diff options
Diffstat (limited to 'docs/htmldocs')
| -rw-r--r-- | docs/htmldocs/Browsing.html | 741 | ||||
| -rw-r--r-- | docs/htmldocs/Bugs.html | 238 | ||||
| -rw-r--r-- | docs/htmldocs/Diagnosis.html | 548 | ||||
| -rw-r--r-- | docs/htmldocs/Integrating-with-Windows.html | 20 | ||||
| -rw-r--r-- | docs/htmldocs/Printing.html | 408 | ||||
| -rw-r--r-- | docs/htmldocs/Samba-HOWTO-Collection.html | 6741 | ||||
| -rw-r--r-- | docs/htmldocs/Samba-LDAP-HOWTO.html | 4 | ||||
| -rw-r--r-- | docs/htmldocs/Samba-PDC-HOWTO.html | 2 | ||||
| -rw-r--r-- | docs/htmldocs/Speed.html | 550 | ||||
| -rw-r--r-- | docs/htmldocs/UNIX_INSTALL.html | 29 | ||||
| -rw-r--r-- | docs/htmldocs/rpcclient.1.html | 43 | ||||
| -rw-r--r-- | docs/htmldocs/security_level.html | 169 | ||||
| -rw-r--r-- | docs/htmldocs/smb.conf.5.html | 1183 | ||||
| -rw-r--r-- | docs/htmldocs/smbcontrol.1.html | 69 | ||||
| -rw-r--r-- | docs/htmldocs/winbind.html | 260 |
15 files changed, 8176 insertions, 2829 deletions
diff --git a/docs/htmldocs/Browsing.html b/docs/htmldocs/Browsing.html new file mode 100644 index 0000000000..5f5f71ba69 --- /dev/null +++ b/docs/htmldocs/Browsing.html @@ -0,0 +1,741 @@ +<HTML +><HEAD +><TITLE +>Improved browsing in samba</TITLE +><META +NAME="GENERATOR" +CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD +><BODY +CLASS="ARTICLE" +BGCOLOR="#FFFFFF" +TEXT="#000000" +LINK="#0000FF" +VLINK="#840084" +ALINK="#0000FF" +><DIV +CLASS="ARTICLE" +><DIV +CLASS="TITLEPAGE" +><H1 +CLASS="TITLE" +><A +NAME="IMPROVED-BROWSING" +>Improved browsing in samba</A +></H1 +><HR></DIV +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN3" +>Overview of browsing</A +></H1 +><P +>SMB networking provides a mechanism by which clients can access a list +of machines in a network, a so-called "browse list". This list +contains machines that are ready to offer file and/or print services +to other machines within the network. Thus it does not include +machines which aren't currently able to do server tasks. The browse +list is heavily used by all SMB clients. Configuration of SMB +browsing has been problematic for some Samba users, hence this +document.</P +><P +>Browsing will NOT work if name resolution from NetBIOS names to IP +addresses does not function correctly. Use of a WINS server is highly +recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. +WINS allows remote segment clients to obtain NetBIOS name_type information +that can NOT be provided by any other means of name resolution.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN7" +>Browsing support in samba</A +></H1 +><P +>Samba now fully supports browsing. The browsing is supported by nmbd +and is also controlled by options in the smb.conf file (see smb.conf(5)).</P +><P +>Samba can act as a local browse master for a workgroup and the ability +for samba to support domain logons and scripts is now available. See +DOMAIN.txt for more information on domain logons.</P +><P +>Samba can also act as a domain master browser for a workgroup. This +means that it will collate lists from local browse masters into a +wide area network server list. In order for browse clients to +resolve the names they may find in this list, it is recommended that +both samba and your clients use a WINS server.</P +><P +>Note that you should NOT set Samba to be the domain master for a +workgroup that has the same name as an NT Domain: on each wide area +network, you must only ever have one domain master browser per workgroup, +regardless of whether it is NT, Samba or any other type of domain master +that is providing this service.</P +><P +>[Note that nmbd can be configured as a WINS server, but it is not +necessary to specifically use samba as your WINS server. NTAS can +be configured as your WINS server. In a mixed NT server and +samba environment on a Wide Area Network, it is recommended that +you use the NT server's WINS server capabilities. In a samba-only +environment, it is recommended that you use one and only one nmbd +as your WINS server].</P +><P +>To get browsing to work you need to run nmbd as usual, but will need +to use the "workgroup" option in smb.conf to control what workgroup +Samba becomes a part of.</P +><P +>Samba also has a useful option for a Samba server to offer itself for +browsing on another subnet. It is recommended that this option is only +used for 'unusual' purposes: announcements over the internet, for +example. See "remote announce" in the smb.conf man page. </P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN16" +>Problem resolution</A +></H1 +><P +>If something doesn't work then hopefully the log.nmb file will help +you track down the problem. Try a debug level of 2 or 3 for finding +problems. Also note that the current browse list usually gets stored +in text form in a file called browse.dat.</P +><P +>Note that if it doesn't work for you, then you should still be able to +type the server name as \\SERVER in filemanager then hit enter and +filemanager should display the list of available shares.</P +><P +>Some people find browsing fails because they don't have the global +"guest account" set to a valid account. Remember that the IPC$ +connection that lists the shares is done as guest, and thus you must +have a valid guest account.</P +><P +>Also, a lot of people are getting bitten by the problem of too many +parameters on the command line of nmbd in inetd.conf. This trick is to +not use spaces between the option and the parameter (eg: -d2 instead +of -d 2), and to not use the -B and -N options. New versions of nmbd +are now far more likely to correctly find your broadcast and network +address, so in most cases these aren't needed.</P +><P +>The other big problem people have is that their broadcast address, +netmask or IP address is wrong (specified with the "interfaces" option +in smb.conf)</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN23" +>Browsing across subnets</A +></H1 +><P +>With the release of Samba 1.9.17(alpha1 and above) Samba has been +updated to enable it to support the replication of browse lists +across subnet boundaries. New code and options have been added to +achieve this. This section describes how to set this feature up +in different settings.</P +><P +>To see browse lists that span TCP/IP subnets (ie. networks separated +by routers that don't pass broadcast traffic) you must set up at least +one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing +NetBIOS name to IP address translation to be done by doing a direct +query of the WINS server. This is done via a directed UDP packet on +port 137 to the WINS server machine. The reason for a WINS server is +that by default, all NetBIOS name to IP address translation is done +by broadcasts from the querying machine. This means that machines +on one subnet will not be able to resolve the names of machines on +another subnet without using a WINS server.</P +><P +>Remember, for browsing across subnets to work correctly, all machines, +be they Windows 95, Windows NT, or Samba servers must have the IP address +of a WINS server given to them by a DHCP server, or by manual configuration +(for Win95 and WinNT, this is in the TCP/IP Properties, under Network +settings) for Samba this is in the smb.conf file.</P +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN28" +>How does cross subnet browsing work ?</A +></H2 +><P +>Cross subnet browsing is a complicated dance, containing multiple +moving parts. It has taken Microsoft several years to get the code +that achieves this correct, and Samba lags behind in some areas. +However, with the 1.9.17 release, Samba is capable of cross subnet +browsing when configured correctly.</P +><P +>Consider a network set up as follows :</P +><P +><PRE +CLASS="PROGRAMLISTING" +> (DMB) + N1_A N1_B N1_C N1_D N1_E + | | | | | + ------------------------------------------------------- + | subnet 1 | + +---+ +---+ + |R1 | Router 1 Router 2 |R2 | + +---+ +---+ + | | + | subnet 2 subnet 3 | + -------------------------- ------------------------------------ + | | | | | | | | + N2_A N2_B N2_C N2_D N3_A N3_B N3_C N3_D + (WINS)</PRE +></P +><P +>Consisting of 3 subnets (1, 2, 3) connected by two routers +(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines +on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume +for the moment that all these machines are configured to be in the +same workgroup (for simplicities sake). Machine N1_C on subnet 1 +is configured as Domain Master Browser (ie. it will collate the +browse lists for the workgroup). Machine N2_D is configured as +WINS server and all the other machines are configured to register +their NetBIOS names with it.</P +><P +>As all these machines are booted up, elections for master browsers +will take place on each of the three subnets. Assume that machine +N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on +subnet 3 - these machines are known as local master browsers for +their particular subnet. N1_C has an advantage in winning as the +local master browser on subnet 1 as it is set up as Domain Master +Browser.</P +><P +>On each of the three networks, machines that are configured to +offer sharing services will broadcast that they are offering +these services. The local master browser on each subnet will +receive these broadcasts and keep a record of the fact that +the machine is offering a service. This list of records is +the basis of the browse list. For this case, assume that +all the machines are configured to offer services so all machines +will be on the browse list.</P +><P +>For each network, the local master browser on that network is +considered 'authoritative' for all the names it receives via +local broadcast. This is because a machine seen by the local +master browser via a local broadcast must be on the same +network as the local master browser and thus is a 'trusted' +and 'verifiable' resource. Machines on other networks that +the local master browsers learn about when collating their +browse lists have not been directly seen - these records are +called 'non-authoritative'.</P +><P +>At this point the browse lists look as follows (these are +the machines you would see in your network neighborhood if +you looked in it on a particular network right now).</P +><P +><PRE +CLASS="PROGRAMLISTING" +>Subnet Browse Master List +------ ------------- ---- +Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E + +Subnet2 N2_B N2_A, N2_B, N2_C, N2_D + +Subnet3 N3_D N3_A, N3_B, N3_C, N3_D</PRE +></P +><P +>Note that at this point all the subnets are separate, no +machine is seen across any of the subnets.</P +><P +>Now examine subnet 2. As soon as N2_B has become the local +master browser it looks for a Domain master browser to synchronize +its browse list with. It does this by querying the WINS server +(N2_D) for the IP address associated with the NetBIOS name +WORKGROUP>1B<. This name was registerd by the Domain master +browser (N1_C) with the WINS server as soon as it was booted.</P +><P +>Once N2_B knows the address of the Domain master browser it +tells it that is the local master browser for subnet 2 by +sending a MasterAnnouncement packet as a UDP port 138 packet. +It then synchronizes with it by doing a NetServerEnum2 call. This +tells the Domain Master Browser to send it all the server +names it knows about. Once the domain master browser receives +the MasterAnnouncement packet it schedules a synchronization +request to the sender of that packet. After both synchronizations +are done the browse lists look like :</P +><P +><PRE +CLASS="PROGRAMLISTING" +>Subnet Browse Master List +------ ------------- ---- +Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, + N2_A(*), N2_B(*), N2_C(*), N2_D(*) + +Subnet2 N2_B N2_A, N2_B, N2_C, N2_D + N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) + +Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + +Servers with a (*) after them are non-authoritative names.</PRE +></P +><P +>At this point users looking in their network neighborhood on +subnets 1 or 2 will see all the servers on both, users on +subnet 3 will still only see the servers on their own subnet.</P +><P +>The same sequence of events that occured for N2_B now occurs +for the local master browser on subnet 3 (N3_D). When it +synchronizes browse lists with the domain master browser (N1_A) +it gets both the server entries on subnet 1, and those on +subnet 2. After N3_D has synchronized with N1_C and vica-versa +the browse lists look like.</P +><P +><PRE +CLASS="PROGRAMLISTING" +>Subnet Browse Master List +------ ------------- ---- +Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, + N2_A(*), N2_B(*), N2_C(*), N2_D(*), + N3_A(*), N3_B(*), N3_C(*), N3_D(*) + +Subnet2 N2_B N2_A, N2_B, N2_C, N2_D + N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) + +Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), + N2_A(*), N2_B(*), N2_C(*), N2_D(*) + +Servers with a (*) after them are non-authoritative names.</PRE +></P +><P +>At this point users looking in their network neighborhood on +subnets 1 or 3 will see all the servers on all sunbets, users on +subnet 2 will still only see the servers on subnets 1 and 2, but not 3.</P +><P +>Finally, the local master browser for subnet 2 (N2_B) will sync again +with the domain master browser (N1_C) and will recieve the missing +server entries. Finally - and as a steady state (if no machines +are removed or shut off) the browse lists will look like :</P +><P +><PRE +CLASS="PROGRAMLISTING" +>Subnet Browse Master List +------ ------------- ---- +Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, + N2_A(*), N2_B(*), N2_C(*), N2_D(*), + N3_A(*), N3_B(*), N3_C(*), N3_D(*) + +Subnet2 N2_B N2_A, N2_B, N2_C, N2_D + N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) + N3_A(*), N3_B(*), N3_C(*), N3_D(*) + +Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), + N2_A(*), N2_B(*), N2_C(*), N2_D(*) + +Servers with a (*) after them are non-authoritative names.</PRE +></P +><P +>Synchronizations between the domain master browser and local +master browsers will continue to occur, but this should be a +steady state situation.</P +><P +>If either router R1 or R2 fails the following will occur:</P +><P +></P +><OL +TYPE="1" +><LI +><P +> Names of computers on each side of the inaccessible network fragments + will be maintained for as long as 36 minutes, in the network neighbourhood + lists. + </P +></LI +><LI +><P +> Attempts to connect to these inaccessible computers will fail, but the + names will not be removed from the network neighbourhood lists. + </P +></LI +><LI +><P +> If one of the fragments is cut off from the WINS server, it will only + be able to access servers on its local subnet, by using subnet-isolated + broadcast NetBIOS name resolution. The effects are similar to that of + losing access to a DNS server. + </P +></LI +></OL +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN63" +>Setting up a WINS server</A +></H1 +><P +>Either a Samba machine or a Windows NT Server machine may be set up +as a WINS server. To set a Samba machine to be a WINS server you must +add the following option to the smb.conf file on the selected machine : +in the [globals] section add the line </P +><P +><B +CLASS="COMMAND" +> wins support = yes</B +></P +><P +>Versions of Samba previous to 1.9.17 had this parameter default to +yes. If you have any older versions of Samba on your network it is +strongly suggested you upgrade to 1.9.17 or above, or at the very +least set the parameter to 'no' on all these machines.</P +><P +>Machines with "<B +CLASS="COMMAND" +>wins support = yes</B +>" will keep a list of +all NetBIOS names registered with them, acting as a DNS for NetBIOS names.</P +><P +>You should set up only ONE wins server. Do NOT set the +"<B +CLASS="COMMAND" +>wins support = yes</B +>" option on more than one Samba +server.</P +><P +>To set up a Windows NT Server as a WINS server you need to set up +the WINS service - see your NT documentation for details. Note that +Windows NT WINS Servers can replicate to each other, allowing more +than one to be set up in a complex subnet environment. As Microsoft +refuse to document these replication protocols Samba cannot currently +participate in these replications. It is possible in the future that +a Samba->Samba WINS replication protocol may be defined, in which +case more than one Samba machine could be set up as a WINS server +but currently only one Samba server should have the "wins support = yes" +parameter set.</P +><P +>After the WINS server has been configured you must ensure that all +machines participating on the network are configured with the address +of this WINS server. If your WINS server is a Samba machine, fill in +the Samba machine IP address in the "Primary WINS Server" field of +the "Control Panel->Network->Protocols->TCP->WINS Server" dialogs +in Windows 95 or Windows NT. To tell a Samba server the IP address +of the WINS server add the following line to the [global] section of +all smb.conf files :</P +><P +><B +CLASS="COMMAND" +> wins server = >name or IP address<</B +></P +><P +>where >name or IP address< is either the DNS name of the WINS server +machine or its IP address.</P +><P +>Note that this line MUST NOT BE SET in the smb.conf file of the Samba +server acting as the WINS server itself. If you set both the +"<B +CLASS="COMMAND" +>wins support = yes</B +>" option and the +"<B +CLASS="COMMAND" +>wins server = >name<</B +>" option then +nmbd will fail to start.</P +><P +>There are two possible scenarios for setting up cross subnet browsing. +The first details setting up cross subnet browsing on a network containing +Windows 95, Samba and Windows NT machines that are not configured as +part of a Windows NT Domain. The second details setting up cross subnet +browsing on networks that contain NT Domains.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN82" +>Setting up Browsing in a WORKGROUP</A +></H1 +><P +>To set up cross subnet browsing on a network containing machines +in up to be in a WORKGROUP, not an NT Domain you need to set up one +Samba server to be the Domain Master Browser (note that this is *NOT* +the same as a Primary Domain Controller, although in an NT Domain the +same machine plays both roles). The role of a Domain master browser is +to collate the browse lists from local master browsers on all the +subnets that have a machine participating in the workgroup. Without +one machine configured as a domain master browser each subnet would +be an isolated workgroup, unable to see any machines on any other +subnet. It is the presense of a domain master browser that makes +cross subnet browsing possible for a workgroup.</P +><P +>In an WORKGROUP environment the domain master browser must be a +Samba server, and there must only be one domain master browser per +workgroup name. To set up a Samba server as a domain master browser, +set the following option in the [global] section of the smb.conf file :</P +><P +><B +CLASS="COMMAND" +> domain master = yes</B +></P +><P +>The domain master browser should also preferrably be the local master +browser for its own subnet. In order to achieve this set the following +options in the [global] section of the smb.conf file :</P +><P +><PRE +CLASS="PROGRAMLISTING" +> domain master = yes + local master = yes + preferred master = yes + os level = 65</PRE +></P +><P +>The domain master browser may be the same machine as the WINS +server, if you require.</P +><P +>Next, you should ensure that each of the subnets contains a +machine that can act as a local master browser for the +workgroup. Any NT machine should be able to do this, as will +Windows 95 machines (although these tend to get rebooted more +often, so it's not such a good idea to use these). To make a +Samba server a local master browser set the following +options in the [global] section of the smb.conf file :</P +><P +><PRE +CLASS="PROGRAMLISTING" +> domain master = no + local master = yes + preferred master = yes + os level = 65</PRE +></P +><P +>Do not do this for more than one Samba server on each subnet, +or they will war with each other over which is to be the local +master browser.</P +><P +>The "local master" parameter allows Samba to act as a local master +browser. The "preferred master" causes nmbd to force a browser +election on startup and the "os level" parameter sets Samba high +enough so that it should win any browser elections.</P +><P +>If you have an NT machine on the subnet that you wish to +be the local master browser then you can disable Samba from +becoming a local master browser by setting the following +options in the [global] section of the smb.conf file :</P +><P +><PRE +CLASS="PROGRAMLISTING" +> domain master = no + local master = no + preferred master = no + os level = 0</PRE +></P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN100" +>Setting up Browsing in a DOMAIN</A +></H1 +><P +>If you are adding Samba servers to a Windows NT Domain then +you must not set up a Samba server as a domain master browser. +By default, a Windows NT Primary Domain Controller for a Domain +name is also the Domain master browser for that name, and many +things will break if a Samba server registers the Domain master +browser NetBIOS name (DOMAIN>1B<) with WINS instead of the PDC.</P +><P +>For subnets other than the one containing the Windows NT PDC +you may set up Samba servers as local master browsers as +described. To make a Samba server a local master browser set +the following options in the [global] section of the smb.conf +file :</P +><P +><PRE +CLASS="PROGRAMLISTING" +> domain master = no + local master = yes + preferred master = yes + os level = 65</PRE +></P +><P +>If you wish to have a Samba server fight the election with machines +on the same subnet you may set the "os level" parameter to lower +levels. By doing this you can tune the order of machines that +will become local master browsers if they are running. For +more details on this see the section "FORCING SAMBA TO BE THE MASTER" +below.</P +><P +>If you have Windows NT machines that are members of the domain +on all subnets, and you are sure they will always be running then +you can disable Samba from taking part in browser elections and +ever becoming a local master browser by setting following options +in the [global] section of the smb.conf file :</P +><P +><B +CLASS="COMMAND" +> domain master = no + local master = no + preferred master = no + os level = 0</B +></P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN110" +>Forcing samba to be the master</A +></H1 +><P +>Who becomes the "master browser" is determined by an election process +using broadcasts. Each election packet contains a number of parameters +which determine what precedence (bias) a host should have in the +election. By default Samba uses a very low precedence and thus loses +elections to just about anyone else.</P +><P +>If you want Samba to win elections then just set the "os level" global +option in smb.conf to a higher number. It defaults to 0. Using 34 +would make it win all elections over every other system (except other +samba systems!)</P +><P +>A "os level" of 2 would make it beat WfWg and Win95, but not NTAS. A +NTAS domain controller uses level 32.</P +><P +>The maximum os level is 255</P +><P +>If you want samba to force an election on startup, then set the +"preferred master" global option in smb.conf to "yes". Samba will +then have a slight advantage over other potential master browsers +that are not preferred master browsers. Use this parameter with +care, as if you have two hosts (whether they are windows 95 or NT or +samba) on the same local subnet both set with "preferred master" to +"yes", then periodically and continually they will force an election +in order to become the local master browser.</P +><P +>If you want samba to be a "domain master browser", then it is +recommended that you also set "preferred master" to "yes", because +samba will not become a domain master browser for the whole of your +LAN or WAN if it is not also a local master browser on its own +broadcast isolated subnet.</P +><P +>It is possible to configure two samba servers to attempt to become +the domain master browser for a domain. The first server that comes +up will be the domain master browser. All other samba servers will +attempt to become the domain master browser every 5 minutes. They +will find that another samba server is already the domain master +browser and will fail. This provides automatic redundancy, should +the current domain master browser fail.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN119" +>Making samba the domain master</A +></H1 +><P +>The domain master is responsible for collating the browse lists of +multiple subnets so that browsing can occur between subnets. You can +make samba act as the domain master by setting "domain master = yes" +in smb.conf. By default it will not be a domain master.</P +><P +>Note that you should NOT set Samba to be the domain master for a +workgroup that has the same name as an NT Domain.</P +><P +>When samba is the domain master and the master browser it will listen +for master announcements (made roughly every twelve minutes) from local +master browsers on other subnets and then contact them to synchronise +browse lists.</P +><P +>If you want samba to be the domain master then I suggest you also set +the "os level" high enough to make sure it wins elections, and set +"preferred master" to "yes", to get samba to force an election on +startup.</P +><P +>Note that all your servers (including samba) and clients should be +using a WINS server to resolve NetBIOS names. If your clients are only +using broadcasting to resolve NetBIOS names, then two things will occur:</P +><P +></P +><OL +TYPE="1" +><LI +><P +> your local master browsers will be unable to find a domain master + browser, as it will only be looking on the local subnet. + </P +></LI +><LI +><P +> if a client happens to get hold of a domain-wide browse list, and + a user attempts to access a host in that list, it will be unable to + resolve the NetBIOS name of that host. + </P +></LI +></OL +><P +>If, however, both samba and your clients are using a WINS server, then:</P +><P +></P +><OL +TYPE="1" +><LI +><P +> your local master browsers will contact the WINS server and, as long as + samba has registered that it is a domain master browser with the WINS + server, your local master browser will receive samba's ip address + as its domain master browser. + </P +></LI +><LI +><P +> when a client receives a domain-wide browse list, and a user attempts + to access a host in that list, it will contact the WINS server to + resolve the NetBIOS name of that host. as long as that host has + registered its NetBIOS name with the same WINS server, the user will + be able to see that host. + </P +></LI +></OL +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN137" +>Note about broadcast addresses</A +></H1 +><P +>If your network uses a "0" based broadcast address (for example if it +ends in a 0) then you will strike problems. Windows for Workgroups +does not seem to support a 0's broadcast and you will probably find +that browsing and name lookups won't work.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN140" +>Multiple interfaces</A +></H1 +><P +>Samba now supports machines with multiple network interfaces. If you +have multiple interfaces then you will need to use the "interfaces" +option in smb.conf to configure them. See smb.conf(5) for details.</P +></DIV +></DIV +></BODY +></HTML +>
\ No newline at end of file diff --git a/docs/htmldocs/Bugs.html b/docs/htmldocs/Bugs.html new file mode 100644 index 0000000000..0f7fb7bd60 --- /dev/null +++ b/docs/htmldocs/Bugs.html @@ -0,0 +1,238 @@ +<HTML +><HEAD +><TITLE +>Reporting Bugs</TITLE +><META +NAME="GENERATOR" +CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD +><BODY +CLASS="ARTICLE" +BGCOLOR="#FFFFFF" +TEXT="#000000" +LINK="#0000FF" +VLINK="#840084" +ALINK="#0000FF" +><DIV +CLASS="ARTICLE" +><DIV +CLASS="TITLEPAGE" +><H1 +CLASS="TITLE" +><A +NAME="BUGREPORT" +>Reporting Bugs</A +></H1 +><HR></DIV +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN3" +>Introduction</A +></H1 +><P +>The email address for bug reports is samba@samba.org</P +><P +>Please take the time to read this file before you submit a bug +report. Also, please see if it has changed between releases, as we +may be changing the bug reporting mechanism at some time.</P +><P +>Please also do as much as you can yourself to help track down the +bug. Samba is maintained by a dedicated group of people who volunteer +their time, skills and efforts. We receive far more mail about it than +we can possibly answer, so you have a much higher chance of an answer +and a fix if you send us a "developer friendly" bug report that lets +us fix it fast. </P +><P +>Do not assume that if you post the bug to the comp.protocols.smb +newsgroup or the mailing list that we will read it. If you suspect that your +problem is not a bug but a configuration problem then it is better to send +it to the Samba mailing list, as there are (at last count) 5000 other users on +that list that may be able to help you.</P +><P +>You may also like to look though the recent mailing list archives, +which are conveniently accessible on the Samba web pages +at http://samba.org/samba/ </P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN10" +>General info</A +></H1 +><P +>Before submitting a bug report check your config for silly +errors. Look in your log files for obvious messages that tell you that +you've misconfigured something and run testparm to test your config +file for correct syntax.</P +><P +>Have you run through the <A +HREF="Diagnosis.html" +TARGET="_top" +>diagnosis</A +>? +This is very important.</P +><P +>If you include part of a log file with your bug report then be sure to +annotate it with exactly what you were doing on the client at the +time, and exactly what the results were.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN16" +>Debug levels</A +></H1 +><P +>If the bug has anything to do with Samba behaving incorrectly as a +server (like refusing to open a file) then the log files will probably +be very useful. Depending on the problem a log level of between 3 and +10 showing the problem may be appropriate. A higher level givesmore +detail, but may use too much disk space.</P +><P +>To set the debug level use <B +CLASS="COMMAND" +>log level =</B +> in your +<TT +CLASS="FILENAME" +>smb.conf</TT +>. You may also find it useful to set the log +level higher for just one machine and keep separate logs for each machine. +To do this use:</P +><P +><PRE +CLASS="PROGRAMLISTING" +>log level = 10 +log file = /usr/local/samba/lib/log.%m +include = /usr/local/samba/lib/smb.conf.%m</PRE +></P +><P +>then create a file +<TT +CLASS="FILENAME" +>/usr/local/samba/lib/smb.conf.machine</TT +> where +"machine" is the name of the client you wish to debug. In that file +put any smb.conf commands you want, for example +<B +CLASS="COMMAND" +>log level=</B +> may be useful. This also allows you to +experiment with different security systems, protocol levels etc on just +one machine.</P +><P +>The <TT +CLASS="FILENAME" +>smb.conf</TT +> entry <B +CLASS="COMMAND" +>log level =</B +> +is synonymous with the entry <B +CLASS="COMMAND" +>debuglevel =</B +> that has been +used in older versions of Samba and is being retained for backwards +compatibility of smb.conf files.</P +><P +>As the <B +CLASS="COMMAND" +>log level =</B +> value is increased you will record +a significantly increasing level of debugging information. For most +debugging operations you may not need a setting higher than 3. Nearly +all bugs can be tracked at a setting of 10, but be prepared for a VERY +large volume of log data.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN33" +>Internal errors</A +></H1 +><P +>If you get a "INTERNAL ERROR" message in your log files it means that +Samba got an unexpected signal while running. It is probably a +segmentation fault and almost certainly means a bug in Samba (unless +you have faulty hardware or system software)</P +><P +>If the message came from smbd then it will probably be accompanied by +a message which details the last SMB message received by smbd. This +info is often very useful in tracking down the problem so please +include it in your bug report.</P +><P +>You should also detail how to reproduce the problem, if +possible. Please make this reasonably detailed.</P +><P +>You may also find that a core file appeared in a "corefiles" +subdirectory of the directory where you keep your samba log +files. This file is the most useful tool for tracking down the bug. To +use it you do this:</P +><P +><B +CLASS="COMMAND" +>gdb smbd core</B +></P +><P +>adding appropriate paths to smbd and core so gdb can find them. If you +don't have gdb then try "dbx". Then within the debugger use the +command "where" to give a stack trace of where the problem +occurred. Include this in your mail.</P +><P +>If you known any assembly language then do a "disass" of the routine +where the problem occurred (if its in a library routine then +disassemble the routine that called it) and try to work out exactly +where the problem is by looking at the surrounding code. Even if you +don't know assembly then incuding this info in the bug report can be +useful. </P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN43" +>Attaching to a running process</A +></H1 +><P +>Unfortunately some unixes (in particular some recent linux kernels) +refuse to dump a core file if the task has changed uid (which smbd +does often). To debug with this sort of system you could try to attach +to the running process using "gdb smbd PID" where you get PID from +smbstatus. Then use "c" to continue and try to cause the core dump +using the client. The debugger should catch the fault and tell you +where it occurred.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN46" +>Patches</A +></H1 +><P +>The best sort of bug report is one that includes a fix! If you send us +patches please use <B +CLASS="COMMAND" +>diff -u</B +> format if your version of +diff supports it, otherwise use <B +CLASS="COMMAND" +>diff -c4</B +>. Make sure +your do the diff against a clean version of the source and let me know +exactly what version you used. </P +></DIV +></DIV +></BODY +></HTML +>
\ No newline at end of file diff --git a/docs/htmldocs/Diagnosis.html b/docs/htmldocs/Diagnosis.html new file mode 100644 index 0000000000..1944c37be9 --- /dev/null +++ b/docs/htmldocs/Diagnosis.html @@ -0,0 +1,548 @@ +<HTML +><HEAD +><TITLE +>Diagnosing your samba server</TITLE +><META +NAME="GENERATOR" +CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD +><BODY +CLASS="ARTICLE" +BGCOLOR="#FFFFFF" +TEXT="#000000" +LINK="#0000FF" +VLINK="#840084" +ALINK="#0000FF" +><DIV +CLASS="ARTICLE" +><DIV +CLASS="TITLEPAGE" +><H1 +CLASS="TITLE" +><A +NAME="DIAGNOSIS" +>Diagnosing your samba server</A +></H1 +><HR></DIV +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN3" +>Introduction</A +></H1 +><P +>This file contains a list of tests you can perform to validate your +Samba server. It also tells you what the likely cause of the problem +is if it fails any one of these steps. If it passes all these tests +then it is probably working fine.</P +><P +>You should do ALL the tests, in the order shown. I have tried to +carefully choose them so later tests only use capabilities verified in +the earlier tests.</P +><P +>If you send me an email saying "it doesn't work" and you have not +followed this test procedure then you should not be surprised if I +ignore your email.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN8" +>Assumptions</A +></H1 +><P +>In all of the tests I assume you have a Samba server called BIGSERVER +and a PC called ACLIENT both in workgroup TESTGROUP. I also assume the +PC is running windows for workgroups with a recent copy of the +microsoft tcp/ip stack. Alternatively, your PC may be running Windows +95 or Windows NT (Workstation or Server).</P +><P +>The procedure is similar for other types of clients.</P +><P +>I also assume you know the name of an available share in your +smb.conf. I will assume this share is called "tmp". You can add a +"tmp" share like by adding the following to smb.conf:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> [tmp] + comment = temporary files + path = /tmp + read only = yes </PRE +></P +><P +>THESE TESTS ASSUME VERSION 2.0.6 OR LATER OF THE SAMBA SUITE. SOME +COMMANDS SHOWN DID NOT EXIST IN EARLIER VERSIONS</P +><P +>Please pay attention to the error messages you receive. If any error message +reports that your server is being unfriendly you should first check that you +IP name resolution is correctly set up. eg: Make sure your /etc/resolv.conf +file points to name servers that really do exist.</P +><P +>Also, if you do not have DNS server access for name resolution please check +that the settings for your smb.conf file results in "dns proxy = no". The +best way to check this is with "testparm smb.conf"</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN18" +>Tests</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN20" +>Test 1</A +></H2 +><P +>In the directory in which you store your smb.conf file, run the command +"testparm smb.conf". If it reports any errors then your smb.conf +configuration file is faulty.</P +><P +>Note: Your smb.conf file may be located in: <TT +CLASS="FILENAME" +>/etc</TT +> + Or in: <TT +CLASS="FILENAME" +>/usr/local/samba/lib</TT +></P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN26" +>Test 2</A +></H2 +><P +>Run the command "ping BIGSERVER" from the PC and "ping ACLIENT" from +the unix box. If you don't get a valid response then your TCP/IP +software is not correctly installed. </P +><P +>Note that you will need to start a "dos prompt" window on the PC to +run ping.</P +><P +>If you get a message saying "host not found" or similar then your DNS +software or /etc/hosts file is not correctly setup. It is possible to +run samba without DNS entries for the server and client, but I assume +you do have correct entries for the remainder of these tests. </P +><P +>Another reason why ping might fail is if your host is running firewall +software. You will need to relax the rules to let in the workstation +in question, perhaps by allowing access from another subnet (on Linux +this is done via the ipfwadm program.)</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN32" +>Test 3</A +></H2 +><P +>Run the command "smbclient -L BIGSERVER" on the unix box. You +should get a list of available shares back. </P +><P +>If you get a error message containing the string "Bad password" then +you probably have either an incorrect "hosts allow", "hosts deny" or +"valid users" line in your smb.conf, or your guest account is not +valid. Check what your guest account is using "testparm" and +temporarily remove any "hosts allow", "hosts deny", "valid users" or +"invalid users" lines.</P +><P +>If you get a "connection refused" response then the smbd server may +not be running. If you installed it in inetd.conf then you probably edited +that file incorrectly. If you installed it as a daemon then check that +it is running, and check that the netbios-ssn port is in a LISTEN +state using "netstat -a".</P +><P +>If you get a "session request failed" then the server refused the +connection. If it says "Your server software is being unfriendly" then +its probably because you have invalid command line parameters to smbd, +or a similar fatal problem with the initial startup of smbd. Also +check your config file (smb.conf) for syntax errors with "testparm" +and that the various directories where samba keeps its log and lock +files exist.</P +><P +>There are a number of reasons for which smbd may refuse or decline +a session request. The most common of these involve one or more of +the following smb.conf file entries:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> hosts deny = ALL + hosts allow = xxx.xxx.xxx.xxx/yy + bind interfaces only = Yes</PRE +></P +><P +>In the above, no allowance has been made for any session requests that +will automatically translate to the loopback adaptor address 127.0.0.1. +To solve this problem change these lines to:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> hosts deny = ALL + hosts allow = xxx.xxx.xxx.xxx/yy 127.</PRE +></P +><P +>Do NOT use the "bind interfaces only" parameter where you may wish to +use the samba password change facility, or where smbclient may need to +access local service for name resolution or for local resource +connections. (Note: the "bind interfaces only" parameter deficiency +where it will not allow connections to the loopback address will be +fixed soon).</P +><P +>Another common cause of these two errors is having something already running +on port 139, such as Samba (ie: smbd is running from inetd already) or +something like Digital's Pathworks. Check your inetd.conf file before trying +to start smbd as a daemon, it can avoid a lot of frustration!</P +><P +>And yet another possible cause for failure of TEST 3 is when the subnet mask +and / or broadcast address settings are incorrect. Please check that the +network interface IP Address / Broadcast Address / Subnet Mask settings are +correct and that Samba has correctly noted these in the log.nmb file.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN47" +>Test 4</A +></H2 +><P +>Run the command "nmblookup -B BIGSERVER __SAMBA__". You should get the +IP address of your Samba server back.</P +><P +>If you don't then nmbd is incorrectly installed. Check your inetd.conf +if you run it from there, or that the daemon is running and listening +to udp port 137.</P +><P +>One common problem is that many inetd implementations can't take many +parameters on the command line. If this is the case then create a +one-line script that contains the right parameters and run that from +inetd.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN52" +>Test 5</A +></H2 +><P +>run the command <B +CLASS="COMMAND" +>nmblookup -B ACLIENT '*'</B +></P +><P +>You should get the PCs IP address back. If you don't then the client +software on the PC isn't installed correctly, or isn't started, or you +got the name of the PC wrong. </P +><P +>If ACLIENT doesn't resolve via DNS then use the IP address of the +client in the above test.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN58" +>Test 6</A +></H2 +><P +>Run the command <B +CLASS="COMMAND" +>nmblookup -d 2 '*'</B +></P +><P +>This time we are trying the same as the previous test but are trying +it via a broadcast to the default broadcast address. A number of +Netbios/TCPIP hosts on the network should respond, although Samba may +not catch all of the responses in the short time it listens. You +should see "got a positive name query response" messages from several +hosts.</P +><P +>If this doesn't give a similar result to the previous test then +nmblookup isn't correctly getting your broadcast address through its +automatic mechanism. In this case you should experiment use the +"interfaces" option in smb.conf to manually configure your IP +address, broadcast and netmask. </P +><P +>If your PC and server aren't on the same subnet then you will need to +use the -B option to set the broadcast address to the that of the PCs +subnet.</P +><P +>This test will probably fail if your subnet mask and broadcast address are +not correct. (Refer to TEST 3 notes above).</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN66" +>Test 7</A +></H2 +><P +>Run the command <B +CLASS="COMMAND" +>smbclient //BIGSERVER/TMP</B +>. You should +then be prompted for a password. You should use the password of the account +you are logged into the unix box with. If you want to test with +another account then add the -U >accountname< option to the end of +the command line. eg: +<B +CLASS="COMMAND" +>smbclient //bigserver/tmp -Ujohndoe</B +></P +><P +>Note: It is possible to specify the password along with the username +as follows: +<B +CLASS="COMMAND" +>smbclient //bigserver/tmp -Ujohndoe%secret</B +></P +><P +>Once you enter the password you should get the "smb>" prompt. If you +don't then look at the error message. If it says "invalid network +name" then the service "tmp" is not correctly setup in your smb.conf.</P +><P +>If it says "bad password" then the likely causes are:</P +><P +></P +><OL +TYPE="1" +><LI +><P +> you have shadow passords (or some other password system) but didn't + compile in support for them in smbd + </P +></LI +><LI +><P +> your "valid users" configuration is incorrect + </P +></LI +><LI +><P +> you have a mixed case password and you haven't enabled the "password + level" option at a high enough level + </P +></LI +><LI +><P +> the "path =" line in smb.conf is incorrect. Check it with testparm + </P +></LI +><LI +><P +> you enabled password encryption but didn't create the SMB encrypted + password file + </P +></LI +></OL +><P +>Once connected you should be able to use the commands +<B +CLASS="COMMAND" +>dir</B +> <B +CLASS="COMMAND" +>get</B +> <B +CLASS="COMMAND" +>put</B +> etc. +Type <B +CLASS="COMMAND" +>help >command<</B +> for instructions. You should +especially check that the amount of free disk space shown is correct +when you type <B +CLASS="COMMAND" +>dir</B +>.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN92" +>Test 8</A +></H2 +><P +>On the PC type the command <B +CLASS="COMMAND" +>net view \\BIGSERVER</B +>. You will +need to do this from within a "dos prompt" window. You should get back a +list of available shares on the server.</P +><P +>If you get a "network name not found" or similar error then netbios +name resolution is not working. This is usually caused by a problem in +nmbd. To overcome it you could do one of the following (you only need +to choose one of them):</P +><P +></P +><OL +TYPE="1" +><LI +><P +> fixup the nmbd installation</P +></LI +><LI +><P +> add the IP address of BIGSERVER to the "wins server" box in the + advanced tcp/ip setup on the PC.</P +></LI +><LI +><P +> enable windows name resolution via DNS in the advanced section of + the tcp/ip setup</P +></LI +><LI +><P +> add BIGSERVER to your lmhosts file on the PC.</P +></LI +></OL +><P +>If you get a "invalid network name" or "bad password error" then the +same fixes apply as they did for the "smbclient -L" test above. In +particular, make sure your "hosts allow" line is correct (see the man +pages)</P +><P +>Also, do not overlook that fact that when the workstation requests the +connection to the samba server it will attempt to connect using the +name with which you logged onto your Windows machine. You need to make +sure that an account exists on your Samba server with that exact same +name and password.</P +><P +>If you get "specified computer is not receiving requests" or similar +it probably means that the host is not contactable via tcp services. +Check to see if the host is running tcp wrappers, and if so add an entry in +the hosts.allow file for your client (or subnet, etc.)</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN109" +>Test 9</A +></H2 +><P +>Run the command <B +CLASS="COMMAND" +>net use x: \\BIGSERVER\TMP</B +>. You should +be prompted for a password then you should get a "command completed +successfully" message. If not then your PC software is incorrectly +installed or your smb.conf is incorrect. make sure your "hosts allow" +and other config lines in smb.conf are correct.</P +><P +>It's also possible that the server can't work out what user name to +connect you as. To see if this is the problem add the line "user = +USERNAME" to the [tmp] section of smb.conf where "USERNAME" is the +username corresponding to the password you typed. If you find this +fixes things you may need the username mapping option.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN114" +>Test 10</A +></H2 +><P +>Run the command <B +CLASS="COMMAND" +>nmblookup -M TESTGROUP</B +> where +TESTGROUP is the name of the workgroup that your Samba server and +Windows PCs belong to. You should get back the IP address of the +master browser for that workgroup.</P +><P +>If you don't then the election process has failed. Wait a minute to +see if it is just being slow then try again. If it still fails after +that then look at the browsing options you have set in smb.conf. Make +sure you have <B +CLASS="COMMAND" +>preferred master = yes</B +> to ensure that +an election is held at startup.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN120" +>Test 11</A +></H2 +><P +>From file manager try to browse the server. Your samba server should +appear in the browse list of your local workgroup (or the one you +specified in smb.conf). You should be able to double click on the name +of the server and get a list of shares. If you get a "invalid +password" error when you do then you are probably running WinNT and it +is refusing to browse a server that has no encrypted password +capability and is in user level security mode. In this case either set +<B +CLASS="COMMAND" +>security = server</B +> AND +<B +CLASS="COMMAND" +>password server = Windows_NT_Machine</B +> in your +smb.conf file, or enable encrypted passwords AFTER compiling in support +for encrypted passwords (refer to the Makefile).</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN125" +>Still having troubles?</A +></H1 +><P +>Try the mailing list or newsgroup, or use the ethereal utility to +sniff the problem. The official samba mailing list can be reached at +<A +HREF="mailto:samba@samba.org" +TARGET="_top" +>samba@samba.org</A +>. To find +out more about samba and how to subscribe to the mailing list check +out the samba web page at +<A +HREF="http://samba.org/samba" +TARGET="_top" +>http://samba.org/samba</A +></P +><P +>Also look at the other docs in the Samba package!</P +></DIV +></DIV +></BODY +></HTML +>
\ No newline at end of file diff --git a/docs/htmldocs/Integrating-with-Windows.html b/docs/htmldocs/Integrating-with-Windows.html index 7c5fe31627..fd2bd7fdaf 100644 --- a/docs/htmldocs/Integrating-with-Windows.html +++ b/docs/htmldocs/Integrating-with-Windows.html @@ -191,7 +191,7 @@ CLASS="FILENAME" > is one such file.</P ><P >When the IP address of the destination interface has been -determined a protocol called ARP/RARP isused to identify +determined a protocol called ARP/RARP is used to identify the MAC address of the target interface. ARP stands for Address Resolution Protocol, and is a broadcast oriented method that uses UDP (User Datagram Protocol) to send a request to all @@ -414,7 +414,7 @@ architecture of the MS Windows network. The term "workgroup" indicates that the primary nature of the network environment is that of a peer-to-peer design. In a WORKGROUP all machines are responsible for their own security, and generally such security is limited to use of -just a password (known as SHARE MORE security). In most situations +just a password (known as SHARE MODE security). In most situations with peer-to-peer networking the users who control their own machines will simply opt to have no security at all. It is possible to have USER MODE security in a WORKGROUP environment, thus requiring use @@ -444,8 +444,8 @@ NAME="AEN100" ></H2 ><P >All MS Windows machines employ an in memory buffer in which is -stored the NetBIOS names and their IP addresses for all external -machines that that the local machine has communicated with over the +stored the NetBIOS names and IP addresses for all external +machines that that machine has communicated with over the past 10-15 minutes. It is more efficient to obtain an IP address for a machine from the local cache than it is to go through all the configured name resolution mechanisms.</P @@ -453,7 +453,7 @@ configured name resolution mechanisms.</P >If a machine whose name is in the local name cache has been shut down before the name had been expired and flushed from the cache, then an attempt to exchange a message with that machine will be subject -to time-out delays. ie: It's name is in the cache, so a name resolution +to time-out delays. i.e.: Its name is in the cache, so a name resolution lookup will succeed, but the machine can not respond. This can be frustrating for users - but it is a characteristic of the protocol.</P ><P @@ -660,7 +660,7 @@ dependable browsing using Samba</A ></H1 ><P >As stated above, MS Windows machines register their NetBIOS names -(ie: the machine name for each service type in operation) on start +(i.e.: the machine name for each service type in operation) on start up. Also, as stated above, the exact method by which this name registration takes place is determined by whether or not the MS Windows client/server has been given a WINS server address, whether or not LMHOSTS lookup @@ -685,7 +685,7 @@ Instead, the domain master browser serves the role of contacting each local master browser (found by asking WINS or from LMHOSTS) and exchanging browse list contents. This way every master browser will eventually obtain a complete list of all machines that are on the network. Every 11-15 minutes an election -is held to determine which machine will be the master browser. By nature of +is held to determine which machine will be the master browser. By the nature of the election criteria used, the machine with the highest uptime, or the most senior protocol version, or other criteria, will win the election as domain master browser.</P @@ -770,8 +770,8 @@ these versions no longer support plain text passwords by default.</P ><P >MS Windows clients have a habit of dropping network mappings that have been idle for 10 minutes or longer. When the user attempts to -use the mapped drive connection that has been dropped the SMB protocol -has a mechanism by which the connection can be re-established using +use the mapped drive connection that has been dropped, the client +re-establishes the connection using a cached copy of the password.</P ><P >When Microsoft changed the default password mode, they dropped support for @@ -959,7 +959,7 @@ NAME="AEN196" ></H2 ><P >This mode of authentication demands that there be on the -Unix/Linux system both a Unix style account as well as and +Unix/Linux system both a Unix style account as well as an smbpasswd entry for the user. The Unix system account can be locked if required as only the encrypted password will be used for SMB client authentication.</P diff --git a/docs/htmldocs/Printing.html b/docs/htmldocs/Printing.html new file mode 100644 index 0000000000..6c8b196240 --- /dev/null +++ b/docs/htmldocs/Printing.html @@ -0,0 +1,408 @@ +<HTML +><HEAD +><TITLE +>Debugging Printing Problems</TITLE +><META +NAME="GENERATOR" +CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD +><BODY +CLASS="ARTICLE" +BGCOLOR="#FFFFFF" +TEXT="#000000" +LINK="#0000FF" +VLINK="#840084" +ALINK="#0000FF" +><DIV +CLASS="ARTICLE" +><DIV +CLASS="TITLEPAGE" +><H1 +CLASS="TITLE" +><A +NAME="PRINTING_DEBUG" +>Debugging Printing Problems</A +></H1 +><HR></DIV +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN3" +>Introduction</A +></H1 +><P +>This is a short description of how to debug printing problems with +Samba. This describes how to debug problems with printing from a SMB +client to a Samba server, not the other way around. For the reverse +see the examples/printing directory.</P +><P +>Ok, so you want to print to a Samba server from your PC. The first +thing you need to understand is that Samba does not actually do any +printing itself, it just acts as a middleman between your PC client +and your Unix printing subsystem. Samba receives the file from the PC +then passes the file to a external "print command". What print command +you use is up to you.</P +><P +>The whole things is controlled using options in smb.conf. The most +relevant options (which you should look up in the smb.conf man page) +are:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> [global] + print command - send a file to a spooler + lpq command - get spool queue status + lprm command - remove a job + [printers] + path = /var/spool/lpd/samba</PRE +></P +><P +>The following are nice to know about:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> queuepause command - stop a printer or print queue + queueresume command - start a printer or print queue</PRE +></P +><P +>Example:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> print command = /usr/bin/lpr -r -P%p %s + lpq command = /usr/bin/lpq -P%p %s + lprm command = /usr/bin/lprm -P%p %j + queuepause command = /usr/sbin/lpc -P%p stop + queuepause command = /usr/sbin/lpc -P%p start</PRE +></P +><P +>Samba should set reasonable defaults for these depending on your +system type, but it isn't clairvoyant. It is not uncommon that you +have to tweak these for local conditions. The commands should +always have fully specified pathnames, as the smdb may not have +the correct PATH values.</P +><P +>When you send a job to Samba to be printed, it will make a temporary +copy of it in the directory specified in the [printers] section. +and it should be periodically cleaned out. The lpr -r option +requests that the temporary copy be removed after printing; If +printing fails then you might find leftover files in this directory, +and it should be periodically cleaned out. Samba used the lpq +command to determine the "job number" assigned to your print job +by the spooler.</P +><P +>The %>letter< are "macros" that get dynamically replaced with appropriate +values when they are used. The %s gets replaced with the name of the spool +file that Samba creates and the %p gets replaced with the name of the +printer. The %j gets replaced with the "job number" which comes from +the lpq output.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN19" +>Debugging printer problems</A +></H1 +><P +>One way to debug printing problems is to start by replacing these +command with shell scripts that record the arguments and the contents +of the print file. A simple example of this kind of things might +be:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> print command = /tmp/saveprint %p %s + + #!/bin/saveprint + # we make sure that we are the right user + /usr/bin/id -p >/tmp/tmp.print + # we run the command and save the error messages + # replace the command with the one appropriate for your system + /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print</PRE +></P +><P +>Then you print a file and try removing it. You may find that the +print queue needs to be stopped in order to see the queue status +and remove the job:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> h4: {42} % echo hi >/tmp/hi +h4: {43} % smbclient //localhost/lw4 +added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0 +Password: +Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7] +smb: \> print /tmp/hi +putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s) +smb: \> queue +1049 3 hi-17534 +smb: \> cancel 1049 +Error cancelling job 1049 : code 0 +smb: \> cancel 1049 +Job 1049 cancelled +smb: \> queue +smb: \> exit</PRE +></P +><P +>The 'code 0' indicates that the job was removed. The comment +by the smbclient is a bit misleading on this. +You can observe the command output and then and look at the +/tmp/tmp.print file to see what the results are. You can quickly +find out if the problem is with your printing system. Often people +have problems with their /etc/printcap file or permissions on +various print queues.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN28" +>What printers do I have?</A +></H1 +><P +>You can use the 'testprns' program to check to see if the printer +name you are using is recognized by Samba. For example, you can +use:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> testprns printer /etc/printcap</PRE +></P +><P +>Samba can get its printcap information from a file or from a program. +You can try the following to see the format of the extracted +information:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> testprns -a printer /etc/printcap + + testprns -a printer '|/bin/cat printcap'</PRE +></P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN36" +>Setting up printcap and print servers</A +></H1 +><P +>You may need to set up some printcaps for your Samba system to use. +It is strongly recommended that you use the facilities provided by +the print spooler to set up queues and printcap information.</P +><P +>Samba requires either a printcap or program to deliver printcap +information. This printcap information has the format:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> name|alias1|alias2...:option=value:...</PRE +></P +><P +>For almost all printing systems, the printer 'name' must be composed +only of alphanumeric or underscore '_' characters. Some systems also +allow hyphens ('-') as well. An alias is an alternative name for the +printer, and an alias with a space in it is used as a 'comment' +about the printer. The printcap format optionally uses a \ at the end of lines +to extend the printcap to multiple lines.</P +><P +>Here are some examples of printcap files:</P +><P +><P +></P +><OL +TYPE="1" +><LI +><P +>pr just printer name</P +></LI +><LI +><P +>pr|alias printer name and alias</P +></LI +><LI +><P +>pr|My Printer printer name, alias used as comment</P +></LI +><LI +><P +>pr:sh:\ Same as pr:sh:cm= testing + :cm= \ + testing</P +></LI +><LI +><P +>pr:sh Same as pr:sh:cm= testing + :cm= testing</P +></LI +></OL +></P +><P +>Samba reads the printcap information when first started. If you make +changes in the printcap information, then you must do the following:</P +><P +></P +><OL +TYPE="1" +><LI +><P +>make sure that the print spooler is aware of these changes. +The LPRng system uses the 'lpc reread' command to do this.</P +></LI +><LI +><P +>make sure that the spool queues, etc., exist and have the +correct permissions. The LPRng system uses the 'checkpc -f' +command to do this.</P +></LI +><LI +><P +>You now should send a SIGHUP signal to the smbd server to have +it reread the printcap information.</P +></LI +></OL +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN64" +>Job sent, no output</A +></H1 +><P +>This is the most frustrating part of printing. You may have sent the +job, verified that the job was forwarded, set up a wrapper around +the command to send the file, but there was no output from the printer.</P +><P +>First, check to make sure that the job REALLY is getting to the +right print queue. If you are using a BSD or LPRng print spooler, +you can temporarily stop the printing of jobs. Jobs can still be +submitted, but they will not be printed. Use:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> lpc -Pprinter stop</PRE +></P +><P +>Now submit a print job and then use 'lpq -Pprinter' to see if the +job is in the print queue. If it is not in the print queue then +you will have to find out why it is not being accepted for printing.</P +><P +>Next, you may want to check to see what the format of the job really +was. With the assistance of the system administrator you can view +the submitted jobs files. You may be surprised to find that these +are not in what you would expect to call a printable format. +You can use the UNIX 'file' utitily to determine what the job +format actually is:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> cd /var/spool/lpd/printer # spool directory of print jobs + ls # find job files + file dfA001myhost</PRE +></P +><P +>You should make sure that your printer supports this format OR that +your system administrator has installed a 'print filter' that will +convert the file to a format appropriate for your printer.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN75" +>Job sent, strange output</A +></H1 +><P +>Once you have the job printing, you can then start worrying about +making it print nicely.</P +><P +>The most common problem is extra pages of output: banner pages +OR blank pages at the end.</P +><P +>If you are getting banner pages, check and make sure that the +printcap option or printer option is configured for no banners. +If you have a printcap, this is the :sh (suppress header or banner +page) option. You should have the following in your printer.</P +><P +><PRE +CLASS="PROGRAMLISTING" +> printer: ... :sh</PRE +></P +><P +>If you have this option and are still getting banner pages, there +is a strong chance that your printer is generating them for you +automatically. You should make sure that banner printing is disabled +for the printer. This usually requires using the printer setup software +or procedures supplied by the printer manufacturer.</P +><P +>If you get an extra page of output, this could be due to problems +with your job format, or if you are generating PostScript jobs, +incorrect setting on your printer driver on the MicroSoft client. +For example, under Win95 there is a option:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|</PRE +></P +><P +>that allows you to choose if a Ctrl-D is appended to all jobs. +This is a very bad thing to do, as most spooling systems will +automatically add a ^D to the end of the job if it is detected as +PostScript. The multiple ^D may cause an additional page of output.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN87" +>Raw PostScript printed</A +></H1 +><P +>This is a problem that is usually caused by either the print spooling +system putting information at the start of the print job that makes +the printer think the job is a text file, or your printer simply +does not support PostScript. You may need to enable 'Automatic +Format Detection' on your printer.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN90" +>Advanced Printing</A +></H1 +><P +>Note that you can do some pretty magic things by using your +imagination with the "print command" option and some shell scripts. +Doing print accounting is easy by passing the %U option to a print +command shell script. You could even make the print command detect +the type of output and its size and send it to an appropriate +printer.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN93" +>Real debugging</A +></H1 +><P +>If the above debug tips don't help, then maybe you need to bring in +the bug guns, system tracing. See Tracing.txt in this directory.</P +></DIV +></DIV +></BODY +></HTML +>
\ No newline at end of file diff --git a/docs/htmldocs/Samba-HOWTO-Collection.html b/docs/htmldocs/Samba-HOWTO-Collection.html index 5175bd4c8d..ffb6939e17 100644 --- a/docs/htmldocs/Samba-HOWTO-Collection.html +++ b/docs/htmldocs/Samba-HOWTO-Collection.html @@ -40,7 +40,7 @@ NAME="AEN8" ><P ><EM >Last Update</EM -> : Mon Apr 1 08:47:26 CST 2002</P +> : Thu Aug 15 12:48:45 CDT 2002</P ><P >This book is a collection of HOWTOs added to Samba documentation over the years. I try to ensure that all are current, but sometimes the is a larger job @@ -178,64 +178,147 @@ HREF="#AEN199" ></DT ><DT >1.10.6. <A -HREF="#AEN209" +HREF="#AEN208" >Mapping Usernames</A ></DT +></DL +></DD +></DL +></DD +><DT +>2. <A +HREF="#DIAGNOSIS" +>Diagnosing your samba server</A +></DT +><DD +><DL +><DT +>2.1. <A +HREF="#AEN222" +>Introduction</A +></DT +><DT +>2.2. <A +HREF="#AEN227" +>Assumptions</A +></DT +><DT +>2.3. <A +HREF="#AEN237" +>Tests</A +></DT +><DD +><DL +><DT +>2.3.1. <A +HREF="#AEN239" +>Test 1</A +></DT +><DT +>2.3.2. <A +HREF="#AEN245" +>Test 2</A +></DT +><DT +>2.3.3. <A +HREF="#AEN251" +>Test 3</A +></DT +><DT +>2.3.4. <A +HREF="#AEN266" +>Test 4</A +></DT +><DT +>2.3.5. <A +HREF="#AEN271" +>Test 5</A +></DT +><DT +>2.3.6. <A +HREF="#AEN277" +>Test 6</A +></DT +><DT +>2.3.7. <A +HREF="#AEN285" +>Test 7</A +></DT +><DT +>2.3.8. <A +HREF="#AEN311" +>Test 8</A +></DT +><DT +>2.3.9. <A +HREF="#AEN328" +>Test 9</A +></DT +><DT +>2.3.10. <A +HREF="#AEN333" +>Test 10</A +></DT ><DT ->1.10.7. <A -HREF="#AEN212" ->Other Character Sets</A +>2.3.11. <A +HREF="#AEN339" +>Test 11</A ></DT ></DL ></DD +><DT +>2.4. <A +HREF="#AEN344" +>Still having troubles?</A +></DT ></DL ></DD ><DT ->2. <A +>3. <A HREF="#INTEGRATE-MS-NETWORKS" >Integrating MS Windows networks with Samba</A ></DT ><DD ><DL ><DT ->2.1. <A -HREF="#AEN226" +>3.1. <A +HREF="#AEN361" >Agenda</A ></DT ><DT ->2.2. <A -HREF="#AEN248" +>3.2. <A +HREF="#AEN383" >Name Resolution in a pure Unix/Linux world</A ></DT ><DD ><DL ><DT ->2.2.1. <A -HREF="#AEN264" +>3.2.1. <A +HREF="#AEN399" ><TT CLASS="FILENAME" >/etc/hosts</TT ></A ></DT ><DT ->2.2.2. <A -HREF="#AEN280" +>3.2.2. <A +HREF="#AEN415" ><TT CLASS="FILENAME" >/etc/resolv.conf</TT ></A ></DT ><DT ->2.2.3. <A -HREF="#AEN291" +>3.2.3. <A +HREF="#AEN426" ><TT CLASS="FILENAME" >/etc/host.conf</TT ></A ></DT ><DT ->2.2.4. <A -HREF="#AEN299" +>3.2.4. <A +HREF="#AEN434" ><TT CLASS="FILENAME" >/etc/nsswitch.conf</TT @@ -244,78 +327,78 @@ CLASS="FILENAME" ></DL ></DD ><DT ->2.3. <A -HREF="#AEN311" +>3.3. <A +HREF="#AEN446" >Name resolution as used within MS Windows networking</A ></DT ><DD ><DL ><DT ->2.3.1. <A -HREF="#AEN323" +>3.3.1. <A +HREF="#AEN458" >The NetBIOS Name Cache</A ></DT ><DT ->2.3.2. <A -HREF="#AEN328" +>3.3.2. <A +HREF="#AEN463" >The LMHOSTS file</A ></DT ><DT ->2.3.3. <A -HREF="#AEN336" +>3.3.3. <A +HREF="#AEN471" >HOSTS file</A ></DT ><DT ->2.3.4. <A -HREF="#AEN341" +>3.3.4. <A +HREF="#AEN476" >DNS Lookup</A ></DT ><DT ->2.3.5. <A -HREF="#AEN344" +>3.3.5. <A +HREF="#AEN479" >WINS Lookup</A ></DT ></DL ></DD ><DT ->2.4. <A -HREF="#AEN356" +>3.4. <A +HREF="#AEN491" >How browsing functions and how to deploy stable and dependable browsing using Samba</A ></DT ><DT ->2.5. <A -HREF="#AEN366" +>3.5. <A +HREF="#AEN501" >MS Windows security options and how to configure Samba for seemless integration</A ></DT ><DD ><DL ><DT ->2.5.1. <A -HREF="#AEN394" +>3.5.1. <A +HREF="#AEN529" >Use MS Windows NT as an authentication server</A ></DT ><DT ->2.5.2. <A -HREF="#AEN402" +>3.5.2. <A +HREF="#AEN537" >Make Samba a member of an MS Windows NT security domain</A ></DT ><DT ->2.5.3. <A -HREF="#AEN419" +>3.5.3. <A +HREF="#AEN554" >Configure Samba as an authentication server</A ></DT ><DD ><DL ><DT ->2.5.3.1. <A -HREF="#AEN426" +>3.5.3.1. <A +HREF="#AEN561" >Users</A ></DT ><DT ->2.5.3.2. <A -HREF="#AEN431" +>3.5.3.2. <A +HREF="#AEN566" >MS Windows NT Machine Accounts</A ></DT ></DL @@ -323,14 +406,14 @@ HREF="#AEN431" ></DL ></DD ><DT ->2.6. <A -HREF="#AEN436" +>3.6. <A +HREF="#AEN571" >Conclusions</A ></DT ></DL ></DD ><DT ->3. <A +>4. <A HREF="#PAM" >Configuring PAM for distributed but centrally managed authentication</A @@ -338,39 +421,39 @@ managed authentication</A ><DD ><DL ><DT ->3.1. <A -HREF="#AEN457" +>4.1. <A +HREF="#AEN592" >Samba and PAM</A ></DT ><DT ->3.2. <A -HREF="#AEN501" +>4.2. <A +HREF="#AEN636" >Distributed Authentication</A ></DT ><DT ->3.3. <A -HREF="#AEN508" +>4.3. <A +HREF="#AEN643" >PAM Configuration in smb.conf</A ></DT ></DL ></DD ><DT ->4. <A +>5. <A HREF="#MSDFS" >Hosting a Microsoft Distributed File System tree on Samba</A ></DT ><DD ><DL ><DT ->4.1. <A -HREF="#AEN528" +>5.1. <A +HREF="#AEN663" >Instructions</A ></DT ><DD ><DL ><DT ->4.1.1. <A -HREF="#AEN563" +>5.1.1. <A +HREF="#AEN698" >Notes</A ></DT ></DL @@ -378,144 +461,144 @@ HREF="#AEN563" ></DL ></DD ><DT ->5. <A +>6. <A HREF="#UNIX-PERMISSIONS" >UNIX Permission Bits and Windows NT Access Control Lists</A ></DT ><DD ><DL ><DT ->5.1. <A -HREF="#AEN583" +>6.1. <A +HREF="#AEN718" >Viewing and changing UNIX permissions using the NT security dialogs</A ></DT ><DT ->5.2. <A -HREF="#AEN592" +>6.2. <A +HREF="#AEN727" >How to view file security on a Samba share</A ></DT ><DT ->5.3. <A -HREF="#AEN603" +>6.3. <A +HREF="#AEN738" >Viewing file ownership</A ></DT ><DT ->5.4. <A -HREF="#AEN623" +>6.4. <A +HREF="#AEN758" >Viewing file or directory permissions</A ></DT ><DD ><DL ><DT ->5.4.1. <A -HREF="#AEN638" +>6.4.1. <A +HREF="#AEN773" >File Permissions</A ></DT ><DT ->5.4.2. <A -HREF="#AEN652" +>6.4.2. <A +HREF="#AEN787" >Directory Permissions</A ></DT ></DL ></DD ><DT ->5.5. <A -HREF="#AEN659" +>6.5. <A +HREF="#AEN794" >Modifying file or directory permissions</A ></DT ><DT ->5.6. <A -HREF="#AEN681" +>6.6. <A +HREF="#AEN816" >Interaction with the standard Samba create mask parameters</A ></DT ><DT ->5.7. <A -HREF="#AEN745" +>6.7. <A +HREF="#AEN880" >Interaction with the standard Samba file attribute mapping</A ></DT ></DL ></DD ><DT ->6. <A +>7. <A HREF="#PRINTING" >Printing Support in Samba 2.2.x</A ></DT ><DD ><DL ><DT ->6.1. <A -HREF="#AEN766" +>7.1. <A +HREF="#AEN901" >Introduction</A ></DT ><DT ->6.2. <A -HREF="#AEN788" +>7.2. <A +HREF="#AEN923" >Configuration</A ></DT ><DD ><DL ><DT ->6.2.1. <A -HREF="#AEN799" +>7.2.1. <A +HREF="#AEN934" >Creating [print$]</A ></DT ><DT ->6.2.2. <A -HREF="#AEN834" +>7.2.2. <A +HREF="#AEN969" >Setting Drivers for Existing Printers</A ></DT ><DT ->6.2.3. <A -HREF="#AEN851" +>7.2.3. <A +HREF="#AEN986" >Support a large number of printers</A ></DT ><DT ->6.2.4. <A -HREF="#AEN862" +>7.2.4. <A +HREF="#AEN997" >Adding New Printers via the Windows NT APW</A ></DT ><DT ->6.2.5. <A -HREF="#AEN887" +>7.2.5. <A +HREF="#AEN1022" >Samba and Printer Ports</A ></DT ></DL ></DD ><DT ->6.3. <A -HREF="#AEN895" +>7.3. <A +HREF="#AEN1030" >The Imprints Toolset</A ></DT ><DD ><DL ><DT ->6.3.1. <A -HREF="#AEN899" +>7.3.1. <A +HREF="#AEN1034" >What is Imprints?</A ></DT ><DT ->6.3.2. <A -HREF="#AEN909" +>7.3.2. <A +HREF="#AEN1044" >Creating Printer Driver Packages</A ></DT ><DT ->6.3.3. <A -HREF="#AEN912" +>7.3.3. <A +HREF="#AEN1047" >The Imprints server</A ></DT ><DT ->6.3.4. <A -HREF="#AEN916" +>7.3.4. <A +HREF="#AEN1051" >The Installation Client</A ></DT ></DL ></DD ><DT ->6.4. <A -HREF="#AEN938" +>7.4. <A +HREF="#AEN1073" ><A NAME="MIGRATION" ></A @@ -524,143 +607,360 @@ NAME="MIGRATION" ></DL ></DD ><DT ->7. <A +>8. <A +HREF="#PRINTING_DEBUG" +>Debugging Printing Problems</A +></DT +><DD +><DL +><DT +>8.1. <A +HREF="#AEN1119" +>Introduction</A +></DT +><DT +>8.2. <A +HREF="#AEN1135" +>Debugging printer problems</A +></DT +><DT +>8.3. <A +HREF="#AEN1144" +>What printers do I have?</A +></DT +><DT +>8.4. <A +HREF="#AEN1152" +>Setting up printcap and print servers</A +></DT +><DT +>8.5. <A +HREF="#AEN1180" +>Job sent, no output</A +></DT +><DT +>8.6. <A +HREF="#AEN1191" +>Job sent, strange output</A +></DT +><DT +>8.7. <A +HREF="#AEN1203" +>Raw PostScript printed</A +></DT +><DT +>8.8. <A +HREF="#AEN1206" +>Advanced Printing</A +></DT +><DT +>8.9. <A +HREF="#AEN1209" +>Real debugging</A +></DT +></DL +></DD +><DT +>9. <A +HREF="#SECURITY_LEVELS" +>Security levels</A +></DT +><DD +><DL +><DT +>9.1. <A +HREF="#AEN1222" +>Introduction</A +></DT +><DT +>9.2. <A +HREF="#AEN1233" +>More complete description of security levels</A +></DT +></DL +></DD +><DT +>10. <A HREF="#DOMAIN-SECURITY" >security = domain in Samba 2.x</A ></DT ><DD ><DL ><DT ->7.1. <A -HREF="#AEN992" +>10.1. <A +HREF="#AEN1266" >Joining an NT Domain with Samba 2.2</A ></DT ><DT ->7.2. <A -HREF="#AEN1056" +>10.2. <A +HREF="#AEN1330" >Samba and Windows 2000 Domains</A ></DT ><DT ->7.3. <A -HREF="#AEN1061" +>10.3. <A +HREF="#AEN1335" >Why is this better than security = server?</A ></DT ></DL ></DD ><DT ->8. <A +>11. <A +HREF="#WINBIND" +>Unified Logons between Windows NT and UNIX using Winbind</A +></DT +><DD +><DL +><DT +>11.1. <A +HREF="#AEN1388" +>Abstract</A +></DT +><DT +>11.2. <A +HREF="#AEN1392" +>Introduction</A +></DT +><DT +>11.3. <A +HREF="#AEN1405" +>What Winbind Provides</A +></DT +><DD +><DL +><DT +>11.3.1. <A +HREF="#AEN1412" +>Target Uses</A +></DT +></DL +></DD +><DT +>11.4. <A +HREF="#AEN1416" +>How Winbind Works</A +></DT +><DD +><DL +><DT +>11.4.1. <A +HREF="#AEN1421" +>Microsoft Remote Procedure Calls</A +></DT +><DT +>11.4.2. <A +HREF="#AEN1425" +>Name Service Switch</A +></DT +><DT +>11.4.3. <A +HREF="#AEN1441" +>Pluggable Authentication Modules</A +></DT +><DT +>11.4.4. <A +HREF="#AEN1449" +>User and Group ID Allocation</A +></DT +><DT +>11.4.5. <A +HREF="#AEN1453" +>Result Caching</A +></DT +></DL +></DD +><DT +>11.5. <A +HREF="#AEN1456" +>Installation and Configuration</A +></DT +><DD +><DL +><DT +>11.5.1. <A +HREF="#AEN1463" +>Introduction</A +></DT +><DT +>11.5.2. <A +HREF="#AEN1476" +>Requirements</A +></DT +><DT +>11.5.3. <A +HREF="#AEN1490" +>Testing Things Out</A +></DT +><DD +><DL +><DT +>11.5.3.1. <A +HREF="#AEN1501" +>Configure and compile SAMBA</A +></DT +><DT +>11.5.3.2. <A +HREF="#AEN1520" +>Configure <TT +CLASS="FILENAME" +>nsswitch.conf</TT +> and the +winbind libraries</A +></DT +><DT +>11.5.3.3. <A +HREF="#AEN1553" +>Configure smb.conf</A +></DT +><DT +>11.5.3.4. <A +HREF="#AEN1569" +>Join the SAMBA server to the PDC domain</A +></DT +><DT +>11.5.3.5. <A +HREF="#AEN1580" +>Start up the winbindd daemon and test it!</A +></DT +><DT +>11.5.3.6. <A +HREF="#AEN1616" +>Fix the init.d startup scripts</A +></DT +><DT +>11.5.3.7. <A +HREF="#AEN1648" +>Configure Winbind and PAM</A +></DT +></DL +></DD +></DL +></DD +><DT +>11.6. <A +HREF="#AEN1705" +>Limitations</A +></DT +><DT +>11.7. <A +HREF="#AEN1715" +>Conclusion</A +></DT +></DL +></DD +><DT +>12. <A HREF="#SAMBA-PDC" >How to Configure Samba 2.2 as a Primary Domain Controller</A ></DT ><DD ><DL ><DT ->8.1. <A -HREF="#AEN1094" +>12.1. <A +HREF="#AEN1735" >Prerequisite Reading</A ></DT ><DT ->8.2. <A -HREF="#AEN1100" +>12.2. <A +HREF="#AEN1741" >Background</A ></DT ><DT ->8.3. <A -HREF="#AEN1139" +>12.3. <A +HREF="#AEN1780" >Configuring the Samba Domain Controller</A ></DT ><DT ->8.4. <A -HREF="#AEN1182" +>12.4. <A +HREF="#AEN1823" >Creating Machine Trust Accounts and Joining Clients to the Domain</A ></DT ><DD ><DL ><DT ->8.4.1. <A -HREF="#AEN1201" +>12.4.1. <A +HREF="#AEN1842" >Manual Creation of Machine Trust Accounts</A ></DT ><DT ->8.4.2. <A -HREF="#AEN1236" +>12.4.2. <A +HREF="#AEN1877" >"On-the-Fly" Creation of Machine Trust Accounts</A ></DT ><DT ->8.4.3. <A -HREF="#AEN1245" +>12.4.3. <A +HREF="#AEN1886" >Joining the Client to the Domain</A ></DT ></DL ></DD ><DT ->8.5. <A -HREF="#AEN1260" +>12.5. <A +HREF="#AEN1901" >Common Problems and Errors</A ></DT ><DT ->8.6. <A -HREF="#AEN1308" +>12.6. <A +HREF="#AEN1949" >System Policies and Profiles</A ></DT ><DT ->8.7. <A -HREF="#AEN1352" +>12.7. <A +HREF="#AEN1993" >What other help can I get?</A ></DT ><DT ->8.8. <A -HREF="#AEN1466" +>12.8. <A +HREF="#AEN2107" >Domain Control for Windows 9x/ME</A ></DT ><DD ><DL ><DT ->8.8.1. <A -HREF="#AEN1492" +>12.8.1. <A +HREF="#AEN2133" >Configuration Instructions: Network Logons</A ></DT ><DT ->8.8.2. <A -HREF="#AEN1511" +>12.8.2. <A +HREF="#AEN2152" >Configuration Instructions: Setting up Roaming User Profiles</A ></DT ><DD ><DL ><DT ->8.8.2.1. <A -HREF="#AEN1519" +>12.8.2.1. <A +HREF="#AEN2160" >Windows NT Configuration</A ></DT ><DT ->8.8.2.2. <A -HREF="#AEN1527" +>12.8.2.2. <A +HREF="#AEN2168" >Windows 9X Configuration</A ></DT ><DT ->8.8.2.3. <A -HREF="#AEN1535" +>12.8.2.3. <A +HREF="#AEN2176" >Win9X and WinNT Configuration</A ></DT ><DT ->8.8.2.4. <A -HREF="#AEN1542" +>12.8.2.4. <A +HREF="#AEN2183" >Windows 9X Profile Setup</A ></DT ><DT ->8.8.2.5. <A -HREF="#AEN1578" +>12.8.2.5. <A +HREF="#AEN2219" >Windows NT Workstation 4.0</A ></DT ><DT ->8.8.2.6. <A -HREF="#AEN1591" +>12.8.2.6. <A +HREF="#AEN2232" >Windows NT Server</A ></DT ><DT ->8.8.2.7. <A -HREF="#AEN1594" +>12.8.2.7. <A +HREF="#AEN2235" >Sharing Profiles between W95 and NT Workstation 4.0</A ></DT ></DL @@ -668,63 +968,63 @@ HREF="#AEN1594" ></DL ></DD ><DT ->8.9. <A -HREF="#AEN1604" +>12.9. <A +HREF="#AEN2245" >DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba</A ></DT ></DL ></DD ><DT ->9. <A +>13. <A HREF="#SAMBA-BDC" >How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain</A ></DT ><DD ><DL ><DT ->9.1. <A -HREF="#AEN1640" +>13.1. <A +HREF="#AEN2281" >Prerequisite Reading</A ></DT ><DT ->9.2. <A -HREF="#AEN1644" +>13.2. <A +HREF="#AEN2285" >Background</A ></DT ><DT ->9.3. <A -HREF="#AEN1652" +>13.3. <A +HREF="#AEN2293" >What qualifies a Domain Controller on the network?</A ></DT ><DD ><DL ><DT ->9.3.1. <A -HREF="#AEN1655" +>13.3.1. <A +HREF="#AEN2296" >How does a Workstation find its domain controller?</A ></DT ><DT ->9.3.2. <A -HREF="#AEN1658" +>13.3.2. <A +HREF="#AEN2299" >When is the PDC needed?</A ></DT ></DL ></DD ><DT ->9.4. <A -HREF="#AEN1661" +>13.4. <A +HREF="#AEN2302" >Can Samba be a Backup Domain Controller?</A ></DT ><DT ->9.5. <A -HREF="#AEN1665" +>13.5. <A +HREF="#AEN2306" >How do I set up a Samba BDC?</A ></DT ><DD ><DL ><DT ->9.5.1. <A -HREF="#AEN1681" +>13.5.1. <A +HREF="#AEN2322" >How do I replicate the smbpasswd file?</A ></DT ></DL @@ -732,260 +1032,299 @@ HREF="#AEN1681" ></DL ></DD ><DT ->10. <A +>14. <A HREF="#SAMBA-LDAP-HOWTO" >Storing Samba's User/Machine Account information in an LDAP Directory</A ></DT ><DD ><DL ><DT ->10.1. <A -HREF="#AEN1702" +>14.1. <A +HREF="#AEN2343" >Purpose</A ></DT ><DT ->10.2. <A -HREF="#AEN1722" +>14.2. <A +HREF="#AEN2363" >Introduction</A ></DT ><DT ->10.3. <A -HREF="#AEN1751" +>14.3. <A +HREF="#AEN2392" >Supported LDAP Servers</A ></DT ><DT ->10.4. <A -HREF="#AEN1756" +>14.4. <A +HREF="#AEN2397" >Schema and Relationship to the RFC 2307 posixAccount</A ></DT ><DT ->10.5. <A -HREF="#AEN1768" +>14.5. <A +HREF="#AEN2409" >Configuring Samba with LDAP</A ></DT ><DD ><DL ><DT ->10.5.1. <A -HREF="#AEN1770" +>14.5.1. <A +HREF="#AEN2411" >OpenLDAP configuration</A ></DT ><DT ->10.5.2. <A -HREF="#AEN1787" +>14.5.2. <A +HREF="#AEN2428" >Configuring Samba</A ></DT ></DL ></DD ><DT ->10.6. <A -HREF="#AEN1815" +>14.6. <A +HREF="#AEN2456" >Accounts and Groups management</A ></DT ><DT ->10.7. <A -HREF="#AEN1820" +>14.7. <A +HREF="#AEN2461" >Security and sambaAccount</A ></DT ><DT ->10.8. <A -HREF="#AEN1840" +>14.8. <A +HREF="#AEN2481" >LDAP specials attributes for sambaAccounts</A ></DT ><DT ->10.9. <A -HREF="#AEN1910" +>14.9. <A +HREF="#AEN2551" >Example LDIF Entries for a sambaAccount</A ></DT ><DT ->10.10. <A -HREF="#AEN1918" +>14.10. <A +HREF="#AEN2559" >Comments</A ></DT ></DL ></DD ><DT ->11. <A -HREF="#WINBIND" ->Unified Logons between Windows NT and UNIX using Winbind</A +>15. <A +HREF="#IMPROVED-BROWSING" +>Improved browsing in samba</A ></DT ><DD ><DL ><DT ->11.1. <A -HREF="#AEN1947" ->Abstract</A +>15.1. <A +HREF="#AEN2570" +>Overview of browsing</A ></DT ><DT ->11.2. <A -HREF="#AEN1951" ->Introduction</A +>15.2. <A +HREF="#AEN2574" +>Browsing support in samba</A ></DT ><DT ->11.3. <A -HREF="#AEN1964" ->What Winbind Provides</A +>15.3. <A +HREF="#AEN2583" +>Problem resolution</A +></DT +><DT +>15.4. <A +HREF="#AEN2590" +>Browsing across subnets</A ></DT ><DD ><DL ><DT ->11.3.1. <A -HREF="#AEN1971" ->Target Uses</A +>15.4.1. <A +HREF="#AEN2595" +>How does cross subnet browsing work ?</A ></DT ></DL ></DD ><DT ->11.4. <A -HREF="#AEN1975" ->How Winbind Works</A +>15.5. <A +HREF="#AEN2630" +>Setting up a WINS server</A ></DT -><DD -><DL ><DT ->11.4.1. <A -HREF="#AEN1980" ->Microsoft Remote Procedure Calls</A +>15.6. <A +HREF="#AEN2649" +>Setting up Browsing in a WORKGROUP</A ></DT ><DT ->11.4.2. <A -HREF="#AEN1984" ->Name Service Switch</A +>15.7. <A +HREF="#AEN2667" +>Setting up Browsing in a DOMAIN</A ></DT ><DT ->11.4.3. <A -HREF="#AEN2000" ->Pluggable Authentication Modules</A +>15.8. <A +HREF="#AEN2677" +>Forcing samba to be the master</A ></DT ><DT ->11.4.4. <A -HREF="#AEN2008" ->User and Group ID Allocation</A +>15.9. <A +HREF="#AEN2686" +>Making samba the domain master</A ></DT ><DT ->11.4.5. <A -HREF="#AEN2012" ->Result Caching</A +>15.10. <A +HREF="#AEN2704" +>Note about broadcast addresses</A +></DT +><DT +>15.11. <A +HREF="#AEN2707" +>Multiple interfaces</A ></DT ></DL ></DD ><DT ->11.5. <A -HREF="#AEN2015" ->Installation and Configuration</A +>16. <A +HREF="#SPEED" +>Samba performance issues</A ></DT ><DD ><DL ><DT ->11.5.1. <A -HREF="#AEN2022" ->Introduction</A -></DT -><DT ->11.5.2. <A -HREF="#AEN2035" ->Requirements</A +>16.1. <A +HREF="#AEN2725" +>Comparisons</A ></DT ><DT ->11.5.3. <A -HREF="#AEN2049" ->Testing Things Out</A +>16.2. <A +HREF="#AEN2731" +>Oplocks</A ></DT ><DD ><DL ><DT ->11.5.3.1. <A -HREF="#AEN2060" ->Configure and compile SAMBA</A +>16.2.1. <A +HREF="#AEN2733" +>Overview</A ></DT ><DT ->11.5.3.2. <A -HREF="#AEN2079" ->Configure <TT -CLASS="FILENAME" ->nsswitch.conf</TT -> and the -winbind libraries</A +>16.2.2. <A +HREF="#AEN2741" +>Level2 Oplocks</A ></DT ><DT ->11.5.3.3. <A -HREF="#AEN2104" ->Configure smb.conf</A +>16.2.3. <A +HREF="#AEN2747" +>Old 'fake oplocks' option - deprecated</A +></DT +></DL +></DD +><DT +>16.3. <A +HREF="#AEN2751" +>Socket options</A ></DT ><DT ->11.5.3.4. <A -HREF="#AEN2120" ->Join the SAMBA server to the PDC domain</A +>16.4. <A +HREF="#AEN2758" +>Read size</A ></DT ><DT ->11.5.3.5. <A -HREF="#AEN2131" ->Start up the winbindd daemon and test it!</A +>16.5. <A +HREF="#AEN2763" +>Max xmit</A ></DT ><DT ->11.5.3.6. <A -HREF="#AEN2167" ->Fix the <TT -CLASS="FILENAME" ->/etc/rc.d/init.d/smb</TT -> startup files</A +>16.6. <A +HREF="#AEN2768" +>Locking</A ></DT ><DT ->11.5.3.7. <A -HREF="#AEN2189" ->Configure Winbind and PAM</A +>16.7. <A +HREF="#AEN2772" +>Share modes</A ></DT -></DL -></DD -></DL -></DD ><DT ->11.6. <A -HREF="#AEN2236" ->Limitations</A +>16.8. <A +HREF="#AEN2777" +>Log level</A ></DT ><DT ->11.7. <A -HREF="#AEN2246" ->Conclusion</A +>16.9. <A +HREF="#AEN2780" +>Wide lines</A +></DT +><DT +>16.10. <A +HREF="#AEN2783" +>Read raw</A +></DT +><DT +>16.11. <A +HREF="#AEN2788" +>Write raw</A +></DT +><DT +>16.12. <A +HREF="#AEN2792" +>Read prediction</A +></DT +><DT +>16.13. <A +HREF="#AEN2799" +>Memory mapping</A +></DT +><DT +>16.14. <A +HREF="#AEN2804" +>Slow Clients</A +></DT +><DT +>16.15. <A +HREF="#AEN2808" +>Slow Logins</A +></DT +><DT +>16.16. <A +HREF="#AEN2811" +>Client tuning</A +></DT +><DT +>16.17. <A +HREF="#AEN2843" +>My Results</A ></DT ></DL ></DD ><DT ->12. <A +>17. <A HREF="#OS2" >OS2 Client HOWTO</A ></DT ><DD ><DL ><DT ->12.1. <A -HREF="#AEN2260" +>17.1. <A +HREF="#AEN2860" >FAQs</A ></DT ><DD ><DL ><DT ->12.1.1. <A -HREF="#AEN2262" +>17.1.1. <A +HREF="#AEN2862" >How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?</A ></DT ><DT ->12.1.2. <A -HREF="#AEN2277" +>17.1.2. <A +HREF="#AEN2877" >How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?</A ></DT ><DT ->12.1.3. <A -HREF="#AEN2286" +>17.1.3. <A +HREF="#AEN2886" >Are there any other issues when OS/2 (any version) is used as a client?</A ></DT ><DT ->12.1.4. <A -HREF="#AEN2290" +>17.1.4. <A +HREF="#AEN2890" >How do I get printer driver download working for OS/2 clients?</A ></DT @@ -994,32 +1333,32 @@ HREF="#AEN2290" ></DL ></DD ><DT ->13. <A +>18. <A HREF="#CVS-ACCESS" >HOWTO Access Samba source code via CVS</A ></DT ><DD ><DL ><DT ->13.1. <A -HREF="#AEN2306" +>18.1. <A +HREF="#AEN2906" >Introduction</A ></DT ><DT ->13.2. <A -HREF="#AEN2311" +>18.2. <A +HREF="#AEN2911" >CVS Access to samba.org</A ></DT ><DD ><DL ><DT ->13.2.1. <A -HREF="#AEN2314" +>18.2.1. <A +HREF="#AEN2914" >Access via CVSweb</A ></DT ><DT ->13.2.2. <A -HREF="#AEN2319" +>18.2.2. <A +HREF="#AEN2919" >Access via cvs</A ></DT ></DL @@ -1027,8 +1366,47 @@ HREF="#AEN2319" ></DL ></DD ><DT +>19. <A +HREF="#BUGREPORT" +>Reporting Bugs</A +></DT +><DD +><DL +><DT +>19.1. <A +HREF="#AEN2954" +>Introduction</A +></DT +><DT +>19.2. <A +HREF="#AEN2961" +>General info</A +></DT +><DT +>19.3. <A +HREF="#AEN2967" +>Debug levels</A +></DT +><DT +>19.4. <A +HREF="#AEN2984" +>Internal errors</A +></DT +><DT +>19.5. <A +HREF="#AEN2994" +>Attaching to a running process</A +></DT +><DT +>19.6. <A +HREF="#AEN2997" +>Patches</A +></DT +></DL +></DD +><DT ><A -HREF="#AEN2347" +HREF="#AEN3002" >Index</A ></DT ></DL @@ -1522,7 +1900,7 @@ CLASS="REPLACEABLE" ></TT ></P ><P ->Your should get back a list of shares available on +>You should get back a list of shares available on your server. If you don't then something is incorrectly setup. Note that this method can also be used to see what shares are available on other LanManager clients (such as WfWg).</P @@ -1700,8 +2078,8 @@ NAME="AEN183" >By default Samba uses a blank scope ID. This means all your windows boxes must also have a blank scope ID. If you really want to use a non-blank scope ID then you will - need to use the -i <scope> option to nmbd, smbd, and - smbclient. All your PCs will need to have the same setting for + need to use the 'netbios scope' smb.conf option. + All your PCs will need to have the same setting for this to work. I do not recommend scope IDs.</P ></DIV ><DIV @@ -1822,19 +2200,13 @@ NAME="AEN199" its open. A client may ask for DENY_NONE, DENY_READ, DENY_WRITE or DENY_ALL. There are also special compatibility modes called DENY_FCB and DENY_DOS.</P -><P ->You can disable share modes using "share modes = no". - This may be useful on a heavily loaded server as the share - modes code is very slow. See also the FAST_SHARE_MODES - option in the Makefile for a way to do full share modes - very fast using shared memory (if your OS supports it).</P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN209" +NAME="AEN208" >1.10.6. Mapping Usernames</A ></H2 ><P @@ -1842,21 +2214,560 @@ NAME="AEN209" the unix server then take a look at the "username map" option. See the smb.conf man page for details.</P ></DIV +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="DIAGNOSIS" +>Chapter 2. Diagnosing your samba server</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN222" +>2.1. Introduction</A +></H1 +><P +>This file contains a list of tests you can perform to validate your +Samba server. It also tells you what the likely cause of the problem +is if it fails any one of these steps. If it passes all these tests +then it is probably working fine.</P +><P +>You should do ALL the tests, in the order shown. I have tried to +carefully choose them so later tests only use capabilities verified in +the earlier tests.</P +><P +>If you send me an email saying "it doesn't work" and you have not +followed this test procedure then you should not be surprised if I +ignore your email.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN227" +>2.2. Assumptions</A +></H1 +><P +>In all of the tests I assume you have a Samba server called BIGSERVER +and a PC called ACLIENT both in workgroup TESTGROUP. I also assume the +PC is running windows for workgroups with a recent copy of the +microsoft tcp/ip stack. Alternatively, your PC may be running Windows +95 or Windows NT (Workstation or Server).</P +><P +>The procedure is similar for other types of clients.</P +><P +>I also assume you know the name of an available share in your +smb.conf. I will assume this share is called "tmp". You can add a +"tmp" share like by adding the following to smb.conf:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> [tmp] + comment = temporary files + path = /tmp + read only = yes </PRE +></TD +></TR +></TABLE +></P +><P +>THESE TESTS ASSUME VERSION 2.0.6 OR LATER OF THE SAMBA SUITE. SOME +COMMANDS SHOWN DID NOT EXIST IN EARLIER VERSIONS</P +><P +>Please pay attention to the error messages you receive. If any error message +reports that your server is being unfriendly you should first check that you +IP name resolution is correctly set up. eg: Make sure your /etc/resolv.conf +file points to name servers that really do exist.</P +><P +>Also, if you do not have DNS server access for name resolution please check +that the settings for your smb.conf file results in "dns proxy = no". The +best way to check this is with "testparm smb.conf"</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN237" +>2.3. Tests</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN239" +>2.3.1. Test 1</A +></H2 +><P +>In the directory in which you store your smb.conf file, run the command +"testparm smb.conf". If it reports any errors then your smb.conf +configuration file is faulty.</P +><P +>Note: Your smb.conf file may be located in: <TT +CLASS="FILENAME" +>/etc</TT +> + Or in: <TT +CLASS="FILENAME" +>/usr/local/samba/lib</TT +></P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN245" +>2.3.2. Test 2</A +></H2 +><P +>Run the command "ping BIGSERVER" from the PC and "ping ACLIENT" from +the unix box. If you don't get a valid response then your TCP/IP +software is not correctly installed. </P +><P +>Note that you will need to start a "dos prompt" window on the PC to +run ping.</P +><P +>If you get a message saying "host not found" or similar then your DNS +software or /etc/hosts file is not correctly setup. It is possible to +run samba without DNS entries for the server and client, but I assume +you do have correct entries for the remainder of these tests. </P +><P +>Another reason why ping might fail is if your host is running firewall +software. You will need to relax the rules to let in the workstation +in question, perhaps by allowing access from another subnet (on Linux +this is done via the ipfwadm program.)</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN251" +>2.3.3. Test 3</A +></H2 +><P +>Run the command "smbclient -L BIGSERVER" on the unix box. You +should get a list of available shares back. </P +><P +>If you get a error message containing the string "Bad password" then +you probably have either an incorrect "hosts allow", "hosts deny" or +"valid users" line in your smb.conf, or your guest account is not +valid. Check what your guest account is using "testparm" and +temporarily remove any "hosts allow", "hosts deny", "valid users" or +"invalid users" lines.</P +><P +>If you get a "connection refused" response then the smbd server may +not be running. If you installed it in inetd.conf then you probably edited +that file incorrectly. If you installed it as a daemon then check that +it is running, and check that the netbios-ssn port is in a LISTEN +state using "netstat -a".</P +><P +>If you get a "session request failed" then the server refused the +connection. If it says "Your server software is being unfriendly" then +its probably because you have invalid command line parameters to smbd, +or a similar fatal problem with the initial startup of smbd. Also +check your config file (smb.conf) for syntax errors with "testparm" +and that the various directories where samba keeps its log and lock +files exist.</P +><P +>There are a number of reasons for which smbd may refuse or decline +a session request. The most common of these involve one or more of +the following smb.conf file entries:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> hosts deny = ALL + hosts allow = xxx.xxx.xxx.xxx/yy + bind interfaces only = Yes</PRE +></TD +></TR +></TABLE +></P +><P +>In the above, no allowance has been made for any session requests that +will automatically translate to the loopback adaptor address 127.0.0.1. +To solve this problem change these lines to:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> hosts deny = ALL + hosts allow = xxx.xxx.xxx.xxx/yy 127.</PRE +></TD +></TR +></TABLE +></P +><P +>Do NOT use the "bind interfaces only" parameter where you may wish to +use the samba password change facility, or where smbclient may need to +access local service for name resolution or for local resource +connections. (Note: the "bind interfaces only" parameter deficiency +where it will not allow connections to the loopback address will be +fixed soon).</P +><P +>Another common cause of these two errors is having something already running +on port 139, such as Samba (ie: smbd is running from inetd already) or +something like Digital's Pathworks. Check your inetd.conf file before trying +to start smbd as a daemon, it can avoid a lot of frustration!</P +><P +>And yet another possible cause for failure of TEST 3 is when the subnet mask +and / or broadcast address settings are incorrect. Please check that the +network interface IP Address / Broadcast Address / Subnet Mask settings are +correct and that Samba has correctly noted these in the log.nmb file.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN266" +>2.3.4. Test 4</A +></H2 +><P +>Run the command "nmblookup -B BIGSERVER __SAMBA__". You should get the +IP address of your Samba server back.</P +><P +>If you don't then nmbd is incorrectly installed. Check your inetd.conf +if you run it from there, or that the daemon is running and listening +to udp port 137.</P +><P +>One common problem is that many inetd implementations can't take many +parameters on the command line. If this is the case then create a +one-line script that contains the right parameters and run that from +inetd.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN271" +>2.3.5. Test 5</A +></H2 +><P +>run the command <B +CLASS="COMMAND" +>nmblookup -B ACLIENT '*'</B +></P +><P +>You should get the PCs IP address back. If you don't then the client +software on the PC isn't installed correctly, or isn't started, or you +got the name of the PC wrong. </P +><P +>If ACLIENT doesn't resolve via DNS then use the IP address of the +client in the above test.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN277" +>2.3.6. Test 6</A +></H2 +><P +>Run the command <B +CLASS="COMMAND" +>nmblookup -d 2 '*'</B +></P +><P +>This time we are trying the same as the previous test but are trying +it via a broadcast to the default broadcast address. A number of +Netbios/TCPIP hosts on the network should respond, although Samba may +not catch all of the responses in the short time it listens. You +should see "got a positive name query response" messages from several +hosts.</P +><P +>If this doesn't give a similar result to the previous test then +nmblookup isn't correctly getting your broadcast address through its +automatic mechanism. In this case you should experiment use the +"interfaces" option in smb.conf to manually configure your IP +address, broadcast and netmask. </P +><P +>If your PC and server aren't on the same subnet then you will need to +use the -B option to set the broadcast address to the that of the PCs +subnet.</P +><P +>This test will probably fail if your subnet mask and broadcast address are +not correct. (Refer to TEST 3 notes above).</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN285" +>2.3.7. Test 7</A +></H2 +><P +>Run the command <B +CLASS="COMMAND" +>smbclient //BIGSERVER/TMP</B +>. You should +then be prompted for a password. You should use the password of the account +you are logged into the unix box with. If you want to test with +another account then add the -U >accountname< option to the end of +the command line. eg: +<B +CLASS="COMMAND" +>smbclient //bigserver/tmp -Ujohndoe</B +></P +><P +>Note: It is possible to specify the password along with the username +as follows: +<B +CLASS="COMMAND" +>smbclient //bigserver/tmp -Ujohndoe%secret</B +></P +><P +>Once you enter the password you should get the "smb>" prompt. If you +don't then look at the error message. If it says "invalid network +name" then the service "tmp" is not correctly setup in your smb.conf.</P +><P +>If it says "bad password" then the likely causes are:</P +><P +></P +><OL +TYPE="1" +><LI +><P +> you have shadow passords (or some other password system) but didn't + compile in support for them in smbd + </P +></LI +><LI +><P +> your "valid users" configuration is incorrect + </P +></LI +><LI +><P +> you have a mixed case password and you haven't enabled the "password + level" option at a high enough level + </P +></LI +><LI +><P +> the "path =" line in smb.conf is incorrect. Check it with testparm + </P +></LI +><LI +><P +> you enabled password encryption but didn't create the SMB encrypted + password file + </P +></LI +></OL +><P +>Once connected you should be able to use the commands +<B +CLASS="COMMAND" +>dir</B +> <B +CLASS="COMMAND" +>get</B +> <B +CLASS="COMMAND" +>put</B +> etc. +Type <B +CLASS="COMMAND" +>help >command<</B +> for instructions. You should +especially check that the amount of free disk space shown is correct +when you type <B +CLASS="COMMAND" +>dir</B +>.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN311" +>2.3.8. Test 8</A +></H2 +><P +>On the PC type the command <B +CLASS="COMMAND" +>net view \\BIGSERVER</B +>. You will +need to do this from within a "dos prompt" window. You should get back a +list of available shares on the server.</P +><P +>If you get a "network name not found" or similar error then netbios +name resolution is not working. This is usually caused by a problem in +nmbd. To overcome it you could do one of the following (you only need +to choose one of them):</P +><P +></P +><OL +TYPE="1" +><LI +><P +> fixup the nmbd installation</P +></LI +><LI +><P +> add the IP address of BIGSERVER to the "wins server" box in the + advanced tcp/ip setup on the PC.</P +></LI +><LI +><P +> enable windows name resolution via DNS in the advanced section of + the tcp/ip setup</P +></LI +><LI +><P +> add BIGSERVER to your lmhosts file on the PC.</P +></LI +></OL +><P +>If you get a "invalid network name" or "bad password error" then the +same fixes apply as they did for the "smbclient -L" test above. In +particular, make sure your "hosts allow" line is correct (see the man +pages)</P +><P +>Also, do not overlook that fact that when the workstation requests the +connection to the samba server it will attempt to connect using the +name with which you logged onto your Windows machine. You need to make +sure that an account exists on your Samba server with that exact same +name and password.</P +><P +>If you get "specified computer is not receiving requests" or similar +it probably means that the host is not contactable via tcp services. +Check to see if the host is running tcp wrappers, and if so add an entry in +the hosts.allow file for your client (or subnet, etc.)</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN328" +>2.3.9. Test 9</A +></H2 +><P +>Run the command <B +CLASS="COMMAND" +>net use x: \\BIGSERVER\TMP</B +>. You should +be prompted for a password then you should get a "command completed +successfully" message. If not then your PC software is incorrectly +installed or your smb.conf is incorrect. make sure your "hosts allow" +and other config lines in smb.conf are correct.</P +><P +>It's also possible that the server can't work out what user name to +connect you as. To see if this is the problem add the line "user = +USERNAME" to the [tmp] section of smb.conf where "USERNAME" is the +username corresponding to the password you typed. If you find this +fixes things you may need the username mapping option.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN333" +>2.3.10. Test 10</A +></H2 +><P +>Run the command <B +CLASS="COMMAND" +>nmblookup -M TESTGROUP</B +> where +TESTGROUP is the name of the workgroup that your Samba server and +Windows PCs belong to. You should get back the IP address of the +master browser for that workgroup.</P +><P +>If you don't then the election process has failed. Wait a minute to +see if it is just being slow then try again. If it still fails after +that then look at the browsing options you have set in smb.conf. Make +sure you have <B +CLASS="COMMAND" +>preferred master = yes</B +> to ensure that +an election is held at startup.</P +></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN212" ->1.10.7. Other Character Sets</A +NAME="AEN339" +>2.3.11. Test 11</A ></H2 ><P ->If you have problems using filenames with accented - characters in them (like the German, French or Scandinavian - character sets) then I recommend you look at the "valid chars" - option in smb.conf and also take a look at the validchars - package in the examples directory.</P +>From file manager try to browse the server. Your samba server should +appear in the browse list of your local workgroup (or the one you +specified in smb.conf). You should be able to double click on the name +of the server and get a list of shares. If you get a "invalid +password" error when you do then you are probably running WinNT and it +is refusing to browse a server that has no encrypted password +capability and is in user level security mode. In this case either set +<B +CLASS="COMMAND" +>security = server</B +> AND +<B +CLASS="COMMAND" +>password server = Windows_NT_Machine</B +> in your +smb.conf file, or enable encrypted passwords AFTER compiling in support +for encrypted passwords (refer to the Makefile).</P +></DIV ></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN344" +>2.4. Still having troubles?</A +></H1 +><P +>Try the mailing list or newsgroup, or use the ethereal utility to +sniff the problem. The official samba mailing list can be reached at +<A +HREF="mailto:samba@samba.org" +TARGET="_top" +>samba@samba.org</A +>. To find +out more about samba and how to subscribe to the mailing list check +out the samba web page at +<A +HREF="http://samba.org/samba" +TARGET="_top" +>http://samba.org/samba</A +></P +><P +>Also look at the other docs in the Samba package!</P ></DIV ></DIV ><DIV @@ -1864,15 +2775,15 @@ CLASS="CHAPTER" ><HR><H1 ><A NAME="INTEGRATE-MS-NETWORKS" ->Chapter 2. Integrating MS Windows networks with Samba</A +>Chapter 3. Integrating MS Windows networks with Samba</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN226" ->2.1. Agenda</A +NAME="AEN361" +>3.1. Agenda</A ></H1 ><P >To identify the key functional mechanisms of MS Windows networking @@ -1938,8 +2849,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN248" ->2.2. Name Resolution in a pure Unix/Linux world</A +NAME="AEN383" +>3.2. Name Resolution in a pure Unix/Linux world</A ></H1 ><P >The key configuration files covered in this section are:</P @@ -1980,8 +2891,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN264" ->2.2.1. <TT +NAME="AEN399" +>3.2.1. <TT CLASS="FILENAME" >/etc/hosts</TT ></A @@ -2043,7 +2954,7 @@ CLASS="FILENAME" > is one such file.</P ><P >When the IP address of the destination interface has been -determined a protocol called ARP/RARP isused to identify +determined a protocol called ARP/RARP is used to identify the MAC address of the target interface. ARP stands for Address Resolution Protocol, and is a broadcast oriented method that uses UDP (User Datagram Protocol) to send a request to all @@ -2070,8 +2981,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN280" ->2.2.2. <TT +NAME="AEN415" +>3.2.2. <TT CLASS="FILENAME" >/etc/resolv.conf</TT ></A @@ -2108,8 +3019,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN291" ->2.2.3. <TT +NAME="AEN426" +>3.2.3. <TT CLASS="FILENAME" >/etc/host.conf</TT ></A @@ -2146,8 +3057,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN299" ->2.2.4. <TT +NAME="AEN434" +>3.2.4. <TT CLASS="FILENAME" >/etc/nsswitch.conf</TT ></A @@ -2224,8 +3135,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN311" ->2.3. Name resolution as used within MS Windows networking</A +NAME="AEN446" +>3.3. Name resolution as used within MS Windows networking</A ></H1 ><P >MS Windows networking is predicated about the name each machine @@ -2293,7 +3204,7 @@ architecture of the MS Windows network. The term "workgroup" indicates that the primary nature of the network environment is that of a peer-to-peer design. In a WORKGROUP all machines are responsible for their own security, and generally such security is limited to use of -just a password (known as SHARE MORE security). In most situations +just a password (known as SHARE MODE security). In most situations with peer-to-peer networking the users who control their own machines will simply opt to have no security at all. It is possible to have USER MODE security in a WORKGROUP environment, thus requiring use @@ -2318,13 +3229,13 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN323" ->2.3.1. The NetBIOS Name Cache</A +NAME="AEN458" +>3.3.1. The NetBIOS Name Cache</A ></H2 ><P >All MS Windows machines employ an in memory buffer in which is -stored the NetBIOS names and their IP addresses for all external -machines that that the local machine has communicated with over the +stored the NetBIOS names and IP addresses for all external +machines that that machine has communicated with over the past 10-15 minutes. It is more efficient to obtain an IP address for a machine from the local cache than it is to go through all the configured name resolution mechanisms.</P @@ -2332,7 +3243,7 @@ configured name resolution mechanisms.</P >If a machine whose name is in the local name cache has been shut down before the name had been expired and flushed from the cache, then an attempt to exchange a message with that machine will be subject -to time-out delays. ie: It's name is in the cache, so a name resolution +to time-out delays. i.e.: Its name is in the cache, so a name resolution lookup will succeed, but the machine can not respond. This can be frustrating for users - but it is a characteristic of the protocol.</P ><P @@ -2345,8 +3256,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN328" ->2.3.2. The LMHOSTS file</A +NAME="AEN463" +>3.3.2. The LMHOSTS file</A ></H2 ><P >This file is usually located in MS Windows NT 4.0 or @@ -2457,8 +3368,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN336" ->2.3.3. HOSTS file</A +NAME="AEN471" +>3.3.3. HOSTS file</A ></H2 ><P >This file is usually located in MS Windows NT 4.0 or 2000 in @@ -2479,8 +3390,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN341" ->2.3.4. DNS Lookup</A +NAME="AEN476" +>3.3.4. DNS Lookup</A ></H2 ><P >This capability is configured in the TCP/IP setup area in the network @@ -2499,8 +3410,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN344" ->2.3.5. WINS Lookup</A +NAME="AEN479" +>3.3.5. WINS Lookup</A ></H2 ><P >A WINS (Windows Internet Name Server) service is the equivaent of the @@ -2560,13 +3471,13 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN356" ->2.4. How browsing functions and how to deploy stable and +NAME="AEN491" +>3.4. How browsing functions and how to deploy stable and dependable browsing using Samba</A ></H1 ><P >As stated above, MS Windows machines register their NetBIOS names -(ie: the machine name for each service type in operation) on start +(i.e.: the machine name for each service type in operation) on start up. Also, as stated above, the exact method by which this name registration takes place is determined by whether or not the MS Windows client/server has been given a WINS server address, whether or not LMHOSTS lookup @@ -2591,7 +3502,7 @@ Instead, the domain master browser serves the role of contacting each local master browser (found by asking WINS or from LMHOSTS) and exchanging browse list contents. This way every master browser will eventually obtain a complete list of all machines that are on the network. Every 11-15 minutes an election -is held to determine which machine will be the master browser. By nature of +is held to determine which machine will be the master browser. By the nature of the election criteria used, the machine with the highest uptime, or the most senior protocol version, or other criteria, will win the election as domain master browser.</P @@ -2627,8 +3538,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN366" ->2.5. MS Windows security options and how to configure +NAME="AEN501" +>3.5. MS Windows security options and how to configure Samba for seemless integration</A ></H1 ><P @@ -2676,8 +3587,8 @@ these versions no longer support plain text passwords by default.</P ><P >MS Windows clients have a habit of dropping network mappings that have been idle for 10 minutes or longer. When the user attempts to -use the mapped drive connection that has been dropped the SMB protocol -has a mechanism by which the connection can be re-established using +use the mapped drive connection that has been dropped, the client +re-establishes the connection using a cached copy of the password.</P ><P >When Microsoft changed the default password mode, they dropped support for @@ -2769,8 +3680,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN394" ->2.5.1. Use MS Windows NT as an authentication server</A +NAME="AEN529" +>3.5.1. Use MS Windows NT as an authentication server</A ></H2 ><P >This method involves the additions of the following parameters @@ -2814,8 +3725,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN402" ->2.5.2. Make Samba a member of an MS Windows NT security domain</A +NAME="AEN537" +>3.5.2. Make Samba a member of an MS Windows NT security domain</A ></H2 ><P >This method involves additon of the following paramters in the smb.conf file:</P @@ -2886,12 +3797,12 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN419" ->2.5.3. Configure Samba as an authentication server</A +NAME="AEN554" +>3.5.3. Configure Samba as an authentication server</A ></H2 ><P >This mode of authentication demands that there be on the -Unix/Linux system both a Unix style account as well as and +Unix/Linux system both a Unix style account as well as an smbpasswd entry for the user. The Unix system account can be locked if required as only the encrypted password will be used for SMB client authentication.</P @@ -2932,8 +3843,8 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN426" ->2.5.3.1. Users</A +NAME="AEN561" +>3.5.3.1. Users</A ></H3 ><P >A user account that may provide a home directory should be @@ -2964,8 +3875,8 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN431" ->2.5.3.2. MS Windows NT Machine Accounts</A +NAME="AEN566" +>3.5.3.2. MS Windows NT Machine Accounts</A ></H3 ><P >These are required only when Samba is used as a domain @@ -2994,8 +3905,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN436" ->2.6. Conclusions</A +NAME="AEN571" +>3.6. Conclusions</A ></H1 ><P >Samba provides a flexible means to operate as...</P @@ -3031,7 +3942,7 @@ CLASS="CHAPTER" ><HR><H1 ><A NAME="PAM" ->Chapter 3. Configuring PAM for distributed but centrally +>Chapter 4. Configuring PAM for distributed but centrally managed authentication</A ></H1 ><DIV @@ -3039,8 +3950,8 @@ CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN457" ->3.1. Samba and PAM</A +NAME="AEN592" +>4.1. Samba and PAM</A ></H1 ><P >A number of Unix systems (eg: Sun Solaris), as well as the @@ -3298,8 +4209,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN501" ->3.2. Distributed Authentication</A +NAME="AEN636" +>4.2. Distributed Authentication</A ></H1 ><P >The astute administrator will realize from this that the @@ -3331,8 +4242,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN508" ->3.3. PAM Configuration in smb.conf</A +NAME="AEN643" +>4.3. PAM Configuration in smb.conf</A ></H1 ><P >There is an option in smb.conf called <A @@ -3372,15 +4283,15 @@ CLASS="CHAPTER" ><HR><H1 ><A NAME="MSDFS" ->Chapter 4. Hosting a Microsoft Distributed File System tree on Samba</A +>Chapter 5. Hosting a Microsoft Distributed File System tree on Samba</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN528" ->4.1. Instructions</A +NAME="AEN663" +>5.1. Instructions</A ></H1 ><P >The Distributed File System (or Dfs) provides a means of @@ -3536,8 +4447,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN563" ->4.1.1. Notes</A +NAME="AEN698" +>5.1.1. Notes</A ></H2 ><P ></P @@ -3570,15 +4481,15 @@ CLASS="CHAPTER" ><HR><H1 ><A NAME="UNIX-PERMISSIONS" ->Chapter 5. UNIX Permission Bits and Windows NT Access Control Lists</A +>Chapter 6. UNIX Permission Bits and Windows NT Access Control Lists</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN583" ->5.1. Viewing and changing UNIX permissions using the NT +NAME="AEN718" +>6.1. Viewing and changing UNIX permissions using the NT security dialogs</A ></H1 ><P @@ -3616,8 +4527,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN592" ->5.2. How to view file security on a Samba share</A +NAME="AEN727" +>6.2. How to view file security on a Samba share</A ></H1 ><P >From an NT 4.0 client, single-click with the right @@ -3662,8 +4573,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN603" ->5.3. Viewing file ownership</A +NAME="AEN738" +>6.3. Viewing file ownership</A ></H1 ><P >Clicking on the <B @@ -3748,8 +4659,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN623" ->5.4. Viewing file or directory permissions</A +NAME="AEN758" +>6.4. Viewing file or directory permissions</A ></H1 ><P >The third button is the <B @@ -3810,8 +4721,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN638" ->5.4.1. File Permissions</A +NAME="AEN773" +>6.4.1. File Permissions</A ></H2 ><P >The standard UNIX user/group/world triple and @@ -3872,8 +4783,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN652" ->5.4.2. Directory Permissions</A +NAME="AEN787" +>6.4.2. Directory Permissions</A ></H2 ><P >Directories on an NT NTFS file system have two @@ -3904,8 +4815,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN659" ->5.5. Modifying file or directory permissions</A +NAME="AEN794" +>6.5. Modifying file or directory permissions</A ></H1 ><P >Modifying file and directory permissions is as simple @@ -4002,8 +4913,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN681" ->5.6. Interaction with the standard Samba create mask +NAME="AEN816" +>6.6. Interaction with the standard Samba create mask parameters</A ></H1 ><P @@ -4275,8 +5186,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN745" ->5.7. Interaction with the standard Samba file attribute +NAME="AEN880" +>6.7. Interaction with the standard Samba file attribute mapping</A ></H1 ><P @@ -4323,15 +5234,15 @@ CLASS="CHAPTER" ><HR><H1 ><A NAME="PRINTING" ->Chapter 6. Printing Support in Samba 2.2.x</A +>Chapter 7. Printing Support in Samba 2.2.x</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN766" ->6.1. Introduction</A +NAME="AEN901" +>7.1. Introduction</A ></H1 ><P >Beginning with the 2.2.0 release, Samba supports @@ -4414,8 +5325,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN788" ->6.2. Configuration</A +NAME="AEN923" +>7.2. Configuration</A ></H1 ><DIV CLASS="WARNING" @@ -4482,8 +5393,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN799" ->6.2.1. Creating [print$]</A +NAME="AEN934" +>7.2.1. Creating [print$]</A ></H2 ><P >In order to support the uploading of printer driver @@ -4685,8 +5596,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN834" ->6.2.2. Setting Drivers for Existing Printers</A +NAME="AEN969" +>7.2.2. Setting Drivers for Existing Printers</A ></H2 ><P >The initial listing of printers in the Samba host's @@ -4757,8 +5668,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN851" ->6.2.3. Support a large number of printers</A +NAME="AEN986" +>7.2.3. Support a large number of printers</A ></H2 ><P >One issue that has arisen during the development @@ -4832,8 +5743,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN862" ->6.2.4. Adding New Printers via the Windows NT APW</A +NAME="AEN997" +>7.2.4. Adding New Printers via the Windows NT APW</A ></H2 ><P >By default, Samba offers all printer shares defined in <TT @@ -4938,8 +5849,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN887" ->6.2.5. Samba and Printer Ports</A +NAME="AEN1022" +>7.2.5. Samba and Printer Ports</A ></H2 ><P >Windows NT/2000 print servers associate a port with each printer. These normally @@ -4975,8 +5886,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN895" ->6.3. The Imprints Toolset</A +NAME="AEN1030" +>7.3. The Imprints Toolset</A ></H1 ><P >The Imprints tool set provides a UNIX equivalent of the @@ -4993,8 +5904,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN899" ->6.3.1. What is Imprints?</A +NAME="AEN1034" +>7.3.1. What is Imprints?</A ></H2 ><P >Imprints is a collection of tools for supporting the goals @@ -5025,8 +5936,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN909" ->6.3.2. Creating Printer Driver Packages</A +NAME="AEN1044" +>7.3.2. Creating Printer Driver Packages</A ></H2 ><P >The process of creating printer driver packages is beyond @@ -5041,8 +5952,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN912" ->6.3.3. The Imprints server</A +NAME="AEN1047" +>7.3.3. The Imprints server</A ></H2 ><P >The Imprints server is really a database server that @@ -5061,8 +5972,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN916" ->6.3.4. The Installation Client</A +NAME="AEN1051" +>7.3.4. The Installation Client</A ></H2 ><P >More information regarding the Imprints installation client @@ -5164,8 +6075,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN938" ->6.4. <A +NAME="AEN1073" +>7.4. <A NAME="MIGRATION" ></A >Migration to from Samba 2.0.x to 2.2.x</A @@ -5320,16 +6231,668 @@ disabled by default.</P CLASS="CHAPTER" ><HR><H1 ><A +NAME="PRINTING_DEBUG" +>Chapter 8. Debugging Printing Problems</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN1119" +>8.1. Introduction</A +></H1 +><P +>This is a short description of how to debug printing problems with +Samba. This describes how to debug problems with printing from a SMB +client to a Samba server, not the other way around. For the reverse +see the examples/printing directory.</P +><P +>Ok, so you want to print to a Samba server from your PC. The first +thing you need to understand is that Samba does not actually do any +printing itself, it just acts as a middleman between your PC client +and your Unix printing subsystem. Samba receives the file from the PC +then passes the file to a external "print command". What print command +you use is up to you.</P +><P +>The whole things is controlled using options in smb.conf. The most +relevant options (which you should look up in the smb.conf man page) +are:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> [global] + print command - send a file to a spooler + lpq command - get spool queue status + lprm command - remove a job + [printers] + path = /var/spool/lpd/samba</PRE +></TD +></TR +></TABLE +></P +><P +>The following are nice to know about:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> queuepause command - stop a printer or print queue + queueresume command - start a printer or print queue</PRE +></TD +></TR +></TABLE +></P +><P +>Example:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> print command = /usr/bin/lpr -r -P%p %s + lpq command = /usr/bin/lpq -P%p %s + lprm command = /usr/bin/lprm -P%p %j + queuepause command = /usr/sbin/lpc -P%p stop + queuepause command = /usr/sbin/lpc -P%p start</PRE +></TD +></TR +></TABLE +></P +><P +>Samba should set reasonable defaults for these depending on your +system type, but it isn't clairvoyant. It is not uncommon that you +have to tweak these for local conditions. The commands should +always have fully specified pathnames, as the smdb may not have +the correct PATH values.</P +><P +>When you send a job to Samba to be printed, it will make a temporary +copy of it in the directory specified in the [printers] section. +and it should be periodically cleaned out. The lpr -r option +requests that the temporary copy be removed after printing; If +printing fails then you might find leftover files in this directory, +and it should be periodically cleaned out. Samba used the lpq +command to determine the "job number" assigned to your print job +by the spooler.</P +><P +>The %>letter< are "macros" that get dynamically replaced with appropriate +values when they are used. The %s gets replaced with the name of the spool +file that Samba creates and the %p gets replaced with the name of the +printer. The %j gets replaced with the "job number" which comes from +the lpq output.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1135" +>8.2. Debugging printer problems</A +></H1 +><P +>One way to debug printing problems is to start by replacing these +command with shell scripts that record the arguments and the contents +of the print file. A simple example of this kind of things might +be:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> print command = /tmp/saveprint %p %s + + #!/bin/saveprint + # we make sure that we are the right user + /usr/bin/id -p >/tmp/tmp.print + # we run the command and save the error messages + # replace the command with the one appropriate for your system + /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print</PRE +></TD +></TR +></TABLE +></P +><P +>Then you print a file and try removing it. You may find that the +print queue needs to be stopped in order to see the queue status +and remove the job:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> h4: {42} % echo hi >/tmp/hi +h4: {43} % smbclient //localhost/lw4 +added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0 +Password: +Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7] +smb: \> print /tmp/hi +putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s) +smb: \> queue +1049 3 hi-17534 +smb: \> cancel 1049 +Error cancelling job 1049 : code 0 +smb: \> cancel 1049 +Job 1049 cancelled +smb: \> queue +smb: \> exit</PRE +></TD +></TR +></TABLE +></P +><P +>The 'code 0' indicates that the job was removed. The comment +by the smbclient is a bit misleading on this. +You can observe the command output and then and look at the +/tmp/tmp.print file to see what the results are. You can quickly +find out if the problem is with your printing system. Often people +have problems with their /etc/printcap file or permissions on +various print queues.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1144" +>8.3. What printers do I have?</A +></H1 +><P +>You can use the 'testprns' program to check to see if the printer +name you are using is recognized by Samba. For example, you can +use:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> testprns printer /etc/printcap</PRE +></TD +></TR +></TABLE +></P +><P +>Samba can get its printcap information from a file or from a program. +You can try the following to see the format of the extracted +information:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> testprns -a printer /etc/printcap + + testprns -a printer '|/bin/cat printcap'</PRE +></TD +></TR +></TABLE +></P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1152" +>8.4. Setting up printcap and print servers</A +></H1 +><P +>You may need to set up some printcaps for your Samba system to use. +It is strongly recommended that you use the facilities provided by +the print spooler to set up queues and printcap information.</P +><P +>Samba requires either a printcap or program to deliver printcap +information. This printcap information has the format:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> name|alias1|alias2...:option=value:...</PRE +></TD +></TR +></TABLE +></P +><P +>For almost all printing systems, the printer 'name' must be composed +only of alphanumeric or underscore '_' characters. Some systems also +allow hyphens ('-') as well. An alias is an alternative name for the +printer, and an alias with a space in it is used as a 'comment' +about the printer. The printcap format optionally uses a \ at the end of lines +to extend the printcap to multiple lines.</P +><P +>Here are some examples of printcap files:</P +><P +><P +></P +><OL +TYPE="1" +><LI +><P +>pr just printer name</P +></LI +><LI +><P +>pr|alias printer name and alias</P +></LI +><LI +><P +>pr|My Printer printer name, alias used as comment</P +></LI +><LI +><P +>pr:sh:\ Same as pr:sh:cm= testing + :cm= \ + testing</P +></LI +><LI +><P +>pr:sh Same as pr:sh:cm= testing + :cm= testing</P +></LI +></OL +></P +><P +>Samba reads the printcap information when first started. If you make +changes in the printcap information, then you must do the following:</P +><P +></P +><OL +TYPE="1" +><LI +><P +>make sure that the print spooler is aware of these changes. +The LPRng system uses the 'lpc reread' command to do this.</P +></LI +><LI +><P +>make sure that the spool queues, etc., exist and have the +correct permissions. The LPRng system uses the 'checkpc -f' +command to do this.</P +></LI +><LI +><P +>You now should send a SIGHUP signal to the smbd server to have +it reread the printcap information.</P +></LI +></OL +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1180" +>8.5. Job sent, no output</A +></H1 +><P +>This is the most frustrating part of printing. You may have sent the +job, verified that the job was forwarded, set up a wrapper around +the command to send the file, but there was no output from the printer.</P +><P +>First, check to make sure that the job REALLY is getting to the +right print queue. If you are using a BSD or LPRng print spooler, +you can temporarily stop the printing of jobs. Jobs can still be +submitted, but they will not be printed. Use:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> lpc -Pprinter stop</PRE +></TD +></TR +></TABLE +></P +><P +>Now submit a print job and then use 'lpq -Pprinter' to see if the +job is in the print queue. If it is not in the print queue then +you will have to find out why it is not being accepted for printing.</P +><P +>Next, you may want to check to see what the format of the job really +was. With the assistance of the system administrator you can view +the submitted jobs files. You may be surprised to find that these +are not in what you would expect to call a printable format. +You can use the UNIX 'file' utitily to determine what the job +format actually is:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> cd /var/spool/lpd/printer # spool directory of print jobs + ls # find job files + file dfA001myhost</PRE +></TD +></TR +></TABLE +></P +><P +>You should make sure that your printer supports this format OR that +your system administrator has installed a 'print filter' that will +convert the file to a format appropriate for your printer.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1191" +>8.6. Job sent, strange output</A +></H1 +><P +>Once you have the job printing, you can then start worrying about +making it print nicely.</P +><P +>The most common problem is extra pages of output: banner pages +OR blank pages at the end.</P +><P +>If you are getting banner pages, check and make sure that the +printcap option or printer option is configured for no banners. +If you have a printcap, this is the :sh (suppress header or banner +page) option. You should have the following in your printer.</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> printer: ... :sh</PRE +></TD +></TR +></TABLE +></P +><P +>If you have this option and are still getting banner pages, there +is a strong chance that your printer is generating them for you +automatically. You should make sure that banner printing is disabled +for the printer. This usually requires using the printer setup software +or procedures supplied by the printer manufacturer.</P +><P +>If you get an extra page of output, this could be due to problems +with your job format, or if you are generating PostScript jobs, +incorrect setting on your printer driver on the MicroSoft client. +For example, under Win95 there is a option:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|</PRE +></TD +></TR +></TABLE +></P +><P +>that allows you to choose if a Ctrl-D is appended to all jobs. +This is a very bad thing to do, as most spooling systems will +automatically add a ^D to the end of the job if it is detected as +PostScript. The multiple ^D may cause an additional page of output.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1203" +>8.7. Raw PostScript printed</A +></H1 +><P +>This is a problem that is usually caused by either the print spooling +system putting information at the start of the print job that makes +the printer think the job is a text file, or your printer simply +does not support PostScript. You may need to enable 'Automatic +Format Detection' on your printer.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1206" +>8.8. Advanced Printing</A +></H1 +><P +>Note that you can do some pretty magic things by using your +imagination with the "print command" option and some shell scripts. +Doing print accounting is easy by passing the %U option to a print +command shell script. You could even make the print command detect +the type of output and its size and send it to an appropriate +printer.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1209" +>8.9. Real debugging</A +></H1 +><P +>If the above debug tips don't help, then maybe you need to bring in +the bug guns, system tracing. See Tracing.txt in this directory.</P +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="SECURITY_LEVELS" +>Chapter 9. Security levels</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN1222" +>9.1. Introduction</A +></H1 +><P +>Samba supports the following options to the global smb.conf parameter</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>[global] +<A +HREF="smb.conf.5.html#SECURITY" +TARGET="_top" +><TT +CLASS="PARAMETER" +><I +>security</I +></TT +></A +> = [share|user(default)|domain|ads]</PRE +></TD +></TR +></TABLE +></P +><P +>Please refer to the smb.conf man page for usage information and to the document +<A +HREF="DOMAIN_MEMBER.html" +TARGET="_top" +>DOMAIN_MEMBER.html</A +> for further background details +on domain mode security. The Windows 2000 Kerberos domain security model +(security = ads) is described in the <A +HREF="ADS-HOWTO.html" +TARGET="_top" +>ADS-HOWTO.html</A +>.</P +><P +>Of the above, "security = server" means that Samba reports to clients that +it is running in "user mode" but actually passes off all authentication +requests to another "user mode" server. This requires an additional +parameter "password server =" that points to the real authentication server. +That real authentication server can be another Samba server or can be a +Windows NT server, the later natively capable of encrypted password support.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1233" +>9.2. More complete description of security levels</A +></H1 +><P +>A SMB server tells the client at startup what "security level" it is +running. There are two options "share level" and "user level". Which +of these two the client receives affects the way the client then tries +to authenticate itself. It does not directly affect (to any great +extent) the way the Samba server does security. I know this is +strange, but it fits in with the client/server approach of SMB. In SMB +everything is initiated and controlled by the client, and the server +can only tell the client what is available and whether an action is +allowed. </P +><P +>I'll describe user level security first, as its simpler. In user level +security the client will send a "session setup" command directly after +the protocol negotiation. This contains a username and password. The +server can either accept or reject that username/password +combination. Note that at this stage the server has no idea what +share the client will eventually try to connect to, so it can't base +the "accept/reject" on anything other than:</P +><P +></P +><OL +TYPE="1" +><LI +><P +>the username/password</P +></LI +><LI +><P +>the machine that the client is coming from</P +></LI +></OL +><P +>If the server accepts the username/password then the client expects to +be able to mount any share (using a "tree connection") without +specifying a password. It expects that all access rights will be as +the username/password specified in the "session setup". </P +><P +>It is also possible for a client to send multiple "session setup" +requests. When the server responds it gives the client a "uid" to use +as an authentication tag for that username/password. The client can +maintain multiple authentication contexts in this way (WinDD is an +example of an application that does this)</P +><P +>Ok, now for share level security. In share level security the client +authenticates itself separately for each share. It will send a +password along with each "tree connection" (share mount). It does not +explicitly send a username with this operation. The client is +expecting a password to be associated with each share, independent of +the user. This means that samba has to work out what username the +client probably wants to use. It is never explicitly sent the +username. Some commercial SMB servers such as NT actually associate +passwords directly with shares in share level security, but samba +always uses the unix authentication scheme where it is a +username/password that is authenticated, not a "share/password".</P +><P +>Many clients send a "session setup" even if the server is in share +level security. They normally send a valid username but no +password. Samba records this username in a list of "possible +usernames". When the client then does a "tree connection" it also adds +to this list the name of the share they try to connect to (useful for +home directories) and any users listed in the "user =" smb.conf +line. The password is then checked in turn against these "possible +usernames". If a match is found then the client is authenticated as +that user.</P +><P +>Finally "server level" security. In server level security the samba +server reports to the client that it is in user level security. The +client then does a "session setup" as described earlier. The samba +server takes the username/password that the client sends and attempts +to login to the "password server" by sending exactly the same +username/password that it got from the client. If that server is in +user level security and accepts the password then samba accepts the +clients connection. This allows the samba server to use another SMB +server as the "password server". </P +><P +>You should also note that at the very start of all this, where the +server tells the client what security level it is in, it also tells +the client if it supports encryption. If it does then it supplies the +client with a random "cryptkey". The client will then send all +passwords in encrypted form. You have to compile samba with encryption +enabled to support this feature, and you have to maintain a separate +smbpasswd file with SMB style encrypted passwords. It is +cryptographically impossible to translate from unix style encryption +to SMB style encryption, although there are some fairly simple management +schemes by which the two could be kept in sync.</P +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A NAME="DOMAIN-SECURITY" ->Chapter 7. security = domain in Samba 2.x</A +>Chapter 10. security = domain in Samba 2.x</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN992" ->7.1. Joining an NT Domain with Samba 2.2</A +NAME="AEN1266" +>10.1. Joining an NT Domain with Samba 2.2</A ></H1 ><P >Assume you have a Samba 2.x server with a NetBIOS name of @@ -5559,8 +7122,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1056" ->7.2. Samba and Windows 2000 Domains</A +NAME="AEN1330" +>10.2. Samba and Windows 2000 Domains</A ></H1 ><P >Many people have asked regarding the state of Samba's ability to participate in @@ -5584,8 +7147,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1061" ->7.3. Why is this better than security = server?</A +NAME="AEN1335" +>10.3. Why is this better than security = server?</A ></H1 ><P >Currently, domain security in Samba doesn't free you from @@ -5670,16 +7233,1643 @@ TARGET="_top" CLASS="CHAPTER" ><HR><H1 ><A +NAME="WINBIND" +>Chapter 11. Unified Logons between Windows NT and UNIX using Winbind</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN1388" +>11.1. Abstract</A +></H1 +><P +>Integration of UNIX and Microsoft Windows NT through + a unified logon has been considered a "holy grail" in heterogeneous + computing environments for a long time. We present + <EM +>winbind</EM +>, a component of the Samba suite + of programs as a solution to the unified logon problem. Winbind + uses a UNIX implementation + of Microsoft RPC calls, Pluggable Authentication Modules, and the Name + Service Switch to allow Windows NT domain users to appear and operate + as UNIX users on a UNIX machine. This paper describes the winbind + system, explaining the functionality it provides, how it is configured, + and how it works internally.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1392" +>11.2. Introduction</A +></H1 +><P +>It is well known that UNIX and Microsoft Windows NT have + different models for representing user and group information and + use different technologies for implementing them. This fact has + made it difficult to integrate the two systems in a satisfactory + manner.</P +><P +>One common solution in use today has been to create + identically named user accounts on both the UNIX and Windows systems + and use the Samba suite of programs to provide file and print services + between the two. This solution is far from perfect however, as + adding and deleting users on both sets of machines becomes a chore + and two sets of passwords are required both of which + can lead to synchronization problems between the UNIX and Windows + systems and confusion for users.</P +><P +>We divide the unified logon problem for UNIX machines into + three smaller problems:</P +><P +></P +><UL +><LI +><P +>Obtaining Windows NT user and group information + </P +></LI +><LI +><P +>Authenticating Windows NT users + </P +></LI +><LI +><P +>Password changing for Windows NT users + </P +></LI +></UL +><P +>Ideally, a prospective solution to the unified logon problem + would satisfy all the above components without duplication of + information on the UNIX machines and without creating additional + tasks for the system administrator when maintaining users and + groups on either system. The winbind system provides a simple + and elegant solution to all three components of the unified logon + problem.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1405" +>11.3. What Winbind Provides</A +></H1 +><P +>Winbind unifies UNIX and Windows NT account management by + allowing a UNIX box to become a full member of a NT domain. Once + this is done the UNIX box will see NT users and groups as if + they were native UNIX users and groups, allowing the NT domain + to be used in much the same manner that NIS+ is used within + UNIX-only environments.</P +><P +>The end result is that whenever any + program on the UNIX machine asks the operating system to lookup + a user or group name, the query will be resolved by asking the + NT domain controller for the specified domain to do the lookup. + Because Winbind hooks into the operating system at a low level + (via the NSS name resolution modules in the C library) this + redirection to the NT domain controller is completely + transparent.</P +><P +>Users on the UNIX machine can then use NT user and group + names as they would use "native" UNIX names. They can chown files + so that they are owned by NT domain users or even login to the + UNIX machine and run a UNIX X-Window session as a domain user.</P +><P +>The only obvious indication that Winbind is being used is + that user and group names take the form DOMAIN\user and + DOMAIN\group. This is necessary as it allows Winbind to determine + that redirection to a domain controller is wanted for a particular + lookup and which trusted domain is being referenced.</P +><P +>Additionally, Winbind provides an authentication service + that hooks into the Pluggable Authentication Modules (PAM) system + to provide authentication via a NT domain to any PAM enabled + applications. This capability solves the problem of synchronizing + passwords between systems since all passwords are stored in a single + location (on the domain controller).</P +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN1412" +>11.3.1. Target Uses</A +></H2 +><P +>Winbind is targeted at organizations that have an + existing NT based domain infrastructure into which they wish + to put UNIX workstations or servers. Winbind will allow these + organizations to deploy UNIX workstations without having to + maintain a separate account infrastructure. This greatly + simplifies the administrative overhead of deploying UNIX + workstations into a NT based organization.</P +><P +>Another interesting way in which we expect Winbind to + be used is as a central part of UNIX based appliances. Appliances + that provide file and print services to Microsoft based networks + will be able to use Winbind to provide seamless integration of + the appliance into the domain.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1416" +>11.4. How Winbind Works</A +></H1 +><P +>The winbind system is designed around a client/server + architecture. A long running <B +CLASS="COMMAND" +>winbindd</B +> daemon + listens on a UNIX domain socket waiting for requests + to arrive. These requests are generated by the NSS and PAM + clients and processed sequentially.</P +><P +>The technologies used to implement winbind are described + in detail below.</P +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN1421" +>11.4.1. Microsoft Remote Procedure Calls</A +></H2 +><P +>Over the last two years, efforts have been underway + by various Samba Team members to decode various aspects of + the Microsoft Remote Procedure Call (MSRPC) system. This + system is used for most network related operations between + Windows NT machines including remote management, user authentication + and print spooling. Although initially this work was done + to aid the implementation of Primary Domain Controller (PDC) + functionality in Samba, it has also yielded a body of code which + can be used for other purposes.</P +><P +>Winbind uses various MSRPC calls to enumerate domain users + and groups and to obtain detailed information about individual + users or groups. Other MSRPC calls can be used to authenticate + NT domain users and to change user passwords. By directly querying + a Windows PDC for user and group information, winbind maps the + NT account information onto UNIX user and group names.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN1425" +>11.4.2. Name Service Switch</A +></H2 +><P +>The Name Service Switch, or NSS, is a feature that is + present in many UNIX operating systems. It allows system + information such as hostnames, mail aliases and user information + to be resolved from different sources. For example, a standalone + UNIX workstation may resolve system information from a series of + flat files stored on the local filesystem. A networked workstation + may first attempt to resolve system information from local files, + and then consult a NIS database for user information or a DNS server + for hostname information.</P +><P +>The NSS application programming interface allows winbind + to present itself as a source of system information when + resolving UNIX usernames and groups. Winbind uses this interface, + and information obtained from a Windows NT server using MSRPC + calls to provide a new source of account enumeration. Using standard + UNIX library calls, one can enumerate the users and groups on + a UNIX machine running winbind and see all users and groups in + a NT domain plus any trusted domain as though they were local + users and groups.</P +><P +>The primary control file for NSS is + <TT +CLASS="FILENAME" +>/etc/nsswitch.conf</TT +>. + When a UNIX application makes a request to do a lookup + the C library looks in <TT +CLASS="FILENAME" +>/etc/nsswitch.conf</TT +> + for a line which matches the service type being requested, for + example the "passwd" service type is used when user or group names + are looked up. This config line species which implementations + of that service should be tried and in what order. If the passwd + config line is:</P +><P +><B +CLASS="COMMAND" +>passwd: files example</B +></P +><P +>then the C library will first load a module called + <TT +CLASS="FILENAME" +>/lib/libnss_files.so</TT +> followed by + the module <TT +CLASS="FILENAME" +>/lib/libnss_example.so</TT +>. The + C library will dynamically load each of these modules in turn + and call resolver functions within the modules to try to resolve + the request. Once the request is resolved the C library returns the + result to the application.</P +><P +>This NSS interface provides a very easy way for Winbind + to hook into the operating system. All that needs to be done + is to put <TT +CLASS="FILENAME" +>libnss_winbind.so</TT +> in <TT +CLASS="FILENAME" +>/lib/</TT +> + then add "winbind" into <TT +CLASS="FILENAME" +>/etc/nsswitch.conf</TT +> at + the appropriate place. The C library will then call Winbind to + resolve user and group names.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN1441" +>11.4.3. Pluggable Authentication Modules</A +></H2 +><P +>Pluggable Authentication Modules, also known as PAM, + is a system for abstracting authentication and authorization + technologies. With a PAM module it is possible to specify different + authentication methods for different system applications without + having to recompile these applications. PAM is also useful + for implementing a particular policy for authorization. For example, + a system administrator may only allow console logins from users + stored in the local password file but only allow users resolved from + a NIS database to log in over the network.</P +><P +>Winbind uses the authentication management and password + management PAM interface to integrate Windows NT users into a + UNIX system. This allows Windows NT users to log in to a UNIX + machine and be authenticated against a suitable Primary Domain + Controller. These users can also change their passwords and have + this change take effect directly on the Primary Domain Controller. + </P +><P +>PAM is configured by providing control files in the directory + <TT +CLASS="FILENAME" +>/etc/pam.d/</TT +> for each of the services that + require authentication. When an authentication request is made + by an application the PAM code in the C library looks up this + control file to determine what modules to load to do the + authentication check and in what order. This interface makes adding + a new authentication service for Winbind very easy, all that needs + to be done is that the <TT +CLASS="FILENAME" +>pam_winbind.so</TT +> module + is copied to <TT +CLASS="FILENAME" +>/lib/security/</TT +> and the PAM + control files for relevant services are updated to allow + authentication via winbind. See the PAM documentation + for more details.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN1449" +>11.4.4. User and Group ID Allocation</A +></H2 +><P +>When a user or group is created under Windows NT + is it allocated a numerical relative identifier (RID). This is + slightly different to UNIX which has a range of numbers that are + used to identify users, and the same range in which to identify + groups. It is winbind's job to convert RIDs to UNIX id numbers and + vice versa. When winbind is configured it is given part of the UNIX + user id space and a part of the UNIX group id space in which to + store Windows NT users and groups. If a Windows NT user is + resolved for the first time, it is allocated the next UNIX id from + the range. The same process applies for Windows NT groups. Over + time, winbind will have mapped all Windows NT users and groups + to UNIX user ids and group ids.</P +><P +>The results of this mapping are stored persistently in + an ID mapping database held in a tdb database). This ensures that + RIDs are mapped to UNIX IDs in a consistent way.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN1453" +>11.4.5. Result Caching</A +></H2 +><P +>An active system can generate a lot of user and group + name lookups. To reduce the network cost of these lookups winbind + uses a caching scheme based on the SAM sequence number supplied + by NT domain controllers. User or group information returned + by a PDC is cached by winbind along with a sequence number also + returned by the PDC. This sequence number is incremented by + Windows NT whenever any user or group information is modified. If + a cached entry has expired, the sequence number is requested from + the PDC and compared against the sequence number of the cached entry. + If the sequence numbers do not match, then the cached information + is discarded and up to date information is requested directly + from the PDC.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1456" +>11.5. Installation and Configuration</A +></H1 +><P +>Many thanks to John Trostel <A +HREF="mailto:jtrostel@snapserver.com" +TARGET="_top" +>jtrostel@snapserver.com</A +> +for providing the HOWTO for this section.</P +><P +>This HOWTO describes how to get winbind services up and running +to control access and authenticate users on your Linux box using +the winbind services which come with SAMBA 2.2.2.</P +><P +>There is also some Solaris specific information in +<TT +CLASS="FILENAME" +>docs/textdocs/Solaris-Winbind-HOWTO.txt</TT +>. +Future revisions of this document will incorporate that +information.</P +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN1463" +>11.5.1. Introduction</A +></H2 +><P +>This HOWTO describes the procedures used to get winbind up and +running on my RedHat 7.1 system. Winbind is capable of providing access +and authentication control for Windows Domain users through an NT +or Win2K PDC for 'regular' services, such as telnet a nd ftp, as +well for SAMBA services.</P +><P +>This HOWTO has been written from a 'RedHat-centric' perspective, so if +you are using another distribution, you may have to modify the instructions +somewhat to fit the way your distribution works.</P +><P +></P +><UL +><LI +><P +> <EM +>Why should I to this?</EM +> + </P +><P +>This allows the SAMBA administrator to rely on the + authentication mechanisms on the NT/Win2K PDC for the authentication + of domain members. NT/Win2K users no longer need to have separate + accounts on the SAMBA server. + </P +></LI +><LI +><P +> <EM +>Who should be reading this document?</EM +> + </P +><P +> This HOWTO is designed for system administrators. If you are + implementing SAMBA on a file server and wish to (fairly easily) + integrate existing NT/Win2K users from your PDC onto the + SAMBA server, this HOWTO is for you. That said, I am no NT or PAM + expert, so you may find a better or easier way to accomplish + these tasks. + </P +></LI +></UL +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN1476" +>11.5.2. Requirements</A +></H2 +><P +>If you have a samba configuration file that you are currently +using... <EM +>BACK IT UP!</EM +> If your system already uses PAM, +<EM +>back up the <TT +CLASS="FILENAME" +>/etc/pam.d</TT +> directory +contents!</EM +> If you haven't already made a boot disk, +<EM +>MAKE ONE NOW!</EM +></P +><P +>Messing with the pam configuration files can make it nearly impossible +to log in to yourmachine. That's why you want to be able to boot back +into your machine in single user mode and restore your +<TT +CLASS="FILENAME" +>/etc/pam.d</TT +> back to the original state they were in if +you get frustrated with the way things are going. ;-)</P +><P +>The latest version of SAMBA (version 2.2.2 as of this writing), now +includes a functioning winbindd daemon. Please refer to the +<A +HREF="http://samba.org/" +TARGET="_top" +>main SAMBA web page</A +> or, +better yet, your closest SAMBA mirror site for instructions on +downloading the source code.</P +><P +>To allow Domain users the ability to access SAMBA shares and +files, as well as potentially other services provided by your +SAMBA machine, PAM (pluggable authentication modules) must +be setup properly on your machine. In order to compile the +winbind modules, you should have at least the pam libraries resident +on your system. For recent RedHat systems (7.1, for instance), that +means <TT +CLASS="FILENAME" +>pam-0.74-22</TT +>. For best results, it is helpful to also +install the development packages in <TT +CLASS="FILENAME" +>pam-devel-0.74-22</TT +>.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN1490" +>11.5.3. Testing Things Out</A +></H2 +><P +>Before starting, it is probably best to kill off all the SAMBA +related daemons running on your server. Kill off all <B +CLASS="COMMAND" +>smbd</B +>, +<B +CLASS="COMMAND" +>nmbd</B +>, and <B +CLASS="COMMAND" +>winbindd</B +> processes that may +be running. To use PAM, you will want to make sure that you have the +standard PAM package (for RedHat) which supplies the <TT +CLASS="FILENAME" +>/etc/pam.d</TT +> +directory structure, including the pam modules are used by pam-aware +services, several pam libraries, and the <TT +CLASS="FILENAME" +>/usr/doc</TT +> +and <TT +CLASS="FILENAME" +>/usr/man</TT +> entries for pam. Winbind built better +in SAMBA if the pam-devel package was also installed. This package includes +the header files needed to compile pam-aware applications. For instance, +my RedHat system has both <TT +CLASS="FILENAME" +>pam-0.74-22</TT +> and +<TT +CLASS="FILENAME" +>pam-devel-0.74-22</TT +> RPMs installed.</P +><DIV +CLASS="SECT3" +><HR><H3 +CLASS="SECT3" +><A +NAME="AEN1501" +>11.5.3.1. Configure and compile SAMBA</A +></H3 +><P +>The configuration and compilation of SAMBA is pretty straightforward. +The first three steps may not be necessary depending upon +whether or not you have previously built the Samba binaries.</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>autoconf</B +> +<TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>make clean</B +> +<TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>rm config.cache</B +> +<TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>./configure --with-winbind</B +> +<TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>make</B +> +<TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>make install</B +></PRE +></TD +></TR +></TABLE +></P +><P +>This will, by default, install SAMBA in <TT +CLASS="FILENAME" +>/usr/local/samba</TT +>. +See the main SAMBA documentation if you want to install SAMBA somewhere else. +It will also build the winbindd executable and libraries. </P +></DIV +><DIV +CLASS="SECT3" +><HR><H3 +CLASS="SECT3" +><A +NAME="AEN1520" +>11.5.3.2. Configure <TT +CLASS="FILENAME" +>nsswitch.conf</TT +> and the +winbind libraries</A +></H3 +><P +>The libraries needed to run the <B +CLASS="COMMAND" +>winbindd</B +> daemon +through nsswitch need to be copied to their proper locations, so</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>cp ../samba/source/nsswitch/libnss_winbind.so /lib</B +></P +><P +>I also found it necessary to make the following symbolic link:</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2</B +></P +><P +>And, in the case of Sun solaris:</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1</B +> +<TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1</B +> +<TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2</B +></P +><P +>Now, as root you need to edit <TT +CLASS="FILENAME" +>/etc/nsswitch.conf</TT +> to +allow user and group entries to be visible from the <B +CLASS="COMMAND" +>winbindd</B +> +daemon. My <TT +CLASS="FILENAME" +>/etc/nsswitch.conf</TT +> file look like +this after editing:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +> passwd: files winbind + shadow: files + group: files winbind</PRE +></TD +></TR +></TABLE +></P +><P +> +The libraries needed by the winbind daemon will be automatically +entered into the <B +CLASS="COMMAND" +>ldconfig</B +> cache the next time +your system reboots, but it +is faster (and you don't need to reboot) if you do it manually:</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>/sbin/ldconfig -v | grep winbind</B +></P +><P +>This makes <TT +CLASS="FILENAME" +>libnss_winbind</TT +> available to winbindd +and echos back a check to you.</P +></DIV +><DIV +CLASS="SECT3" +><HR><H3 +CLASS="SECT3" +><A +NAME="AEN1553" +>11.5.3.3. Configure smb.conf</A +></H3 +><P +>Several parameters are needed in the smb.conf file to control +the behavior of <B +CLASS="COMMAND" +>winbindd</B +>. Configure +<TT +CLASS="FILENAME" +>smb.conf</TT +> These are described in more detail in +the <A +HREF="winbindd.8.html" +TARGET="_top" +>winbindd(8)</A +> man page. My +<TT +CLASS="FILENAME" +>smb.conf</TT +> file was modified to +include the following entries in the [global] section:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>[global] + <...> + # separate domain and username with '+', like DOMAIN+username + <A +HREF="winbindd.8.html#WINBINDSEPARATOR" +TARGET="_top" +>winbind separator</A +> = + + # use uids from 10000 to 20000 for domain users + <A +HREF="winbindd.8.html#WINBINDUID" +TARGET="_top" +>winbind uid</A +> = 10000-20000 + # use gids from 10000 to 20000 for domain groups + <A +HREF="winbindd.8.html#WINBINDGID" +TARGET="_top" +>winbind gid</A +> = 10000-20000 + # allow enumeration of winbind users and groups + <A +HREF="winbindd.8.html#WINBINDENUMUSERS" +TARGET="_top" +>winbind enum users</A +> = yes + <A +HREF="winbindd.8.html#WINBINDENUMGROUP" +TARGET="_top" +>winbind enum groups</A +> = yes + # give winbind users a real shell (only needed if they have telnet access) + <A +HREF="winbindd.8.html#TEMPLATEHOMEDIR" +TARGET="_top" +>template homedir</A +> = /home/winnt/%D/%U + <A +HREF="winbindd.8.html#TEMPLATESHELL" +TARGET="_top" +>template shell</A +> = /bin/bash</PRE +></TD +></TR +></TABLE +></P +></DIV +><DIV +CLASS="SECT3" +><HR><H3 +CLASS="SECT3" +><A +NAME="AEN1569" +>11.5.3.4. Join the SAMBA server to the PDC domain</A +></H3 +><P +>Enter the following command to make the SAMBA server join the +PDC domain, where <TT +CLASS="REPLACEABLE" +><I +>DOMAIN</I +></TT +> is the name of +your Windows domain and <TT +CLASS="REPLACEABLE" +><I +>Administrator</I +></TT +> is +a domain user who has administrative privileges in the domain.</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>/usr/local/samba/bin/net rpc join -s PDC -U Administrator</B +></P +><P +>The proper response to the command should be: "Joined the domain +<TT +CLASS="REPLACEABLE" +><I +>DOMAIN</I +></TT +>" where <TT +CLASS="REPLACEABLE" +><I +>DOMAIN</I +></TT +> +is your DOMAIN name.</P +></DIV +><DIV +CLASS="SECT3" +><HR><H3 +CLASS="SECT3" +><A +NAME="AEN1580" +>11.5.3.5. Start up the winbindd daemon and test it!</A +></H3 +><P +>Eventually, you will want to modify your smb startup script to +automatically invoke the winbindd daemon when the other parts of +SAMBA start, but it is possible to test out just the winbind +portion first. To start up winbind services, enter the following +command as root:</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>/usr/local/samba/bin/winbindd</B +></P +><P +>I'm always paranoid and like to make sure the daemon +is really running...</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>ps -ae | grep winbindd</B +></P +><P +>This command should produce output like this, if the daemon is running</P +><P +>3025 ? 00:00:00 winbindd</P +><P +>Now... for the real test, try to get some information about the +users on your PDC</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>/usr/local/samba/bin/wbinfo -u</B +></P +><P +> +This should echo back a list of users on your Windows users on +your PDC. For example, I get the following response:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>CEO+Administrator +CEO+burdell +CEO+Guest +CEO+jt-ad +CEO+krbtgt +CEO+TsInternetUser</PRE +></TD +></TR +></TABLE +></P +><P +>Obviously, I have named my domain 'CEO' and my <TT +CLASS="PARAMETER" +><I +>winbind +separator</I +></TT +> is '+'.</P +><P +>You can do the same sort of thing to get group information from +the PDC:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>/usr/local/samba/bin/wbinfo -g</B +> +CEO+Domain Admins +CEO+Domain Users +CEO+Domain Guests +CEO+Domain Computers +CEO+Domain Controllers +CEO+Cert Publishers +CEO+Schema Admins +CEO+Enterprise Admins +CEO+Group Policy Creator Owners</PRE +></TD +></TR +></TABLE +></P +><P +>The function 'getent' can now be used to get unified +lists of both local and PDC users and groups. +Try the following command:</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>getent passwd</B +></P +><P +>You should get a list that looks like your <TT +CLASS="FILENAME" +>/etc/passwd</TT +> +list followed by the domain users with their new uids, gids, home +directories and default shells.</P +><P +>The same thing can be done for groups with the command</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>getent group</B +></P +></DIV +><DIV +CLASS="SECT3" +><HR><H3 +CLASS="SECT3" +><A +NAME="AEN1616" +>11.5.3.6. Fix the init.d startup scripts</A +></H3 +><DIV +CLASS="SECT4" +><H4 +CLASS="SECT4" +><A +NAME="AEN1618" +>11.5.3.6.1. Linux</A +></H4 +><P +>The <B +CLASS="COMMAND" +>winbindd</B +> daemon needs to start up after the +<B +CLASS="COMMAND" +>smbd</B +> and <B +CLASS="COMMAND" +>nmbd</B +> daemons are running. +To accomplish this task, you need to modify the startup scripts of your system. They are located at <TT +CLASS="FILENAME" +>/etc/init.d/smb</TT +> in RedHat and +<TT +CLASS="FILENAME" +>/etc/init.d/samba</TT +> in Debian. +script to add commands to invoke this daemon in the proper sequence. My +startup script starts up <B +CLASS="COMMAND" +>smbd</B +>, +<B +CLASS="COMMAND" +>nmbd</B +>, and <B +CLASS="COMMAND" +>winbindd</B +> from the +<TT +CLASS="FILENAME" +>/usr/local/samba/bin</TT +> directory directly. The 'start' +function in the script looks like this:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>start() { + KIND="SMB" + echo -n $"Starting $KIND services: " + daemon /usr/local/samba/bin/smbd $SMBDOPTIONS + RETVAL=$? + echo + KIND="NMB" + echo -n $"Starting $KIND services: " + daemon /usr/local/samba/bin/nmbd $NMBDOPTIONS + RETVAL2=$? + echo + KIND="Winbind" + echo -n $"Starting $KIND services: " + daemon /usr/local/samba/bin/winbindd + RETVAL3=$? + echo + [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && touch /var/lock/subsys/smb || \ + RETVAL=1 + return $RETVAL +}</PRE +></TD +></TR +></TABLE +></P +><P +>The 'stop' function has a corresponding entry to shut down the +services and look s like this:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>stop() { + KIND="SMB" + echo -n $"Shutting down $KIND services: " + killproc smbd + RETVAL=$? + echo + KIND="NMB" + echo -n $"Shutting down $KIND services: " + killproc nmbd + RETVAL2=$? + echo + KIND="Winbind" + echo -n $"Shutting down $KIND services: " + killproc winbindd + RETVAL3=$? + [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && rm -f /var/lock/subsys/smb + echo "" + return $RETVAL +}</PRE +></TD +></TR +></TABLE +></P +></DIV +><DIV +CLASS="SECT4" +><HR><H4 +CLASS="SECT4" +><A +NAME="AEN1635" +>11.5.3.6.2. Solaris</A +></H4 +><P +>On solaris, you need to modify the +<TT +CLASS="FILENAME" +>/etc/init.d/samba.server</TT +> startup script. It usually +only starts smbd and nmbd but should now start winbindd too. If you +have samba installed in <TT +CLASS="FILENAME" +>/usr/local/samba/bin</TT +>, +the file could contains something like this:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>## +## samba.server +## + +if [ ! -d /usr/bin ] +then # /usr not mounted + exit +fi + +killproc() { # kill the named process(es) + pid=`/usr/bin/ps -e | + /usr/bin/grep -w $1 | + /usr/bin/sed -e 's/^ *//' -e 's/ .*//'` + [ "$pid" != "" ] && kill $pid +} + +# Start/stop processes required for samba server + +case "$1" in + +'start') +# +# Edit these lines to suit your installation (paths, workgroup, host) +# +echo Starting SMBD + /usr/local/samba/bin/smbd -D -s \ + /usr/local/samba/smb.conf + +echo Starting NMBD + /usr/local/samba/bin/nmbd -D -l \ + /usr/local/samba/var/log -s /usr/local/samba/smb.conf + +echo Starting Winbind Daemon + /usr/local/samba/bin/winbindd + ;; + +'stop') + killproc nmbd + killproc smbd + killproc winbindd + ;; + +*) + echo "Usage: /etc/init.d/samba.server { start | stop }" + ;; +esac</PRE +></TD +></TR +></TABLE +></P +></DIV +><DIV +CLASS="SECT4" +><HR><H4 +CLASS="SECT4" +><A +NAME="AEN1642" +>11.5.3.6.3. Restarting</A +></H4 +><P +>If you restart the <B +CLASS="COMMAND" +>smbd</B +>, <B +CLASS="COMMAND" +>nmbd</B +>, +and <B +CLASS="COMMAND" +>winbindd</B +> daemons at this point, you +should be able to connect to the samba server as a domain member just as +if you were a local user.</P +></DIV +></DIV +><DIV +CLASS="SECT3" +><HR><H3 +CLASS="SECT3" +><A +NAME="AEN1648" +>11.5.3.7. Configure Winbind and PAM</A +></H3 +><P +>If you have made it this far, you know that winbindd and samba are working +together. If you want to use winbind to provide authentication for other +services, keep reading. The pam configuration files need to be altered in +this step. (Did you remember to make backups of your original +<TT +CLASS="FILENAME" +>/etc/pam.d</TT +> files? If not, do it now.)</P +><P +>You will need a pam module to use winbindd with these other services. This +module will be compiled in the <TT +CLASS="FILENAME" +>../source/nsswitch</TT +> directory +by invoking the command</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>make nsswitch/pam_winbind.so</B +></P +><P +>from the <TT +CLASS="FILENAME" +>../source</TT +> directory. The +<TT +CLASS="FILENAME" +>pam_winbind.so</TT +> file should be copied to the location of +your other pam security modules. On my RedHat system, this was the +<TT +CLASS="FILENAME" +>/lib/security</TT +> directory. On Solaris, the pam security +modules reside in <TT +CLASS="FILENAME" +>/usr/lib/security</TT +>.</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>cp ../samba/source/nsswitch/pam_winbind.so /lib/security</B +></P +><DIV +CLASS="SECT4" +><HR><H4 +CLASS="SECT4" +><A +NAME="AEN1665" +>11.5.3.7.1. Linux/FreeBSD-specific PAM configuration</A +></H4 +><P +>The <TT +CLASS="FILENAME" +>/etc/pam.d/samba</TT +> file does not need to be changed. I +just left this fileas it was:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>auth required /lib/security/pam_stack.so service=system-auth +account required /lib/security/pam_stack.so service=system-auth</PRE +></TD +></TR +></TABLE +></P +><P +>The other services that I modified to allow the use of winbind +as an authentication service were the normal login on the console (or a terminal +session), telnet logins, and ftp service. In order to enable these +services, you may first need to change the entries in +<TT +CLASS="FILENAME" +>/etc/xinetd.d</TT +> (or <TT +CLASS="FILENAME" +>/etc/inetd.conf</TT +>). +RedHat 7.1 uses the new xinetd.d structure, in this case you need +to change the lines in <TT +CLASS="FILENAME" +>/etc/xinetd.d/telnet</TT +> +and <TT +CLASS="FILENAME" +>/etc/xinetd.d/wu-ftp</TT +> from </P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>enable = no</PRE +></TD +></TR +></TABLE +></P +><P +>to</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>enable = yes</PRE +></TD +></TR +></TABLE +></P +><P +> +For ftp services to work properly, you will also need to either +have individual directories for the domain users already present on +the server, or change the home directory template to a general +directory for all domain users. These can be easily set using +the <TT +CLASS="FILENAME" +>smb.conf</TT +> global entry +<B +CLASS="COMMAND" +>template homedir</B +>.</P +><P +>The <TT +CLASS="FILENAME" +>/etc/pam.d/ftp</TT +> file can be changed +to allow winbind ftp access in a manner similar to the +samba file. My <TT +CLASS="FILENAME" +>/etc/pam.d/ftp</TT +> file was +changed to look like this:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>auth required /lib/security/pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed +auth sufficient /lib/security/pam_winbind.so +auth required /lib/security/pam_stack.so service=system-auth +auth required /lib/security/pam_shells.so +account sufficient /lib/security/pam_winbind.so +account required /lib/security/pam_stack.so service=system-auth +session required /lib/security/pam_stack.so service=system-auth</PRE +></TD +></TR +></TABLE +></P +><P +>The <TT +CLASS="FILENAME" +>/etc/pam.d/login</TT +> file can be changed nearly the +same way. It now looks like this:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>auth required /lib/security/pam_securetty.so +auth sufficient /lib/security/pam_winbind.so +auth sufficient /lib/security/pam_unix.so use_first_pass +auth required /lib/security/pam_stack.so service=system-auth +auth required /lib/security/pam_nologin.so +account sufficient /lib/security/pam_winbind.so +account required /lib/security/pam_stack.so service=system-auth +password required /lib/security/pam_stack.so service=system-auth +session required /lib/security/pam_stack.so service=system-auth +session optional /lib/security/pam_console.so</PRE +></TD +></TR +></TABLE +></P +><P +>In this case, I added the <B +CLASS="COMMAND" +>auth sufficient /lib/security/pam_winbind.so</B +> +lines as before, but also added the <B +CLASS="COMMAND" +>required pam_securetty.so</B +> +above it, to disallow root logins over the network. I also added a +<B +CLASS="COMMAND" +>sufficient /lib/security/pam_unix.so use_first_pass</B +> +line after the <B +CLASS="COMMAND" +>winbind.so</B +> line to get rid of annoying +double prompts for passwords.</P +></DIV +><DIV +CLASS="SECT4" +><HR><H4 +CLASS="SECT4" +><A +NAME="AEN1698" +>11.5.3.7.2. Solaris-specific configuration</A +></H4 +><P +>The /etc/pam.conf needs to be changed. I changed this file so that my Domain +users can logon both locally as well as telnet.The following are the changes +that I made.You can customize the pam.conf file as per your requirements,but +be sure of those changes because in the worst case it will leave your system +nearly impossible to boot.</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +># +#ident "@(#)pam.conf 1.14 99/09/16 SMI" +# +# Copyright (c) 1996-1999, Sun Microsystems, Inc. +# All Rights Reserved. +# +# PAM configuration +# +# Authentication management +# +login auth required /usr/lib/security/pam_winbind.so +login auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass +login auth required /usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass +# +rlogin auth sufficient /usr/lib/security/pam_winbind.so +rlogin auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1 +rlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass +# +dtlogin auth sufficient /usr/lib/security/pam_winbind.so +dtlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass +# +rsh auth required /usr/lib/security/$ISA/pam_rhosts_auth.so.1 +other auth sufficient /usr/lib/security/pam_winbind.so +other auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass +# +# Account management +# +login account sufficient /usr/lib/security/pam_winbind.so +login account requisite /usr/lib/security/$ISA/pam_roles.so.1 +login account required /usr/lib/security/$ISA/pam_unix.so.1 +# +dtlogin account sufficient /usr/lib/security/pam_winbind.so +dtlogin account requisite /usr/lib/security/$ISA/pam_roles.so.1 +dtlogin account required /usr/lib/security/$ISA/pam_unix.so.1 +# +other account sufficient /usr/lib/security/pam_winbind.so +other account requisite /usr/lib/security/$ISA/pam_roles.so.1 +other account required /usr/lib/security/$ISA/pam_unix.so.1 +# +# Session management +# +other session required /usr/lib/security/$ISA/pam_unix.so.1 +# +# Password management +# +#other password sufficient /usr/lib/security/pam_winbind.so +other password required /usr/lib/security/$ISA/pam_unix.so.1 +dtsession auth required /usr/lib/security/$ISA/pam_unix.so.1 +# +# Support for Kerberos V5 authentication (uncomment to use Kerberos) +# +#rlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#login auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#dtlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#other auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#dtlogin account optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other account optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other session optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass</PRE +></TD +></TR +></TABLE +></P +><P +>I also added a try_first_pass line after the winbind.so line to get rid of +annoying double prompts for passwords.</P +><P +>Now restart your Samba & try connecting through your application that you +configured in the pam.conf.</P +></DIV +></DIV +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1705" +>11.6. Limitations</A +></H1 +><P +>Winbind has a number of limitations in its current + released version that we hope to overcome in future + releases:</P +><P +></P +><UL +><LI +><P +>Winbind is currently only available for + the Linux operating system, although ports to other operating + systems are certainly possible. For such ports to be feasible, + we require the C library of the target operating system to + support the Name Service Switch and Pluggable Authentication + Modules systems. This is becoming more common as NSS and + PAM gain support among UNIX vendors.</P +></LI +><LI +><P +>The mappings of Windows NT RIDs to UNIX ids + is not made algorithmically and depends on the order in which + unmapped users or groups are seen by winbind. It may be difficult + to recover the mappings of rid to UNIX id mapping if the file + containing this information is corrupted or destroyed.</P +></LI +><LI +><P +>Currently the winbind PAM module does not take + into account possible workstation and logon time restrictions + that may be been set for Windows NT users.</P +></LI +></UL +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN1715" +>11.7. Conclusion</A +></H1 +><P +>The winbind system, through the use of the Name Service + Switch, Pluggable Authentication Modules, and appropriate + Microsoft RPC calls have allowed us to provide seamless + integration of Microsoft Windows NT domain users on a + UNIX system. The result is a great reduction in the administrative + cost of running a mixed UNIX and NT network.</P +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A NAME="SAMBA-PDC" ->Chapter 8. How to Configure Samba 2.2 as a Primary Domain Controller</A +>Chapter 12. How to Configure Samba 2.2 as a Primary Domain Controller</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN1094" ->8.1. Prerequisite Reading</A +NAME="AEN1735" +>12.1. Prerequisite Reading</A ></H1 ><P >Before you continue reading in this chapter, please make sure @@ -5706,8 +8896,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1100" ->8.2. Background</A +NAME="AEN1741" +>12.2. Background</A ></H1 ><DIV CLASS="NOTE" @@ -5838,8 +9028,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1139" ->8.3. Configuring the Samba Domain Controller</A +NAME="AEN1780" +>12.3. Configuring the Samba Domain Controller</A ></H1 ><P >The first step in creating a working Samba PDC is to @@ -6059,8 +9249,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1182" ->8.4. Creating Machine Trust Accounts and Joining Clients to the +NAME="AEN1823" +>12.4. Creating Machine Trust Accounts and Joining Clients to the Domain</A ></H1 ><P @@ -6133,8 +9323,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN1201" ->8.4.1. Manual Creation of Machine Trust Accounts</A +NAME="AEN1842" +>12.4.1. Manual Creation of Machine Trust Accounts</A ></H2 ><P >The first step in manually creating a machine trust account is to @@ -6300,8 +9490,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN1236" ->8.4.2. "On-the-Fly" Creation of Machine Trust Accounts</A +NAME="AEN1877" +>12.4.2. "On-the-Fly" Creation of Machine Trust Accounts</A ></H2 ><P >The second (and recommended) way of creating machine trust accounts is @@ -6346,8 +9536,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN1245" ->8.4.3. Joining the Client to the Domain</A +NAME="AEN1886" +>12.4.3. Joining the Client to the Domain</A ></H2 ><P >The procedure for joining a client to the domain varies with the @@ -6406,8 +9596,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1260" ->8.5. Common Problems and Errors</A +NAME="AEN1901" +>12.5. Common Problems and Errors</A ></H1 ><P ></P @@ -6605,8 +9795,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1308" ->8.6. System Policies and Profiles</A +NAME="AEN1949" +>12.6. System Policies and Profiles</A ></H1 ><P >Much of the information necessary to implement System Policies and @@ -6762,8 +9952,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1352" ->8.7. What other help can I get?</A +NAME="AEN1993" +>12.7. What other help can I get?</A ></H1 ><P >There are many sources of information available in the form @@ -7158,8 +10348,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1466" ->8.8. Domain Control for Windows 9x/ME</A +NAME="AEN2107" +>12.8. Domain Control for Windows 9x/ME</A ></H1 ><DIV CLASS="NOTE" @@ -7272,8 +10462,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN1492" ->8.8.1. Configuration Instructions: Network Logons</A +NAME="AEN2133" +>12.8.1. Configuration Instructions: Network Logons</A ></H2 ><P >The main difference between a PDC and a Windows 9x logon @@ -7366,8 +10556,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN1511" ->8.8.2. Configuration Instructions: Setting up Roaming User Profiles</A +NAME="AEN2152" +>12.8.2. Configuration Instructions: Setting up Roaming User Profiles</A ></H2 ><DIV CLASS="WARNING" @@ -7413,8 +10603,8 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN1519" ->8.8.2.1. Windows NT Configuration</A +NAME="AEN2160" +>12.8.2.1. Windows NT Configuration</A ></H3 ><P >To support WinNT clients, in the [global] section of smb.conf set the @@ -7457,8 +10647,8 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN1527" ->8.8.2.2. Windows 9X Configuration</A +NAME="AEN2168" +>12.8.2.2. Windows 9X Configuration</A ></H3 ><P >To support Win9X clients, you must use the "logon home" parameter. Samba has @@ -7497,8 +10687,8 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN1535" ->8.8.2.3. Win9X and WinNT Configuration</A +NAME="AEN2176" +>12.8.2.3. Win9X and WinNT Configuration</A ></H3 ><P >You can support profiles for both Win9X and WinNT clients by setting both the @@ -7535,8 +10725,8 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN1542" ->8.8.2.4. Windows 9X Profile Setup</A +NAME="AEN2183" +>12.8.2.4. Windows 9X Profile Setup</A ></H3 ><P >When a user first logs in on Windows 9X, the file user.DAT is created, @@ -7691,8 +10881,8 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN1578" ->8.8.2.5. Windows NT Workstation 4.0</A +NAME="AEN2219" +>12.8.2.5. Windows NT Workstation 4.0</A ></H3 ><P >When a user first logs in to a Windows NT Workstation, the profile @@ -7773,8 +10963,8 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN1591" ->8.8.2.6. Windows NT Server</A +NAME="AEN2232" +>12.8.2.6. Windows NT Server</A ></H3 ><P >There is nothing to stop you specifying any path that you like for the @@ -7787,8 +10977,8 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN1594" ->8.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0</A +NAME="AEN2235" +>12.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0</A ></H3 ><DIV CLASS="WARNING" @@ -7815,7 +11005,7 @@ ALIGN="LEFT" ></TABLE ></DIV ><P ->The default logon path is \\%N\U%. NT Workstation will attempt to create +>The default logon path is \\%N\%U. NT Workstation will attempt to create a directory "\\samba-server\username.PDS" if you specify the logon path as "\\samba-server\username" with the NT User Manager. Therefore, you will need to specify (for example) "\\samba-server\username\profile". @@ -7852,8 +11042,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1604" ->8.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba</A +NAME="AEN2245" +>12.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba</A ></H1 ><DIV CLASS="WARNING" @@ -7974,15 +11164,15 @@ CLASS="CHAPTER" ><HR><H1 ><A NAME="SAMBA-BDC" ->Chapter 9. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain</A +>Chapter 13. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN1640" ->9.1. Prerequisite Reading</A +NAME="AEN2281" +>13.1. Prerequisite Reading</A ></H1 ><P >Before you continue reading in this chapter, please make sure @@ -7998,8 +11188,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1644" ->9.2. Background</A +NAME="AEN2285" +>13.2. Background</A ></H1 ><P >What is a Domain Controller? It is a machine that is able to answer @@ -8052,8 +11242,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1652" ->9.3. What qualifies a Domain Controller on the network?</A +NAME="AEN2293" +>13.3. What qualifies a Domain Controller on the network?</A ></H1 ><P >Every machine that is a Domain Controller for the domain SAMBA has to @@ -8069,8 +11259,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN1655" ->9.3.1. How does a Workstation find its domain controller?</A +NAME="AEN2296" +>13.3.1. How does a Workstation find its domain controller?</A ></H2 ><P >A NT workstation in the domain SAMBA that wants a local user to be @@ -8088,8 +11278,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN1658" ->9.3.2. When is the PDC needed?</A +NAME="AEN2299" +>13.3.2. When is the PDC needed?</A ></H2 ><P >Whenever a user wants to change his password, this has to be done on @@ -8104,8 +11294,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1661" ->9.4. Can Samba be a Backup Domain Controller?</A +NAME="AEN2302" +>13.4. Can Samba be a Backup Domain Controller?</A ></H1 ><P >With version 2.2, no. The native NT SAM replication protocols have @@ -8123,8 +11313,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1665" ->9.5. How do I set up a Samba BDC?</A +NAME="AEN2306" +>13.5. How do I set up a Samba BDC?</A ></H1 ><P >Several things have to be done:</P @@ -8193,8 +11383,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN1681" ->9.5.1. How do I replicate the smbpasswd file?</A +NAME="AEN2322" +>13.5.1. How do I replicate the smbpasswd file?</A ></H2 ><P >Replication of the smbpasswd file is sensitive. It has to be done @@ -8216,15 +11406,15 @@ CLASS="CHAPTER" ><HR><H1 ><A NAME="SAMBA-LDAP-HOWTO" ->Chapter 10. Storing Samba's User/Machine Account information in an LDAP Directory</A +>Chapter 14. Storing Samba's User/Machine Account information in an LDAP Directory</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN1702" ->10.1. Purpose</A +NAME="AEN2343" +>14.1. Purpose</A ></H1 ><P >This document describes how to use an LDAP directory for storing Samba user @@ -8291,8 +11481,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1722" ->10.2. Introduction</A +NAME="AEN2363" +>14.2. Introduction</A ></H1 ><P >Traditionally, when configuring <A @@ -8408,8 +11598,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1751" ->10.3. Supported LDAP Servers</A +NAME="AEN2392" +>14.3. Supported LDAP Servers</A ></H1 ><P >The LDAP samdb code in 2.2.3 has been developed and tested using the OpenLDAP @@ -8433,8 +11623,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1756" ->10.4. Schema and Relationship to the RFC 2307 posixAccount</A +NAME="AEN2397" +>14.4. Schema and Relationship to the RFC 2307 posixAccount</A ></H1 ><P >Samba 2.2.3 includes the necessary schema file for OpenLDAP 2.0 in @@ -8501,16 +11691,16 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1768" ->10.5. Configuring Samba with LDAP</A +NAME="AEN2409" +>14.5. Configuring Samba with LDAP</A ></H1 ><DIV CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN1770" ->10.5.1. OpenLDAP configuration</A +NAME="AEN2411" +>14.5.1. OpenLDAP configuration</A ></H2 ><P >To include support for the sambaAccount object in an OpenLDAP directory @@ -8609,8 +11799,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN1787" ->10.5.2. Configuring Samba</A +NAME="AEN2428" +>14.5.2. Configuring Samba</A ></H2 ><P >The following parameters are available in smb.conf only with <TT @@ -8738,8 +11928,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1815" ->10.6. Accounts and Groups management</A +NAME="AEN2456" +>14.6. Accounts and Groups management</A ></H1 ><P >As users accounts are managed thru the sambaAccount objectclass, you should @@ -8763,8 +11953,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1820" ->10.7. Security and sambaAccount</A +NAME="AEN2461" +>14.7. Security and sambaAccount</A ></H1 ><P >There are two important points to remember when discussing the security @@ -8843,8 +12033,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1840" ->10.8. LDAP specials attributes for sambaAccounts</A +NAME="AEN2481" +>14.8. LDAP specials attributes for sambaAccounts</A ></H1 ><P >The sambaAccount objectclass is composed of the following attributes:</P @@ -9054,8 +12244,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1910" ->10.9. Example LDIF Entries for a sambaAccount</A +NAME="AEN2551" +>14.9. Example LDIF Entries for a sambaAccount</A ></H1 ><P >The following is a working LDIF with the inclusion of the posixAccount objectclass:</P @@ -9130,8 +12320,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1918" ->10.10. Comments</A +NAME="AEN2559" +>14.10. Comments</A ></H1 ><P >Please mail all comments regarding this HOWTO to <A @@ -9146,569 +12336,159 @@ last updated to reflect the Samba 2.2.3 release. </P CLASS="CHAPTER" ><HR><H1 ><A -NAME="WINBIND" ->Chapter 11. Unified Logons between Windows NT and UNIX using Winbind</A +NAME="IMPROVED-BROWSING" +>Chapter 15. Improved browsing in samba</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN1947" ->11.1. Abstract</A -></H1 -><P ->Integration of UNIX and Microsoft Windows NT through - a unified logon has been considered a "holy grail" in heterogeneous - computing environments for a long time. We present - <EM ->winbind</EM ->, a component of the Samba suite - of programs as a solution to the unified logon problem. Winbind - uses a UNIX implementation - of Microsoft RPC calls, Pluggable Authentication Modules, and the Name - Service Switch to allow Windows NT domain users to appear and operate - as UNIX users on a UNIX machine. This paper describes the winbind - system, explaining the functionality it provides, how it is configured, - and how it works internally.</P -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN1951" ->11.2. Introduction</A +NAME="AEN2570" +>15.1. Overview of browsing</A ></H1 ><P ->It is well known that UNIX and Microsoft Windows NT have - different models for representing user and group information and - use different technologies for implementing them. This fact has - made it difficult to integrate the two systems in a satisfactory - manner.</P -><P ->One common solution in use today has been to create - identically named user accounts on both the UNIX and Windows systems - and use the Samba suite of programs to provide file and print services - between the two. This solution is far from perfect however, as - adding and deleting users on both sets of machines becomes a chore - and two sets of passwords are required both of which - can lead to synchronization problems between the UNIX and Windows - systems and confusion for users.</P -><P ->We divide the unified logon problem for UNIX machines into - three smaller problems:</P -><P -></P -><UL -><LI -><P ->Obtaining Windows NT user and group information - </P -></LI -><LI -><P ->Authenticating Windows NT users - </P -></LI -><LI -><P ->Password changing for Windows NT users - </P -></LI -></UL +>SMB networking provides a mechanism by which clients can access a list +of machines in a network, a so-called "browse list". This list +contains machines that are ready to offer file and/or print services +to other machines within the network. Thus it does not include +machines which aren't currently able to do server tasks. The browse +list is heavily used by all SMB clients. Configuration of SMB +browsing has been problematic for some Samba users, hence this +document.</P ><P ->Ideally, a prospective solution to the unified logon problem - would satisfy all the above components without duplication of - information on the UNIX machines and without creating additional - tasks for the system administrator when maintaining users and - groups on either system. The winbind system provides a simple - and elegant solution to all three components of the unified logon - problem.</P +>Browsing will NOT work if name resolution from NetBIOS names to IP +addresses does not function correctly. Use of a WINS server is highly +recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. +WINS allows remote segment clients to obtain NetBIOS name_type information +that can NOT be provided by any other means of name resolution.</P ></DIV ><DIV CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1964" ->11.3. What Winbind Provides</A +NAME="AEN2574" +>15.2. Browsing support in samba</A ></H1 ><P ->Winbind unifies UNIX and Windows NT account management by - allowing a UNIX box to become a full member of a NT domain. Once - this is done the UNIX box will see NT users and groups as if - they were native UNIX users and groups, allowing the NT domain - to be used in much the same manner that NIS+ is used within - UNIX-only environments.</P +>Samba now fully supports browsing. The browsing is supported by nmbd +and is also controlled by options in the smb.conf file (see smb.conf(5)).</P ><P ->The end result is that whenever any - program on the UNIX machine asks the operating system to lookup - a user or group name, the query will be resolved by asking the - NT domain controller for the specified domain to do the lookup. - Because Winbind hooks into the operating system at a low level - (via the NSS name resolution modules in the C library) this - redirection to the NT domain controller is completely - transparent.</P +>Samba can act as a local browse master for a workgroup and the ability +for samba to support domain logons and scripts is now available. See +DOMAIN.txt for more information on domain logons.</P ><P ->Users on the UNIX machine can then use NT user and group - names as they would use "native" UNIX names. They can chown files - so that they are owned by NT domain users or even login to the - UNIX machine and run a UNIX X-Window session as a domain user.</P +>Samba can also act as a domain master browser for a workgroup. This +means that it will collate lists from local browse masters into a +wide area network server list. In order for browse clients to +resolve the names they may find in this list, it is recommended that +both samba and your clients use a WINS server.</P ><P ->The only obvious indication that Winbind is being used is - that user and group names take the form DOMAIN\user and - DOMAIN\group. This is necessary as it allows Winbind to determine - that redirection to a domain controller is wanted for a particular - lookup and which trusted domain is being referenced.</P +>Note that you should NOT set Samba to be the domain master for a +workgroup that has the same name as an NT Domain: on each wide area +network, you must only ever have one domain master browser per workgroup, +regardless of whether it is NT, Samba or any other type of domain master +that is providing this service.</P ><P ->Additionally, Winbind provides an authentication service - that hooks into the Pluggable Authentication Modules (PAM) system - to provide authentication via a NT domain to any PAM enabled - applications. This capability solves the problem of synchronizing - passwords between systems since all passwords are stored in a single - location (on the domain controller).</P -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN1971" ->11.3.1. Target Uses</A -></H2 +>[Note that nmbd can be configured as a WINS server, but it is not +necessary to specifically use samba as your WINS server. NTAS can +be configured as your WINS server. In a mixed NT server and +samba environment on a Wide Area Network, it is recommended that +you use the NT server's WINS server capabilities. In a samba-only +environment, it is recommended that you use one and only one nmbd +as your WINS server].</P ><P ->Winbind is targeted at organizations that have an - existing NT based domain infrastructure into which they wish - to put UNIX workstations or servers. Winbind will allow these - organizations to deploy UNIX workstations without having to - maintain a separate account infrastructure. This greatly - simplifies the administrative overhead of deploying UNIX - workstations into a NT based organization.</P +>To get browsing to work you need to run nmbd as usual, but will need +to use the "workgroup" option in smb.conf to control what workgroup +Samba becomes a part of.</P ><P ->Another interesting way in which we expect Winbind to - be used is as a central part of UNIX based appliances. Appliances - that provide file and print services to Microsoft based networks - will be able to use Winbind to provide seamless integration of - the appliance into the domain.</P -></DIV +>Samba also has a useful option for a Samba server to offer itself for +browsing on another subnet. It is recommended that this option is only +used for 'unusual' purposes: announcements over the internet, for +example. See "remote announce" in the smb.conf man page. </P ></DIV ><DIV CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN1975" ->11.4. How Winbind Works</A +NAME="AEN2583" +>15.3. Problem resolution</A ></H1 ><P ->The winbind system is designed around a client/server - architecture. A long running <B -CLASS="COMMAND" ->winbindd</B -> daemon - listens on a UNIX domain socket waiting for requests - to arrive. These requests are generated by the NSS and PAM - clients and processed sequentially.</P -><P ->The technologies used to implement winbind are described - in detail below.</P -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN1980" ->11.4.1. Microsoft Remote Procedure Calls</A -></H2 -><P ->Over the last two years, efforts have been underway - by various Samba Team members to decode various aspects of - the Microsoft Remote Procedure Call (MSRPC) system. This - system is used for most network related operations between - Windows NT machines including remote management, user authentication - and print spooling. Although initially this work was done - to aid the implementation of Primary Domain Controller (PDC) - functionality in Samba, it has also yielded a body of code which - can be used for other purposes.</P -><P ->Winbind uses various MSRPC calls to enumerate domain users - and groups and to obtain detailed information about individual - users or groups. Other MSRPC calls can be used to authenticate - NT domain users and to change user passwords. By directly querying - a Windows PDC for user and group information, winbind maps the - NT account information onto UNIX user and group names.</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN1984" ->11.4.2. Name Service Switch</A -></H2 -><P ->The Name Service Switch, or NSS, is a feature that is - present in many UNIX operating systems. It allows system - information such as hostnames, mail aliases and user information - to be resolved from different sources. For example, a standalone - UNIX workstation may resolve system information from a series of - flat files stored on the local filesystem. A networked workstation - may first attempt to resolve system information from local files, - and then consult a NIS database for user information or a DNS server - for hostname information.</P -><P ->The NSS application programming interface allows winbind - to present itself as a source of system information when - resolving UNIX usernames and groups. Winbind uses this interface, - and information obtained from a Windows NT server using MSRPC - calls to provide a new source of account enumeration. Using standard - UNIX library calls, one can enumerate the users and groups on - a UNIX machine running winbind and see all users and groups in - a NT domain plus any trusted domain as though they were local - users and groups.</P -><P ->The primary control file for NSS is - <TT -CLASS="FILENAME" ->/etc/nsswitch.conf</TT ->. - When a UNIX application makes a request to do a lookup - the C library looks in <TT -CLASS="FILENAME" ->/etc/nsswitch.conf</TT -> - for a line which matches the service type being requested, for - example the "passwd" service type is used when user or group names - are looked up. This config line species which implementations - of that service should be tried and in what order. If the passwd - config line is:</P -><P -><B -CLASS="COMMAND" ->passwd: files example</B -></P -><P ->then the C library will first load a module called - <TT -CLASS="FILENAME" ->/lib/libnss_files.so</TT -> followed by - the module <TT -CLASS="FILENAME" ->/lib/libnss_example.so</TT ->. The - C library will dynamically load each of these modules in turn - and call resolver functions within the modules to try to resolve - the request. Once the request is resolved the C library returns the - result to the application.</P -><P ->This NSS interface provides a very easy way for Winbind - to hook into the operating system. All that needs to be done - is to put <TT -CLASS="FILENAME" ->libnss_winbind.so</TT -> in <TT -CLASS="FILENAME" ->/lib/</TT -> - then add "winbind" into <TT -CLASS="FILENAME" ->/etc/nsswitch.conf</TT -> at - the appropriate place. The C library will then call Winbind to - resolve user and group names.</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN2000" ->11.4.3. Pluggable Authentication Modules</A -></H2 -><P ->Pluggable Authentication Modules, also known as PAM, - is a system for abstracting authentication and authorization - technologies. With a PAM module it is possible to specify different - authentication methods for different system applications without - having to recompile these applications. PAM is also useful - for implementing a particular policy for authorization. For example, - a system administrator may only allow console logins from users - stored in the local password file but only allow users resolved from - a NIS database to log in over the network.</P -><P ->Winbind uses the authentication management and password - management PAM interface to integrate Windows NT users into a - UNIX system. This allows Windows NT users to log in to a UNIX - machine and be authenticated against a suitable Primary Domain - Controller. These users can also change their passwords and have - this change take effect directly on the Primary Domain Controller. - </P +>If something doesn't work then hopefully the log.nmb file will help +you track down the problem. Try a debug level of 2 or 3 for finding +problems. Also note that the current browse list usually gets stored +in text form in a file called browse.dat.</P ><P ->PAM is configured by providing control files in the directory - <TT -CLASS="FILENAME" ->/etc/pam.d/</TT -> for each of the services that - require authentication. When an authentication request is made - by an application the PAM code in the C library looks up this - control file to determine what modules to load to do the - authentication check and in what order. This interface makes adding - a new authentication service for Winbind very easy, all that needs - to be done is that the <TT -CLASS="FILENAME" ->pam_winbind.so</TT -> module - is copied to <TT -CLASS="FILENAME" ->/lib/security/</TT -> and the PAM - control files for relevant services are updated to allow - authentication via winbind. See the PAM documentation - for more details.</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN2008" ->11.4.4. User and Group ID Allocation</A -></H2 +>Note that if it doesn't work for you, then you should still be able to +type the server name as \\SERVER in filemanager then hit enter and +filemanager should display the list of available shares.</P ><P ->When a user or group is created under Windows NT - is it allocated a numerical relative identifier (RID). This is - slightly different to UNIX which has a range of numbers that are - used to identify users, and the same range in which to identify - groups. It is winbind's job to convert RIDs to UNIX id numbers and - vice versa. When winbind is configured it is given part of the UNIX - user id space and a part of the UNIX group id space in which to - store Windows NT users and groups. If a Windows NT user is - resolved for the first time, it is allocated the next UNIX id from - the range. The same process applies for Windows NT groups. Over - time, winbind will have mapped all Windows NT users and groups - to UNIX user ids and group ids.</P +>Some people find browsing fails because they don't have the global +"guest account" set to a valid account. Remember that the IPC$ +connection that lists the shares is done as guest, and thus you must +have a valid guest account.</P ><P ->The results of this mapping are stored persistently in - an ID mapping database held in a tdb database). This ensures that - RIDs are mapped to UNIX IDs in a consistent way.</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN2012" ->11.4.5. Result Caching</A -></H2 +>Also, a lot of people are getting bitten by the problem of too many +parameters on the command line of nmbd in inetd.conf. This trick is to +not use spaces between the option and the parameter (eg: -d2 instead +of -d 2), and to not use the -B and -N options. New versions of nmbd +are now far more likely to correctly find your broadcast and network +address, so in most cases these aren't needed.</P ><P ->An active system can generate a lot of user and group - name lookups. To reduce the network cost of these lookups winbind - uses a caching scheme based on the SAM sequence number supplied - by NT domain controllers. User or group information returned - by a PDC is cached by winbind along with a sequence number also - returned by the PDC. This sequence number is incremented by - Windows NT whenever any user or group information is modified. If - a cached entry has expired, the sequence number is requested from - the PDC and compared against the sequence number of the cached entry. - If the sequence numbers do not match, then the cached information - is discarded and up to date information is requested directly - from the PDC.</P -></DIV +>The other big problem people have is that their broadcast address, +netmask or IP address is wrong (specified with the "interfaces" option +in smb.conf)</P ></DIV ><DIV CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN2015" ->11.5. Installation and Configuration</A +NAME="AEN2590" +>15.4. Browsing across subnets</A ></H1 ><P ->Many thanks to John Trostel <A -HREF="mailto:jtrostel@snapserver.com" -TARGET="_top" ->jtrostel@snapserver.com</A -> -for providing the HOWTO for this section.</P -><P ->This HOWTO describes how to get winbind services up and running -to control access and authenticate users on your Linux box using -the winbind services which come with SAMBA 2.2.2.</P -><P ->There is also some Solaris specific information in -<TT -CLASS="FILENAME" ->docs/textdocs/Solaris-Winbind-HOWTO.txt</TT ->. -Future revisions of this document will incorporate that -information.</P -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN2022" ->11.5.1. Introduction</A -></H2 -><P ->This HOWTO describes the procedures used to get winbind up and -running on my RedHat 7.1 system. Winbind is capable of providing access -and authentication control for Windows Domain users through an NT -or Win2K PDC for 'regular' services, such as telnet a nd ftp, as -well for SAMBA services.</P -><P ->This HOWTO has been written from a 'RedHat-centric' perspective, so if -you are using another distribution, you may have to modify the instructions -somewhat to fit the way your distribution works.</P -><P -></P -><UL -><LI -><P -> <EM ->Why should I to this?</EM -> - </P -><P ->This allows the SAMBA administrator to rely on the - authentication mechanisms on the NT/Win2K PDC for the authentication - of domain members. NT/Win2K users no longer need to have separate - accounts on the SAMBA server. - </P -></LI -><LI -><P -> <EM ->Who should be reading this document?</EM -> - </P -><P -> This HOWTO is designed for system administrators. If you are - implementing SAMBA on a file server and wish to (fairly easily) - integrate existing NT/Win2K users from your PDC onto the - SAMBA server, this HOWTO is for you. That said, I am no NT or PAM - expert, so you may find a better or easier way to accomplish - these tasks. - </P -></LI -></UL -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN2035" ->11.5.2. Requirements</A -></H2 -><P ->If you have a samba configuration file that you are currently -using... <EM ->BACK IT UP!</EM -> If your system already uses PAM, -<EM ->back up the <TT -CLASS="FILENAME" ->/etc/pam.d</TT -> directory -contents!</EM -> If you haven't already made a boot disk, -<EM ->MAKE ONE NOW!</EM -></P -><P ->Messing with the pam configuration files can make it nearly impossible -to log in to yourmachine. That's why you want to be able to boot back -into your machine in single user mode and restore your -<TT -CLASS="FILENAME" ->/etc/pam.d</TT -> back to the original state they were in if -you get frustrated with the way things are going. ;-)</P -><P ->The latest version of SAMBA (version 2.2.2 as of this writing), now -includes a functioning winbindd daemon. Please refer to the -<A -HREF="http://samba.org/" -TARGET="_top" ->main SAMBA web page</A -> or, -better yet, your closest SAMBA mirror site for instructions on -downloading the source code.</P -><P ->To allow Domain users the ability to access SAMBA shares and -files, as well as potentially other services provided by your -SAMBA machine, PAM (pluggable authentication modules) must -be setup properly on your machine. In order to compile the -winbind modules, you should have at least the pam libraries resident -on your system. For recent RedHat systems (7.1, for instance), that -means <TT -CLASS="FILENAME" ->pam-0.74-22</TT ->. For best results, it is helpful to also -install the development packages in <TT -CLASS="FILENAME" ->pam-devel-0.74-22</TT ->.</P -></DIV +>With the release of Samba 1.9.17(alpha1 and above) Samba has been +updated to enable it to support the replication of browse lists +across subnet boundaries. New code and options have been added to +achieve this. This section describes how to set this feature up +in different settings.</P +><P +>To see browse lists that span TCP/IP subnets (ie. networks separated +by routers that don't pass broadcast traffic) you must set up at least +one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing +NetBIOS name to IP address translation to be done by doing a direct +query of the WINS server. This is done via a directed UDP packet on +port 137 to the WINS server machine. The reason for a WINS server is +that by default, all NetBIOS name to IP address translation is done +by broadcasts from the querying machine. This means that machines +on one subnet will not be able to resolve the names of machines on +another subnet without using a WINS server.</P +><P +>Remember, for browsing across subnets to work correctly, all machines, +be they Windows 95, Windows NT, or Samba servers must have the IP address +of a WINS server given to them by a DHCP server, or by manual configuration +(for Win95 and WinNT, this is in the TCP/IP Properties, under Network +settings) for Samba this is in the smb.conf file.</P ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN2049" ->11.5.3. Testing Things Out</A +NAME="AEN2595" +>15.4.1. How does cross subnet browsing work ?</A ></H2 ><P ->Before starting, it is probably best to kill off all the SAMBA -related daemons running on your server. Kill off all <B -CLASS="COMMAND" ->smbd</B ->, -<B -CLASS="COMMAND" ->nmbd</B ->, and <B -CLASS="COMMAND" ->winbindd</B -> processes that may -be running. To use PAM, you will want to make sure that you have the -standard PAM package (for RedHat) which supplies the <TT -CLASS="FILENAME" ->/etc/pam.d</TT -> -directory structure, including the pam modules are used by pam-aware -services, several pam libraries, and the <TT -CLASS="FILENAME" ->/usr/doc</TT -> -and <TT -CLASS="FILENAME" ->/usr/man</TT -> entries for pam. Winbind built better -in SAMBA if the pam-devel package was also installed. This package includes -the header files needed to compile pam-aware applications. For instance, -my RedHat system has both <TT -CLASS="FILENAME" ->pam-0.74-22</TT -> and -<TT -CLASS="FILENAME" ->pam-devel-0.74-22</TT -> RPMs installed.</P -><DIV -CLASS="SECT3" -><HR><H3 -CLASS="SECT3" -><A -NAME="AEN2060" ->11.5.3.1. Configure and compile SAMBA</A -></H3 +>Cross subnet browsing is a complicated dance, containing multiple +moving parts. It has taken Microsoft several years to get the code +that achieves this correct, and Samba lags behind in some areas. +However, with the 1.9.17 release, Samba is capable of cross subnet +browsing when configured correctly.</P ><P ->The configuration and compilation of SAMBA is pretty straightforward. -The first three steps may not be necessary depending upon -whether or not you have previously built the Samba binaries.</P +>Consider a network set up as follows :</P ><P ><TABLE BORDER="0" @@ -9718,110 +12498,65 @@ WIDTH="100%" ><TD ><PRE CLASS="PROGRAMLISTING" -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->autoconf</B -> -<TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->make clean</B -> -<TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->rm config.cache</B -> -<TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->./configure --with-winbind</B -> -<TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->make</B -> -<TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->make install</B -></PRE +> (DMB) + N1_A N1_B N1_C N1_D N1_E + | | | | | + ------------------------------------------------------- + | subnet 1 | + +---+ +---+ + |R1 | Router 1 Router 2 |R2 | + +---+ +---+ + | | + | subnet 2 subnet 3 | + -------------------------- ------------------------------------ + | | | | | | | | + N2_A N2_B N2_C N2_D N3_A N3_B N3_C N3_D + (WINS)</PRE ></TD ></TR ></TABLE ></P ><P ->This will, by default, install SAMBA in <TT -CLASS="FILENAME" ->/usr/local/samba</TT ->. -See the main SAMBA documentation if you want to install SAMBA somewhere else. -It will also build the winbindd executable and libraries. </P -></DIV -><DIV -CLASS="SECT3" -><HR><H3 -CLASS="SECT3" -><A -NAME="AEN2079" ->11.5.3.2. Configure <TT -CLASS="FILENAME" ->nsswitch.conf</TT -> and the -winbind libraries</A -></H3 -><P ->The libraries needed to run the <B -CLASS="COMMAND" ->winbindd</B -> daemon -through nsswitch need to be copied to their proper locations, so</P -><P -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->cp ../samba/source/nsswitch/libnss_winbind.so /lib</B -></P -><P ->I also found it necessary to make the following symbolic link:</P -><P -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2</B -></P -><P ->Now, as root you need to edit <TT -CLASS="FILENAME" ->/etc/nsswitch.conf</TT -> to -allow user and group entries to be visible from the <B -CLASS="COMMAND" ->winbindd</B -> -daemon. My <TT -CLASS="FILENAME" ->/etc/nsswitch.conf</TT -> file look like -this after editing:</P +>Consisting of 3 subnets (1, 2, 3) connected by two routers +(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines +on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume +for the moment that all these machines are configured to be in the +same workgroup (for simplicities sake). Machine N1_C on subnet 1 +is configured as Domain Master Browser (ie. it will collate the +browse lists for the workgroup). Machine N2_D is configured as +WINS server and all the other machines are configured to register +their NetBIOS names with it.</P +><P +>As all these machines are booted up, elections for master browsers +will take place on each of the three subnets. Assume that machine +N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on +subnet 3 - these machines are known as local master browsers for +their particular subnet. N1_C has an advantage in winning as the +local master browser on subnet 1 as it is set up as Domain Master +Browser.</P +><P +>On each of the three networks, machines that are configured to +offer sharing services will broadcast that they are offering +these services. The local master browser on each subnet will +receive these broadcasts and keep a record of the fact that +the machine is offering a service. This list of records is +the basis of the browse list. For this case, assume that +all the machines are configured to offer services so all machines +will be on the browse list.</P +><P +>For each network, the local master browser on that network is +considered 'authoritative' for all the names it receives via +local broadcast. This is because a machine seen by the local +master browser via a local broadcast must be on the same +network as the local master browser and thus is a 'trusted' +and 'verifiable' resource. Machines on other networks that +the local master browsers learn about when collating their +browse lists have not been directly seen - these records are +called 'non-authoritative'.</P +><P +>At this point the browse lists look as follows (these are +the machines you would see in your network neighborhood if +you looked in it on a particular network right now).</P ><P ><TABLE BORDER="0" @@ -9831,65 +12566,37 @@ WIDTH="100%" ><TD ><PRE CLASS="PROGRAMLISTING" -> passwd: files winbind - shadow: files - group: files winbind</PRE +>Subnet Browse Master List +------ ------------- ---- +Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E + +Subnet2 N2_B N2_A, N2_B, N2_C, N2_D + +Subnet3 N3_D N3_A, N3_B, N3_C, N3_D</PRE ></TD ></TR ></TABLE ></P ><P -> -The libraries needed by the winbind daemon will be automatically -entered into the <B -CLASS="COMMAND" ->ldconfig</B -> cache the next time -your system reboots, but it -is faster (and you don't need to reboot) if you do it manually:</P -><P -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->/sbin/ldconfig -v | grep winbind</B -></P +>Note that at this point all the subnets are separate, no +machine is seen across any of the subnets.</P ><P ->This makes <TT -CLASS="FILENAME" ->libnss_winbind</TT -> available to winbindd -and echos back a check to you.</P -></DIV -><DIV -CLASS="SECT3" -><HR><H3 -CLASS="SECT3" -><A -NAME="AEN2104" ->11.5.3.3. Configure smb.conf</A -></H3 +>Now examine subnet 2. As soon as N2_B has become the local +master browser it looks for a Domain master browser to synchronize +its browse list with. It does this by querying the WINS server +(N2_D) for the IP address associated with the NetBIOS name +WORKGROUP>1B<. This name was registerd by the Domain master +browser (N1_C) with the WINS server as soon as it was booted.</P ><P ->Several parameters are needed in the smb.conf file to control -the behavior of <B -CLASS="COMMAND" ->winbindd</B ->. Configure -<TT -CLASS="FILENAME" ->smb.conf</TT -> These are described in more detail in -the <A -HREF="winbindd.8.html" -TARGET="_top" ->winbindd(8)</A -> man page. My -<TT -CLASS="FILENAME" ->smb.conf</TT -> file was modified to -include the following entries in the [global] section:</P +>Once N2_B knows the address of the Domain master browser it +tells it that is the local master browser for subnet 2 by +sending a MasterAnnouncement packet as a UDP port 138 packet. +It then synchronizes with it by doing a NetServerEnum2 call. This +tells the Domain Master Browser to send it all the server +names it knows about. Once the domain master browser receives +the MasterAnnouncement packet it schedules a synchronization +request to the sender of that packet. After both synchronizations +are done the browse lists look like :</P ><P ><TABLE BORDER="0" @@ -9899,151 +12606,32 @@ WIDTH="100%" ><TD ><PRE CLASS="PROGRAMLISTING" ->[global] - <...> - # separate domain and username with '+', like DOMAIN+username - <A -HREF="winbindd.8.html#WINBINDSEPARATOR" -TARGET="_top" ->winbind separator</A -> = + - # use uids from 10000 to 20000 for domain users - <A -HREF="winbindd.8.html#WINBINDUID" -TARGET="_top" ->winbind uid</A -> = 10000-20000 - # use gids from 10000 to 20000 for domain groups - <A -HREF="winbindd.8.html#WINBINDGID" -TARGET="_top" ->winbind gid</A -> = 10000-20000 - # allow enumeration of winbind users and groups - <A -HREF="winbindd.8.html#WINBINDENUMUSERS" -TARGET="_top" ->winbind enum users</A -> = yes - <A -HREF="winbindd.8.html#WINBINDENUMGROUP" -TARGET="_top" ->winbind enum groups</A -> = yes - # give winbind users a real shell (only needed if they have telnet access) - <A -HREF="winbindd.8.html#TEMPLATEHOMEDIR" -TARGET="_top" ->template homedir</A -> = /home/winnt/%D/%U - <A -HREF="winbindd.8.html#TEMPLATESHELL" -TARGET="_top" ->template shell</A -> = /bin/bash</PRE +>Subnet Browse Master List +------ ------------- ---- +Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, + N2_A(*), N2_B(*), N2_C(*), N2_D(*) + +Subnet2 N2_B N2_A, N2_B, N2_C, N2_D + N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) + +Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + +Servers with a (*) after them are non-authoritative names.</PRE ></TD ></TR ></TABLE ></P -></DIV -><DIV -CLASS="SECT3" -><HR><H3 -CLASS="SECT3" -><A -NAME="AEN2120" ->11.5.3.4. Join the SAMBA server to the PDC domain</A -></H3 -><P ->Enter the following command to make the SAMBA server join the -PDC domain, where <TT -CLASS="REPLACEABLE" -><I ->DOMAIN</I -></TT -> is the name of -your Windows domain and <TT -CLASS="REPLACEABLE" -><I ->Administrator</I -></TT -> is -a domain user who has administrative privileges in the domain.</P -><P -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->/usr/local/samba/bin/net rpc join -s PDC -U Administrator</B -></P -><P ->The proper response to the command should be: "Joined the domain -<TT -CLASS="REPLACEABLE" -><I ->DOMAIN</I -></TT ->" where <TT -CLASS="REPLACEABLE" -><I ->DOMAIN</I -></TT -> -is your DOMAIN name.</P -></DIV -><DIV -CLASS="SECT3" -><HR><H3 -CLASS="SECT3" -><A -NAME="AEN2131" ->11.5.3.5. Start up the winbindd daemon and test it!</A -></H3 -><P ->Eventually, you will want to modify your smb startup script to -automatically invoke the winbindd daemon when the other parts of -SAMBA start, but it is possible to test out just the winbind -portion first. To start up winbind services, enter the following -command as root:</P -><P -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->/usr/local/samba/bin/winbindd</B -></P -><P ->I'm always paranoid and like to make sure the daemon -is really running...</P -><P -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->ps -ae | grep winbindd</B -></P -><P ->This command should produce output like this, if the daemon is running</P -><P ->3025 ? 00:00:00 winbindd</P -><P ->Now... for the real test, try to get some information about the -users on your PDC</P ><P -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->/usr/local/samba/bin/wbinfo -u</B -></P +>At this point users looking in their network neighborhood on +subnets 1 or 2 will see all the servers on both, users on +subnet 3 will still only see the servers on their own subnet.</P ><P -> -This should echo back a list of users on your Windows users on -your PDC. For example, I get the following response:</P +>The same sequence of events that occured for N2_B now occurs +for the local master browser on subnet 3 (N3_D). When it +synchronizes browse lists with the domain master browser (N1_A) +it gets both the server entries on subnet 1, and those on +subnet 2. After N3_D has synchronized with N1_C and vica-versa +the browse lists look like.</P ><P ><TABLE BORDER="0" @@ -10053,27 +12641,33 @@ WIDTH="100%" ><TD ><PRE CLASS="PROGRAMLISTING" ->CEO+Administrator -CEO+burdell -CEO+Guest -CEO+jt-ad -CEO+krbtgt -CEO+TsInternetUser</PRE +>Subnet Browse Master List +------ ------------- ---- +Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, + N2_A(*), N2_B(*), N2_C(*), N2_D(*), + N3_A(*), N3_B(*), N3_C(*), N3_D(*) + +Subnet2 N2_B N2_A, N2_B, N2_C, N2_D + N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) + +Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), + N2_A(*), N2_B(*), N2_C(*), N2_D(*) + +Servers with a (*) after them are non-authoritative names.</PRE ></TD ></TR ></TABLE ></P ><P ->Obviously, I have named my domain 'CEO' and my <TT -CLASS="PARAMETER" -><I ->winbind -separator</I -></TT -> is '+'.</P +>At this point users looking in their network neighborhood on +subnets 1 or 3 will see all the servers on all sunbets, users on +subnet 2 will still only see the servers on subnets 1 and 2, but not 3.</P ><P ->You can do the same sort of thing to get group information from -the PDC:</P +>Finally, the local master browser for subnet 2 (N2_B) will sync again +with the domain master browser (N1_C) and will recieve the missing +server entries. Finally - and as a steady state (if no machines +are removed or shut off) the browse lists will look like :</P ><P ><TABLE BORDER="0" @@ -10083,246 +12677,176 @@ WIDTH="100%" ><TD ><PRE CLASS="PROGRAMLISTING" -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->/usr/local/samba/bin/wbinfo -g</B -> -CEO+Domain Admins -CEO+Domain Users -CEO+Domain Guests -CEO+Domain Computers -CEO+Domain Controllers -CEO+Cert Publishers -CEO+Schema Admins -CEO+Enterprise Admins -CEO+Group Policy Creator Owners</PRE +>Subnet Browse Master List +------ ------------- ---- +Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, + N2_A(*), N2_B(*), N2_C(*), N2_D(*), + N3_A(*), N3_B(*), N3_C(*), N3_D(*) + +Subnet2 N2_B N2_A, N2_B, N2_C, N2_D + N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) + N3_A(*), N3_B(*), N3_C(*), N3_D(*) + +Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), + N2_A(*), N2_B(*), N2_C(*), N2_D(*) + +Servers with a (*) after them are non-authoritative names.</PRE ></TD ></TR ></TABLE ></P ><P ->The function 'getent' can now be used to get unified -lists of both local and PDC users and groups. -Try the following command:</P +>Synchronizations between the domain master browser and local +master browsers will continue to occur, but this should be a +steady state situation.</P +><P +>If either router R1 or R2 fails the following will occur:</P ><P -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->getent passwd</B ></P +><OL +TYPE="1" +><LI ><P ->You should get a list that looks like your <TT -CLASS="FILENAME" ->/etc/passwd</TT -> -list followed by the domain users with their new uids, gids, home -directories and default shells.</P +> Names of computers on each side of the inaccessible network fragments + will be maintained for as long as 36 minutes, in the network neighbourhood + lists. + </P +></LI +><LI ><P ->The same thing can be done for groups with the command</P +> Attempts to connect to these inaccessible computers will fail, but the + names will not be removed from the network neighbourhood lists. + </P +></LI +><LI ><P -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->getent group</B -></P +> If one of the fragments is cut off from the WINS server, it will only + be able to access servers on its local subnet, by using subnet-isolated + broadcast NetBIOS name resolution. The effects are similar to that of + losing access to a DNS server. + </P +></LI +></OL +></DIV ></DIV ><DIV -CLASS="SECT3" -><HR><H3 -CLASS="SECT3" +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" ><A -NAME="AEN2167" ->11.5.3.6. Fix the <TT -CLASS="FILENAME" ->/etc/rc.d/init.d/smb</TT -> startup files</A -></H3 +NAME="AEN2630" +>15.5. Setting up a WINS server</A +></H1 ><P ->The <B -CLASS="COMMAND" ->winbindd</B -> daemon needs to start up after the -<B -CLASS="COMMAND" ->smbd</B -> and <B -CLASS="COMMAND" ->nmbd</B -> daemons are running. -To accomplish this task, you need to modify the <TT -CLASS="FILENAME" ->/etc/init.d/smb</TT -> -script to add commands to invoke this daemon in the proper sequence. My -<TT -CLASS="FILENAME" ->/etc/init.d/smb</TT -> file starts up <B -CLASS="COMMAND" ->smbd</B ->, -<B +>Either a Samba machine or a Windows NT Server machine may be set up +as a WINS server. To set a Samba machine to be a WINS server you must +add the following option to the smb.conf file on the selected machine : +in the [globals] section add the line </P +><P +><B CLASS="COMMAND" ->nmbd</B ->, and <B +> wins support = yes</B +></P +><P +>Versions of Samba previous to 1.9.17 had this parameter default to +yes. If you have any older versions of Samba on your network it is +strongly suggested you upgrade to 1.9.17 or above, or at the very +least set the parameter to 'no' on all these machines.</P +><P +>Machines with "<B CLASS="COMMAND" ->winbindd</B -> from the -<TT -CLASS="FILENAME" ->/usr/local/samba/bin</TT -> directory directly. The 'start' -function in the script looks like this:</P +>wins support = yes</B +>" will keep a list of +all NetBIOS names registered with them, acting as a DNS for NetBIOS names.</P ><P -><TABLE -BORDER="0" -BGCOLOR="#E0E0E0" -WIDTH="100%" -><TR -><TD -><PRE -CLASS="PROGRAMLISTING" ->start() { - KIND="SMB" - echo -n $"Starting $KIND services: " - daemon /usr/local/samba/bin/smbd $SMBDOPTIONS - RETVAL=$? - echo - KIND="NMB" - echo -n $"Starting $KIND services: " - daemon /usr/local/samba/bin/nmbd $NMBDOPTIONS - RETVAL2=$? - echo - KIND="Winbind" - echo -n $"Starting $KIND services: " - daemon /usr/local/samba/bin/winbindd - RETVAL3=$? - echo - [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && touch /var/lock/subsys/smb || \ - RETVAL=1 - return $RETVAL -}</PRE -></TD -></TR -></TABLE -></P +>You should set up only ONE wins server. Do NOT set the +"<B +CLASS="COMMAND" +>wins support = yes</B +>" option on more than one Samba +server.</P ><P ->The 'stop' function has a corresponding entry to shut down the -services and look s like this:</P +>To set up a Windows NT Server as a WINS server you need to set up +the WINS service - see your NT documentation for details. Note that +Windows NT WINS Servers can replicate to each other, allowing more +than one to be set up in a complex subnet environment. As Microsoft +refuse to document these replication protocols Samba cannot currently +participate in these replications. It is possible in the future that +a Samba->Samba WINS replication protocol may be defined, in which +case more than one Samba machine could be set up as a WINS server +but currently only one Samba server should have the "wins support = yes" +parameter set.</P +><P +>After the WINS server has been configured you must ensure that all +machines participating on the network are configured with the address +of this WINS server. If your WINS server is a Samba machine, fill in +the Samba machine IP address in the "Primary WINS Server" field of +the "Control Panel->Network->Protocols->TCP->WINS Server" dialogs +in Windows 95 or Windows NT. To tell a Samba server the IP address +of the WINS server add the following line to the [global] section of +all smb.conf files :</P ><P -><TABLE -BORDER="0" -BGCOLOR="#E0E0E0" -WIDTH="100%" -><TR -><TD -><PRE -CLASS="PROGRAMLISTING" ->stop() { - KIND="SMB" - echo -n $"Shutting down $KIND services: " - killproc smbd - RETVAL=$? - echo - KIND="NMB" - echo -n $"Shutting down $KIND services: " - killproc nmbd - RETVAL2=$? - echo - KIND="Winbind" - echo -n $"Shutting down $KIND services: " - killproc winbindd - RETVAL3=$? - [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && rm -f /var/lock/subsys/smb - echo "" - return $RETVAL -}</PRE -></TD -></TR -></TABLE +><B +CLASS="COMMAND" +> wins server = >name or IP address<</B ></P ><P ->If you restart the <B -CLASS="COMMAND" ->smbd</B ->, <B +>where >name or IP address< is either the DNS name of the WINS server +machine or its IP address.</P +><P +>Note that this line MUST NOT BE SET in the smb.conf file of the Samba +server acting as the WINS server itself. If you set both the +"<B CLASS="COMMAND" ->nmbd</B ->, -and <B +>wins support = yes</B +>" option and the +"<B CLASS="COMMAND" ->winbindd</B -> daemons at this point, you -should be able to connect to the samba server as a domain member just as -if you were a local user.</P +>wins server = >name<</B +>" option then +nmbd will fail to start.</P +><P +>There are two possible scenarios for setting up cross subnet browsing. +The first details setting up cross subnet browsing on a network containing +Windows 95, Samba and Windows NT machines that are not configured as +part of a Windows NT Domain. The second details setting up cross subnet +browsing on networks that contain NT Domains.</P ></DIV ><DIV -CLASS="SECT3" -><HR><H3 -CLASS="SECT3" +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" ><A -NAME="AEN2189" ->11.5.3.7. Configure Winbind and PAM</A -></H3 -><P ->If you have made it this far, you know that winbindd and samba are working -together. If you want to use winbind to provide authentication for other -services, keep reading. The pam configuration files need to be altered in -this step. (Did you remember to make backups of your original -<TT -CLASS="FILENAME" ->/etc/pam.d</TT -> files? If not, do it now.)</P -><P ->You will need a pam module to use winbindd with these other services. This -module will be compiled in the <TT -CLASS="FILENAME" ->../source/nsswitch</TT -> directory -by invoking the command</P -><P -><TT -CLASS="PROMPT" ->root#</TT -> <B -CLASS="COMMAND" ->make nsswitch/pam_winbind.so</B -></P +NAME="AEN2649" +>15.6. Setting up Browsing in a WORKGROUP</A +></H1 ><P ->from the <TT -CLASS="FILENAME" ->../source</TT -> directory. The -<TT -CLASS="FILENAME" ->pam_winbind.so</TT -> file should be copied to the location of -your other pam security modules. On my RedHat system, this was the -<TT -CLASS="FILENAME" ->/lib/security</TT -> directory.</P +>To set up cross subnet browsing on a network containing machines +in up to be in a WORKGROUP, not an NT Domain you need to set up one +Samba server to be the Domain Master Browser (note that this is *NOT* +the same as a Primary Domain Controller, although in an NT Domain the +same machine plays both roles). The role of a Domain master browser is +to collate the browse lists from local master browsers on all the +subnets that have a machine participating in the workgroup. Without +one machine configured as a domain master browser each subnet would +be an isolated workgroup, unable to see any machines on any other +subnet. It is the presense of a domain master browser that makes +cross subnet browsing possible for a workgroup.</P +><P +>In an WORKGROUP environment the domain master browser must be a +Samba server, and there must only be one domain master browser per +workgroup name. To set up a Samba server as a domain master browser, +set the following option in the [global] section of the smb.conf file :</P ><P -><TT -CLASS="PROMPT" ->root#</TT -> <B +><B CLASS="COMMAND" ->cp ../samba/source/nsswitch/pam_winbind.so /lib/security</B +> domain master = yes</B ></P ><P ->The <TT -CLASS="FILENAME" ->/etc/pam.d/samba</TT -> file does not need to be changed. I -just left this fileas it was:</P +>The domain master browser should also preferrably be the local master +browser for its own subnet. In order to achieve this set the following +options in the [global] section of the smb.conf file :</P ><P ><TABLE BORDER="0" @@ -10332,33 +12856,25 @@ WIDTH="100%" ><TD ><PRE CLASS="PROGRAMLISTING" ->auth required /lib/security/pam_stack.so service=system-auth -account required /lib/security/pam_stack.so service=system-auth</PRE +> domain master = yes + local master = yes + preferred master = yes + os level = 65</PRE ></TD ></TR ></TABLE ></P ><P ->The other services that I modified to allow the use of winbind -as an authentication service were the normal login on the console (or a terminal -session), telnet logins, and ftp service. In order to enable these -services, you may first need to change the entries in -<TT -CLASS="FILENAME" ->/etc/xinetd.d</TT -> (or <TT -CLASS="FILENAME" ->/etc/inetd.conf</TT ->). -RedHat 7.1 uses the new xinetd.d structure, in this case you need -to change the lines in <TT -CLASS="FILENAME" ->/etc/xinetd.d/telnet</TT -> -and <TT -CLASS="FILENAME" ->/etc/xinetd.d/wu-ftp</TT -> from </P +>The domain master browser may be the same machine as the WINS +server, if you require.</P +><P +>Next, you should ensure that each of the subnets contains a +machine that can act as a local master browser for the +workgroup. Any NT machine should be able to do this, as will +Windows 95 machines (although these tend to get rebooted more +often, so it's not such a good idea to use these). To make a +Samba server a local master browser set the following +options in the [global] section of the smb.conf file :</P ><P ><TABLE BORDER="0" @@ -10368,13 +12884,28 @@ WIDTH="100%" ><TD ><PRE CLASS="PROGRAMLISTING" ->enable = no</PRE +> domain master = no + local master = yes + preferred master = yes + os level = 65</PRE ></TD ></TR ></TABLE ></P ><P ->to</P +>Do not do this for more than one Samba server on each subnet, +or they will war with each other over which is to be the local +master browser.</P +><P +>The "local master" parameter allows Samba to act as a local master +browser. The "preferred master" causes nmbd to force a browser +election on startup and the "os level" parameter sets Samba high +enough so that it should win any browser elections.</P +><P +>If you have an NT machine on the subnet that you wish to +be the local master browser then you can disable Samba from +becoming a local master browser by setting the following +options in the [global] section of the smb.conf file :</P ><P ><TABLE BORDER="0" @@ -10384,36 +12915,36 @@ WIDTH="100%" ><TD ><PRE CLASS="PROGRAMLISTING" ->enable = yes</PRE +> domain master = no + local master = no + preferred master = no + os level = 0</PRE ></TD ></TR ></TABLE ></P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2667" +>15.7. Setting up Browsing in a DOMAIN</A +></H1 ><P -> -For ftp services to work properly, you will also need to either -have individual directories for the domain users already present on -the server, or change the home directory template to a general -directory for all domain users. These can be easily set using -the <TT -CLASS="FILENAME" ->smb.conf</TT -> global entry -<B -CLASS="COMMAND" ->template homedir</B ->.</P +>If you are adding Samba servers to a Windows NT Domain then +you must not set up a Samba server as a domain master browser. +By default, a Windows NT Primary Domain Controller for a Domain +name is also the Domain master browser for that name, and many +things will break if a Samba server registers the Domain master +browser NetBIOS name (DOMAIN>1B<) with WINS instead of the PDC.</P ><P ->The <TT -CLASS="FILENAME" ->/etc/pam.d/ftp</TT -> file can be changed -to allow winbind ftp access in a manner similar to the -samba file. My <TT -CLASS="FILENAME" ->/etc/pam.d/ftp</TT -> file was -changed to look like this:</P +>For subnets other than the one containing the Windows NT PDC +you may set up Samba servers as local master browsers as +described. To make a Samba server a local master browser set +the following options in the [global] section of the smb.conf +file :</P ><P ><TABLE BORDER="0" @@ -10423,66 +12954,310 @@ WIDTH="100%" ><TD ><PRE CLASS="PROGRAMLISTING" ->auth required /lib/security/pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed -auth sufficient /lib/security/pam_winbind.so -auth required /lib/security/pam_stack.so service=system-auth -auth required /lib/security/pam_shells.so -account sufficient /lib/security/pam_winbind.so -account required /lib/security/pam_stack.so service=system-auth -session required /lib/security/pam_stack.so service=system-auth</PRE +> domain master = no + local master = yes + preferred master = yes + os level = 65</PRE ></TD ></TR ></TABLE ></P ><P ->The <TT -CLASS="FILENAME" ->/etc/pam.d/login</TT -> file can be changed nearly the -same way. It now looks like this:</P +>If you wish to have a Samba server fight the election with machines +on the same subnet you may set the "os level" parameter to lower +levels. By doing this you can tune the order of machines that +will become local master browsers if they are running. For +more details on this see the section "FORCING SAMBA TO BE THE MASTER" +below.</P ><P -><TABLE -BORDER="0" -BGCOLOR="#E0E0E0" -WIDTH="100%" -><TR -><TD -><PRE -CLASS="PROGRAMLISTING" ->auth required /lib/security/pam_securetty.so -auth sufficient /lib/security/pam_winbind.so -auth sufficient /lib/security/pam_unix.so use_first_pass -auth required /lib/security/pam_stack.so service=system-auth -auth required /lib/security/pam_nologin.so -account sufficient /lib/security/pam_winbind.so -account required /lib/security/pam_stack.so service=system-auth -password required /lib/security/pam_stack.so service=system-auth -session required /lib/security/pam_stack.so service=system-auth -session optional /lib/security/pam_console.so</PRE -></TD -></TR -></TABLE -></P +>If you have Windows NT machines that are members of the domain +on all subnets, and you are sure they will always be running then +you can disable Samba from taking part in browser elections and +ever becoming a local master browser by setting following options +in the [global] section of the smb.conf file :</P ><P ->In this case, I added the <B -CLASS="COMMAND" ->auth sufficient /lib/security/pam_winbind.so</B -> -lines as before, but also added the <B +><B CLASS="COMMAND" ->required pam_securetty.so</B -> -above it, to disallow root logins over the network. I also added a -<B +> domain master = no + local master = no + preferred master = no + os level = 0</B +></P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2677" +>15.8. Forcing samba to be the master</A +></H1 +><P +>Who becomes the "master browser" is determined by an election process +using broadcasts. Each election packet contains a number of parameters +which determine what precedence (bias) a host should have in the +election. By default Samba uses a very low precedence and thus loses +elections to just about anyone else.</P +><P +>If you want Samba to win elections then just set the "os level" global +option in smb.conf to a higher number. It defaults to 0. Using 34 +would make it win all elections over every other system (except other +samba systems!)</P +><P +>A "os level" of 2 would make it beat WfWg and Win95, but not NTAS. A +NTAS domain controller uses level 32.</P +><P +>The maximum os level is 255</P +><P +>If you want samba to force an election on startup, then set the +"preferred master" global option in smb.conf to "yes". Samba will +then have a slight advantage over other potential master browsers +that are not preferred master browsers. Use this parameter with +care, as if you have two hosts (whether they are windows 95 or NT or +samba) on the same local subnet both set with "preferred master" to +"yes", then periodically and continually they will force an election +in order to become the local master browser.</P +><P +>If you want samba to be a "domain master browser", then it is +recommended that you also set "preferred master" to "yes", because +samba will not become a domain master browser for the whole of your +LAN or WAN if it is not also a local master browser on its own +broadcast isolated subnet.</P +><P +>It is possible to configure two samba servers to attempt to become +the domain master browser for a domain. The first server that comes +up will be the domain master browser. All other samba servers will +attempt to become the domain master browser every 5 minutes. They +will find that another samba server is already the domain master +browser and will fail. This provides automatic redundancy, should +the current domain master browser fail.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2686" +>15.9. Making samba the domain master</A +></H1 +><P +>The domain master is responsible for collating the browse lists of +multiple subnets so that browsing can occur between subnets. You can +make samba act as the domain master by setting "domain master = yes" +in smb.conf. By default it will not be a domain master.</P +><P +>Note that you should NOT set Samba to be the domain master for a +workgroup that has the same name as an NT Domain.</P +><P +>When samba is the domain master and the master browser it will listen +for master announcements (made roughly every twelve minutes) from local +master browsers on other subnets and then contact them to synchronise +browse lists.</P +><P +>If you want samba to be the domain master then I suggest you also set +the "os level" high enough to make sure it wins elections, and set +"preferred master" to "yes", to get samba to force an election on +startup.</P +><P +>Note that all your servers (including samba) and clients should be +using a WINS server to resolve NetBIOS names. If your clients are only +using broadcasting to resolve NetBIOS names, then two things will occur:</P +><P +></P +><OL +TYPE="1" +><LI +><P +> your local master browsers will be unable to find a domain master + browser, as it will only be looking on the local subnet. + </P +></LI +><LI +><P +> if a client happens to get hold of a domain-wide browse list, and + a user attempts to access a host in that list, it will be unable to + resolve the NetBIOS name of that host. + </P +></LI +></OL +><P +>If, however, both samba and your clients are using a WINS server, then:</P +><P +></P +><OL +TYPE="1" +><LI +><P +> your local master browsers will contact the WINS server and, as long as + samba has registered that it is a domain master browser with the WINS + server, your local master browser will receive samba's ip address + as its domain master browser. + </P +></LI +><LI +><P +> when a client receives a domain-wide browse list, and a user attempts + to access a host in that list, it will contact the WINS server to + resolve the NetBIOS name of that host. as long as that host has + registered its NetBIOS name with the same WINS server, the user will + be able to see that host. + </P +></LI +></OL +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2704" +>15.10. Note about broadcast addresses</A +></H1 +><P +>If your network uses a "0" based broadcast address (for example if it +ends in a 0) then you will strike problems. Windows for Workgroups +does not seem to support a 0's broadcast and you will probably find +that browsing and name lookups won't work.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2707" +>15.11. Multiple interfaces</A +></H1 +><P +>Samba now supports machines with multiple network interfaces. If you +have multiple interfaces then you will need to use the "interfaces" +option in smb.conf to configure them. See smb.conf(5) for details.</P +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="SPEED" +>Chapter 16. Samba performance issues</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN2725" +>16.1. Comparisons</A +></H1 +><P +>The Samba server uses TCP to talk to the client. Thus if you are +trying to see if it performs well you should really compare it to +programs that use the same protocol. The most readily available +programs for file transfer that use TCP are ftp or another TCP based +SMB server.</P +><P +>If you want to test against something like a NT or WfWg server then +you will have to disable all but TCP on either the client or +server. Otherwise you may well be using a totally different protocol +(such as Netbeui) and comparisons may not be valid.</P +><P +>Generally you should find that Samba performs similarly to ftp at raw +transfer speed. It should perform quite a bit faster than NFS, +although this very much depends on your system.</P +><P +>Several people have done comparisons between Samba and Novell, NFS or +WinNT. In some cases Samba performed the best, in others the worst. I +suspect the biggest factor is not Samba vs some other system but the +hardware and drivers used on the various systems. Given similar +hardware Samba should certainly be competitive in speed with other +systems.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2731" +>16.2. Oplocks</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN2733" +>16.2.1. Overview</A +></H2 +><P +>Oplocks are the way that SMB clients get permission from a server to +locally cache file operations. If a server grants an oplock +(opportunistic lock) then the client is free to assume that it is the +only one accessing the file and it will agressively cache file +data. With some oplock types the client may even cache file open/close +operations. This can give enormous performance benefits.</P +><P +>With the release of Samba 1.9.18 we now correctly support opportunistic +locks. This is turned on by default, and can be turned off on a share- +by-share basis by setting the parameter :</P +><P +><B CLASS="COMMAND" ->sufficient /lib/security/pam_unix.so use_first_pass</B -> -line after the <B +>oplocks = False</B +></P +><P +>We recommend that you leave oplocks on however, as current benchmark +tests with NetBench seem to give approximately a 30% improvement in +speed with them on. This is on average however, and the actual +improvement seen can be orders of magnitude greater, depending on +what the client redirector is doing.</P +><P +>Previous to Samba 1.9.18 there was a 'fake oplocks' option. This +option has been left in the code for backwards compatibility reasons +but it's use is now deprecated. A short summary of what the old +code did follows.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN2741" +>16.2.2. Level2 Oplocks</A +></H2 +><P +>With Samba 2.0.5 a new capability - level2 (read only) oplocks is +supported (although the option is off by default - see the smb.conf +man page for details). Turning on level2 oplocks (on a share-by-share basis) +by setting the parameter :</P +><P +><B CLASS="COMMAND" ->winbind.so</B -> line to get rid of annoying -double prompts for passwords.</P +>level2 oplocks = true</B +></P +><P +>should speed concurrent access to files that are not commonly written +to, such as application serving shares (ie. shares that contain common +.EXE files - such as a Microsoft Office share) as it allows clients to +read-ahread cache copies of these files.</P ></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN2747" +>16.2.3. Old 'fake oplocks' option - deprecated</A +></H2 +><P +>Samba can also fake oplocks, by granting a oplock whenever a client +asks for one. This is controlled using the smb.conf option "fake +oplocks". If you set "fake oplocks = yes" then you are telling the +client that it may agressively cache the file data for all opens.</P +><P +>Enabling 'fake oplocks' on all read-only shares or shares that you know +will only be accessed from one client at a time you will see a big +performance improvement on many operations. If you enable this option +on shares where multiple clients may be accessing the files read-write +at the same time you can get data corruption.</P ></DIV ></DIV ><DIV @@ -10490,57 +13265,401 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN2236" ->11.6. Limitations</A +NAME="AEN2751" +>16.3. Socket options</A ></H1 ><P ->Winbind has a number of limitations in its current - released version that we hope to overcome in future - releases:</P +>There are a number of socket options that can greatly affect the +performance of a TCP based server like Samba.</P +><P +>The socket options that Samba uses are settable both on the command +line with the -O option, or in the smb.conf file.</P +><P +>The "socket options" section of the smb.conf manual page describes how +to set these and gives recommendations.</P +><P +>Getting the socket options right can make a big difference to your +performance, but getting them wrong can degrade it by just as +much. The correct settings are very dependent on your local network.</P +><P +>The socket option TCP_NODELAY is the one that seems to make the +biggest single difference for most networks. Many people report that +adding "socket options = TCP_NODELAY" doubles the read performance of +a Samba drive. The best explanation I have seen for this is that the +Microsoft TCP/IP stack is slow in sending tcp ACKs.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2758" +>16.4. Read size</A +></H1 +><P +>The option "read size" affects the overlap of disk reads/writes with +network reads/writes. If the amount of data being transferred in +several of the SMB commands (currently SMBwrite, SMBwriteX and +SMBreadbraw) is larger than this value then the server begins writing +the data before it has received the whole packet from the network, or +in the case of SMBreadbraw, it begins writing to the network before +all the data has been read from disk.</P +><P +>This overlapping works best when the speeds of disk and network access +are similar, having very little effect when the speed of one is much +greater than the other.</P +><P +>The default value is 16384, but very little experimentation has been +done yet to determine the optimal value, and it is likely that the best +value will vary greatly between systems anyway. A value over 65536 is +pointless and will cause you to allocate memory unnecessarily.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2763" +>16.5. Max xmit</A +></H1 +><P +>At startup the client and server negotiate a "maximum transmit" size, +which limits the size of nearly all SMB commands. You can set the +maximum size that Samba will negotiate using the "max xmit = " option +in smb.conf. Note that this is the maximum size of SMB request that +Samba will accept, but not the maximum size that the *client* will accept. +The client maximum receive size is sent to Samba by the client and Samba +honours this limit.</P +><P +>It defaults to 65536 bytes (the maximum), but it is possible that some +clients may perform better with a smaller transmit unit. Trying values +of less than 2048 is likely to cause severe problems.</P +><P +>In most cases the default is the best option.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2768" +>16.6. Locking</A +></H1 +><P +>By default Samba does not implement strict locking on each read/write +call (although it did in previous versions). If you enable strict +locking (using "strict locking = yes") then you may find that you +suffer a severe performance hit on some systems.</P +><P +>The performance hit will probably be greater on NFS mounted +filesystems, but could be quite high even on local disks.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2772" +>16.7. Share modes</A +></H1 +><P +>Some people find that opening files is very slow. This is often +because of the "share modes" code needed to fully implement the dos +share modes stuff. You can disable this code using "share modes = +no". This will gain you a lot in opening and closing files but will +mean that (in some cases) the system won't force a second user of a +file to open the file read-only if the first has it open +read-write. For many applications that do their own locking this +doesn't matter, but for some it may. Most Windows applications +depend heavily on "share modes" working correctly and it is +recommended that the Samba share mode support be left at the +default of "on".</P +><P +>The share mode code in Samba has been re-written in the 1.9.17 +release following tests with the Ziff-Davis NetBench PC Benchmarking +tool. It is now believed that Samba 1.9.17 implements share modes +similarly to Windows NT.</P +><P +>NOTE: In the most recent versions of Samba there is an option to use +shared memory via mmap() to implement the share modes. This makes +things much faster. See the Makefile for how to enable this.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2777" +>16.8. Log level</A +></H1 +><P +>If you set the log level (also known as "debug level") higher than 2 +then you may suffer a large drop in performance. This is because the +server flushes the log file after each operation, which can be very +expensive. </P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2780" +>16.9. Wide lines</A +></H1 +><P +>The "wide links" option is now enabled by default, but if you disable +it (for better security) then you may suffer a performance hit in +resolving filenames. The performance loss is lessened if you have +"getwd cache = yes", which is now the default.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2783" +>16.10. Read raw</A +></H1 +><P +>The "read raw" operation is designed to be an optimised, low-latency +file read operation. A server may choose to not support it, +however. and Samba makes support for "read raw" optional, with it +being enabled by default.</P +><P +>In some cases clients don't handle "read raw" very well and actually +get lower performance using it than they get using the conventional +read operations. </P +><P +>So you might like to try "read raw = no" and see what happens on your +network. It might lower, raise or not affect your performance. Only +testing can really tell.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2788" +>16.11. Write raw</A +></H1 +><P +>The "write raw" operation is designed to be an optimised, low-latency +file write operation. A server may choose to not support it, +however. and Samba makes support for "write raw" optional, with it +being enabled by default.</P +><P +>Some machines may find "write raw" slower than normal write, in which +case you may wish to change this option.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2792" +>16.12. Read prediction</A +></H1 +><P +>Samba can do read prediction on some of the SMB commands. Read +prediction means that Samba reads some extra data on the last file it +read while waiting for the next SMB command to arrive. It can then +respond more quickly when the next read request arrives.</P +><P +>This is disabled by default. You can enable it by using "read +prediction = yes".</P +><P +>Note that read prediction is only used on files that were opened read +only.</P +><P +>Read prediction should particularly help for those silly clients (such +as "Write" under NT) which do lots of very small reads on a file.</P +><P +>Samba will not read ahead more data than the amount specified in the +"read size" option. It always reads ahead on 1k block boundaries.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2799" +>16.13. Memory mapping</A +></H1 +><P +>Samba supports reading files via memory mapping them. One some +machines this can give a large boost to performance, on others it +makes not difference at all, and on some it may reduce performance.</P +><P +>To enable you you have to recompile Samba with the -DUSE_MMAP option +on the FLAGS line of the Makefile.</P +><P +>Note that memory mapping is only used on files opened read only, and +is not used by the "read raw" operation. Thus you may find memory +mapping is more effective if you disable "read raw" using "read raw = +no".</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2804" +>16.14. Slow Clients</A +></H1 +><P +>One person has reported that setting the protocol to COREPLUS rather +than LANMAN2 gave a dramatic speed improvement (from 10k/s to 150k/s).</P +><P +>I suspect that his PC's (386sx16 based) were asking for more data than +they could chew. I suspect a similar speed could be had by setting +"read raw = no" and "max xmit = 2048", instead of changing the +protocol. Lowering the "read size" might also help.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2808" +>16.15. Slow Logins</A +></H1 +><P +>Slow logins are almost always due to the password checking time. Using +the lowest practical "password level" will improve things a lot. You +could also enable the "UFC crypt" option in the Makefile.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2811" +>16.16. Client tuning</A +></H1 +><P +>Often a speed problem can be traced to the client. The client (for +example Windows for Workgroups) can often be tuned for better TCP +performance.</P +><P +>See your client docs for details. In particular, I have heard rumours +that the WfWg options TCPWINDOWSIZE and TCPSEGMENTSIZE can have a +large impact on performance.</P +><P +>Also note that some people have found that setting DefaultRcvWindow in +the [MSTCP] section of the SYSTEM.INI file under WfWg to 3072 gives a +big improvement. I don't know why.</P +><P +>My own experience wth DefaultRcvWindow is that I get much better +performance with a large value (16384 or larger). Other people have +reported that anything over 3072 slows things down enourmously. One +person even reported a speed drop of a factor of 30 when he went from +3072 to 8192. I don't know why.</P +><P +>It probably depends a lot on your hardware, and the type of unix box +you have at the other end of the link.</P +><P +>Paul Cochrane has done some testing on client side tuning and come +to the following conclusions:</P +><P +>Install the W2setup.exe file from www.microsoft.com. This is an +update for the winsock stack and utilities which improve performance.</P +><P +>Configure the win95 TCPIP registry settings to give better +perfomance. I use a program called MTUSPEED.exe which I got off the +net. There are various other utilities of this type freely available. +The setting which give the best performance for me are:</P ><P ></P -><UL +><OL +TYPE="1" ><LI ><P ->Winbind is currently only available for - the Linux operating system, although ports to other operating - systems are certainly possible. For such ports to be feasible, - we require the C library of the target operating system to - support the Name Service Switch and Pluggable Authentication - Modules systems. This is becoming more common as NSS and - PAM gain support among UNIX vendors.</P +>MaxMTU Remove</P ></LI ><LI ><P ->The mappings of Windows NT RIDs to UNIX ids - is not made algorithmically and depends on the order in which - unmapped users or groups are seen by winbind. It may be difficult - to recover the mappings of rid to UNIX id mapping if the file - containing this information is corrupted or destroyed.</P +>RWIN Remove</P ></LI ><LI ><P ->Currently the winbind PAM module does not take - into account possible workstation and logon time restrictions - that may be been set for Windows NT users.</P +>MTUAutoDiscover Disable</P ></LI -></UL +><LI +><P +>MTUBlackHoleDetect Disable</P +></LI +><LI +><P +>Time To Live Enabled</P +></LI +><LI +><P +>Time To Live - HOPS 32</P +></LI +><LI +><P +>NDI Cache Size 0</P +></LI +></OL +><P +>I tried virtually all of the items mentioned in the document and +the only one which made a difference to me was the socket options. It +turned out I was better off without any!!!!!</P +><P +>In terms of overall speed of transfer, between various win95 clients +and a DX2-66 20MB server with a crappy NE2000 compatible and old IDE +drive (Kernel 2.0.30). The transfer rate was reasonable for 10 baseT.</P +><P +>FIXME +The figures are: Put Get +P166 client 3Com card: 420-440kB/s 500-520kB/s +P100 client 3Com card: 390-410kB/s 490-510kB/s +DX4-75 client NE2000: 370-380kB/s 330-350kB/s</P +><P +>I based these test on transfer two files a 4.5MB text file and a 15MB +textfile. The results arn't bad considering the hardware Samba is +running on. It's a crap machine!!!!</P +><P +>The updates mentioned in 1 and 2 brought up the transfer rates from +just over 100kB/s in some clients.</P +><P +>A new client is a P333 connected via a 100MB/s card and hub. The +transfer rates from this were good: 450-500kB/s on put and 600+kB/s +on get.</P +><P +>Looking at standard FTP throughput, Samba is a bit slower (100kB/s +upwards). I suppose there is more going on in the samba protocol, but +if it could get up to the rate of FTP the perfomance would be quite +staggering.</P ></DIV ><DIV CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN2246" ->11.7. Conclusion</A +NAME="AEN2843" +>16.17. My Results</A ></H1 ><P ->The winbind system, through the use of the Name Service - Switch, Pluggable Authentication Modules, and appropriate - Microsoft RPC calls have allowed us to provide seamless - integration of Microsoft Windows NT domain users on a - UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network.</P +>Some people want to see real numbers in a document like this, so here +they are. I have a 486sx33 client running WfWg 3.11 with the 3.11b +tcp/ip stack. It has a slow IDE drive and 20Mb of ram. It has a SMC +Elite-16 ISA bus ethernet card. The only WfWg tuning I've done is to +set DefaultRcvWindow in the [MSTCP] section of system.ini to 16384. My +server is a 486dx3-66 running Linux. It also has 20Mb of ram and a SMC +Elite-16 card. You can see my server config in the examples/tridge/ +subdirectory of the distribution.</P +><P +>I get 490k/s on reading a 8Mb file with copy. +I get 441k/s writing the same file to the samba server.</P +><P +>Of course, there's a lot more to benchmarks than 2 raw throughput +figures, but it gives you a ballpark figure.</P +><P +>I've also tested Win95 and WinNT, and found WinNT gave me the best +speed as a samba client. The fastest client of all (for me) is +smbclient running on another linux box. Maybe I'll add those results +here someday ...</P ></DIV ></DIV ><DIV @@ -10548,23 +13667,23 @@ CLASS="CHAPTER" ><HR><H1 ><A NAME="OS2" ->Chapter 12. OS2 Client HOWTO</A +>Chapter 17. OS2 Client HOWTO</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN2260" ->12.1. FAQs</A +NAME="AEN2860" +>17.1. FAQs</A ></H1 ><DIV CLASS="SECT2" ><H2 CLASS="SECT2" ><A -NAME="AEN2262" ->12.1.1. How can I configure OS/2 Warp Connect or +NAME="AEN2862" +>17.1.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?</A ></H2 ><P @@ -10622,8 +13741,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN2277" ->12.1.2. How can I configure OS/2 Warp 3 (not Connect), +NAME="AEN2877" +>17.1.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?</A ></H2 ><P @@ -10675,8 +13794,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN2286" ->12.1.3. Are there any other issues when OS/2 (any version) +NAME="AEN2886" +>17.1.3. Are there any other issues when OS/2 (any version) is used as a client?</A ></H2 ><P @@ -10697,8 +13816,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN2290" ->12.1.4. How do I get printer driver download working +NAME="AEN2890" +>17.1.4. How do I get printer driver download working for OS/2 clients?</A ></H2 ><P @@ -10746,15 +13865,15 @@ CLASS="CHAPTER" ><HR><H1 ><A NAME="CVS-ACCESS" ->Chapter 13. HOWTO Access Samba source code via CVS</A +>Chapter 18. HOWTO Access Samba source code via CVS</A ></H1 ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A -NAME="AEN2306" ->13.1. Introduction</A +NAME="AEN2906" +>18.1. Introduction</A ></H1 ><P >Samba is developed in an open environment. Developers use CVS @@ -10775,8 +13894,8 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN2311" ->13.2. CVS Access to samba.org</A +NAME="AEN2911" +>18.2. CVS Access to samba.org</A ></H1 ><P >The machine samba.org runs a publicly accessible CVS @@ -10788,8 +13907,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN2314" ->13.2.1. Access via CVSweb</A +NAME="AEN2914" +>18.2.1. Access via CVSweb</A ></H2 ><P >You can access the source code via your @@ -10809,8 +13928,8 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN2319" ->13.2.2. Access via cvs</A +NAME="AEN2919" +>18.2.2. Access via cvs</A ></H2 ><P >You can also access the source code via a @@ -10913,16 +14032,242 @@ CLASS="COMMAND" ></DIV ></DIV ></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="BUGREPORT" +>Chapter 19. Reporting Bugs</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN2954" +>19.1. Introduction</A +></H1 +><P +>The email address for bug reports is samba@samba.org</P +><P +>Please take the time to read this file before you submit a bug +report. Also, please see if it has changed between releases, as we +may be changing the bug reporting mechanism at some time.</P +><P +>Please also do as much as you can yourself to help track down the +bug. Samba is maintained by a dedicated group of people who volunteer +their time, skills and efforts. We receive far more mail about it than +we can possibly answer, so you have a much higher chance of an answer +and a fix if you send us a "developer friendly" bug report that lets +us fix it fast. </P +><P +>Do not assume that if you post the bug to the comp.protocols.smb +newsgroup or the mailing list that we will read it. If you suspect that your +problem is not a bug but a configuration problem then it is better to send +it to the Samba mailing list, as there are (at last count) 5000 other users on +that list that may be able to help you.</P +><P +>You may also like to look though the recent mailing list archives, +which are conveniently accessible on the Samba web pages +at http://samba.org/samba/ </P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2961" +>19.2. General info</A +></H1 +><P +>Before submitting a bug report check your config for silly +errors. Look in your log files for obvious messages that tell you that +you've misconfigured something and run testparm to test your config +file for correct syntax.</P +><P +>Have you run through the <A +HREF="Diagnosis.html" +TARGET="_top" +>diagnosis</A +>? +This is very important.</P +><P +>If you include part of a log file with your bug report then be sure to +annotate it with exactly what you were doing on the client at the +time, and exactly what the results were.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2967" +>19.3. Debug levels</A +></H1 +><P +>If the bug has anything to do with Samba behaving incorrectly as a +server (like refusing to open a file) then the log files will probably +be very useful. Depending on the problem a log level of between 3 and +10 showing the problem may be appropriate. A higher level givesmore +detail, but may use too much disk space.</P +><P +>To set the debug level use <B +CLASS="COMMAND" +>log level =</B +> in your +<TT +CLASS="FILENAME" +>smb.conf</TT +>. You may also find it useful to set the log +level higher for just one machine and keep separate logs for each machine. +To do this use:</P +><P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><PRE +CLASS="PROGRAMLISTING" +>log level = 10 +log file = /usr/local/samba/lib/log.%m +include = /usr/local/samba/lib/smb.conf.%m</PRE +></TD +></TR +></TABLE +></P +><P +>then create a file +<TT +CLASS="FILENAME" +>/usr/local/samba/lib/smb.conf.machine</TT +> where +"machine" is the name of the client you wish to debug. In that file +put any smb.conf commands you want, for example +<B +CLASS="COMMAND" +>log level=</B +> may be useful. This also allows you to +experiment with different security systems, protocol levels etc on just +one machine.</P +><P +>The <TT +CLASS="FILENAME" +>smb.conf</TT +> entry <B +CLASS="COMMAND" +>log level =</B +> +is synonymous with the entry <B +CLASS="COMMAND" +>debuglevel =</B +> that has been +used in older versions of Samba and is being retained for backwards +compatibility of smb.conf files.</P +><P +>As the <B +CLASS="COMMAND" +>log level =</B +> value is increased you will record +a significantly increasing level of debugging information. For most +debugging operations you may not need a setting higher than 3. Nearly +all bugs can be tracked at a setting of 10, but be prepared for a VERY +large volume of log data.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2984" +>19.4. Internal errors</A +></H1 +><P +>If you get a "INTERNAL ERROR" message in your log files it means that +Samba got an unexpected signal while running. It is probably a +segmentation fault and almost certainly means a bug in Samba (unless +you have faulty hardware or system software)</P +><P +>If the message came from smbd then it will probably be accompanied by +a message which details the last SMB message received by smbd. This +info is often very useful in tracking down the problem so please +include it in your bug report.</P +><P +>You should also detail how to reproduce the problem, if +possible. Please make this reasonably detailed.</P +><P +>You may also find that a core file appeared in a "corefiles" +subdirectory of the directory where you keep your samba log +files. This file is the most useful tool for tracking down the bug. To +use it you do this:</P +><P +><B +CLASS="COMMAND" +>gdb smbd core</B +></P +><P +>adding appropriate paths to smbd and core so gdb can find them. If you +don't have gdb then try "dbx". Then within the debugger use the +command "where" to give a stack trace of where the problem +occurred. Include this in your mail.</P +><P +>If you known any assembly language then do a "disass" of the routine +where the problem occurred (if its in a library routine then +disassemble the routine that called it) and try to work out exactly +where the problem is by looking at the surrounding code. Even if you +don't know assembly then incuding this info in the bug report can be +useful. </P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2994" +>19.5. Attaching to a running process</A +></H1 +><P +>Unfortunately some unixes (in particular some recent linux kernels) +refuse to dump a core file if the task has changed uid (which smbd +does often). To debug with this sort of system you could try to attach +to the running process using "gdb smbd PID" where you get PID from +smbstatus. Then use "c" to continue and try to cause the core dump +using the client. The debugger should catch the fault and tell you +where it occurred.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN2997" +>19.6. Patches</A +></H1 +><P +>The best sort of bug report is one that includes a fix! If you send us +patches please use <B +CLASS="COMMAND" +>diff -u</B +> format if your version of +diff supports it, otherwise use <B +CLASS="COMMAND" +>diff -c4</B +>. Make sure +your do the diff against a clean version of the source and let me know +exactly what version you used. </P +></DIV +></DIV ><HR><H1 ><A -NAME="AEN2347" +NAME="AEN3002" >Index</A ></H1 ><DL ><DT >Primary Domain Controller, <A -HREF="x1100.htm" +HREF="x1741.htm" >Background</A > </DT diff --git a/docs/htmldocs/Samba-LDAP-HOWTO.html b/docs/htmldocs/Samba-LDAP-HOWTO.html index 3fb4e1df09..21ebbfe7b0 100644 --- a/docs/htmldocs/Samba-LDAP-HOWTO.html +++ b/docs/htmldocs/Samba-LDAP-HOWTO.html @@ -152,7 +152,7 @@ Identified (RID).</P >As a result of these defeciencies, a more robust means of storing user attributes used by smbd was developed. The API which defines access to user accounts is commonly referred to as the samdb interface (previously this was called the passdb -API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support +API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support for a samdb backend (e.g. <TT CLASS="PARAMETER" ><I @@ -498,7 +498,7 @@ CLASS="REPLACEABLE" ldap suffix = "ou=people,dc=samba,dc=org" # generally the default ldap search filter is ok - # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))"</PRE + # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))"</PRE ></P ></DIV ></DIV diff --git a/docs/htmldocs/Samba-PDC-HOWTO.html b/docs/htmldocs/Samba-PDC-HOWTO.html index 58f3989b4f..ae4f545800 100644 --- a/docs/htmldocs/Samba-PDC-HOWTO.html +++ b/docs/htmldocs/Samba-PDC-HOWTO.html @@ -2124,7 +2124,7 @@ ALIGN="LEFT" ></TABLE ></DIV ><P ->The default logon path is \\%N\U%. NT Workstation will attempt to create +>The default logon path is \\%N\%U. NT Workstation will attempt to create a directory "\\samba-server\username.PDS" if you specify the logon path as "\\samba-server\username" with the NT User Manager. Therefore, you will need to specify (for example) "\\samba-server\username\profile". diff --git a/docs/htmldocs/Speed.html b/docs/htmldocs/Speed.html new file mode 100644 index 0000000000..47a8c885b6 --- /dev/null +++ b/docs/htmldocs/Speed.html @@ -0,0 +1,550 @@ +<HTML +><HEAD +><TITLE +>Samba performance issues</TITLE +><META +NAME="GENERATOR" +CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD +><BODY +CLASS="ARTICLE" +BGCOLOR="#FFFFFF" +TEXT="#000000" +LINK="#0000FF" +VLINK="#840084" +ALINK="#0000FF" +><DIV +CLASS="ARTICLE" +><DIV +CLASS="TITLEPAGE" +><H1 +CLASS="TITLE" +><A +NAME="SPEED" +>Samba performance issues</A +></H1 +><HR></DIV +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN3" +>Comparisons</A +></H1 +><P +>The Samba server uses TCP to talk to the client. Thus if you are +trying to see if it performs well you should really compare it to +programs that use the same protocol. The most readily available +programs for file transfer that use TCP are ftp or another TCP based +SMB server.</P +><P +>If you want to test against something like a NT or WfWg server then +you will have to disable all but TCP on either the client or +server. Otherwise you may well be using a totally different protocol +(such as Netbeui) and comparisons may not be valid.</P +><P +>Generally you should find that Samba performs similarly to ftp at raw +transfer speed. It should perform quite a bit faster than NFS, +although this very much depends on your system.</P +><P +>Several people have done comparisons between Samba and Novell, NFS or +WinNT. In some cases Samba performed the best, in others the worst. I +suspect the biggest factor is not Samba vs some other system but the +hardware and drivers used on the various systems. Given similar +hardware Samba should certainly be competitive in speed with other +systems.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN9" +>Oplocks</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN11" +>Overview</A +></H2 +><P +>Oplocks are the way that SMB clients get permission from a server to +locally cache file operations. If a server grants an oplock +(opportunistic lock) then the client is free to assume that it is the +only one accessing the file and it will agressively cache file +data. With some oplock types the client may even cache file open/close +operations. This can give enormous performance benefits.</P +><P +>With the release of Samba 1.9.18 we now correctly support opportunistic +locks. This is turned on by default, and can be turned off on a share- +by-share basis by setting the parameter :</P +><P +><B +CLASS="COMMAND" +>oplocks = False</B +></P +><P +>We recommend that you leave oplocks on however, as current benchmark +tests with NetBench seem to give approximately a 30% improvement in +speed with them on. This is on average however, and the actual +improvement seen can be orders of magnitude greater, depending on +what the client redirector is doing.</P +><P +>Previous to Samba 1.9.18 there was a 'fake oplocks' option. This +option has been left in the code for backwards compatibility reasons +but it's use is now deprecated. A short summary of what the old +code did follows.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN19" +>Level2 Oplocks</A +></H2 +><P +>With Samba 2.0.5 a new capability - level2 (read only) oplocks is +supported (although the option is off by default - see the smb.conf +man page for details). Turning on level2 oplocks (on a share-by-share basis) +by setting the parameter :</P +><P +><B +CLASS="COMMAND" +>level2 oplocks = true</B +></P +><P +>should speed concurrent access to files that are not commonly written +to, such as application serving shares (ie. shares that contain common +.EXE files - such as a Microsoft Office share) as it allows clients to +read-ahread cache copies of these files.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN25" +>Old 'fake oplocks' option - deprecated</A +></H2 +><P +>Samba can also fake oplocks, by granting a oplock whenever a client +asks for one. This is controlled using the smb.conf option "fake +oplocks". If you set "fake oplocks = yes" then you are telling the +client that it may agressively cache the file data for all opens.</P +><P +>Enabling 'fake oplocks' on all read-only shares or shares that you know +will only be accessed from one client at a time you will see a big +performance improvement on many operations. If you enable this option +on shares where multiple clients may be accessing the files read-write +at the same time you can get data corruption.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN29" +>Socket options</A +></H1 +><P +>There are a number of socket options that can greatly affect the +performance of a TCP based server like Samba.</P +><P +>The socket options that Samba uses are settable both on the command +line with the -O option, or in the smb.conf file.</P +><P +>The "socket options" section of the smb.conf manual page describes how +to set these and gives recommendations.</P +><P +>Getting the socket options right can make a big difference to your +performance, but getting them wrong can degrade it by just as +much. The correct settings are very dependent on your local network.</P +><P +>The socket option TCP_NODELAY is the one that seems to make the +biggest single difference for most networks. Many people report that +adding "socket options = TCP_NODELAY" doubles the read performance of +a Samba drive. The best explanation I have seen for this is that the +Microsoft TCP/IP stack is slow in sending tcp ACKs.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN36" +>Read size</A +></H1 +><P +>The option "read size" affects the overlap of disk reads/writes with +network reads/writes. If the amount of data being transferred in +several of the SMB commands (currently SMBwrite, SMBwriteX and +SMBreadbraw) is larger than this value then the server begins writing +the data before it has received the whole packet from the network, or +in the case of SMBreadbraw, it begins writing to the network before +all the data has been read from disk.</P +><P +>This overlapping works best when the speeds of disk and network access +are similar, having very little effect when the speed of one is much +greater than the other.</P +><P +>The default value is 16384, but very little experimentation has been +done yet to determine the optimal value, and it is likely that the best +value will vary greatly between systems anyway. A value over 65536 is +pointless and will cause you to allocate memory unnecessarily.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN41" +>Max xmit</A +></H1 +><P +>At startup the client and server negotiate a "maximum transmit" size, +which limits the size of nearly all SMB commands. You can set the +maximum size that Samba will negotiate using the "max xmit = " option +in smb.conf. Note that this is the maximum size of SMB request that +Samba will accept, but not the maximum size that the *client* will accept. +The client maximum receive size is sent to Samba by the client and Samba +honours this limit.</P +><P +>It defaults to 65536 bytes (the maximum), but it is possible that some +clients may perform better with a smaller transmit unit. Trying values +of less than 2048 is likely to cause severe problems.</P +><P +>In most cases the default is the best option.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN46" +>Locking</A +></H1 +><P +>By default Samba does not implement strict locking on each read/write +call (although it did in previous versions). If you enable strict +locking (using "strict locking = yes") then you may find that you +suffer a severe performance hit on some systems.</P +><P +>The performance hit will probably be greater on NFS mounted +filesystems, but could be quite high even on local disks.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN50" +>Share modes</A +></H1 +><P +>Some people find that opening files is very slow. This is often +because of the "share modes" code needed to fully implement the dos +share modes stuff. You can disable this code using "share modes = +no". This will gain you a lot in opening and closing files but will +mean that (in some cases) the system won't force a second user of a +file to open the file read-only if the first has it open +read-write. For many applications that do their own locking this +doesn't matter, but for some it may. Most Windows applications +depend heavily on "share modes" working correctly and it is +recommended that the Samba share mode support be left at the +default of "on".</P +><P +>The share mode code in Samba has been re-written in the 1.9.17 +release following tests with the Ziff-Davis NetBench PC Benchmarking +tool. It is now believed that Samba 1.9.17 implements share modes +similarly to Windows NT.</P +><P +>NOTE: In the most recent versions of Samba there is an option to use +shared memory via mmap() to implement the share modes. This makes +things much faster. See the Makefile for how to enable this.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN55" +>Log level</A +></H1 +><P +>If you set the log level (also known as "debug level") higher than 2 +then you may suffer a large drop in performance. This is because the +server flushes the log file after each operation, which can be very +expensive. </P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN58" +>Wide lines</A +></H1 +><P +>The "wide links" option is now enabled by default, but if you disable +it (for better security) then you may suffer a performance hit in +resolving filenames. The performance loss is lessened if you have +"getwd cache = yes", which is now the default.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN61" +>Read raw</A +></H1 +><P +>The "read raw" operation is designed to be an optimised, low-latency +file read operation. A server may choose to not support it, +however. and Samba makes support for "read raw" optional, with it +being enabled by default.</P +><P +>In some cases clients don't handle "read raw" very well and actually +get lower performance using it than they get using the conventional +read operations. </P +><P +>So you might like to try "read raw = no" and see what happens on your +network. It might lower, raise or not affect your performance. Only +testing can really tell.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN66" +>Write raw</A +></H1 +><P +>The "write raw" operation is designed to be an optimised, low-latency +file write operation. A server may choose to not support it, +however. and Samba makes support for "write raw" optional, with it +being enabled by default.</P +><P +>Some machines may find "write raw" slower than normal write, in which +case you may wish to change this option.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN70" +>Read prediction</A +></H1 +><P +>Samba can do read prediction on some of the SMB commands. Read +prediction means that Samba reads some extra data on the last file it +read while waiting for the next SMB command to arrive. It can then +respond more quickly when the next read request arrives.</P +><P +>This is disabled by default. You can enable it by using "read +prediction = yes".</P +><P +>Note that read prediction is only used on files that were opened read +only.</P +><P +>Read prediction should particularly help for those silly clients (such +as "Write" under NT) which do lots of very small reads on a file.</P +><P +>Samba will not read ahead more data than the amount specified in the +"read size" option. It always reads ahead on 1k block boundaries.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN77" +>Memory mapping</A +></H1 +><P +>Samba supports reading files via memory mapping them. One some +machines this can give a large boost to performance, on others it +makes not difference at all, and on some it may reduce performance.</P +><P +>To enable you you have to recompile Samba with the -DUSE_MMAP option +on the FLAGS line of the Makefile.</P +><P +>Note that memory mapping is only used on files opened read only, and +is not used by the "read raw" operation. Thus you may find memory +mapping is more effective if you disable "read raw" using "read raw = +no".</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN82" +>Slow Clients</A +></H1 +><P +>One person has reported that setting the protocol to COREPLUS rather +than LANMAN2 gave a dramatic speed improvement (from 10k/s to 150k/s).</P +><P +>I suspect that his PC's (386sx16 based) were asking for more data than +they could chew. I suspect a similar speed could be had by setting +"read raw = no" and "max xmit = 2048", instead of changing the +protocol. Lowering the "read size" might also help.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN86" +>Slow Logins</A +></H1 +><P +>Slow logins are almost always due to the password checking time. Using +the lowest practical "password level" will improve things a lot. You +could also enable the "UFC crypt" option in the Makefile.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN89" +>Client tuning</A +></H1 +><P +>Often a speed problem can be traced to the client. The client (for +example Windows for Workgroups) can often be tuned for better TCP +performance.</P +><P +>See your client docs for details. In particular, I have heard rumours +that the WfWg options TCPWINDOWSIZE and TCPSEGMENTSIZE can have a +large impact on performance.</P +><P +>Also note that some people have found that setting DefaultRcvWindow in +the [MSTCP] section of the SYSTEM.INI file under WfWg to 3072 gives a +big improvement. I don't know why.</P +><P +>My own experience wth DefaultRcvWindow is that I get much better +performance with a large value (16384 or larger). Other people have +reported that anything over 3072 slows things down enourmously. One +person even reported a speed drop of a factor of 30 when he went from +3072 to 8192. I don't know why.</P +><P +>It probably depends a lot on your hardware, and the type of unix box +you have at the other end of the link.</P +><P +>Paul Cochrane has done some testing on client side tuning and come +to the following conclusions:</P +><P +>Install the W2setup.exe file from www.microsoft.com. This is an +update for the winsock stack and utilities which improve performance.</P +><P +>Configure the win95 TCPIP registry settings to give better +perfomance. I use a program called MTUSPEED.exe which I got off the +net. There are various other utilities of this type freely available. +The setting which give the best performance for me are:</P +><P +></P +><OL +TYPE="1" +><LI +><P +>MaxMTU Remove</P +></LI +><LI +><P +>RWIN Remove</P +></LI +><LI +><P +>MTUAutoDiscover Disable</P +></LI +><LI +><P +>MTUBlackHoleDetect Disable</P +></LI +><LI +><P +>Time To Live Enabled</P +></LI +><LI +><P +>Time To Live - HOPS 32</P +></LI +><LI +><P +>NDI Cache Size 0</P +></LI +></OL +><P +>I tried virtually all of the items mentioned in the document and +the only one which made a difference to me was the socket options. It +turned out I was better off without any!!!!!</P +><P +>In terms of overall speed of transfer, between various win95 clients +and a DX2-66 20MB server with a crappy NE2000 compatible and old IDE +drive (Kernel 2.0.30). The transfer rate was reasonable for 10 baseT.</P +><P +>FIXME +The figures are: Put Get +P166 client 3Com card: 420-440kB/s 500-520kB/s +P100 client 3Com card: 390-410kB/s 490-510kB/s +DX4-75 client NE2000: 370-380kB/s 330-350kB/s</P +><P +>I based these test on transfer two files a 4.5MB text file and a 15MB +textfile. The results arn't bad considering the hardware Samba is +running on. It's a crap machine!!!!</P +><P +>The updates mentioned in 1 and 2 brought up the transfer rates from +just over 100kB/s in some clients.</P +><P +>A new client is a P333 connected via a 100MB/s card and hub. The +transfer rates from this were good: 450-500kB/s on put and 600+kB/s +on get.</P +><P +>Looking at standard FTP throughput, Samba is a bit slower (100kB/s +upwards). I suppose there is more going on in the samba protocol, but +if it could get up to the rate of FTP the perfomance would be quite +staggering.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN121" +>My Results</A +></H1 +><P +>Some people want to see real numbers in a document like this, so here +they are. I have a 486sx33 client running WfWg 3.11 with the 3.11b +tcp/ip stack. It has a slow IDE drive and 20Mb of ram. It has a SMC +Elite-16 ISA bus ethernet card. The only WfWg tuning I've done is to +set DefaultRcvWindow in the [MSTCP] section of system.ini to 16384. My +server is a 486dx3-66 running Linux. It also has 20Mb of ram and a SMC +Elite-16 card. You can see my server config in the examples/tridge/ +subdirectory of the distribution.</P +><P +>I get 490k/s on reading a 8Mb file with copy. +I get 441k/s writing the same file to the samba server.</P +><P +>Of course, there's a lot more to benchmarks than 2 raw throughput +figures, but it gives you a ballpark figure.</P +><P +>I've also tested Win95 and WinNT, and found WinNT gave me the best +speed as a samba client. The fastest client of all (for me) is +smbclient running on another linux box. Maybe I'll add those results +here someday ...</P +></DIV +></DIV +></BODY +></HTML +>
\ No newline at end of file diff --git a/docs/htmldocs/UNIX_INSTALL.html b/docs/htmldocs/UNIX_INSTALL.html index 35b1d9b01b..9946e7e64e 100644 --- a/docs/htmldocs/UNIX_INSTALL.html +++ b/docs/htmldocs/UNIX_INSTALL.html @@ -478,7 +478,7 @@ CLASS="REPLACEABLE" ></TT ></P ><P ->Your should get back a list of shares available on +>You should get back a list of shares available on your server. If you don't then something is incorrectly setup. Note that this method can also be used to see what shares are available on other LanManager clients (such as WfWg).</P @@ -656,8 +656,8 @@ NAME="AEN166" >By default Samba uses a blank scope ID. This means all your windows boxes must also have a blank scope ID. If you really want to use a non-blank scope ID then you will - need to use the -i <scope> option to nmbd, smbd, and - smbclient. All your PCs will need to have the same setting for + need to use the 'netbios scope' smb.conf option. + All your PCs will need to have the same setting for this to work. I do not recommend scope IDs.</P ></DIV ><DIV @@ -778,19 +778,13 @@ NAME="AEN182" its open. A client may ask for DENY_NONE, DENY_READ, DENY_WRITE or DENY_ALL. There are also special compatibility modes called DENY_FCB and DENY_DOS.</P -><P ->You can disable share modes using "share modes = no". - This may be useful on a heavily loaded server as the share - modes code is very slow. See also the FAST_SHARE_MODES - option in the Makefile for a way to do full share modes - very fast using shared memory (if your OS supports it).</P ></DIV ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN192" +NAME="AEN191" >Mapping Usernames</A ></H2 ><P @@ -798,21 +792,6 @@ NAME="AEN192" the unix server then take a look at the "username map" option. See the smb.conf man page for details.</P ></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN195" ->Other Character Sets</A -></H2 -><P ->If you have problems using filenames with accented - characters in them (like the German, French or Scandinavian - character sets) then I recommend you look at the "valid chars" - option in smb.conf and also take a look at the validchars - package in the examples directory.</P -></DIV ></DIV ></DIV ></BODY diff --git a/docs/htmldocs/rpcclient.1.html b/docs/htmldocs/rpcclient.1.html index eaa864f109..9ffca61437 100644 --- a/docs/htmldocs/rpcclient.1.html +++ b/docs/htmldocs/rpcclient.1.html @@ -37,12 +37,12 @@ NAME="AEN8" ><B CLASS="COMMAND" >rpcclient</B -> [-A authfile] [-c <command string>] [-d debuglevel] [-h] [-l logfile] [-N] [-s <smb config file>] [-U username[%password]] [-W workgroup] [-N] {server}</P +> [-A authfile] [-c <command string>] [-d debuglevel] [-h] [-l logfile] [-N] [-s <smb config file>] [-U username[%password]] [-W workgroup] [-N] [-I destinationIP] {server}</P ></DIV ><DIV CLASS="REFSECT1" ><A -NAME="AEN22" +NAME="AEN23" ></A ><H2 >DESCRIPTION</H2 @@ -65,7 +65,7 @@ CLASS="COMMAND" ><DIV CLASS="REFSECT1" ><A -NAME="AEN28" +NAME="AEN29" ></A ><H2 >OPTIONS</H2 @@ -151,6 +151,35 @@ CLASS="FILENAME" </P ></DD ><DT +>-I IP-address</DT +><DD +><P +><TT +CLASS="REPLACEABLE" +><I +>IP address</I +></TT +> is the address of the server to connect to. + It should be specified in standard "a.b.c.d" notation. </P +><P +>Normally the client would attempt to locate a named + SMB/CIFS server by looking it up via the NetBIOS name resolution + mechanism described above in the <TT +CLASS="PARAMETER" +><I +>name resolve order</I +></TT +> + parameter above. Using this parameter will force the client + to assume that the server is on the machine with the specified IP + address and the NetBIOS name component of the resource being + connected to will be ignored. </P +><P +>There is no default for this parameter. If not supplied, + it will be determined automatically by the client as described + above. </P +></DD +><DT >-l|--logfile=logbasename</DT ><DD ><P @@ -253,7 +282,7 @@ CLASS="COMMAND" ><DIV CLASS="REFSECT1" ><A -NAME="AEN92" +NAME="AEN101" ></A ><H2 >COMMANDS</H2 @@ -647,7 +676,7 @@ CLASS="COMMAND" ><DIV CLASS="REFSECT1" ><A -NAME="AEN212" +NAME="AEN221" ></A ><H2 >BUGS</H2 @@ -688,7 +717,7 @@ CLASS="COMMAND" ><DIV CLASS="REFSECT1" ><A -NAME="AEN222" +NAME="AEN231" ></A ><H2 >VERSION</H2 @@ -699,7 +728,7 @@ NAME="AEN222" ><DIV CLASS="REFSECT1" ><A -NAME="AEN225" +NAME="AEN234" ></A ><H2 >AUTHOR</H2 diff --git a/docs/htmldocs/security_level.html b/docs/htmldocs/security_level.html new file mode 100644 index 0000000000..e26e1ea78b --- /dev/null +++ b/docs/htmldocs/security_level.html @@ -0,0 +1,169 @@ +<HTML +><HEAD +><TITLE +>Security levels</TITLE +><META +NAME="GENERATOR" +CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD +><BODY +CLASS="ARTICLE" +BGCOLOR="#FFFFFF" +TEXT="#000000" +LINK="#0000FF" +VLINK="#840084" +ALINK="#0000FF" +><DIV +CLASS="ARTICLE" +><DIV +CLASS="TITLEPAGE" +><H1 +CLASS="TITLE" +><A +NAME="SECURITY_LEVELS" +>Security levels</A +></H1 +><HR></DIV +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN3" +>Introduction</A +></H1 +><P +>Samba supports the following options to the global smb.conf parameter</P +><P +><PRE +CLASS="PROGRAMLISTING" +>[global] +<A +HREF="smb.conf.5.html#SECURITY" +TARGET="_top" +><TT +CLASS="PARAMETER" +><I +>security</I +></TT +></A +> = [share|user(default)|domain|ads]</PRE +></P +><P +>Please refer to the smb.conf man page for usage information and to the document +<A +HREF="DOMAIN_MEMBER.html" +TARGET="_top" +>DOMAIN_MEMBER.html</A +> for further background details +on domain mode security. The Windows 2000 Kerberos domain security model +(security = ads) is described in the <A +HREF="ADS-HOWTO.html" +TARGET="_top" +>ADS-HOWTO.html</A +>.</P +><P +>Of the above, "security = server" means that Samba reports to clients that +it is running in "user mode" but actually passes off all authentication +requests to another "user mode" server. This requires an additional +parameter "password server =" that points to the real authentication server. +That real authentication server can be another Samba server or can be a +Windows NT server, the later natively capable of encrypted password support.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN14" +>More complete description of security levels</A +></H1 +><P +>A SMB server tells the client at startup what "security level" it is +running. There are two options "share level" and "user level". Which +of these two the client receives affects the way the client then tries +to authenticate itself. It does not directly affect (to any great +extent) the way the Samba server does security. I know this is +strange, but it fits in with the client/server approach of SMB. In SMB +everything is initiated and controlled by the client, and the server +can only tell the client what is available and whether an action is +allowed. </P +><P +>I'll describe user level security first, as its simpler. In user level +security the client will send a "session setup" command directly after +the protocol negotiation. This contains a username and password. The +server can either accept or reject that username/password +combination. Note that at this stage the server has no idea what +share the client will eventually try to connect to, so it can't base +the "accept/reject" on anything other than:</P +><P +></P +><OL +TYPE="1" +><LI +><P +>the username/password</P +></LI +><LI +><P +>the machine that the client is coming from</P +></LI +></OL +><P +>If the server accepts the username/password then the client expects to +be able to mount any share (using a "tree connection") without +specifying a password. It expects that all access rights will be as +the username/password specified in the "session setup". </P +><P +>It is also possible for a client to send multiple "session setup" +requests. When the server responds it gives the client a "uid" to use +as an authentication tag for that username/password. The client can +maintain multiple authentication contexts in this way (WinDD is an +example of an application that does this)</P +><P +>Ok, now for share level security. In share level security the client +authenticates itself separately for each share. It will send a +password along with each "tree connection" (share mount). It does not +explicitly send a username with this operation. The client is +expecting a password to be associated with each share, independent of +the user. This means that samba has to work out what username the +client probably wants to use. It is never explicitly sent the +username. Some commercial SMB servers such as NT actually associate +passwords directly with shares in share level security, but samba +always uses the unix authentication scheme where it is a +username/password that is authenticated, not a "share/password".</P +><P +>Many clients send a "session setup" even if the server is in share +level security. They normally send a valid username but no +password. Samba records this username in a list of "possible +usernames". When the client then does a "tree connection" it also adds +to this list the name of the share they try to connect to (useful for +home directories) and any users listed in the "user =" smb.conf +line. The password is then checked in turn against these "possible +usernames". If a match is found then the client is authenticated as +that user.</P +><P +>Finally "server level" security. In server level security the samba +server reports to the client that it is in user level security. The +client then does a "session setup" as described earlier. The samba +server takes the username/password that the client sends and attempts +to login to the "password server" by sending exactly the same +username/password that it got from the client. If that server is in +user level security and accepts the password then samba accepts the +clients connection. This allows the samba server to use another SMB +server as the "password server". </P +><P +>You should also note that at the very start of all this, where the +server tells the client what security level it is in, it also tells +the client if it supports encryption. If it does then it supplies the +client with a random "cryptkey". The client will then send all +passwords in encrypted form. You have to compile samba with encryption +enabled to support this feature, and you have to maintain a separate +smbpasswd file with SMB style encrypted passwords. It is +cryptographically impossible to translate from unix style encryption +to SMB style encryption, although there are some fairly simple management +schemes by which the two could be kept in sync.</P +></DIV +></DIV +></BODY +></HTML +>
\ No newline at end of file diff --git a/docs/htmldocs/smb.conf.5.html b/docs/htmldocs/smb.conf.5.html index d329c25d65..6f0e88c4d3 100644 --- a/docs/htmldocs/smb.conf.5.html +++ b/docs/htmldocs/smb.conf.5.html @@ -1465,11 +1465,11 @@ CLASS="PARAMETER" ><LI ><P ><A -HREF="#LDAPPORT" +HREF="#LDAPSSL" ><TT CLASS="PARAMETER" ><I ->ldap port</I +>ldap ssl</I ></TT ></A ></P @@ -1477,11 +1477,11 @@ CLASS="PARAMETER" ><LI ><P ><A -HREF="#LDAPSERVER" +HREF="#LDAPSUFFIX" ><TT CLASS="PARAMETER" ><I ->ldap server</I +>ldap suffix</I ></TT ></A ></P @@ -1489,11 +1489,11 @@ CLASS="PARAMETER" ><LI ><P ><A -HREF="#LDAPSSL" +HREF="#LDAPUSERSUFFIX" ><TT CLASS="PARAMETER" ><I ->ldap ssl</I +>ldap suffix</I ></TT ></A ></P @@ -1501,7 +1501,7 @@ CLASS="PARAMETER" ><LI ><P ><A -HREF="#LDAPSUFFIX" +HREF="#LDAPMACHINESUFFIX" ><TT CLASS="PARAMETER" ><I @@ -2461,203 +2461,11 @@ CLASS="PARAMETER" ><LI ><P ><A -HREF="#SSL" -><TT -CLASS="PARAMETER" -><I ->ssl</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLCACERTDIR" -><TT -CLASS="PARAMETER" -><I ->ssl CA certDir</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLCACERTFILE" -><TT -CLASS="PARAMETER" -><I ->ssl CA certFile</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLCIPHERS" -><TT -CLASS="PARAMETER" -><I ->ssl ciphers</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLCLIENTCERT" -><TT -CLASS="PARAMETER" -><I ->ssl client cert</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLCLIENTKEY" -><TT -CLASS="PARAMETER" -><I ->ssl client key</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLCOMPATIBILITY" -><TT -CLASS="PARAMETER" -><I ->ssl compatibility</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLEGDSOCKET" -><TT -CLASS="PARAMETER" -><I ->ssl egd socket</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLENTROPYBYTES" +HREF="#SPNEGO" ><TT CLASS="PARAMETER" ><I ->ssl entropy bytes</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLENTROPYFILE" -><TT -CLASS="PARAMETER" -><I ->ssl entropy file</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLHOSTS" -><TT -CLASS="PARAMETER" -><I ->ssl hosts</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLHOSTSRESIGN" -><TT -CLASS="PARAMETER" -><I ->ssl hosts resign</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLREQUIRECLIENTCERT" -><TT -CLASS="PARAMETER" -><I ->ssl require clientcert</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLREQUIRESERVERCERT" -><TT -CLASS="PARAMETER" -><I ->ssl require servercert</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLSERVERCERT" -><TT -CLASS="PARAMETER" -><I ->ssl server cert</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLSERVERKEY" -><TT -CLASS="PARAMETER" -><I ->ssl server key</I -></TT -></A -></P -></LI -><LI -><P -><A -HREF="#SSLVERSION" -><TT -CLASS="PARAMETER" -><I ->ssl version</I +>use spnego</I ></TT ></A ></P @@ -3063,7 +2871,7 @@ CLASS="PARAMETER" ><DIV CLASS="REFSECT1" ><A -NAME="AEN991" +NAME="AEN927" ></A ><H2 >COMPLETE LIST OF SERVICE PARAMETERS</H2 @@ -4542,7 +4350,7 @@ CLASS="PARAMETER" ><DIV CLASS="REFSECT1" ><A -NAME="AEN1483" +NAME="AEN1419" ></A ><H2 >EXPLANATION OF EACH PARAMETER</H2 @@ -5075,6 +4883,28 @@ CLASS="COMMAND" ></DD ><DT ><A +NAME="ADDGROUPSCRIPT" +></A +>add group script (G)</DT +><DD +><P +>This is the full pathname to a script that will + be run <EM +>AS ROOT</EM +> by <A +HREF="smbd.8.html" +TARGET="_top" +>smbd(8) when a new group is requested. It will expand any <TT +CLASS="PARAMETER" +><I +>%g</I +></TT +> to the group name passed. This script is only useful for installations using the Windows NT domain administration tools. + </A +> </P +></DD +><DT +><A NAME="ADMINUSERS" ></A >admin users (S)</DT @@ -6657,131 +6487,27 @@ NAME="DELETEUSERSCRIPT" ><DD ><P >This is the full pathname to a script that will - be run <EM ->AS ROOT</EM -> by <A + be run by <A HREF="smbd.8.html" TARGET="_top" -> <B +><B CLASS="COMMAND" >smbd(8)</B ></A -> under special circumstances - described below.</P -><P ->Normally, a Samba server requires that UNIX users are - created for all users accessing files on this server. For sites - that use Windows NT account databases as their primary user database - creating these users and keeping the user list in sync with the - Windows NT PDC is an onerous task. This option allows <B -CLASS="COMMAND" -> smbd</B -> to delete the required UNIX users <EM ->ON - DEMAND</EM -> when a user accesses the Samba server and the - Windows NT user no longer exists.</P -><P ->In order to use this option, <B -CLASS="COMMAND" ->smbd</B -> must be - set to <TT -CLASS="PARAMETER" -><I ->security = domain</I -></TT -> or <TT -CLASS="PARAMETER" -><I ->security = - user</I -></TT -> and <TT -CLASS="PARAMETER" -><I ->delete user script</I -></TT -> - must be set to a full pathname for a script - that will delete a UNIX user given one argument of <TT -CLASS="PARAMETER" -><I ->%u</I -></TT ->, - which expands into the UNIX user name to delete.</P +> + when managing user's with remote RPC (NT) tools. + </P ><P ->When the Windows user attempts to access the Samba server, - at <EM ->login</EM -> (session setup in the SMB protocol) - time, <B -CLASS="COMMAND" ->smbd</B -> contacts the <A -HREF="#PASSWORDSERVER" -> <TT -CLASS="PARAMETER" -><I ->password server</I -></TT -></A -> and attempts to authenticate - the given user with the given password. If the authentication fails - with the specific Domain error code meaning that the user no longer - exists then <B +>This script is called when a remote client removes a user + from the server, normally using 'User Manager for Domains' or + <B CLASS="COMMAND" ->smbd</B -> attempts to find a UNIX user in - the UNIX password database that matches the Windows user account. If - this lookup succeeds, and <TT -CLASS="PARAMETER" -><I ->delete user script</I -></TT -> is - set then <B -CLASS="COMMAND" ->smbd</B -> will all the specified script - <EM ->AS ROOT</EM ->, expanding any <TT -CLASS="PARAMETER" -><I ->%u</I -></TT -> - argument to be the user name to delete.</P -><P ->This script should delete the given UNIX username. In this way, - UNIX users are dynamically deleted to match existing Windows NT - accounts.</P +>rpcclient</B +>. + </P ><P ->See also <A -HREF="#SECURITYEQUALSDOMAIN" ->security = domain</A ->, - <A -HREF="#PASSWORDSERVER" -><TT -CLASS="PARAMETER" -><I ->password server</I -></TT -> - </A ->, <A -HREF="#ADDUSERSCRIPT" -><TT -CLASS="PARAMETER" -><I ->add user script</I -></TT -> - </A ->.</P +>This script should delete the given UNIX username. + </P ><P >Default: <B CLASS="COMMAND" @@ -9435,26 +9161,14 @@ NAME="LDAPADMINDN" >ldap admin dn (G)</DT ><DD ><P ->This parameter is only available if Samba has been - configure to include the <B -CLASS="COMMAND" ->--with-ldapsam</B -> option - at compile time. This option should be considered experimental and - under active development. - </P -><P -> The <TT +> The <TT CLASS="PARAMETER" ><I >ldap admin dn</I ></TT > defines the Distinguished - Name (DN) name used by Samba to contact the <A -HREF="#LDAPSERVER" ->ldap - server</A -> when retreiving user account information. The <TT + Name (DN) name used by Samba to contact the ldap server when retreiving + user account information. The <TT CLASS="PARAMETER" ><I >ldap @@ -9487,16 +9201,7 @@ NAME="LDAPFILTER" >ldap filter (G)</DT ><DD ><P ->This parameter is only available if Samba has been - configure to include the <B -CLASS="COMMAND" ->--with-ldapsam</B -> option - at compile time. This option should be considered experimental and - under active development. - </P -><P -> This parameter specifies the RFC 2254 compliant LDAP search filter. +>This parameter specifies the RFC 2254 compliant LDAP search filter. The default is to match the login name with the <TT CLASS="CONSTANT" >uid</TT @@ -9515,99 +9220,17 @@ CLASS="COMMAND" ></DD ><DT ><A -NAME="LDAPPORT" -></A ->ldap port (G)</DT -><DD -><P ->This parameter is only available if Samba has been - configure to include the <B -CLASS="COMMAND" ->--with-ldapsam</B -> option - at compile time. This option should be considered experimental and - under active development. - </P -><P -> This option is used to control the tcp port number used to contact - the <A -HREF="#LDAPSERVER" -><TT -CLASS="PARAMETER" -><I ->ldap server</I -></TT -></A ->. - The default is to use the stand LDAPS port 636. - </P -><P ->See Also: <A -HREF="#LDAPSSL" ->ldap ssl</A -> - </P -><P ->Default : <B -CLASS="COMMAND" ->ldap port = 636</B -></P -></DD -><DT -><A -NAME="LDAPSERVER" -></A ->ldap server (G)</DT -><DD -><P ->This parameter is only available if Samba has been - configure to include the <B -CLASS="COMMAND" ->--with-ldapsam</B -> option - at compile time. This option should be considered experimental and - under active development. - </P -><P -> This parameter should contains the FQDN of the ldap directory - server which should be queried to locate user account information. - </P -><P ->Default : <B -CLASS="COMMAND" ->ldap server = localhost</B -></P -></DD -><DT -><A NAME="LDAPSSL" ></A >ldap ssl (G)</DT ><DD ><P ->This parameter is only available if Samba has been - configure to include the <B -CLASS="COMMAND" ->--with-ldapsam</B -> option - at compile time. This option should be considered experimental and - under active development. - </P -><P -> This option is used to define whether or not Samba should - use SSL when connecting to the <A -HREF="#LDAPSERVER" -><TT -CLASS="PARAMETER" -><I ->ldap - server</I -></TT -></A ->. This is <EM +>This option is used to define whether or not Samba should + use SSL when connecting to the ldap server + This is <EM >NOT</EM > related to - Samba SSL support which is enabled by specifying the + Samba's previous SSL support which was enabled by specifying the <B CLASS="COMMAND" >--with-ssl</B @@ -9615,15 +9238,7 @@ CLASS="COMMAND" CLASS="FILENAME" >configure</TT > - script (see <A -HREF="#SSL" -><TT -CLASS="PARAMETER" -><I ->ssl</I -></TT -></A ->). + script. </P ><P > The <TT @@ -9665,13 +9280,33 @@ NAME="LDAPSUFFIX" >ldap suffix (G)</DT ><DD ><P ->This parameter is only available if Samba has been - configure to include the <B -CLASS="COMMAND" ->--with-ldapsam</B -> option - at compile time. This option should be considered experimental and - under active development. +>Default : <EM +>none</EM +></P +></DD +><DT +><A +NAME="LDAPUSERSUFFIX" +></A +>ldap user suffix (G)</DT +><DD +><P +>It specifies where users are added to the tree. + </P +><P +>Default : <EM +>none</EM +></P +></DD +><DT +><A +NAME="LDAPMACHINESUFFIX" +></A +>ldap machine suffix (G)</DT +><DD +><P +>It specifies where machines should be + added to the ldap tree. </P ><P >Default : <EM @@ -10135,12 +9770,14 @@ NAME="LOGLEVEL" >log level (G)</DT ><DD ><P ->The value of the parameter (an integer) allows +>The value of the parameter (a astring) allows the debug level (logging level) to be specified in the <TT CLASS="FILENAME" >smb.conf</TT -> file. This is to give greater +> file. This parameter has been + extended since 2.2.x series, now it allow to specify the debug + level for multiple debug classes. This is to give greater flexibility in the configuration of the system.</P ><P >The default will be the log level specified on @@ -10148,7 +9785,8 @@ CLASS="FILENAME" ><P >Example: <B CLASS="COMMAND" ->log level = 3</B +>log level = 3 passdb:5 auth:10 winbind:2 + </B ></P ></DD ><DT @@ -13058,23 +12696,41 @@ CLASS="COMMAND" >Any characters after the (optional) second : are passed to the plugin for its own processing</P ></LI +><LI +><P +><B +CLASS="COMMAND" +>unixsam</B +> - Allows samba to map all (other) available unix users</P +><P +>This backend uses the standard unix database for retrieving users. Users included + in this pdb are NOT listed in samba user listings and users included in this pdb won't be + able to login. The use of this backend is to always be able to display the owner of a file + on the samba server - even when the user doesn't have a 'real' samba account in one of the + other passdb backends. + </P +><P +>This backend should always be the last backend listed, since it contains all users in + the unix passdb and might 'override' mappings if specified earlier. It's meant to only return + accounts for users that aren't covered by the previous backends.</P +></LI ></UL > </P ><P >Default: <B CLASS="COMMAND" ->passdb backend = smbpasswd</B +>passdb backend = smbpasswd unixsam</B ></P ><P >Example: <B CLASS="COMMAND" ->passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd</B +>passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd unixsam</B ></P ><P >Example: <B CLASS="COMMAND" ->passdb backend = ldapsam_nua:ldaps://ldap.example.com</B +>passdb backend = ldapsam_nua:ldaps://ldap.example.com unixsam</B ></P ><P >Example: <B @@ -16667,606 +16323,15 @@ CLASS="COMMAND" ></DD ><DT ><A -NAME="SSL" -></A ->ssl (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->This variable enables or disables the entire SSL mode. If - it is set to <TT -CLASS="CONSTANT" ->no</TT ->, the SSL-enabled Samba behaves - exactly like the non-SSL Samba. If set to <TT -CLASS="CONSTANT" ->yes</TT ->, - it depends on the variables <A -HREF="#SSLHOSTS" -><TT -CLASS="PARAMETER" -><I -> ssl hosts</I -></TT -></A -> and <A -HREF="#SSLHOSTSRESIGN" -> <TT -CLASS="PARAMETER" -><I ->ssl hosts resign</I -></TT -></A -> whether an SSL - connection will be required.</P -><P ->Default: <B -CLASS="COMMAND" ->ssl = no</B -></P -></DD -><DT -><A -NAME="SSLCACERTDIR" -></A ->ssl CA certDir (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->This variable defines where to look up the Certification - Authorities. The given directory should contain one file for - each CA that Samba will trust. The file name must be the hash - value over the "Distinguished Name" of the CA. How this directory - is set up is explained later in this document. All files within the - directory that don't fit into this naming scheme are ignored. You - don't need this variable if you don't verify client certificates.</P -><P ->Default: <B -CLASS="COMMAND" ->ssl CA certDir = /usr/local/ssl/certs - </B -></P -></DD -><DT -><A -NAME="SSLCACERTFILE" +NAME="SPNEGO" ></A ->ssl CA certFile (G)</DT +>use spnego (G)</DT ><DD ><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->This variable is a second way to define the trusted CAs. - The certificates of the trusted CAs are collected in one big - file and this variable points to the file. You will probably - only use one of the two ways to define your CAs. The first choice is - preferable if you have many CAs or want to be flexible, the second - is preferable if you only have one CA and want to keep things - simple (you won't need to create the hashed file names). You - don't need this variable if you don't verify client certificates.</P +> This variable controls controls whether samba will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000sp2 clients to agree upon an authentication mechanism. As of samba 3.0alpha it must be set to "no" for these clients to join a samba domain controller. It can be set to "yes" to allow samba to participate in an AD domain controlled by a Windows2000 domain controller.</P ><P ->Default: <B -CLASS="COMMAND" ->ssl CA certFile = /usr/local/ssl/certs/trustedCAs.pem - </B -></P -></DD -><DT -><A -NAME="SSLCIPHERS" -></A ->ssl ciphers (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->This variable defines the ciphers that should be offered - during SSL negotiation. You should not set this variable unless - you know what you are doing.</P -></DD -><DT -><A -NAME="SSLCLIENTCERT" -></A ->ssl client cert (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->The certificate in this file is used by <A -HREF="smbclient.1.html" -TARGET="_top" -> <B -CLASS="COMMAND" ->smbclient(1)</B -></A -> if it exists. It's needed - if the server requires a client certificate.</P -><P ->Default: <B -CLASS="COMMAND" ->ssl client cert = /usr/local/ssl/certs/smbclient.pem - </B -></P -></DD -><DT -><A -NAME="SSLCLIENTKEY" -></A ->ssl client key (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->This is the private key for <A -HREF="smbclient.1.html" -TARGET="_top" -> <B -CLASS="COMMAND" ->smbclient(1)</B -></A ->. It's only needed if the - client should have a certificate. </P -><P ->Default: <B -CLASS="COMMAND" ->ssl client key = /usr/local/ssl/private/smbclient.pem - </B -></P -></DD -><DT -><A -NAME="SSLCOMPATIBILITY" -></A ->ssl compatibility (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->This variable defines whether OpenSSL should be configured - for bug compatibility with other SSL implementations. This is - probably not desirable because currently no clients with SSL - implementations other than OpenSSL exist.</P -><P ->Default: <B -CLASS="COMMAND" ->ssl compatibility = no</B -></P -></DD -><DT -><A -NAME="SSLEGDSOCKET" -></A ->ssl egd socket (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P -> This option is used to define the location of the communiation socket of - an EGD or PRNGD daemon, from which entropy can be retrieved. This option - can be used instead of or together with the <A -HREF="#SSLENTROPYFILE" -><TT -CLASS="PARAMETER" -><I ->ssl entropy file</I -></TT -></A -> - directive. 255 bytes of entropy will be retrieved from the daemon. - </P -><P ->Default: <EM ->none</EM -></P -></DD -><DT -><A -NAME="SSLENTROPYBYTES" -></A ->ssl entropy bytes (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P -> This parameter is used to define the number of bytes which should - be read from the <A -HREF="#SSLENTROPYFILE" -><TT -CLASS="PARAMETER" -><I ->ssl entropy - file</I -></TT -></A -> If a -1 is specified, the entire file will - be read. - </P -><P ->Default: <B -CLASS="COMMAND" ->ssl entropy bytes = 255</B -></P -></DD -><DT -><A -NAME="SSLENTROPYFILE" -></A ->ssl entropy file (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P -> This parameter is used to specify a file from which processes will - read "random bytes" on startup. In order to seed the internal pseudo - random number generator, entropy must be provided. On system with a - <TT -CLASS="FILENAME" ->/dev/urandom</TT -> device file, the processes - will retrieve its entropy from the kernel. On systems without kernel - entropy support, a file can be supplied that will be read on startup - and that will be used to seed the PRNG. - </P -><P ->Default: <EM ->none</EM -></P -></DD -><DT -><A -NAME="SSLHOSTS" -></A ->ssl hosts (G)</DT -><DD -><P ->See <A -HREF="#SSLHOSTSRESIGN" -><TT -CLASS="PARAMETER" -><I -> ssl hosts resign</I -></TT -></A ->.</P -></DD -><DT -><A -NAME="SSLHOSTSRESIGN" -></A ->ssl hosts resign (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->These two variables define whether Samba will go - into SSL mode or not. If none of them is defined, Samba will - allow only SSL connections. If the <A -HREF="#SSLHOSTS" -> <TT -CLASS="PARAMETER" -><I ->ssl hosts</I -></TT -></A -> variable lists - hosts (by IP-address, IP-address range, net group or name), - only these hosts will be forced into SSL mode. If the <TT -CLASS="PARAMETER" -><I -> ssl hosts resign</I -></TT -> variable lists hosts, only these - hosts will <EM ->NOT</EM -> be forced into SSL mode. The syntax for these two - variables is the same as for the <A -HREF="#HOSTSALLOW" -><TT -CLASS="PARAMETER" -><I -> hosts allow</I -></TT -></A -> and <A -HREF="#HOSTSDENY" -> <TT -CLASS="PARAMETER" -><I ->hosts deny</I -></TT -></A -> pair of variables, only - that the subject of the decision is different: It's not the access - right but whether SSL is used or not. </P -><P ->The example below requires SSL connections from all hosts - outside the local net (which is 192.168.*.*).</P -><P ->Default: <B -CLASS="COMMAND" ->ssl hosts = <empty string></B -></P -><P -><B -CLASS="COMMAND" ->ssl hosts resign = <empty string></B -></P -><P ->Example: <B -CLASS="COMMAND" ->ssl hosts resign = 192.168.</B -></P -></DD -><DT -><A -NAME="SSLREQUIRECLIENTCERT" -></A ->ssl require clientcert (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->If this variable is set to <TT -CLASS="CONSTANT" ->yes</TT ->, the - server will not tolerate connections from clients that don't - have a valid certificate. The directory/file given in <A -HREF="#SSLCACERTDIR" -><TT -CLASS="PARAMETER" -><I ->ssl CA certDir</I -></TT -> - </A -> and <A -HREF="#SSLCACERTFILE" -><TT -CLASS="PARAMETER" -><I ->ssl CA certFile - </I -></TT -></A -> will be used to look up the CAs that issued - the client's certificate. If the certificate can't be verified - positively, the connection will be terminated. If this variable - is set to <TT -CLASS="CONSTANT" ->no</TT ->, clients don't need certificates. - Contrary to web applications you really <EM ->should</EM -> - require client certificates. In the web environment the client's - data is sensitive (credit card numbers) and the server must prove - to be trustworthy. In a file server environment the server's data - will be sensitive and the clients must prove to be trustworthy.</P -><P ->Default: <B -CLASS="COMMAND" ->ssl require clientcert = no</B -></P -></DD -><DT -><A -NAME="SSLREQUIRESERVERCERT" -></A ->ssl require servercert (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->If this variable is set to <TT -CLASS="CONSTANT" ->yes</TT ->, the - <A -HREF="smbclient.1.html" -TARGET="_top" -><B -CLASS="COMMAND" ->smbclient(1)</B -> - </A -> will request a certificate from the server. Same as - <A -HREF="#SSLREQUIRECLIENTCERT" -><TT -CLASS="PARAMETER" -><I ->ssl require - clientcert</I -></TT -></A -> for the server.</P -><P ->Default: <B -CLASS="COMMAND" ->ssl require servercert = no</B -> - </P -></DD -><DT -><A -NAME="SSLSERVERCERT" -></A ->ssl server cert (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->This is the file containing the server's certificate. - The server <EM ->must</EM -> have a certificate. The - file may also contain the server's private key. See later for - how certificates and private keys are created.</P -><P ->Default: <B -CLASS="COMMAND" ->ssl server cert = <empty string> - </B -></P -></DD -><DT -><A -NAME="SSLSERVERKEY" -></A ->ssl server key (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->This file contains the private key of the server. If - this variable is not defined, the key is looked up in the - certificate file (it may be appended to the certificate). - The server <EM ->must</EM -> have a private key - and the certificate <EM ->must</EM -> - match this private key.</P -><P ->Default: <B -CLASS="COMMAND" ->ssl server key = <empty string> - </B -></P -></DD -><DT -><A -NAME="SSLVERSION" -></A ->ssl version (G)</DT -><DD -><P ->This variable is part of SSL-enabled Samba. This - is only available if the SSL libraries have been compiled on your - system and the configure option <B -CLASS="COMMAND" ->--with-ssl</B -> was - given at configure time.</P -><P ->This enumeration variable defines the versions of the - SSL protocol that will be used. <TT -CLASS="CONSTANT" ->ssl2or3</TT -> allows - dynamic negotiation of SSL v2 or v3, <TT -CLASS="CONSTANT" ->ssl2</TT -> results - in SSL v2, <TT -CLASS="CONSTANT" ->ssl3</TT -> results in SSL v3 and - <TT -CLASS="CONSTANT" ->tls1</TT -> results in TLS v1. TLS (Transport Layer - Security) is the new standard for SSL.</P -><P ->Default: <B -CLASS="COMMAND" ->ssl version = "ssl2or3"</B +>Default: <EM +>use spnego = yes</EM ></P ></DD ><DT @@ -17730,9 +16795,9 @@ NAME="UNIXEXTENSIONS" ><DD ><P >This boolean parameter controls whether Samba - implments the CIFS UNIX extensions, as defined by HP. These - extensions enable CIFS to server UNIX clients to UNIX servers - better, and allow such things as symbolic links, hard links etc. + implments the CIFS UNIX extensions, as defined by HP. + These extensions enable Samba to better serve UNIX CIFS clients + by supporting features such as symbolic links, hard links, etc... These extensions require a similarly enabled client, and are of no current use to Windows clients.</P ><P @@ -18300,6 +17365,12 @@ CLASS="CONSTANT" connection is made to a Samba server. Sites may use this to record the user connecting to a Samba share.</P ><P +>Due to the requirements of the utmp record, we + are required to create a unique identifier for the + incoming user. Enabling this option creates an n^2 + algorithm to find this number. This may impede + performance on large installations. </P +><P >See also the <A HREF="#UTMPDIRECTORY" ><TT @@ -19246,7 +18317,7 @@ CLASS="COMMAND" ><DIV CLASS="REFSECT1" ><A -NAME="AEN6101" +NAME="AEN5817" ></A ><H2 >WARNINGS</H2 @@ -19276,7 +18347,7 @@ TARGET="_top" ><DIV CLASS="REFSECT1" ><A -NAME="AEN6107" +NAME="AEN5823" ></A ><H2 >VERSION</H2 @@ -19287,7 +18358,7 @@ NAME="AEN6107" ><DIV CLASS="REFSECT1" ><A -NAME="AEN6110" +NAME="AEN5826" ></A ><H2 >SEE ALSO</H2 @@ -19366,7 +18437,7 @@ CLASS="COMMAND" ><DIV CLASS="REFSECT1" ><A -NAME="AEN6130" +NAME="AEN5846" ></A ><H2 >AUTHOR</H2 diff --git a/docs/htmldocs/smbcontrol.1.html b/docs/htmldocs/smbcontrol.1.html index 5dc9854a84..74c2854a86 100644 --- a/docs/htmldocs/smbcontrol.1.html +++ b/docs/htmldocs/smbcontrol.1.html @@ -170,7 +170,7 @@ CLASS="CONSTANT" >, or <TT CLASS="CONSTANT" ->printer-notify</TT +>printnotify</TT >.</P ><P >The <TT @@ -246,15 +246,68 @@ CLASS="CONSTANT" ><P >The <TT CLASS="CONSTANT" ->printer-notify</TT +>printnotify</TT > message-type sends a message to smbd which in turn sends a printer notify message to - any Windows NT clients connected to a printer. This message-type - takes an argument of the printer name to send notify messages to. + any Windows NT clients connected to a printer. This message-type + takes the following arguments: + + <P +></P +><DIV +CLASS="VARIABLELIST" +><DL +><DT +>queuepause printername</DT +><DD +><P +>Send a queue pause change notify + message to the printer specified.</P +></DD +><DT +>queueresume printername</DT +><DD +><P +>Send a queue resume change notify + message for the printer specified.</P +></DD +><DT +>jobpause printername unixjobid</DT +><DD +><P +>Send a job pause change notify + message for the printer and unix jobid + specified.</P +></DD +><DT +>jobresume printername unixjobid</DT +><DD +><P +>Send a job resume change notify + message for the printer and unix jobid + specified.</P +></DD +><DT +>jobdelete printername unixjobid</DT +><DD +><P +>Send a job delete change notify + message for the printer and unix jobid + specified.</P +></DD +></DL +></DIV +> + + Note that this message only sends notification that an + event has occured. It doesn't actually cause the + event to happen. + This message can only be sent to <TT CLASS="CONSTANT" >smbd</TT ->.</P +>. + </P ></DD ><DT >parameters</DT @@ -268,7 +321,7 @@ CLASS="CONSTANT" ><DIV CLASS="REFSECT1" ><A -NAME="AEN81" +NAME="AEN102" ></A ><H2 >VERSION</H2 @@ -279,7 +332,7 @@ NAME="AEN81" ><DIV CLASS="REFSECT1" ><A -NAME="AEN84" +NAME="AEN105" ></A ><H2 >SEE ALSO</H2 @@ -305,7 +358,7 @@ CLASS="COMMAND" ><DIV CLASS="REFSECT1" ><A -NAME="AEN91" +NAME="AEN112" ></A ><H2 >AUTHOR</H2 diff --git a/docs/htmldocs/winbind.html b/docs/htmldocs/winbind.html index 6063828222..7d45b174dd 100644 --- a/docs/htmldocs/winbind.html +++ b/docs/htmldocs/winbind.html @@ -410,12 +410,20 @@ for providing the HOWTO for this section.</P >This HOWTO describes how to get winbind services up and running to control access and authenticate users on your Linux box using the winbind services which come with SAMBA 2.2.2.</P +><P +>There is also some Solaris specific information in +<TT +CLASS="FILENAME" +>docs/textdocs/Solaris-Winbind-HOWTO.txt</TT +>. +Future revisions of this document will incorporate that +information.</P ><DIV CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN76" +NAME="AEN78" >Introduction</A ></H2 ><P @@ -468,7 +476,7 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN89" +NAME="AEN91" >Requirements</A ></H2 ><P @@ -529,7 +537,7 @@ CLASS="SECT2" ><HR><H2 CLASS="SECT2" ><A -NAME="AEN103" +NAME="AEN105" >Testing Things Out</A ></H2 ><P @@ -574,7 +582,7 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN114" +NAME="AEN116" >Configure and compile SAMBA</A ></H3 ><P @@ -640,7 +648,7 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN133" +NAME="AEN135" >Configure <TT CLASS="FILENAME" >nsswitch.conf</TT @@ -672,6 +680,30 @@ CLASS="COMMAND" >ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2</B ></P ><P +>And, in the case of Sun solaris:</P +><P +><TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1</B +> +<TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1</B +> +<TT +CLASS="PROMPT" +>root#</TT +> <B +CLASS="COMMAND" +>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2</B +></P +><P >Now, as root you need to edit <TT CLASS="FILENAME" >/etc/nsswitch.conf</TT @@ -721,7 +753,7 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN158" +NAME="AEN168" >Configure smb.conf</A ></H3 ><P @@ -796,7 +828,7 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN174" +NAME="AEN184" >Join the SAMBA server to the PDC domain</A ></H3 ><P @@ -842,7 +874,7 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN185" +NAME="AEN195" >Start up the winbindd daemon and test it!</A ></H3 ><P @@ -965,12 +997,17 @@ CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN221" ->Fix the <TT -CLASS="FILENAME" ->/etc/rc.d/init.d/smb</TT -> startup files</A +NAME="AEN231" +>Fix the init.d startup scripts</A ></H3 +><DIV +CLASS="SECT4" +><H4 +CLASS="SECT4" +><A +NAME="AEN233" +>Linux</A +></H4 ><P >The <B CLASS="COMMAND" @@ -983,15 +1020,16 @@ CLASS="COMMAND" CLASS="COMMAND" >nmbd</B > daemons are running. -To accomplish this task, you need to modify the <TT +To accomplish this task, you need to modify the startup scripts of your system. They are located at <TT CLASS="FILENAME" >/etc/init.d/smb</TT -> -script to add commands to invoke this daemon in the proper sequence. My +> in RedHat and <TT CLASS="FILENAME" ->/etc/init.d/smb</TT -> file starts up <B +>/etc/init.d/samba</TT +> in Debian. +script to add commands to invoke this daemon in the proper sequence. My +startup script starts up <B CLASS="COMMAND" >smbd</B >, @@ -1057,6 +1095,86 @@ CLASS="PROGRAMLISTING" return $RETVAL }</PRE ></P +></DIV +><DIV +CLASS="SECT4" +><HR><H4 +CLASS="SECT4" +><A +NAME="AEN250" +>Solaris</A +></H4 +><P +>On solaris, you need to modify the +<TT +CLASS="FILENAME" +>/etc/init.d/samba.server</TT +> startup script. It usually +only starts smbd and nmbd but should now start winbindd too. If you +have samba installed in <TT +CLASS="FILENAME" +>/usr/local/samba/bin</TT +>, +the file could contains something like this:</P +><P +><PRE +CLASS="PROGRAMLISTING" +>## +## samba.server +## + +if [ ! -d /usr/bin ] +then # /usr not mounted + exit +fi + +killproc() { # kill the named process(es) + pid=`/usr/bin/ps -e | + /usr/bin/grep -w $1 | + /usr/bin/sed -e 's/^ *//' -e 's/ .*//'` + [ "$pid" != "" ] && kill $pid +} + +# Start/stop processes required for samba server + +case "$1" in + +'start') +# +# Edit these lines to suit your installation (paths, workgroup, host) +# +echo Starting SMBD + /usr/local/samba/bin/smbd -D -s \ + /usr/local/samba/smb.conf + +echo Starting NMBD + /usr/local/samba/bin/nmbd -D -l \ + /usr/local/samba/var/log -s /usr/local/samba/smb.conf + +echo Starting Winbind Daemon + /usr/local/samba/bin/winbindd + ;; + +'stop') + killproc nmbd + killproc smbd + killproc winbindd + ;; + +*) + echo "Usage: /etc/init.d/samba.server { start | stop }" + ;; +esac</PRE +></P +></DIV +><DIV +CLASS="SECT4" +><HR><H4 +CLASS="SECT4" +><A +NAME="AEN257" +>Restarting</A +></H4 ><P >If you restart the <B CLASS="COMMAND" @@ -1072,12 +1190,13 @@ CLASS="COMMAND" should be able to connect to the samba server as a domain member just as if you were a local user.</P ></DIV +></DIV ><DIV CLASS="SECT3" ><HR><H3 CLASS="SECT3" ><A -NAME="AEN243" +NAME="AEN263" >Configure Winbind and PAM</A ></H3 ><P @@ -1117,7 +1236,11 @@ your other pam security modules. On my RedHat system, this was the <TT CLASS="FILENAME" >/lib/security</TT -> directory.</P +> directory. On Solaris, the pam security +modules reside in <TT +CLASS="FILENAME" +>/usr/lib/security</TT +>.</P ><P ><TT CLASS="PROMPT" @@ -1126,6 +1249,14 @@ CLASS="PROMPT" CLASS="COMMAND" >cp ../samba/source/nsswitch/pam_winbind.so /lib/security</B ></P +><DIV +CLASS="SECT4" +><HR><H4 +CLASS="SECT4" +><A +NAME="AEN280" +>Linux/FreeBSD-specific PAM configuration</A +></H4 ><P >The <TT CLASS="FILENAME" @@ -1247,6 +1378,91 @@ CLASS="COMMAND" > line to get rid of annoying double prompts for passwords.</P ></DIV +><DIV +CLASS="SECT4" +><HR><H4 +CLASS="SECT4" +><A +NAME="AEN313" +>Solaris-specific configuration</A +></H4 +><P +>The /etc/pam.conf needs to be changed. I changed this file so that my Domain +users can logon both locally as well as telnet.The following are the changes +that I made.You can customize the pam.conf file as per your requirements,but +be sure of those changes because in the worst case it will leave your system +nearly impossible to boot.</P +><P +><PRE +CLASS="PROGRAMLISTING" +># +#ident "@(#)pam.conf 1.14 99/09/16 SMI" +# +# Copyright (c) 1996-1999, Sun Microsystems, Inc. +# All Rights Reserved. +# +# PAM configuration +# +# Authentication management +# +login auth required /usr/lib/security/pam_winbind.so +login auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass +login auth required /usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass +# +rlogin auth sufficient /usr/lib/security/pam_winbind.so +rlogin auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1 +rlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass +# +dtlogin auth sufficient /usr/lib/security/pam_winbind.so +dtlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass +# +rsh auth required /usr/lib/security/$ISA/pam_rhosts_auth.so.1 +other auth sufficient /usr/lib/security/pam_winbind.so +other auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass +# +# Account management +# +login account sufficient /usr/lib/security/pam_winbind.so +login account requisite /usr/lib/security/$ISA/pam_roles.so.1 +login account required /usr/lib/security/$ISA/pam_unix.so.1 +# +dtlogin account sufficient /usr/lib/security/pam_winbind.so +dtlogin account requisite /usr/lib/security/$ISA/pam_roles.so.1 +dtlogin account required /usr/lib/security/$ISA/pam_unix.so.1 +# +other account sufficient /usr/lib/security/pam_winbind.so +other account requisite /usr/lib/security/$ISA/pam_roles.so.1 +other account required /usr/lib/security/$ISA/pam_unix.so.1 +# +# Session management +# +other session required /usr/lib/security/$ISA/pam_unix.so.1 +# +# Password management +# +#other password sufficient /usr/lib/security/pam_winbind.so +other password required /usr/lib/security/$ISA/pam_unix.so.1 +dtsession auth required /usr/lib/security/$ISA/pam_unix.so.1 +# +# Support for Kerberos V5 authentication (uncomment to use Kerberos) +# +#rlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#login auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#dtlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#other auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#dtlogin account optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other account optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other session optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass</PRE +></P +><P +>I also added a try_first_pass line after the winbind.so line to get rid of +annoying double prompts for passwords.</P +><P +>Now restart your Samba & try connecting through your application that you +configured in the pam.conf.</P +></DIV +></DIV ></DIV ></DIV ><DIV @@ -1254,7 +1470,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN290" +NAME="AEN320" >Limitations</A ></H1 ><P @@ -1295,7 +1511,7 @@ CLASS="SECT1" ><HR><H1 CLASS="SECT1" ><A -NAME="AEN300" +NAME="AEN330" >Conclusion</A ></H1 ><P |