diff options
Diffstat (limited to 'docs/htmldocs/samba-pdc-faq.html')
| -rw-r--r-- | docs/htmldocs/samba-pdc-faq.html | 1509 |
1 files changed, 637 insertions, 872 deletions
diff --git a/docs/htmldocs/samba-pdc-faq.html b/docs/htmldocs/samba-pdc-faq.html index ec8efaff4b..058a5d5f51 100644 --- a/docs/htmldocs/samba-pdc-faq.html +++ b/docs/htmldocs/samba-pdc-faq.html @@ -44,45 +44,24 @@ NAME="AEN12" ></A ></H1 ><P ->Comments, corrections and additions to <TT -CLASS="EMAIL" -><<A -HREF="mailto:D.Bannon@latrobe.edu.au" ->D.Bannon@latrobe.edu.au</A ->></TT -></P -><P ->This is the FAQ for Samba 2.2 as an NTDomain controller. +> This is the FAQ for Samba 2.2 as an NTDomain controller. This document is derived from the origional FAQ that was built and - maintained by Gerald Carter - from the early days of Samba NTDomain development up until recently. - It is now being updated as significent changes are made to 2.2.0.</P -><P ->Please note it does not apply to Samba2.2alpha0, Samba2.2alpha1, Samba 2.0.7, TNG nor HEAD branch. - </P + maintained by Gerald Carter from the early days of Samba NTDomain development + up until recently. It is now being updated as significent changes are + made to 2.2.0. + </P ><P ->I'll repeat, it does not apply to the current snapshot [ftp mirror]:/pub/samba/alpha/samba-2.2.0-alpha1.tar.gz, only to the to the current cvs.</P +> Please note it does not apply to the SAMBA_TNG nor the HEAD branch. + </P ><P > Also available is a Samba 2.2 PDC <A HREF="samba-pdc-howto.html" TARGET="_top" ->HowTo</A -> that takes you, step - by step, over the process of setting up a very basic Samba 2.2 Primary Domain Controller - </P -><DIV -CLASS="NOTE" -><BLOCKQUOTE -CLASS="NOTE" -><P -><B ->Note: </B ->Please read the Introduction for the current <A -HREF="#AEN27" -> state of play</A ->.</P -></BLOCKQUOTE -></DIV +>HOWTO</A +> + that takes you, step by step, over the process of setting up a very basic Samba + 2.2 Primary Domain Controller + </P ><DIV CLASS="TOC" ><DL @@ -92,69 +71,65 @@ CLASS="TOC" ></DT ><DT >1. <A -HREF="#AEN25" +HREF="#AEN19" >Introduction</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN27" +HREF="#AEN21" >State of Play</A ></DT ><DT ><A -HREF="#AEN50" +HREF="#AEN27" >Introduction</A ></DT ></DL ></DD ><DT >2. <A -HREF="#AEN55" +HREF="#AEN33" >General Information</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN57" +HREF="#AEN35" >What can we do ?</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN59" ->What can Samba Primary Domain Controller (PDC) do ?</A +HREF="#AEN37" +>What can Samba 2.2.x Primary Domain Controller (PDC) do ?</A ></DT ><DT ><A -HREF="#AEN92" ->Can I have a Windows 2000 client logon to a Samba controlled domain?</A -></DT -><DT -><A -HREF="#AEN95" ->What's the status of print spool (spoolss) support in the NTDOM code?</A +HREF="#AEN62" +>Can I have a Windows 2000 client logon to a Samba +controlled domain?</A ></DT ></DL ></DD ><DT ><A -HREF="#AEN98" +HREF="#AEN65" >CVS</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN101" +HREF="#AEN68" >What are the different Samba branches available in CVS ?</A ></DT ><DT ><A -HREF="#AEN124" +HREF="#AEN91" >What are the CVS commands ?</A ></DT ></DL @@ -163,58 +138,60 @@ HREF="#AEN124" ></DD ><DT >3. <A -HREF="#AEN155" +HREF="#AEN95" >Establishing Connections</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN157" +HREF="#AEN97" ></A ></DT ><DD ><DL ><DT ><A -HREF="#AEN159" ->How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</A +HREF="#AEN99" +>How do I get my NT4 or W2000 Workstation to login to the Samba +controlled Domain?</A ></DT ><DT ><A -HREF="#AEN164" +HREF="#AEN103" >What is a 'machine account' ?</A ></DT ><DT ><A -HREF="#AEN171" ->"The machine account for this computer either does not exist or is not accessable."</A +HREF="#AEN110" +>"The machine account for this computer either does not +exist or is not accessable."</A ></DT ><DT ><A -HREF="#AEN177" +HREF="#AEN116" >How do I create machine accounts manually ?</A ></DT ><DT ><A -HREF="#AEN190" +HREF="#AEN129" >I cannot include a '$' in a machine name.</A ></DT ><DT ><A -HREF="#AEN196" ->I get told "You already have a connection to the Domain...." when creating a - machine account.</A +HREF="#AEN135" +>I get told "You already have a connection to the Domain...." +when creating a machine account.</A ></DT ><DT ><A -HREF="#AEN200" ->I get told "Cannot join domain, the credentials supplied conflict - with an existing set.."</A +HREF="#AEN139" +>I get told "Cannot join domain, the credentials supplied +conflict with an existing set.."</A ></DT ><DT ><A -HREF="#AEN204" +HREF="#AEN143" >"The system can not log you on (C000019B)...."</A ></DT ></DL @@ -223,93 +200,96 @@ HREF="#AEN204" ></DD ><DT >4. <A -HREF="#AEN208" +HREF="#AEN147" >User Account Management</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN210" +HREF="#AEN149" >Domain Admins</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN212" +HREF="#AEN151" >How do I configure an account as a domain administrator?</A ></DT ></DL ></DD ><DT ><A -HREF="#AEN216" +HREF="#AEN155" >Profiles</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN218" ->Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</A +HREF="#AEN157" +>Why is it bad to set "logon path = \\%N\%U\profile" in +smb.conf?</A ></DT ><DT ><A -HREF="#AEN232" ->Why are all the users listed in the "domain admin users" using the same profile?</A +HREF="#AEN169" +>Why are all the users listed in the "domain admin users" using the +same profile?</A ></DT ><DT ><A -HREF="#AEN235" ->The roaming profiles do not seem to be updating on the server.</A +HREF="#AEN172" +>The roaming profiles do not seem to be updating on the +server.</A ></DT ></DL ></DD ><DT ><A -HREF="#AEN243" +HREF="#AEN180" >Policies</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN245" +HREF="#AEN182" >What are 'Policies' ?.</A ></DT ><DT ><A -HREF="#AEN252" +HREF="#AEN188" >I can't get system policies to work.</A ></DT ><DT ><A -HREF="#AEN266" +HREF="#AEN203" >What about Windows NT Policy Editor ?</A ></DT ><DT ><A -HREF="#AEN280" +HREF="#AEN217" >Can Win95 do Policies ?</A ></DT ></DL ></DD ><DT ><A -HREF="#AEN286" +HREF="#AEN223" >Passwords</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN288" +HREF="#AEN225" >What is password sync and should I use it ?</A ></DT ><DT ><A -HREF="#AEN301" +HREF="#AEN239" >How do I get remote password (unix and SMB) changing working ?</A ></DT ></DL @@ -318,41 +298,42 @@ HREF="#AEN301" ></DD ><DT >5. <A -HREF="#AEN307" +HREF="#AEN246" >Miscellaneous</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN309" +HREF="#AEN248" ></A ></DT ><DD ><DL ><DT ><A -HREF="#AEN311" ->What editor can I use in DOS/Windows that won't mess with my unix EOF</A +HREF="#AEN250" +>What editor can I use in DOS/Windows that won't +mess with my unix EOF</A ></DT ><DT ><A -HREF="#AEN324" +HREF="#AEN263" >How do I get 'User Manager' and 'Server Manager'</A ></DT ><DT ><A -HREF="#AEN339" +HREF="#AEN278" >The time setting from a Samba server does not work.</A ></DT ><DT ><A -HREF="#AEN343" +HREF="#AEN282" >"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A ></DT ><DT ><A -HREF="#AEN347" +HREF="#AEN286" >How do I get my samba server to become a member ( not PDC ) of an NT domain?</A ></DT ></DL @@ -361,51 +342,52 @@ HREF="#AEN347" ></DD ><DT >6. <A -HREF="#AEN382" +HREF="#AEN290" >Troubleshooting and Bug Reporting</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN384" +HREF="#AEN292" >Diagnostic tools</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN386" +HREF="#AEN294" >What are some diagnostics tools I can use to debug the domain logon process and where can I find them?</A ></DT ><DT ><A -HREF="#AEN400" ->How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</A +HREF="#AEN309" +>How do I install 'Network Monitor' on an NT Workstation +or a Windows 9x box?</A ></DT ></DL ></DD ><DT ><A -HREF="#AEN429" +HREF="#AEN338" >What other help can I get ?</A ></DT ><DD ><DL ><DT ><A -HREF="#AEN432" +HREF="#AEN341" >URLs and similar</A ></DT ><DT ><A -HREF="#AEN481" +HREF="#AEN374" >How do I get help from the mailing lists ?</A ></DT ><DT ><A -HREF="#AEN510" +HREF="#AEN403" >How do I get off the mailing lists ?</A ></DT ></DL @@ -418,7 +400,7 @@ HREF="#AEN510" CLASS="CHAPTER" ><HR><H1 ><A -NAME="AEN25" +NAME="AEN19" >Chapter 1. Introduction</A ></H1 ><DIV @@ -426,72 +408,10 @@ CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN27" +NAME="AEN21" >State of Play</A ></H1 ><P -><I -CLASS="EMPHASIS" ->It should be noted that 2.2.0 in its pre-release form still has a few problems, - I'll try and keep this section current while things are still dynamic. - At the time of this update (December 15, 2000) the current state of play is :</I -></P -><P ->Comments here about W2K joining the domain apply only to Samba 2.2 from the CVS after November 27th. The - 'snapshot' release Samba2.2alpha1 does not work !!! See below on how to get a CVS tree.</P -><P -><B -CLASS="COMMAND" ->Known Bug !</B ->W2K machines will not successfully join a domain with a name that - is made up from an even number of characters. Yep, thats right ! BIOTEST is OK as is MYDOMAI - but MYDOMAIN will not work until this bug is fixed. Hmm.., we believe - that this bug is fixed, but see below.</P -><P -><B -CLASS="COMMAND" ->Known Bug !</B ->After some bugs were fixed just before - Christmas, W2K SP1 machines cannot join the domain. Expected to be - fixed early in the new year. Whats that ? yeah, samba developers - have a Christmas break too !</P -><P -><B -CLASS="COMMAND" ->Know Bug !</B ->NTs (and possibly W2K ?) are not told the logged on user is a domain - admin if the parameter "domain admin users = user" is used. The alternative, "domain admin group" - does work. See the HowTo.</P -><P ->Client Side creation of Machine accounts does work but is not complete. - Firstly, the <TT -CLASS="FILENAME" ->add user script</TT -> runs as the user who's - name was entered, not as root. Secondly, the machine name passed to the script (%U) - has an underscore at the end, not a '$'. One alternative is to use %m and add the $. - This method is documented in the <A -HREF="samba-pdc-howto.html" -TARGET="_top" ->HowTo</A ->. - And thirdly, it does not work with NT4ws. - </P -><P ->A W2K machine can join the domain. See the <A -HREF="samba-pdc-howto.html" -TARGET="_top" ->HowTo</A -> - which explains the process. The methods - described are 'work arounds' and should be regarded as temporary. Although I (drb) - have tested these procedures a number of people have had difficulty so there - may be other issues at work. JFM is aware of these - problems and will attend to them when he can.</P -><P ->A Domain Admin account is required and at present it appears that only root - is a suitable candidate.</P -><P >Much of the related code does work. For example, if an NT is removed from the domain and then rejoins, the <TT CLASS="FILENAME" @@ -501,45 +421,47 @@ CLASS="FILENAME" the unix box. However, at the present, you do need to have root as an administrator and use the root user name and password.</P ><P -><I -CLASS="EMPHASIS" ->Actually I'm - not sure that last paragraph is correct ....</I -></P -><P ><B CLASS="COMMAND" >Policies</B -> do work on a W2K machine. MS says that recent builds of - W2K dont observe an NT policy but it appears it does in 'legacy' mode.</P +> do work on a W2K machine. MS says that recent + builds of W2K dont observe an NT policy but it appears it does in 'legacy' + mode.</P ></DIV ><DIV CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN50" +NAME="AEN27" >Introduction</A ></H1 ><P ->This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing with the 'old head' - version of Samba and its NTDomain facilities. It is being rewritten by David Bannon (drb) - so that it addresses more accurately the Samba 2.2 planned for release late 2000. </P +> This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing + with the 'old HEAD' version of Samba and its NTDomain facilities. It is + being rewritten by David Bannon (drb) so that it addresses more + accurately the Samba 2.2.x release. + </P ><P ->This document probably still contains some material that does not apply to - Samba 2.2 but most (all?) of the really misleading stuff has been removed. Some - issues are not dealt with or are dealt with badly. Please send corrections and additions to - David Bannon at D.Bannon@latrobe.edu.au</P +> This document probably still contains some material that does not apply + to Samba 2.2 but most (all?) of the really misleading stuff has been + removed. Some issues are not dealt with or are dealt with badly. Please + send corrections and additions to <A +HREF="mailto:D.Bannon@latrobe.edu.au" +TARGET="_top" +>David Bannon</A +>. + </P ><P ->Hopefully, as we all become familiar with the Samba 2.2 as a PDC this document will - become much more usefull.</P +>Hopefully, as we all become familiar with the Samba 2.2 as a + PDC this document will become much more usefull.</P ></DIV ></DIV ><DIV CLASS="CHAPTER" ><HR><H1 ><A -NAME="AEN55" +NAME="AEN33" >Chapter 2. General Information</A ></H1 ><DIV @@ -547,7 +469,7 @@ CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN57" +NAME="AEN35" >What can we do ?</A ></H1 ><DIV @@ -555,38 +477,44 @@ CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN59" ->What can Samba Primary Domain Controller (PDC) do ?</A +NAME="AEN37" +>What can Samba 2.2.x Primary Domain Controller (PDC) do ?</A ></H2 ><P ->If you wish to have Samba act as a PDC for Windows NT 3.51.and 4.0 or W2000 client, then you - will need to obtain the 2.2.0 version, currently in pre-release. Release of a stable, - full featured Samba PDC is currently slated for version 3.0. </P +> If you wish to have Samba act as a PDC for Windows NT 4.0/2000 client, + then you will need to obtain the 2.2.0 version. Release of a stable, + full featured Samba PDC is currently slated for version 3.0. + </P ><P ->The following is a list of included features currently in Samba 2.2:</P +> The following is a list of included features currently in + Samba 2.2: + </P ><P ></P ><UL ><LI ><P ->The ability to act as a limited PDC for Windows NT and W2000 clients. - This includes adding NT and W2K machines to the domain and authenticating users logging - into the domain.</P +>The ability to act as a limited PDC for + Windows NT and W2000 clients. This includes adding NT and + W2K machines to the domain and authenticating users logging + into the domain.</P ></LI ><LI ><P ->Domain account can be viewed using the User Manager for - Domains ????</P +>Domain account can be viewed using the User + Manager for Domains</P ></LI ><LI ><P ->Viewing resources on the Samba PDC via the Server Manager for Domains - from the NT client. ??</P +>Viewing/adding/deleting resources on the Samba + PDC via the Server Manager for Domains from the NT client. + </P ></LI ><LI ><P ->Windows 95 clients will allow user level security to be set - but will not currently allow browsing of accounts.</P +>Windows 95/98/ME clients will allow user + level security to be set and browsing of domain accounts. + </P ></LI ><LI ><P @@ -594,26 +522,19 @@ NAME="AEN59" ></LI ><LI ><P ->Changing of user passwords from an NT client.</P -></LI -><LI -><P ->Partial support for Windows NT group and username mapping.</P -></LI -><LI -><P ->Support for a LDAP password database backend.</P +>Changing of user passwords from an NT client. + </P ></LI ><LI ><P ->Printing.</P +>Partial support for Windows NT username mapping. + Group name mapping is slated for a later release.</P ></LI ></UL ><P -></P +> These things are note expected to work in the forseeable future: + </P ><P -><B ->These things are note expected to work in the forseeable future</B ></P ><UL ><LI @@ -624,15 +545,6 @@ NAME="AEN59" ><P >PDC and BDC integration</P ></LI -><LI -><P ->Windows NT ACLs (on the Samba shares)</P -></LI -><LI -><P ->Offer a list of domain users to User Manager for Domains - (or the Security Tab etc).</P -></LI ></UL ></DIV ><DIV @@ -640,26 +552,15 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN92" ->Can I have a Windows 2000 client logon to a Samba controlled domain?</A +NAME="AEN62" +>Can I have a Windows 2000 client logon to a Samba +controlled domain?</A ></H2 ><P ->The 2.2 release branch of Samba supports Windows 2000 domain - clients in legacy mode, ie as if the PDC is a NTServer, not a - W2K server.</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN95" ->What's the status of print spool (spoolss) support in the NTDOM code?</A -></H2 -><P ->The implementation of support for SPOOLSS pipe is complete and it will be available - in the 2.2.0 release. This means that Samba will support the automatic downloading of printer - drivers for Windows NT clients just as it currently does for Windows 9x clients.</P +> The 2.2 release branch of Samba supports Windows 2000 domain + clients in legacy mode, ie as if the PDC is a NTServer, not a + W2K server. + </P ></DIV ></DIV ><DIV @@ -667,82 +568,79 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN98" +NAME="AEN65" >CVS</A ></H1 ><P ->CVS is a programme (publically available) that the Samba developers use to - maintain the central source code. Non developers can get access to the source in - a read only capacity. Many flavours of unix now arrive with cvs installed.</P +> CVS is a programme (publically available) that the Samba developers + use to maintain the central source code. Non developers can get + access to the source in a read only capacity. Many flavours of unix + now arrive with cvs installed.</P ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN101" +NAME="AEN68" >What are the different Samba branches available in CVS ?</A ></H2 ><P ->You can find out more about obtaining Samba's via - anonymous CVS from - <A +>You can find out more about obtaining Samba's via anonymous + CVS from <A HREF="http://pserver.samba.org/samba/cvs.html" TARGET="_top" -> http://pserver.samba.org/samba/cvs.html"</A ->. </P +> http://pserver.samba.org/samba/cvs.html</A +>. + </P +><P +> There are basically four branches to watch at the moment : + </P ><P ></P ><DIV CLASS="VARIABLELIST" -><P -><B ->There are basically four branches to watch at the moment :</B -></P ><DL ><DT >HEAD</DT ><DD ><P ->Samba 3.0 ? This code boasts all the main development - work in Samba. Two things that most people are not aware of - which live in the HEAD branch code are winbind NSS module and - Tim Potter's VFS implementation. Due to its developmental +>Samba 3.0 ? This code boasts all the main + development work in Samba. Due to its developmental nature, its not really suitable for production work. - </P + </P ></DD ><DT >SAMBA_2_0</DT ><DD ><P ->This branch contains the current stable release release. - At the moment it contains 2.0.7, a version that will do some - limited PDC stuff. If you are really going to do PDC things then - I (drb) suggest that you consider 2.2 instead. - </P +>This branch contains the previous stable + release. At the moment it contains 2.0.8, a version that + will do some limited PDC stuff. If you are really going to + do PDC things, you consider 2.2 instead. + </P ></DD ><DT >SAMBA_2_2</DT ><DD ><P ->The next stable release, currently in a 'alpha' form. - It provides the Samba developers, testers and interested - people with an approximation of what is to come. This document - addresses only SAMBA_2_2. - </P +>The 2.2.x release branch which is a subset + of the features of the HEAD branch. This document addresses + only SAMBA_2_2. + </P ></DD ><DT >SAMBA_TNG</DT ><DD ><P ->This branch is no longer maintained from the Samba sites. - Please see <A +>This branch is no longer maintained from the Samba + sites. Please see <A HREF="http://www.samba-tng.org/" TARGET="_top" > http://www.samba-tng.org/</A >. It has been requested - that questions about TNG are not posted to the regular Samba mailing - lists including samba-ntdom and samba-technical. - </P + that questions about TNG are not posted to the regular Samba + mailing lists including samba-ntdom and samba-technical. + </P ></DD ></DL ></DIV @@ -752,86 +650,17 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN124" +NAME="AEN91" >What are the CVS commands ?</A ></H2 ><P ->See <A +> See <A HREF="http://pserver.samba.org/samba/cvs.html" TARGET="_top" > http://pserver.samba.org/samba/cvs.html</A -></P -><P -></P -><P -><B ->To get the Samba 2.2 version, tag SAMBA_2_2 you would do :</B -></P -><UL -><LI -><P -> For example : <B -CLASS="COMMAND" ->cd /usr/local/src/</B -></P -></LI -><LI -><P -> <B -CLASS="COMMAND" ->cvs -d :pserver:cvs@pserver.samba.org:/cvsroot - login</B -></P -></LI -><LI -><P -> When prompted enter a password of <B -CLASS="COMMAND" ->cvs</B -></P -></LI -><LI -><P -> <B -CLASS="COMMAND" ->cvs -d :pserver:cvs@pserver.samba.org:/cvsroot - co -r SAMBA_2_2 samba</B -></P -></LI -></UL -><P -></P -><P -><B ->Then to update that directory at some later time,</B -></P -><UL -><LI -><P -> <B -CLASS="COMMAND" ->cd /usr/local/src/samba</B -></P -></LI -><LI -><P -> <B -CLASS="COMMAND" ->cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login</B -></P -></LI -><LI -><P -> When prompted enter a password of 'cvs'.</P -></LI -><LI -><P -> <B -CLASS="COMMAND" ->cvs update -d -P</B -></P -></LI -></UL +> for instructions + on obtaining the SAMBA_2_2 or HEAD cvs code. + </P ></DIV ></DIV ></DIV @@ -839,7 +668,7 @@ CLASS="COMMAND" CLASS="CHAPTER" ><HR><H1 ><A -NAME="AEN155" +NAME="AEN95" >Chapter 3. Establishing Connections</A ></H1 ><DIV @@ -847,7 +676,7 @@ CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN157" +NAME="AEN97" ></A ></H1 ><DIV @@ -855,201 +684,224 @@ CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN159" ->How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</A +NAME="AEN99" +>How do I get my NT4 or W2000 Workstation to login to the Samba +controlled Domain?</A ></H2 ><P ->There is a comprehensive Samba PDC <A +> There is a comprehensive Samba PDC <A HREF="samba-pdc-howto.html" TARGET="_top" ->HowTo</A -> - accessable from the samba web site - under 'Documentation'. Its currently located at <A -HREF="http://bioserve.latrobe.edu.au/samba" -TARGET="_top" -> http://bioserve.latrobe.edu.au/samba</A ->. Read it.</P +>HOWTO</A +> accessable from the samba web + site under 'Documentation'. Read it. + </P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN164" +NAME="AEN103" >What is a 'machine account' ?</A ></H2 ><P ->Every NT, W2K or Samba machine that joins a Samba controlled domain must be known to - the Samba PDC. There are two entries required, one in (typically) <TT +> Every NT, W2K or Samba machine that joins a Samba controlled + domain must be known to the Samba PDC. There are two entries + required, one in (typically) <TT CLASS="FILENAME" >/etc/passwd</TT > and the other in (typically) <TT CLASS="FILENAME" >/usr/local/samba/private/smbpasswd</TT ->. Under - some circumstances these entries are made <A -HREF="#AEN177" +>. + Under some circumstances these entries are made + <A +HREF="#AEN116" >manually</A ->, the - <A +>, the <A HREF="samba-pdc-howto.html" TARGET="_top" ->HowTo</A -> discusses ways of creating them automatically.</P +>HOWTO</A +> + discusses ways of creating them automatically.</P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN171" ->"The machine account for this computer either does not exist or is not accessable."</A +NAME="AEN110" +>"The machine account for this computer either does not +exist or is not accessable."</A ></H2 ><P ->When I try to join the domain I get the message "The machine account for this computer - either does not exist or is not accessable". Whats wrong ?</P +> When I try to join the domain I get the message "The machine account + for this computer either does not exist or is not accessable". Whats + wrong ? + </P ><P ->This problem is caused by the PDC not having a suitable machine account. +> This problem is caused by the PDC not having a suitable machine account. If you are using the <B CLASS="COMMAND" >add user script =</B -> method to create accounts - then this would indicate that it has not worked. Ensure the domain admin user - system is working.</P -><P ->Alternatively if you are creating account entries manually then they have not been created - correctly. Make sure that you have the entry correct for the machine account in smbpasswd - file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, - make sure that the account name is the machine netbios name with a '$' appended to it - ( ie. computer_name$ ). There must be an entry in both /etc/passwd and - the smbpasswd file. Some people have reported that - inconsistent subnet masks between the Samba server and the NT client have caused this problem. - Make sure that these are consistent for both client and server.</P +> method to create + accounts then this would indicate that it has not worked. Ensure the domain + admin user system is working. + </P +><P +> Alternatively if you are creating account entries manually then they + have not been created correctly. Make sure that you have the entry + correct for the machine account in smbpasswd file on the Samba PDC. + If you added the account using an editor rather than using the smbpasswd + utility, make sure that the account name is the machine netbios name + with a '$' appended to it ( ie. computer_name$ ). There must be an entry + in both /etc/passwd and the smbpasswd file. Some people have reported + that inconsistent subnet masks between the Samba server and the NT + client have caused this problem. Make sure that these are consistent + for both client and server. + </P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN177" +NAME="AEN116" >How do I create machine accounts manually ?</A ></H2 ><P ->This was the only option until recently, now in version 2.2 better means are available. - You might still need to do it manually for a couple of reasons. A machine account - consists of two entries (assuming a standard install and /etc/passwd use), - one in /etc/passwd and the other in /usr/local/samba/private/smbpasswd. The /etc/passwd - entry will list the machine name with a $ appended, won't have a passwd, will have a null - shell and no home directory. For example a machine called 'doppy' would have an /etc/passwd - entry like this :</P +> This was the only option until recently, now in version 2.2 better + means are available. You might still need to do it manually for a + couple of reasons. A machine account consists of two entries (assuming + a standard install and /etc/passwd use), one in /etc/passwd and the + other in /usr/local/samba/private/smbpasswd. The /etc/passwd + entry will list the machine name with a $ appended, won't have a + passwd, will have a null shell and no home directory. For example + a machine called 'doppy' would have an /etc/passwd entry like this :</P ><P -><B +> <B CLASS="COMMAND" >doppy$:x:505:501:NTMachine:/dev/null:/bin/false</B -></P +> + </P ><P ->On a linux system for example, you would typically add it like this :</P +> On a linux system for example, you would typically add it like + this : + </P ><P -><B +> <B CLASS="COMMAND" >adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n - doppy$</B -></P + doppy$</B +> + </P ><P ->Then you need to add that entry to smbpasswd, assuming you have a suitable +> Then you need to add that entry to smbpasswd, assuming you have a suitable path to the <B CLASS="COMMAND" >smbpasswd</B -> programme, do this :</P +> programme, do this : + </P ><P -><B +> <B CLASS="COMMAND" >smbpasswd -a -m doppy$</B -></P +> + </P ><P ->The entry will be created with a well known password, so any machine that - says its doppy could join the domain as long as it gets in first. So don't create - the accounts any earlier than you need them.</P +> The entry will be created with a well known password, so any machine that + says its doppy could join the domain as long as it gets in first. So + don't create the accounts any earlier than you need them. + </P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN190" +NAME="AEN129" >I cannot include a '$' in a machine name.</A ></H2 ><P ->A 'machine name' in (typically) <TT +> A 'machine name' in (typically) <TT CLASS="FILENAME" >/etc/passwd</TT > consists - of the machine name with a '$' appended. FreeBSD (and other BSD systems ?) - won't create a user with a '$' in their name.</P + of the machine name with a '$' appended. FreeBSD (and other BSD + systems ?) won't create a user with a '$' in their name. + </P ><P ->The problem is only in the program used to make the entry, once made, it works - perfectly. So create a user without the '$' and use <B +> The problem is only in the program used to make the entry, once + made, it works perfectly. So create a user without the '$' and + use <B CLASS="COMMAND" >vipw</B -> to edit - the entry, adding the '$'. Or create the whole entry with vipw if you like, - make sure you use a unique uid !</P +> to edit the entry, adding the '$'. Or create + the whole entry with vipw if you like, make sure you use a + unique uid !</P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN196" ->I get told "You already have a connection to the Domain...." when creating a - machine account.</A +NAME="AEN135" +>I get told "You already have a connection to the Domain...." +when creating a machine account.</A ></H2 ><P ->This happens if you try to create a machine account from the machine itself - and use a user name that does not work (for whatever reason) and then try - another (possibly valid) user name. - Exit out of the network applet to close the initial connection and try again.</P +> This happens if you try to create a machine account from the + machine itself and use a user name that does not work (for whatever + reason) and then try another (possibly valid) user name. + Exit out of the network applet to close the initial connection + and try again. + </P ><P ->Further, if the machine is a already a 'member of a workgroup' that is the - same name as the domain you are joining (bad idea) you will get this message. - Change the workgroup name to something else, it does not matter what, reboot, - and try again.</P +> Further, if the machine is a already a 'member of a workgroup' that + is the same name as the domain you are joining (bad idea) you will + get this message. Change the workgroup name to something else, it + does not matter what, reboot, and try again.</P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN200" ->I get told "Cannot join domain, the credentials supplied conflict - with an existing set.."</A +NAME="AEN139" +>I get told "Cannot join domain, the credentials supplied +conflict with an existing set.."</A ></H2 ><P ->This is the same basic problem as mentioned above, <A -HREF="#AEN196" -> "You already have a connection..."</A -></P +> This is the same basic problem as mentioned above, <A +HREF="#AEN135" +> "You already have a connection..."</A +> + </P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN204" +NAME="AEN143" >"The system can not log you on (C000019B)...."</A ></H2 ><P ->I joined the domain successfully but after upgrading to a newer version of the - Samba code I get the message, "The system can not log you on (C000019B), Please try a - gain or consult your system administrator" when attempting to logon.</P +>I joined the domain successfully but after upgrading + to a newer version of the Samba code I get the message, "The system + can not log you on (C000019B), Please try a gain or consult your + system administrator" when attempting to logon. + </P ><P ->This occurs when the domain SID stored in private/WORKGROUP.SID is changed. - For example, you remove the file and smbd automatically creates a new one. - Or you are swapping back and forth between versions 2.0.7, TNG and the HEAD branch - code (not recommended). The only way to correct the problem is to restore the - original domain SID or remove the domain client from the domain and rejoin.</P +> This occurs when the domain SID stored in private/WORKGROUP.SID is + changed. For example, you remove the file and smbd automatically + creates a new one. Or you are swapping back and forth between + versions 2.0.7, TNG and the HEAD branch code (not recommended). The + only way to correct the problem is to restore the original domain + SID or remove the domain client from the domain and rejoin. + </P ></DIV ></DIV ></DIV @@ -1057,7 +909,7 @@ NAME="AEN204" CLASS="CHAPTER" ><HR><H1 ><A -NAME="AEN208" +NAME="AEN147" >Chapter 4. User Account Management</A ></H1 ><DIV @@ -1065,7 +917,7 @@ CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN210" +NAME="AEN149" >Domain Admins</A ></H1 ><DIV @@ -1073,15 +925,16 @@ CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN212" +NAME="AEN151" >How do I configure an account as a domain administrator?</A ></H2 ><P ->See the NTDom <A +> See the NTDom <A HREF="samba-pdc-howto.html" TARGET="_top" >HowTo</A ->.</P +>. + </P ></DIV ></DIV ><DIV @@ -1089,7 +942,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN216" +NAME="AEN155" >Profiles</A ></H1 ><DIV @@ -1097,87 +950,94 @@ CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN218" ->Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</A +NAME="AEN157" +>Why is it bad to set "logon path = \\%N\%U\profile" in +smb.conf?</A ></H2 ><P ->Sometimes Windows clients will maintain a connection to the \\homes\ ( or [%U] ) share - even after the user has logged out. Consider the following scenario.</P +> Sometimes Windows clients will maintain a connection to + the \\homes\ ( or [%U] ) share even after the user has logged out. + Consider the following scenario. + </P ><P ></P ><UL ><LI ><P -> user1 logs into the Windows NT machine. Therefore the - [homes] share is set to \\server\user1.</P +> user1 logs into the Windows NT machine. + Therefore the [homes] share is set to \\server\user1. + </P ></LI ><LI ><P -> user1 works for a while and then logs out. </P +> user1 works for a while and then logs + out. </P ></LI ><LI ><P -> user2 logs into the same Windows NT machine.</P +> user2 logs into the same Windows NT + machine.</P ></LI ></UL ><P ->However, since the NT box has maintained a connection to [homes] which was - previously set to \\server\user1, when the operating system attempts to - get the profile and if it can read users1's profile, will get it otherwise it - will return an error. You get the picture.</P -><P ->A better solution is to use a separate [profiles] share and set the - "logon path = \\%N\profiles\%U" </P -><DIV -CLASS="NOTE" -><BLOCKQUOTE -CLASS="NOTE" +> However, since the NT box has maintained a connection to [homes] + which was previously set to \\server\user1, when the operating system + attempts to get the profile and if it can read users1's profile, will + get it otherwise it will return an error. You get the picture. + </P ><P -><B ->Note: </B ->Is this still a problem ????</P -></BLOCKQUOTE -></DIV +> A better solution is to use a separate [profiles] share and + set the "logon path = \\%N\profiles\%U" + </P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN232" ->Why are all the users listed in the "domain admin users" using the same profile?</A +NAME="AEN169" +>Why are all the users listed in the "domain admin users" using the +same profile?</A ></H2 ><P ->You are using a very very old development version of Samba. Upgrade.</P +> You are using a very very old development version of Samba. + Upgrade. + </P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN235" ->The roaming profiles do not seem to be updating on the server.</A +NAME="AEN172" +>The roaming profiles do not seem to be updating on the +server.</A ></H2 ><P ->There can be several reasons for this.</P +> There can be several reasons for this. + </P ><P ->Make sure that the time on the client and the PDC are synchronized. You can accomplish - this by executing a <B +> Make sure that the time on the client and the PDC are synchronized. You + can accomplish this by executing a <B CLASS="COMMAND" >net time \\server /set /yes</B -> replacing server with the - name of your PDC (or another synchronized SMB server). See <A -HREF="#AEN339" -> about Setting Time</A -></P +> + replacing server with the name of your PDC (or another synchronized SMB server). + See <A +HREF="#AEN278" +> about Setting Time</A +> + </P ><P ->Make sure that the - logon path is writeable by the user and make sure that the connection to the logon - path location is by the current user. Sometimes Windows client do not drop the - connection immediately upon logoff.</P +> Make sure that the "logon path" is writeable by the user and make sure + that the connection to the logon path location is by the current user. + Sometimes Windows client do not drop the connection immediately upon + logoff. + </P ><P ->Some people have reported that the logon path location should also be browseable. - I (GC) have yet to emperically verify this, but you can try.</P +> Some people have reported that the logon path location should + also be browseable. I (GC) have yet to emperically verify this, + but you can try.</P ></DIV ></DIV ><DIV @@ -1185,7 +1045,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN243" +NAME="AEN180" >Policies</A ></H1 ><DIV @@ -1193,39 +1053,43 @@ CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN245" +NAME="AEN182" >What are 'Policies' ?.</A ></H2 ><P ->When a user logs onto the domain via a client machine, the PDC sends - the client machine a list of things contained in the 'policy' (if it exists). - This list may do things like suppress a splach screen, format the dates the way you - like them or perhaps remove locally stored profiles.</P +> When a user logs onto the domain via a client machine, the PDC + sends the client machine a list of things contained in the + 'policy' (if it exists). This list may do things like suppress + a splach screen, format the dates the way you like them or perhaps + remove locally stored profiles. + </P ><P ->On a samba PDC this list is obtained from a file called <B -CLASS="COMMAND" ->ntconfig.pol</B -> - and located in the <B -CLASS="COMMAND" ->[netlogon]</B ->share. The file is created with a policy editor - and must be readable by anyone and writeable by only root. See <A -HREF="#AEN266" +> On a samba PDC this list is obtained from a file called + <TT +CLASS="FILENAME" +>ntconfig.pol</TT +> and located in the [netlogon] + share. The file is created with a policy editor and must be readable + by anyone and writeable by only root. See <A +HREF="#AEN203" > below</A -> for how to get a suitable editor.</P +> for how to get a suitable editor. + </P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN252" +NAME="AEN188" >I can't get system policies to work.</A ></H2 ><P ->There are two possible reasons for system policies not functioning correctly. - Make sure that you have the following parameters set in smb.conf </P +> There are two possible reasons for system policies not + functioning correctly. Make sure that you have the following + parameters set in smb.conf + </P +><P ><PRE CLASS="PROGRAMLISTING" > [netlogon] @@ -1235,66 +1099,71 @@ CLASS="PROGRAMLISTING" browseable = yes .... </PRE +></P ><P ->A policy file must be in the <B -CLASS="COMMAND" ->[netlogon]</B -> share and must be - readable by everyone and writeable by only root. The file must be created - by an NTServer <A -HREF="#AEN266" ->Policy Editor</A ->.</P +> A policy file must be in the [netlogon] share and must be + readable by everyone and writeable by only root. The file + must be created by an NTServer <A +HREF="#AEN203" +>Policy + Editor</A +>. + </P ><P ->Last time I (drb) looked in the source, it was - looking for <TT +> Last time I (drb) looked in the source, it was looking for + <TT CLASS="FILENAME" >ntconfig.pol</TT -> first then several other combinations of upper - and lower case. People have reported success using <TT +> first then several other + combinations of upper and lower case. People have reported + success using <TT CLASS="FILENAME" >NTconfig.pol</TT ->, - <TT +>, <TT CLASS="FILENAME" >NTconfig.POL</TT -> and <TT +> + and <TT CLASS="FILENAME" >ntconfig.pol</TT ->. These are the case - settings that I (GC) use with the - filename <TT +>. These are the case settings that + I (GC) use with the filename <TT CLASS="FILENAME" >ntconfig.pol</TT -></P +>: + </P +><P ><PRE CLASS="PROGRAMLISTING" > case sensitive = no case preserve = yes + short preserve case = no default case = yes - </PRE + </PRE +></P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN266" +NAME="AEN203" >What about Windows NT Policy Editor ?</A ></H2 ><P ->To create or edit <B -CLASS="COMMAND" ->ntconfig.pol</B -> you must use the NT Server - Policy Editor, <B +> To create or edit <TT +CLASS="FILENAME" +>ntconfig.pol</TT +> you must use + the NT Server Policy Editor, <B CLASS="COMMAND" >poledit.exe</B -> which is included with NT Server - but <I +> which + is included with NT Server but <I CLASS="EMPHASIS" >not NT Workstation</I ->. There is a Policy Editor on a NTws +>. + There is a Policy Editor on a NTws but it is not suitable for creating <I CLASS="EMPHASIS" >Domain Policies</I @@ -1315,7 +1184,8 @@ CLASS="FILENAME" >c:\winnt\inf</TT > which is where the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'.</P + directory is 'hidden'. + </P ><P >The Windows NT policy editor is also included with the Service Pack 3 (and later) for Windows NT 4.0. Extract the files using @@ -1324,13 +1194,13 @@ CLASS="COMMAND" >servicepackname /x</B >, ie thats <B CLASS="COMMAND" ->Nt4sp6ai.exe /x</B -> - for service pack 6a. - The policy editor, <B +>Nt4sp6ai.exe + /x</B +> for service pack 6a. The policy editor, <B CLASS="COMMAND" >poledt.exe</B -> and the associated template files (*.adm) should +> and the + associated template files (*.adm) should be extracted as well. It is also possible to downloaded the policy template files for Office97 and get a copy of the policy editor. Another possible location is with the Zero Administration Kit available for download from Microsoft. @@ -1341,24 +1211,28 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN280" +NAME="AEN217" >Can Win95 do Policies ?</A ></H2 ><P ->Install the group policy handler for Win9x to pick up group policies. - Look on the Win98 CD in <TT +> Install the group policy handler for Win9x to pick up group + policies. Look on the Win98 CD in <TT CLASS="FILENAME" -> \tools\reskit\netadmin\poledit</TT ->. Install group policies on a Win9x client by double-clicking +>\tools\reskit\netadmin\poledit</TT +>. + Install group policies on a Win9x client by double-clicking <TT CLASS="FILENAME" >grouppol.inf</TT ->. Log off and on again a couple of times and see if - Win98 picks up group policies. - Unfortunately this needs to be done on every Win9x machine that uses group policies....</P +>. Log off and on again a couple of + times and see if Win98 picks up group policies. Unfortunately this needs + to be done on every Win9x machine that uses group policies.... + </P ><P ->If group policies don't work one reports suggests getting the updated (read: working) - grouppol.dll for Windows 9x. The group list is grabbed from /etc/group.</P +> If group policies don't work one reports suggests getting the updated + (read: working) grouppol.dll for Windows 9x. The group list is grabbed + from /etc/group. + </P ></DIV ></DIV ><DIV @@ -1366,7 +1240,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN286" +NAME="AEN223" >Passwords</A ></H1 ><DIV @@ -1374,23 +1248,28 @@ CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN288" +NAME="AEN225" >What is password sync and should I use it ?</A ></H2 ><P ->NTws users can change their domain password by pressing Ctrl-Alt-Del and - choosing 'Change Password'. By default however, this does not change the unix password +> NTws users can change their domain password by pressing Ctrl-Alt-Del + and choosing 'Change Password'. By default however, this does not change the unix password (typically in <TT CLASS="FILENAME" ->/etc/passwd or /etc/shadow</TT ->). In lots of situations - thats OK, for example :</P +>/etc/passwd</TT +> or <TT +CLASS="FILENAME" +>/etc/shadow</TT +>). + In lots of situations thats OK, for example : + </P ><P ></P ><UL ><LI ><P ->The server is only accessible to the user via samba.</P +>The server is only accessible to the user via + samba.</P ></LI ><LI ><P @@ -1399,41 +1278,46 @@ CLASS="FILENAME" ></LI ></UL ><P ->But sometimes you really do need to maintain two seperate password databases and - there are good reasons to keep then in sync. Trying to explain to users - that they need to change their passwords in two seperate places or use - two seperate passwords is not fun.</P +> But sometimes you really do need to maintain two seperate password + databases and there are good reasons to keep then in sync. Trying + to explain to users that they need to change their passwords in two + seperate places or use two seperate passwords is not fun. + </P ><P ->However do understand that setting up password sync is not without problems either. - The chief difficulty is the interface between Samba and the <B +> However do understand that setting up password sync is not without + problems either. The chief difficulty is the interface between Samba + and the <B CLASS="COMMAND" >passwd</B -> command, - it can be a fiddle to set up and if the password the user has entered fails, - the resulting errors are ambiguously reported - and the user is confused. Further, you need to take steps to ensure that users - only ever change their passwords via samba (or use <B +> command, it can be a fiddle to set + up and if the password the user has entered fails, the resulting errors + are ambiguously reported and the user is confused. Further, you need + to take steps to ensure that users only ever change their passwords + via samba (or use <B CLASS="COMMAND" >smbpasswd</B ->), - otherwise they will only be changing the unix password.</P +>), otherwise they will + only be changing the unix password.</P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN301" +NAME="AEN239" >How do I get remote password (unix and SMB) changing working ?</A ></H2 ><P ->Have a practice changing a user's password (as root) to see what - discussion takes place and change the text in the 'passwd chat' line below as necessary. The - line as shown works for recent RH Linux but most other systems seem to like to do something - different. The '*' is a wild card and will match anything (or nothing). +> Have a practice changing a user's password (as root) to see + what discussion takes place and change the text in the 'passwd chat' + line below as necessary. The line as shown works for recent RH Linux + but most other systems seem to like to do something different. The '*' is + a wild card and will match anything (or nothing). + </P +><P +> Add these lines to smb.conf under [Global] </P ><P ->Add these lines to smb.conf under [Global]</P ><PRE CLASS="PROGRAMLISTING" > @@ -1442,10 +1326,13 @@ CLASS="PROGRAMLISTING" passwd program = /usr/bin/passwd %u passwd chat = *password* %n\n *password* %n\n *successful* </PRE +></P ><P ->As mentioned above, the change to the unix password - happens as root, not as the user, as is indicated in ~/smbd/chgpasswd.c If - you are using NIS, the Samba server must be running on the NIS master machine.</P +> As mentioned above, the change to the unix password happens as root, + not as the user, as is indicated in ~/smbd/chgpasswd.c If + you are using NIS, the Samba server must be running on the NIS + master machine. + </P ></DIV ></DIV ></DIV @@ -1453,7 +1340,7 @@ CLASS="PROGRAMLISTING" CLASS="CHAPTER" ><HR><H1 ><A -NAME="AEN307" +NAME="AEN246" >Chapter 5. Miscellaneous</A ></H1 ><DIV @@ -1461,7 +1348,7 @@ CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN309" +NAME="AEN248" ></A ></H1 ><DIV @@ -1469,12 +1356,15 @@ CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN311" ->What editor can I use in DOS/Windows that won't mess with my unix EOF</A +NAME="AEN250" +>What editor can I use in DOS/Windows that won't +mess with my unix EOF</A ></H2 ><P ->There are a number of Windows or DOS based editors that will understand, and - leave intact, the unix eof (as opposed to a DOS CL/LF). List members suggested :</P +>There are a number of Windows or DOS based editors that will + understand, and leave intact, the unix eof (as opposed to a DOS CL/LF). + List members suggested : + </P ><P ></P ><UL @@ -1499,7 +1389,7 @@ TARGET="_top" >The author prefers PFE at <A HREF="http://www.lancs.ac.uk/people/cpaap/pfe/" TARGET="_top" -> www.lancs.ac.uk/people/cpaap/pfe/</A +> www.lancs.ac.uk/people/cpaap/pfe/</A > but its no longer being developed...</P ></LI ></UL @@ -1509,18 +1399,19 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN324" +NAME="AEN263" >How do I get 'User Manager' and 'Server Manager'</A ></H2 ><P ->Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for - Domains', the 'Server Manager' ?</P +> Since I don't need to buy an NT Server CD now, how do I get + the 'User Manager for Domains', the 'Server Manager' ? + </P ><P -></P +> Microsoft distributes a version of + these tools called nexus for installation on Windows 95 systems. The + tools set includes + </P ><P -><B ->Microsoft distributes a version of these tools called nexus - for installation on Windows 95 systems. The tools set includes</B ></P ><UL ><LI @@ -1537,27 +1428,28 @@ NAME="AEN324" ></LI ></UL ><P ->Click here to download the archived file - <A +> Click here to download the archived file <A HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE" TARGET="_top" -> ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A -></P +>ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A +> + </P ><P ->The Windows NT 4.0 version of the 'User Manager for Domains' - and 'Server Manager' are available from Microsoft via ftp from - <A +> The Windows NT 4.0 version of the 'User Manager for + Domains' and 'Server Manager' are available from Microsoft via ftp + from <A HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" TARGET="_top" -> ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A -></P +>ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A +> + </P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN339" +NAME="AEN278" >The time setting from a Samba server does not work.</A ></H2 ><P @@ -1574,7 +1466,7 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN343" +NAME="AEN282" >"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A ></H2 ><P @@ -1589,140 +1481,17 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN347" +NAME="AEN286" >How do I get my samba server to become a member ( not PDC ) of an NT domain?</A ></H2 ><P ->In a domain that has a number of servers you only need one password database. - The machines that don't have their own ask the PDC to check for them. - This will work fine for a domain controlled by either a Samba or NT machine. - The following lines in smb.conf are typical, 'password server' points to the - samba machine (or an NT) that has the password list : </P -><PRE -CLASS="PROGRAMLISTING" -> - - [global] - ... - security = domain - workgroup = { Put your domain name here } - password server = { Put the ip of the PDC here } - encrypt passwords = yes - ... - </PRE -><P ->The samba server in question will have to 'join the domain', that requires - the domain controller to have a machine account for it. This is no different - to the machine account requirements to allow a NTws to join the domain. For - example, if we want a unix box called <I -CLASS="EMPHASIS" ->sleepy</I -> to ask the PDC called <I -CLASS="EMPHASIS" ->grumpy</I -> - to do its authentication then <I -CLASS="EMPHASIS" ->grumpy</I -> will need an entry in its smbpasswd - (assuming it's also samba) that starts with <I -CLASS="EMPHASIS" ->sleepy$</I ->. It would have to be - created <A -HREF="#AEN177" ->manually</A ->. </P -><P ->If the domain is controlled by an NTServer then the "Server Manager for Domains" - tool must be used to add 'sleepy' to the domain list.</P -><P ->In either case we then join the domain. If the domain is called <I -CLASS="EMPHASIS" ->forest</I -> - then on sleepy we would join the domain by typing :</P -><P -><B -CLASS="COMMAND" ->smbpasswd -j forest</B -></P -><P ->Note that the directory where the smbpasswd file would be - located should exist as this is where smbd will generate the MACHINE.SID file. This - might be <TT -CLASS="FILENAME" ->/usr/local/samba/private/FOREST.SLEEPY.SID</TT -> and - it contains the trust account password for the domain member. The permissions are - (and should remain) "rw-------</P -><P ->Note the Samba Servers without the password list will most likely still need an account - for each user, this means a line in its <TT -CLASS="FILENAME" ->/etc/passwd</TT ->. Because authentication - is being handled at the domain level the - <TT -CLASS="FILENAME" ->/etc/passwd</TT -> line does not need a password. - If the shares being offered are not user specific, ie a common (read only ?) - area or perhaps just printing then the user's - <TT -CLASS="FILENAME" ->/etc/passwd</TT -> does not need a home directory. A typical - line in <TT -CLASS="FILENAME" ->/etc/passwd</TT -> for a server that allows domain users to - connect to the samba shares but does not offer a home share ('cos that's on the PDC) - and does not allow logon to the unix prompt would be like this :</P -><PRE -CLASS="PROGRAMLISTING" ->jblow:x:542:100:Joe Blow:/dev/null:/bin/false</PRE -><DIV -CLASS="NOTE" -><BLOCKQUOTE -CLASS="NOTE" -><P -></P -><UL -><LI -><P ->When removing those 'dummy' users, watch the 'remove user' scripts, - some OS think they should remove a users directory even when its not owned by the user ! +> Please refer to the <A +HREF="DOMAIN_MEMBER.html" +TARGET="_top" +>Domain Member + HOWTO</A +> for more information on this. </P -></LI -><LI -><P ->The <TT -CLASS="FILENAME" ->username map = </TT -> parameter might help you to avoid having - all those accounts created.</P -></LI -><LI -><P ->You should investigate the smb.conf parameter - <TT -CLASS="FILENAME" ->'add user script'</TT ->, it will be used to create accounts on - secondary servers when that account already exists on the PDC. Very nice. - Something like :</P -><PRE -CLASS="PROGRAMLISTING" -> [Global] - .... - add user script = /usr/sbin/adduser -n -g users -c User -d /dev/null -s /bin/false %U - .... - </PRE -></LI -></UL -></BLOCKQUOTE -></DIV ></DIV ></DIV ></DIV @@ -1730,7 +1499,7 @@ CLASS="PROGRAMLISTING" CLASS="CHAPTER" ><HR><H1 ><A -NAME="AEN382" +NAME="AEN290" >Chapter 6. Troubleshooting and Bug Reporting</A ></H1 ><DIV @@ -1738,7 +1507,7 @@ CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN384" +NAME="AEN292" >Diagnostic tools</A ></H1 ><DIV @@ -1746,30 +1515,38 @@ CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN386" +NAME="AEN294" >What are some diagnostics tools I can use to debug the domain logon process and where can I find them?</A ></H2 ><P ->One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d - option for both smbd and nmbd to specifiy what 'debug level' at which to run. See the man - pages on smbd, nmbd and smb.conf for more information on debugging options. The debug - level can range from 1 (the default) to around 100 but a debug level of about 20 will - normally help you find any errors that samba is encountering. Another helpful method - of debugging is to compile samba using the gcc -g flag. This will include debug - information in the binaries and allow you to attch gdb to the running smbd / nmbd - process. In order to attach gdb to an smbd process for an NT workstation, first - get the workstation to make the connection. Pressing ctrl-alt-delete and going down - to the domain box is sufficient (at least, on the first time you join the domain) to - generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open - connection, and therefore there will be an smbd process running (assuming that you - haven't set a really short smbd idle timeout) So, in between pressing ctrl alt - delete, and actually typing in your password, you can gdb attach and continue.</P +> One of the best diagnostic tools for debugging problems is Samba itself. + You can use the -d option for both smbd and nmbd to specifiy what + 'debug level' at which to run. See the man pages on smbd, nmbd and + smb.conf for more information on debugging options. The debug + level can range from 1 (the default) to 10 (100 for debugging passwords). + </P ><P -></P +> Another helpful method of debugging is to compile samba using the + <B +CLASS="COMMAND" +>gcc -g </B +> flag. This will include debug + information in the binaries and allow you to attch gdb to the + running smbd / nmbd process. In order to attach gdb to an smbd + process for an NT workstation, first get the workstation to make the + connection. Pressing ctrl-alt-delete and going down to the domain box + is sufficient (at least, on the first time you join the domain) to + generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation + maintains an open connection, and therefore there will be an smbd + process running (assuming that you haven't set a really short smbd + idle timeout) So, in between pressing ctrl alt delete, and actually + typing in your password, you can gdb attach and continue. + </P +><P +> Some usefull samba commands worth investigating: + </P ><P -><B ->Some usefull samba commands worth investigating:</B ></P ><UL ><LI @@ -1782,113 +1559,134 @@ NAME="AEN386" ></LI ></UL ><P ->An SMB enabled version of tcpdump is available from +> An SMB enabled version of tcpdump is available from <A -HREF="ftp://samba.org/pub/samba/tcpdump-smb/" +HREF="http://www.tcpdump.org/" TARGET="_top" ->ftp://samba.org/pub/samba/tcpdump-smb/ - </A -></P -><P ->Capconvert is a small C program for translating output from tcpdump-smb to CAP format - that can be read by netmon. You will need to use the raw output from tcp dump - ( ie. <B -CLASS="COMMAND" ->tcpdump -w output.dump</B -> ). Good news! Now you can convert - Solaris' snoop output as well. The C source code for snoop2cap is available for download. - </P +>http://www.tcpdup.org/</A +>. + Ethereal, another good packet sniffer for UNIX and Win32 + hosts, can be downloaded from <A +HREF="http://www.ethereal.com/" +TARGET="_top" +>http://www.ethereal.com</A +>. + </P ><P ->For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available - on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's. - The version of netmon that ships with SMS allows for dumping packets between any two - computers (ie. placing the network interface in promiscuous mode). The version - on the NT Server install CD will only allow monitoring of network traffic directed to the - local NT box and broadcasts on the local subnet.</P +> For tracing things on the Microsoft Windows NT, Network Monitor + (aka. netmon) is available on the Microsoft Developer Network CD's, + the Windows NT Server install CD and the SMS CD's. The version of + netmon that ships with SMS allows for dumping packets between any two + computers (ie. placing the network interface in promiscuous mode). + The version on the NT Server install CD will only allow monitoring + of network traffic directed to the local NT box and broadcasts on the + local subnet. Be aware that Ethereal can read and write netmon + formatted files. + </P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN400" ->How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</A +NAME="AEN309" +>How do I install 'Network Monitor' on an NT Workstation +or a Windows 9x box?</A ></H2 ><P ->Installing netmon on an NT workstation requires a couple of steps. The following - are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server - 4.0, on Microsoft Windows NT Workstation 4.0. The process should be similar - for other version of Windows NT / Netmon. You will need both the Microsoft Windows - NT Server 4.0 Install CD and the Workstation 4.0 Install CD.</P +> Installing netmon on an NT workstation requires a couple + of steps. The following are for installing Netmon V4.00.349, which comes + with Microsoft Windows NT Server 4.0, on Microsoft Windows NT + Workstation 4.0. The process should be similar for other version of + Windows NT / Netmon. You will need both the Microsoft Windows + NT Server 4.0 Install CD and the Workstation 4.0 Install CD. + </P ><P ->Initially you will need to install 'Network Monitor Tools and Agent' on the - NT Server. To do this </P +> Initially you will need to install 'Network Monitor Tools and Agent' + on the NT Server. To do this + </P ><P ></P ><UL ><LI ><P ->Goto Start - Settings - Control Panel - Network - Services - Add </P +>Goto Start - Settings - Control Panel - + Network - Services - Add </P ></LI ><LI ><P ->Select the 'Network Monitor Tools and Agent' and click on 'OK'.</P +>Select the 'Network Monitor Tools and Agent' and + click on 'OK'.</P ></LI ><LI ><P ->Click 'OK' on the Network Control Panel.</P +>Click 'OK' on the Network Control Panel. + </P ></LI ><LI ><P ->Insert the Windows NT Server 4.0 install CD when prompted.</P +>Insert the Windows NT Server 4.0 install CD + when prompted.</P ></LI ></UL ><P ->At this point the Netmon files should exist in <TT +> At this point the Netmon files should exist in + <TT CLASS="FILENAME" >%SYSTEMROOT%\System32\netmon\*.*</TT >. Two subdirectories exist as well, <TT CLASS="FILENAME" >parsers\</TT -> which contains the necessary DLL's - for parsing the netmon packet dump, and <TT +> + which contains the necessary DLL's for parsing the netmon packet + dump, and <TT CLASS="FILENAME" >captures\</TT ->.</P +>. + </P ><P ->In order to install the Netmon tools on an NT Workstation, you will first need to - install the 'Network Monitor Agent' from the Workstation install CD.</P +> In order to install the Netmon tools on an NT Workstation, you will + first need to install the 'Network Monitor Agent' from the Workstation + install CD. + </P ><P ></P ><UL ><LI ><P ->Goto Start - Settings - Control Panel - Network - Services - Add</P +>Goto Start - Settings - Control Panel - + Network - Services - Add</P ></LI ><LI ><P ->Select the 'Network Monitor Agent' and click on 'OK'.</P +>Select the 'Network Monitor Agent' and click + on 'OK'.</P ></LI ><LI ><P ->Click 'OK' on the Network Control Panel.</P +>Click 'OK' on the Network Control Panel. + </P ></LI ><LI ><P ->Insert the Windows NT Workstation 4.0 install CD when prompted.</P +>Insert the Windows NT Workstation 4.0 install + CD when prompted.</P ></LI ></UL ><P ->Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to - %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as - you deem appropriate for your site. You will need administrative rights on the - NT box to run netmon.</P +> Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* + to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set + permissions as you deem appropriate for your site. You will need + administrative rights on the NT box to run netmon. + </P ><P ->To install Netmon on a Windows 9x box install the network monitor agent from - the Windows 9x CD (\admin\nettools\netmon). - There is a readme file located with the netmon driver files on the CD if you need - information on how to do this. Copy the files from a working Netmon installation.</P +> To install Netmon on a Windows 9x box install the network monitor agent + from the Windows 9x CD (\admin\nettools\netmon). There is a readme + file located with the netmon driver files on the CD if you need + information on how to do this. Copy the files from a working + Netmon installation. + </P ></DIV ></DIV ><DIV @@ -1896,19 +1694,20 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN429" +NAME="AEN338" >What other help can I get ?</A ></H1 ><P ->There are many sources of information available in the form of mailing lists, RFC's - and documentation. The docs that come with the samba distribution contain very - good explanations of general SMB topics such as browsing.</P +> There are many sources of information available in the form + of mailing lists, RFC's and documentation. The docs that come + with the samba distribution contain very good explanations of + general SMB topics such as browsing.</P ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN432" +NAME="AEN341" >URLs and similar</A ></H2 ><P @@ -2003,55 +1802,20 @@ TARGET="_top" ></LI ></UL ><P -></P -><P -><B ->There are a number of documents that no longer appear to live at their - origional home. Any one know where the following may be found ?</B -></P -><UL -><LI -><P ->CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt</P -></LI -><LI -><P ->CIFS Remote Administration Protocol draft-leach-cifs-rap-spec-00.txt</P -></LI -><LI -><P ->CIFS Logon and Pass Through Authentication draft-leach-cifs-logon-spec-00.txt</P -></LI -><LI -><P ->A Common Internet File System (CIFS/1.0) Protocol draft-leach-cifs-v1-spec-01.txt</P -></LI -><LI -><P ->CIFS Printing Specification draft-leach-cifs-print-spec-00.txt</P -></LI -><LI -><P ->RFC1001 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Concepts and methods. - http://ds.internic.net/rfc/rfc1001.txt </P -></LI -><LI -><P ->RFC1002 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Detailed specifications. - http://ds.internic.net/rfc/rfc1002.txt </P -></LI -><LI -><P ->Microsoft's main CIFS page: http://www.microsoft.com/workshop/networking/cifs/</P -></LI -></UL +> You should also refer to the MS archives at + <A +HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/" +TARGET="_top" +>ftp://ftp.microsoft.com/developr/drg/CIFS/"</A +> + </P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN481" +NAME="AEN374" >How do I get help from the mailing lists ?</A ></H2 ><P @@ -2154,22 +1918,23 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN510" +NAME="AEN403" >How do I get off the mailing lists ?</A ></H2 ><P >To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to <A -HREF="http://samba.org" +HREF="http://lists.samba.org/" TARGET="_top" ->http://samba.org</A ->, click on your nearest mirror - and then click on <B +>http://lists.samba.org</A +>, click + on your nearest mirror and then click on <B CLASS="COMMAND" >Support</B -> and then click on <B +> and + then click on <B CLASS="COMMAND" -> Samba related mailing lists</B +> Samba related mailing lists</B >. Or perhaps see <A HREF="http://lists.samba.org/mailman/roster/samba-ntdom" @@ -2177,7 +1942,7 @@ TARGET="_top" >here</A ></P ><P ->Please don't post messages to the list asking to be removed, you will just +> Please don't post messages to the list asking to be removed, you will just be refered to the above address (unless that process failed in some way...) </P ></DIV |