diff options
Diffstat (limited to 'docs/docbook')
27 files changed, 832 insertions, 775 deletions
diff --git a/docs/docbook/Makefile.in b/docs/docbook/Makefile.in index ae24606caf..1ac71e452b 100644 --- a/docs/docbook/Makefile.in +++ b/docs/docbook/Makefile.in @@ -13,14 +13,16 @@ MANPAGES_NAMES=findsmb.1 smbclient.1 \ smbspool.8 lmhosts.5 \ - smbcontrol.1 smbstatus.1 \ - smbd.8 net.8 smbtar.1 nmbd.8 \ - smbmnt.8 smbumount.8 nmblookup.1 \ - smbmount.8 swat.8 rpcclient.1 \ + smbcontrol.1 smbstatus.1 \ + make_smbcodepage.1 smbd.8 \ + smbtar.1 nmbd.8 smbmnt.8 \ + smbumount.8 nmblookup.1 \ + smbmount.8 swat.8 rpcclient.1 \ smbpasswd.5 testparm.1 samba.7 \ smbpasswd.8 testprns.1 \ smb.conf.5 wbinfo.1 pdbedit.8 \ smbcacls.1 smbsh.1 winbindd.8 \ + make_unicodemap.1 net.8 \ smbgroupedit.8 vfstest.1 ## This part contains only rules. You shouldn't need to change it diff --git a/docs/docbook/devdoc/dev-doc.sgml b/docs/docbook/devdoc/dev-doc.sgml index e256dbe3a2..adc25e83bd 100644 --- a/docs/docbook/devdoc/dev-doc.sgml +++ b/docs/docbook/devdoc/dev-doc.sgml @@ -11,7 +11,6 @@ <!ENTITY printing SYSTEM "printing.sgml"> <!ENTITY wins SYSTEM "wins.sgml"> <!ENTITY sam SYSTEM "sam.sgml"> -<!ENTITY encryption SYSTEM "encryption.sgml"> ]> <book id="Samba-Developers-Guide"> @@ -65,6 +64,5 @@ url="http://www.fsf.org/licenses/gpl.txt">http://www.fsf.org/licenses/gpl.txt</u &printing; &wins; &sam; -&encryption; </book> diff --git a/docs/docbook/devdoc/unix-smb.sgml b/docs/docbook/devdoc/unix-smb.sgml index aae96edfb7..be79698857 100644 --- a/docs/docbook/devdoc/unix-smb.sgml +++ b/docs/docbook/devdoc/unix-smb.sgml @@ -144,11 +144,6 @@ details. <sect1> <title>Locking</title> <para> -Since samba 2.2, samba supports other types of locking as well. This -section is outdated. -</para> - -<para> The locking calls available under a DOS/Windows environment are much richer than those available in unix. This means a unix server (like Samba) choosing to use the standard fcntl() based unix locking calls diff --git a/docs/docbook/global.ent b/docs/docbook/global.ent index 46745c2773..d88c489a4a 100644 --- a/docs/docbook/global.ent +++ b/docs/docbook/global.ent @@ -31,58 +31,3 @@ <!-- Misc --> <!ENTITY samba.pub.cvshost 'pserver.samba.org'> -<!ENTITY stdarg.debuglevel ' -<varlistentry> -<term>-d|--debug=debuglevel</term> -<listitem> -<para><replaceable>debuglevel</replaceable> is an integer -from 0 to 10. The default value if this parameter is -not specified is zero.</para> - -<para>The higher this value, the more detail will be -logged to the log files about the activities of the -server. At level 0, only critical errors and serious -warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of -information about operations carried out.</para> - -<para>Levels above 1 will generate considerable -amounts of log data, and should only be used when -investigating a problem. Levels above 3 are designed for -use only by developers and generate HUGE amounts of log -data, most of which is extremely cryptic.</para> - -<para>Note that specifying this parameter here will -override the <ulink url="smb.conf.5.html#loglevel">log -level</ulink> parameter in the <ulink url="smb.conf.5.html"> -<filename>smb.conf(5)</filename></ulink> file.</para> -</listitem> -</varlistentry>'> - -<!ENTITY stdarg.help ' -<varlistentry> -<term>-h|--help</term> -<listitem><para>Print a summary of command line options. -</para></listitem> -</varlistentry>'> - -<!ENTITY stdarg.configfile ' -<varlistentry> -<term>-s <configuration file></term> -<listitem><para>The file specified contains the -configuration details required by the server. The -information in this file includes server-specific -information such as what printcap file to use, as well -as descriptions of all the services that the server is -to provide. See <ulink url="smb.conf.5.html"><filename> -smb.conf(5)</filename></ulink> for more information. -The default configuration file name is determined at -compile time.</para></listitem> -</varlistentry>'> - -<!ENTITY stdarg.version ' -<varlistentry> -<term>-v</term> -<listitem><para>Prints the version number for -<command>smbd</command>.</para></listitem> -</varlistentry>'> diff --git a/docs/docbook/manpages/nmbd.8.sgml b/docs/docbook/manpages/nmbd.8.sgml index b8986110a6..bd8bf964f1 100644 --- a/docs/docbook/manpages/nmbd.8.sgml +++ b/docs/docbook/manpages/nmbd.8.sgml @@ -1,3 +1,4 @@ +2Q <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN"> <refentry id="nmbd"> @@ -317,7 +318,7 @@ <refsect1> <title>VERSION</title> - <para>This man page is correct for version 3.0 of + <para>This man page is correct for version 2.2 of the Samba suite.</para> </refsect1> diff --git a/docs/docbook/manpages/pdbedit.8.sgml b/docs/docbook/manpages/pdbedit.8.sgml index ed49b9f540..fd8ce375e5 100644 --- a/docs/docbook/manpages/pdbedit.8.sgml +++ b/docs/docbook/manpages/pdbedit.8.sgml @@ -1,6 +1,4 @@ -<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN" [ -<!ENTITY % globalentities SYSTEM '../global.ent'> %globalentities; -]> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN"> <refentry id="pdbedit"> <refmeta> @@ -23,8 +21,8 @@ <arg choice="opt">-u username</arg> <arg choice="opt">-f fullname</arg> <arg choice="opt">-h homedir</arg> - <arg choice="opt">-D drive</arg> - <arg choice="opt">-S script</arg> + <arg choice="opt">-d drive</arg> + <arg choice="opt">-s script</arg> <arg choice="opt">-p profile</arg> <arg choice="opt">-a</arg> <arg choice="opt">-m</arg> @@ -32,8 +30,7 @@ <arg choice="opt">-i passdb-backend</arg> <arg choice="opt">-e passdb-backend</arg> <arg choice="opt">-b passdb-backend</arg> - <arg choice="opt">-d debuglevel</arg> - <arg choice="opt">-s configfile</arg> + <arg choice="opt">-D debuglevel</arg> <arg choice="opt">-P account-policy</arg> <arg choice="opt">-V value</arg> </cmdsynopsis> @@ -163,8 +160,9 @@ </varlistentry> + <varlistentry> - <term>-D drive</term> + <term>-d drive</term> <listitem><para>This option can be used while adding or modifing a user account. It will specify the windows drive letter to be used to map the home directory.</para> @@ -176,7 +174,7 @@ <varlistentry> - <term>-S script</term> + <term>-s script</term> <listitem><para>This option can be used while adding or modifing a user account. It will specify the user's logon script path.</para> @@ -301,10 +299,6 @@ </programlisting></para> </listitem> </varlistentry> - - &stdarg.debuglevel; - &stdarg.help; - &stdarg.configfile; </variablelist> </refsect1> diff --git a/docs/docbook/manpages/rpcclient.1.sgml b/docs/docbook/manpages/rpcclient.1.sgml index 10e0ff438d..7a7a19c837 100644 --- a/docs/docbook/manpages/rpcclient.1.sgml +++ b/docs/docbook/manpages/rpcclient.1.sgml @@ -1,6 +1,4 @@ -<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN" [ -<!ENTITY % globalentities SYSTEM '../global.ent'> %globalentities; -]> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN"> <refentry id="rpcclient"> <refmeta> @@ -89,8 +87,23 @@ - &stdarg.debuglevel; - &stdarg.help; + <varlistentry> + <term>-d|--debug=debuglevel</term> + <listitem><para>set the debuglevel. Debug level 0 is the lowest + and 100 being the highest. This should be set to 100 if you are + planning on submitting a bug report to the Samba team (see <filename>BUGS.txt</filename>). + </para></listitem> + </varlistentry> + + + + + <varlistentry> + <term>-h|--help</term> + <listitem><para>Print a summary of command line options. + </para></listitem> + </varlistentry> + <varlistentry> <term>-I IP-address</term> diff --git a/docs/docbook/manpages/smb.conf.5.sgml b/docs/docbook/manpages/smb.conf.5.sgml index 0cdf2bbcd6..621b764a11 100644 --- a/docs/docbook/manpages/smb.conf.5.sgml +++ b/docs/docbook/manpages/smb.conf.5.sgml @@ -1269,10 +1269,10 @@ <term><anchor id="ANNOUNCEVERSION">announce version (G)</term> <listitem><para>This specifies the major and minor version numbers that nmbd will use when announcing itself as a server. The default - is 4.9. Do not change this parameter unless you have a specific + is 4.2. Do not change this parameter unless you have a specific need to set a Samba server to be a downlevel server.</para> - <para>Default: <command>announce version = 4.9</command></para> + <para>Default: <command>announce version = 4.5</command></para> <para>Example: <command>announce version = 2.0</command></para> </listitem> @@ -2862,7 +2862,7 @@ system print command such as <command>lpr(1)</command> or <command> lp(1)</command>.</para> - <para>This parameter does not accept % macros, because + <para>This paramater does not accept % macros, because many parts of the system require this value to be constant for correct operation.</para> @@ -3475,7 +3475,7 @@ <parameter>ldap server</parameter>. Only available when the backwards-compatiblity <command> --with-ldapsam</command> option is specified - to configure. See <link linkend="PASSDBBACKEND"><parameter>passdb backend</parameter></link></para></listitem> + to configure. See <link linkend="PASSDBBACKEND"><paramater>passdb backend</parameter></link></para></listitem> </itemizedlist> <para>Default : <command>ldap ssl = start_tls</command></para> @@ -5387,8 +5387,8 @@ <para>LDAP connections should be secured where possible. This may be done using either Start-TLS (see <link linkend="LDAPSSL"> - <parameter>ldap ssl</parameter></link>) or by - specifying <parameter>ldaps://</parameter> in + <parameter>ldap ssl</parameter>) or by + specifying <paramater>ldaps://</paramater> in the URL argument. </para></listitem> @@ -7499,8 +7499,7 @@ <varlistentry> <term><anchor id="UNICODE">unicode (G)</term> <listitem><para>Specifies whether Samba should try - to use unicode on the wire by default. Note: This does NOT - mean that samba will assume that the unix machine uses unicode! + to use unicode on the wire by default. </para> <para>Default: <command>unicode = yes</command></para> @@ -7516,7 +7515,6 @@ </para> <para>Default: <command>unix charset = ASCII</command></para> - <para>Example: <command>unix charset = UTF8</command></para> </listitem> </varlistentry> diff --git a/docs/docbook/manpages/smbclient.1.sgml b/docs/docbook/manpages/smbclient.1.sgml index 43994a4529..31031dafc4 100644 --- a/docs/docbook/manpages/smbclient.1.sgml +++ b/docs/docbook/manpages/smbclient.1.sgml @@ -30,7 +30,7 @@ <arg choice="opt">-l logfile</arg> <arg choice="opt">-L <netbios name></arg> <arg choice="opt">-I destinationIP</arg> - <arg choice="opt">-E</arg> + <arg choice="opt">-E <terminal code></arg> <arg choice="opt">-c <command string></arg> <arg choice="opt">-i scope</arg> <arg choice="opt">-O <socket options></arg> diff --git a/docs/docbook/manpages/vfstest.1.sgml b/docs/docbook/manpages/vfstest.1.sgml index f8fa7298b8..9a7eff1939 100644 --- a/docs/docbook/manpages/vfstest.1.sgml +++ b/docs/docbook/manpages/vfstest.1.sgml @@ -1,7 +1,4 @@ -<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN" [ -<!ENTITY % globalentities SYSTEM '../global.ent'> %globalentities; -]> - +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN"> <refentry id="vfstest"> <refmeta> @@ -51,8 +48,20 @@ </para> </listitem> </varlistentry> - &stdarg.debuglevel; - &stdarg.help; + <varlistentry> + <term>-d|--debug=debuglevel</term> + <listitem><para>set the debuglevel. Debug level 0 is the lowest + and 100 being the highest. This should be set to 100 if you are + planning on submitting a bug report to the Samba team (see + <filename>BUGS.txt</filename>). + </para></listitem> + </varlistentry> + + <varlistentry> + <term>-h|--help</term> + <listitem><para>Print a summary of command line options. + </para></listitem> + </varlistentry> <varlistentry> <term>-l|--logfile=logbasename</term> diff --git a/docs/docbook/manpages/wbinfo.1.sgml b/docs/docbook/manpages/wbinfo.1.sgml index a6ca244243..f1461b07b9 100644 --- a/docs/docbook/manpages/wbinfo.1.sgml +++ b/docs/docbook/manpages/wbinfo.1.sgml @@ -17,8 +17,8 @@ <command>wbinfo</command> <arg choice="opt">-u</arg> <arg choice="opt">-g</arg> + <arg choice="opt">-h name</arg> <arg choice="opt">-i ip</arg> - <arg choice="opt">-N netbios-name</arg> <arg choice="opt">-n name</arg> <arg choice="opt">-s sid</arg> <arg choice="opt">-U uid</arg> @@ -30,7 +30,6 @@ <arg choice="opt">-r user</arg> <arg choice="opt">-a user%password</arg> <arg choice="opt">-A user%password</arg> - <arg choice="opt">-p</arg> </cmdsynopsis> </refsynopsisdiv> @@ -73,9 +72,10 @@ <command>winbindd(8)</command>. </para></listitem> </varlistentry> + <varlistentry> - <term>-N name</term> - <listitem><para>The <parameter>-N</parameter> option + <term>-h name</term> + <listitem><para>The <parameter>-h</parameter> option queries <command>winbindd(8)</command> to query the WINS server for the IP address associated with the NetBIOS name specified by the <parameter>name</parameter> parameter. @@ -84,8 +84,8 @@ <varlistentry> - <term>-I ip</term> - <listitem><para>The <parameter>-I</parameter> option + <term>-i ip</term> + <listitem><para>The <parameter>-i</parameter> option queries <command>winbindd(8)</command> to send a node status request to get the NetBIOS name associated with the IP address specified by the <parameter>ip</parameter> parameter. @@ -210,7 +210,7 @@ <refsect1> <title>VERSION</title> - <para>This man page is correct for version 3.0 of + <para>This man page is correct for version 2.2 of the Samba suite.</para> </refsect1> diff --git a/docs/docbook/projdoc/ADS-HOWTO.sgml b/docs/docbook/projdoc/ADS-HOWTO.sgml index 83bb2dc85d..0d2fda5f78 100644 --- a/docs/docbook/projdoc/ADS-HOWTO.sgml +++ b/docs/docbook/projdoc/ADS-HOWTO.sgml @@ -7,7 +7,7 @@ <pubdate>2002</pubdate> </chapterinfo> -<title>Samba as a ADS domain member</title> +<title>Using samba 3.0 with ActiveDirectory support</title> <para> This is a VERY ROUGH guide to setting up the current (November 2001) diff --git a/docs/docbook/projdoc/Browsing.sgml b/docs/docbook/projdoc/Browsing.sgml index 13d6fce917..a463ea786b 100644 --- a/docs/docbook/projdoc/Browsing.sgml +++ b/docs/docbook/projdoc/Browsing.sgml @@ -461,7 +461,7 @@ all smb.conf files : </para> <para> -<command>wins server = >name or IP address<</command> +<command> wins server = >name or IP address<</command> </para> <para> @@ -512,7 +512,7 @@ set the following option in the [global] section of the smb.conf file : </para> <para> -<command>domain master = yes</command> +<command> domain master = yes</command> </para> <para> diff --git a/docs/docbook/projdoc/Bugs.sgml b/docs/docbook/projdoc/Bugs.sgml index a9493b07d4..5a24458e08 100644 --- a/docs/docbook/projdoc/Bugs.sgml +++ b/docs/docbook/projdoc/Bugs.sgml @@ -15,8 +15,7 @@ <title>Introduction</title> <para> -The email address for bug reports for stable releases is <ulink url="samba@samba.org">samba@samba.org</ulink>. -Bug reports for alpha releases should go to <ulink url="mailto:samba-technical@samba.org">samba-technical@samba.org</ulink>. +The email address for bug reports is samba@samba.org </para> <para> @@ -45,7 +44,7 @@ that list that may be able to help you. <para> You may also like to look though the recent mailing list archives, which are conveniently accessible on the Samba web pages -at <ulink url="http://samba.org/samba/">http://samba.org/samba/</ulink>. +at http://samba.org/samba/ </para> </sect1> diff --git a/docs/docbook/projdoc/DOMAIN_MEMBER.sgml b/docs/docbook/projdoc/DOMAIN_MEMBER.sgml index 8a30a5527d..6d0b36eafc 100644 --- a/docs/docbook/projdoc/DOMAIN_MEMBER.sgml +++ b/docs/docbook/projdoc/DOMAIN_MEMBER.sgml @@ -25,7 +25,7 @@ </chapterinfo> -<title>Samba as a NT4 domain member</title> +<title>security = domain in Samba 2.x</title> <sect1> @@ -139,11 +139,10 @@ <sect1> <title>Samba and Windows 2000 Domains</title> -<!-- FIXME: this section is partly obsoleted - jelmer@samba.org --> <para> Many people have asked regarding the state of Samba's ability to participate in -a Windows 2000 Domain. Samba 3.0 is able to act as a member server of a Windows +a Windows 2000 Domain. Samba 2.2 is able to act as a member server of a Windows 2000 domain operating in mixed or native mode. </para> @@ -165,6 +164,7 @@ Computers" MMC (Microsoft Management Console) plugin. </sect1> + <sect1> <title>Why is this better than security = server?</title> diff --git a/docs/docbook/projdoc/Diagnosis.sgml b/docs/docbook/projdoc/Diagnosis.sgml index b2d7abb656..3cc0bab5d5 100644 --- a/docs/docbook/projdoc/Diagnosis.sgml +++ b/docs/docbook/projdoc/Diagnosis.sgml @@ -7,14 +7,7 @@ <address><email>tridge@samba.org</email></address> </affiliation> </author> - <author> - <firstname>Jelmer</firstname><surname>Vernooij</surname> - <affiliation> - <orgname>Samba Team</orgname> - <address><email>jelmer@samba.org</email></address> - </affiliation> - </author> - <pubdate>$Id: Diagnosis.sgml,v 1.3 2002/11/02 00:20:29 jelmer Exp $</pubdate> + <pubdate> 1 November 1999</pubdate> </chapterinfo> <title>Diagnosing your samba server</title> @@ -30,15 +23,15 @@ then it is probably working fine. </para> <para> -You should do ALL the tests, in the order shown. We have tried to +You should do ALL the tests, in the order shown. I have tried to carefully choose them so later tests only use capabilities verified in the earlier tests. </para> <para> -If you send one of the samba mailing lists an email saying "it doesn't work" -and you have not followed this test procedure then you should not be surprised -your email is ignored. +If you send me an email saying "it doesn't work" and you have not +followed this test procedure then you should not be surprised if I +ignore your email. </para> </sect1> @@ -47,8 +40,11 @@ your email is ignored. <title>Assumptions</title> <para> -In all of the tests it is assumed you have a Samba server called -BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP. +In all of the tests I assume you have a Samba server called BIGSERVER +and a PC called ACLIENT both in workgroup TESTGROUP. I also assume the +PC is running windows for workgroups with a recent copy of the +microsoft tcp/ip stack. Alternatively, your PC may be running Windows +95 or Windows NT (Workstation or Server). </para> <para> @@ -56,7 +52,7 @@ The procedure is similar for other types of clients. </para> <para> -It is also assumed you know the name of an available share in your +I also assume you know the name of an available share in your smb.conf. I will assume this share is called "tmp". You can add a "tmp" share like by adding the following to smb.conf: </para> @@ -72,7 +68,7 @@ smb.conf. I will assume this share is called "tmp". You can add a </para> <para> -THESE TESTS ASSUME VERSION 3.0.0 OR LATER OF THE SAMBA SUITE. SOME +THESE TESTS ASSUME VERSION 2.0.6 OR LATER OF THE SAMBA SUITE. SOME COMMANDS SHOWN DID NOT EXIST IN EARLIER VERSIONS </para> @@ -103,7 +99,7 @@ configuration file is faulty. </para> <para> -Note: Your smb.conf file may be located in: <filename>/etc/samba</filename> +Note: Your smb.conf file may be located in: <filename>/etc</filename> Or in: <filename>/usr/local/samba/lib</filename> </para> </sect2> diff --git a/docs/docbook/projdoc/ENCRYPTION.sgml b/docs/docbook/projdoc/ENCRYPTION.sgml index f903d7d334..6a26dbeffa 100644 --- a/docs/docbook/projdoc/ENCRYPTION.sgml +++ b/docs/docbook/projdoc/ENCRYPTION.sgml @@ -7,42 +7,88 @@ <affiliation> <orgname>Samba Team</orgname> <address> - <email>jra@samba.org</email> - </address> - </affiliation> - </author> - - <author> - <firstname>Jelmer</firstname><surname>Vernooij</surname> - <affiliation> - <orgname>Samba Team</orgname> - <address> - <email>jelmer@samba.org</email> + <email>samba@samba.org</email> </address> </affiliation> </author> + - <pubdate>4 November 2002</pubdate> + <pubdate>19 Apr 1999</pubdate> </chapterinfo> -<title>LanMan and NT Password Encryption in Samba</title> +<title>LanMan and NT Password Encryption in Samba 2.x</title> <sect1> <title>Introduction</title> - <para>Newer windows clients send encrypted passwords over - the wire, instead of plain text passwords. The newest clients - will only send encrypted passwords and refuse to send plain text - passwords, unless their registry is tweaked.</para> + <para>With the development of LanManager and Windows NT + compatible password encryption for Samba, it is now able + to validate user connections in exactly the same way as + a LanManager or Windows NT server.</para> - <para>These passwords can't be converted to unix style encrypted - passwords. Because of that you can't use the standard unix - user database, and you have to store the Lanman and NT hashes - somewhere else. For more information, see the documentation - about the <command>passdb backend = </command> parameter. - </para> + <para>This document describes how the SMB password encryption + algorithm works and what issues there are in choosing whether + you want to use it. You should read it carefully, especially + the part about security and the "PROS and CONS" section.</para> + +</sect1> + +<sect1> + <title>How does it work?</title> + + <para>LanManager encryption is somewhat similar to UNIX + password encryption. The server uses a file containing a + hashed value of a user's password. This is created by taking + the user's plaintext password, capitalising it, and either + truncating to 14 bytes or padding to 14 bytes with null bytes. + This 14 byte value is used as two 56 bit DES keys to encrypt + a 'magic' eight byte value, forming a 16 byte value which is + stored by the server and client. Let this value be known as + the "hashed password".</para> + + <para>Windows NT encryption is a higher quality mechanism, + consisting of doing an MD4 hash on a Unicode version of the user's + password. This also produces a 16 byte hash value that is + non-reversible.</para> + + <para>When a client (LanManager, Windows for WorkGroups, Windows + 95 or Windows NT) wishes to mount a Samba drive (or use a Samba + resource), it first requests a connection and negotiates the + protocol that the client and server will use. In the reply to this + request the Samba server generates and appends an 8 byte, random + value - this is stored in the Samba server after the reply is sent + and is known as the "challenge". The challenge is different for + every client connection.</para> + + <para>The client then uses the hashed password (16 byte values + described above), appended with 5 null bytes, as three 56 bit + DES keys, each of which is used to encrypt the challenge 8 byte + value, forming a 24 byte value known as the "response".</para> + + <para>In the SMB call SMBsessionsetupX (when user level security + is selected) or the call SMBtconX (when share level security is + selected), the 24 byte response is returned by the client to the + Samba server. For Windows NT protocol levels the above calculation + is done on both hashes of the user's password and both responses are + returned in the SMB call, giving two 24 byte values.</para> + <para>The Samba server then reproduces the above calculation, using + its own stored value of the 16 byte hashed password (read from the + <filename>smbpasswd</filename> file - described later) and the challenge + value that it kept from the negotiate protocol reply. It then checks + to see if the 24 byte value it calculates matches the 24 byte value + returned to it from the client.</para> + + <para>If these values match exactly, then the client knew the + correct password (or the 16 byte hashed value - see security note + below) and is thus allowed access. If not, then the client did not + know the correct password and is denied access.</para> + + <para>Note that the Samba server never knows or stores the cleartext + of the user's password - just the 16 byte hashed values derived from + it. Also note that the cleartext password or 16 byte hashed values + are never transmitted over the network - thus increasing security.</para> </sect1> <sect1> @@ -138,6 +184,111 @@ <sect1> + <title><anchor id="SMBPASSWDFILEFORMAT">The smbpasswd file</title> + + <para>In order for Samba to participate in the above protocol + it must be able to look up the 16 byte hashed values given a user name. + Unfortunately, as the UNIX password value is also a one way hash + function (ie. it is impossible to retrieve the cleartext of the user's + password given the UNIX hash of it), a separate password file + containing this 16 byte value must be kept. To minimise problems with + these two password files, getting out of sync, the UNIX <filename> + /etc/passwd</filename> and the <filename>smbpasswd</filename> file, + a utility, <command>mksmbpasswd.sh</command>, is provided to generate + a smbpasswd file from a UNIX <filename>/etc/passwd</filename> file. + </para + + + <para>To generate the smbpasswd file from your <filename>/etc/passwd + </filename> file use the following command :</para> + + <para><prompt>$ </prompt><userinput>cat /etc/passwd | mksmbpasswd.sh + > /usr/local/samba/private/smbpasswd</userinput></para> + + <para>If you are running on a system that uses NIS, use</para> + + <para><prompt>$ </prompt><userinput>ypcat passwd | mksmbpasswd.sh + > /usr/local/samba/private/smbpasswd</userinput></para> + + <para>The <command>mksmbpasswd.sh</command> program is found in + the Samba source directory. By default, the smbpasswd file is + stored in :</para> + + <para><filename>/usr/local/samba/private/smbpasswd</filename></para> + + <para>The owner of the <filename>/usr/local/samba/private/</filename> + directory should be set to root, and the permissions on it should + be set to 0500 (<command>chmod 500 /usr/local/samba/private</command>). + </para> + + <para>Likewise, the smbpasswd file inside the private directory should + be owned by root and the permissions on is should be set to 0600 + (<command>chmod 600 smbpasswd</command>).</para> + + + <para>The format of the smbpasswd file is (The line has been + wrapped here. It should appear as one entry per line in + your smbpasswd file.)</para> + + <para><programlisting> +username:uid:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: + [Account type]:LCT-<last-change-time>:Long name + </programlisting></para> + + <para>Although only the <replaceable>username</replaceable>, + <replaceable>uid</replaceable>, <replaceable> + XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</replaceable>, + [<replaceable>Account type</replaceable>] and <replaceable> + last-change-time</replaceable> sections are significant + and are looked at in the Samba code.</para> + + <para>It is <emphasis>VITALLY</emphasis> important that there by 32 + 'X' characters between the two ':' characters in the XXX sections - + the smbpasswd and Samba code will fail to validate any entries that + do not have 32 characters between ':' characters. The first XXX + section is for the Lanman password hash, the second is for the + Windows NT version.</para> + + <para>When the password file is created all users have password entries + consisting of 32 'X' characters. By default this disallows any access + as this user. When a user has a password set, the 'X' characters change + to 32 ascii hexadecimal digits (0-9, A-F). These are an ascii + representation of the 16 byte hashed value of a user's password.</para> + + <para>To set a user to have no password (not recommended), edit the file + using vi, and replace the first 11 characters with the ascii text + <constant>"NO PASSWORD"</constant> (minus the quotes).</para> + + <para>For example, to clear the password for user bob, his smbpasswd file + entry would look like :</para> + + <para><programlisting> + bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[U ]:LCT-00000000:Bob's full name:/bobhome:/bobshell + </programlisting></para> + + <para>If you are allowing users to use the smbpasswd command to set + their own passwords, you may want to give users NO PASSWORD initially + so they do not have to enter a previous password when changing to their + new password (not recommended). In order for you to allow this the + <command>smbpasswd</command> program must be able to connect to the + <command>smbd</command> daemon as that user with no password. Enable this + by adding the line :</para> + + <para><command>null passwords = yes</command></para> + + <para>to the [global] section of the smb.conf file (this is why + the above scenario is not recommended). Preferably, allocate your + users a default password to begin with, so you do not have + to enable this on your server.</para> + + <para><emphasis>Note : </emphasis>This file should be protected very + carefully. Anyone with access to this file can (with enough knowledge of + the protocols) gain access to your SMB server. The file is thus more + sensitive than a normal unix <filename>/etc/passwd</filename> file.</para> +</sect1> + + +<sect1> <title>The smbpasswd Command</title> <para>The smbpasswd command maintains the two 32 byte password fields @@ -146,14 +297,25 @@ install it in <filename>/usr/local/samba/bin/</filename> (or your main Samba binary directory).</para> + <para>Note that as of Samba 1.9.18p4 this program <emphasis>MUST NOT + BE INSTALLED</emphasis> setuid root (the new <command>smbpasswd</command> + code enforces this restriction so it cannot be run this way by + accident).</para> + <para><command>smbpasswd</command> now works in a client-server mode where it contacts the local smbd to change the user's password on its behalf. This has enormous benefits - as follows.</para> - <para><command>smbpasswd</command> now has the capability - to change passwords on Windows NT servers (this only works when - the request is sent to the NT Primary Domain Controller if you - are changing an NT Domain user's password).</para> + <itemizedlist> + <listitem><para>smbpasswd no longer has to be setuid root - + an enormous range of potential security problems is + eliminated.</para></listitem> + + <listitem><para><command>smbpasswd</command> now has the capability + to change passwords on Windows NT servers (this only works when + the request is sent to the NT Primary Domain Controller if you + are changing an NT Domain user's password).</para></listitem> + </itemizedlist> <para>To run smbpasswd as a normal user just type :</para> @@ -186,4 +348,31 @@ to the man page which will always be the definitive reference.</para> </sect1> + +<sect1> + <title>Setting up Samba to support LanManager Encryption</title> + + <para>This is a very brief description on how to setup samba to + support password encryption. </para> + + <orderedlist numeration="Arabic"> + <listitem><para>compile and install samba as usual</para> + </listitem> + + <listitem><para>enable encrypted passwords in <filename> + smb.conf</filename> by adding the line <command>encrypt + passwords = yes</command> in the [global] section</para> + </listitem> + + <listitem><para>create the initial <filename>smbpasswd</filename> + password file in the place you specified in the Makefile + (--prefix=<dir>). See the notes under the <link + linkend="SMBPASSWDFILEFORMAT">The smbpasswd File</link> + section earlier in the document for details.</para> + </listitem> + </orderedlist> + + <para>Note that you can test things using smbclient.</para> +</sect1> + </chapter> diff --git a/docs/docbook/projdoc/Integrating-with-Windows.sgml b/docs/docbook/projdoc/Integrating-with-Windows.sgml index 3b0faf81af..701e48678c 100644 --- a/docs/docbook/projdoc/Integrating-with-Windows.sgml +++ b/docs/docbook/projdoc/Integrating-with-Windows.sgml @@ -253,7 +253,7 @@ principal of speaking only when necessary. </para> <para> -Starting with version 2.2.0 samba has Linux support for extensions to +Samba version 2.2.0 will add Linux support for extensions to the name service switch infrastructure so that linux clients will be able to obtain resolution of MS Windows NetBIOS names to IP Addresses. To gain this functionality Samba needs to be compiled diff --git a/docs/docbook/projdoc/Printing.sgml b/docs/docbook/projdoc/Printing.sgml new file mode 100644 index 0000000000..ce9f40e88b --- /dev/null +++ b/docs/docbook/projdoc/Printing.sgml @@ -0,0 +1,398 @@ +<chapter id="printingdebug"> +<chapterinfo> + <author> + <firstname>Patrick</firstname><surname>Powell</surname> + <affiliation> + <address><email>papowell@lprng.org</email></address> + </affiliation> + </author> + <pubdate>11 August 2000</pubdate> +</chapterinfo> + +<title>Debugging Printing Problems</title> + +<sect1> +<title>Introduction</title> + +<para> +This is a short description of how to debug printing problems with +Samba. This describes how to debug problems with printing from a SMB +client to a Samba server, not the other way around. For the reverse +see the examples/printing directory. +</para> + +<para> +Ok, so you want to print to a Samba server from your PC. The first +thing you need to understand is that Samba does not actually do any +printing itself, it just acts as a middleman between your PC client +and your Unix printing subsystem. Samba receives the file from the PC +then passes the file to a external "print command". What print command +you use is up to you. +</para> + +<para> +The whole things is controlled using options in smb.conf. The most +relevant options (which you should look up in the smb.conf man page) +are: +</para> + +<para><programlisting> + [global] + print command - send a file to a spooler + lpq command - get spool queue status + lprm command - remove a job + [printers] + path = /var/spool/lpd/samba +</programlisting></para> + +<para> +The following are nice to know about: +</para> + +<para><programlisting> + queuepause command - stop a printer or print queue + queueresume command - start a printer or print queue +</programlisting></para> + +<para> +Example: +</para> + +<para><programlisting> + print command = /usr/bin/lpr -r -P%p %s + lpq command = /usr/bin/lpq -P%p %s + lprm command = /usr/bin/lprm -P%p %j + queuepause command = /usr/sbin/lpc -P%p stop + queuepause command = /usr/sbin/lpc -P%p start +</programlisting></para> + +<para> +Samba should set reasonable defaults for these depending on your +system type, but it isn't clairvoyant. It is not uncommon that you +have to tweak these for local conditions. The commands should +always have fully specified pathnames, as the smdb may not have +the correct PATH values. +</para> + +<para> +When you send a job to Samba to be printed, it will make a temporary +copy of it in the directory specified in the [printers] section. +and it should be periodically cleaned out. The lpr -r option +requests that the temporary copy be removed after printing; If +printing fails then you might find leftover files in this directory, +and it should be periodically cleaned out. Samba used the lpq +command to determine the "job number" assigned to your print job +by the spooler. +</para> + +<para> +The %>letter< are "macros" that get dynamically replaced with appropriate +values when they are used. The %s gets replaced with the name of the spool +file that Samba creates and the %p gets replaced with the name of the +printer. The %j gets replaced with the "job number" which comes from +the lpq output. +</para> + +</sect1> + +<sect1> +<title>Debugging printer problems</title> + +<para> +One way to debug printing problems is to start by replacing these +command with shell scripts that record the arguments and the contents +of the print file. A simple example of this kind of things might +be: +</para> + +<para><programlisting> + print command = /tmp/saveprint %p %s + + #!/bin/saveprint + # we make sure that we are the right user + /usr/bin/id -p >/tmp/tmp.print + # we run the command and save the error messages + # replace the command with the one appropriate for your system + /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print +</programlisting></para> + +<para> +Then you print a file and try removing it. You may find that the +print queue needs to be stopped in order to see the queue status +and remove the job: +</para> + +<para><programlisting> + +h4: {42} % echo hi >/tmp/hi +h4: {43} % smbclient //localhost/lw4 +added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0 +Password: +Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7] +smb: \> print /tmp/hi +putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s) +smb: \> queue +1049 3 hi-17534 +smb: \> cancel 1049 +Error cancelling job 1049 : code 0 +smb: \> cancel 1049 +Job 1049 cancelled +smb: \> queue +smb: \> exit +</programlisting></para> + +<para> +The 'code 0' indicates that the job was removed. The comment +by the smbclient is a bit misleading on this. +You can observe the command output and then and look at the +/tmp/tmp.print file to see what the results are. You can quickly +find out if the problem is with your printing system. Often people +have problems with their /etc/printcap file or permissions on +various print queues. +</para> +</sect1> + +<sect1> +<title>What printers do I have?</title> + +<para> +You can use the 'testprns' program to check to see if the printer +name you are using is recognized by Samba. For example, you can +use: +</para> + +<para><programlisting> + testprns printer /etc/printcap +</programlisting></para> + +<para> +Samba can get its printcap information from a file or from a program. +You can try the following to see the format of the extracted +information: +</para> + +<para><programlisting> + testprns -a printer /etc/printcap + + testprns -a printer '|/bin/cat printcap' +</programlisting></para> + +</sect1> + +<sect1> +<title>Setting up printcap and print servers</title> + +<para> +You may need to set up some printcaps for your Samba system to use. +It is strongly recommended that you use the facilities provided by +the print spooler to set up queues and printcap information. +</para> + +<para> +Samba requires either a printcap or program to deliver printcap +information. This printcap information has the format: +</para> + +<para><programlisting> + name|alias1|alias2...:option=value:... +</programlisting></para> + +<para> +For almost all printing systems, the printer 'name' must be composed +only of alphanumeric or underscore '_' characters. Some systems also +allow hyphens ('-') as well. An alias is an alternative name for the +printer, and an alias with a space in it is used as a 'comment' +about the printer. The printcap format optionally uses a \ at the end of lines +to extend the printcap to multiple lines. +</para> + +<para> +Here are some examples of printcap files: +</para> + +<para> +<orderedlist> +<listitem><para> +pr just printer name +</para></listitem> +<listitem><para> +pr|alias printer name and alias +</para></listitem> +<listitem><para> +pr|My Printer printer name, alias used as comment +</para></listitem> +<listitem><para> +pr:sh:\ Same as pr:sh:cm= testing + :cm= \ + testing +</para></listitem> +<listitem><para> +pr:sh Same as pr:sh:cm= testing + :cm= testing +</para></listitem> +</orderedlist> +</para> + +<para> +Samba reads the printcap information when first started. If you make +changes in the printcap information, then you must do the following: +</para> + +<orderedlist> + +<listitem><para> +make sure that the print spooler is aware of these changes. +The LPRng system uses the 'lpc reread' command to do this. +</para></listitem> + +<listitem><para> +make sure that the spool queues, etc., exist and have the +correct permissions. The LPRng system uses the 'checkpc -f' +command to do this. +</para></listitem> + +<listitem><para> +You now should send a SIGHUP signal to the smbd server to have +it reread the printcap information. +</para></listitem> +</orderedlist> + +</sect1> + +<sect1> +<title>Job sent, no output</title> + +<para> +This is the most frustrating part of printing. You may have sent the +job, verified that the job was forwarded, set up a wrapper around +the command to send the file, but there was no output from the printer. +</para> + +<para> +First, check to make sure that the job REALLY is getting to the +right print queue. If you are using a BSD or LPRng print spooler, +you can temporarily stop the printing of jobs. Jobs can still be +submitted, but they will not be printed. Use: +</para> + +<para><programlisting> + lpc -Pprinter stop +</programlisting></para> + +<para> +Now submit a print job and then use 'lpq -Pprinter' to see if the +job is in the print queue. If it is not in the print queue then +you will have to find out why it is not being accepted for printing. +</para> + +<para> +Next, you may want to check to see what the format of the job really +was. With the assistance of the system administrator you can view +the submitted jobs files. You may be surprised to find that these +are not in what you would expect to call a printable format. +You can use the UNIX 'file' utitily to determine what the job +format actually is: +</para> + +<para><programlisting> + cd /var/spool/lpd/printer # spool directory of print jobs + ls # find job files + file dfA001myhost +</programlisting></para> + +<para> +You should make sure that your printer supports this format OR that +your system administrator has installed a 'print filter' that will +convert the file to a format appropriate for your printer. +</para> + +</sect1> + +<sect1> +<title>Job sent, strange output</title> + +<para> +Once you have the job printing, you can then start worrying about +making it print nicely. +</para> + +<para> +The most common problem is extra pages of output: banner pages +OR blank pages at the end. +</para> + +<para> +If you are getting banner pages, check and make sure that the +printcap option or printer option is configured for no banners. +If you have a printcap, this is the :sh (suppress header or banner +page) option. You should have the following in your printer. +</para> + +<para><programlisting> + printer: ... :sh +</programlisting></para> + +<para> +If you have this option and are still getting banner pages, there +is a strong chance that your printer is generating them for you +automatically. You should make sure that banner printing is disabled +for the printer. This usually requires using the printer setup software +or procedures supplied by the printer manufacturer. +</para> + +<para> +If you get an extra page of output, this could be due to problems +with your job format, or if you are generating PostScript jobs, +incorrect setting on your printer driver on the MicroSoft client. +For example, under Win95 there is a option: +</para> + +<para><programlisting> + Printers|Printer Name|(Right Click)Properties|Postscript|Advanced| +</programlisting></para> + +<para> +that allows you to choose if a Ctrl-D is appended to all jobs. +This is a very bad thing to do, as most spooling systems will +automatically add a ^D to the end of the job if it is detected as +PostScript. The multiple ^D may cause an additional page of output. +</para> + +</sect1> + +<sect1> +<title>Raw PostScript printed</title> + +<para> +This is a problem that is usually caused by either the print spooling +system putting information at the start of the print job that makes +the printer think the job is a text file, or your printer simply +does not support PostScript. You may need to enable 'Automatic +Format Detection' on your printer. +</para> + +</sect1> + +<sect1> +<title>Advanced Printing</title> + +<para> +Note that you can do some pretty magic things by using your +imagination with the "print command" option and some shell scripts. +Doing print accounting is easy by passing the %U option to a print +command shell script. You could even make the print command detect +the type of output and its size and send it to an appropriate +printer. +</para> + +</sect1> + +<sect1> +<title>Real debugging</title> + +<para> +If the above debug tips don't help, then maybe you need to bring in +the bug guns, system tracing. See Tracing.txt in this directory. +</para> +</sect1> +</chapter> diff --git a/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml b/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml index 7cf3e5735c..25a9783277 100644 --- a/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml +++ b/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml @@ -19,7 +19,7 @@ </chapterinfo> <title> -How to Configure Samba as a NT4 Primary Domain Controller +How to Configure Samba 2.2 as a Primary Domain Controller </title> diff --git a/docs/docbook/projdoc/UNIX_INSTALL.sgml b/docs/docbook/projdoc/UNIX_INSTALL.sgml index 1ff735a656..c307636d5f 100644 --- a/docs/docbook/projdoc/UNIX_INSTALL.sgml +++ b/docs/docbook/projdoc/UNIX_INSTALL.sgml @@ -3,17 +3,15 @@ <title>How to Install and Test SAMBA</title> <sect1> - <title>Read the man pages</title> + <title>Step 0: Read the man pages</title> <para>The man pages distributed with SAMBA contain lots of useful info that will help to get you started. If you don't know how to read man pages then try something like:</para> - <para><prompt>$ </prompt><userinput>man smbd.8</userinput> - or - <prompt>$ </prompt><userinput>nroff -man smbd.8 | more - </userinput> on older unixes.</para> + <para><prompt>$ </prompt><userinput>nroff -man smbd.8 | more + </userinput></para> <para>Other sources of information are pointed to by the Samba web site,<ulink url="http://www.samba.org/"> @@ -21,7 +19,7 @@ </sect1> <sect1> - <title>Building the Binaries</title> + <title>Step 1: Building the Binaries</title> <para>To do this, first run the program <command>./configure </command> in the source directory. This should automatically @@ -64,7 +62,7 @@ </sect1> <sect1> - <title>The all important step</title> + <title>Step 2: The all important step</title> <para>At this stage you must fetch yourself a coffee or other drink you find stimulating. Getting the rest @@ -76,7 +74,7 @@ </sect1> <sect1> - <title>Create the smb configuration file. </title> + <title>Step 3: Create the smb configuration file. </title> <para>There are sample configuration files in the examples subdirectory in the distribution. I suggest you read them @@ -93,7 +91,7 @@ [homes] guest ok = no read only = no - </programlisting></para> + </programlisting</para> <para>which would allow connections by anyone with an account on the server, using either their login name or @@ -113,7 +111,7 @@ </sect1> <sect1> - <title>Test your config file with + <title>Step 4: Test your config file with <command>testparm</command></title> <para>It's important that you test the validity of your @@ -124,13 +122,10 @@ <para>Make sure it runs OK and that the services look reasonable before proceeding. </para> - <para>Always run testparm again when you change - <filename>smb.conf</filename>!</para> - </sect1> <sect1> - <title>Starting the smbd and nmbd</title> + <title>Step 5: Starting the smbd and nmbd</title> <para>You must choose to start smbd and nmbd either as daemons or from <command>inetd</command>. Don't try @@ -149,7 +144,7 @@ request.</para> <sect2> - <title>Starting from inetd.conf</title> + <title>Step 5a: Starting from inetd.conf</title> <para>NOTE; The following will be different if you use NIS or NIS+ to distributed services maps.</para> @@ -201,7 +196,7 @@ </sect2> <sect2> - <title>Alternative: starting it as a daemon</title> + <title>Step 5b. Alternative: starting it as a daemon</title> <para>To start the server as a daemon you should create a script something like this one, perhaps calling @@ -230,7 +225,7 @@ </sect1> <sect1> - <title>Try listing the shares available on your + <title>Step 6: Try listing the shares available on your server</title> <para><prompt>$ </prompt><userinput>smbclient -L @@ -250,7 +245,7 @@ </sect1> <sect1> - <title>Try connecting with the unix client</title> + <title>Step 7: Try connecting with the unix client</title> <para><prompt>$ </prompt><userinput>smbclient <replaceable> //yourhostname/aservice</replaceable></userinput></para> @@ -270,7 +265,7 @@ </sect1> <sect1> - <title>Try connecting from a DOS, WfWg, Win9x, WinNT, + <title>Step 8: Try connecting from a DOS, WfWg, Win9x, WinNT, Win2k, OS/2, etc... client</title> <para>Try mounting disks. eg:</para> @@ -310,8 +305,8 @@ <sect2> <title>Diagnosing Problems</title> - <para>If you have installation problems then go to the - <ulink url="Diagnosis.html">Diagnosis</ulink> chapter to try to find the + <para>If you have installation problems then go to + <filename>DIAGNOSIS.txt</filename> to try to find the problem.</para> </sect2> @@ -429,8 +424,6 @@ its open. A client may ask for DENY_NONE, DENY_READ, DENY_WRITE or DENY_ALL. There are also special compatibility modes called DENY_FCB and DENY_DOS.</para> - - <!-- FIXME: Sync this with oplocks.sgml --> </sect2> <sect2> diff --git a/docs/docbook/projdoc/msdfs_setup.sgml b/docs/docbook/projdoc/msdfs_setup.sgml index 6e1609460f..35c9d40840 100644 --- a/docs/docbook/projdoc/msdfs_setup.sgml +++ b/docs/docbook/projdoc/msdfs_setup.sgml @@ -11,7 +11,8 @@ </affiliation> </author> - <pubdate>12 Jul 2000</pubdate> + + <pubdate>12 Jul 200</pubdate> </chapterinfo> diff --git a/docs/docbook/projdoc/pdb_mysql.sgml b/docs/docbook/projdoc/pdb_mysql.sgml deleted file mode 100644 index 220f17caa1..0000000000 --- a/docs/docbook/projdoc/pdb_mysql.sgml +++ /dev/null @@ -1,138 +0,0 @@ -<chapter id="pdb-mysql"> -<chapterinfo> - <author> - <firstname>Jelmer</firstname><surname>Vernooij</surname> - <affiliation> - <orgname>The Samba Team</orgname> - <address><email>jelmer@samba.org</email></address> - </affiliation> - </author> - <pubdate>November 2002</pubdate> -</chapterinfo> - -<title>Passdb MySQL plugin</title> - -<sect1> -<title>Building</title> - -<para>To build the plugin, run <command>make bin/pdb_mysql.so</command> -in the <filename>source/</filename> directory of samba distribution. -</para> - -<para>Next, copy pdb_mysql.so to any location you want. I -strongly recommend installing it in $PREFIX/lib or /usr/lib/samba/</para> - -</sect1> - -<sect1> -<title>Configuring</title> - -<para>This plugin lacks some good documentation, but here is some short info:</para> - -<para>Add a the following to the <command>passdb backend</command> variable in your <filename>smb.conf</filename>: -<programlisting> -passdb backend = [other-plugins] plugin:/location/to/pdb_mysql.so:identifier [other-plugins] -</programlisting> -</para> - -<para>The identifier can be any string you like, as long as it doesn't collide with -the identifiers of other plugins or other instances of pdb_mysql. If you -specify multiple pdb_mysql.so entries in 'passdb backend', you also need to -use different identifiers! -</para> - -<para> -Additional options can be given thru the smb.conf file in the [global] section. -</para> - -<para><programlisting> -identifier:mysql host - host name, defaults to 'localhost' -identifier:mysql password -identifier:mysql user - defaults to 'samba' -identifier:mysql database - defaults to 'samba' -identifier:mysql port - defaults to 3306 -identifier:table - Name of the table containing users -</programlisting></para> - -<para>Names of the columns in this table(I've added column types those columns should have first):</para> - -<para><programlisting> -identifier:logon time column - int(9) -identifier:logoff time column - int(9) -identifier:kickoff time column - int(9) -identifier:pass last set time column - int(9) -identifier:pass can change time column - int(9) -identifier:pass must change time column - int(9) -identifier:username column - varchar(255) - unix username -identifier:domain column - varchar(255) - NT domain user is part of -identifier:nt username column - varchar(255) - NT username -identifier:fullname column - varchar(255) - Full name of user -identifier:home dir column - varchar(255) - Unix homedir path -identifier:dir drive column - varchar(2) - Directory drive path (eg: 'H:') -identifier:logon script column - varchar(255) - Batch file to run on client side when logging on -identifier:profile path column - varchar(255) - Path of profile -identifier:acct desc column - varchar(255) - Some ASCII NT user data -identifier:workstations column - varchar(255) - Workstations user can logon to (or NULL for all) -identifier:unknown string column - varchar(255) - unknown string -identifier:munged dial column - varchar(255) - ? -identifier:uid column - int(9) - Unix user ID (uid) -identifier:gid column - int(9) - Unix user group (gid) -identifier:user sid column - varchar(255) - NT user SID -identifier:group sid column - varchar(255) - NT group ID -identifier:lanman pass column - varchar(255) - encrypted lanman password -identifier:nt pass column - varchar(255) - encrypted nt passwd -identifier:plaintext pass column - varchar(255) - plaintext password -identifier:acct control column - int(9) - nt user data -identifier:unknown 3 column - int(9) - unknown -identifier:logon divs column - int(9) - ? -identifier:hours len column - int(9) - ? -identifier:unknown 5 column - int(9) - unknown -identifier:unknown 6 column - int(9) - unknown -</programlisting></para> - -<para> -Eventually, you can put a colon (:) after the name of each column, which -should specify the column to update when updating the table. You can also -specify nothing behind the colon - then the data from the field will not be -updated. -</para> - -</sect1> - -<sect1> -<title>Using plaintext passwords or encrypted password</title> - -<para> -I strongly discourage the use of plaintext passwords, however, you can use them: -</para> - -<para> -If you would like to use plaintext passwords, set 'identifier:lanman pass column' and 'identifier:nt pass column' to 'NULL' (without the quotes) and 'identifier:plaintext pass column' to the name of the column containing the plaintext passwords. -</para> - -<para> -If you use encrypted passwords, set the 'identifier:plaintext pass column' to 'NULL' (without the quotes). This is the default. -</para> - -</sect1> - -<sect1> -<title>Getting non-column data from the table</title> - -<para> -It is possible to have not all data in the database and making some 'constant'. -</para> - -<para> -For example, you can set 'identifier:fullname column' to : -<command>CONCAT(First_name,' ',Sur_name)</command> -</para> - -<para> -Or, set 'identifier:workstations column' to : -<command>NULL</command></para> - -<para>See the MySQL documentation for more language constructs.</para> - -</sect1> -</chapter> diff --git a/docs/docbook/projdoc/printer_driver2.sgml b/docs/docbook/projdoc/printer_driver2.sgml index 7bca8dc6f5..85ae0713b3 100644 --- a/docs/docbook/projdoc/printer_driver2.sgml +++ b/docs/docbook/projdoc/printer_driver2.sgml @@ -11,16 +11,12 @@ </address> </affiliation> </author> - <author> - <firstname>Patrick</firstname><surname>Powell</surname> - <affiliation> - <address><email>papowell@lprng.org</email></address> - </affiliation> - </author> + + <pubdate> (3 May 2001) </pubdate> </chapterinfo> -<title>Printing Support</title> +<title>Printing Support in Samba 2.2.x</title> <sect1> <title>Introduction</title> @@ -63,7 +59,12 @@ SPOOLSS support includes:</para> There has been some initial confusion about what all this means and whether or not it is a requirement for printer drivers to be installed on a Samba host in order to support printing from Windows -clients. As a side note, Samba does not use these drivers in any way to process +clients. A bug existed in Samba 2.2.0 which made Windows NT/2000 clients +require that the Samba server possess a valid driver for the printer. +This is fixed in Samba 2.2.1 and once again, Windows NT/2000 clients +can use the local APW for installing drivers to be used with a Samba +served printer. This is the same behavior exhibited by Windows 9x clients. +As a side note, Samba does not use these drivers in any way to process spooled files. They are utilized entirely by the clients. </para> @@ -103,9 +104,16 @@ parameter named <parameter>printer driver</parameter> provided a means of defining the printer driver name to be sent to the client. </para> - -</warning> +<para> +These parameters, including <parameter>printer driver +file</parameter> parameter, are being deprecated and should not +be used in new installations. For more information on this change, +you should refer to the <link linkend="MIGRATION">Migration section</link> +of this document. +</para> +</warning> + <sect2> <title>Creating [print$]</title> @@ -235,8 +243,10 @@ that matches the printer shares defined on your Samba host. <para>The initial listing of printers in the Samba host's Printers folder will have no real printer driver assigned -to them. This defaults to a NULL string to allow the use -of the local Add Printer Wizard on NT/2000 clients. +to them. By default, in Samba 2.2.0 this driver name was set to +<emphasis>NO PRINTER DRIVER AVAILABLE FOR THIS PRINTER</emphasis>. +Later versions changed this to a NULL string to allow the use +tof the local Add Printer Wizard on NT/2000 clients. Attempting to view the printer properties for a printer which has this default driver assigned will result in the error message:</para> @@ -593,6 +603,84 @@ foreach (supported architecture for a given driver) </sect1> + +<sect1> +<title><anchor id="MIGRATION">Migration to from Samba 2.0.x to 2.2.x</title> + +<para> +Given that printer driver management has changed (we hope improved) in +2.2 over prior releases, migration from an existing setup to 2.2 can +follow several paths. Here are the possible scenarios for +migration: +</para> + +<itemizedlist> + <listitem><para>If you do not desire the new Windows NT + print driver support, nothing needs to be done. + All existing parameters work the same.</para></listitem> + + <listitem><para>If you want to take advantage of NT printer + driver support but do not want to migrate the + 9x drivers to the new setup, the leave the existing + <filename>printers.def</filename> file. When smbd attempts + to locate a + 9x driver for the printer in the TDB and fails it + will drop down to using the printers.def (and all + associated parameters). The <command>make_printerdef</command> + tool will also remain for backwards compatibility but will + be removed in the next major release.</para></listitem> + + <listitem><para>If you install a Windows 9x driver for a printer + on your Samba host (in the printing TDB), this information will + take precedence and the three old printing parameters + will be ignored (including print driver location).</para></listitem> + + <listitem><para>If you want to migrate an existing <filename>printers.def</filename> + file into the new setup, the current only solution is to use the Windows + NT APW to install the NT drivers and the 9x drivers. This can be scripted + using <command>smbclient</command> and <command>rpcclient</command>. See the + Imprints installation client at <ulink + url="http://imprints.sourceforge.net/">http://imprints.sourceforge.net/</ulink> + for an example. + </para></listitem> +</itemizedlist> + + +<warning> +<title>Achtung!</title> + +<para> +The following <filename>smb.conf</filename> parameters are considered to +be deprecated and will be removed soon. Do not use them in new +installations +</para> + +<itemizedlist> + <listitem><para><parameter>printer driver file (G)</parameter> + </para></listitem> + + <listitem><para><parameter>printer driver (S)</parameter> + </para></listitem> + + <listitem><para><parameter>printer driver location (S)</parameter> + </para></listitem> +</itemizedlist> +</warning> + + +<para> +The have been two new parameters add in Samba 2.2.2 to for +better support of Samba 2.0.x backwards capability (<parameter>disable +spoolss</parameter>) and for using local printers drivers on Windows +NT/2000 clients (<parameter>use client driver</parameter>). Both of +these options are described in the smb.coinf(5) man page and are +disabled by default. +</para> + + +</sect1> + + <!-- This comment from rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex() @@ -652,393 +740,4 @@ foreach (supported architecture for a given driver) * on the Advanced Tab of the printer properties window. --> -<sect1> -<title>Diagnosis</title> - -<sect2> -<title>Introduction</title> - -<para> -This is a short description of how to debug printing problems with -Samba. This describes how to debug problems with printing from a SMB -client to a Samba server, not the other way around. For the reverse -see the examples/printing directory. -</para> - -<para> -Ok, so you want to print to a Samba server from your PC. The first -thing you need to understand is that Samba does not actually do any -printing itself, it just acts as a middleman between your PC client -and your Unix printing subsystem. Samba receives the file from the PC -then passes the file to a external "print command". What print command -you use is up to you. -</para> - -<para> -The whole things is controlled using options in smb.conf. The most -relevant options (which you should look up in the smb.conf man page) -are: -</para> - -<para><programlisting> - [global] - print command - send a file to a spooler - lpq command - get spool queue status - lprm command - remove a job - [printers] - path = /var/spool/lpd/samba -</programlisting></para> - -<para> -The following are nice to know about: -</para> - -<para><programlisting> - queuepause command - stop a printer or print queue - queueresume command - start a printer or print queue -</programlisting></para> - -<para> -Example: -</para> - -<para><programlisting> - print command = /usr/bin/lpr -r -P%p %s - lpq command = /usr/bin/lpq -P%p %s - lprm command = /usr/bin/lprm -P%p %j - queuepause command = /usr/sbin/lpc -P%p stop - queuepause command = /usr/sbin/lpc -P%p start -</programlisting></para> - -<para> -Samba should set reasonable defaults for these depending on your -system type, but it isn't clairvoyant. It is not uncommon that you -have to tweak these for local conditions. The commands should -always have fully specified pathnames, as the smdb may not have -the correct PATH values. -</para> - -<para> -When you send a job to Samba to be printed, it will make a temporary -copy of it in the directory specified in the [printers] section. -and it should be periodically cleaned out. The lpr -r option -requests that the temporary copy be removed after printing; If -printing fails then you might find leftover files in this directory, -and it should be periodically cleaned out. Samba used the lpq -command to determine the "job number" assigned to your print job -by the spooler. -</para> - -<para> -The %>letter< are "macros" that get dynamically replaced with appropriate -values when they are used. The %s gets replaced with the name of the spool -file that Samba creates and the %p gets replaced with the name of the -printer. The %j gets replaced with the "job number" which comes from -the lpq output. -</para> - -</sect2> - -<sect2> -<title>Debugging printer problems</title> - -<para> -One way to debug printing problems is to start by replacing these -command with shell scripts that record the arguments and the contents -of the print file. A simple example of this kind of things might -be: -</para> - -<para><programlisting> - print command = /tmp/saveprint %p %s - - #!/bin/saveprint - # we make sure that we are the right user - /usr/bin/id -p >/tmp/tmp.print - # we run the command and save the error messages - # replace the command with the one appropriate for your system - /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print -</programlisting></para> - -<para> -Then you print a file and try removing it. You may find that the -print queue needs to be stopped in order to see the queue status -and remove the job: -</para> - -<para><programlisting> - -h4: {42} % echo hi >/tmp/hi -h4: {43} % smbclient //localhost/lw4 -added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0 -Password: -Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7] -smb: \> print /tmp/hi -putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s) -smb: \> queue -1049 3 hi-17534 -smb: \> cancel 1049 -Error cancelling job 1049 : code 0 -smb: \> cancel 1049 -Job 1049 cancelled -smb: \> queue -smb: \> exit -</programlisting></para> - -<para> -The 'code 0' indicates that the job was removed. The comment -by the smbclient is a bit misleading on this. -You can observe the command output and then and look at the -/tmp/tmp.print file to see what the results are. You can quickly -find out if the problem is with your printing system. Often people -have problems with their /etc/printcap file or permissions on -various print queues. -</para> -</sect2> - -<sect2> -<title>What printers do I have?</title> - -<para> -You can use the 'testprns' program to check to see if the printer -name you are using is recognized by Samba. For example, you can -use: -</para> - -<para><programlisting> - testprns printer /etc/printcap -</programlisting></para> - -<para> -Samba can get its printcap information from a file or from a program. -You can try the following to see the format of the extracted -information: -</para> - -<para><programlisting> - testprns -a printer /etc/printcap - - testprns -a printer '|/bin/cat printcap' -</programlisting></para> - -</sect2> - -<sect2> -<title>Setting up printcap and print servers</title> - -<para> -You may need to set up some printcaps for your Samba system to use. -It is strongly recommended that you use the facilities provided by -the print spooler to set up queues and printcap information. -</para> - -<para> -Samba requires either a printcap or program to deliver printcap -information. This printcap information has the format: -</para> - -<para><programlisting> - name|alias1|alias2...:option=value:... -</programlisting></para> - -<para> -For almost all printing systems, the printer 'name' must be composed -only of alphanumeric or underscore '_' characters. Some systems also -allow hyphens ('-') as well. An alias is an alternative name for the -printer, and an alias with a space in it is used as a 'comment' -about the printer. The printcap format optionally uses a \ at the end of lines -to extend the printcap to multiple lines. -</para> - -<para> -Here are some examples of printcap files: -</para> - -<para> -<orderedlist> -<listitem><para> -pr just printer name -</para></listitem> -<listitem><para> -pr|alias printer name and alias -</para></listitem> -<listitem><para> -pr|My Printer printer name, alias used as comment -</para></listitem> -<listitem><para> -pr:sh:\ Same as pr:sh:cm= testing - :cm= \ - testing -</para></listitem> -<listitem><para> -pr:sh Same as pr:sh:cm= testing - :cm= testing -</para></listitem> -</orderedlist> -</para> - -<para> -Samba reads the printcap information when first started. If you make -changes in the printcap information, then you must do the following: -</para> - -<orderedlist> - -<listitem><para> -make sure that the print spooler is aware of these changes. -The LPRng system uses the 'lpc reread' command to do this. -</para></listitem> - -<listitem><para> -make sure that the spool queues, etc., exist and have the -correct permissions. The LPRng system uses the 'checkpc -f' -command to do this. -</para></listitem> - -<listitem><para> -You now should send a SIGHUP signal to the smbd server to have -it reread the printcap information. -</para></listitem> -</orderedlist> - -</sect2> - -<sect2> -<title>Job sent, no output</title> - -<para> -This is the most frustrating part of printing. You may have sent the -job, verified that the job was forwarded, set up a wrapper around -the command to send the file, but there was no output from the printer. -</para> - -<para> -First, check to make sure that the job REALLY is getting to the -right print queue. If you are using a BSD or LPRng print spooler, -you can temporarily stop the printing of jobs. Jobs can still be -submitted, but they will not be printed. Use: -</para> - -<para><programlisting> - lpc -Pprinter stop -</programlisting></para> - -<para> -Now submit a print job and then use 'lpq -Pprinter' to see if the -job is in the print queue. If it is not in the print queue then -you will have to find out why it is not being accepted for printing. -</para> - -<para> -Next, you may want to check to see what the format of the job really -was. With the assistance of the system administrator you can view -the submitted jobs files. You may be surprised to find that these -are not in what you would expect to call a printable format. -You can use the UNIX 'file' utitily to determine what the job -format actually is: -</para> - -<para><programlisting> - cd /var/spool/lpd/printer # spool directory of print jobs - ls # find job files - file dfA001myhost -</programlisting></para> - -<para> -You should make sure that your printer supports this format OR that -your system administrator has installed a 'print filter' that will -convert the file to a format appropriate for your printer. -</para> - -</sect2> - -<sect2> -<title>Job sent, strange output</title> - -<para> -Once you have the job printing, you can then start worrying about -making it print nicely. -</para> - -<para> -The most common problem is extra pages of output: banner pages -OR blank pages at the end. -</para> - -<para> -If you are getting banner pages, check and make sure that the -printcap option or printer option is configured for no banners. -If you have a printcap, this is the :sh (suppress header or banner -page) option. You should have the following in your printer. -</para> - -<para><programlisting> - printer: ... :sh -</programlisting></para> - -<para> -If you have this option and are still getting banner pages, there -is a strong chance that your printer is generating them for you -automatically. You should make sure that banner printing is disabled -for the printer. This usually requires using the printer setup software -or procedures supplied by the printer manufacturer. -</para> - -<para> -If you get an extra page of output, this could be due to problems -with your job format, or if you are generating PostScript jobs, -incorrect setting on your printer driver on the MicroSoft client. -For example, under Win95 there is a option: -</para> - -<para><programlisting> - Printers|Printer Name|(Right Click)Properties|Postscript|Advanced| -</programlisting></para> - -<para> -that allows you to choose if a Ctrl-D is appended to all jobs. -This is a very bad thing to do, as most spooling systems will -automatically add a ^D to the end of the job if it is detected as -PostScript. The multiple ^D may cause an additional page of output. -</para> - -</sect2> - -<sect2> -<title>Raw PostScript printed</title> - -<para> -This is a problem that is usually caused by either the print spooling -system putting information at the start of the print job that makes -the printer think the job is a text file, or your printer simply -does not support PostScript. You may need to enable 'Automatic -Format Detection' on your printer. -</para> - -</sect2> - -<sect2> -<title>Advanced Printing</title> - -<para> -Note that you can do some pretty magic things by using your -imagination with the "print command" option and some shell scripts. -Doing print accounting is easy by passing the %U option to a print -command shell script. You could even make the print command detect -the type of output and its size and send it to an appropriate -printer. -</para> - -</sect2> - -<sect2> -<title>Real debugging</title> - -<para> -If the above debug tips don't help, then maybe you need to bring in -the bug guns, system tracing. See Tracing.txt in this directory. -</para> -</sect2> -</sect1> - </chapter> diff --git a/docs/docbook/projdoc/samba-doc.sgml b/docs/docbook/projdoc/samba-doc.sgml index f00dfd9db6..f20849edbf 100644 --- a/docs/docbook/projdoc/samba-doc.sgml +++ b/docs/docbook/projdoc/samba-doc.sgml @@ -13,6 +13,7 @@ <!ENTITY Samba-PAM SYSTEM "PAM-Authentication-And-Samba.sgml"> <!ENTITY Samba-LDAP SYSTEM "Samba-LDAP-HOWTO.sgml"> <!ENTITY Diagnosis SYSTEM "Diagnosis.sgml"> +<!ENTITY PRINTING SYSTEM "Printing.sgml"> <!ENTITY BUGS SYSTEM "Bugs.sgml"> <!ENTITY SECURITY-LEVEL SYSTEM "security_level.sgml"> <!ENTITY SPEED SYSTEM "Speed.sgml"> @@ -22,9 +23,6 @@ <!ENTITY Portability SYSTEM "Portability.sgml"> <!ENTITY Other-Clients SYSTEM "Other-Clients.sgml"> <!ENTITY ADS-HOWTO SYSTEM "ADS-HOWTO.sgml"> -<!ENTITY oplocks SYSTEM "oplocks.sgml"> -<!ENTITY pdb-mysql SYSTEM "pdb_mysql.sgml"> -<!ENTITY pdb-xml SYSTEM "pdb_xml.sgml"> ]> <book id="Samba-HOWTO-Collection"> @@ -68,63 +66,30 @@ Cheers, jerry </dedication> <!-- Chapters --> -<part> -<title>General installation</title> -<partintro> -<title>Introduction</title> -<para>This part contains general info on how to install samba -and how to configure the parts of samba you will most likely need. -PLEASE read this.</para> -</partintro> &UNIX-INSTALL; -&BROWSING; -&oplocks; -&BROWSING-Quick; -&ENCRYPTION; -</part> - -<part> -<title>Type of installation</title> -<partintro> -<title>Introduction</title> -<para>This part contains information on using samba in a (NT 4 or ADS) domain. -If you wish to run samba as a domain member or DC, read the appropriate chapter in -this part.</para> -</partintro> -&Samba-PDC-HOWTO; -&Samba-BDC-HOWTO; -&ADS-HOWTO; -&DOMAIN-MEMBER; -</part> - -<part> -<title>Optional configuration</title> -<partintro> -<title>Introduction</title> -<para>Samba has several features that you might want or might not want to use. The chapters in this -part each cover one specific feature.</para> -</partintro> &IntegratingWithWindows; -&NT-Security; &Samba-PAM; &MS-Dfs-Setup; +&NT-Security; &PRINTER-DRIVER2; +&PRINTING; &SECURITY-LEVEL; +&DOMAIN-MEMBER; &WINBIND; -&pdb-mysql; -&pdb-xml; +&Samba-PDC-HOWTO; +&Samba-BDC-HOWTO; &Samba-LDAP; +&ADS-HOWTO; +&BROWSING; +&BROWSING-Quick; +&SPEED; &CVS-Access; +&BUGS; &GROUP-MAPPING-HOWTO; -&SPEED; -</part> -<part> -<title>Appendixes</title> +<!-- Appendices --> &Portability; &Other-Clients; -&BUGS; &Diagnosis; -</part> </book> diff --git a/docs/docbook/projdoc/security_level.sgml b/docs/docbook/projdoc/security_level.sgml index 2f9a92d872..efe2b6eaf3 100644 --- a/docs/docbook/projdoc/security_level.sgml +++ b/docs/docbook/projdoc/security_level.sgml @@ -20,7 +20,7 @@ Samba supports the following options to the global smb.conf parameter <para><programlisting> [global] -<ulink url="smb.conf.5.html#SECURITY"><parameter>security</parameter></ulink> = [share|user(default)|server|domain|ads] +<ulink url="smb.conf.5.html#SECURITY"><parameter>security</parameter></ulink> = [share|user(default)|domain|ads] </programlisting></para> <para> diff --git a/docs/docbook/projdoc/winbind.sgml b/docs/docbook/projdoc/winbind.sgml index d2bfb8ab67..b045a26db6 100644 --- a/docs/docbook/projdoc/winbind.sgml +++ b/docs/docbook/projdoc/winbind.sgml @@ -412,7 +412,7 @@ you get frustrated with the way things are going. ;-) </para> <para> -The latest version of SAMBA (version 3.0 as of this writing), now +The latest version of SAMBA (version 2.2.2 as of this writing), now includes a functioning winbindd daemon. Please refer to the <ulink url="http://samba.org/">main SAMBA web page</ulink> or, better yet, your closest SAMBA mirror site for instructions on |