summaryrefslogtreecommitdiff
path: root/docs/htmldocs/Samba-HOWTO-Collection.html
diff options
context:
space:
mode:
Diffstat (limited to 'docs/htmldocs/Samba-HOWTO-Collection.html')
-rw-r--r--docs/htmldocs/Samba-HOWTO-Collection.html5305
1 files changed, 2665 insertions, 2640 deletions
diff --git a/docs/htmldocs/Samba-HOWTO-Collection.html b/docs/htmldocs/Samba-HOWTO-Collection.html
index d758fbbe11..cad5fbc2bc 100644
--- a/docs/htmldocs/Samba-HOWTO-Collection.html
+++ b/docs/htmldocs/Samba-HOWTO-Collection.html
@@ -5,7 +5,7 @@
>SAMBA Project Documentation</TITLE
><META
NAME="GENERATOR"
-CONTENT="Modular DocBook HTML Stylesheet Version 1.77+"></HEAD
+CONTENT="Modular DocBook HTML Stylesheet Version 1.7"></HEAD
><BODY
CLASS="BOOK"
BGCOLOR="#FFFFFF"
@@ -24,8 +24,8 @@ CLASS="TITLEPAGE"
CLASS="TITLE"
><A
NAME="SAMBA-HOWTO-COLLECTION"
-></A
->SAMBA Project Documentation</H1
+>SAMBA Project Documentation</A
+></H1
><H3
CLASS="AUTHOR"
><A
@@ -99,57 +99,33 @@ HREF="#INSTALL"
><DT
>1.1. <A
HREF="#AEN26"
->Read the man pages</A
+>Obtaining and installing samba</A
></DT
><DT
>1.2. <A
-HREF="#AEN36"
->Building the Binaries</A
+HREF="#AEN31"
+>Configuring samba</A
></DT
><DT
>1.3. <A
HREF="#AEN64"
->The all important step</A
-></DT
-><DT
->1.4. <A
-HREF="#AEN68"
->Create the smb configuration file.</A
-></DT
-><DT
->1.5. <A
-HREF="#AEN82"
->Test your config file with
- <B
-CLASS="COMMAND"
->testparm</B
-></A
-></DT
-><DT
->1.6. <A
-HREF="#AEN90"
->Starting the smbd and nmbd</A
-></DT
-><DT
->1.7. <A
-HREF="#AEN145"
>Try listing the shares available on your
server</A
></DT
><DT
->1.8. <A
-HREF="#AEN154"
+>1.4. <A
+HREF="#AEN73"
>Try connecting with the unix client</A
></DT
><DT
->1.9. <A
-HREF="#AEN170"
+>1.5. <A
+HREF="#AEN89"
>Try connecting from a DOS, WfWg, Win9x, WinNT,
Win2k, OS/2, etc... client</A
></DT
><DT
->1.10. <A
-HREF="#AEN184"
+>1.6. <A
+HREF="#AEN103"
>What If Things Don't Work?</A
></DT
></DL
@@ -163,32 +139,32 @@ HREF="#BROWSING-QUICK"
><DL
><DT
>2.1. <A
-HREF="#AEN230"
+HREF="#AEN130"
>Discussion</A
></DT
><DT
>2.2. <A
-HREF="#AEN238"
+HREF="#AEN139"
>Use of the "Remote Announce" parameter</A
></DT
><DT
>2.3. <A
-HREF="#AEN252"
+HREF="#AEN153"
>Use of the "Remote Browse Sync" parameter</A
></DT
><DT
>2.4. <A
-HREF="#AEN257"
+HREF="#AEN158"
>Use of WINS</A
></DT
><DT
>2.5. <A
-HREF="#AEN268"
+HREF="#AEN169"
>Do NOT use more than one (1) protocol on MS Windows machines</A
></DT
><DT
>2.6. <A
-HREF="#AEN274"
+HREF="#AEN177"
>Name Resolution Order</A
></DT
></DL
@@ -202,42 +178,42 @@ HREF="#PASSDB"
><DL
><DT
>3.1. <A
-HREF="#AEN324"
+HREF="#AEN227"
>Introduction</A
></DT
><DT
>3.2. <A
-HREF="#AEN331"
+HREF="#AEN234"
>Important Notes About Security</A
></DT
><DT
>3.3. <A
-HREF="#AEN357"
+HREF="#AEN260"
>The smbpasswd Command</A
></DT
><DT
>3.4. <A
-HREF="#AEN388"
+HREF="#AEN291"
>Plain text</A
></DT
><DT
>3.5. <A
-HREF="#AEN393"
+HREF="#AEN296"
>TDB</A
></DT
><DT
>3.6. <A
-HREF="#AEN396"
+HREF="#AEN299"
>LDAP</A
></DT
><DT
>3.7. <A
-HREF="#AEN614"
+HREF="#AEN517"
>MySQL</A
></DT
><DT
>3.8. <A
-HREF="#AEN662"
+HREF="#AEN565"
>Passdb XML plugin</A
></DT
></DL
@@ -265,49 +241,49 @@ HREF="#SAMBA-PDC"
><DL
><DT
>5.1. <A
-HREF="#AEN722"
+HREF="#AEN625"
>Prerequisite Reading</A
></DT
><DT
>5.2. <A
-HREF="#AEN728"
+HREF="#AEN631"
>Background</A
></DT
><DT
>5.3. <A
-HREF="#AEN767"
+HREF="#AEN670"
>Configuring the Samba Domain Controller</A
></DT
><DT
>5.4. <A
-HREF="#AEN810"
+HREF="#AEN713"
>Creating Machine Trust Accounts and Joining Clients to the
Domain</A
></DT
><DT
>5.5. <A
-HREF="#AEN894"
+HREF="#AEN797"
>Common Problems and Errors</A
></DT
><DT
>5.6. <A
-HREF="#AEN942"
+HREF="#AEN845"
>System Policies and Profiles</A
></DT
><DT
>5.7. <A
-HREF="#AEN986"
+HREF="#AEN889"
>What other help can I get?</A
></DT
><DT
>5.8. <A
-HREF="#AEN1100"
+HREF="#AEN1003"
>Domain Control for Windows 9x/ME</A
></DT
><DT
>5.9. <A
-HREF="#AEN1238"
->DOMAIN_CONTROL.txt : Windows NT Domain Control &amp; Samba</A
+HREF="#AEN1141"
+>DOMAIN_CONTROL.txt : Windows NT Domain Control &#38; Samba</A
></DT
></DL
></DD
@@ -320,27 +296,27 @@ HREF="#SAMBA-BDC"
><DL
><DT
>6.1. <A
-HREF="#AEN1274"
+HREF="#AEN1177"
>Prerequisite Reading</A
></DT
><DT
>6.2. <A
-HREF="#AEN1278"
+HREF="#AEN1181"
>Background</A
></DT
><DT
>6.3. <A
-HREF="#AEN1286"
+HREF="#AEN1189"
>What qualifies a Domain Controller on the network?</A
></DT
><DT
>6.4. <A
-HREF="#AEN1295"
+HREF="#AEN1198"
>Can Samba be a Backup Domain Controller to an NT PDC?</A
></DT
><DT
>6.5. <A
-HREF="#AEN1300"
+HREF="#AEN1203"
>How do I set up a Samba BDC?</A
></DT
></DL
@@ -354,42 +330,42 @@ HREF="#ADS"
><DL
><DT
>7.1. <A
-HREF="#AEN1339"
+HREF="#AEN1242"
>Installing the required packages for Debian</A
></DT
><DT
>7.2. <A
-HREF="#AEN1346"
+HREF="#AEN1249"
>Installing the required packages for RedHat</A
></DT
><DT
>7.3. <A
-HREF="#AEN1356"
+HREF="#AEN1259"
>Compile Samba</A
></DT
><DT
>7.4. <A
-HREF="#AEN1371"
+HREF="#AEN1274"
>Setup your /etc/krb5.conf</A
></DT
><DT
>7.5. <A
-HREF="#AEN1381"
+HREF="#AEN1284"
>Create the computer account</A
></DT
><DT
>7.6. <A
-HREF="#AEN1393"
+HREF="#AEN1296"
>Test your server setup</A
></DT
><DT
>7.7. <A
-HREF="#AEN1398"
+HREF="#AEN1301"
>Testing with smbclient</A
></DT
><DT
>7.8. <A
-HREF="#AEN1401"
+HREF="#AEN1304"
>Notes</A
></DT
></DL
@@ -403,17 +379,17 @@ HREF="#DOMAIN-SECURITY"
><DL
><DT
>8.1. <A
-HREF="#AEN1423"
+HREF="#AEN1326"
>Joining an NT Domain with Samba 3.0</A
></DT
><DT
>8.2. <A
-HREF="#AEN1478"
+HREF="#AEN1381"
>Samba and Windows 2000 Domains</A
></DT
><DT
>8.3. <A
-HREF="#AEN1481"
+HREF="#AEN1384"
>Why is this better than security = server?</A
></DT
></DL
@@ -436,34 +412,34 @@ HREF="#INTEGRATE-MS-NETWORKS"
><DL
><DT
>9.1. <A
-HREF="#AEN1513"
+HREF="#AEN1416"
>Agenda</A
></DT
><DT
>9.2. <A
-HREF="#AEN1535"
+HREF="#AEN1438"
>Name Resolution in a pure Unix/Linux world</A
></DT
><DT
>9.3. <A
-HREF="#AEN1598"
+HREF="#AEN1501"
>Name resolution as used within MS Windows networking</A
></DT
><DT
>9.4. <A
-HREF="#AEN1643"
+HREF="#AEN1546"
>How browsing functions and how to deploy stable and
dependable browsing using Samba</A
></DT
><DT
>9.5. <A
-HREF="#AEN1653"
+HREF="#AEN1556"
>MS Windows security options and how to configure
Samba for seemless integration</A
></DT
><DT
>9.6. <A
-HREF="#AEN1723"
+HREF="#AEN1626"
>Conclusions</A
></DT
></DL
@@ -477,39 +453,39 @@ HREF="#UNIX-PERMISSIONS"
><DL
><DT
>10.1. <A
-HREF="#AEN1744"
+HREF="#AEN1647"
>Viewing and changing UNIX permissions using the NT
security dialogs</A
></DT
><DT
>10.2. <A
-HREF="#AEN1748"
+HREF="#AEN1651"
>How to view file security on a Samba share</A
></DT
><DT
>10.3. <A
-HREF="#AEN1759"
+HREF="#AEN1662"
>Viewing file ownership</A
></DT
><DT
>10.4. <A
-HREF="#AEN1779"
+HREF="#AEN1682"
>Viewing file or directory permissions</A
></DT
><DT
>10.5. <A
-HREF="#AEN1815"
+HREF="#AEN1718"
>Modifying file or directory permissions</A
></DT
><DT
>10.6. <A
-HREF="#AEN1837"
+HREF="#AEN1740"
>Interaction with the standard Samba create mask
parameters</A
></DT
><DT
>10.7. <A
-HREF="#AEN1901"
+HREF="#AEN1804"
>Interaction with the standard Samba file attribute
mapping</A
></DT
@@ -525,17 +501,17 @@ managed authentication</A
><DL
><DT
>11.1. <A
-HREF="#AEN1922"
+HREF="#AEN1825"
>Samba and PAM</A
></DT
><DT
>11.2. <A
-HREF="#AEN1966"
+HREF="#AEN1869"
>Distributed Authentication</A
></DT
><DT
>11.3. <A
-HREF="#AEN1973"
+HREF="#AEN1876"
>PAM Configuration in smb.conf</A
></DT
></DL
@@ -549,7 +525,7 @@ HREF="#MSDFS"
><DL
><DT
>12.1. <A
-HREF="#AEN1993"
+HREF="#AEN1896"
>Instructions</A
></DT
></DL
@@ -563,22 +539,22 @@ HREF="#PRINTING"
><DL
><DT
>13.1. <A
-HREF="#AEN2054"
+HREF="#AEN1957"
>Introduction</A
></DT
><DT
>13.2. <A
-HREF="#AEN2076"
+HREF="#AEN1979"
>Configuration</A
></DT
><DT
>13.3. <A
-HREF="#AEN2184"
+HREF="#AEN2087"
>The Imprints Toolset</A
></DT
><DT
>13.4. <A
-HREF="#AEN2227"
+HREF="#AEN2130"
>Diagnosis</A
></DT
></DL
@@ -592,37 +568,37 @@ HREF="#WINBIND"
><DL
><DT
>14.1. <A
-HREF="#AEN2360"
+HREF="#AEN2263"
>Abstract</A
></DT
><DT
>14.2. <A
-HREF="#AEN2364"
+HREF="#AEN2267"
>Introduction</A
></DT
><DT
>14.3. <A
-HREF="#AEN2377"
+HREF="#AEN2280"
>What Winbind Provides</A
></DT
><DT
>14.4. <A
-HREF="#AEN2388"
+HREF="#AEN2291"
>How Winbind Works</A
></DT
><DT
>14.5. <A
-HREF="#AEN2431"
+HREF="#AEN2334"
>Installation and Configuration</A
></DT
><DT
>14.6. <A
-HREF="#AEN2680"
+HREF="#AEN2583"
>Limitations</A
></DT
><DT
>14.7. <A
-HREF="#AEN2690"
+HREF="#AEN2593"
>Conclusion</A
></DT
></DL
@@ -636,57 +612,57 @@ HREF="#IMPROVED-BROWSING"
><DL
><DT
>15.1. <A
-HREF="#AEN2700"
+HREF="#AEN2603"
>Overview of browsing</A
></DT
><DT
>15.2. <A
-HREF="#AEN2704"
+HREF="#AEN2608"
>Browsing support in samba</A
></DT
><DT
>15.3. <A
-HREF="#AEN2713"
+HREF="#AEN2616"
>Problem resolution</A
></DT
><DT
>15.4. <A
-HREF="#AEN2720"
+HREF="#AEN2625"
>Browsing across subnets</A
></DT
><DT
>15.5. <A
-HREF="#AEN2760"
+HREF="#AEN2665"
>Setting up a WINS server</A
></DT
><DT
>15.6. <A
-HREF="#AEN2779"
+HREF="#AEN2684"
>Setting up Browsing in a WORKGROUP</A
></DT
><DT
>15.7. <A
-HREF="#AEN2797"
+HREF="#AEN2702"
>Setting up Browsing in a DOMAIN</A
></DT
><DT
>15.8. <A
-HREF="#AEN2807"
+HREF="#AEN2712"
>Forcing samba to be the master</A
></DT
><DT
>15.9. <A
-HREF="#AEN2816"
+HREF="#AEN2721"
>Making samba the domain master</A
></DT
><DT
>15.10. <A
-HREF="#AEN2834"
+HREF="#AEN2739"
>Note about broadcast addresses</A
></DT
><DT
>15.11. <A
-HREF="#AEN2837"
+HREF="#AEN2742"
>Multiple interfaces</A
></DT
></DL
@@ -700,128 +676,148 @@ HREF="#VFS"
><DL
><DT
>16.1. <A
-HREF="#AEN2855"
+HREF="#AEN2760"
>Introduction and configuration</A
></DT
><DT
>16.2. <A
-HREF="#AEN2864"
+HREF="#AEN2769"
>Included modules</A
></DT
><DT
>16.3. <A
-HREF="#AEN2918"
+HREF="#AEN2823"
>VFS modules available elsewhere</A
></DT
></DL
></DD
><DT
>17. <A
-HREF="#CVS-ACCESS"
->Access Samba source code via CVS</A
-></DT
-><DD
-><DL
-><DT
->17.1. <A
-HREF="#AEN2942"
->Introduction</A
-></DT
-><DT
->17.2. <A
-HREF="#AEN2947"
->CVS Access to samba.org</A
-></DT
-></DL
-></DD
-><DT
->18. <A
HREF="#GROUPMAPPING"
>Group mapping HOWTO</A
></DT
><DT
->19. <A
+>18. <A
HREF="#SPEED"
>Samba performance issues</A
></DT
><DD
><DL
><DT
->19.1. <A
-HREF="#AEN3033"
+>18.1. <A
+HREF="#AEN2890"
>Comparisons</A
></DT
><DT
->19.2. <A
-HREF="#AEN3039"
+>18.2. <A
+HREF="#AEN2896"
>Socket options</A
></DT
><DT
->19.3. <A
-HREF="#AEN3046"
+>18.3. <A
+HREF="#AEN2903"
>Read size</A
></DT
><DT
->19.4. <A
-HREF="#AEN3051"
+>18.4. <A
+HREF="#AEN2908"
>Max xmit</A
></DT
><DT
->19.5. <A
-HREF="#AEN3056"
+>18.5. <A
+HREF="#AEN2913"
>Log level</A
></DT
><DT
->19.6. <A
-HREF="#AEN3059"
+>18.6. <A
+HREF="#AEN2916"
>Read raw</A
></DT
><DT
->19.7. <A
-HREF="#AEN3064"
+>18.7. <A
+HREF="#AEN2921"
>Write raw</A
></DT
><DT
->19.8. <A
-HREF="#AEN3068"
+>18.8. <A
+HREF="#AEN2925"
>Slow Clients</A
></DT
><DT
->19.9. <A
-HREF="#AEN3072"
+>18.9. <A
+HREF="#AEN2929"
>Slow Logins</A
></DT
><DT
->19.10. <A
-HREF="#AEN3075"
+>18.10. <A
+HREF="#AEN2932"
>Client tuning</A
></DT
></DL
></DD
><DT
->20. <A
+>19. <A
HREF="#GROUPPROFILES"
->Creating Group Profiles</A
+>Creating Group Prolicy Files</A
></DT
><DD
><DL
><DT
->20.1. <A
-HREF="#AEN3123"
+>19.1. <A
+HREF="#AEN2980"
>Windows '9x</A
></DT
><DT
->20.2. <A
-HREF="#AEN3132"
+>19.2. <A
+HREF="#AEN2990"
>Windows NT 4</A
></DT
><DT
->20.3. <A
-HREF="#AEN3170"
+>19.3. <A
+HREF="#AEN3028"
>Windows 2000/XP</A
></DT
></DL
></DD
+><DT
+>20. <A
+HREF="#SECURING-SAMBA"
+>Securing Samba</A
+></DT
+><DD
+><DL
+><DT
+>20.1. <A
+HREF="#AEN3109"
+>Introduction</A
+></DT
+><DT
+>20.2. <A
+HREF="#AEN3112"
+>Using host based protection</A
+></DT
+><DT
+>20.3. <A
+HREF="#AEN3119"
+>Using interface protection</A
+></DT
+><DT
+>20.4. <A
+HREF="#AEN3128"
+>Using a firewall</A
+></DT
+><DT
+>20.5. <A
+HREF="#AEN3135"
+>Using a IPC$ share deny</A
+></DT
+><DT
+>20.6. <A
+HREF="#AEN3144"
+>Upgrading Samba</A
+></DT
+></DL
+></DD
></DL
></DD
><DT
@@ -840,24 +836,29 @@ HREF="#PORTABILITY"
><DL
><DT
>21.1. <A
-HREF="#AEN3251"
+HREF="#AEN3156"
>HPUX</A
></DT
><DT
>21.2. <A
-HREF="#AEN3257"
+HREF="#AEN3162"
>SCO Unix</A
></DT
><DT
>21.3. <A
-HREF="#AEN3261"
+HREF="#AEN3166"
>DNIX</A
></DT
><DT
>21.4. <A
-HREF="#AEN3290"
+HREF="#AEN3195"
>RedHat Linux Rembrandt-II</A
></DT
+><DT
+>21.5. <A
+HREF="#AEN3201"
+>AIX</A
+></DT
></DL
></DD
><DT
@@ -869,95 +870,124 @@ HREF="#OTHER-CLIENTS"
><DL
><DT
>22.1. <A
-HREF="#AEN3311"
+HREF="#AEN3221"
>Macintosh clients?</A
></DT
><DT
>22.2. <A
-HREF="#AEN3320"
+HREF="#AEN3230"
>OS2 Client</A
></DT
><DT
>22.3. <A
-HREF="#AEN3360"
+HREF="#AEN3270"
>Windows for Workgroups</A
></DT
><DT
>22.4. <A
-HREF="#AEN3381"
+HREF="#AEN3294"
>Windows '95/'98</A
></DT
><DT
>22.5. <A
-HREF="#AEN3397"
+HREF="#AEN3310"
>Windows 2000 Service Pack 2</A
></DT
></DL
></DD
><DT
>23. <A
+HREF="#COMPILING"
+>How to compile SAMBA</A
+></DT
+><DD
+><DL
+><DT
+>23.1. <A
+HREF="#AEN3337"
+>Access Samba source code via CVS</A
+></DT
+><DT
+>23.2. <A
+HREF="#AEN3380"
+>Accessing the samba sources via rsync and ftp</A
+></DT
+><DT
+>23.3. <A
+HREF="#AEN3386"
+>Building the Binaries</A
+></DT
+><DT
+>23.4. <A
+HREF="#AEN3414"
+>Starting the smbd and nmbd</A
+></DT
+></DL
+></DD
+><DT
+>24. <A
HREF="#BUGREPORT"
>Reporting Bugs</A
></DT
><DD
><DL
><DT
->23.1. <A
-HREF="#AEN3421"
+>24.1. <A
+HREF="#AEN3476"
>Introduction</A
></DT
><DT
->23.2. <A
-HREF="#AEN3431"
+>24.2. <A
+HREF="#AEN3486"
>General info</A
></DT
><DT
->23.3. <A
-HREF="#AEN3437"
+>24.3. <A
+HREF="#AEN3492"
>Debug levels</A
></DT
><DT
->23.4. <A
-HREF="#AEN3454"
+>24.4. <A
+HREF="#AEN3509"
>Internal errors</A
></DT
><DT
->23.5. <A
-HREF="#AEN3464"
+>24.5. <A
+HREF="#AEN3519"
>Attaching to a running process</A
></DT
><DT
->23.6. <A
-HREF="#AEN3467"
+>24.6. <A
+HREF="#AEN3522"
>Patches</A
></DT
></DL
></DD
><DT
->24. <A
+>25. <A
HREF="#DIAGNOSIS"
->Diagnosing your samba server</A
+>The samba checklist</A
></DT
><DD
><DL
><DT
->24.1. <A
-HREF="#AEN3490"
+>25.1. <A
+HREF="#AEN3545"
>Introduction</A
></DT
><DT
->24.2. <A
-HREF="#AEN3495"
+>25.2. <A
+HREF="#AEN3550"
>Assumptions</A
></DT
><DT
->24.3. <A
-HREF="#AEN3505"
+>25.3. <A
+HREF="#AEN3560"
>Tests</A
></DT
><DT
->24.4. <A
-HREF="#AEN3615"
+>25.4. <A
+HREF="#AEN3670"
>Still having troubles?</A
></DT
></DL
@@ -1005,105 +1035,61 @@ HREF="#INSTALL"
><DT
>1.1. <A
HREF="#AEN26"
->Read the man pages</A
+>Obtaining and installing samba</A
></DT
><DT
>1.2. <A
-HREF="#AEN36"
->Building the Binaries</A
-></DT
-><DT
->1.3. <A
-HREF="#AEN64"
->The all important step</A
-></DT
-><DT
->1.4. <A
-HREF="#AEN68"
->Create the smb configuration file.</A
-></DT
-><DT
->1.5. <A
-HREF="#AEN82"
->Test your config file with
- <B
-CLASS="COMMAND"
->testparm</B
-></A
-></DT
-><DT
->1.6. <A
-HREF="#AEN90"
->Starting the smbd and nmbd</A
+HREF="#AEN31"
+>Configuring samba</A
></DT
><DD
><DL
><DT
->1.6.1. <A
-HREF="#AEN100"
->Starting from inetd.conf</A
+>1.2.1. <A
+HREF="#AEN36"
+>Editing the smb.conf file</A
></DT
><DT
->1.6.2. <A
-HREF="#AEN129"
->Alternative: starting it as a daemon</A
+>1.2.2. <A
+HREF="#AEN58"
+>SWAT</A
></DT
></DL
></DD
><DT
->1.7. <A
-HREF="#AEN145"
+>1.3. <A
+HREF="#AEN64"
>Try listing the shares available on your
server</A
></DT
><DT
->1.8. <A
-HREF="#AEN154"
+>1.4. <A
+HREF="#AEN73"
>Try connecting with the unix client</A
></DT
><DT
->1.9. <A
-HREF="#AEN170"
+>1.5. <A
+HREF="#AEN89"
>Try connecting from a DOS, WfWg, Win9x, WinNT,
Win2k, OS/2, etc... client</A
></DT
><DT
->1.10. <A
-HREF="#AEN184"
+>1.6. <A
+HREF="#AEN103"
>What If Things Don't Work?</A
></DT
><DD
><DL
><DT
->1.10.1. <A
-HREF="#AEN189"
->Diagnosing Problems</A
-></DT
-><DT
->1.10.2. <A
-HREF="#AEN193"
+>1.6.1. <A
+HREF="#AEN108"
>Scope IDs</A
></DT
><DT
->1.10.3. <A
-HREF="#AEN196"
->Choosing the Protocol Level</A
-></DT
-><DT
->1.10.4. <A
-HREF="#AEN205"
->Printing from UNIX to a Client PC</A
-></DT
-><DT
->1.10.5. <A
-HREF="#AEN210"
+>1.6.2. <A
+HREF="#AEN111"
>Locking</A
></DT
-><DT
->1.10.6. <A
-HREF="#AEN219"
->Mapping Usernames</A
-></DT
></DL
></DD
></DL
@@ -1117,32 +1103,32 @@ HREF="#BROWSING-QUICK"
><DL
><DT
>2.1. <A
-HREF="#AEN230"
+HREF="#AEN130"
>Discussion</A
></DT
><DT
>2.2. <A
-HREF="#AEN238"
+HREF="#AEN139"
>Use of the "Remote Announce" parameter</A
></DT
><DT
>2.3. <A
-HREF="#AEN252"
+HREF="#AEN153"
>Use of the "Remote Browse Sync" parameter</A
></DT
><DT
>2.4. <A
-HREF="#AEN257"
+HREF="#AEN158"
>Use of WINS</A
></DT
><DT
>2.5. <A
-HREF="#AEN268"
+HREF="#AEN169"
>Do NOT use more than one (1) protocol on MS Windows machines</A
></DT
><DT
>2.6. <A
-HREF="#AEN274"
+HREF="#AEN177"
>Name Resolution Order</A
></DT
></DL
@@ -1156,146 +1142,146 @@ HREF="#PASSDB"
><DL
><DT
>3.1. <A
-HREF="#AEN324"
+HREF="#AEN227"
>Introduction</A
></DT
><DT
>3.2. <A
-HREF="#AEN331"
+HREF="#AEN234"
>Important Notes About Security</A
></DT
><DD
><DL
><DT
>3.2.1. <A
-HREF="#AEN346"
+HREF="#AEN249"
>Advantages of SMB Encryption</A
></DT
><DT
>3.2.2. <A
-HREF="#AEN351"
+HREF="#AEN254"
>Advantages of non-encrypted passwords</A
></DT
></DL
></DD
><DT
>3.3. <A
-HREF="#AEN357"
+HREF="#AEN260"
>The smbpasswd Command</A
></DT
><DT
>3.4. <A
-HREF="#AEN388"
+HREF="#AEN291"
>Plain text</A
></DT
><DT
>3.5. <A
-HREF="#AEN393"
+HREF="#AEN296"
>TDB</A
></DT
><DT
>3.6. <A
-HREF="#AEN396"
+HREF="#AEN299"
>LDAP</A
></DT
><DD
><DL
><DT
>3.6.1. <A
-HREF="#AEN398"
+HREF="#AEN301"
>Introduction</A
></DT
><DT
>3.6.2. <A
-HREF="#AEN418"
+HREF="#AEN321"
>Introduction</A
></DT
><DT
>3.6.3. <A
-HREF="#AEN447"
+HREF="#AEN350"
>Supported LDAP Servers</A
></DT
><DT
>3.6.4. <A
-HREF="#AEN452"
+HREF="#AEN355"
>Schema and Relationship to the RFC 2307 posixAccount</A
></DT
><DT
>3.6.5. <A
-HREF="#AEN464"
+HREF="#AEN367"
>Configuring Samba with LDAP</A
></DT
><DT
>3.6.6. <A
-HREF="#AEN511"
+HREF="#AEN414"
>Accounts and Groups management</A
></DT
><DT
>3.6.7. <A
-HREF="#AEN516"
+HREF="#AEN419"
>Security and sambaAccount</A
></DT
><DT
>3.6.8. <A
-HREF="#AEN536"
+HREF="#AEN439"
>LDAP specials attributes for sambaAccounts</A
></DT
><DT
>3.6.9. <A
-HREF="#AEN606"
+HREF="#AEN509"
>Example LDIF Entries for a sambaAccount</A
></DT
></DL
></DD
><DT
>3.7. <A
-HREF="#AEN614"
+HREF="#AEN517"
>MySQL</A
></DT
><DD
><DL
><DT
>3.7.1. <A
-HREF="#AEN616"
+HREF="#AEN519"
>Building</A
></DT
><DT
>3.7.2. <A
-HREF="#AEN622"
+HREF="#AEN525"
>Creating the database</A
></DT
><DT
>3.7.3. <A
-HREF="#AEN632"
+HREF="#AEN535"
>Configuring</A
></DT
><DT
>3.7.4. <A
-HREF="#AEN649"
+HREF="#AEN552"
>Using plaintext passwords or encrypted password</A
></DT
><DT
>3.7.5. <A
-HREF="#AEN654"
+HREF="#AEN557"
>Getting non-column data from the table</A
></DT
></DL
></DD
><DT
>3.8. <A
-HREF="#AEN662"
+HREF="#AEN565"
>Passdb XML plugin</A
></DT
><DD
><DL
><DT
>3.8.1. <A
-HREF="#AEN664"
+HREF="#AEN567"
>Building</A
></DT
><DT
>3.8.2. <A
-HREF="#AEN670"
+HREF="#AEN573"
>Usage</A
></DT
></DL
@@ -1318,166 +1304,50 @@ CLASS="SECT1"
CLASS="SECT1"
><A
NAME="AEN26"
-></A
->1.1. Read the man pages</H2
-><P
->The man pages distributed with SAMBA contain
- lots of useful info that will help to get you started.
- If you don't know how to read man pages then try
- something like:</P
-><P
-><TT
-CLASS="PROMPT"
->$ </TT
-><TT
-CLASS="USERINPUT"
-><B
->man smbd.8</B
-></TT
->
- or
- <TT
-CLASS="PROMPT"
->$ </TT
-><TT
-CLASS="USERINPUT"
-><B
->nroff -man smbd.8 | more
- </B
-></TT
-> on older unixes.</P
+>1.1. Obtaining and installing samba</A
+></H2
><P
->Other sources of information are pointed to
- by the Samba web site,<A
-HREF="http://www.samba.org/"
+>Binary packages of samba are included in almost any Linux or
+ Unix distribution. There are also some packages available at
+ <A
+HREF="http://samba.org/"
TARGET="_top"
-> http://www.samba.org</A
-></P
-></DIV
-><DIV
-CLASS="SECT1"
-><HR><H2
-CLASS="SECT1"
-><A
-NAME="AEN36"
-></A
->1.2. Building the Binaries</H2
-><P
->To do this, first run the program <B
-CLASS="COMMAND"
->./configure
- </B
-> in the source directory. This should automatically
- configure Samba for your operating system. If you have unusual
- needs then you may wish to run</P
-><P
-><TT
-CLASS="PROMPT"
->root# </TT
-><TT
-CLASS="USERINPUT"
-><B
->./configure --help
- </B
-></TT
-></P
-><P
->first to see what special options you can enable.
- Then executing</P
-><P
-><TT
-CLASS="PROMPT"
->root# </TT
-><TT
-CLASS="USERINPUT"
-><B
->make</B
-></TT
-></P
-><P
->will create the binaries. Once it's successfully
- compiled you can use </P
-><P
-><TT
-CLASS="PROMPT"
->root# </TT
-><TT
-CLASS="USERINPUT"
-><B
->make install</B
-></TT
-></P
-><P
->to install the binaries and manual pages. You can
- separately install the binaries and/or man pages using</P
-><P
-><TT
-CLASS="PROMPT"
->root# </TT
-><TT
-CLASS="USERINPUT"
-><B
->make installbin
- </B
-></TT
-></P
-><P
->and</P
-><P
-><TT
-CLASS="PROMPT"
->root# </TT
-><TT
-CLASS="USERINPUT"
-><B
->make installman
- </B
-></TT
-></P
-><P
->Note that if you are upgrading for a previous version
- of Samba you might like to know that the old versions of
- the binaries will be renamed with a ".old" extension. You
- can go back to the previous version with</P
-><P
-><TT
-CLASS="PROMPT"
->root# </TT
-><TT
-CLASS="USERINPUT"
-><B
->make revert
- </B
-></TT
-></P
+>the samba homepage</A
+>
+ </P
><P
->if you find this version a disaster!</P
+>If you need to compile samba from source, check the
+ appropriate appendix chapter.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN64"
-></A
->1.3. The all important step</H2
-><P
->At this stage you must fetch yourself a
- coffee or other drink you find stimulating. Getting the rest
- of the install right can sometimes be tricky, so you will
- probably need it.</P
+NAME="AEN31"
+>1.2. Configuring samba</A
+></H2
><P
->If you have installed samba before then you can skip
- this step.</P
-></DIV
+>Samba's configuration is stored in the smb.conf file,
+ that usually resides in <TT
+CLASS="FILENAME"
+>/etc/samba/smb.conf</TT
+>
+ or <TT
+CLASS="FILENAME"
+>/usr/local/samba/lib/smb.conf</TT
+>. You can either
+ edit this file yourself or do it using one of the many graphical
+ tools that are available, such as the web-based interface swat, that
+ is included with samba.</P
><DIV
-CLASS="SECT1"
-><HR><H2
-CLASS="SECT1"
+CLASS="SECT2"
+><HR><H3
+CLASS="SECT2"
><A
-NAME="AEN68"
-></A
->1.4. Create the smb configuration file.</H2
+NAME="AEN36"
+>1.2.1. Editing the smb.conf file</A
+></H3
><P
>There are sample configuration files in the examples
subdirectory in the distribution. I suggest you read them
@@ -1525,19 +1395,18 @@ CLASS="FILENAME"
><P
>For more information about security settings for the
[homes] share please refer to the document UNIX_SECURITY.txt.</P
-></DIV
><DIV
-CLASS="SECT1"
-><HR><H2
-CLASS="SECT1"
+CLASS="SECT3"
+><HR><H4
+CLASS="SECT3"
><A
-NAME="AEN82"
-></A
->1.5. Test your config file with
+NAME="AEN50"
+>1.2.1.1. Test your config file with
<B
CLASS="COMMAND"
>testparm</B
-></H2
+></A
+></H4
><P
>It's important that you test the validity of your
<TT
@@ -1556,205 +1425,33 @@ CLASS="FILENAME"
>smb.conf</TT
>!</P
></DIV
-><DIV
-CLASS="SECT1"
-><HR><H2
-CLASS="SECT1"
-><A
-NAME="AEN90"
-></A
->1.6. Starting the smbd and nmbd</H2
-><P
->You must choose to start smbd and nmbd either
- as daemons or from <B
-CLASS="COMMAND"
->inetd</B
->. Don't try
- to do both! Either you can put them in <TT
-CLASS="FILENAME"
-> inetd.conf</TT
-> and have them started on demand
- by <B
-CLASS="COMMAND"
->inetd</B
->, or you can start them as
- daemons either from the command line or in <TT
-CLASS="FILENAME"
-> /etc/rc.local</TT
->. See the man pages for details
- on the command line options. Take particular care to read
- the bit about what user you need to be in order to start
- Samba. In many cases you must be root.</P
-><P
->The main advantage of starting <B
-CLASS="COMMAND"
->smbd</B
->
- and <B
-CLASS="COMMAND"
->nmbd</B
-> using the recommended daemon method
- is that they will respond slightly more quickly to an initial connection
- request.</P
-><DIV
-CLASS="SECT2"
-><HR><H3
-CLASS="SECT2"
-><A
-NAME="AEN100"
-></A
->1.6.1. Starting from inetd.conf</H3
-><P
->NOTE; The following will be different if
- you use NIS or NIS+ to distributed services maps.</P
-><P
->Look at your <TT
-CLASS="FILENAME"
->/etc/services</TT
->.
- What is defined at port 139/tcp. If nothing is defined
- then add a line like this:</P
-><P
-><TT
-CLASS="USERINPUT"
-><B
->netbios-ssn 139/tcp</B
-></TT
-></P
-><P
->similarly for 137/udp you should have an entry like:</P
-><P
-><TT
-CLASS="USERINPUT"
-><B
->netbios-ns 137/udp</B
-></TT
-></P
-><P
->Next edit your <TT
-CLASS="FILENAME"
->/etc/inetd.conf</TT
->
- and add two lines something like this:</P
-><P
-><PRE
-CLASS="PROGRAMLISTING"
-> netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd
- netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd
- </PRE
-></P
-><P
->The exact syntax of <TT
-CLASS="FILENAME"
->/etc/inetd.conf</TT
->
- varies between unixes. Look at the other entries in inetd.conf
- for a guide.</P
-><P
->NOTE: Some unixes already have entries like netbios_ns
- (note the underscore) in <TT
-CLASS="FILENAME"
->/etc/services</TT
->.
- You must either edit <TT
-CLASS="FILENAME"
->/etc/services</TT
-> or
- <TT
-CLASS="FILENAME"
->/etc/inetd.conf</TT
-> to make them consistent.</P
-><P
->NOTE: On many systems you may need to use the
- "interfaces" option in smb.conf to specify the IP address
- and netmask of your interfaces. Run <B
-CLASS="COMMAND"
->ifconfig</B
->
- as root if you don't know what the broadcast is for your
- net. <B
-CLASS="COMMAND"
->nmbd</B
-> tries to determine it at run
- time, but fails on some unixes. See the section on "testing nmbd"
- for a method of finding if you need to do this.</P
-><P
->!!!WARNING!!! Many unixes only accept around 5
- parameters on the command line in <TT
-CLASS="FILENAME"
->inetd.conf</TT
->.
- This means you shouldn't use spaces between the options and
- arguments, or you should use a script, and start the script
- from <B
-CLASS="COMMAND"
->inetd</B
->.</P
-><P
->Restart <B
-CLASS="COMMAND"
->inetd</B
->, perhaps just send
- it a HUP. If you have installed an earlier version of <B
-CLASS="COMMAND"
-> nmbd</B
-> then you may need to kill nmbd as well.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN129"
-></A
->1.6.2. Alternative: starting it as a daemon</H3
-><P
->To start the server as a daemon you should create
- a script something like this one, perhaps calling
- it <TT
-CLASS="FILENAME"
->startsmb</TT
->.</P
-><P
-><PRE
-CLASS="PROGRAMLISTING"
-> #!/bin/sh
- /usr/local/samba/bin/smbd -D
- /usr/local/samba/bin/nmbd -D
- </PRE
-></P
-><P
->then make it executable with <B
-CLASS="COMMAND"
->chmod
- +x startsmb</B
-></P
+NAME="AEN58"
+>1.2.2. SWAT</A
+></H3
><P
->You can then run <B
-CLASS="COMMAND"
->startsmb</B
-> by
- hand or execute it from <TT
-CLASS="FILENAME"
->/etc/rc.local</TT
->
- </P
+> SWAT is a web-based interface that helps you configure samba.
+ SWAT might not be available in the samba package on your platform,
+ but in a seperate package. Please read the swat manpage
+ on compiling, installing and configuring swat from source.
+ </P
><P
->To kill it send a kill signal to the processes
- <B
-CLASS="COMMAND"
->nmbd</B
-> and <B
-CLASS="COMMAND"
->smbd</B
->.</P
+>To launch SWAT just run your favorite web browser and
+ point it at "http://localhost:901/". Replace <VAR
+CLASS="REPLACEABLE"
+>localhost</VAR
+> with the name of the computer you are running samba on if you
+ are running samba on a different computer then your browser.</P
><P
->NOTE: If you use the SVR4 style init system then
- you may like to look at the <TT
-CLASS="FILENAME"
->examples/svr4-startup</TT
->
- script to make Samba fit into that system.</P
+>Note that you can attach to SWAT from any IP connected
+ machine but connecting from a remote machine leaves your
+ connection open to password sniffing as passwords will be sent
+ in the clear over the wire. </P
></DIV
></DIV
><DIV
@@ -1762,25 +1459,21 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN145"
-></A
->1.7. Try listing the shares available on your
- server</H2
+NAME="AEN64"
+>1.3. Try listing the shares available on your
+ server</A
+></H2
><P
-><TT
+><SAMP
CLASS="PROMPT"
->$ </TT
-><TT
+>$ </SAMP
+><KBD
CLASS="USERINPUT"
-><B
>smbclient -L
- <TT
+ <VAR
CLASS="REPLACEABLE"
-><I
->yourhostname</I
-></TT
-></B
-></TT
+>yourhostname</VAR
+></KBD
></P
><P
>You should get back a list of shares available on
@@ -1803,39 +1496,31 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN154"
-></A
->1.8. Try connecting with the unix client</H2
+NAME="AEN73"
+>1.4. Try connecting with the unix client</A
+></H2
><P
-><TT
+><SAMP
CLASS="PROMPT"
->$ </TT
-><TT
+>$ </SAMP
+><KBD
CLASS="USERINPUT"
-><B
->smbclient <TT
+>smbclient <VAR
CLASS="REPLACEABLE"
-><I
-> //yourhostname/aservice</I
-></TT
-></B
-></TT
+> //yourhostname/aservice</VAR
+></KBD
></P
><P
->Typically the <TT
+>Typically the <VAR
CLASS="REPLACEABLE"
-><I
->yourhostname</I
-></TT
+>yourhostname</VAR
>
would be the name of the host where you installed <B
CLASS="COMMAND"
> smbd</B
->. The <TT
+>. The <VAR
CLASS="REPLACEABLE"
-><I
->aservice</I
-></TT
+>aservice</VAR
> is
any service you have defined in the <TT
CLASS="FILENAME"
@@ -1850,15 +1535,13 @@ CLASS="FILENAME"
>For example if your unix host is bambi and your login
name is fred you would type:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->$ </TT
-><TT
+>$ </SAMP
+><KBD
CLASS="USERINPUT"
-><B
>smbclient //bambi/fred
- </B
-></TT
+ </KBD
></P
></DIV
><DIV
@@ -1866,46 +1549,40 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN170"
-></A
->1.9. Try connecting from a DOS, WfWg, Win9x, WinNT,
- Win2k, OS/2, etc... client</H2
+NAME="AEN89"
+>1.5. Try connecting from a DOS, WfWg, Win9x, WinNT,
+ Win2k, OS/2, etc... client</A
+></H2
><P
>Try mounting disks. eg:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->C:\WINDOWS\&#62; </TT
-><TT
+>C:\WINDOWS\&#62; </SAMP
+><KBD
CLASS="USERINPUT"
-><B
>net use d: \\servername\service
- </B
-></TT
+ </KBD
></P
><P
>Try printing. eg:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->C:\WINDOWS\&#62; </TT
-><TT
+>C:\WINDOWS\&#62; </SAMP
+><KBD
CLASS="USERINPUT"
-><B
>net use lpt1:
- \\servername\spoolservice</B
-></TT
+ \\servername\spoolservice</KBD
></P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->C:\WINDOWS\&#62; </TT
-><TT
+>C:\WINDOWS\&#62; </SAMP
+><KBD
CLASS="USERINPUT"
-><B
>print filename
- </B
-></TT
+ </KBD
></P
><P
>Celebrate, or send me a bug report!</P
@@ -1915,55 +1592,41 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN184"
-></A
->1.10. What If Things Don't Work?</H2
-><P
->If nothing works and you start to think "who wrote
- this pile of trash" then I suggest you do step 2 again (and
- again) till you calm down.</P
+NAME="AEN103"
+>1.6. What If Things Don't Work?</A
+></H2
><P
->Then you might read the file DIAGNOSIS.txt and the
+>Then you might read the file HOWTO chapter Diagnosis and the
FAQ. If you are still stuck then try the mailing list or
newsgroup (look in the README for details). Samba has been
successfully installed at thousands of sites worldwide, so maybe
someone else has hit your problem and has overcome it. You could
also use the WWW site to scan back issues of the samba-digest.</P
><P
->When you fix the problem PLEASE send me some updates to the
- documentation (or source code) so that the next person will find it
- easier. </P
-><DIV
-CLASS="SECT2"
-><HR><H3
-CLASS="SECT2"
-><A
-NAME="AEN189"
-></A
->1.10.1. Diagnosing Problems</H3
-><P
->If you have installation problems then go to the
- <A
-HREF="Diagnosis.html"
-TARGET="_top"
->Diagnosis</A
-> chapter to try to find the
- problem.</P
-></DIV
+>When you fix the problem <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>please</I
+></SPAN
+> send some
+ updates of the documentation (or source code) to one of
+ the documentation maintainers or the list.
+ </P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN193"
-></A
->1.10.2. Scope IDs</H3
+NAME="AEN108"
+>1.6.1. Scope IDs</A
+></H3
><P
>By default Samba uses a blank scope ID. This means
all your windows boxes must also have a blank scope ID.
If you really want to use a non-blank scope ID then you will
need to use the 'netbios scope' smb.conf option.
- All your PCs will need to have the same setting for
+ All your PCs will need to have the same setting for
this to work. I do not recommend scope IDs.</P
></DIV
><DIV
@@ -1971,71 +1634,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN196"
-></A
->1.10.3. Choosing the Protocol Level</H3
-><P
->The SMB protocol has many dialects. Currently
- Samba supports 5, called CORE, COREPLUS, LANMAN1,
- LANMAN2 and NT1.</P
-><P
->You can choose what maximum protocol to support
- in the <TT
-CLASS="FILENAME"
->smb.conf</TT
-> file. The default is
- NT1 and that is the best for the vast majority of sites.</P
-><P
->In older versions of Samba you may have found it
- necessary to use COREPLUS. The limitations that led to
- this have mostly been fixed. It is now less likely that you
- will want to use less than LANMAN1. The only remaining advantage
- of COREPLUS is that for some obscure reason WfWg preserves
- the case of passwords in this protocol, whereas under LANMAN1,
- LANMAN2 or NT1 it uppercases all passwords before sending them,
- forcing you to use the "password level=" option in some cases.</P
-><P
->The main advantage of LANMAN2 and NT1 is support for
- long filenames with some clients (eg: smbclient, Windows NT
- or Win95). </P
-><P
->See the smb.conf(5) manual page for more details.</P
-><P
->Note: To support print queue reporting you may find
- that you have to use TCP/IP as the default protocol under
- WfWg. For some reason if you leave Netbeui as the default
- it may break the print queue reporting on some systems.
- It is presumably a WfWg bug.</P
-></DIV
-><DIV
-CLASS="SECT2"
-><HR><H3
-CLASS="SECT2"
-><A
-NAME="AEN205"
-></A
->1.10.4. Printing from UNIX to a Client PC</H3
-><P
->To use a printer that is available via a smb-based
- server from a unix host with LPR you will need to compile the
- smbclient program. You then need to install the script
- "smbprint". Read the instruction in smbprint for more details.
- </P
-><P
->There is also a SYSV style script that does much
- the same thing called smbprint.sysv. It contains instructions.</P
-><P
->See the CUPS manual for information about setting up
- printing from a unix host with CUPS to a smb-based server. </P
-></DIV
-><DIV
-CLASS="SECT2"
-><HR><H3
-CLASS="SECT2"
-><A
-NAME="AEN210"
-></A
->1.10.5. Locking</H3
+NAME="AEN111"
+>1.6.2. Locking</A
+></H3
><P
>One area which sometimes causes trouble is locking.</P
><P
@@ -2088,19 +1689,6 @@ NAME="AEN210"
or DENY_ALL. There are also special compatibility modes called
DENY_FCB and DENY_DOS.</P
></DIV
-><DIV
-CLASS="SECT2"
-><HR><H3
-CLASS="SECT2"
-><A
-NAME="AEN219"
-></A
->1.10.6. Mapping Usernames</H3
-><P
->If you have different usernames on the PCs and
- the unix server then take a look at the "username map" option.
- See the smb.conf man page for details.</P
-></DIV
></DIV
></DIV
><DIV
@@ -2116,21 +1704,24 @@ be taken as the fast track guide to implementing browsing across subnets
and / or across workgroups (or domains). WINS is the best tool for resolution
of NetBIOS names to IP addesses. WINS is NOT involved in browse list handling
except by way of name to address mapping.</P
+><P
+>Note: MS Windows 2000 and later can be configured to operate with NO NetBIOS
+over TCP/IP. Samba-3 and later also supports this mode of operation.</P
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN230"
-></A
->2.1. Discussion</H2
+NAME="AEN130"
+>2.1. Discussion</A
+></H2
><P
>Firstly, all MS Windows networking is based on SMB (Server Message
-Block) based messaging. SMB messaging is implemented using NetBIOS. Samba
-implements NetBIOS by encapsulating it over TCP/IP. MS Windows products can
-do likewise. NetBIOS based networking uses broadcast messaging to affect
-browse list management. When running NetBIOS over TCP/IP this uses UDP
-based messaging. UDP messages can be broadcast or unicast.</P
+Block) based messaging. SMB messaging may be implemented using NetBIOS or
+without NetBIOS. Samba implements NetBIOS by encapsulating it over TCP/IP.
+MS Windows products can do likewise. NetBIOS based networking uses broadcast
+messaging to affect browse list management. When running NetBIOS over
+TCP/IP this uses UDP based messaging. UDP messages can be broadcast or unicast.</P
><P
>Normally, only unicast UDP messaging can be forwarded by routers. The
"remote announce" parameter to smb.conf helps to project browse announcements
@@ -2144,18 +1735,23 @@ segment is configured with it's own Samba WINS server, then the only way to
get cross segment browsing to work is by using the "remote announce" and
the "remote browse sync" parameters to your smb.conf file.</P
><P
->If only one WINS server is used then the use of the "remote announce" and the
-"remote browse sync" parameters should NOT be necessary.</P
+>If only one WINS server is used for an entire multi-segment network then
+the use of the "remote announce" and the "remote browse sync" parameters
+should NOT be necessary.</P
><P
->Samba WINS does not support MS-WINS replication. This means that when setting up
-Samba as a WINS server there must only be one nmbd configured as a WINS server
-on the network. Some sites have used multiple Samba WINS servers for redundancy
-(one server per subnet) and then used "remote browse sync" and "remote announce"
-to affect browse list collation across all segments. Note that this means
-clients will only resolve local names, and must be configured to use DNS to
-resolve names on other subnets in order to resolve the IP addresses of the
-servers they can see on other subnets. This setup is not recommended, but is
-mentioned as a practical consideration (ie: an 'if all else fails' scenario).</P
+>As of Samba-3 WINS replication is being worked on. The bulk of the code has
+been committed, but it still needs maturation.</P
+><P
+>Right now samba WINS does not support MS-WINS replication. This means that
+when setting up Samba as a WINS server there must only be one nmbd configured
+as a WINS server on the network. Some sites have used multiple Samba WINS
+servers for redundancy (one server per subnet) and then used "remote browse
+sync" and "remote announce" to affect browse list collation across all
+segments. Note that this means clients will only resolve local names,
+and must be configured to use DNS to resolve names on other subnets in
+order to resolve the IP addresses of the servers they can see on other
+subnets. This setup is not recommended, but is mentioned as a practical
+consideration (ie: an 'if all else fails' scenario).</P
><P
>Lastly, take note that browse lists are a collection of unreliable broadcast
messages that are repeated at intervals of not more than 15 minutes. This means
@@ -2167,9 +1763,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN238"
-></A
->2.2. Use of the "Remote Announce" parameter</H2
+NAME="AEN139"
+>2.2. Use of the "Remote Announce" parameter</A
+></H2
><P
>The "remote announce" parameter of smb.conf can be used to forcibly ensure
that all the NetBIOS names on a network get announced to a remote network.
@@ -2225,9 +1821,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN252"
-></A
->2.3. Use of the "Remote Browse Sync" parameter</H2
+NAME="AEN153"
+>2.3. Use of the "Remote Browse Sync" parameter</A
+></H2
><P
>The "remote browse sync" parameter of smb.conf is used to announce to
another LMB that it must synchronise it's NetBIOS name list with our
@@ -2248,9 +1844,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN257"
-></A
->2.4. Use of WINS</H2
+NAME="AEN158"
+>2.4. Use of WINS</A
+></H2
><P
>Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly
recommended. Every NetBIOS machine registers it's name together with a
@@ -2302,22 +1898,23 @@ CLASS="emphasis"
CLASS="EMPHASIS"
>DO NOT EVER</I
></SPAN
-> use both "wins support = yes" together with "wins server = a.b.c.d"
-particularly not using it's own IP address.</P
+> use both "wins support = yes" together
+with "wins server = a.b.c.d" particularly not using it's own IP address.
+Specifying both will cause nmbd to refuse to start!</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN268"
-></A
->2.5. Do NOT use more than one (1) protocol on MS Windows machines</H2
+NAME="AEN169"
+>2.5. Do NOT use more than one (1) protocol on MS Windows machines</A
+></H2
><P
>A very common cause of browsing problems results from installing more than
one protocol on an MS Windows machine.</P
><P
->Every NetBIOS machine take part in a process of electing the LMB (and DMB)
+>Every NetBIOS machine takes part in a process of electing the LMB (and DMB)
every 15 minutes. A set of election criteria is used to determine the order
of precidence for winning this election process. A machine running Samba or
Windows NT will be biased so that the most suitable machine will predictably
@@ -2333,6 +1930,19 @@ interface over the IPX protocol. Samba will then lose the LMB role as Windows
as an LMB and thus browse list operation on all TCP/IP only machines will
fail.</P
><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Windows 95, 98, 98se, Me are referred to generically as Windows 9x.
+The Windows NT4, 2000, XP and 2003 use common protocols. These are roughly
+referred to as the WinNT family, but it should be recognised that 2000 and
+XP/2003 introduce new protocol extensions that cause them to behave
+differently from MS Windows NT4. Generally, where a server does NOT support
+the newer or extended protocol, these will fall back to the NT4 protocols.</I
+></SPAN
+></P
+><P
>The safest rule of all to follow it this - USE ONLY ONE PROTOCOL!</P
></DIV
><DIV
@@ -2340,9 +1950,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN274"
-></A
->2.6. Name Resolution Order</H2
+NAME="AEN177"
+>2.6. Name Resolution Order</A
+></H2
><P
>Resolution of NetBIOS names to IP addresses can take place using a number
of methods. The only ones that can provide NetBIOS name_type information
@@ -2431,9 +2041,9 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN324"
-></A
->3.1. Introduction</H2
+NAME="AEN227"
+>3.1. Introduction</A
+></H2
><P
>Old windows clients send plain text passwords over the wire.
Samba can check these passwords by crypting them and comparing them
@@ -2472,9 +2082,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN331"
-></A
->3.2. Important Notes About Security</H2
+NAME="AEN234"
+>3.2. Important Notes About Security</A
+></H2
><P
>The unix and SMB password encryption techniques seem similar
on the surface. This similarity is, however, only skin deep. The unix
@@ -2580,9 +2190,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN346"
-></A
->3.2.1. Advantages of SMB Encryption</H3
+NAME="AEN249"
+>3.2.1. Advantages of SMB Encryption</A
+></H3
><P
></P
><TABLE
@@ -2614,9 +2224,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN351"
-></A
->3.2.2. Advantages of non-encrypted passwords</H3
+NAME="AEN254"
+>3.2.2. Advantages of non-encrypted passwords</A
+></H3
><P
></P
><TABLE
@@ -2650,9 +2260,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN357"
-></A
->3.3. The smbpasswd Command</H2
+NAME="AEN260"
+>3.3. The smbpasswd Command</A
+></H2
><P
>The smbpasswd utility is a utility similar to the
<B
@@ -2682,47 +2292,39 @@ CLASS="COMMAND"
><P
>To run smbpasswd as a normal user just type :</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->$ </TT
-><TT
+>$ </SAMP
+><KBD
CLASS="USERINPUT"
-><B
->smbpasswd</B
-></TT
+>smbpasswd</KBD
></P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->Old SMB password: </TT
-><TT
+>Old SMB password: </SAMP
+><KBD
CLASS="USERINPUT"
-><B
->&lt;type old value here -
- or hit return if there was no old password&gt;</B
-></TT
+>&#60;type old value here -
+ or hit return if there was no old password&#62;</KBD
></P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->New SMB Password: </TT
-><TT
+>New SMB Password: </SAMP
+><KBD
CLASS="USERINPUT"
-><B
->&lt;type new value&gt;
- </B
-></TT
+>&#60;type new value&#62;
+ </KBD
></P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->Repeat New SMB Password: </TT
-><TT
+>Repeat New SMB Password: </SAMP
+><KBD
CLASS="USERINPUT"
-><B
->&lt;re-type new value
- </B
-></TT
+>&#60;re-type new value
+ </KBD
></P
><P
>If the old value does not match the current value stored for
@@ -2762,9 +2364,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN388"
-></A
->3.4. Plain text</H2
+NAME="AEN291"
+>3.4. Plain text</A
+></H2
><P
>Older versions of samba retrieved user information from the unix user database
and eventually some other fields from the file <TT
@@ -2782,9 +2384,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN393"
-></A
->3.5. TDB</H2
+NAME="AEN296"
+>3.5. TDB</A
+></H2
><P
>Samba can also store the user data in a "TDB" (Trivial Database). Using this backend
doesn't require any additional configuration. This backend is recommended for new installations who
@@ -2795,17 +2397,17 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN396"
-></A
->3.6. LDAP</H2
+NAME="AEN299"
+>3.6. LDAP</A
+></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
-NAME="AEN398"
-></A
->3.6.1. Introduction</H3
+NAME="AEN301"
+>3.6.1. Introduction</A
+></H3
><P
>This document describes how to use an LDAP directory for storing Samba user
account information traditionally stored in the smbpasswd(5) file. It is
@@ -2871,9 +2473,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN418"
-></A
->3.6.2. Introduction</H3
+NAME="AEN321"
+>3.6.2. Introduction</A
+></H3
><P
>Traditionally, when configuring <A
HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
@@ -2928,35 +2530,27 @@ Identified (RID).</P
used by smbd was developed. The API which defines access to user accounts
is commonly referred to as the samdb interface (previously this was called the passdb
API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support
-for a samdb backend (e.g. <TT
+for a samdb backend (e.g. <VAR
CLASS="PARAMETER"
-><I
->--with-ldapsam</I
-></TT
+>--with-ldapsam</VAR
> or
-<TT
+<VAR
CLASS="PARAMETER"
-><I
->--with-tdbsam</I
-></TT
+>--with-tdbsam</VAR
>) requires compile time support.</P
><P
->When compiling Samba to include the <TT
+>When compiling Samba to include the <VAR
CLASS="PARAMETER"
-><I
->--with-ldapsam</I
-></TT
+>--with-ldapsam</VAR
> autoconf
option, smbd (and associated tools) will store and lookup user accounts in
an LDAP directory. In reality, this is very easy to understand. If you are
comfortable with using an smbpasswd file, simply replace "smbpasswd" with
"LDAP directory" in all the documentation.</P
><P
->There are a few points to stress about what the <TT
+>There are a few points to stress about what the <VAR
CLASS="PARAMETER"
-><I
->--with-ldapsam</I
-></TT
+>--with-ldapsam</VAR
>
does not provide. The LDAP support referred to in the this documentation does not
include:</P
@@ -2988,9 +2582,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN447"
-></A
->3.6.3. Supported LDAP Servers</H3
+NAME="AEN350"
+>3.6.3. Supported LDAP Servers</A
+></H3
><P
>The LDAP samdb code in 2.2.3 has been developed and tested using the OpenLDAP
2.0 server and client libraries. The same code should be able to work with
@@ -3013,9 +2607,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN452"
-></A
->3.6.4. Schema and Relationship to the RFC 2307 posixAccount</H3
+NAME="AEN355"
+>3.6.4. Schema and Relationship to the RFC 2307 posixAccount</A
+></H3
><P
>Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in
<TT
@@ -3049,9 +2643,9 @@ CLASS="FILENAME"
>/etc/passwd</TT
> entry, so is the sambaAccount object
meant to supplement the UNIX user account information. A sambaAccount is a
-<TT
+<CODE
CLASS="CONSTANT"
->STRUCTURAL</TT
+>STRUCTURAL</CODE
> objectclass so it can be stored individually
in the directory. However, there are several fields (e.g. uid) which overlap
with the posixAccount objectclass outlined in RFC2307. This is by design.</P
@@ -3070,24 +2664,24 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN464"
-></A
->3.6.5. Configuring Samba with LDAP</H3
+NAME="AEN367"
+>3.6.5. Configuring Samba with LDAP</A
+></H3
><DIV
CLASS="SECT3"
><H4
CLASS="SECT3"
><A
-NAME="AEN466"
-></A
->3.6.5.1. OpenLDAP configuration</H4
+NAME="AEN369"
+>3.6.5.1. OpenLDAP configuration</A
+></H4
><P
>To include support for the sambaAccount object in an OpenLDAP directory
server, first copy the samba.schema file to slapd's configuration directory.</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root# </TT
+>root# </SAMP
><B
CLASS="COMMAND"
>cp samba.schema /etc/openldap/schema/</B
@@ -3160,15 +2754,13 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN483"
-></A
->3.6.5.2. Configuring Samba</H4
+NAME="AEN386"
+>3.6.5.2. Configuring Samba</A
+></H4
><P
->The following parameters are available in smb.conf only with <TT
+>The following parameters are available in smb.conf only with <VAR
CLASS="PARAMETER"
-><I
->--with-ldapsam</I
-></TT
+>--with-ldapsam</VAR
>
was included with compiling Samba.</P
><P
@@ -3246,11 +2838,9 @@ CLASS="PROGRAMLISTING"
# define the DN to use when binding to the directory servers
# The password for this DN is not stored in smb.conf. Rather it
- # must be set by using 'smbpasswd -w <TT
+ # must be set by using 'smbpasswd -w <VAR
CLASS="REPLACEABLE"
-><I
->secretpw</I
-></TT
+>secretpw</VAR
>' to store the
# passphrase in the secrets.tdb file. If the "ldap admin dn" values
# changes, this password will need to be reset.
@@ -3271,7 +2861,7 @@ CLASS="REPLACEABLE"
ldap suffix = "ou=people,dc=samba,dc=org"
# generally the default ldap search filter is ok
- # ldap filter = "(&amp;(uid=%u)(objectclass=sambaAccount))"</PRE
+ # ldap filter = "(&#38;(uid=%u)(objectclass=sambaAccount))"</PRE
></P
></DIV
></DIV
@@ -3280,9 +2870,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN511"
-></A
->3.6.6. Accounts and Groups management</H3
+NAME="AEN414"
+>3.6.6. Accounts and Groups management</A
+></H3
><P
>As users accounts are managed thru the sambaAccount objectclass, you should
modify you existing administration tools to deal with sambaAccount attributes.</P
@@ -3305,9 +2895,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN516"
-></A
->3.6.7. Security and sambaAccount</H3
+NAME="AEN419"
+>3.6.7. Security and sambaAccount</A
+></H3
><P
>There are two important points to remember when discussing the security
of sambaAccount entries in the directory.</P
@@ -3384,9 +2974,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN536"
-></A
->3.6.8. LDAP specials attributes for sambaAccounts</H3
+NAME="AEN439"
+>3.6.8. LDAP specials attributes for sambaAccounts</A
+></H3
><P
>The sambaAccount objectclass is composed of the following attributes:</P
><P
@@ -3394,84 +2984,84 @@ NAME="AEN536"
><UL
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->lmPassword</TT
+>lmPassword</CODE
>: the LANMAN password 16-byte hash stored as a character
representation of a hexidecimal string.</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->ntPassword</TT
+>ntPassword</CODE
>: the NT password hash 16-byte stored as a character
representation of a hexidecimal string.</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->pwdLastSet</TT
+>pwdLastSet</CODE
>: The integer time in seconds since 1970 when the
- <TT
+ <CODE
CLASS="CONSTANT"
->lmPassword</TT
-> and <TT
+>lmPassword</CODE
+> and <CODE
CLASS="CONSTANT"
->ntPassword</TT
+>ntPassword</CODE
> attributes were last set.
</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->acctFlags</TT
+>acctFlags</CODE
>: string of 11 characters surrounded by square brackets []
representing account flags such as U (user), W(workstation), X(no password expiration), and
D(disabled).</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->logonTime</TT
+>logonTime</CODE
>: Integer value currently unused</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->logoffTime</TT
+>logoffTime</CODE
>: Integer value currently unused</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->kickoffTime</TT
+>kickoffTime</CODE
>: Integer value currently unused</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->pwdCanChange</TT
+>pwdCanChange</CODE
>: Integer value currently unused</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->pwdMustChange</TT
+>pwdMustChange</CODE
>: Integer value currently unused</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->homeDrive</TT
+>homeDrive</CODE
>: specifies the drive letter to which to map the
UNC path specified by homeDirectory. The drive letter must be specified in the form "X:"
where X is the letter of the drive to map. Refer to the "logon drive" parameter in the
@@ -3479,9 +3069,9 @@ CLASS="CONSTANT"
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->scriptPath</TT
+>scriptPath</CODE
>: The scriptPath property specifies the path of
the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path
is relative to the netlogon share. Refer to the "logon script" parameter in the
@@ -3489,18 +3079,18 @@ CLASS="CONSTANT"
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->profilePath</TT
+>profilePath</CODE
>: specifies a path to the user's profile.
This value can be a null string, a local absolute path, or a UNC path. Refer to the
"logon path" parameter in the smb.conf(5) man page for more information.</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->smbHome</TT
+>smbHome</CODE
>: The homeDirectory property specifies the path of
the home directory for the user. The string can be null. If homeDrive is set and specifies
a drive letter, homeDirectory should be a UNC path. The path must be a network
@@ -3510,25 +3100,25 @@ CLASS="CONSTANT"
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->userWorkstation</TT
+>userWorkstation</CODE
>: character string value currently unused.
</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->rid</TT
+>rid</CODE
>: the integer representation of the user's relative identifier
(RID).</P
></LI
><LI
><P
-><TT
+><CODE
CLASS="CONSTANT"
->primaryGroupID</TT
+>primaryGroupID</CODE
>: the relative identifier (RID) of the primary group
of the user.</P
></LI
@@ -3573,19 +3163,15 @@ its <TT
CLASS="FILENAME"
>smb.conf</TT
> file. When a user named "becky" logons to the domain,
-the <TT
+the <VAR
CLASS="PARAMETER"
-><I
->logon home</I
-></TT
+>logon home</VAR
> string is expanded to \\TASHTEGO\becky.
If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org",
this value is used. However, if this attribute does not exist, then the value
-of the <TT
+of the <VAR
CLASS="PARAMETER"
-><I
->logon home</I
-></TT
+>logon home</VAR
> parameter is used in its place. Samba
will only write the attribute value to the directory entry is the value is
something other than the default (e.g. \\MOBY\becky).</P
@@ -3595,9 +3181,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN606"
-></A
->3.6.9. Example LDIF Entries for a sambaAccount</H3
+NAME="AEN509"
+>3.6.9. Example LDIF Entries for a sambaAccount</A
+></H3
><P
>The following is a working LDIF with the inclusion of the posixAccount objectclass:</P
><P
@@ -3654,17 +3240,17 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN614"
-></A
->3.7. MySQL</H2
+NAME="AEN517"
+>3.7. MySQL</A
+></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
-NAME="AEN616"
-></A
->3.7.1. Building</H3
+NAME="AEN519"
+>3.7.1. Building</A
+></H3
><P
>To build the plugin, run <B
CLASS="COMMAND"
@@ -3683,9 +3269,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN622"
-></A
->3.7.2. Creating the database</H3
+NAME="AEN525"
+>3.7.2. Creating the database</A
+></H3
><P
>You either can set up your own table and specify the field names to pdb_mysql (see below
for the column names) or use the default table. The file <TT
@@ -3696,26 +3282,18 @@ contains the correct queries to create the required tables. Use the command :
<B
CLASS="COMMAND"
->mysql -u<TT
+>mysql -u<VAR
CLASS="REPLACEABLE"
-><I
->username</I
-></TT
-> -h<TT
+>username</VAR
+> -h<VAR
CLASS="REPLACEABLE"
-><I
->hostname</I
-></TT
-> -p<TT
+>hostname</VAR
+> -p<VAR
CLASS="REPLACEABLE"
-><I
->password</I
-></TT
-> <TT
+>password</VAR
+> <VAR
CLASS="REPLACEABLE"
-><I
->databasename</I
-></TT
+>databasename</VAR
> &#60; <TT
CLASS="FILENAME"
>/path/to/samba/examples/pdb/mysql/mysql.dump</TT
@@ -3727,9 +3305,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN632"
-></A
->3.7.3. Configuring</H3
+NAME="AEN535"
+>3.7.3. Configuring</A
+></H3
><P
>This plugin lacks some good documentation, but here is some short info:</P
><P
@@ -3838,9 +3416,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN649"
-></A
->3.7.4. Using plaintext passwords or encrypted password</H3
+NAME="AEN552"
+>3.7.4. Using plaintext passwords or encrypted password</A
+></H3
><P
>I strongly discourage the use of plaintext passwords, however, you can use them:</P
><P
@@ -3853,9 +3431,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN654"
-></A
->3.7.5. Getting non-column data from the table</H3
+NAME="AEN557"
+>3.7.5. Getting non-column data from the table</A
+></H3
><P
>It is possible to have not all data in the database and making some 'constant'.</P
><P
@@ -3879,17 +3457,17 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN662"
-></A
->3.8. Passdb XML plugin</H2
+NAME="AEN565"
+>3.8. Passdb XML plugin</A
+></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
-NAME="AEN664"
-></A
->3.8.1. Building</H3
+NAME="AEN567"
+>3.8.1. Building</A
+></H3
><P
>This module requires libxml2 to be installed.</P
><P
@@ -3907,9 +3485,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN670"
-></A
->3.8.2. Usage</H3
+NAME="AEN573"
+>3.8.2. Usage</A
+></H3
><P
>The usage of pdb_xml is pretty straightforward. To export data, use:
@@ -3944,7 +3522,7 @@ CLASS="TITLE"
><DIV
CLASS="PARTINTRO"
><A
-NAME="AEN678"
+NAME="AEN581"
></A
><H1
>Introduction</H1
@@ -3973,22 +3551,22 @@ HREF="#SAMBA-PDC"
><DL
><DT
>5.1. <A
-HREF="#AEN722"
+HREF="#AEN625"
>Prerequisite Reading</A
></DT
><DT
>5.2. <A
-HREF="#AEN728"
+HREF="#AEN631"
>Background</A
></DT
><DT
>5.3. <A
-HREF="#AEN767"
+HREF="#AEN670"
>Configuring the Samba Domain Controller</A
></DT
><DT
>5.4. <A
-HREF="#AEN810"
+HREF="#AEN713"
>Creating Machine Trust Accounts and Joining Clients to the
Domain</A
></DT
@@ -3996,59 +3574,59 @@ Domain</A
><DL
><DT
>5.4.1. <A
-HREF="#AEN829"
+HREF="#AEN732"
>Manual Creation of Machine Trust Accounts</A
></DT
><DT
>5.4.2. <A
-HREF="#AEN870"
+HREF="#AEN773"
>"On-the-Fly" Creation of Machine Trust Accounts</A
></DT
><DT
>5.4.3. <A
-HREF="#AEN879"
+HREF="#AEN782"
>Joining the Client to the Domain</A
></DT
></DL
></DD
><DT
>5.5. <A
-HREF="#AEN894"
+HREF="#AEN797"
>Common Problems and Errors</A
></DT
><DT
>5.6. <A
-HREF="#AEN942"
+HREF="#AEN845"
>System Policies and Profiles</A
></DT
><DT
>5.7. <A
-HREF="#AEN986"
+HREF="#AEN889"
>What other help can I get?</A
></DT
><DT
>5.8. <A
-HREF="#AEN1100"
+HREF="#AEN1003"
>Domain Control for Windows 9x/ME</A
></DT
><DD
><DL
><DT
>5.8.1. <A
-HREF="#AEN1126"
+HREF="#AEN1029"
>Configuration Instructions: Network Logons</A
></DT
><DT
>5.8.2. <A
-HREF="#AEN1145"
+HREF="#AEN1048"
>Configuration Instructions: Setting up Roaming User Profiles</A
></DT
></DL
></DD
><DT
>5.9. <A
-HREF="#AEN1238"
->DOMAIN_CONTROL.txt : Windows NT Domain Control &amp; Samba</A
+HREF="#AEN1141"
+>DOMAIN_CONTROL.txt : Windows NT Domain Control &#38; Samba</A
></DT
></DL
></DD
@@ -4061,53 +3639,53 @@ HREF="#SAMBA-BDC"
><DL
><DT
>6.1. <A
-HREF="#AEN1274"
+HREF="#AEN1177"
>Prerequisite Reading</A
></DT
><DT
>6.2. <A
-HREF="#AEN1278"
+HREF="#AEN1181"
>Background</A
></DT
><DT
>6.3. <A
-HREF="#AEN1286"
+HREF="#AEN1189"
>What qualifies a Domain Controller on the network?</A
></DT
><DD
><DL
><DT
>6.3.1. <A
-HREF="#AEN1289"
+HREF="#AEN1192"
>How does a Workstation find its domain controller?</A
></DT
><DT
>6.3.2. <A
-HREF="#AEN1292"
+HREF="#AEN1195"
>When is the PDC needed?</A
></DT
></DL
></DD
><DT
>6.4. <A
-HREF="#AEN1295"
+HREF="#AEN1198"
>Can Samba be a Backup Domain Controller to an NT PDC?</A
></DT
><DT
>6.5. <A
-HREF="#AEN1300"
+HREF="#AEN1203"
>How do I set up a Samba BDC?</A
></DT
><DD
><DL
><DT
>6.5.1. <A
-HREF="#AEN1317"
+HREF="#AEN1220"
>How do I replicate the smbpasswd file?</A
></DT
><DT
>6.5.2. <A
-HREF="#AEN1321"
+HREF="#AEN1224"
>Can I do this all with LDAP?</A
></DT
></DL
@@ -4123,51 +3701,51 @@ HREF="#ADS"
><DL
><DT
>7.1. <A
-HREF="#AEN1339"
+HREF="#AEN1242"
>Installing the required packages for Debian</A
></DT
><DT
>7.2. <A
-HREF="#AEN1346"
+HREF="#AEN1249"
>Installing the required packages for RedHat</A
></DT
><DT
>7.3. <A
-HREF="#AEN1356"
+HREF="#AEN1259"
>Compile Samba</A
></DT
><DT
>7.4. <A
-HREF="#AEN1371"
+HREF="#AEN1274"
>Setup your /etc/krb5.conf</A
></DT
><DT
>7.5. <A
-HREF="#AEN1381"
+HREF="#AEN1284"
>Create the computer account</A
></DT
><DD
><DL
><DT
>7.5.1. <A
-HREF="#AEN1385"
+HREF="#AEN1288"
>Possible errors</A
></DT
></DL
></DD
><DT
>7.6. <A
-HREF="#AEN1393"
+HREF="#AEN1296"
>Test your server setup</A
></DT
><DT
>7.7. <A
-HREF="#AEN1398"
+HREF="#AEN1301"
>Testing with smbclient</A
></DT
><DT
>7.8. <A
-HREF="#AEN1401"
+HREF="#AEN1304"
>Notes</A
></DT
></DL
@@ -4181,17 +3759,17 @@ HREF="#DOMAIN-SECURITY"
><DL
><DT
>8.1. <A
-HREF="#AEN1423"
+HREF="#AEN1326"
>Joining an NT Domain with Samba 3.0</A
></DT
><DT
>8.2. <A
-HREF="#AEN1478"
+HREF="#AEN1381"
>Samba and Windows 2000 Domains</A
></DT
><DT
>8.3. <A
-HREF="#AEN1481"
+HREF="#AEN1384"
>Why is this better than security = server?</A
></DT
></DL
@@ -4311,9 +3889,9 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN722"
-></A
->5.1. Prerequisite Reading</H2
+NAME="AEN625"
+>5.1. Prerequisite Reading</A
+></H2
><P
>Before you continue reading in this chapter, please make sure
that you are comfortable with configuring basic files services
@@ -4339,9 +3917,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN728"
-></A
->5.2. Background</H2
+NAME="AEN631"
+>5.2. Background</A
+></H2
><DIV
CLASS="NOTE"
><P
@@ -4491,9 +4069,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN767"
-></A
->5.3. Configuring the Samba Domain Controller</H2
+NAME="AEN670"
+>5.3. Configuring the Samba Domain Controller</A
+></H2
><P
>The first step in creating a working Samba PDC is to
understand the parameters necessary in smb.conf. I will not
@@ -4519,21 +4097,17 @@ CLASS="PROGRAMLISTING"
HREF="smb.conf.5.html#NETBIOSNAME"
TARGET="_top"
>netbios name</A
-> = <TT
+> = <VAR
CLASS="REPLACEABLE"
-><I
->POGO</I
-></TT
+>POGO</VAR
>
<A
HREF="smb.conf.5.html#WORKGROUP"
TARGET="_top"
>workgroup</A
-> = <TT
+> = <VAR
CLASS="REPLACEABLE"
-><I
->NARNIA</I
-></TT
+>NARNIA</VAR
>
; we should act as the domain and local master browser
@@ -4623,11 +4197,9 @@ TARGET="_top"
HREF="smb.conf.5.html#WRITELIST"
TARGET="_top"
>write list</A
-> = <TT
+> = <VAR
CLASS="REPLACEABLE"
-><I
->ntadmin</I
-></TT
+>ntadmin</VAR
>
; share for storing user profiles
@@ -4703,10 +4275,10 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN810"
-></A
+NAME="AEN713"
>5.4. Creating Machine Trust Accounts and Joining Clients to the
-Domain</H2
+Domain</A
+></H2
><P
>A machine trust account is a Samba account that is used to
authenticate a client machine (rather than a user) to the Samba
@@ -4777,9 +4349,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN829"
-></A
->5.4.1. Manual Creation of Machine Trust Accounts</H3
+NAME="AEN732"
+>5.4.1. Manual Creation of Machine Trust Accounts</A
+></H3
><P
>The first step in manually creating a machine trust account is to
manually create the corresponding Unix account in
@@ -4794,55 +4366,45 @@ CLASS="COMMAND"
used to create new Unix accounts. The following is an example for a
Linux based Samba server:</P
><P
-> <TT
+> <SAMP
CLASS="PROMPT"
->root# </TT
+>root# </SAMP
><B
CLASS="COMMAND"
->/usr/sbin/useradd -g 100 -d /dev/null -c <TT
+>/usr/sbin/useradd -g 100 -d /dev/null -c <VAR
CLASS="REPLACEABLE"
-><I
>"machine
-nickname"</I
-></TT
-> -s /bin/false <TT
+nickname"</VAR
+> -s /bin/false <VAR
CLASS="REPLACEABLE"
-><I
->machine_name</I
-></TT
+>machine_name</VAR
>$ </B
></P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root# </TT
+>root# </SAMP
><B
CLASS="COMMAND"
->passwd -l <TT
+>passwd -l <VAR
CLASS="REPLACEABLE"
-><I
->machine_name</I
-></TT
+>machine_name</VAR
>$</B
></P
><P
>On *BSD systems, this can be done using the 'chpass' utility:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root# </TT
+>root# </SAMP
><B
CLASS="COMMAND"
->chpass -a "<TT
+>chpass -a "<VAR
CLASS="REPLACEABLE"
-><I
->machine_name</I
-></TT
->$:*:101:100::0:0:Workstation <TT
+>machine_name</VAR
+>$:*:101:100::0:0:Workstation <VAR
CLASS="REPLACEABLE"
-><I
->machine_name</I
-></TT
+>machine_name</VAR
>:/dev/null:/sbin/nologin"</B
></P
><P
@@ -4859,26 +4421,20 @@ CLASS="FILENAME"
><P
><PRE
CLASS="PROGRAMLISTING"
->doppy$:x:505:501:<TT
+>doppy$:x:505:501:<VAR
CLASS="REPLACEABLE"
-><I
->machine_nickname</I
-></TT
+>machine_nickname</VAR
>:/dev/null:/bin/false</PRE
></P
><P
->Above, <TT
+>Above, <VAR
CLASS="REPLACEABLE"
-><I
->machine_nickname</I
-></TT
+>machine_nickname</VAR
> can be any
descriptive name for the client, i.e., BasementComputer.
-<TT
+<VAR
CLASS="REPLACEABLE"
-><I
->machine_name</I
-></TT
+>machine_name</VAR
> absolutely must be the NetBIOS
name of the client to be joined to the domain. The "$" must be
appended to the NetBIOS name of the client or Samba will not recognize
@@ -4896,24 +4452,20 @@ CLASS="COMMAND"
> command
as shown here:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root# </TT
+>root# </SAMP
><B
CLASS="COMMAND"
->smbpasswd -a -m <TT
+>smbpasswd -a -m <VAR
CLASS="REPLACEABLE"
-><I
->machine_name</I
-></TT
+>machine_name</VAR
></B
></P
><P
->where <TT
+>where <VAR
CLASS="REPLACEABLE"
-><I
->machine_name</I
-></TT
+>machine_name</VAR
> is the machine's NetBIOS
name. The RID of the new machine account is generated from the UID of
the corresponding Unix account.</P
@@ -4967,9 +4519,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN870"
-></A
->5.4.2. "On-the-Fly" Creation of Machine Trust Accounts</H3
+NAME="AEN773"
+>5.4.2. "On-the-Fly" Creation of Machine Trust Accounts</A
+></H3
><P
>The second (and recommended) way of creating machine trust accounts is
simply to allow the Samba server to create them as needed when the client
@@ -4995,7 +4547,7 @@ be created manually.</P
><PRE
CLASS="PROGRAMLISTING"
>[global]
- # &lt;...remainder of parameters...&gt;
+ # &#60;...remainder of parameters...&#62;
add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u </PRE
></P
></DIV
@@ -5004,9 +4556,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN879"
-></A
->5.4.3. Joining the Client to the Domain</H3
+NAME="AEN782"
+>5.4.3. Joining the Client to the Domain</A
+></H3
><P
>The procedure for joining a client to the domain varies with the
version of Windows.</P
@@ -5072,9 +4624,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN894"
-></A
->5.5. Common Problems and Errors</H2
+NAME="AEN797"
+>5.5. Common Problems and Errors</A
+></H2
><P
></P
><P
@@ -5128,9 +4680,9 @@ CLASS="EMPHASIS"
will remove all network drive connections:
</P
><P
-> <TT
+> <SAMP
CLASS="PROMPT"
->C:\WINNT\&#62;</TT
+>C:\WINNT\&#62;</SAMP
> <B
CLASS="COMMAND"
>net use * /d</B
@@ -5193,11 +4745,9 @@ CLASS="EMPHASIS"
</P
><P
> This problem is caused by the PDC not having a suitable machine trust account.
- If you are using the <TT
+ If you are using the <VAR
CLASS="PARAMETER"
-><I
->add user script</I
-></TT
+>add user script</VAR
> method to create
accounts then this would indicate that it has not worked. Ensure the domain
admin user system is working.
@@ -5241,11 +4791,9 @@ CLASS="COMMAND"
</P
><P
> In order to work around this problem in 2.2.0, configure the
- <TT
+ <VAR
CLASS="PARAMETER"
-><I
->account</I
-></TT
+>account</VAR
> control flag in
<TT
CLASS="FILENAME"
@@ -5282,9 +4830,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN942"
-></A
->5.6. System Policies and Profiles</H2
+NAME="AEN845"
+>5.6. System Policies and Profiles</A
+></H2
><P
>Much of the information necessary to implement System Policies and
Roving User Profiles in a Samba domain is the same as that for
@@ -5459,9 +5007,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN986"
-></A
->5.7. What other help can I get?</H2
+NAME="AEN889"
+>5.7. What other help can I get?</A
+></H2
><P
>There are many sources of information available in the form
of mailing lists, RFC's and documentation. The docs that come
@@ -5879,9 +5427,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1100"
-></A
->5.8. Domain Control for Windows 9x/ME</H2
+NAME="AEN1003"
+>5.8. Domain Control for Windows 9x/ME</A
+></H2
><DIV
CLASS="NOTE"
><P
@@ -5958,7 +5506,7 @@ TYPE="1"
><LI
><P
> The client broadcasts (to the IP broadcast address of the subnet it is in)
- a NetLogon request. This is sent to the NetBIOS name DOMAIN&lt;1c&gt; at the
+ a NetLogon request. This is sent to the NetBIOS name DOMAIN&#60;1c&#62; at the
NetBIOS layer. The client chooses the first response it receives, which
contains the NetBIOS name of the logon server to use in the format of
\\SERVER.
@@ -6013,9 +5561,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1126"
-></A
->5.8.1. Configuration Instructions: Network Logons</H3
+NAME="AEN1029"
+>5.8.1. Configuration Instructions: Network Logons</A
+></H3
><P
>The main difference between a PDC and a Windows 9x logon
server configuration is that</P
@@ -6068,20 +5616,20 @@ VALIGN="TOP"
>There are a few comments to make in order to tie up some
loose ends. There has been much debate over the issue of whether
or not it is ok to configure Samba as a Domain Controller in security
-modes other than <TT
+modes other than <CODE
CLASS="CONSTANT"
->USER</TT
+>USER</CODE
>. The only security mode
-which will not work due to technical reasons is <TT
+which will not work due to technical reasons is <CODE
CLASS="CONSTANT"
->SHARE</TT
+>SHARE</CODE
>
-mode security. <TT
+mode security. <CODE
CLASS="CONSTANT"
->DOMAIN</TT
-> and <TT
+>DOMAIN</CODE
+> and <CODE
CLASS="CONSTANT"
->SERVER</TT
+>SERVER</CODE
>
mode security is really just a variation on SMB user level security.</P
><P
@@ -6119,9 +5667,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1145"
-></A
->5.8.2. Configuration Instructions: Setting up Roaming User Profiles</H3
+NAME="AEN1048"
+>5.8.2. Configuration Instructions: Setting up Roaming User Profiles</A
+></H3
><DIV
CLASS="WARNING"
><P
@@ -6172,9 +5720,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN1153"
-></A
->5.8.2.1. Windows NT Configuration</H4
+NAME="AEN1056"
+>5.8.2.1. Windows NT Configuration</A
+></H4
><P
>To support WinNT clients, in the [global] section of smb.conf set the
following (for example):</P
@@ -6223,9 +5771,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN1161"
-></A
->5.8.2.2. Windows 9X Configuration</H4
+NAME="AEN1064"
+>5.8.2.2. Windows 9X Configuration</A
+></H4
><P
>To support Win9X clients, you must use the "logon home" parameter. Samba has
now been fixed so that "net use/home" now works as well, and it, too, relies
@@ -6254,9 +5802,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN1169"
-></A
->5.8.2.3. Win9X and WinNT Configuration</H4
+NAME="AEN1072"
+>5.8.2.3. Win9X and WinNT Configuration</A
+></H4
><P
>You can support profiles for both Win9X and WinNT clients by setting both the
"logon home" and "logon path" parameters. For example:</P
@@ -6299,9 +5847,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN1176"
-></A
->5.8.2.4. Windows 9X Profile Setup</H4
+NAME="AEN1079"
+>5.8.2.4. Windows 9X Profile Setup</A
+></H4
><P
>When a user first logs in on Windows 9X, the file user.DAT is created,
as are folders "Start Menu", "Desktop", "Programs" and "Nethood".
@@ -6459,9 +6007,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN1212"
-></A
->5.8.2.5. Windows NT Workstation 4.0</H4
+NAME="AEN1115"
+>5.8.2.5. Windows NT Workstation 4.0</A
+></H4
><P
>When a user first logs in to a Windows NT Workstation, the profile
NTuser.DAT is created. The profile location can be now specified
@@ -6573,9 +6121,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN1225"
-></A
->5.8.2.6. Windows NT Server</H4
+NAME="AEN1128"
+>5.8.2.6. Windows NT Server</A
+></H4
><P
>There is nothing to stop you specifying any path that you like for the
location of users' profiles. Therefore, you could specify that the
@@ -6587,9 +6135,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN1228"
-></A
->5.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0</H4
+NAME="AEN1131"
+>5.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0</A
+></H4
><DIV
CLASS="WARNING"
><P
@@ -6680,9 +6228,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1238"
-></A
->5.9. DOMAIN_CONTROL.txt : Windows NT Domain Control &amp; Samba</H2
+NAME="AEN1141"
+>5.9. DOMAIN_CONTROL.txt : Windows NT Domain Control &#38; Samba</A
+></H2
><DIV
CLASS="WARNING"
><P
@@ -6757,16 +6305,16 @@ may need to know to interact with the rest of the system.</P
>The registry files can be located on any Windows NT machine by opening a
command prompt and typing:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->C:\WINNT\&#62;</TT
+>C:\WINNT\&#62;</SAMP
> dir %SystemRoot%\System32\config</P
><P
>The environment variable %SystemRoot% value can be obtained by typing:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->C:\WINNT&#62;</TT
+>C:\WINNT&#62;</SAMP
>echo %SystemRoot%</P
><P
>The active parts of the registry that you may want to be familiar with are
@@ -6825,9 +6373,9 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN1274"
-></A
->6.1. Prerequisite Reading</H2
+NAME="AEN1177"
+>6.1. Prerequisite Reading</A
+></H2
><P
>Before you continue reading in this chapter, please make sure
that you are comfortable with configuring a Samba PDC
@@ -6842,9 +6390,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1278"
-></A
->6.2. Background</H2
+NAME="AEN1181"
+>6.2. Background</A
+></H2
><P
>What is a Domain Controller? It is a machine that is able to answer
logon requests from workstations in a Windows NT Domain. Whenever a
@@ -6887,9 +6435,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1286"
-></A
->6.3. What qualifies a Domain Controller on the network?</H2
+NAME="AEN1189"
+>6.3. What qualifies a Domain Controller on the network?</A
+></H2
><P
>Every machine that is a Domain Controller for the domain SAMBA has to
register the NetBIOS group name SAMBA#1c with the WINS server and/or
@@ -6904,9 +6452,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1289"
-></A
->6.3.1. How does a Workstation find its domain controller?</H3
+NAME="AEN1192"
+>6.3.1. How does a Workstation find its domain controller?</A
+></H3
><P
>A NT workstation in the domain SAMBA that wants a local user to be
authenticated has to find the domain controller for SAMBA. It does
@@ -6923,9 +6471,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1292"
-></A
->6.3.2. When is the PDC needed?</H3
+NAME="AEN1195"
+>6.3.2. When is the PDC needed?</A
+></H3
><P
>Whenever a user wants to change his password, this has to be done on
the PDC. To find the PDC, the workstation does a NetBIOS name query
@@ -6939,9 +6487,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1295"
-></A
->6.4. Can Samba be a Backup Domain Controller to an NT PDC?</H2
+NAME="AEN1198"
+>6.4. Can Samba be a Backup Domain Controller to an NT PDC?</A
+></H2
><P
>With version 2.2, no. The native NT SAM replication protocols have
not yet been fully implemented. The Samba Team is working on
@@ -6962,9 +6510,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1300"
-></A
->6.5. How do I set up a Samba BDC?</H2
+NAME="AEN1203"
+>6.5. How do I set up a Samba BDC?</A
+></H2
><P
>Several things have to be done:</P
><P
@@ -7029,9 +6577,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1317"
-></A
->6.5.1. How do I replicate the smbpasswd file?</H3
+NAME="AEN1220"
+>6.5.1. How do I replicate the smbpasswd file?</A
+></H3
><P
>Replication of the smbpasswd file is sensitive. It has to be done
whenever changes to the SAM are made. Every user's password change is
@@ -7050,9 +6598,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1321"
-></A
->6.5.2. Can I do this all with LDAP?</H3
+NAME="AEN1224"
+>6.5.2. Can I do this all with LDAP?</A
+></H3
><P
>The simple answer is YES. Samba's pdb_ldap code supports
binding to a replica LDAP server, and will also follow referrals and
@@ -7106,9 +6654,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1339"
-></A
->7.1. Installing the required packages for Debian</H2
+NAME="AEN1242"
+>7.1. Installing the required packages for Debian</A
+></H2
><P
>On Debian you need to install the following packages:</P
><P
@@ -7136,9 +6684,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1346"
-></A
->7.2. Installing the required packages for RedHat</H2
+NAME="AEN1249"
+>7.2. Installing the required packages for RedHat</A
+></H2
><P
>On RedHat this means you should have at least: </P
><P
@@ -7175,9 +6723,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1356"
-></A
->7.3. Compile Samba</H2
+NAME="AEN1259"
+>7.3. Compile Samba</A
+></H2
><P
>If your kerberos libraries are in a non-standard location then
remember to add the configure option --with-krb5=DIR.</P
@@ -7231,9 +6779,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1371"
-></A
->7.4. Setup your /etc/krb5.conf</H2
+NAME="AEN1274"
+>7.4. Setup your /etc/krb5.conf</A
+></H2
><P
>The minimal configuration for krb5.conf is:</P
><P
@@ -7270,9 +6818,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1381"
-></A
->7.5. Create the computer account</H2
+NAME="AEN1284"
+>7.5. Create the computer account</A
+></H2
><P
>As a user that has write permission on the Samba private directory
(usually root) run:
@@ -7285,9 +6833,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1385"
-></A
->7.5.1. Possible errors</H3
+NAME="AEN1288"
+>7.5.1. Possible errors</A
+></H3
><P
><P
></P
@@ -7310,9 +6858,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1393"
-></A
->7.6. Test your server setup</H2
+NAME="AEN1296"
+>7.6. Test your server setup</A
+></H2
><P
>On a Windows 2000 client try <B
CLASS="COMMAND"
@@ -7330,9 +6878,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1398"
-></A
->7.7. Testing with smbclient</H2
+NAME="AEN1301"
+>7.7. Testing with smbclient</A
+></H2
><P
>On your Samba server try to login to a Win2000 server or your Samba
server using smbclient and kerberos. Use smbclient as usual, but
@@ -7343,9 +6891,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1401"
-></A
->7.8. Notes</H2
+NAME="AEN1304"
+>7.8. Notes</A
+></H2
><P
>You must change administrator password at least once after DC install,
to create the right encoding types</P
@@ -7366,30 +6914,30 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN1423"
-></A
->8.1. Joining an NT Domain with Samba 3.0</H2
+NAME="AEN1326"
+>8.1. Joining an NT Domain with Samba 3.0</A
+></H2
><P
>Assume you have a Samba 3.0 server with a NetBIOS name of
- <TT
+ <CODE
CLASS="CONSTANT"
->SERV1</TT
+>SERV1</CODE
> and are joining an or Win2k NT domain called
- <TT
+ <CODE
CLASS="CONSTANT"
->DOM</TT
+>DOM</CODE
>, which has a PDC with a NetBIOS name
- of <TT
+ of <CODE
CLASS="CONSTANT"
->DOMPDC</TT
+>DOMPDC</CODE
> and two backup domain controllers
- with NetBIOS names <TT
+ with NetBIOS names <CODE
CLASS="CONSTANT"
->DOMBDC1</TT
-> and <TT
+>DOMBDC1</CODE
+> and <CODE
CLASS="CONSTANT"
>DOMBDC2
- </TT
+ </CODE
>.</P
><P
>Firstly, you must edit your <A
@@ -7405,11 +6953,9 @@ CLASS="FILENAME"
>Change (or add) your <A
HREF="smb.conf.5.html#SECURITY"
TARGET="_top"
-> <TT
+> <VAR
CLASS="PARAMETER"
-><I
->security =</I
-></TT
+>security =</VAR
></A
> line in the [global] section
of your smb.conf to read:</P
@@ -7427,11 +6973,9 @@ CLASS="COMMAND"
>Next change the <A
HREF="smb.conf.5.html#WORKGROUP"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
-> workgroup =</I
-></TT
+> workgroup =</VAR
></A
> line in the [global] section to read: </P
><P
@@ -7445,26 +6989,22 @@ CLASS="COMMAND"
>You must also have the parameter <A
HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
TARGET="_top"
-> <TT
+> <VAR
CLASS="PARAMETER"
-><I
->encrypt passwords</I
-></TT
+>encrypt passwords</VAR
></A
-> set to <TT
+> set to <CODE
CLASS="CONSTANT"
>yes
- </TT
+ </CODE
> in order for your users to authenticate to the NT PDC.</P
><P
>Finally, add (or modify) a <A
HREF="smb.conf.5.html#PASSWORDSERVER"
TARGET="_top"
-> <TT
+> <VAR
CLASS="PARAMETER"
-><I
->password server =</I
-></TT
+>password server =</VAR
></A
> line in the [global]
section to read: </P
@@ -7497,41 +7037,35 @@ CLASS="COMMAND"
>In order to actually join the domain, you must run this
command:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root# </TT
-><TT
+>root# </SAMP
+><KBD
CLASS="USERINPUT"
-><B
>net join -S DOMPDC
- -U<TT
+ -U<VAR
CLASS="REPLACEABLE"
-><I
->Administrator%password</I
-></TT
-></B
-></TT
+>Administrator%password</VAR
+></KBD
></P
><P
>as we are joining the domain DOM and the PDC for that domain
(the only machine that has write access to the domain SAM database)
- is DOMPDC. The <TT
+ is DOMPDC. The <VAR
CLASS="REPLACEABLE"
-><I
->Administrator%password</I
-></TT
+>Administrator%password</VAR
> is
the login name and password for an account which has the necessary
privilege to add machines to the domain. If this is successful
you will see the message:</P
><P
-><TT
+><SAMP
CLASS="COMPUTEROUTPUT"
->Joined domain DOM.</TT
+>Joined domain DOM.</SAMP
>
- or <TT
+ or <SAMP
CLASS="COMPUTEROUTPUT"
->Joined 'SERV1' to realm 'MYREALM'</TT
+>Joined 'SERV1' to realm 'MYREALM'</SAMP
>
</P
><P
@@ -7568,9 +7102,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1478"
-></A
->8.2. Samba and Windows 2000 Domains</H2
+NAME="AEN1381"
+>8.2. Samba and Windows 2000 Domains</A
+></H2
><P
>Many people have asked regarding the state of Samba's ability to participate in
a Windows 2000 Domain. Samba 3.0 is able to act as a member server of a Windows
@@ -7582,16 +7116,16 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1481"
-></A
->8.3. Why is this better than security = server?</H2
+NAME="AEN1384"
+>8.3. Why is this better than security = server?</A
+></H2
><P
>Currently, domain security in Samba doesn't free you from
having to create local Unix users to represent the users attaching
- to your server. This means that if domain user <TT
+ to your server. This means that if domain user <CODE
CLASS="CONSTANT"
>DOM\fred
- </TT
+ </CODE
> attaches to your domain security Samba server, there needs
to be a local Unix user fred to represent that user in the Unix
filesystem. This is very similar to the older Samba security mode
@@ -7676,7 +7210,7 @@ CLASS="TITLE"
><DIV
CLASS="PARTINTRO"
><A
-NAME="AEN1499"
+NAME="AEN1402"
></A
><H1
>Introduction</H1
@@ -7700,19 +7234,19 @@ HREF="#INTEGRATE-MS-NETWORKS"
><DL
><DT
>9.1. <A
-HREF="#AEN1513"
+HREF="#AEN1416"
>Agenda</A
></DT
><DT
>9.2. <A
-HREF="#AEN1535"
+HREF="#AEN1438"
>Name Resolution in a pure Unix/Linux world</A
></DT
><DD
><DL
><DT
>9.2.1. <A
-HREF="#AEN1551"
+HREF="#AEN1454"
><TT
CLASS="FILENAME"
>/etc/hosts</TT
@@ -7720,7 +7254,7 @@ CLASS="FILENAME"
></DT
><DT
>9.2.2. <A
-HREF="#AEN1567"
+HREF="#AEN1470"
><TT
CLASS="FILENAME"
>/etc/resolv.conf</TT
@@ -7728,7 +7262,7 @@ CLASS="FILENAME"
></DT
><DT
>9.2.3. <A
-HREF="#AEN1578"
+HREF="#AEN1481"
><TT
CLASS="FILENAME"
>/etc/host.conf</TT
@@ -7736,7 +7270,7 @@ CLASS="FILENAME"
></DT
><DT
>9.2.4. <A
-HREF="#AEN1586"
+HREF="#AEN1489"
><TT
CLASS="FILENAME"
>/etc/nsswitch.conf</TT
@@ -7746,47 +7280,47 @@ CLASS="FILENAME"
></DD
><DT
>9.3. <A
-HREF="#AEN1598"
+HREF="#AEN1501"
>Name resolution as used within MS Windows networking</A
></DT
><DD
><DL
><DT
>9.3.1. <A
-HREF="#AEN1610"
+HREF="#AEN1513"
>The NetBIOS Name Cache</A
></DT
><DT
>9.3.2. <A
-HREF="#AEN1615"
+HREF="#AEN1518"
>The LMHOSTS file</A
></DT
><DT
>9.3.3. <A
-HREF="#AEN1623"
+HREF="#AEN1526"
>HOSTS file</A
></DT
><DT
>9.3.4. <A
-HREF="#AEN1628"
+HREF="#AEN1531"
>DNS Lookup</A
></DT
><DT
>9.3.5. <A
-HREF="#AEN1631"
+HREF="#AEN1534"
>WINS Lookup</A
></DT
></DL
></DD
><DT
>9.4. <A
-HREF="#AEN1643"
+HREF="#AEN1546"
>How browsing functions and how to deploy stable and
dependable browsing using Samba</A
></DT
><DT
>9.5. <A
-HREF="#AEN1653"
+HREF="#AEN1556"
>MS Windows security options and how to configure
Samba for seemless integration</A
></DT
@@ -7794,24 +7328,24 @@ Samba for seemless integration</A
><DL
><DT
>9.5.1. <A
-HREF="#AEN1681"
+HREF="#AEN1584"
>Use MS Windows NT as an authentication server</A
></DT
><DT
>9.5.2. <A
-HREF="#AEN1689"
+HREF="#AEN1592"
>Make Samba a member of an MS Windows NT security domain</A
></DT
><DT
>9.5.3. <A
-HREF="#AEN1706"
+HREF="#AEN1609"
>Configure Samba as an authentication server</A
></DT
></DL
></DD
><DT
>9.6. <A
-HREF="#AEN1723"
+HREF="#AEN1626"
>Conclusions</A
></DT
></DL
@@ -7825,53 +7359,53 @@ HREF="#UNIX-PERMISSIONS"
><DL
><DT
>10.1. <A
-HREF="#AEN1744"
+HREF="#AEN1647"
>Viewing and changing UNIX permissions using the NT
security dialogs</A
></DT
><DT
>10.2. <A
-HREF="#AEN1748"
+HREF="#AEN1651"
>How to view file security on a Samba share</A
></DT
><DT
>10.3. <A
-HREF="#AEN1759"
+HREF="#AEN1662"
>Viewing file ownership</A
></DT
><DT
>10.4. <A
-HREF="#AEN1779"
+HREF="#AEN1682"
>Viewing file or directory permissions</A
></DT
><DD
><DL
><DT
>10.4.1. <A
-HREF="#AEN1794"
+HREF="#AEN1697"
>File Permissions</A
></DT
><DT
>10.4.2. <A
-HREF="#AEN1808"
+HREF="#AEN1711"
>Directory Permissions</A
></DT
></DL
></DD
><DT
>10.5. <A
-HREF="#AEN1815"
+HREF="#AEN1718"
>Modifying file or directory permissions</A
></DT
><DT
>10.6. <A
-HREF="#AEN1837"
+HREF="#AEN1740"
>Interaction with the standard Samba create mask
parameters</A
></DT
><DT
>10.7. <A
-HREF="#AEN1901"
+HREF="#AEN1804"
>Interaction with the standard Samba file attribute
mapping</A
></DT
@@ -7887,17 +7421,17 @@ managed authentication</A
><DL
><DT
>11.1. <A
-HREF="#AEN1922"
+HREF="#AEN1825"
>Samba and PAM</A
></DT
><DT
>11.2. <A
-HREF="#AEN1966"
+HREF="#AEN1869"
>Distributed Authentication</A
></DT
><DT
>11.3. <A
-HREF="#AEN1973"
+HREF="#AEN1876"
>PAM Configuration in smb.conf</A
></DT
></DL
@@ -7911,14 +7445,14 @@ HREF="#MSDFS"
><DL
><DT
>12.1. <A
-HREF="#AEN1993"
+HREF="#AEN1896"
>Instructions</A
></DT
><DD
><DL
><DT
>12.1.1. <A
-HREF="#AEN2028"
+HREF="#AEN1931"
>Notes</A
></DT
></DL
@@ -7934,122 +7468,122 @@ HREF="#PRINTING"
><DL
><DT
>13.1. <A
-HREF="#AEN2054"
+HREF="#AEN1957"
>Introduction</A
></DT
><DT
>13.2. <A
-HREF="#AEN2076"
+HREF="#AEN1979"
>Configuration</A
></DT
><DD
><DL
><DT
>13.2.1. <A
-HREF="#AEN2084"
+HREF="#AEN1987"
>Creating [print$]</A
></DT
><DT
>13.2.2. <A
-HREF="#AEN2119"
+HREF="#AEN2022"
>Setting Drivers for Existing Printers</A
></DT
><DT
>13.2.3. <A
-HREF="#AEN2135"
+HREF="#AEN2038"
>Support a large number of printers</A
></DT
><DT
>13.2.4. <A
-HREF="#AEN2146"
+HREF="#AEN2049"
>Adding New Printers via the Windows NT APW</A
></DT
><DT
>13.2.5. <A
-HREF="#AEN2176"
+HREF="#AEN2079"
>Samba and Printer Ports</A
></DT
></DL
></DD
><DT
>13.3. <A
-HREF="#AEN2184"
+HREF="#AEN2087"
>The Imprints Toolset</A
></DT
><DD
><DL
><DT
>13.3.1. <A
-HREF="#AEN2188"
+HREF="#AEN2091"
>What is Imprints?</A
></DT
><DT
>13.3.2. <A
-HREF="#AEN2198"
+HREF="#AEN2101"
>Creating Printer Driver Packages</A
></DT
><DT
>13.3.3. <A
-HREF="#AEN2201"
+HREF="#AEN2104"
>The Imprints server</A
></DT
><DT
>13.3.4. <A
-HREF="#AEN2205"
+HREF="#AEN2108"
>The Installation Client</A
></DT
></DL
></DD
><DT
>13.4. <A
-HREF="#AEN2227"
+HREF="#AEN2130"
>Diagnosis</A
></DT
><DD
><DL
><DT
>13.4.1. <A
-HREF="#AEN2229"
+HREF="#AEN2132"
>Introduction</A
></DT
><DT
>13.4.2. <A
-HREF="#AEN2245"
+HREF="#AEN2148"
>Debugging printer problems</A
></DT
><DT
>13.4.3. <A
-HREF="#AEN2254"
+HREF="#AEN2157"
>What printers do I have?</A
></DT
><DT
>13.4.4. <A
-HREF="#AEN2262"
+HREF="#AEN2165"
>Setting up printcap and print servers</A
></DT
><DT
>13.4.5. <A
-HREF="#AEN2290"
+HREF="#AEN2193"
>Job sent, no output</A
></DT
><DT
>13.4.6. <A
-HREF="#AEN2301"
+HREF="#AEN2204"
>Job sent, strange output</A
></DT
><DT
>13.4.7. <A
-HREF="#AEN2313"
+HREF="#AEN2216"
>Raw PostScript printed</A
></DT
><DT
>13.4.8. <A
-HREF="#AEN2316"
+HREF="#AEN2219"
>Advanced Printing</A
></DT
><DT
>13.4.9. <A
-HREF="#AEN2319"
+HREF="#AEN2222"
>Real debugging</A
></DT
></DL
@@ -8065,99 +7599,99 @@ HREF="#WINBIND"
><DL
><DT
>14.1. <A
-HREF="#AEN2360"
+HREF="#AEN2263"
>Abstract</A
></DT
><DT
>14.2. <A
-HREF="#AEN2364"
+HREF="#AEN2267"
>Introduction</A
></DT
><DT
>14.3. <A
-HREF="#AEN2377"
+HREF="#AEN2280"
>What Winbind Provides</A
></DT
><DD
><DL
><DT
>14.3.1. <A
-HREF="#AEN2384"
+HREF="#AEN2287"
>Target Uses</A
></DT
></DL
></DD
><DT
>14.4. <A
-HREF="#AEN2388"
+HREF="#AEN2291"
>How Winbind Works</A
></DT
><DD
><DL
><DT
>14.4.1. <A
-HREF="#AEN2393"
+HREF="#AEN2296"
>Microsoft Remote Procedure Calls</A
></DT
><DT
>14.4.2. <A
-HREF="#AEN2397"
+HREF="#AEN2300"
>Microsoft Active Directory Services</A
></DT
><DT
>14.4.3. <A
-HREF="#AEN2400"
+HREF="#AEN2303"
>Name Service Switch</A
></DT
><DT
>14.4.4. <A
-HREF="#AEN2416"
+HREF="#AEN2319"
>Pluggable Authentication Modules</A
></DT
><DT
>14.4.5. <A
-HREF="#AEN2424"
+HREF="#AEN2327"
>User and Group ID Allocation</A
></DT
><DT
>14.4.6. <A
-HREF="#AEN2428"
+HREF="#AEN2331"
>Result Caching</A
></DT
></DL
></DD
><DT
>14.5. <A
-HREF="#AEN2431"
+HREF="#AEN2334"
>Installation and Configuration</A
></DT
><DD
><DL
><DT
>14.5.1. <A
-HREF="#AEN2438"
+HREF="#AEN2341"
>Introduction</A
></DT
><DT
>14.5.2. <A
-HREF="#AEN2451"
+HREF="#AEN2354"
>Requirements</A
></DT
><DT
>14.5.3. <A
-HREF="#AEN2465"
+HREF="#AEN2368"
>Testing Things Out</A
></DT
></DL
></DD
><DT
>14.6. <A
-HREF="#AEN2680"
+HREF="#AEN2583"
>Limitations</A
></DT
><DT
>14.7. <A
-HREF="#AEN2690"
+HREF="#AEN2593"
>Conclusion</A
></DT
></DL
@@ -8171,66 +7705,66 @@ HREF="#IMPROVED-BROWSING"
><DL
><DT
>15.1. <A
-HREF="#AEN2700"
+HREF="#AEN2603"
>Overview of browsing</A
></DT
><DT
>15.2. <A
-HREF="#AEN2704"
+HREF="#AEN2608"
>Browsing support in samba</A
></DT
><DT
>15.3. <A
-HREF="#AEN2713"
+HREF="#AEN2616"
>Problem resolution</A
></DT
><DT
>15.4. <A
-HREF="#AEN2720"
+HREF="#AEN2625"
>Browsing across subnets</A
></DT
><DD
><DL
><DT
>15.4.1. <A
-HREF="#AEN2725"
+HREF="#AEN2630"
>How does cross subnet browsing work ?</A
></DT
></DL
></DD
><DT
>15.5. <A
-HREF="#AEN2760"
+HREF="#AEN2665"
>Setting up a WINS server</A
></DT
><DT
>15.6. <A
-HREF="#AEN2779"
+HREF="#AEN2684"
>Setting up Browsing in a WORKGROUP</A
></DT
><DT
>15.7. <A
-HREF="#AEN2797"
+HREF="#AEN2702"
>Setting up Browsing in a DOMAIN</A
></DT
><DT
>15.8. <A
-HREF="#AEN2807"
+HREF="#AEN2712"
>Forcing samba to be the master</A
></DT
><DT
>15.9. <A
-HREF="#AEN2816"
+HREF="#AEN2721"
>Making samba the domain master</A
></DT
><DT
>15.10. <A
-HREF="#AEN2834"
+HREF="#AEN2739"
>Note about broadcast addresses</A
></DT
><DT
>15.11. <A
-HREF="#AEN2837"
+HREF="#AEN2742"
>Multiple interfaces</A
></DT
></DL
@@ -8244,48 +7778,48 @@ HREF="#VFS"
><DL
><DT
>16.1. <A
-HREF="#AEN2855"
+HREF="#AEN2760"
>Introduction and configuration</A
></DT
><DT
>16.2. <A
-HREF="#AEN2864"
+HREF="#AEN2769"
>Included modules</A
></DT
><DD
><DL
><DT
>16.2.1. <A
-HREF="#AEN2866"
+HREF="#AEN2771"
>audit</A
></DT
><DT
>16.2.2. <A
-HREF="#AEN2874"
+HREF="#AEN2779"
>recycle</A
></DT
><DT
>16.2.3. <A
-HREF="#AEN2911"
+HREF="#AEN2816"
>netatalk</A
></DT
></DL
></DD
><DT
>16.3. <A
-HREF="#AEN2918"
+HREF="#AEN2823"
>VFS modules available elsewhere</A
></DT
><DD
><DL
><DT
>16.3.1. <A
-HREF="#AEN2922"
+HREF="#AEN2827"
>DatabaseFS</A
></DT
><DT
>16.3.2. <A
-HREF="#AEN2930"
+HREF="#AEN2835"
>vscan</A
></DT
></DL
@@ -8294,149 +7828,155 @@ HREF="#AEN2930"
></DD
><DT
>17. <A
-HREF="#CVS-ACCESS"
->Access Samba source code via CVS</A
-></DT
-><DD
-><DL
-><DT
->17.1. <A
-HREF="#AEN2942"
->Introduction</A
-></DT
-><DT
->17.2. <A
-HREF="#AEN2947"
->CVS Access to samba.org</A
-></DT
-><DD
-><DL
-><DT
->17.2.1. <A
-HREF="#AEN2950"
->Access via CVSweb</A
-></DT
-><DT
->17.2.2. <A
-HREF="#AEN2955"
->Access via cvs</A
-></DT
-></DL
-></DD
-></DL
-></DD
-><DT
->18. <A
HREF="#GROUPMAPPING"
>Group mapping HOWTO</A
></DT
><DT
->19. <A
+>18. <A
HREF="#SPEED"
>Samba performance issues</A
></DT
><DD
><DL
><DT
->19.1. <A
-HREF="#AEN3033"
+>18.1. <A
+HREF="#AEN2890"
>Comparisons</A
></DT
><DT
->19.2. <A
-HREF="#AEN3039"
+>18.2. <A
+HREF="#AEN2896"
>Socket options</A
></DT
><DT
->19.3. <A
-HREF="#AEN3046"
+>18.3. <A
+HREF="#AEN2903"
>Read size</A
></DT
><DT
->19.4. <A
-HREF="#AEN3051"
+>18.4. <A
+HREF="#AEN2908"
>Max xmit</A
></DT
><DT
->19.5. <A
-HREF="#AEN3056"
+>18.5. <A
+HREF="#AEN2913"
>Log level</A
></DT
><DT
->19.6. <A
-HREF="#AEN3059"
+>18.6. <A
+HREF="#AEN2916"
>Read raw</A
></DT
><DT
->19.7. <A
-HREF="#AEN3064"
+>18.7. <A
+HREF="#AEN2921"
>Write raw</A
></DT
><DT
->19.8. <A
-HREF="#AEN3068"
+>18.8. <A
+HREF="#AEN2925"
>Slow Clients</A
></DT
><DT
->19.9. <A
-HREF="#AEN3072"
+>18.9. <A
+HREF="#AEN2929"
>Slow Logins</A
></DT
><DT
->19.10. <A
-HREF="#AEN3075"
+>18.10. <A
+HREF="#AEN2932"
>Client tuning</A
></DT
></DL
></DD
><DT
->20. <A
+>19. <A
HREF="#GROUPPROFILES"
->Creating Group Profiles</A
+>Creating Group Prolicy Files</A
></DT
><DD
><DL
><DT
->20.1. <A
-HREF="#AEN3123"
+>19.1. <A
+HREF="#AEN2980"
>Windows '9x</A
></DT
><DT
->20.2. <A
-HREF="#AEN3132"
+>19.2. <A
+HREF="#AEN2990"
>Windows NT 4</A
></DT
><DD
><DL
><DT
->20.2.1. <A
-HREF="#AEN3155"
+>19.2.1. <A
+HREF="#AEN3013"
>Side bar Notes</A
></DT
><DT
->20.2.2. <A
-HREF="#AEN3159"
+>19.2.2. <A
+HREF="#AEN3017"
>Mandatory profiles</A
></DT
><DT
->20.2.3. <A
-HREF="#AEN3162"
+>19.2.3. <A
+HREF="#AEN3020"
>moveuser.exe</A
></DT
><DT
->20.2.4. <A
-HREF="#AEN3165"
+>19.2.4. <A
+HREF="#AEN3023"
>Get SID</A
></DT
></DL
></DD
><DT
->20.3. <A
-HREF="#AEN3170"
+>19.3. <A
+HREF="#AEN3028"
>Windows 2000/XP</A
></DT
></DL
></DD
+><DT
+>20. <A
+HREF="#SECURING-SAMBA"
+>Securing Samba</A
+></DT
+><DD
+><DL
+><DT
+>20.1. <A
+HREF="#AEN3109"
+>Introduction</A
+></DT
+><DT
+>20.2. <A
+HREF="#AEN3112"
+>Using host based protection</A
+></DT
+><DT
+>20.3. <A
+HREF="#AEN3119"
+>Using interface protection</A
+></DT
+><DT
+>20.4. <A
+HREF="#AEN3128"
+>Using a firewall</A
+></DT
+><DT
+>20.5. <A
+HREF="#AEN3135"
+>Using a IPC$ share deny</A
+></DT
+><DT
+>20.6. <A
+HREF="#AEN3144"
+>Upgrading Samba</A
+></DT
+></DL
+></DD
></DL
></DIV
></DIV
@@ -8452,9 +7992,9 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN1513"
-></A
->9.1. Agenda</H2
+NAME="AEN1416"
+>9.1. Agenda</A
+></H2
><P
>To identify the key functional mechanisms of MS Windows networking
to enable the deployment of Samba as a means of extending and/or
@@ -8519,9 +8059,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1535"
-></A
->9.2. Name Resolution in a pure Unix/Linux world</H2
+NAME="AEN1438"
+>9.2. Name Resolution in a pure Unix/Linux world</A
+></H2
><P
>The key configuration files covered in this section are:</P
><P
@@ -8561,11 +8101,11 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1551"
-></A
+NAME="AEN1454"
>9.2.1. <TT
CLASS="FILENAME"
>/etc/hosts</TT
+></A
></H3
><P
>Contains a static list of IP Addresses and names.
@@ -8642,11 +8182,11 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1567"
-></A
+NAME="AEN1470"
>9.2.2. <TT
CLASS="FILENAME"
>/etc/resolv.conf</TT
+></A
></H3
><P
>This file tells the name resolution libraries:</P
@@ -8680,11 +8220,11 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1578"
-></A
+NAME="AEN1481"
>9.2.3. <TT
CLASS="FILENAME"
>/etc/host.conf</TT
+></A
></H3
><P
><TT
@@ -8709,11 +8249,11 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1586"
-></A
+NAME="AEN1489"
>9.2.4. <TT
CLASS="FILENAME"
>/etc/nsswitch.conf</TT
+></A
></H3
><P
>This file controls the actual name resolution targets. The
@@ -8778,9 +8318,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1598"
-></A
->9.3. Name resolution as used within MS Windows networking</H2
+NAME="AEN1501"
+>9.3. Name resolution as used within MS Windows networking</A
+></H2
><P
>MS Windows networking is predicated about the name each machine
is given. This name is known variously (and inconsistently) as
@@ -8800,16 +8340,16 @@ the client/server.</P
><PRE
CLASS="PROGRAMLISTING"
> Unique NetBIOS Names:
- MACHINENAME&lt;00&gt; = Server Service is running on MACHINENAME
- MACHINENAME&lt;03&gt; = Generic Machine Name (NetBIOS name)
- MACHINENAME&lt;20&gt; = LanMan Server service is running on MACHINENAME
- WORKGROUP&lt;1b&gt; = Domain Master Browser
+ MACHINENAME&#60;00&#62; = Server Service is running on MACHINENAME
+ MACHINENAME&#60;03&#62; = Generic Machine Name (NetBIOS name)
+ MACHINENAME&#60;20&#62; = LanMan Server service is running on MACHINENAME
+ WORKGROUP&#60;1b&#62; = Domain Master Browser
Group Names:
- WORKGROUP&lt;03&gt; = Generic Name registered by all members of WORKGROUP
- WORKGROUP&lt;1c&gt; = Domain Controllers / Netlogon Servers
- WORKGROUP&lt;1d&gt; = Local Master Browsers
- WORKGROUP&lt;1e&gt; = Internet Name Resolvers</PRE
+ WORKGROUP&#60;03&#62; = Generic Name registered by all members of WORKGROUP
+ WORKGROUP&#60;1c&#62; = Domain Controllers / Netlogon Servers
+ WORKGROUP&#60;1d&#62; = Local Master Browsers
+ WORKGROUP&#60;1e&#62; = Internet Name Resolvers</PRE
></P
><P
>It should be noted that all NetBIOS machines register their own
@@ -8828,7 +8368,7 @@ be needed. An example of this is what happens when an MS Windows client
wants to locate a domain logon server. It find this service and the IP
address of a server that provides it by performing a lookup (via a
NetBIOS broadcast) for enumeration of all machines that have
-registered the name type *&lt;1c&gt;. A logon request is then sent to each
+registered the name type *&#60;1c&#62;. A logon request is then sent to each
IP address that is returned in the enumerated list of IP addresses. Which
ever machine first replies then ends up providing the logon services.</P
><P
@@ -8863,9 +8403,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1610"
-></A
->9.3.1. The NetBIOS Name Cache</H3
+NAME="AEN1513"
+>9.3.1. The NetBIOS Name Cache</A
+></H3
><P
>All MS Windows machines employ an in memory buffer in which is
stored the NetBIOS names and IP addresses for all external
@@ -8890,9 +8430,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1615"
-></A
->9.3.2. The LMHOSTS file</H3
+NAME="AEN1518"
+>9.3.2. The LMHOSTS file</A
+></H3
><P
>This file is usually located in MS Windows NT 4.0 or
2000 in <TT
@@ -8927,8 +8467,8 @@ CLASS="PROGRAMLISTING"
# files and offers the following extensions:
#
# #PRE
- # #DOM:&lt;domain&gt;
- # #INCLUDE &lt;filename&gt;
+ # #DOM:&#60;domain&#62;
+ # #INCLUDE &#60;filename&#62;
# #BEGIN_ALTERNATE
# #END_ALTERNATE
# \0xnn (non-printing character support)
@@ -8937,16 +8477,16 @@ CLASS="PROGRAMLISTING"
# the entry to be preloaded into the name cache. By default, entries are
# not preloaded, but are parsed only after dynamic name resolution fails.
#
- # Following an entry with the "#DOM:&lt;domain&gt;" tag will associate the
- # entry with the domain specified by &lt;domain&gt;. This affects how the
+ # Following an entry with the "#DOM:&#60;domain&#62;" tag will associate the
+ # entry with the domain specified by &#60;domain&#62;. This affects how the
# browser and logon services behave in TCP/IP environments. To preload
# the host name associated with #DOM entry, it is necessary to also add a
- # #PRE to the line. The &lt;domain&gt; is always preloaded although it will not
+ # #PRE to the line. The &#60;domain&#62; is always preloaded although it will not
# be shown when the name cache is viewed.
#
- # Specifying "#INCLUDE &lt;filename&gt;" will force the RFC NetBIOS (NBT)
- # software to seek the specified &lt;filename&gt; and parse it as if it were
- # local. &lt;filename&gt; is generally a UNC-based name, allowing a
+ # Specifying "#INCLUDE &#60;filename&#62;" will force the RFC NetBIOS (NBT)
+ # software to seek the specified &#60;filename&#62; and parse it as if it were
+ # local. &#60;filename&#62; is generally a UNC-based name, allowing a
# centralized lmhosts file to be maintained on a server.
# It is ALWAYS necessary to provide a mapping for the IP address of the
# server prior to the #INCLUDE. This mapping must use the #PRE directive.
@@ -8993,9 +8533,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1623"
-></A
->9.3.3. HOSTS file</H3
+NAME="AEN1526"
+>9.3.3. HOSTS file</A
+></H3
><P
>This file is usually located in MS Windows NT 4.0 or 2000 in
<TT
@@ -9015,9 +8555,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1628"
-></A
->9.3.4. DNS Lookup</H3
+NAME="AEN1531"
+>9.3.4. DNS Lookup</A
+></H3
><P
>This capability is configured in the TCP/IP setup area in the network
configuration facility. If enabled an elaborate name resolution sequence
@@ -9035,9 +8575,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1631"
-></A
->9.3.5. WINS Lookup</H3
+NAME="AEN1534"
+>9.3.5. WINS Lookup</A
+></H3
><P
>A WINS (Windows Internet Name Server) service is the equivaent of the
rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores
@@ -9064,11 +8604,9 @@ CLASS="PROGRAMLISTING"
wins server = xxx.xxx.xxx.xxx</PRE
></P
><P
->where <TT
+>where <VAR
CLASS="REPLACEABLE"
-><I
->xxx.xxx.xxx.xxx</I
-></TT
+>xxx.xxx.xxx.xxx</VAR
> is the IP address
of the WINS server.</P
></DIV
@@ -9078,10 +8616,10 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1643"
-></A
+NAME="AEN1546"
>9.4. How browsing functions and how to deploy stable and
-dependable browsing using Samba</H2
+dependable browsing using Samba</A
+></H2
><P
>As stated above, MS Windows machines register their NetBIOS names
(i.e.: the machine name for each service type in operation) on start
@@ -9145,10 +8683,10 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1653"
-></A
+NAME="AEN1556"
>9.5. MS Windows security options and how to configure
-Samba for seemless integration</H2
+Samba for seemless integration</A
+></H2
><P
>MS Windows clients may use encrypted passwords as part of a
challenege/response authentication model (a.k.a. NTLMv1) or
@@ -9217,43 +8755,35 @@ CLASS="PROGRAMLISTING"
HREF="smb.conf.5.html#PASSWORDLEVEL"
TARGET="_top"
>passsword level</A
-> = <TT
+> = <VAR
CLASS="REPLACEABLE"
-><I
->integer</I
-></TT
+>integer</VAR
>
<A
HREF="smb.conf.5.html#USERNAMELEVEL"
TARGET="_top"
>username level</A
-> = <TT
+> = <VAR
CLASS="REPLACEABLE"
-><I
->integer</I
-></TT
+>integer</VAR
></PRE
></P
><P
>By default Samba will lower case the username before attempting
to lookup the user in the database of local system accounts.
Because UNIX usernames conventionally only contain lower case
-character, the <TT
+character, the <VAR
CLASS="PARAMETER"
-><I
->username level</I
-></TT
+>username level</VAR
> parameter
is rarely even needed.</P
><P
>However, password on UNIX systems often make use of mixed case
characters. This means that in order for a user on a Windows 9x
client to connect to a Samba server using clear text authentication,
-the <TT
+the <VAR
CLASS="PARAMETER"
-><I
->password level</I
-></TT
+>password level</VAR
> must be set to the maximum
number of upper case letter which <SPAN
CLASS="emphasis"
@@ -9263,11 +8793,9 @@ CLASS="EMPHASIS"
></SPAN
> appear
is a password. Note that is the server OS uses the traditional
-DES version of crypt(), then a <TT
+DES version of crypt(), then a <VAR
CLASS="PARAMETER"
-><I
->password level</I
-></TT
+>password level</VAR
>
of 8 will result in case insensitive passwords as seen from Windows
users. This will also result in longer login times as Samba
@@ -9282,9 +8810,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1681"
-></A
->9.5.1. Use MS Windows NT as an authentication server</H3
+NAME="AEN1584"
+>9.5.1. Use MS Windows NT as an authentication server</A
+></H3
><P
>This method involves the additions of the following parameters
in the smb.conf file:</P
@@ -9318,9 +8846,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1689"
-></A
->9.5.2. Make Samba a member of an MS Windows NT security domain</H3
+NAME="AEN1592"
+>9.5.2. Make Samba a member of an MS Windows NT security domain</A
+></H3
><P
>This method involves additon of the following paramters in the smb.conf file:</P
><P
@@ -9381,9 +8909,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1706"
-></A
->9.5.3. Configure Samba as an authentication server</H3
+NAME="AEN1609"
+>9.5.3. Configure Samba as an authentication server</A
+></H3
><P
>This mode of authentication demands that there be on the
Unix/Linux system both a Unix style account as well as an
@@ -9418,9 +8946,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN1713"
-></A
->9.5.3.1. Users</H4
+NAME="AEN1616"
+>9.5.3.1. Users</A
+></H4
><P
>A user account that may provide a home directory should be
created. The following Linux system commands are typical of
@@ -9430,10 +8958,10 @@ the procedure for creating an account.</P
CLASS="PROGRAMLISTING"
> # useradd -s /bin/bash -d /home/"userid" -m "userid"
# passwd "userid"
- Enter Password: &lt;pw&gt;
+ Enter Password: &#60;pw&#62;
# smbpasswd -a "userid"
- Enter Password: &lt;pw&gt;</PRE
+ Enter Password: &#60;pw&#62;</PRE
></P
></DIV
><DIV
@@ -9441,9 +8969,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN1718"
-></A
->9.5.3.2. MS Windows NT Machine Accounts</H4
+NAME="AEN1621"
+>9.5.3.2. MS Windows NT Machine Accounts</A
+></H4
><P
>These are required only when Samba is used as a domain
controller. Refer to the Samba-PDC-HOWTO for more details.</P
@@ -9462,9 +8990,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1723"
-></A
->9.6. Conclusions</H2
+NAME="AEN1626"
+>9.6. Conclusions</A
+></H2
><P
>Samba provides a flexible means to operate as...</P
><P
@@ -9506,10 +9034,10 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN1744"
-></A
+NAME="AEN1647"
>10.1. Viewing and changing UNIX permissions using the NT
- security dialogs</H2
+ security dialogs</A
+></H2
><P
>New in the Samba 2.0.4 release is the ability for Windows
NT clients to use their native security settings dialog box to
@@ -9525,9 +9053,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1748"
-></A
->10.2. How to view file security on a Samba share</H2
+NAME="AEN1651"
+>10.2. How to view file security on a Samba share</A
+></H2
><P
>From an NT 4.0 client, single-click with the right
mouse button on any file or directory in a Samba mounted
@@ -9595,9 +9123,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1759"
-></A
->10.3. Viewing file ownership</H2
+NAME="AEN1662"
+>10.3. Viewing file ownership</A
+></H2
><P
>Clicking on the <B
CLASS="COMMAND"
@@ -9611,23 +9139,17 @@ CLASS="COMMAND"
>"SERVER\user (Long name)"</B
></P
><P
->Where <TT
+>Where <VAR
CLASS="REPLACEABLE"
-><I
->SERVER</I
-></TT
+>SERVER</VAR
> is the NetBIOS name of
- the Samba server, <TT
+ the Samba server, <VAR
CLASS="REPLACEABLE"
-><I
->user</I
-></TT
+>user</VAR
> is the user name of
- the UNIX user who owns the file, and <TT
+ the UNIX user who owns the file, and <VAR
CLASS="REPLACEABLE"
-><I
->(Long name)</I
-></TT
+>(Long name)</VAR
>
is the descriptive string identifying the user (normally found in the
GECOS field of the UNIX password database). Click on the <B
@@ -9636,15 +9158,13 @@ CLASS="COMMAND"
</B
> button to remove this dialog.</P
><P
->If the parameter <TT
+>If the parameter <VAR
CLASS="PARAMETER"
-><I
->nt acl support</I
-></TT
+>nt acl support</VAR
>
- is set to <TT
+ is set to <CODE
CLASS="CONSTANT"
->false</TT
+>false</CODE
> then the file owner will
be shown as the NT user <B
CLASS="COMMAND"
@@ -9689,9 +9209,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1779"
-></A
->10.4. Viewing file or directory permissions</H2
+NAME="AEN1682"
+>10.4. Viewing file or directory permissions</A
+></H2
><P
>The third button is the <B
CLASS="COMMAND"
@@ -9706,36 +9226,28 @@ CLASS="COMMAND"
>"SERVER\user (Long name)"</B
></P
><P
->Where <TT
+>Where <VAR
CLASS="REPLACEABLE"
-><I
->SERVER</I
-></TT
+>SERVER</VAR
> is the NetBIOS name of
- the Samba server, <TT
+ the Samba server, <VAR
CLASS="REPLACEABLE"
-><I
->user</I
-></TT
+>user</VAR
> is the user name of
- the UNIX user who owns the file, and <TT
+ the UNIX user who owns the file, and <VAR
CLASS="REPLACEABLE"
-><I
->(Long name)</I
-></TT
+>(Long name)</VAR
>
is the descriptive string identifying the user (normally found in the
GECOS field of the UNIX password database).</P
><P
->If the parameter <TT
+>If the parameter <VAR
CLASS="PARAMETER"
-><I
->nt acl support</I
-></TT
+>nt acl support</VAR
>
- is set to <TT
+ is set to <CODE
CLASS="CONSTANT"
->false</TT
+>false</CODE
> then the file owner will
be shown as the NT user <B
CLASS="COMMAND"
@@ -9751,9 +9263,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1794"
-></A
->10.4.1. File Permissions</H3
+NAME="AEN1697"
+>10.4.1. File Permissions</A
+></H3
><P
>The standard UNIX user/group/world triple and
the corresponding "read", "write", "execute" permissions
@@ -9813,9 +9325,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN1808"
-></A
->10.4.2. Directory Permissions</H3
+NAME="AEN1711"
+>10.4.2. Directory Permissions</A
+></H3
><P
>Directories on an NT NTFS file system have two
different sets of permissions. The first set of permissions
@@ -9845,9 +9357,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1815"
-></A
->10.5. Modifying file or directory permissions</H2
+NAME="AEN1718"
+>10.5. Modifying file or directory permissions</A
+></H2
><P
>Modifying file and directory permissions is as simple
as changing the displayed permissions in the dialog box, and
@@ -9859,15 +9371,13 @@ CLASS="COMMAND"
with the standard Samba permission masks and mapping of DOS
attributes that need to also be taken into account.</P
><P
->If the parameter <TT
+>If the parameter <VAR
CLASS="PARAMETER"
-><I
->nt acl support</I
-></TT
+>nt acl support</VAR
>
- is set to <TT
+ is set to <CODE
CLASS="CONSTANT"
->false</TT
+>false</CODE
> then any attempt to set
security permissions will fail with an <B
CLASS="COMMAND"
@@ -9943,40 +9453,32 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1837"
-></A
+NAME="AEN1740"
>10.6. Interaction with the standard Samba create mask
- parameters</H2
+ parameters</A
+></H2
><P
>Note that with Samba 2.0.5 there are four new parameters
to control this interaction. These are :</P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->security mask</I
-></TT
+>security mask</VAR
></P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->force security mode</I
-></TT
+>force security mode</VAR
></P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->directory security mask</I
-></TT
+>directory security mask</VAR
></P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->force directory security mode</I
-></TT
+>force directory security mode</VAR
></P
><P
>Once a user clicks <B
@@ -9989,21 +9491,17 @@ CLASS="COMMAND"
HREF="smb.conf.5.html#SECURITYMASK"
TARGET="_top"
>
- <TT
+ <VAR
CLASS="PARAMETER"
-><I
->security mask</I
-></TT
+>security mask</VAR
></A
> parameter. Any bits that
were changed that are not set to '1' in this parameter are left alone
in the file permissions.</P
><P
->Essentially, zero bits in the <TT
+>Essentially, zero bits in the <VAR
CLASS="PARAMETER"
-><I
->security mask</I
-></TT
+>security mask</VAR
>
mask may be treated as a set of bits the user is <SPAN
CLASS="emphasis"
@@ -10019,12 +9517,10 @@ CLASS="EMPHASIS"
the <A
HREF="smb.conf.5.html#CREATEMASK"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
>create mask
- </I
-></TT
+ </VAR
></A
> parameter to provide compatibility with Samba 2.0.4
where this permission change facility was introduced. To allow a user to
@@ -10035,22 +9531,18 @@ CLASS="PARAMETER"
the bits set in the <A
HREF="smb.conf.5.html#FORCESECURITYMODE"
TARGET="_top"
-> <TT
+> <VAR
CLASS="PARAMETER"
-><I
->force security mode</I
-></TT
+>force security mode</VAR
></A
> parameter. Any bits
that were changed that correspond to bits set to '1' in this parameter
are forced to be set.</P
><P
->Essentially, bits set in the <TT
+>Essentially, bits set in the <VAR
CLASS="PARAMETER"
-><I
>force security mode
- </I
-></TT
+ </VAR
> parameter may be treated as a set of bits that, when
modifying security on a file, the user has always set to be 'on'.</P
><P
@@ -10058,82 +9550,60 @@ CLASS="PARAMETER"
as the <A
HREF="smb.conf.5.html#FORCECREATEMODE"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
>force
- create mode</I
-></TT
+ create mode</VAR
></A
> parameter to provide compatibility
with Samba 2.0.4 where the permission change facility was introduced.
To allow a user to modify all the user/group/world permissions on a file
with no restrictions set this parameter to 000.</P
><P
->The <TT
+>The <VAR
CLASS="PARAMETER"
-><I
->security mask</I
-></TT
-> and <TT
+>security mask</VAR
+> and <VAR
CLASS="PARAMETER"
-><I
>force
- security mode</I
-></TT
+ security mode</VAR
> parameters are applied to the change
request in that order.</P
><P
>For a directory Samba will perform the same operations as
- described above for a file except using the parameter <TT
+ described above for a file except using the parameter <VAR
CLASS="PARAMETER"
-><I
-> directory security mask</I
-></TT
-> instead of <TT
+> directory security mask</VAR
+> instead of <VAR
CLASS="PARAMETER"
-><I
>security
- mask</I
-></TT
->, and <TT
+ mask</VAR
+>, and <VAR
CLASS="PARAMETER"
-><I
>force directory security mode
- </I
-></TT
-> parameter instead of <TT
+ </VAR
+> parameter instead of <VAR
CLASS="PARAMETER"
-><I
>force security mode
- </I
-></TT
+ </VAR
>.</P
><P
->The <TT
+>The <VAR
CLASS="PARAMETER"
-><I
->directory security mask</I
-></TT
+>directory security mask</VAR
> parameter
- by default is set to the same value as the <TT
+ by default is set to the same value as the <VAR
CLASS="PARAMETER"
-><I
>directory mask
- </I
-></TT
-> parameter and the <TT
+ </VAR
+> parameter and the <VAR
CLASS="PARAMETER"
-><I
>force directory security
- mode</I
-></TT
+ mode</VAR
> parameter by default is set to the same value as
- the <TT
+ the <VAR
CLASS="PARAMETER"
-><I
->force directory mode</I
-></TT
+>force directory mode</VAR
> parameter to provide
compatibility with Samba 2.0.4 where the permission change facility
was introduced.</P
@@ -10155,62 +9625,46 @@ CLASS="FILENAME"
></A
> file in that share specific section :</P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->security mask = 0777</I
-></TT
+>security mask = 0777</VAR
></P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->force security mode = 0</I
-></TT
+>force security mode = 0</VAR
></P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->directory security mask = 0777</I
-></TT
+>directory security mask = 0777</VAR
></P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->force directory security mode = 0</I
-></TT
+>force directory security mode = 0</VAR
></P
><P
>As described, in Samba 2.0.4 the parameters :</P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->create mask</I
-></TT
+>create mask</VAR
></P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->force create mode</I
-></TT
+>force create mode</VAR
></P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->directory mask</I
-></TT
+>directory mask</VAR
></P
><P
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->force directory mode</I
-></TT
+>force directory mode</VAR
></P
><P
>were used instead of the parameters discussed here.</P
@@ -10220,10 +9674,10 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1901"
-></A
+NAME="AEN1804"
>10.7. Interaction with the standard Samba file attribute
- mapping</H2
+ mapping</A
+></H2
><P
>Samba maps some of the DOS attribute bits (such as "read
only") into the UNIX permissions of a file. This means there can
@@ -10276,9 +9730,9 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN1922"
-></A
->11.1. Samba and PAM</H2
+NAME="AEN1825"
+>11.1. Samba and PAM</A
+></H2
><P
>A number of Unix systems (eg: Sun Solaris), as well as the
xxxxBSD family and Linux, now utilize the Pluggable Authentication
@@ -10490,9 +9944,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1966"
-></A
->11.2. Distributed Authentication</H2
+NAME="AEN1869"
+>11.2. Distributed Authentication</A
+></H2
><P
>The astute administrator will realize from this that the
combination of <TT
@@ -10523,9 +9977,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN1973"
-></A
->11.3. PAM Configuration in smb.conf</H2
+NAME="AEN1876"
+>11.3. PAM Configuration in smb.conf</A
+></H2
><P
>There is an option in smb.conf called <A
HREF="smb.conf.5.html#OBEYPAMRESTRICTIONS"
@@ -10535,9 +9989,9 @@ TARGET="_top"
The following is from the on-line help for this option in SWAT;</P
><P
>When Samba 2.2 is configure to enable PAM support (i.e.
-<TT
+<CODE
CLASS="CONSTANT"
->--with-pam</TT
+>--with-pam</CODE
>), this parameter will
control whether or not Samba should obey PAM's account
and session management directives. The default behavior
@@ -10571,9 +10025,9 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN1993"
-></A
->12.1. Instructions</H2
+NAME="AEN1896"
+>12.1. Instructions</A
+></H2
><P
>The Distributed File System (or Dfs) provides a means of
separating the logical view of files and directories that users
@@ -10589,21 +10043,17 @@ TARGET="_top"
machine (for Dfs-aware clients to browse) using Samba.</P
><P
>To enable SMB-based DFS for Samba, configure it with the
- <TT
+ <VAR
CLASS="PARAMETER"
-><I
->--with-msdfs</I
-></TT
+>--with-msdfs</VAR
> option. Once built, a
Samba server can be made a Dfs server by setting the global
boolean <A
HREF="smb.conf.5.html#HOSTMSDFS"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
-> host msdfs</I
-></TT
+> host msdfs</VAR
></A
> parameter in the <TT
CLASS="FILENAME"
@@ -10613,18 +10063,16 @@ CLASS="FILENAME"
level boolean <A
HREF="smb.conf.5.html#MSDFSROOT"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
-> msdfs root</I
-></TT
+> msdfs root</VAR
></A
> parameter. A Dfs root directory on
Samba hosts Dfs links in the form of symbolic links that point
to other servers. For example, a symbolic link
<TT
CLASS="FILENAME"
->junction-&gt;msdfs:storage1\share1</TT
+>junction-&#62;msdfs:storage1\share1</TT
> in
the share directory acts as the Dfs junction. When Dfs-aware
clients attempt to access the junction link, they are redirected
@@ -10652,54 +10100,44 @@ CLASS="PROGRAMLISTING"
>In the /export/dfsroot directory we set up our dfs links to
other servers on the network.</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root# </TT
-><TT
+>root# </SAMP
+><KBD
CLASS="USERINPUT"
-><B
->cd /export/dfsroot</B
-></TT
+>cd /export/dfsroot</KBD
></P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root# </TT
-><TT
+>root# </SAMP
+><KBD
CLASS="USERINPUT"
-><B
->chown root /export/dfsroot</B
-></TT
+>chown root /export/dfsroot</KBD
></P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root# </TT
-><TT
+>root# </SAMP
+><KBD
CLASS="USERINPUT"
-><B
->chmod 755 /export/dfsroot</B
-></TT
+>chmod 755 /export/dfsroot</KBD
></P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root# </TT
-><TT
+>root# </SAMP
+><KBD
CLASS="USERINPUT"
-><B
->ln -s msdfs:storageA\\shareA linka</B
-></TT
+>ln -s msdfs:storageA\\shareA linka</KBD
></P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root# </TT
-><TT
+>root# </SAMP
+><KBD
CLASS="USERINPUT"
-><B
->ln -s msdfs:serverB\\share,serverC\\share linkb</B
-></TT
+>ln -s msdfs:serverB\\share,serverC\\share linkb</KBD
></P
><P
>You should set up the permissions and ownership of
@@ -10719,9 +10157,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2028"
-></A
->12.1.1. Notes</H3
+NAME="AEN1931"
+>12.1.1. Notes</A
+></H3
><P
></P
><UL
@@ -10760,9 +10198,9 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN2054"
-></A
->13.1. Introduction</H2
+NAME="AEN1957"
+>13.1. Introduction</A
+></H2
><P
>Beginning with the 2.2.0 release, Samba supports
the native Windows NT printing mechanisms implemented via
@@ -10843,9 +10281,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2076"
-></A
->13.2. Configuration</H2
+NAME="AEN1979"
+>13.2. Configuration</A
+></H2
><DIV
CLASS="WARNING"
><P
@@ -10884,19 +10322,15 @@ a printer$ service which provides read-only access via no
password in order to support printer driver downloads.</P
><P
>However, the initial implementation allowed for a
-parameter named <TT
+parameter named <VAR
CLASS="PARAMETER"
-><I
->printer driver location</I
-></TT
+>printer driver location</VAR
>
to be used on a per share basis to specify the location of
the driver files associated with that printer. Another
-parameter named <TT
+parameter named <VAR
CLASS="PARAMETER"
-><I
->printer driver</I
-></TT
+>printer driver</VAR
> provided
a means of defining the printer driver name to be sent to
the client.</P
@@ -10909,9 +10343,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2084"
-></A
->13.2.1. Creating [print$]</H3
+NAME="AEN1987"
+>13.2.1. Creating [print$]</A
+></H3
><P
>In order to support the uploading of printer driver
files, you must first configure a file share named [print$].
@@ -10950,11 +10384,9 @@ CLASS="PROGRAMLISTING"
>The <A
HREF="smb.conf.5.html#WRITELIST"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->write list</I
-></TT
+>write list</VAR
></A
> is used to allow administrative
level user accounts to have write access in order to update files
@@ -11094,12 +10526,10 @@ one of two conditions must hold true:</P
must be a member of the <A
HREF="smb.conf.5.html#PRINTERADMIN"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
>printer
- admin</I
-></TT
+ admin</VAR
></A
> list.</P
></LI
@@ -11115,11 +10545,9 @@ that all file shares are set to 'read only' by default.</P
><P
>Once you have created the required [print$] service and
associated subdirectories, simply log onto the Samba server using
-a root (or <TT
+a root (or <VAR
CLASS="PARAMETER"
-><I
->printer admin</I
-></TT
+>printer admin</VAR
>) account
from a Windows NT 4.0/2k client. Open "Network Neighbourhood" or
"My Network Places" and browse for the Samba host. Once you have located
@@ -11132,9 +10560,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2119"
-></A
->13.2.2. Setting Drivers for Existing Printers</H3
+NAME="AEN2022"
+>13.2.2. Setting Drivers for Existing Printers</A
+></H3
><P
>The initial listing of printers in the Samba host's
Printers folder will have no real printer driver assigned
@@ -11204,9 +10632,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2135"
-></A
->13.2.3. Support a large number of printers</H3
+NAME="AEN2038"
+>13.2.3. Support a large number of printers</A
+></H3
><P
>One issue that has arisen during the development
phase of Samba 2.2 is the need to support driver downloads for
@@ -11227,9 +10655,9 @@ of how this could be accomplished:</P
><PRE
CLASS="PROGRAMLISTING"
>
-<TT
+<SAMP
CLASS="PROMPT"
->$ </TT
+>$ </SAMP
>rpcclient pogo -U root%secret -c "enumdrivers"
Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
@@ -11243,9 +10671,9 @@ Printer Driver Info 1:
Printer Driver Info 1:
Driver Name: [HP LaserJet 4Si/4SiMX PS]
-<TT
+<SAMP
CLASS="PROMPT"
->$ </TT
+>$ </SAMP
>rpcclient pogo -U root%secret -c "enumprinters"
Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
flags:[0x800000]
@@ -11253,13 +10681,13 @@ Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
description:[POGO\\POGO\hp-print,NO DRIVER AVAILABLE FOR THIS PRINTER,]
comment:[]
-<TT
+<SAMP
CLASS="PROMPT"
->$ </TT
+>$ </SAMP
>rpcclient pogo -U root%secret \
-<TT
+<SAMP
CLASS="PROMPT"
->&gt; </TT
+>&#62; </SAMP
> -c "setdriver hp-print \"HP LaserJet 4000 Series PS\""
Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
Successfully set hp-print to driver HP LaserJet 4000 Series PS.</PRE
@@ -11270,9 +10698,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2146"
-></A
->13.2.4. Adding New Printers via the Windows NT APW</H3
+NAME="AEN2049"
+>13.2.4. Adding New Printers via the Windows NT APW</A
+></H3
><P
>By default, Samba offers all printer shares defined in <TT
CLASS="FILENAME"
@@ -11287,11 +10715,9 @@ Add Printer Wizard icon. The APW will be show only if</P
><P
>The connected user is able to successfully
execute an OpenPrinterEx(\\server) with administrative
- privileges (i.e. root or <TT
+ privileges (i.e. root or <VAR
CLASS="PARAMETER"
-><I
->printer admin</I
-></TT
+>printer admin</VAR
>).
</P
></LI
@@ -11300,12 +10726,10 @@ CLASS="PARAMETER"
><A
HREF="smb.conf.5.html#SHOWADDPRINTERWIZARD"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
>show
- add printer wizard = yes</I
-></TT
+ add printer wizard = yes</VAR
></A
> (the default).
</P
@@ -11316,12 +10740,10 @@ CLASS="PARAMETER"
server, the <A
HREF="smb.conf.5.html#ADDPRINTERCOMMAND"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
>add
-printer command</I
-></TT
+printer command</VAR
></A
> must have a defined value. The program
hook must successfully add the printer to the system (i.e.
@@ -11338,35 +10760,29 @@ CLASS="FILENAME"
not exist, <B
CLASS="COMMAND"
>smbd</B
-> will execute the <TT
+> will execute the <VAR
CLASS="PARAMETER"
-><I
>add printer
-command</I
-></TT
+command</VAR
> and reparse to the <TT
CLASS="FILENAME"
>smb.conf</TT
>
to attempt to locate the new printer share. If the share is still not defined,
an error of "Access Denied" is returned to the client. Note that the
-<TT
+<VAR
CLASS="PARAMETER"
-><I
->add printer program</I
-></TT
+>add printer program</VAR
> is executed under the context
of the connected user, not necessarily a root account.</P
><P
>There is a complementary <A
HREF="smb.conf.5.html#DELETEPRINTERCOMMAND"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
>delete
-printer command</I
-></TT
+printer command</VAR
></A
> for removing entries from the "Printers..."
folder.</P
@@ -11374,11 +10790,9 @@ folder.</P
>The following is an example <A
HREF="smb.conf.5.html#ADDPRINTERCOMMAN"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
->add printer command</I
-></TT
+>add printer command</VAR
></A
> script. It adds the appropriate entries to <TT
CLASS="FILENAME"
@@ -11413,8 +10827,8 @@ echo " :sd=/var/spool/lpd/$2:\\" &#62;&#62; $PRINTCAP
echo " :mx=0:ml=0:sh:\\" &#62;&#62; $PRINTCAP
echo " :lp=/usr/local/samba/var/print/$5.prn:" &#62;&#62; $PRINTCAP
-touch "/usr/local/samba/var/print/$5.prn" &#62;&#62; /tmp/printadd.$$ 2&#62;&amp;1
-chown $LP "/usr/local/samba/var/print/$5.prn" &#62;&#62; /tmp/printadd.$$ 2&#62;&amp;1
+touch "/usr/local/samba/var/print/$5.prn" &#62;&#62; /tmp/printadd.$$ 2&#62;&#38;1
+chown $LP "/usr/local/samba/var/print/$5.prn" &#62;&#62; /tmp/printadd.$$ 2&#62;&#38;1
mkdir /var/spool/lpd/$2
chmod 700 /var/spool/lpd/$2
@@ -11439,9 +10853,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2176"
-></A
->13.2.5. Samba and Printer Ports</H3
+NAME="AEN2079"
+>13.2.5. Samba and Printer Ports</A
+></H3
><P
>Windows NT/2000 print servers associate a port with each printer. These normally
take the form of LPT1:, COM1:, FILE:, etc... Samba must also support the
@@ -11460,12 +10874,10 @@ CLASS="FILENAME"
> possesses a <A
HREF="smb.conf.5.html#ENUMPORTSCOMMAND"
TARGET="_top"
-><TT
+><VAR
CLASS="PARAMETER"
-><I
>enumports
-command</I
-></TT
+command</VAR
></A
> which can be used to define an external program
that generates a listing of ports on a system.</P
@@ -11476,9 +10888,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2184"
-></A
->13.3. The Imprints Toolset</H2
+NAME="AEN2087"
+>13.3. The Imprints Toolset</A
+></H2
><P
>The Imprints tool set provides a UNIX equivalent of the
Windows NT Add Printer Wizard. For complete information, please
@@ -11494,9 +10906,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2188"
-></A
->13.3.1. What is Imprints?</H3
+NAME="AEN2091"
+>13.3.1. What is Imprints?</A
+></H3
><P
>Imprints is a collection of tools for supporting the goals
of</P
@@ -11526,9 +10938,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2198"
-></A
->13.3.2. Creating Printer Driver Packages</H3
+NAME="AEN2101"
+>13.3.2. Creating Printer Driver Packages</A
+></H3
><P
>The process of creating printer driver packages is beyond
the scope of this document (refer to Imprints.txt also included
@@ -11542,9 +10954,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2201"
-></A
->13.3.3. The Imprints server</H3
+NAME="AEN2104"
+>13.3.3. The Imprints server</A
+></H3
><P
>The Imprints server is really a database server that
may be queried via standard HTTP mechanisms. Each printer
@@ -11566,9 +10978,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2205"
-></A
->13.3.4. The Installation Client</H3
+NAME="AEN2108"
+>13.3.4. The Installation Client</A
+></H3
><P
>More information regarding the Imprints installation client
is available in the <TT
@@ -11660,17 +11072,17 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2227"
-></A
->13.4. Diagnosis</H2
+NAME="AEN2130"
+>13.4. Diagnosis</A
+></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
-NAME="AEN2229"
-></A
->13.4.1. Introduction</H3
+NAME="AEN2132"
+>13.4.1. Introduction</A
+></H3
><P
>This is a short description of how to debug printing problems with
Samba. This describes how to debug problems with printing from a SMB
@@ -11732,7 +11144,7 @@ and it should be periodically cleaned out. Samba used the lpq
command to determine the "job number" assigned to your print job
by the spooler.</P
><P
->The %&gt;letter&lt; are "macros" that get dynamically replaced with appropriate
+>The %&#62;letter&#60; are "macros" that get dynamically replaced with appropriate
values when they are used. The %s gets replaced with the name of the spool
file that Samba creates and the %p gets replaced with the name of the
printer. The %j gets replaced with the "job number" which comes from
@@ -11743,9 +11155,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2245"
-></A
->13.4.2. Debugging printer problems</H3
+NAME="AEN2148"
+>13.4.2. Debugging printer problems</A
+></H3
><P
>One way to debug printing problems is to start by replacing these
command with shell scripts that record the arguments and the contents
@@ -11761,7 +11173,7 @@ CLASS="PROGRAMLISTING"
/usr/bin/id -p &#62;/tmp/tmp.print
# we run the command and save the error messages
# replace the command with the one appropriate for your system
- /usr/bin/lpr -r -P$1 $2 2&#62;&#62;&amp;/tmp/tmp.print</PRE
+ /usr/bin/lpr -r -P$1 $2 2&#62;&#62;&#38;/tmp/tmp.print</PRE
></P
><P
>Then you print a file and try removing it. You may find that the
@@ -11800,9 +11212,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2254"
-></A
->13.4.3. What printers do I have?</H3
+NAME="AEN2157"
+>13.4.3. What printers do I have?</A
+></H3
><P
>You can use the 'testprns' program to check to see if the printer
name you are using is recognized by Samba. For example, you can
@@ -11829,9 +11241,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2262"
-></A
->13.4.4. Setting up printcap and print servers</H3
+NAME="AEN2165"
+>13.4.4. Setting up printcap and print servers</A
+></H3
><P
>You may need to set up some printcaps for your Samba system to use.
It is strongly recommended that you use the facilities provided by
@@ -11913,9 +11325,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2290"
-></A
->13.4.5. Job sent, no output</H3
+NAME="AEN2193"
+>13.4.5. Job sent, no output</A
+></H3
><P
>This is the most frustrating part of printing. You may have sent the
job, verified that the job was forwarded, set up a wrapper around
@@ -11958,9 +11370,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2301"
-></A
->13.4.6. Job sent, strange output</H3
+NAME="AEN2204"
+>13.4.6. Job sent, strange output</A
+></H3
><P
>Once you have the job printing, you can then start worrying about
making it print nicely.</P
@@ -12004,9 +11416,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2313"
-></A
->13.4.7. Raw PostScript printed</H3
+NAME="AEN2216"
+>13.4.7. Raw PostScript printed</A
+></H3
><P
>This is a problem that is usually caused by either the print spooling
system putting information at the start of the print job that makes
@@ -12019,9 +11431,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2316"
-></A
->13.4.8. Advanced Printing</H3
+NAME="AEN2219"
+>13.4.8. Advanced Printing</A
+></H3
><P
>Note that you can do some pretty magic things by using your
imagination with the "print command" option and some shell scripts.
@@ -12035,9 +11447,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2319"
-></A
->13.4.9. Real debugging</H3
+NAME="AEN2222"
+>13.4.9. Real debugging</A
+></H3
><P
>If the above debug tips don't help, then maybe you need to bring in
the bug guns, system tracing. See Tracing.txt in this directory.</P
@@ -12056,9 +11468,9 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN2360"
-></A
->14.1. Abstract</H2
+NAME="AEN2263"
+>14.1. Abstract</A
+></H2
><P
>Integration of UNIX and Microsoft Windows NT through
a unified logon has been considered a "holy grail" in heterogeneous
@@ -12083,9 +11495,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2364"
-></A
->14.2. Introduction</H2
+NAME="AEN2267"
+>14.2. Introduction</A
+></H2
><P
>It is well known that UNIX and Microsoft Windows NT have
different models for representing user and group information and
@@ -12137,9 +11549,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2377"
-></A
->14.3. What Winbind Provides</H2
+NAME="AEN2280"
+>14.3. What Winbind Provides</A
+></H2
><P
>Winbind unifies UNIX and Windows NT account management by
allowing a UNIX box to become a full member of a NT domain. Once
@@ -12179,9 +11591,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2384"
-></A
->14.3.1. Target Uses</H3
+NAME="AEN2287"
+>14.3.1. Target Uses</A
+></H3
><P
>Winbind is targeted at organizations that have an
existing NT based domain infrastructure into which they wish
@@ -12203,9 +11615,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2388"
-></A
->14.4. How Winbind Works</H2
+NAME="AEN2291"
+>14.4. How Winbind Works</A
+></H2
><P
>The winbind system is designed around a client/server
architecture. A long running <B
@@ -12223,9 +11635,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2393"
-></A
->14.4.1. Microsoft Remote Procedure Calls</H3
+NAME="AEN2296"
+>14.4.1. Microsoft Remote Procedure Calls</A
+></H3
><P
>Over the last few years, efforts have been underway
by various Samba Team members to decode various aspects of
@@ -12249,9 +11661,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2397"
-></A
->14.4.2. Microsoft Active Directory Services</H3
+NAME="AEN2300"
+>14.4.2. Microsoft Active Directory Services</A
+></H3
><P
> Since late 2001, Samba has gained the ability to
interact with Microsoft Windows 2000 using its 'Native
@@ -12268,9 +11680,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2400"
-></A
->14.4.3. Name Service Switch</H3
+NAME="AEN2303"
+>14.4.3. Name Service Switch</A
+></H3
><P
>The Name Service Switch, or NSS, is a feature that is
present in many UNIX operating systems. It allows system
@@ -12348,9 +11760,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2416"
-></A
->14.4.4. Pluggable Authentication Modules</H3
+NAME="AEN2319"
+>14.4.4. Pluggable Authentication Modules</A
+></H3
><P
>Pluggable Authentication Modules, also known as PAM,
is a system for abstracting authentication and authorization
@@ -12397,9 +11809,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2424"
-></A
->14.4.5. User and Group ID Allocation</H3
+NAME="AEN2327"
+>14.4.5. User and Group ID Allocation</A
+></H3
><P
>When a user or group is created under Windows NT
is it allocated a numerical relative identifier (RID). This is
@@ -12423,9 +11835,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2428"
-></A
->14.4.6. Result Caching</H3
+NAME="AEN2331"
+>14.4.6. Result Caching</A
+></H3
><P
>An active system can generate a lot of user and group
name lookups. To reduce the network cost of these lookups winbind
@@ -12446,9 +11858,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2431"
-></A
->14.5. Installation and Configuration</H2
+NAME="AEN2334"
+>14.5. Installation and Configuration</A
+></H2
><P
>Many thanks to John Trostel <A
HREF="mailto:jtrostel@snapserver.com"
@@ -12473,9 +11885,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2438"
-></A
->14.5.1. Introduction</H3
+NAME="AEN2341"
+>14.5.1. Introduction</A
+></H3
><P
>This HOWTO describes the procedures used to get winbind up and
running on my RedHat 7.1 system. Winbind is capable of providing access
@@ -12532,9 +11944,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2451"
-></A
->14.5.2. Requirements</H3
+NAME="AEN2354"
+>14.5.2. Requirements</A
+></H3
><P
>If you have a samba configuration file that you are currently
using... <SPAN
@@ -12602,9 +12014,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2465"
-></A
->14.5.3. Testing Things Out</H3
+NAME="AEN2368"
+>14.5.3. Testing Things Out</A
+></H3
><P
>Before starting, it is probably best to kill off all the SAMBA
related daemons running on your server. Kill off all <B
@@ -12647,9 +12059,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN2476"
-></A
->14.5.3.1. Configure and compile SAMBA</H4
+NAME="AEN2379"
+>14.5.3.1. Configure and compile SAMBA</A
+></H4
><P
>The configuration and compilation of SAMBA is pretty straightforward.
The first three steps may not be necessary depending upon
@@ -12657,44 +12069,44 @@ whether or not you have previously built the Samba binaries.</P
><P
><PRE
CLASS="PROGRAMLISTING"
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>autoconf</B
>
-<TT
+<SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>make clean</B
>
-<TT
+<SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>rm config.cache</B
>
-<TT
+<SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>./configure</B
>
-<TT
+<SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>make</B
>
-<TT
+<SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>make install</B
@@ -12713,13 +12125,13 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN2495"
-></A
+NAME="AEN2398"
>14.5.3.2. Configure <TT
CLASS="FILENAME"
>nsswitch.conf</TT
> and the
-winbind libraries</H4
+winbind libraries</A
+></H4
><P
>The libraries needed to run the <B
CLASS="COMMAND"
@@ -12727,9 +12139,9 @@ CLASS="COMMAND"
> daemon
through nsswitch need to be copied to their proper locations, so</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>cp ../samba/source/nsswitch/libnss_winbind.so /lib</B
@@ -12737,9 +12149,9 @@ CLASS="COMMAND"
><P
>I also found it necessary to make the following symbolic link:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2</B
@@ -12747,23 +12159,23 @@ CLASS="COMMAND"
><P
>And, in the case of Sun solaris:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1</B
>
-<TT
+<SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1</B
>
-<TT
+<SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2</B
@@ -12799,9 +12211,9 @@ CLASS="COMMAND"
your system reboots, but it
is faster (and you don't need to reboot) if you do it manually:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>/sbin/ldconfig -v | grep winbind</B
@@ -12818,9 +12230,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN2528"
-></A
->14.5.3.3. Configure smb.conf</H4
+NAME="AEN2431"
+>14.5.3.3. Configure smb.conf</A
+></H4
><P
>Several parameters are needed in the smb.conf file to control
the behavior of <B
@@ -12845,7 +12257,7 @@ include the following entries in the [global] section:</P
><PRE
CLASS="PROGRAMLISTING"
>[global]
- &lt;...&gt;
+ &#60;...&#62;
# separate domain and username with '+', like DOMAIN+username
<A
HREF="winbindd.8.html#WINBINDSEPARATOR"
@@ -12893,44 +12305,36 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN2544"
-></A
->14.5.3.4. Join the SAMBA server to the PDC domain</H4
+NAME="AEN2447"
+>14.5.3.4. Join the SAMBA server to the PDC domain</A
+></H4
><P
>Enter the following command to make the SAMBA server join the
-PDC domain, where <TT
+PDC domain, where <VAR
CLASS="REPLACEABLE"
-><I
->DOMAIN</I
-></TT
+>DOMAIN</VAR
> is the name of
-your Windows domain and <TT
+your Windows domain and <VAR
CLASS="REPLACEABLE"
-><I
->Administrator</I
-></TT
+>Administrator</VAR
> is
a domain user who has administrative privileges in the domain.</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>/usr/local/samba/bin/net join -S PDC -U Administrator</B
></P
><P
>The proper response to the command should be: "Joined the domain
-<TT
+<VAR
CLASS="REPLACEABLE"
-><I
->DOMAIN</I
-></TT
->" where <TT
+>DOMAIN</VAR
+>" where <VAR
CLASS="REPLACEABLE"
-><I
->DOMAIN</I
-></TT
+>DOMAIN</VAR
>
is your DOMAIN name.</P
></DIV
@@ -12939,9 +12343,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN2555"
-></A
->14.5.3.5. Start up the winbindd daemon and test it!</H4
+NAME="AEN2458"
+>14.5.3.5. Start up the winbindd daemon and test it!</A
+></H4
><P
>Eventually, you will want to modify your smb startup script to
automatically invoke the winbindd daemon when the other parts of
@@ -12949,9 +12353,9 @@ SAMBA start, but it is possible to test out just the winbind
portion first. To start up winbind services, enter the following
command as root:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>/usr/local/samba/bin/winbindd</B
@@ -12960,9 +12364,9 @@ CLASS="COMMAND"
>I'm always paranoid and like to make sure the daemon
is really running...</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>ps -ae | grep winbindd</B
@@ -12975,9 +12379,9 @@ CLASS="COMMAND"
>Now... for the real test, try to get some information about the
users on your PDC</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>/usr/local/samba/bin/wbinfo -u</B
@@ -12997,12 +12401,10 @@ CEO+krbtgt
CEO+TsInternetUser</PRE
></P
><P
->Obviously, I have named my domain 'CEO' and my <TT
+>Obviously, I have named my domain 'CEO' and my <VAR
CLASS="PARAMETER"
-><I
>winbind
-separator</I
-></TT
+separator</VAR
> is '+'.</P
><P
>You can do the same sort of thing to get group information from
@@ -13010,9 +12412,9 @@ the PDC:</P
><P
><PRE
CLASS="PROGRAMLISTING"
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>/usr/local/samba/bin/wbinfo -g</B
@@ -13032,9 +12434,9 @@ CEO+Group Policy Creator Owners</PRE
lists of both local and PDC users and groups.
Try the following command:</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>getent passwd</B
@@ -13049,9 +12451,9 @@ directories and default shells.</P
><P
>The same thing can be done for groups with the command</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>getent group</B
@@ -13062,17 +12464,17 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN2591"
-></A
->14.5.3.6. Fix the init.d startup scripts</H4
+NAME="AEN2494"
+>14.5.3.6. Fix the init.d startup scripts</A
+></H4
><DIV
CLASS="SECT4"
><H5
CLASS="SECT4"
><A
-NAME="AEN2593"
-></A
->14.5.3.6.1. Linux</H5
+NAME="AEN2496"
+>14.5.3.6.1. Linux</A
+></H5
><P
>The <B
CLASS="COMMAND"
@@ -13129,7 +12531,7 @@ CLASS="PROGRAMLISTING"
daemon /usr/local/samba/bin/winbindd
RETVAL3=$?
echo
- [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] &amp;&amp; touch /var/lock/subsys/smb || \
+ [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] &#38;&#38; touch /var/lock/subsys/smb || \
RETVAL=1
return $RETVAL
}</PRE
@@ -13155,7 +12557,7 @@ CLASS="PROGRAMLISTING"
echo -n $"Shutting down $KIND services: "
killproc winbindd
RETVAL3=$?
- [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] &amp;&amp; rm -f /var/lock/subsys/smb
+ [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] &#38;&#38; rm -f /var/lock/subsys/smb
echo ""
return $RETVAL
}</PRE
@@ -13166,9 +12568,9 @@ CLASS="SECT4"
><HR><H5
CLASS="SECT4"
><A
-NAME="AEN2610"
-></A
->14.5.3.6.2. Solaris</H5
+NAME="AEN2513"
+>14.5.3.6.2. Solaris</A
+></H5
><P
>On solaris, you need to modify the
<TT
@@ -13197,7 +12599,7 @@ killproc() { # kill the named process(es)
pid=`/usr/bin/ps -e |
/usr/bin/grep -w $1 |
/usr/bin/sed -e 's/^ *//' -e 's/ .*//'`
- [ "$pid" != "" ] &amp;&amp; kill $pid
+ [ "$pid" != "" ] &#38;&#38; kill $pid
}
# Start/stop processes required for samba server
@@ -13237,9 +12639,9 @@ CLASS="SECT4"
><HR><H5
CLASS="SECT4"
><A
-NAME="AEN2617"
-></A
->14.5.3.6.3. Restarting</H5
+NAME="AEN2520"
+>14.5.3.6.3. Restarting</A
+></H5
><P
>If you restart the <B
CLASS="COMMAND"
@@ -13261,9 +12663,9 @@ CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
-NAME="AEN2623"
-></A
->14.5.3.7. Configure Winbind and PAM</H4
+NAME="AEN2526"
+>14.5.3.7. Configure Winbind and PAM</A
+></H4
><P
>If you have made it this far, you know that winbindd and samba are working
together. If you want to use winbind to provide authentication for other
@@ -13281,9 +12683,9 @@ CLASS="FILENAME"
> directory
by invoking the command</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>make nsswitch/pam_winbind.so</B
@@ -13307,9 +12709,9 @@ CLASS="FILENAME"
>/usr/lib/security</TT
>.</P
><P
-><TT
+><SAMP
CLASS="PROMPT"
->root#</TT
+>root#</SAMP
> <B
CLASS="COMMAND"
>cp ../samba/source/nsswitch/pam_winbind.so /lib/security</B
@@ -13319,9 +12721,9 @@ CLASS="SECT4"
><HR><H5
CLASS="SECT4"
><A
-NAME="AEN2640"
-></A
->14.5.3.7.1. Linux/FreeBSD-specific PAM configuration</H5
+NAME="AEN2543"
+>14.5.3.7.1. Linux/FreeBSD-specific PAM configuration</A
+></H5
><P
>The <TT
CLASS="FILENAME"
@@ -13448,9 +12850,9 @@ CLASS="SECT4"
><HR><H5
CLASS="SECT4"
><A
-NAME="AEN2673"
-></A
->14.5.3.7.2. Solaris-specific configuration</H5
+NAME="AEN2576"
+>14.5.3.7.2. Solaris-specific configuration</A
+></H5
><P
>The /etc/pam.conf needs to be changed. I changed this file so that my Domain
users can logon both locally as well as telnet.The following are the changes
@@ -13535,9 +12937,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2680"
-></A
->14.6. Limitations</H2
+NAME="AEN2583"
+>14.6. Limitations</A
+></H2
><P
>Winbind has a number of limitations in its current
released version that we hope to overcome in future
@@ -13577,9 +12979,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2690"
-></A
->14.7. Conclusion</H2
+NAME="AEN2593"
+>14.7. Conclusion</A
+></H2
><P
>The winbind system, through the use of the Name Service
Switch, Pluggable Authentication Modules, and appropriate
@@ -13601,9 +13003,9 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN2700"
-></A
->15.1. Overview of browsing</H2
+NAME="AEN2603"
+>15.1. Overview of browsing</A
+></H2
><P
>SMB networking provides a mechanism by which clients can access a list
of machines in a network, a so-called "browse list". This list
@@ -13614,8 +13016,13 @@ list is heavily used by all SMB clients. Configuration of SMB
browsing has been problematic for some Samba users, hence this
document.</P
><P
->Browsing will NOT work if name resolution from NetBIOS names to IP
-addresses does not function correctly. Use of a WINS server is highly
+>MS Windows 2000 and later, as with Samba-3 and later, can be
+configured to not use NetBIOS over TCP/IP. When configured this way
+it is imperative that name resolution (using DNS/LDAP/ADS) be correctly
+configured and operative. Browsing will NOT work if name resolution
+from SMB machine names to IP addresses does not function correctly.</P
+><P
+>Where NetBIOS over TCP/IP is enabled use of a WINS server is highly
recommended to aid the resolution of NetBIOS (SMB) names to IP addresses.
WINS allows remote segment clients to obtain NetBIOS name_type information
that can NOT be provided by any other means of name resolution.</P
@@ -13625,16 +13032,14 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2704"
-></A
->15.2. Browsing support in samba</H2
-><P
->Samba now fully supports browsing. The browsing is supported by nmbd
-and is also controlled by options in the smb.conf file (see smb.conf(5)).</P
+NAME="AEN2608"
+>15.2. Browsing support in samba</A
+></H2
><P
->Samba can act as a local browse master for a workgroup and the ability
-for samba to support domain logons and scripts is now available. See
-DOMAIN.txt for more information on domain logons.</P
+>Samba facilitates browsing. The browsing is supported by nmbd
+and is also controlled by options in the smb.conf file (see smb.conf(5)).
+Samba can act as a local browse master for a workgroup and the ability
+for samba to support domain logons and scripts is now available.</P
><P
>Samba can also act as a domain master browser for a workgroup. This
means that it will collate lists from local browse masters into a
@@ -13649,12 +13054,12 @@ regardless of whether it is NT, Samba or any other type of domain master
that is providing this service.</P
><P
>[Note that nmbd can be configured as a WINS server, but it is not
-necessary to specifically use samba as your WINS server. NTAS can
-be configured as your WINS server. In a mixed NT server and
-samba environment on a Wide Area Network, it is recommended that
-you use the NT server's WINS server capabilities. In a samba-only
-environment, it is recommended that you use one and only one nmbd
-as your WINS server].</P
+necessary to specifically use samba as your WINS server. MS Windows
+NT4, Server or Advanced Server 2000 or 2003 can be configured as
+your WINS server. In a mixed NT/2000/2003 server and samba environment on
+a Wide Area Network, it is recommended that you use the Microsoft
+WINS server capabilities. In a samba-only environment, it is
+recommended that you use one and only one Samba server as your WINS server.</P
><P
>To get browsing to work you need to run nmbd as usual, but will need
to use the "workgroup" option in smb.conf to control what workgroup
@@ -13670,9 +13075,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2713"
-></A
->15.3. Problem resolution</H2
+NAME="AEN2616"
+>15.3. Problem resolution</A
+></H2
><P
>If something doesn't work then hopefully the log.nmb file will help
you track down the problem. Try a debug level of 2 or 3 for finding
@@ -13688,6 +13093,19 @@ filemanager should display the list of available shares.</P
connection that lists the shares is done as guest, and thus you must
have a valid guest account.</P
><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>MS Windows 2000 and upwards (as with Samba) can be configured to disallow
+anonymous (ie: Guest account) access to the IPC$ share. In that case, the
+MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the
+name of the currently logged in user to query the IPC$ share. MS Windows
+9X clients are not able to do this and thus will NOT be able to browse
+server resources.</I
+></SPAN
+></P
+><P
>Also, a lot of people are getting bitten by the problem of too many
parameters on the command line of nmbd in inetd.conf. This trick is to
not use spaces between the option and the parameter (eg: -d2 instead
@@ -13704,11 +13122,11 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2720"
-></A
->15.4. Browsing across subnets</H2
+NAME="AEN2625"
+>15.4. Browsing across subnets</A
+></H2
><P
->With the release of Samba 1.9.17(alpha1 and above) Samba has been
+>Since the release of Samba 1.9.17(alpha1) Samba has been
updated to enable it to support the replication of browse lists
across subnet boundaries. New code and options have been added to
achieve this. This section describes how to set this feature up
@@ -13735,15 +13153,14 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2725"
-></A
->15.4.1. How does cross subnet browsing work ?</H3
+NAME="AEN2630"
+>15.4.1. How does cross subnet browsing work ?</A
+></H3
><P
>Cross subnet browsing is a complicated dance, containing multiple
moving parts. It has taken Microsoft several years to get the code
that achieves this correct, and Samba lags behind in some areas.
-However, with the 1.9.17 release, Samba is capable of cross subnet
-browsing when configured correctly.</P
+Samba is capable of cross subnet browsing when configured correctly.</P
><P
>Consider a network set up as follows :</P
><P
@@ -13824,7 +13241,7 @@ machine is seen across any of the subnets.</P
master browser it looks for a Domain master browser to synchronize
its browse list with. It does this by querying the WINS server
(N2_D) for the IP address associated with the NetBIOS name
-WORKGROUP&gt;1B&lt;. This name was registerd by the Domain master
+WORKGROUP&#62;1B&#60;. This name was registerd by the Domain master
browser (N1_C) with the WINS server as soon as it was booted.</P
><P
>Once N2_B knows the address of the Domain master browser it
@@ -13947,9 +13364,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2760"
-></A
->15.5. Setting up a WINS server</H2
+NAME="AEN2665"
+>15.5. Setting up a WINS server</A
+></H2
><P
>Either a Samba machine or a Windows NT Server machine may be set up
as a WINS server. To set a Samba machine to be a WINS server you must
@@ -13961,9 +13378,9 @@ CLASS="COMMAND"
> wins support = yes</B
></P
><P
->Versions of Samba previous to 1.9.17 had this parameter default to
+>Versions of Samba prior to 1.9.17 had this parameter default to
yes. If you have any older versions of Samba on your network it is
-strongly suggested you upgrade to 1.9.17 or above, or at the very
+strongly suggested you upgrade to a recent version, or at the very
least set the parameter to 'no' on all these machines.</P
><P
>Machines with "<B
@@ -14001,10 +13418,10 @@ all smb.conf files :</P
><P
><B
CLASS="COMMAND"
->wins server = &gt;name or IP address&lt;</B
+>wins server = &#62;name or IP address&#60;</B
></P
><P
->where &gt;name or IP address&lt; is either the DNS name of the WINS server
+>where &#62;name or IP address&#60; is either the DNS name of the WINS server
machine or its IP address.</P
><P
>Note that this line MUST NOT BE SET in the smb.conf file of the Samba
@@ -14015,7 +13432,7 @@ CLASS="COMMAND"
>" option and the
"<B
CLASS="COMMAND"
->wins server = &gt;name&lt;</B
+>wins server = &#60;name&#62;</B
>" option then
nmbd will fail to start.</P
><P
@@ -14030,9 +13447,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2779"
-></A
->15.6. Setting up Browsing in a WORKGROUP</H2
+NAME="AEN2684"
+>15.6. Setting up Browsing in a WORKGROUP</A
+></H2
><P
>To set up cross subnet browsing on a network containing machines
in up to be in a WORKGROUP, not an NT Domain you need to set up one
@@ -14073,11 +13490,12 @@ server, if you require.</P
><P
>Next, you should ensure that each of the subnets contains a
machine that can act as a local master browser for the
-workgroup. Any NT machine should be able to do this, as will
-Windows 95 machines (although these tend to get rebooted more
-often, so it's not such a good idea to use these). To make a
-Samba server a local master browser set the following
-options in the [global] section of the smb.conf file :</P
+workgroup. Any MS Windows NT/2K/XP/2003 machine should be
+able to do this, as will Windows 9x machines (although these
+tend to get rebooted more often, so it's not such a good idea
+to use these). To make a Samba server a local master browser
+set the following options in the [global] section of the
+smb.conf file :</P
><P
><PRE
CLASS="PROGRAMLISTING"
@@ -14114,16 +13532,16 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2797"
-></A
->15.7. Setting up Browsing in a DOMAIN</H2
+NAME="AEN2702"
+>15.7. Setting up Browsing in a DOMAIN</A
+></H2
><P
>If you are adding Samba servers to a Windows NT Domain then
you must not set up a Samba server as a domain master browser.
By default, a Windows NT Primary Domain Controller for a Domain
name is also the Domain master browser for that name, and many
things will break if a Samba server registers the Domain master
-browser NetBIOS name (DOMAIN&gt;1B&lt;) with WINS instead of the PDC.</P
+browser NetBIOS name (DOMAIN&#60;1B&#62;) with WINS instead of the PDC.</P
><P
>For subnets other than the one containing the Windows NT PDC
you may set up Samba servers as local master browsers as
@@ -14165,9 +13583,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2807"
-></A
->15.8. Forcing samba to be the master</H2
+NAME="AEN2712"
+>15.8. Forcing samba to be the master</A
+></H2
><P
>Who becomes the "master browser" is determined by an election process
using broadcasts. Each election packet contains a number of parameters
@@ -14180,8 +13598,8 @@ option in smb.conf to a higher number. It defaults to 0. Using 34
would make it win all elections over every other system (except other
samba systems!)</P
><P
->A "os level" of 2 would make it beat WfWg and Win95, but not NTAS. A
-NTAS domain controller uses level 32.</P
+>A "os level" of 2 would make it beat WfWg and Win95, but not MS Windows
+NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.</P
><P
>The maximum os level is 255</P
><P
@@ -14213,9 +13631,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2816"
-></A
->15.9. Making samba the domain master</H2
+NAME="AEN2721"
+>15.9. Making samba the domain master</A
+></H2
><P
>The domain master is responsible for collating the browse lists of
multiple subnets so that browsing can occur between subnets. You can
@@ -14286,9 +13704,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2834"
-></A
->15.10. Note about broadcast addresses</H2
+NAME="AEN2739"
+>15.10. Note about broadcast addresses</A
+></H2
><P
>If your network uses a "0" based broadcast address (for example if it
ends in a 0) then you will strike problems. Windows for Workgroups
@@ -14300,9 +13718,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2837"
-></A
->15.11. Multiple interfaces</H2
+NAME="AEN2742"
+>15.11. Multiple interfaces</A
+></H2
><P
>Samba now supports machines with multiple network interfaces. If you
have multiple interfaces then you will need to use the "interfaces"
@@ -14321,9 +13739,9 @@ CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN2855"
-></A
->16.1. Introduction and configuration</H2
+NAME="AEN2760"
+>16.1. Introduction and configuration</A
+></H2
><P
>Since samba 3.0, samba supports stackable VFS(Virtual File System) modules.
Samba passes each request to access the unix file system thru the loaded VFS modules.
@@ -14362,17 +13780,17 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2864"
-></A
->16.2. Included modules</H2
+NAME="AEN2769"
+>16.2. Included modules</A
+></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
-NAME="AEN2866"
-></A
->16.2.1. audit</H3
+NAME="AEN2771"
+>16.2.1. audit</A
+></H3
><P
>A simple module to audit file access to the syslog
facility. The following operations are logged:
@@ -14408,9 +13826,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2874"
-></A
->16.2.2. recycle</H3
+NAME="AEN2779"
+>16.2.2. recycle</A
+></H3
><P
>A recycle-bin like modules. When used any unlink call
will be intercepted and files moved to the recycle
@@ -14479,9 +13897,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2911"
-></A
->16.2.3. netatalk</H3
+NAME="AEN2816"
+>16.2.3. netatalk</A
+></H3
><P
>A netatalk module, that will ease co-existence of samba and
netatalk file sharing services.</P
@@ -14512,9 +13930,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN2918"
-></A
->16.3. VFS modules available elsewhere</H2
+NAME="AEN2823"
+>16.3. VFS modules available elsewhere</A
+></H2
><P
>This section contains a listing of various other VFS modules that
have been posted but don't currently reside in the Samba CVS
@@ -14528,9 +13946,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2922"
-></A
->16.3.1. DatabaseFS</H3
+NAME="AEN2827"
+>16.3.1. DatabaseFS</A
+></H3
><P
>URL: <A
HREF="http://www.css.tayloru.edu/~elorimer/databasefs/index.php"
@@ -14562,9 +13980,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN2930"
-></A
->16.3.2. vscan</H3
+NAME="AEN2835"
+>16.3.2. vscan</A
+></H3
><P
>URL: <A
HREF="http://www.openantivirus.org/"
@@ -14584,181 +14002,9 @@ by Rainer Link.</P
CLASS="CHAPTER"
><HR><H1
><A
-NAME="CVS-ACCESS"
-></A
->Chapter 17. Access Samba source code via CVS</H1
-><DIV
-CLASS="SECT1"
-><H2
-CLASS="SECT1"
-><A
-NAME="AEN2942"
-></A
->17.1. Introduction</H2
-><P
->Samba is developed in an open environment. Developers use CVS
-(Concurrent Versioning System) to "checkin" (also known as
-"commit") new source code. Samba's various CVS branches can
-be accessed via anonymous CVS using the instructions
-detailed in this chapter.</P
-><P
->This document is a modified version of the instructions found at
-<A
-HREF="http://samba.org/samba/cvs.html"
-TARGET="_top"
->http://samba.org/samba/cvs.html</A
-></P
-></DIV
-><DIV
-CLASS="SECT1"
-><HR><H2
-CLASS="SECT1"
-><A
-NAME="AEN2947"
-></A
->17.2. CVS Access to samba.org</H2
-><P
->The machine samba.org runs a publicly accessible CVS
-repository for access to the source code of several packages,
-including samba, rsync and jitterbug. There are two main ways of
-accessing the CVS server on this host.</P
-><DIV
-CLASS="SECT2"
-><HR><H3
-CLASS="SECT2"
-><A
-NAME="AEN2950"
-></A
->17.2.1. Access via CVSweb</H3
-><P
->You can access the source code via your
-favourite WWW browser. This allows you to access the contents of
-individual files in the repository and also to look at the revision
-history and commit logs of individual files. You can also ask for a diff
-listing between any two versions on the repository.</P
-><P
->Use the URL : <A
-HREF="http://samba.org/cgi-bin/cvsweb"
-TARGET="_top"
->http://samba.org/cgi-bin/cvsweb</A
-></P
-></DIV
-><DIV
-CLASS="SECT2"
-><HR><H3
-CLASS="SECT2"
-><A
-NAME="AEN2955"
-></A
->17.2.2. Access via cvs</H3
-><P
->You can also access the source code via a
-normal cvs client. This gives you much more control over you can
-do with the repository and allows you to checkout whole source trees
-and keep them up to date via normal cvs commands. This is the
-preferred method of access if you are a developer and not
-just a casual browser.</P
-><P
->To download the latest cvs source code, point your
-browser at the URL : <A
-HREF="http://www.cyclic.com/"
-TARGET="_top"
->http://www.cyclic.com/</A
->.
-and click on the 'How to get cvs' link. CVS is free software under
-the GNU GPL (as is Samba). Note that there are several graphical CVS clients
-which provide a graphical interface to the sometimes mundane CVS commands.
-Links to theses clients are also available from http://www.cyclic.com.</P
-><P
->To gain access via anonymous cvs use the following steps.
-For this example it is assumed that you want a copy of the
-samba source code. For the other source code repositories
-on this system just substitute the correct package name</P
-><P
-></P
-><OL
-TYPE="1"
-><LI
-><P
-> Install a recent copy of cvs. All you really need is a
- copy of the cvs client binary.
- </P
-></LI
-><LI
-><P
-> Run the command
- </P
-><P
-> <B
-CLASS="COMMAND"
->cvs -d :pserver:cvs@samba.org:/cvsroot login</B
->
- </P
-><P
-> When it asks you for a password type <TT
-CLASS="USERINPUT"
-><B
->cvs</B
-></TT
->.
- </P
-></LI
-><LI
-><P
-> Run the command
- </P
-><P
-> <B
-CLASS="COMMAND"
->cvs -d :pserver:cvs@samba.org:/cvsroot co samba</B
->
- </P
-><P
-> This will create a directory called samba containing the
- latest samba source code (i.e. the HEAD tagged cvs branch). This
- currently corresponds to the 3.0 development tree.
- </P
-><P
-> CVS branches other HEAD can be obtained by using the <TT
-CLASS="PARAMETER"
-><I
->-r</I
-></TT
->
- and defining a tag name. A list of branch tag names can be found on the
- "Development" page of the samba web site. A common request is to obtain the
- latest 2.2 release code. This could be done by using the following command.
- </P
-><P
-> <B
-CLASS="COMMAND"
->cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_2_2 samba</B
->
- </P
-></LI
-><LI
-><P
-> Whenever you want to merge in the latest code changes use
- the following command from within the samba directory:
- </P
-><P
-> <B
-CLASS="COMMAND"
->cvs update -d -P</B
->
- </P
-></LI
-></OL
-></DIV
-></DIV
-></DIV
-><DIV
-CLASS="CHAPTER"
-><HR><H1
-><A
NAME="GROUPMAPPING"
></A
->Chapter 18. Group mapping HOWTO</H1
+>Chapter 17. Group mapping HOWTO</H1
><P
>
Starting with Samba 3.0 alpha 2, a new group mapping function is available. The
@@ -14859,15 +14105,15 @@ CLASS="CHAPTER"
><A
NAME="SPEED"
></A
->Chapter 19. Samba performance issues</H1
+>Chapter 18. Samba performance issues</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN3033"
-></A
->19.1. Comparisons</H2
+NAME="AEN2890"
+>18.1. Comparisons</A
+></H2
><P
>The Samba server uses TCP to talk to the client. Thus if you are
trying to see if it performs well you should really compare it to
@@ -14896,9 +14142,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3039"
-></A
->19.2. Socket options</H2
+NAME="AEN2896"
+>18.2. Socket options</A
+></H2
><P
>There are a number of socket options that can greatly affect the
performance of a TCP based server like Samba.</P
@@ -14924,9 +14170,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3046"
-></A
->19.3. Read size</H2
+NAME="AEN2903"
+>18.3. Read size</A
+></H2
><P
>The option "read size" affects the overlap of disk reads/writes with
network reads/writes. If the amount of data being transferred in
@@ -14950,9 +14196,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3051"
-></A
->19.4. Max xmit</H2
+NAME="AEN2908"
+>18.4. Max xmit</A
+></H2
><P
>At startup the client and server negotiate a "maximum transmit" size,
which limits the size of nearly all SMB commands. You can set the
@@ -14973,9 +14219,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3056"
-></A
->19.5. Log level</H2
+NAME="AEN2913"
+>18.5. Log level</A
+></H2
><P
>If you set the log level (also known as "debug level") higher than 2
then you may suffer a large drop in performance. This is because the
@@ -14987,9 +14233,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3059"
-></A
->19.6. Read raw</H2
+NAME="AEN2916"
+>18.6. Read raw</A
+></H2
><P
>The "read raw" operation is designed to be an optimised, low-latency
file read operation. A server may choose to not support it,
@@ -15009,9 +14255,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3064"
-></A
->19.7. Write raw</H2
+NAME="AEN2921"
+>18.7. Write raw</A
+></H2
><P
>The "write raw" operation is designed to be an optimised, low-latency
file write operation. A server may choose to not support it,
@@ -15026,9 +14272,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3068"
-></A
->19.8. Slow Clients</H2
+NAME="AEN2925"
+>18.8. Slow Clients</A
+></H2
><P
>One person has reported that setting the protocol to COREPLUS rather
than LANMAN2 gave a dramatic speed improvement (from 10k/s to 150k/s).</P
@@ -15043,9 +14289,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3072"
-></A
->19.9. Slow Logins</H2
+NAME="AEN2929"
+>18.9. Slow Logins</A
+></H2
><P
>Slow logins are almost always due to the password checking time. Using
the lowest practical "password level" will improve things a lot. You
@@ -15056,9 +14302,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3075"
-></A
->19.10. Client tuning</H2
+NAME="AEN2932"
+>18.10. Client tuning</A
+></H2
><P
>Often a speed problem can be traced to the client. The client (for
example Windows for Workgroups) can often be tuned for better TCP
@@ -15164,15 +14410,15 @@ CLASS="CHAPTER"
><A
NAME="GROUPPROFILES"
></A
->Chapter 20. Creating Group Profiles</H1
+>Chapter 19. Creating Group Prolicy Files</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN3123"
-></A
->20.1. Windows '9x</H2
+NAME="AEN2980"
+>19.1. Windows '9x</A
+></H2
><P
>You need the Win98 Group Policy Editor to
set Group Profiles up under Windows '9x. It can be found on the Original
@@ -15196,25 +14442,28 @@ CLASS="FILENAME"
> that needs to be placed in
the root of the [NETLOGON] share. If your Win98 is configured to log onto
the Samba Domain, it will automatically read this file and update the
-Win98 registry of the machine that is logging on.</P
+Win9x/Me registry of the machine that is logging on.</P
><P
>All of this is covered in the Win98 Resource Kit documentation.</P
><P
->If you do not do it this way, then every so often Win98 will check the
+>If you do not do it this way, then every so often Win9x/Me will check the
integrity of the registry and will restore it's settings from the back-up
-copy of the registry it stores on each Win98 machine. Hence, you will notice
-things changing back to the original settings.</P
+copy of the registry it stores on each Win9x/Me machine. Hence, you will
+occasionally notice things changing back to the original settings.</P
+><P
+>The following all refers to Windows NT/200x profile migration - not to policies.
+We need a separate section on policies (NTConfig.Pol) for NT4/200x.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3132"
-></A
->20.2. Windows NT 4</H2
+NAME="AEN2990"
+>19.2. Windows NT 4</A
+></H2
><P
->Unfortunately, the Resource Kit info is Win NT4/2K version specific.</P
+>Unfortunately, the Resource Kit info is Win NT4 or 200x specific.</P
><P
>Here is a quick guide:</P
><P
@@ -15249,7 +14498,7 @@ ALT="Note"></TD
ALIGN="LEFT"
VALIGN="TOP"
><P
->I am using the term &quot;migrate&quot; lossely. You can copy a profile to
+>I am using the term "migrate" lossely. You can copy a profile to
create a group profile. You can give the user 'Everyone' rights to the
profile you copy this to. That is what you need to do, since your samba
domain is not a member of a trust relationship with your NT4 PDC.</P
@@ -15291,9 +14540,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3155"
-></A
->20.2.1. Side bar Notes</H3
+NAME="AEN3013"
+>19.2.1. Side bar Notes</A
+></H3
><P
>You should obtain the SID of your NT4 domain. You can use smbpasswd to do
this. Read the man page.</P
@@ -15307,9 +14556,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3159"
-></A
->20.2.2. Mandatory profiles</H3
+NAME="AEN3017"
+>19.2.2. Mandatory profiles</A
+></H3
><P
>The above method can be used to create mandatory profiles also. To convert
a group profile into a mandatory profile simply locate the NTUser.DAT file
@@ -15320,9 +14569,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3162"
-></A
->20.2.3. moveuser.exe</H3
+NAME="AEN3020"
+>19.2.3. moveuser.exe</A
+></H3
><P
>The W2K professional resource kit has moveuser.exe. moveuser.exe changes
the security of a profile from one user to another. This allows the account
@@ -15333,9 +14582,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3165"
-></A
->20.2.4. Get SID</H3
+NAME="AEN3023"
+>19.2.4. Get SID</A
+></H3
><P
>You can identify the SID by using GetSID.exe from the Windows NT Server 4.0
Resource Kit.</P
@@ -15356,9 +14605,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3170"
-></A
->20.3. Windows 2000/XP</H2
+NAME="AEN3028"
+>19.3. Windows 2000/XP</A
+></H2
><P
>You must first convert the profile from a local profile to a domain
profile on the MS Windows workstation as follows:</P
@@ -15588,6 +14837,178 @@ changed).</P
></DIV
></DIV
></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="SECURING-SAMBA"
+></A
+>Chapter 20. Securing Samba</H1
+><DIV
+CLASS="SECT1"
+><H2
+CLASS="SECT1"
+><A
+NAME="AEN3109"
+>20.1. Introduction</A
+></H2
+><P
+>This note was attached to the Samba 2.2.8 release notes as it contained an
+important security fix. The information contained here applies to Samba
+installations in general.</P
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H2
+CLASS="SECT1"
+><A
+NAME="AEN3112"
+>20.2. Using host based protection</A
+></H2
+><P
+>In many installations of Samba the greatest threat comes for outside
+your immediate network. By default Samba will accept connections from
+any host, which means that if you run an insecure version of Samba on
+a host that is directly connected to the Internet you can be
+especially vulnerable.</P
+><P
+>One of the simplest fixes in this case is to use the 'hosts allow' and
+'hosts deny' options in the Samba smb.conf configuration file to only
+allow access to your server from a specific range of hosts. An example
+might be:</P
+><P
+><PRE
+CLASS="PROGRAMLISTING"
+> hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
+ hosts deny = 0.0.0.0/0</PRE
+></P
+><P
+>The above will only allow SMB connections from 'localhost' (your own
+computer) and from the two private networks 192.168.2 and
+192.168.3. All other connections will be refused connections as soon
+as the client sends its first packet. The refusal will be marked as a
+'not listening on called name' error.</P
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H2
+CLASS="SECT1"
+><A
+NAME="AEN3119"
+>20.3. Using interface protection</A
+></H2
+><P
+>By default Samba will accept connections on any network interface that
+it finds on your system. That means if you have a ISDN line or a PPP
+connection to the Internet then Samba will accept connections on those
+links. This may not be what you want.</P
+><P
+>You can change this behaviour using options like the following:</P
+><P
+><PRE
+CLASS="PROGRAMLISTING"
+> interfaces = eth* lo
+ bind interfaces only = yes</PRE
+></P
+><P
+></P
+><P
+>This tells Samba to only listen for connections on interfaces with a
+name starting with 'eth' such as eth0, eth1, plus on the loopback
+interface called 'lo'. The name you will need to use depends on what
+OS you are using, in the above I used the common name for Ethernet
+adapters on Linux.</P
+><P
+>If you use the above and someone tries to make a SMB connection to
+your host over a PPP interface called 'ppp0' then they will get a TCP
+connection refused reply. In that case no Samba code is run at all as
+the operating system has been told not to pass connections from that
+interface to any process.</P
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H2
+CLASS="SECT1"
+><A
+NAME="AEN3128"
+>20.4. Using a firewall</A
+></H2
+><P
+>Many people use a firewall to deny access to services that they don't
+want exposed outside their network. This can be a very good idea,
+although I would recommend using it in conjunction with the above
+methods so that you are protected even if your firewall is not active
+for some reason.</P
+><P
+>If you are setting up a firewall then you need to know what TCP and
+UDP ports to allow and block. Samba uses the following:</P
+><P
+><PRE
+CLASS="PROGRAMLISTING"
+>UDP/137 - used by nmbd
+UDP/138 - used by nmbd
+TCP/139 - used by smbd
+TCP/445 - used by smbd</PRE
+></P
+><P
+>The last one is important as many older firewall setups may not be
+aware of it, given that this port was only added to the protocol in
+recent years. </P
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H2
+CLASS="SECT1"
+><A
+NAME="AEN3135"
+>20.5. Using a IPC$ share deny</A
+></H2
+><P
+>If the above methods are not suitable, then you could also place a
+more specific deny on the IPC$ share that is used in the recently
+discovered security hole. This allows you to offer access to other
+shares while denying access to IPC$ from potentially untrustworthy
+hosts.</P
+><P
+>To do that you could use:</P
+><P
+><PRE
+CLASS="PROGRAMLISTING"
+> [ipc$]
+ hosts allow = 192.168.115.0/24 127.0.0.1
+ hosts deny = 0.0.0.0/0</PRE
+></P
+><P
+>this would tell Samba that IPC$ connections are not allowed from
+anywhere but the two listed places (localhost and a local
+subnet). Connections to other shares would still be allowed. As the
+IPC$ share is the only share that is always accessible anonymously
+this provides some level of protection against attackers that do not
+know a username/password for your host.</P
+><P
+>If you use this method then clients will be given a 'access denied'
+reply when they try to access the IPC$ share. That means that those
+clients will not be able to browse shares, and may also be unable to
+access some other resources. </P
+><P
+>This is not recommended unless you cannot use one of the other
+methods listed above for some reason.</P
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H2
+CLASS="SECT1"
+><A
+NAME="AEN3144"
+>20.6. Upgrading Samba</A
+></H2
+><P
+>Please check regularly on http://www.samba.org/ for updates and
+important announcements. Occasionally security releases are made and
+it is highly recommended to upgrade Samba when a security vulnerability
+is discovered.</P
+></DIV
+></DIV
></DIV
><DIV
CLASS="PART"
@@ -15615,24 +15036,38 @@ HREF="#PORTABILITY"
><DL
><DT
>21.1. <A
-HREF="#AEN3251"
+HREF="#AEN3156"
>HPUX</A
></DT
><DT
>21.2. <A
-HREF="#AEN3257"
+HREF="#AEN3162"
>SCO Unix</A
></DT
><DT
>21.3. <A
-HREF="#AEN3261"
+HREF="#AEN3166"
>DNIX</A
></DT
><DT
>21.4. <A
-HREF="#AEN3290"
+HREF="#AEN3195"
>RedHat Linux Rembrandt-II</A
></DT
+><DT
+>21.5. <A
+HREF="#AEN3201"
+>AIX</A
+></DT
+><DD
+><DL
+><DT
+>21.5.1. <A
+HREF="#AEN3203"
+>Sequential Read Ahead</A
+></DT
+></DL
+></DD
></DL
></DD
><DT
@@ -15644,37 +15079,37 @@ HREF="#OTHER-CLIENTS"
><DL
><DT
>22.1. <A
-HREF="#AEN3311"
+HREF="#AEN3221"
>Macintosh clients?</A
></DT
><DT
>22.2. <A
-HREF="#AEN3320"
+HREF="#AEN3230"
>OS2 Client</A
></DT
><DD
><DL
><DT
>22.2.1. <A
-HREF="#AEN3322"
+HREF="#AEN3232"
>How can I configure OS/2 Warp Connect or
OS/2 Warp 4 as a client for Samba?</A
></DT
><DT
>22.2.2. <A
-HREF="#AEN3337"
+HREF="#AEN3247"
>How can I configure OS/2 Warp 3 (not Connect),
OS/2 1.2, 1.3 or 2.x for Samba?</A
></DT
><DT
>22.2.3. <A
-HREF="#AEN3346"
+HREF="#AEN3256"
>Are there any other issues when OS/2 (any version)
is used as a client?</A
></DT
><DT
>22.2.4. <A
-HREF="#AEN3350"
+HREF="#AEN3260"
>How do I get printer driver download working
for OS/2 clients?</A
></DT
@@ -15682,168 +15117,230 @@ HREF="#AEN3350"
></DD
><DT
>22.3. <A
-HREF="#AEN3360"
+HREF="#AEN3270"
>Windows for Workgroups</A
></DT
><DD
><DL
><DT
>22.3.1. <A
-HREF="#AEN3362"
+HREF="#AEN3272"
>Use latest TCP/IP stack from Microsoft</A
></DT
><DT
>22.3.2. <A
-HREF="#AEN3367"
+HREF="#AEN3277"
>Delete .pwl files after password change</A
></DT
><DT
>22.3.3. <A
-HREF="#AEN3372"
+HREF="#AEN3282"
>Configure WfW password handling</A
></DT
><DT
>22.3.4. <A
-HREF="#AEN3376"
+HREF="#AEN3286"
>Case handling of passwords</A
></DT
+><DT
+>22.3.5. <A
+HREF="#AEN3291"
+>Use TCP/IP as default protocol</A
+></DT
></DL
></DD
><DT
>22.4. <A
-HREF="#AEN3381"
+HREF="#AEN3294"
>Windows '95/'98</A
></DT
><DT
>22.5. <A
-HREF="#AEN3397"
+HREF="#AEN3310"
>Windows 2000 Service Pack 2</A
></DT
></DL
></DD
><DT
>23. <A
-HREF="#BUGREPORT"
->Reporting Bugs</A
+HREF="#COMPILING"
+>How to compile SAMBA</A
></DT
><DD
><DL
><DT
>23.1. <A
-HREF="#AEN3421"
+HREF="#AEN3337"
+>Access Samba source code via CVS</A
+></DT
+><DD
+><DL
+><DT
+>23.1.1. <A
+HREF="#AEN3339"
>Introduction</A
></DT
><DT
+>23.1.2. <A
+HREF="#AEN3344"
+>CVS Access to samba.org</A
+></DT
+></DL
+></DD
+><DT
>23.2. <A
-HREF="#AEN3431"
->General info</A
+HREF="#AEN3380"
+>Accessing the samba sources via rsync and ftp</A
></DT
><DT
>23.3. <A
-HREF="#AEN3437"
->Debug levels</A
+HREF="#AEN3386"
+>Building the Binaries</A
></DT
><DT
>23.4. <A
-HREF="#AEN3454"
+HREF="#AEN3414"
+>Starting the smbd and nmbd</A
+></DT
+><DD
+><DL
+><DT
+>23.4.1. <A
+HREF="#AEN3424"
+>Starting from inetd.conf</A
+></DT
+><DT
+>23.4.2. <A
+HREF="#AEN3453"
+>Alternative: starting it as a daemon</A
+></DT
+></DL
+></DD
+></DL
+></DD
+><DT
+>24. <A
+HREF="#BUGREPORT"
+>Reporting Bugs</A
+></DT
+><DD
+><DL
+><DT
+>24.1. <A
+HREF="#AEN3476"
+>Introduction</A
+></DT
+><DT
+>24.2. <A
+HREF="#AEN3486"
+>General info</A
+></DT
+><DT
+>24.3. <A
+HREF="#AEN3492"
+>Debug levels</A
+></DT
+><DT
+>24.4. <A
+HREF="#AEN3509"
>Internal errors</A
></DT
><DT
->23.5. <A
-HREF="#AEN3464"
+>24.5. <A
+HREF="#AEN3519"
>Attaching to a running process</A
></DT
><DT
->23.6. <A
-HREF="#AEN3467"
+>24.6. <A
+HREF="#AEN3522"
>Patches</A
></DT
></DL
></DD
><DT
->24. <A
+>25. <A
HREF="#DIAGNOSIS"
->Diagnosing your samba server</A
+>The samba checklist</A
></DT
><DD
><DL
><DT
->24.1. <A
-HREF="#AEN3490"
+>25.1. <A
+HREF="#AEN3545"
>Introduction</A
></DT
><DT
->24.2. <A
-HREF="#AEN3495"
+>25.2. <A
+HREF="#AEN3550"
>Assumptions</A
></DT
><DT
->24.3. <A
-HREF="#AEN3505"
+>25.3. <A
+HREF="#AEN3560"
>Tests</A
></DT
><DD
><DL
><DT
->24.3.1. <A
-HREF="#AEN3507"
+>25.3.1. <A
+HREF="#AEN3562"
>Test 1</A
></DT
><DT
->24.3.2. <A
-HREF="#AEN3513"
+>25.3.2. <A
+HREF="#AEN3568"
>Test 2</A
></DT
><DT
->24.3.3. <A
-HREF="#AEN3519"
+>25.3.3. <A
+HREF="#AEN3574"
>Test 3</A
></DT
><DT
->24.3.4. <A
-HREF="#AEN3534"
+>25.3.4. <A
+HREF="#AEN3589"
>Test 4</A
></DT
><DT
->24.3.5. <A
-HREF="#AEN3539"
+>25.3.5. <A
+HREF="#AEN3594"
>Test 5</A
></DT
><DT
->24.3.6. <A
-HREF="#AEN3545"
+>25.3.6. <A
+HREF="#AEN3600"
>Test 6</A
></DT
><DT
->24.3.7. <A
-HREF="#AEN3553"
+>25.3.7. <A
+HREF="#AEN3608"
>Test 7</A
></DT
><DT
->24.3.8. <A
-HREF="#AEN3579"
+>25.3.8. <A
+HREF="#AEN3634"
>Test 8</A
></DT
><DT
->24.3.9. <A
-HREF="#AEN3596"
+>25.3.9. <A
+HREF="#AEN3651"
>Test 9</A
></DT
><DT
->24.3.10. <A
-HREF="#AEN3604"
+>25.3.10. <A
+HREF="#AEN3659"
>Test 10</A
></DT
><DT
->24.3.11. <A
-HREF="#AEN3610"
+>25.3.11. <A
+HREF="#AEN3665"
>Test 11</A
></DT
></DL
></DD
><DT
->24.4. <A
-HREF="#AEN3615"
+>25.4. <A
+HREF="#AEN3670"
>Still having troubles?</A
></DT
></DL
@@ -15867,9 +15364,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3251"
-></A
->21.1. HPUX</H2
+NAME="AEN3156"
+>21.1. HPUX</A
+></H2
><P
>HP's implementation of supplementary groups is, er, non-standard (for
hysterical reasons). There are two group files, /etc/group and
@@ -15897,9 +15394,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3257"
-></A
->21.2. SCO Unix</H2
+NAME="AEN3162"
+>21.2. SCO Unix</A
+></H2
><P
>
If you run an old version of SCO Unix then you may need to get important
@@ -15914,9 +15411,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3261"
-></A
->21.3. DNIX</H2
+NAME="AEN3166"
+>21.3. DNIX</A
+></H2
><P
>DNIX has a problem with seteuid() and setegid(). These routines are
needed for Samba to work correctly, but they were left out of the DNIX
@@ -16021,9 +15518,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3290"
-></A
->21.4. RedHat Linux Rembrandt-II</H2
+NAME="AEN3195"
+>21.4. RedHat Linux Rembrandt-II</A
+></H2
><P
>By default RedHat Rembrandt-II during installation adds an
entry to /etc/hosts as follows:
@@ -16040,6 +15537,27 @@ is the master browse list holder and who is the master browser.</P
>Corrective Action: Delete the entry after the word loopback
in the line starting 127.0.0.1</P
></DIV
+><DIV
+CLASS="SECT1"
+><HR><H2
+CLASS="SECT1"
+><A
+NAME="AEN3201"
+>21.5. AIX</A
+></H2
+><DIV
+CLASS="SECT2"
+><H3
+CLASS="SECT2"
+><A
+NAME="AEN3203"
+>21.5.1. Sequential Read Ahead</A
+></H3
+><P
+>Disabling Sequential Read Ahead using "vmtune -r 0" improves
+samba performance significally.</P
+></DIV
+></DIV
></DIV
><DIV
CLASS="CHAPTER"
@@ -16055,9 +15573,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3311"
-></A
->22.1. Macintosh clients?</H2
+NAME="AEN3221"
+>22.1. Macintosh clients?</A
+></H2
><P
>Yes. <A
HREF="http://www.thursby.com/"
@@ -16101,18 +15619,18 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3320"
-></A
->22.2. OS2 Client</H2
+NAME="AEN3230"
+>22.2. OS2 Client</A
+></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
-NAME="AEN3322"
-></A
+NAME="AEN3232"
>22.2.1. How can I configure OS/2 Warp Connect or
- OS/2 Warp 4 as a client for Samba?</H3
+ OS/2 Warp 4 as a client for Samba?</A
+></H3
><P
>A more complete answer to this question can be
found on <A
@@ -16168,10 +15686,10 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3337"
-></A
+NAME="AEN3247"
>22.2.2. How can I configure OS/2 Warp 3 (not Connect),
- OS/2 1.2, 1.3 or 2.x for Samba?</H3
+ OS/2 1.2, 1.3 or 2.x for Samba?</A
+></H3
><P
>You can use the free Microsoft LAN Manager 2.2c Client
for OS/2 from
@@ -16212,10 +15730,10 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3346"
-></A
+NAME="AEN3256"
>22.2.3. Are there any other issues when OS/2 (any version)
- is used as a client?</H3
+ is used as a client?</A
+></H3
><P
>When you do a NET VIEW or use the "File and Print
Client Resource Browser", no Samba servers show up. This can
@@ -16234,10 +15752,10 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3350"
-></A
+NAME="AEN3260"
>22.2.4. How do I get printer driver download working
- for OS/2 clients?</H3
+ for OS/2 clients?</A
+></H3
><P
>First, create a share called [PRINTDRV] that is
world-readable. Copy your OS/2 driver files there. Note
@@ -16247,17 +15765,13 @@ NAME="AEN3350"
><P
>Install the NT driver first for that printer. Then,
add to your smb.conf a parameter, os2 driver map =
- <TT
+ <VAR
CLASS="REPLACEABLE"
-><I
->filename</I
-></TT
+>filename</VAR
>". Then, in the file
- specified by <TT
+ specified by <VAR
CLASS="REPLACEABLE"
-><I
->filename</I
-></TT
+>filename</VAR
>, map the
name of the NT driver name to the OS/2 driver name as
follows:</P
@@ -16285,17 +15799,17 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3360"
-></A
->22.3. Windows for Workgroups</H2
+NAME="AEN3270"
+>22.3. Windows for Workgroups</A
+></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
-NAME="AEN3362"
-></A
->22.3.1. Use latest TCP/IP stack from Microsoft</H3
+NAME="AEN3272"
+>22.3.1. Use latest TCP/IP stack from Microsoft</A
+></H3
><P
>Use the latest TCP/IP stack from microsoft if you use Windows
for workgroups.</P
@@ -16315,9 +15829,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3367"
-></A
->22.3.2. Delete .pwl files after password change</H3
+NAME="AEN3277"
+>22.3.2. Delete .pwl files after password change</A
+></H3
><P
>WfWg does a lousy job with passwords. I find that if I change my
password on either the unix box or the PC the safest thing to do is to
@@ -16335,9 +15849,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3372"
-></A
->22.3.3. Configure WfW password handling</H3
+NAME="AEN3282"
+>22.3.3. Configure WfW password handling</A
+></H3
><P
>There is a program call admincfg.exe
on the last disk (disk 8) of the WFW 3.11 disk set. To install it
@@ -16354,9 +15868,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3376"
-></A
->22.3.4. Case handling of passwords</H3
+NAME="AEN3286"
+>22.3.4. Case handling of passwords</A
+></H3
><P
>Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the <A
HREF="smb.conf.5.html"
@@ -16367,15 +15881,30 @@ CLASS="COMMAND"
>password level</B
> to specify what characters samba should try to uppercase when checking.</P
></DIV
+><DIV
+CLASS="SECT2"
+><HR><H3
+CLASS="SECT2"
+><A
+NAME="AEN3291"
+>22.3.5. Use TCP/IP as default protocol</A
+></H3
+><P
+>To support print queue reporting you may find
+that you have to use TCP/IP as the default protocol under
+WfWg. For some reason if you leave Netbeui as the default
+it may break the print queue reporting on some systems.
+It is presumably a WfWg bug.</P
+></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3381"
-></A
->22.4. Windows '95/'98</H2
+NAME="AEN3294"
+>22.4. Windows '95/'98</A
+></H2
><P
>When using Windows 95 OEM SR2 the following updates are recommended where Samba
is being used. Please NOTE that the above change will affect you once these
@@ -16421,9 +15950,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3397"
-></A
->22.5. Windows 2000 Service Pack 2</H2
+NAME="AEN3310"
+>22.5. Windows 2000 Service Pack 2</A
+></H2
><P
>
There are several annoyances with Windows 2000 SP2. One of which
@@ -16503,17 +16032,513 @@ create accounts on the Samba host for Domain users.</I
CLASS="CHAPTER"
><HR><H1
><A
+NAME="COMPILING"
+></A
+>Chapter 23. How to compile SAMBA</H1
+><P
+>You can obtain the samba source from the <A
+HREF="http://samba.org/"
+TARGET="_top"
+>samba website</A
+>. To obtain a development version,
+you can download samba from CVS or using rsync. </P
+><DIV
+CLASS="SECT1"
+><HR><H2
+CLASS="SECT1"
+><A
+NAME="AEN3337"
+>23.1. Access Samba source code via CVS</A
+></H2
+><DIV
+CLASS="SECT2"
+><H3
+CLASS="SECT2"
+><A
+NAME="AEN3339"
+>23.1.1. Introduction</A
+></H3
+><P
+>Samba is developed in an open environment. Developers use CVS
+(Concurrent Versioning System) to "checkin" (also known as
+"commit") new source code. Samba's various CVS branches can
+be accessed via anonymous CVS using the instructions
+detailed in this chapter.</P
+><P
+>This chapter is a modified version of the instructions found at
+<A
+HREF="http://samba.org/samba/cvs.html"
+TARGET="_top"
+>http://samba.org/samba/cvs.html</A
+></P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H3
+CLASS="SECT2"
+><A
+NAME="AEN3344"
+>23.1.2. CVS Access to samba.org</A
+></H3
+><P
+>The machine samba.org runs a publicly accessible CVS
+repository for access to the source code of several packages,
+including samba, rsync and jitterbug. There are two main ways of
+accessing the CVS server on this host.</P
+><DIV
+CLASS="SECT3"
+><HR><H4
+CLASS="SECT3"
+><A
+NAME="AEN3347"
+>23.1.2.1. Access via CVSweb</A
+></H4
+><P
+>You can access the source code via your
+favourite WWW browser. This allows you to access the contents of
+individual files in the repository and also to look at the revision
+history and commit logs of individual files. You can also ask for a diff
+listing between any two versions on the repository.</P
+><P
+>Use the URL : <A
+HREF="http://samba.org/cgi-bin/cvsweb"
+TARGET="_top"
+>http://samba.org/cgi-bin/cvsweb</A
+></P
+></DIV
+><DIV
+CLASS="SECT3"
+><HR><H4
+CLASS="SECT3"
+><A
+NAME="AEN3352"
+>23.1.2.2. Access via cvs</A
+></H4
+><P
+>You can also access the source code via a
+normal cvs client. This gives you much more control over you can
+do with the repository and allows you to checkout whole source trees
+and keep them up to date via normal cvs commands. This is the
+preferred method of access if you are a developer and not
+just a casual browser.</P
+><P
+>To download the latest cvs source code, point your
+browser at the URL : <A
+HREF="http://www.cyclic.com/"
+TARGET="_top"
+>http://www.cyclic.com/</A
+>.
+and click on the 'How to get cvs' link. CVS is free software under
+the GNU GPL (as is Samba). Note that there are several graphical CVS clients
+which provide a graphical interface to the sometimes mundane CVS commands.
+Links to theses clients are also available from http://www.cyclic.com.</P
+><P
+>To gain access via anonymous cvs use the following steps.
+For this example it is assumed that you want a copy of the
+samba source code. For the other source code repositories
+on this system just substitute the correct package name</P
+><P
+></P
+><OL
+TYPE="1"
+><LI
+><P
+> Install a recent copy of cvs. All you really need is a
+ copy of the cvs client binary.
+ </P
+></LI
+><LI
+><P
+> Run the command
+ </P
+><P
+> <B
+CLASS="COMMAND"
+>cvs -d :pserver:cvs@samba.org:/cvsroot login</B
+>
+ </P
+><P
+> When it asks you for a password type <KBD
+CLASS="USERINPUT"
+>cvs</KBD
+>.
+ </P
+></LI
+><LI
+><P
+> Run the command
+ </P
+><P
+> <B
+CLASS="COMMAND"
+>cvs -d :pserver:cvs@samba.org:/cvsroot co samba</B
+>
+ </P
+><P
+> This will create a directory called samba containing the
+ latest samba source code (i.e. the HEAD tagged cvs branch). This
+ currently corresponds to the 3.0 development tree.
+ </P
+><P
+> CVS branches other HEAD can be obtained by using the <VAR
+CLASS="PARAMETER"
+>-r</VAR
+>
+ and defining a tag name. A list of branch tag names can be found on the
+ "Development" page of the samba web site. A common request is to obtain the
+ latest 2.2 release code. This could be done by using the following command.
+ </P
+><P
+> <B
+CLASS="COMMAND"
+>cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_2_2 samba</B
+>
+ </P
+></LI
+><LI
+><P
+> Whenever you want to merge in the latest code changes use
+ the following command from within the samba directory:
+ </P
+><P
+> <B
+CLASS="COMMAND"
+>cvs update -d -P</B
+>
+ </P
+></LI
+></OL
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H2
+CLASS="SECT1"
+><A
+NAME="AEN3380"
+>23.2. Accessing the samba sources via rsync and ftp</A
+></H2
+><P
+> pserver.samba.org also exports unpacked copies of most parts of the CVS tree at <A
+HREF="ftp://pserver.samba.org/pub/unpacked"
+TARGET="_top"
+>ftp://pserver.samba.org/pub/unpacked</A
+> and also via anonymous rsync at rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp.
+ See <A
+HREF="http://rsync.samba.org/"
+TARGET="_top"
+>the rsync homepage</A
+> for more info on rsync.
+ </P
+><P
+> The disadvantage of the unpacked trees
+ is that they do not support automatic
+ merging of local changes like CVS does.
+ rsync access is most convenient for an
+ initial install.
+ </P
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H2
+CLASS="SECT1"
+><A
+NAME="AEN3386"
+>23.3. Building the Binaries</A
+></H2
+><P
+>To do this, first run the program <B
+CLASS="COMMAND"
+>./configure
+ </B
+> in the source directory. This should automatically
+ configure Samba for your operating system. If you have unusual
+ needs then you may wish to run</P
+><P
+><SAMP
+CLASS="PROMPT"
+>root# </SAMP
+><KBD
+CLASS="USERINPUT"
+>./configure --help
+ </KBD
+></P
+><P
+>first to see what special options you can enable.
+ Then executing</P
+><P
+><SAMP
+CLASS="PROMPT"
+>root# </SAMP
+><KBD
+CLASS="USERINPUT"
+>make</KBD
+></P
+><P
+>will create the binaries. Once it's successfully
+ compiled you can use </P
+><P
+><SAMP
+CLASS="PROMPT"
+>root# </SAMP
+><KBD
+CLASS="USERINPUT"
+>make install</KBD
+></P
+><P
+>to install the binaries and manual pages. You can
+ separately install the binaries and/or man pages using</P
+><P
+><SAMP
+CLASS="PROMPT"
+>root# </SAMP
+><KBD
+CLASS="USERINPUT"
+>make installbin
+ </KBD
+></P
+><P
+>and</P
+><P
+><SAMP
+CLASS="PROMPT"
+>root# </SAMP
+><KBD
+CLASS="USERINPUT"
+>make installman
+ </KBD
+></P
+><P
+>Note that if you are upgrading for a previous version
+ of Samba you might like to know that the old versions of
+ the binaries will be renamed with a ".old" extension. You
+ can go back to the previous version with</P
+><P
+><SAMP
+CLASS="PROMPT"
+>root# </SAMP
+><KBD
+CLASS="USERINPUT"
+>make revert
+ </KBD
+></P
+><P
+>if you find this version a disaster!</P
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H2
+CLASS="SECT1"
+><A
+NAME="AEN3414"
+>23.4. Starting the smbd and nmbd</A
+></H2
+><P
+>You must choose to start smbd and nmbd either
+ as daemons or from <B
+CLASS="COMMAND"
+>inetd</B
+>. Don't try
+ to do both! Either you can put them in <TT
+CLASS="FILENAME"
+> inetd.conf</TT
+> and have them started on demand
+ by <B
+CLASS="COMMAND"
+>inetd</B
+>, or you can start them as
+ daemons either from the command line or in <TT
+CLASS="FILENAME"
+> /etc/rc.local</TT
+>. See the man pages for details
+ on the command line options. Take particular care to read
+ the bit about what user you need to be in order to start
+ Samba. In many cases you must be root.</P
+><P
+>The main advantage of starting <B
+CLASS="COMMAND"
+>smbd</B
+>
+ and <B
+CLASS="COMMAND"
+>nmbd</B
+> using the recommended daemon method
+ is that they will respond slightly more quickly to an initial connection
+ request.</P
+><DIV
+CLASS="SECT2"
+><HR><H3
+CLASS="SECT2"
+><A
+NAME="AEN3424"
+>23.4.1. Starting from inetd.conf</A
+></H3
+><P
+>NOTE; The following will be different if
+ you use NIS, NIS+ or LDAP to distribute services maps.</P
+><P
+>Look at your <TT
+CLASS="FILENAME"
+>/etc/services</TT
+>.
+ What is defined at port 139/tcp. If nothing is defined
+ then add a line like this:</P
+><P
+><KBD
+CLASS="USERINPUT"
+>netbios-ssn 139/tcp</KBD
+></P
+><P
+>similarly for 137/udp you should have an entry like:</P
+><P
+><KBD
+CLASS="USERINPUT"
+>netbios-ns 137/udp</KBD
+></P
+><P
+>Next edit your <TT
+CLASS="FILENAME"
+>/etc/inetd.conf</TT
+>
+ and add two lines something like this:</P
+><P
+><PRE
+CLASS="PROGRAMLISTING"
+> netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd
+ netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd
+ </PRE
+></P
+><P
+>The exact syntax of <TT
+CLASS="FILENAME"
+>/etc/inetd.conf</TT
+>
+ varies between unixes. Look at the other entries in inetd.conf
+ for a guide.</P
+><P
+>NOTE: Some unixes already have entries like netbios_ns
+ (note the underscore) in <TT
+CLASS="FILENAME"
+>/etc/services</TT
+>.
+ You must either edit <TT
+CLASS="FILENAME"
+>/etc/services</TT
+> or
+ <TT
+CLASS="FILENAME"
+>/etc/inetd.conf</TT
+> to make them consistent.</P
+><P
+>NOTE: On many systems you may need to use the
+ "interfaces" option in smb.conf to specify the IP address
+ and netmask of your interfaces. Run <B
+CLASS="COMMAND"
+>ifconfig</B
+>
+ as root if you don't know what the broadcast is for your
+ net. <B
+CLASS="COMMAND"
+>nmbd</B
+> tries to determine it at run
+ time, but fails on some unixes. See the section on "testing nmbd"
+ for a method of finding if you need to do this.</P
+><P
+>!!!WARNING!!! Many unixes only accept around 5
+ parameters on the command line in <TT
+CLASS="FILENAME"
+>inetd.conf</TT
+>.
+ This means you shouldn't use spaces between the options and
+ arguments, or you should use a script, and start the script
+ from <B
+CLASS="COMMAND"
+>inetd</B
+>.</P
+><P
+>Restart <B
+CLASS="COMMAND"
+>inetd</B
+>, perhaps just send
+ it a HUP. If you have installed an earlier version of <B
+CLASS="COMMAND"
+> nmbd</B
+> then you may need to kill nmbd as well.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H3
+CLASS="SECT2"
+><A
+NAME="AEN3453"
+>23.4.2. Alternative: starting it as a daemon</A
+></H3
+><P
+>To start the server as a daemon you should create
+ a script something like this one, perhaps calling
+ it <TT
+CLASS="FILENAME"
+>startsmb</TT
+>.</P
+><P
+><PRE
+CLASS="PROGRAMLISTING"
+> #!/bin/sh
+ /usr/local/samba/bin/smbd -D
+ /usr/local/samba/bin/nmbd -D
+ </PRE
+></P
+><P
+>then make it executable with <B
+CLASS="COMMAND"
+>chmod
+ +x startsmb</B
+></P
+><P
+>You can then run <B
+CLASS="COMMAND"
+>startsmb</B
+> by
+ hand or execute it from <TT
+CLASS="FILENAME"
+>/etc/rc.local</TT
+>
+ </P
+><P
+>To kill it send a kill signal to the processes
+ <B
+CLASS="COMMAND"
+>nmbd</B
+> and <B
+CLASS="COMMAND"
+>smbd</B
+>.</P
+><P
+>NOTE: If you use the SVR4 style init system then
+ you may like to look at the <TT
+CLASS="FILENAME"
+>examples/svr4-startup</TT
+>
+ script to make Samba fit into that system.</P
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
NAME="BUGREPORT"
></A
->Chapter 23. Reporting Bugs</H1
+>Chapter 24. Reporting Bugs</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN3421"
-></A
->23.1. Introduction</H2
+NAME="AEN3476"
+>24.1. Introduction</A
+></H2
><P
>The email address for bug reports for stable releases is <A
HREF="samba@samba.org"
@@ -16556,9 +16581,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3431"
-></A
->23.2. General info</H2
+NAME="AEN3486"
+>24.2. General info</A
+></H2
><P
>Before submitting a bug report check your config for silly
errors. Look in your log files for obvious messages that tell you that
@@ -16581,9 +16606,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3437"
-></A
->23.3. Debug levels</H2
+NAME="AEN3492"
+>24.3. Debug levels</A
+></H2
><P
>If the bug has anything to do with Samba behaving incorrectly as a
server (like refusing to open a file) then the log files will probably
@@ -16651,9 +16676,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3454"
-></A
->23.4. Internal errors</H2
+NAME="AEN3509"
+>24.4. Internal errors</A
+></H2
><P
>If you get a "INTERNAL ERROR" message in your log files it means that
Samba got an unexpected signal while running. It is probably a
@@ -16695,9 +16720,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3464"
-></A
->23.5. Attaching to a running process</H2
+NAME="AEN3519"
+>24.5. Attaching to a running process</A
+></H2
><P
>Unfortunately some unixes (in particular some recent linux kernels)
refuse to dump a core file if the task has changed uid (which smbd
@@ -16712,9 +16737,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3467"
-></A
->23.6. Patches</H2
+NAME="AEN3522"
+>24.6. Patches</A
+></H2
><P
>The best sort of bug report is one that includes a fix! If you send us
patches please use <B
@@ -16735,15 +16760,15 @@ CLASS="CHAPTER"
><A
NAME="DIAGNOSIS"
></A
->Chapter 24. Diagnosing your samba server</H1
+>Chapter 25. The samba checklist</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
-NAME="AEN3490"
-></A
->24.1. Introduction</H2
+NAME="AEN3545"
+>25.1. Introduction</A
+></H2
><P
>This file contains a list of tests you can perform to validate your
Samba server. It also tells you what the likely cause of the problem
@@ -16763,9 +16788,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3495"
-></A
->24.2. Assumptions</H2
+NAME="AEN3550"
+>25.2. Assumptions</A
+></H2
><P
>In all of the tests it is assumed you have a Samba server called
BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.</P
@@ -16801,17 +16826,17 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3505"
-></A
->24.3. Tests</H2
+NAME="AEN3560"
+>25.3. Tests</A
+></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
-NAME="AEN3507"
-></A
->24.3.1. Test 1</H3
+NAME="AEN3562"
+>25.3.1. Test 1</A
+></H3
><P
>In the directory in which you store your smb.conf file, run the command
"testparm smb.conf". If it reports any errors then your smb.conf
@@ -16831,9 +16856,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3513"
-></A
->24.3.2. Test 2</H3
+NAME="AEN3568"
+>25.3.2. Test 2</A
+></H3
><P
>Run the command "ping BIGSERVER" from the PC and "ping ACLIENT" from
the unix box. If you don't get a valid response then your TCP/IP
@@ -16857,9 +16882,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3519"
-></A
->24.3.3. Test 3</H3
+NAME="AEN3574"
+>25.3.3. Test 3</A
+></H3
><P
>Run the command "smbclient -L BIGSERVER" on the unix box. You
should get a list of available shares back. </P
@@ -16928,9 +16953,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3534"
-></A
->24.3.4. Test 4</H3
+NAME="AEN3589"
+>25.3.4. Test 4</A
+></H3
><P
>Run the command "nmblookup -B BIGSERVER __SAMBA__". You should get the
IP address of your Samba server back.</P
@@ -16949,9 +16974,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3539"
-></A
->24.3.5. Test 5</H3
+NAME="AEN3594"
+>25.3.5. Test 5</A
+></H3
><P
>run the command <B
CLASS="COMMAND"
@@ -16970,9 +16995,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3545"
-></A
->24.3.6. Test 6</H3
+NAME="AEN3600"
+>25.3.6. Test 6</A
+></H3
><P
>Run the command <B
CLASS="COMMAND"
@@ -17004,9 +17029,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3553"
-></A
->24.3.7. Test 7</H3
+NAME="AEN3608"
+>25.3.7. Test 7</A
+></H3
><P
>Run the command <B
CLASS="COMMAND"
@@ -17014,7 +17039,7 @@ CLASS="COMMAND"
>. You should
then be prompted for a password. You should use the password of the account
you are logged into the unix box with. If you want to test with
-another account then add the -U &gt;accountname&lt; option to the end of
+another account then add the -U &#62;accountname&#60; option to the end of
the command line. eg:
<B
CLASS="COMMAND"
@@ -17080,7 +17105,7 @@ CLASS="COMMAND"
> etc.
Type <B
CLASS="COMMAND"
->help &gt;command&lt;</B
+>help &#62;command&#60;</B
> for instructions. You should
especially check that the amount of free disk space shown is correct
when you type <B
@@ -17093,9 +17118,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3579"
-></A
->24.3.8. Test 8</H3
+NAME="AEN3634"
+>25.3.8. Test 8</A
+></H3
><P
>On the PC type the command <B
CLASS="COMMAND"
@@ -17153,9 +17178,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3596"
-></A
->24.3.9. Test 9</H3
+NAME="AEN3651"
+>25.3.9. Test 9</A
+></H3
><P
>Run the command <B
CLASS="COMMAND"
@@ -17187,9 +17212,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3604"
-></A
->24.3.10. Test 10</H3
+NAME="AEN3659"
+>25.3.10. Test 10</A
+></H3
><P
>Run the command <B
CLASS="COMMAND"
@@ -17213,9 +17238,9 @@ CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
-NAME="AEN3610"
-></A
->24.3.11. Test 11</H3
+NAME="AEN3665"
+>25.3.11. Test 11</A
+></H3
><P
>From file manager try to browse the server. Your samba server should
appear in the browse list of your local workgroup (or the one you
@@ -17241,9 +17266,9 @@ CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
-NAME="AEN3615"
-></A
->24.4. Still having troubles?</H2
+NAME="AEN3670"
+>25.4. Still having troubles?</A
+></H2
><P
>Try the mailing list or newsgroup, or use the ethereal utility to
sniff the problem. The official samba mailing list can be reached at
generated by cgit (git 2.34.1) at 2024-11-10 03:52:31 +0000