diff options
Diffstat (limited to 'docs/htmldocs/samba-pdc-howto.html')
| -rw-r--r-- | docs/htmldocs/samba-pdc-howto.html | 1558 |
1 files changed, 0 insertions, 1558 deletions
diff --git a/docs/htmldocs/samba-pdc-howto.html b/docs/htmldocs/samba-pdc-howto.html deleted file mode 100644 index a2bca689ef..0000000000 --- a/docs/htmldocs/samba-pdc-howto.html +++ /dev/null @@ -1,1558 +0,0 @@ -<HTML -><HEAD -><TITLE ->The Samba 2.2 PDC HowTo </TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD -><BODY -CLASS="BOOK" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="BOOK" -><A -NAME="SAMBA-PDC-HOWTO" -></A -><DIV -CLASS="TITLEPAGE" -><H1 -CLASS="TITLE" -><A -NAME="SAMBA-PDC-HOWTO" ->The Samba 2.2 PDC HowTo</A -></H1 -><H3 -CLASS="AUTHOR" -><A -NAME="AEN4" ->David Bannon</A -></H3 -><DIV -CLASS="AFFILIATION" -><SPAN -CLASS="ORGNAME" ->La Trobe University<BR></SPAN -></DIV -><HR></DIV -><HR><H1 -><A -NAME="AEN10" -></A -></H1 -><P ->Comments, corrections and additions to <TT -CLASS="EMAIL" -><<A -HREF="mailto:dbannon@samba.org" ->dbannon@samba.org</A ->></TT -></P -><P -> This document explains how to setup Samba as a Primary Domain Controller and - applies to version 2.2.0. - Before - using these functions make sure you understand what the controller can and cannot do. - Please read the sections below in the Introduction. - As 2.2.0 is incrementally updated - this document will change or become out of date very quickly, make sure you are - reading the most current version. - </P -><P ->Please note this document does not apply to Samba2.2alpha0, Samba2.2alpha1, - Samba 2.0.7, TNG nor HEAD branch.</P -><P ->It does apply to the current (post November 27th) cvs.</P -><P -> Also available is an updated version of Jerry Carter's NTDom <A -HREF="samba-pdc-faq.html" -TARGET="_top" -> FAQ</A -> that will answer lots of - the special 'tuning' questions that are not covered here. Over the next couple of weeks - some of the items here will be moved to the FAQ. - </P -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->1. <A -HREF="#AEN20" ->Introduction</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN28" ->What can we do ?</A -></DT -><DT -><A -HREF="#AEN44" ->What can't we do ?</A -></DT -></DL -></DD -><DT ->2. <A -HREF="#AEN55" ->Installing</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN59" ->Start Up Script</A -></DT -><DT -><A -HREF="#AEN66" ->Config File</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN68" ->A sample conf file</A -></DT -><DT -><A -HREF="#AEN79" ->PDC Config Parameters</A -></DT -></DL -></DD -><DT -><A -HREF="#AEN115" ->Special directories</A -></DT -></DL -></DD -><DT ->3. <A -HREF="#AEN126" ->User and Machine Accounts</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN128" ->Logon Accounts</A -></DT -><DT -><A -HREF="#MACHINEACCOUNT" ->Machine Accounts</A -></DT -><DT -><A -HREF="#AEN163" ->Joining the Domain</A -></DT -><DT -><A -HREF="#AEN211" ->User Accounts</A -></DT -><DT -><A -HREF="#AEN223" ->Domain Admin Accounts</A -></DT -></DL -></DD -><DT ->4. <A -HREF="#AEN231" ->Profiles, Policies and Logon Scripts</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN233" ->Profiles</A -></DT -><DT -><A -HREF="#AEN240" ->Policies</A -></DT -><DT -><A -HREF="#AEN251" ->Logon Scripts</A -></DT -></DL -></DD -><DT ->5. <A -HREF="#AEN272" ->Passwords and Authentication</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN278" -></A -></DT -><DD -><DL -><DT -><A -HREF="#AEN280" ->Syncing Passwords</A -></DT -><DT -><A -HREF="#AEN286" ->Using PAM</A -></DT -><DT -><A -HREF="#AEN292" ->Authenticating other Samba Servers</A -></DT -></DL -></DD -></DL -></DD -><DT ->6. <A -HREF="#AEN298" ->Background</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN300" -></A -></DT -><DD -><DL -><DT -><A -HREF="#AEN302" ->History</A -></DT -><DT -><A -HREF="#AEN310" ->The Future</A -></DT -><DT -><A -HREF="#AEN322" ->Getting further help</A -></DT -></DL -></DD -></DL -></DD -></DL -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN20" ->Chapter 1. Introduction</A -></H1 -><P ->This document will show you one way of making Version 2.2.0 -of Samba perform some of the tasks of a -NT Primary Domain Controller. The facilities described are built into Samba as a result of -development work done over a number of years by a large number of people. These facilities -are only just beginning to be officially supported and although they do appear to work reliably, -if you use them then you take the risks upon your self. This document does not cover the -developmental versions of Samba, particularly -<A -HREF="http://www.samba-tng.org/" -TARGET="_top" -><I -CLASS="CITETITLE" ->Samba-TNG</I -></A -> - </P -><P ->Note that <A -HREF="http://bioserve.latrobe.edu.au/samba" -TARGET="_top" ->Samba 2.0.7</A -> - supports significently less of the NT Domain facilities compared with 2.2.0 - </P -><P -> This document does not replace the text files DOMAIN_CONTROL.txt, DOMAIN.txt (by - John H Terpstra) or NTDOMAIN.txt (by Luke Kenneth Casson Leighton). Those documents provide - more detail and an insight to the development - cycle and should be considered 'further reading'. </P -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN28" ->What can we do ?</A -></H1 -><P -></P -><UL -><LI -><P ->Permit 'domain logons' for Win95/98, NT4 and W2K workstations from one central - password database. WRT W2K, please see the section about adding machine - accounts and the Intro in the <A -HREF="samba-pdc-faq.html" -TARGET="_top" ->FAQ</A ->.</P -></LI -><LI -><P ->Grant Administrator privileges to particular domain users on an - NT or W2K workstation.</P -></LI -><LI -><P ->Apply policies from a domain policy file to NT and W2K (?) - workstation.</P -></LI -><LI -><P ->Run the appropriate logon script when a user logs on to the domain - .</P -></LI -><LI -><P ->Maintain a user's local profile on the server.</P -></LI -><LI -><P ->Validate a user using another system via smb (such as smb_pam) and - soon winbind (?).</P -></LI -></UL -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN44" ->What can't we do ?</A -></H1 -><P -></P -><UL -><LI -><P -> Become or work with a Backup Domain Controller (a BDC).</P -></LI -><LI -><P -> Participate in any sort of trust relationship (with either Samba or NT - Servers).</P -></LI -><LI -><P -> Offer a list of domain users to User Manager for Domains - on the Security Tab etc).</P -></LI -><LI -><P ->Be a W2K type of Domain Controller. Samba PDC will behave like - an NT PDC, W2K workstations connect in legacy mode.</P -></LI -></UL -></DIV -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN55" ->Chapter 2. Installing</A -></H1 -><P ->Installing consists of the usual download, configure, make and make - install process. These steps are well documented elsewhere. - The <A -HREF="samba-pdc-faq.html" -TARGET="_top" ->FAQ</A -> discusses getting pre-release versions via CVS. - Then you need to configure the server.</P -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN59" ->Start Up Script</A -></H1 -><P ->Skip this section if you have a working Samba already. - Everyone has their own favourite startup script. Here is mine, offered with no warrantee - at all !</P -><PRE -CLASS="PROGRAMLISTING" -> - - #!/bin/sh - # Script to control Samba server, David Bannon, 14-6-96 - # - # - PATH=/bin:/usr/sbin:/usr/bin - export PATH - case "$1" in - 'start') - if [ -f /usr/local/samba/bin/smbd ] - then - /usr/local/samba/bin/smbd -D - /usr/local/samba/bin/nmbd -D - echo "Starting Samba Server" - fi - ;; - 'conf') - if [ -f /usr/local/samba/lib/smb.conf ] - then - vi /usr/local/samba/lib/smb.conf - fi - ;; - 'pw') - if [ -f /usr/local/samba/private/smbpasswd ] - then - vi /usr/local/samba/private/smbpasswd - fi - ;; - 'who') - /usr/local/samba/bin/smbstatus -b - ;; - 'restart') - psline=`/bin/ps x | grep smbd | grep -v grep` - - if [ "$psline" != "" ] - then - while [ "$psline" != "" ] - do - psline=`/bin/ps x | fgrep smbd | grep -v grep` - if [ "$psline" ] - then - set -- $psline - pid=$1 - /bin/kill -HUP $pid - echo "Stopped $pid line = $psline" - sleep 2 - fi - done - fi - echo "Stopped Samba servers" - ;; - 'stop') - psline=`/bin/ps x | grep smbd | grep -v grep` - - if [ "$psline" != "" ] - then - while [ "$psline" != "" ] - do - psline=`/bin/ps x | fgrep smbd | grep -v grep` - if [ "$psline" ] - then - set -- $psline - pid=$1 - /bin/kill -9 $pid - echo "Stopped $pid line = $psline" - sleep 2 - fi - done - fi - echo "Stopped Samba servers" - psline=`/bin/ps x | grep nmbd | grep -v grep` - if [ "$psline" ] - then - set -- $psline - pid=$1 - /bin/kill -9 $pid - echo "Stopped Name Server " - fi - echo "Stopped Name Servers" - ;; - *) - echo "usage: samba {start | restart |stop | conf | pw | who}" - ;; - esac - </PRE -><P -> Use this script, or some other one, you will need to ensure its used while the machine - is booting. (This typically involves <TT -CLASS="FILENAME" ->/etc/rc.d</TT ->, we'll be - assuming that there is a script called - samba in <TT -CLASS="FILENAME" ->/etc/rc.d/init.d</TT -> further down in this document.)</P -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN66" ->Config File</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN68" ->A sample conf file</A -></H2 -><P ->Here is a fairly minimal config file to do PDC. It will also make the server - become the browse master for the - specified domain (not necessary but usually desirable). You will need to change only - two parameters to make this - file work, <TT -CLASS="FILENAME" ->wins server</TT -> and <TT -CLASS="FILENAME" ->workgroup</TT ->, plus - you will need to put your own name (not mine!) in the <TT -CLASS="FILENAME" ->domain admin users</TT -> fields. - Some of the parameters are discussed further down this document.</P -><P ->Assuming you have used the default install directories, this file should appear as - <TT -CLASS="FILENAME" ->/usr/local/samba/lib/smb.conf</TT ->. It should not be - writable by anyone except root.</P -><DIV -CLASS="NOTE" -><BLOCKQUOTE -CLASS="NOTE" -><P -><B ->Note: </B ->The 'add user script' parameter is a work-around, watch for changes !</P -></BLOCKQUOTE -></DIV -><PRE -CLASS="PROGRAMLISTING" -> - - [global] - security = user - status = yes - workgroup = { Your domain name here } - wins server = { ip of a wins server if you have one } - encrypt passwords = yes - domain logons =yes - logon script = scripts\%U.bat - domain admin group = @adm - add user script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %m$ - guest account = ftp - share modes=no - os level=65 - [homes] - guest ok = no - read only = no - create mask = 0700 - directory mask = 0700 - oplocks = false - locking = no - [netlogon] - path = /usr/local/samba/netlogon - writeable = no - guest ok = no - </PRE -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN79" ->PDC Config Parameters</A -></H2 -><P -></P -><DIV -CLASS="VARIABLELIST" -><P -><B ->There are a huge range of parameters that may appear in a smb.conf file. Some - that may be of interest to a PDC are :</B -></P -><DL -><DT ->add user script</DT -><DD -><P ->This parameter specifies a script (or program) that will be run - to add a user to the system. Here it is being used to add a machine, not a user. - This is probably not very nice and may change. But it does work !</P -><P ->For this example, I have a group called 'machines', entries can be added to - <TT -CLASS="FILENAME" ->/etc/passwd</TT -> using a programme called <TT -CLASS="FILENAME" ->/usr/adduser</TT -> and - the other parameters are chosen as suitable for a machine account. Works for - RH Linux, your system may require changes.</P -></DD -><DT ->domain admin group = @adm</DT -><DD -><P ->This parameter specifies a unix group whose members will be granted - admin privileges on a NT workstation when - logged onto that workstation. See the section called <A -HREF="#AEN223" -> Domain Admin</A -> Accounts.</P -></DD -><DT ->domain admin users = user1 users2</DT -><DD -><P ->It appears that this parameter does not funtion correctly at present. - Use the 'domain admin group' instread. This parameter specifies a unix user who will - be granted admin privileges - on a NT workstation when - logged onto that workstation. See the section called <A -HREF="#AEN223" -> Domain Admin</A -> Accounts.</P -></DD -><DT ->encrypt passwords = yes</DT -><DD -><P ->This parameter must be 'yes' to allow any of the recent service pack NTs to logon. There are some reg hacks that - turn off encrypted passwords on the NTws itself but if you are going to use the smbpasswd system (and you - should) you must use encrypted passwords.</P -></DD -><DT ->logon script = scripts\%U.bat</DT -><DD -><P ->This will make samba look for a logon script named after the user - (eg joeblow.bat). - See the section further on called <A -HREF="#AEN251" ->Logon Scripts</A -></P -><DIV -CLASS="NOTE" -><BLOCKQUOTE -CLASS="NOTE" -><P -><B ->Note: </B ->Note that the slash is like this '\', not like this '/'. - NT is happy with both, win95 is not !</P -></BLOCKQUOTE -></DIV -></DD -><DT ->logon path</DT -><DD -><P ->Lets you specify where you would like users profiles kept. The default, that is in the users - home directory, does encourage a bit of fiddling.</P -></DD -></DL -></DIV -></DIV -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN115" ->Special directories</A -></H1 -><P ->You need to create a couple of special files and directories. Its nice - to have some of the binaries handy too, so I create links to them. Assuming - you have used the default samba location and have not - changed the locations mentioned in the sample config file, do the following :</P -><PRE -CLASS="PROGRAMLISTING" -> - - mkdir /usr/local/samba/netlogon - mkdir /usr/local/samba/netlogon/scripts - mkdir /usr/local/samba/private - touch /usr/local/samba/private/smbpasswd - chmod go-rwx /usr/local/samba/private/smbpasswd - cd /usr/local/sbin - ln -s /usr/local/samba/bin/smbpasswd - ln -s /usr/local/samba/bin/smbclient - ln -s /etc/rc.d/init.d/samba</PRE -><P ->Make sure permissions are appropriate !</P -><P ->OK, if you have used the scripts above and have a path to where the links are do this to start up - the Samba Server :</P -><P -><B -CLASS="COMMAND" ->samba start</B -></P -><P ->Instead, you might like to reboot the machine to make sure that you - got the init stuff right. Any way, a quick look in the logs - <TT -CLASS="FILENAME" ->/usr/local/samba/var/log.smbd</TT -> and <TT -CLASS="FILENAME" -> /usr/local/samba/var/log/nmbd</TT -> - will give you an idea of what's happening. Assuming all is well, lets create - some accounts...</P -></DIV -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN126" ->Chapter 3. User and Machine Accounts</A -></H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN128" ->Logon Accounts</A -></H1 -><P -><I -CLASS="EMPHASIS" ->This section is very nearly out of date already !</I -> It - appears that while you are reading it, Jean Francois Micou is making it - redundant ! Jean Francois is adding facilities to add users - (via User Manager) and machines (when joining the domain) and it looks like these facilities will - make it into the official release of 2.2.</P -><P ->Every user and NTws (and other samba servers) that will be on the domain - must have its own passwd entry in both <TT -CLASS="FILENAME" ->/etc/passwd</TT -> and - <TT -CLASS="FILENAME" ->/usr/local/samba/private/smbpasswd</TT -> . - The <TT -CLASS="FILENAME" ->/etc/passwd</TT -> entry is really - only to reserve a user ID. The NT encrypted password is stored in - <TT -CLASS="FILENAME" ->/usr/local/samba/private/smbpasswd</TT ->. - (Note that win95/98 machines don't need an account as they don't do - any security aware things.)</P -><P ->Samba 2.2 will now create these entries for us. Carefull set up is required - and there may well be some changes to this system before its released. - </P -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="MACHINEACCOUNT" ->Machine Accounts</A -></H1 -><DIV -CLASS="NOTE" -><BLOCKQUOTE -CLASS="NOTE" -><P -><B ->Note: </B ->There is an entry in the ntdom <A -HREF="samba-pdc-faq.html" -TARGET="_top" ->FAQ</A -> explaining how to create - machine entries manually.</P -></BLOCKQUOTE -></DIV -><P -></P -><DIV -CLASS="VARIABLELIST" -><P -><B -><I -CLASS="EMPHASIS" ->At present</I -> to have the machine accounts created when a machine joins - the domain a number of conditions must be met :</B -></P -><DL -><DT ->Only root can do it !</DT -><DD -><P ->There must be an entry in <TT -CLASS="FILENAME" ->/usr/local/samba/private/smbpasswd</TT -> - for root and root must be mentioned in <TT -CLASS="FILENAME" ->domain admins</TT ->. This may - be fixed some time in the future so any 'domain admin' can do it. If you don't - like having root as a windows logon account, make the machine - entries manually (both of them).</P -></DD -><DT ->Use the <TT -CLASS="FILENAME" ->add user script</TT -></DT -><DD -><P ->Again, this looks a bit like a 'work around'. Use a suitable - command line to add a machine account <A -HREF="#AEN68" ->see above</A ->, - and pass it %m$, that is %m to get machine name plus the '$'. Now, this - means you cannot use the <TT -CLASS="FILENAME" ->add user script</TT -> to really add users .... </P -></DD -><DT ->Only for W2K</DT -><DD -><P ->This automatic creation of machine accounts does not work for - NT4ws at present. Watch this space.</P -></DD -></DL -></DIV -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN163" ->Joining the Domain</A -></H1 -><P ->You must have either added the machine account entries manually (NT4 ws) - or set up the automatic system (W2K), <A -HREF="#MACHINEACCOUNT" ->see Machine Accounts</A -> - before proceeding.</P -><P -></P -><DIV -CLASS="VARIABLELIST" -><DL -><DT -><B -CLASS="COMMAND" ->Windows NT</B -></DT -><DD -><P -></P -><UL -><LI -><P -> (<I -CLASS="EMPHASIS" ->this step may not be necessary some time in the near future</I ->). - On the samba server that is the PDC, add a machine account manually - as per the instructions in the <A -HREF="samba-pdc-faq.html" -TARGET="_top" ->FAQ</A -> - Then give the command <B -CLASS="COMMAND" ->smbpasswd -a -m {machine}</B -> substituting in the - client machine name.</P -></LI -><LI -><P -> Logon to the NTws in question as a local admin, go to the - <B -CLASS="COMMAND" ->Control Panel, Network IdentificationTag</B ->.</P -></LI -><LI -><P -> Press the <B -CLASS="COMMAND" ->Change</B -> button.</P -></LI -><LI -><P -> Enter the Domain name (from the 'Workgroup' parameter, smb.conf) - in the Domain Field.</P -></LI -><LI -><P -> Press OK and after a few seconds you will get a 'Welcome to Whatever Domain'. - Allow to reboot.</P -></LI -></UL -></DD -><DT -><B -CLASS="COMMAND" ->Windows 2000</B -></DT -><DD -><P -></P -><UL -><LI -><P ->Logon to the W2k machine as Administrator, go to the Control - Panel and double click on <B -CLASS="COMMAND" ->Network and Dialup Connections</B ->. - </P -></LI -><LI -><P ->Pull down the <B -CLASS="COMMAND" ->Advanced</B -> menu and choose - <B -CLASS="COMMAND" ->Network Identification</B ->. Press <B -CLASS="COMMAND" ->Properties - </B ->. </P -></LI -><LI -><P ->Choose <B -CLASS="COMMAND" ->Domain</B -> and enter the domain name. Press 'OK'.</P -></LI -><LI -><P ->Now enter a user name and password for a Domain Admin - <I -CLASS="EMPHASIS" ->(Who must be root until a pre-release bug is fixed)</I -> and press - 'OK'.</P -></LI -><LI -><P ->Wait for the confirmation, reboot when prompted.</P -></LI -></UL -><P ->To remove a W2K machine from the domain, follow the first two steps then - choose <B -CLASS="COMMAND" ->Workgroup</B ->, enter a work group name (or just WORKGROUP) and follow - the prompts.</P -></DD -></DL -></DIV -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN211" ->User Accounts</A -></H1 -><P -><I -CLASS="EMPHASIS" ->Again, doing it manually (cos' the auto way is not working pre-release). - </I -> - In our simple case every domain user should have an account on the PDC. The - account may have a null shell if they are not allowed to log on to the unix - prompt. Again they need an entry in both the <TT -CLASS="FILENAME" ->/etc/passwd</TT -> and - <TT -CLASS="FILENAME" ->/usr/local/samba/private/smbpasswd</TT ->. Again a password is - not necessary in <TT -CLASS="FILENAME" ->/etc/passwd</TT -> but the location - of the home directory is honoured. - To make an entry for a user called Joe Blow you would typically do the following :</P -><P -><B -CLASS="COMMAND" ->adduser -g users -c 'Joe Blow' -s /bin/false -n joeblow</B -></P -><P -><B -CLASS="COMMAND" ->smbpasswd -a joeblow</B -></P -><P ->And you will prompted to enter a password for Joe. Ideally he will be - hovering over your shoulder and will, when asked, type in a password of - his choice. There are a number of scripts and systems to ease the migration of users - from somewhere to samba. Better start looking !</P -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN223" ->Domain Admin Accounts</A -></H1 -><P ->Certain operations demand that the logged on user has Administrator - privileges, typically installing software and - doing maintenance tasks. It is very simple to appoint some users as Domain Admins, - most likely yourself. Make - sure you trust the appointee !</P -><P ->Samba 2.2 recognizes particular users as being - domain admins and tells the NTws when it thinks that it has got one logged on. - In the smb.conf file we declare - that the <TT -CLASS="FILENAME" ->Domain Admin group = @adm</TT ->. - Any user who is a menber of the unix group 'adm' is treated as a Domain Admin by a NTws when - logged onto the Domain. They will have full Administrator rights - including the rights to change permissions on files and run the system - utilities such as Disk Administrator. Add users to the group by editing <TT -CLASS="FILENAME" -> /etc/group/</TT ->. You do not need to use the 'adm' group, choose any one you like.</P -><P ->Further, and this is very new, they will be allowed to create a - new machine account when first connecting a new NT or W2K machine to - the domain. <I -CLASS="EMPHASIS" ->However, at present, ie pre-release, only a Domain Admin who - also happens to be root can do so. </I -></P -></DIV -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN231" ->Chapter 4. Profiles, Policies and Logon Scripts</A -></H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN233" ->Profiles</A -></H1 -><P ->NT Profiles should work if you have followed the setup so far. - A user's profile contains a whole lot of their personal settings, - the contents of their desktop, personal 'My Documents' and so on. - When they log off, all of the profile is copied to their directory - on the server and is downloaded again when they logon on again, possibly - on another client machine.</P -><P ->Sounds great but can be a bit of a bug bear sometimes. Users let - their profiles get too big and then complain about how long it takes - to log on each time. This sample setup only supports NT profiles, - rumor has it that it is also possible to do the same on Win95, my - users don't know and I'm not telling them.</P -><DIV -CLASS="NOTE" -><BLOCKQUOTE -CLASS="NOTE" -><P -><B ->Note: </B ->There is more info about Profiles (including for W95/98) - in the <A -HREF="samba-pdc-faq.html" -TARGET="_top" ->FAQ</A ->.</P -></BLOCKQUOTE -></DIV -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN240" ->Policies</A -></H1 -><P ->Policies are an easy way to make or enforce specific characteristics across your network. You create a ntconfig.pol - file and every time someone logs on with their NTws, the settings you put in ntconfig.pol are applied to the NTws. - Typical setting are things like making the date appear the way you want it (none of these 2 figure years here) or - maybe suppressing one of the splash screens. Perhaps you want to set the NTws so it does not keep users profiles - on the local machine. Cool. The only problem is making the ntconfig.pol file itself. You cannot use the policy editor - that comes with NTws.</P -><DIV -CLASS="NOTE" -><BLOCKQUOTE -CLASS="NOTE" -><P -><B ->Note: </B ->See the <A -HREF="samba-pdc-faq.html" -TARGET="_top" ->FAQ</A -> for pointers on how to get a suitable Policy Editor.</P -></BLOCKQUOTE -></DIV -><P ->The Policy Editor (and associated files) will create a - <TT -CLASS="FILENAME" ->ntconfig.pol</TT -> file using the - parameters Microsoft thought of and parameters you specify by making your own - template file.</P -><P ->In our example configuration here, Samba will expect to find - the <TT -CLASS="FILENAME" ->ntconfig.pol</TT -> file in - <TT -CLASS="FILENAME" ->/usr/local/samba/netlogon</TT ->. Needless to say (I hope !), - it is vitally important that ordinary users don't have - write permission to the Policy files.</P -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN251" ->Logon Scripts</A -></H1 -><P ->In the sample config file above there is a line - <TT -CLASS="FILENAME" ->logon script = scripts\%U.bat</TT -></P -><DIV -CLASS="NOTE" -><BLOCKQUOTE -CLASS="NOTE" -><P -><B ->Note: </B ->Note that the slash is like this '\' not like this '/'. - NT is happy with both, win95 is not !</P -></BLOCKQUOTE -></DIV -><P ->This allows you to run a dos batch file every time someone logs on. The batch - file is located on the server, in the sample install mentioned here, - its in <TT -CLASS="FILENAME" ->/usr/local/samba/netlogon/scripts</TT -> and - is named after the user with <TT -CLASS="FILENAME" ->.bat</TT -> appended, eg Joe - Blow's script is called <TT -CLASS="FILENAME" ->/usr/local/samba/netlogon/scripts/joeblow.bat</TT ->.</P -><DIV -CLASS="NOTE" -><BLOCKQUOTE -CLASS="NOTE" -><P -><B ->Note: </B ->There is a suggestion that user names longer than 8 characters may cause - problems with some systems being unable to run logon scripts. This is confirmed in earlier - versions when connecting using W95, comments about other combinations ??</P -></BLOCKQUOTE -></DIV -><P ->You could use a line like this <TT -CLASS="FILENAME" ->logon script = default.bat</TT -> and samba - will supply <TT -CLASS="FILENAME" ->/usr/local/samba/netlogon/default.bat</TT -> for any client and every - user. Maybe you could use %m and get a client machine dependant logon script. - You get the idea...</P -><P ->Note that the file is a dos batch file not a Unix script. It runs dos commands on the client - computer with the logon user's permissions. It must be a dos file with each line ending with - the dos cr/lf not a nice clean newline. Generally, - its best to create the initial file on a DOS system and copy it across.</P -><P ->There is lots of very clever uses of the Samba replaceable variables such - ( %U = user, %G = primary group, %H = client machine, see the 'man 5 smb.conf') to - give you control over which script runs when a particular person logs - on. (Gee, it would be nice to have a default.bat run when nothing else is available.)</P -><P ->Again, it is vitally important that ordinary users don't have write - permission to other peoples, or even probably their own, logon script files.</P -><P ->A typical logon script is reproduced below. Note that it runs separate - commands for win95 and NT, that's because NT has slightly different behaviour - when using the <TT -CLASS="FILENAME" ->net use ..</TT -> command. Its useful for lots of - other situations too. I don't know what syntax to use for win98, I don't use it - here.</P -><PRE -CLASS="PROGRAMLISTING" -> - - rem Default logon script, create links to this file. - - net time \\bioserve /set /yes - @echo off - if %OS%.==Windows_NT. goto WinNT - - :Win95 - net use k: \\trillion\bio_prog - net use p: \\bcfile\homes - goto end - :WinNT - net use k: \\trillion\bio_prog /persistent:no - net use p: \\bcfile\homes /persistent:no - - :end - </PRE -></DIV -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN272" ->Chapter 5. Passwords and Authentication</A -></H1 -><P ->So far our configuration assumes that ordinary users don't have unix logon access. A change - to the <A -HREF="#AEN211" -><TT -CLASS="FILENAME" ->adduser</TT -></A -> line above would allow unix logon - but it would be with passwords that may - be different from the NT logon. Clearly that won't suit everyone. Trying to explain to users - that they need to change their passwords in two seperate places is not fun. - Further, even if they cannot do a unix logon there are other processes that - might require authentication. We have a nice securely encrypted password in - <TT -CLASS="FILENAME" ->/usr/local/samba/private/smbpasswd</TT ->, why not use it ?</P -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN278" -></A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN280" ->Syncing Passwords</A -></H2 -><P ->Yes, its possible and seems the easiest way (initially anyway). - The <A -HREF="samba-pdc-faq.html" -TARGET="_top" ->FAQ</A -> details how to - do so in the sections <I -CLASS="EMPHASIS" ->What is password sync and should I use it ?</I -> and <I -CLASS="EMPHASIS" -> How do I get remote password (unix and SMB) changing working ?</I -></P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN286" ->Using PAM</A -></H2 -><P ->Pam enabled systems have a much better solution available. The Samba - PDC server will offer to authenticate domain users to other processes - (either on this server or on the domain). With a suitable pam stack - such as <A -HREF="http://www.csn.ul.ie/~airlied/pam_smb/" -TARGET="_top" -> Pam_smb</A -> - you can get any pam aware application looking to the samba password and - can leave the password field in <TT -CLASS="FILENAME" ->/etc/shadow</TT -> - or <TT -CLASS="FILENAME" ->/etc/passwd</TT -> invalid.</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN292" ->Authenticating other Samba Servers</A -></H2 -><P ->In a domain that has a number of servers you only need one password database. - The machines that don't have their own ask the PDC to check for them. - This will work fine for a domain controlled by either a Samba or NT machine.</P -><P ->To do so the Samba machine must be told to refer to the PDC and where the PDC is. - See the section in the NTDom <A -HREF="samba-pdc-faq.html" -TARGET="_top" ->FAQ</A -> called <I -CLASS="EMPHASIS" ->How do I get my samba server to - become a member ( not PDC ) of an NT domain?</I -></P -></DIV -></DIV -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN298" ->Chapter 6. Background</A -></H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN300" -></A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN302" ->History</A -></H2 -><P ->It might help you understand the limitations of the PDC in Samba if you - read something of its history. Well, the history as I understand it anyway.</P -><P ->For many years the Samba team have been developing Samba, some time ago - a number of people, possibly lead by Luke Leighton started contributing NT - PDC stuff. This was added to the 'head' stream (that would eventually - become the next version) and later to a seperate stream (NTDom). They did so - much that eventually this development stream was so mutated that it could not - be merged back into the main stream and was abandoned towards the end of 1999. - And that was very sad because many users, myself include had become heavily - dependant on the NTController facilities it offered. Oh well...</P -><P ->The NTDom team continued on with their new found knowledge however and - built the TNG stream. Intended to be carefully controlled so that it can be - merged back into the main stream and benefiting from what they learnt, it is - a very different product to the origional NTDom product. However, for a - number of reasons, the merge did not take place and now TNG is being developed - at <A -HREF="http://www.samba-tng.org" -TARGET="_top" ->http://www.samba-tng.org</A ->.</P -><P ->Now, the NTDom things that the main strean 2.0.x version does is based more - on the old (initial version) abandoned code than on the TNG ideas. It appears - that version 2.2.0 will also include an improved version of the 2.0.7 domain - controller charactistics, not the TNG ways. The developers have indicated - that 2.2.0 will be further developed incrementally and the ideas from TNG - incorporated into it.</P -><P ->One more little wriggle is worth mentioning. At one stage the NTDom - stream was called Samba 2.1.0-prealpha and similar names. This is most - unfortunate because at least one book published advises people who want to - use NTDom Samba to get version 2.1.0 or later. As main stream Samba will soon - be called 2.2.0 and NOT officially supporting NTDom Controlling functions, - the potential for confusion is certainly there.</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN310" ->The Future</A -></H2 -><P ->There is a document on the Samba mirrors called <I -CLASS="EMPHASIS" ->'Development' - </I ->. It offers the 'best guess' of what is planned for future releases - of Samba.</P -><P ->The future of Samba as a Primary Domain Controller appears rosie, however - be aware that its the future, not the present. The developers are strongly committed - to building a full featured PDC into Samba but it will take time. If this - version does not meet your requirements then you should consider (in no particular - order) :</P -><P -></P -><UL -><LI -><P -> Wait. No, we don't know how long. Repeated asking won't help.</P -></LI -><LI -><P ->Investigate the development versions, TNG perhaps or HEAD where new code is being added - all the time. Realise that development code is often unstable, poorly documented and subject to change. - You will need to use cvs to download development versions.</P -></LI -><LI -><P ->Join one of the Samba mailing lists so that you can find out - what is happening on the 'bleeding edge'.</P -></LI -></UL -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN322" ->Getting further help</A -></H2 -><P ->This document cannot possibly answer all your questions. Please understand that its very - likely that someone has been confrounted by the same problem that you have. The - <A -HREF="samba-pdc-faq.html" -TARGET="_top" ->FAQ</A -> - discusses a number of possible paths to take to get further help :</P -><P -></P -><UL -><LI -><P ->Documents on the Samba Sites.</P -></LI -><LI -><P ->Other web sites.</P -></LI -><LI -><P ->Mailing list.</P -></LI -></UL -><P ->There is some discussion about guide lines for using the Mailing Lists on the - accompanying <A -HREF="samba-pdc-faq.html" -TARGET="_top" ->FAQ</A ->, - please read them before posting.</P -></DIV -></DIV -></DIV -></DIV -></BODY -></HTML ->
\ No newline at end of file |