Windows 9x CD (\admin\nettools\netmon). There is a readme - file located with the netmon driver files on the CD if you need - information on how to do this. Copy the files from a working - Netmon installation. - </para> -</sect2> - -</sect1> - -<sect1> -<title>What other help can I get ? </title> - - <para> - There are many sources of information available in the form - of mailing lists, RFC's and documentation. The docs that come - with the samba distribution contain very good explanations of - general SMB topics such as browsing.</para> - -<sect2> -<title id=urls>URLs and similar</title> - - - <itemizedlist> - - <listitem><para>Home of Samba site <ulink url="http://samba.org"> - http://samba.org</ulink>. We have a mirror near you !</para></listitem> - - <listitem><para> The <emphasis role=strong>Development</emphasis> document - on the Samba mirrors might mention your problem. If so, - it might mean that the developers are working on it.</para></listitem> - - <listitem><para> Ignacio Coupeau has a very comprehesive look at LDAP with Samba at - <ulink url="http://www.unav.es/cti/ldap-smb-howto.html"> - http://www.unav.es/cti/ldap-smb-howto.html</ulink> - Be a little carefull however, I suspect that it does not specificly - address samba 2.2.x. The HEAD pre-2.1 may possibly be the best - stream to look at.</para></listitem> - - <listitem><para> Lars Kneschke's site covers <ulink url="http://www.samba-tng.org"> - Samba-TNG</ulink> at - <ulink url="http://www.kneschke.de/projekte/samba_tng"> - http://www.kneschke.de/projekte/samba_tng</ulink>, but again, a - lot of it does not apply to the main stream Samba.</para></listitem> - - <listitem><para>See how Scott Merrill simulates a BDC behaviour at - <ulink url="http://www.skippy.net/linux/smb-howto.html"> - http://www.skippy.net/linux/smb-howto.html</>. </para></listitem> - - <listitem><para>Although 2.0.7 has almost had its day as a PDC, I (drb) will - keep the 2.0.7 PDC pages at <ulink url="http://bioserve.latrobe.edu.au/samba"> - http://bioserve.latrobe.edu.au/samba</ulink> going for a while yet.</para></listitem> - - <listitem><para>Misc links to CIFS information - <ulink url="http://samba.org/cifs/">http://samba.org/cifs/</ulink></para></listitem> - - <listitem><para>NT Domains for Unix <ulink url="http://mailhost.cb1.com/~lkcl/ntdom/"> - http://mailhost.cb1.com/~lkcl/ntdom/</ulink></para></listitem> - - <listitem><para>FTP site for older SMB specs: - <ulink url="ftp://ftp.microsoft.com/developr/drg/CIFS/"> - ftp://ftp.microsoft.com/developr/drg/CIFS/</ulink></para></listitem> - - </itemizedlist> - - - <para> - You should also refer to the MS archives at - <ulink url="ftp://ftp.microsoft.com/developr/drg/CIFS/">ftp://ftp.microsoft.com/developr/drg/CIFS/"</ulink> - </para> - -</sect2> - - -<sect2> -<title>How do I get help from the mailing lists ?</title> - - <para> There are a number of Samba related mailing lists. Go to <ulink url= - "http://samba.org">http://samba.org</ulink>, click on your nearest mirror - and then click on <command>Support</> and then click on <command> - Samba related mailing lists</>.</para> - - <para>For questions relating to Samba TNG go to - <ulink url="http://www.samba-tng.org/">http://www.samba-tng.org/</ulink> - It has been requested that you don't post questions about Samba-TNG to the - main stream Samba lists.</para> - -<itemizedlist><title>If you post a message to one of the lists please - observe the following guide lines :</title> - - <listitem><para> Always remember that the developers are volunteers, they are - not paid and they never guarantee to produce a particular feature at - a particular time. Any time lines are 'best guess' and nothing more. - </para></listitem> - - <listitem><para> Always mention what version of samba you are using and what - operating system its running under. You should probably list the - relevant sections of your smb.conf file, at least the options - in [global] that affect PDC support.</para></listitem> - - <listitem><para>In addition to the version, if you obtained Samba via - CVS mention the date when you last checked it out.</para></listitem> - - <listitem><para> Try and make your question clear and brief, lots of long, - convoluted questions get deleted before they are completely read ! - Don't post html encoded messages (if you can select colour or font - size its html).</para></listitem> - - <listitem><para> If you run one of those niffy 'I'm on holidays' things when - you are away, make sure its configured to not answer mailing lists. - </para></listitem> - - <listitem><para> Don't cross post. Work out which is the best list to post to - and see what happens, ie don't post to both samba-ntdom and samba-technical. - Many people active on the lists subscribe to more - than one list and get annoyed to see the same message two or more times. - Often someone will see a message and thinking it would be better dealt - with on another, will forward it on for you.</para></listitem> - - <listitem><para>You might include <emphasis>partial</emphasis> - log files written at a debug level set to as much as 20. - Please don't send the entire log but enough to give the context of the - error messages.</para></listitem> - - <listitem><para>(Possibly) If you have a complete netmon trace ( from the opening of - the pipe to the error ) you can send the *.CAP file as well.</para></listitem> - - <listitem><para>Please think carefully before attaching a document to an email. - Consider pasting the relevant parts into the body of the message. The samba - mailing lists go to a huge number of people, do they all need a copy of your - smb.conf in their attach directory ?</para></listitem> - -</itemizedlist> -</sect2> - - -<sect2> -<title>How do I get off the mailing lists ?</title> - - <para>To have your name removed from a samba mailing list, go to the - same place you went to to get on it. Go to <ulink url= - "http://lists.samba.org/">http://lists.samba.org</ulink>, click - on your nearest mirror and then click on <command>Support</> and - then click on <command> Samba related mailing lists</>. Or perhaps see - <ulink url="http://lists.samba.org/mailman/roster/samba-ntdom">here</ulink></para> - - <para> - Please don't post messages to the list asking to be removed, you will just - be refered to the above address (unless that process failed in some way...) - </para> -</sect2> - -</sect1> - -</chapter> - - - - -</book> |