diff options
Diffstat (limited to 'docs/htmldocs')
| -rw-r--r-- | docs/htmldocs/ads.html | 467 | ||||
| -rw-r--r-- | docs/htmldocs/advancednetworkmanagement.html | 555 | ||||
| -rw-r--r-- | docs/htmldocs/appendixes.html | 140 | ||||
| -rw-r--r-- | docs/htmldocs/browsing-quick.html | 805 | ||||
| -rw-r--r-- | docs/htmldocs/cups-printing.html | 2773 | ||||
| -rw-r--r-- | docs/htmldocs/domain-security.html | 427 | ||||
| -rw-r--r-- | docs/htmldocs/groupprofiles.html | 568 | ||||
| -rw-r--r-- | docs/htmldocs/improved-browsing.html | 1094 | ||||
| -rwxr-xr-x | docs/htmldocs/index.html | 76 | ||||
| -rw-r--r-- | docs/htmldocs/interdomaintrusts.html | 451 | ||||
| -rw-r--r-- | docs/htmldocs/introsmb.html | 659 | ||||
| -rw-r--r-- | docs/htmldocs/nt4migration.html | 356 | ||||
| -rw-r--r-- | docs/htmldocs/other-clients.html | 734 | ||||
| -rw-r--r-- | docs/htmldocs/policymgmt.html | 758 | ||||
| -rw-r--r-- | docs/htmldocs/portability.html | 418 | ||||
| -rw-r--r-- | docs/htmldocs/profilemgmt.html | 1753 | ||||
| -rw-r--r-- | docs/htmldocs/samba-howto-collection.html | 1394 | ||||
| -rw-r--r-- | docs/htmldocs/securitylevels.html | 212 | ||||
| -rw-r--r-- | docs/htmldocs/servertype.html | 368 | ||||
| -rw-r--r-- | docs/htmldocs/swat.html | 233 | ||||
| -rw-r--r-- | docs/htmldocs/unix-permissions.html | 194 | ||||
| -rw-r--r-- | docs/htmldocs/vfs.html | 490 |
22 files changed, 0 insertions, 14925 deletions
diff --git a/docs/htmldocs/ads.html b/docs/htmldocs/ads.html deleted file mode 100644 index b7468eb091..0000000000 --- a/docs/htmldocs/ads.html +++ /dev/null @@ -1,467 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Samba as a ADS domain member</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Type of installation" -HREF="type.html"><LINK -REL="PREVIOUS" -TITLE="Samba Backup Domain Controller to Samba Domain Control" -HREF="samba-bdc.html"><LINK -REL="NEXT" -TITLE="Samba as a NT4 or Win2k domain member" -HREF="domain-member.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="samba-bdc.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="domain-member.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="ADS" -></A ->Chapter 9. Samba as a ADS domain member</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->9.1. <A -HREF="ads.html#AEN1363" ->Setup your <TT -CLASS="FILENAME" ->smb.conf</TT -></A -></DT -><DT ->9.2. <A -HREF="ads.html#AEN1376" ->Setup your <TT -CLASS="FILENAME" ->/etc/krb5.conf</TT -></A -></DT -><DT ->9.3. <A -HREF="ads.html#ADS-CREATE-MACHINE-ACCOUNT" ->Create the computer account</A -></DT -><DT ->9.4. <A -HREF="ads.html#ADS-TEST-SERVER" ->Test your server setup</A -></DT -><DT ->9.5. <A -HREF="ads.html#ADS-TEST-SMBCLIENT" ->Testing with <SPAN -CLASS="APPLICATION" ->smbclient</SPAN -></A -></DT -><DT ->9.6. <A -HREF="ads.html#AEN1424" ->Notes</A -></DT -></DL -></DIV -><P ->This is a rough guide to setting up Samba 3.0 with kerberos authentication against a -Windows2000 KDC. </P -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN1363" ->9.1. Setup your <TT -CLASS="FILENAME" ->smb.conf</TT -></A -></H1 -><P ->You must use at least the following 3 options in smb.conf:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> realm = YOUR.KERBEROS.REALM - security = ADS - encrypt passwords = yes</PRE -></P -><P ->In case samba can't figure out your ads server using your realm name, use the -<B -CLASS="COMMAND" ->ads server</B -> option in <TT -CLASS="FILENAME" ->smb.conf</TT ->: -<PRE -CLASS="PROGRAMLISTING" -> ads server = your.kerberos.server</PRE -></P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->You do *not* need a smbpasswd file, and older clients will - be authenticated as if <B -CLASS="COMMAND" ->security = domain</B ->, - although it won't do any harm - and allows you to have local users not in the domain. - I expect that the above required options will change soon when we get better - active directory integration.</P -></TD -></TR -></TABLE -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN1376" ->9.2. Setup your <TT -CLASS="FILENAME" ->/etc/krb5.conf</TT -></A -></H1 -><P ->The minimal configuration for <TT -CLASS="FILENAME" ->krb5.conf</TT -> is:</P -><P -><PRE -CLASS="PROGRAMLISTING" ->[realms] - YOUR.KERBEROS.REALM = { - kdc = your.kerberos.server - }</PRE -></P -><P ->Test your config by doing a <KBD -CLASS="USERINPUT" ->kinit <VAR -CLASS="REPLACEABLE" ->USERNAME</VAR ->@<VAR -CLASS="REPLACEABLE" ->REALM</VAR -></KBD -> and making sure that - your password is accepted by the Win2000 KDC. </P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->The realm must be uppercase. </P -></TD -></TR -></TABLE -></DIV -><P ->You also must ensure that you can do a reverse DNS lookup on the IP -address of your KDC. Also, the name that this reverse lookup maps to -must either be the netbios name of the KDC (ie. the hostname with no -domain attached) or it can alternatively be the netbios name -followed by the realm. </P -><P ->The easiest way to ensure you get this right is to add a -<TT -CLASS="FILENAME" ->/etc/hosts</TT -> entry mapping the IP address of your KDC to -its netbios name. If you don't get this right then you will get a -"local error" when you try to join the realm.</P -><P ->If all you want is kerberos support in <SPAN -CLASS="APPLICATION" ->smbclient</SPAN -> then you can skip -straight to <A -HREF="ads.html#ADS-TEST-SMBCLIENT" ->Test with <SPAN -CLASS="APPLICATION" ->smbclient</SPAN -></A -> now. -<A -HREF="ads.html#ADS-CREATE-MACHINE-ACCOUNT" ->Creating a computer account</A -> -and <A -HREF="ads.html#ADS-TEST-SERVER" ->testing your servers</A -> -is only needed if you want kerberos -support for <SPAN -CLASS="APPLICATION" ->smbd</SPAN -> and <SPAN -CLASS="APPLICATION" ->winbindd</SPAN ->.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="ADS-CREATE-MACHINE-ACCOUNT" ->9.3. Create the computer account</A -></H1 -><P ->As a user that has write permission on the Samba private directory -(usually root) run: -<KBD -CLASS="USERINPUT" ->net ads join</KBD -></P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN1404" ->9.3.1. Possible errors</A -></H2 -><P -><P -></P -><DIV -CLASS="VARIABLELIST" -><DL -><DT ->"ADS support not compiled in"</DT -><DD -><P ->Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the kerberos libs and headers are installed.</P -></DD -></DL -></DIV -></P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="ADS-TEST-SERVER" ->9.4. Test your server setup</A -></H1 -><P ->On a Windows 2000 client try <KBD -CLASS="USERINPUT" ->net use * \\server\share</KBD ->. You should -be logged in with kerberos without needing to know a password. If -this fails then run <KBD -CLASS="USERINPUT" ->klist tickets</KBD ->. Did you get a ticket for the -server? Does it have an encoding type of DES-CBC-MD5 ? </P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="ADS-TEST-SMBCLIENT" ->9.5. Testing with <SPAN -CLASS="APPLICATION" ->smbclient</SPAN -></A -></H1 -><P ->On your Samba server try to login to a Win2000 server or your Samba -server using <SPAN -CLASS="APPLICATION" ->smbclient</SPAN -> and kerberos. Use <SPAN -CLASS="APPLICATION" ->smbclient</SPAN -> as usual, but -specify the <VAR -CLASS="PARAMETER" ->-k</VAR -> option to choose kerberos authentication.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN1424" ->9.6. Notes</A -></H1 -><P ->You must change administrator password at least once after DC -install, to create the right encoding types</P -><P ->w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in - their defaults DNS setup. Maybe fixed in service packs?</P -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="samba-bdc.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="domain-member.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Samba Backup Domain Controller to Samba Domain Control</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="type.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Samba as a NT4 or Win2k domain member</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/advancednetworkmanagement.html b/docs/htmldocs/advancednetworkmanagement.html deleted file mode 100644 index b55eed16bc..0000000000 --- a/docs/htmldocs/advancednetworkmanagement.html +++ /dev/null @@ -1,555 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Advanced Network Manangement</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Advanced Configuration" -HREF="optional.html"><LINK -REL="PREVIOUS" -TITLE="Unified Logons between Windows NT and UNIX using Winbind" -HREF="winbind.html"><LINK -REL="NEXT" -TITLE="System and Account Policies" -HREF="policymgmt.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="winbind.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="policymgmt.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="ADVANCEDNETWORKMANAGEMENT" -></A ->Chapter 16. Advanced Network Manangement</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->16.1. <A -HREF="advancednetworkmanagement.html#AEN2869" ->Configuring Samba Share Access Controls</A -></DT -><DT ->16.2. <A -HREF="advancednetworkmanagement.html#AEN2907" ->Remote Server Administration</A -></DT -><DT ->16.3. <A -HREF="advancednetworkmanagement.html#AEN2924" ->Network Logon Script Magic</A -></DT -></DL -></DIV -><P ->This section attempts to document peripheral issues that are of great importance to network -administrators who want to improve network resource access control, to automate the user -environment, and to make their lives a little easier.</P -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2869" ->16.1. Configuring Samba Share Access Controls</A -></H1 -><P ->This section deals with how to configure Samba per share access control restrictions. -By default samba sets no restrictions on the share itself. Restrictions on the share itself -can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can -connect to a share. In the absence of specific restrictions the default setting is to allow -the global user <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Everyone</I -></SPAN -> Full Control (ie: Full control, Change and Read).</P -><P ->At this time Samba does NOT provide a tool for configuring access control setting on the Share -itself. Samba does have the capacity to store and act on access control settings, but the only -way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for -Computer Management.</P -><P ->Samba stores the per share access control settings in a file called <TT -CLASS="FILENAME" ->share_info.tdb</TT ->. -The location of this file on your system will depend on how samba was compiled. The default location -for samba's tdb files is under <TT -CLASS="FILENAME" ->/usr/local/samba/var</TT ->. If the <TT -CLASS="FILENAME" ->tdbdump</TT -> -utility has been compiled and installed on your system then you can examine the contents of this file -by: <KBD -CLASS="USERINPUT" ->tdbdump share_info.tdb</KBD ->.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN2879" ->16.1.1. Share Permissions Management</A -></H2 -><P ->The best tool for the task is platform dependant. Choose the best tool for your environmemt.</P -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN2882" ->16.1.1.1. Windows NT4 Workstation/Server</A -></H3 -><P ->The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. -Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. -You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below.</P -><DIV -CLASS="PROCEDURE" -><P -><B ->Instructions</B -></P -><OL -TYPE="1" -><LI -><P ->Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu -select Computer, then click on the Shared Directories entry.</P -></LI -><LI -><P -> Now click on the share that you wish to manage, then click on the Properties tab, next click on - the Permissions tab. Now you can Add or change access control settings as you wish.</P -></LI -></OL -></DIV -></DIV -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN2891" ->16.1.1.2. Windows 200x/XP</A -></H3 -><P ->On MS Windows NT4/200x/XP system access control lists on the share itself are set using native -tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, -then select 'Sharing', then click on 'Permissions'. The default Windows NT4/200x permission allows -<SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Everyone</I -></SPAN -> Full Control on the Share.</P -><P ->MS Windows 200x and later all comes with a tool called the 'Computer Management' snap-in for the -Microsoft Management Console (MMC). This tool is located by clicking on <TT -CLASS="FILENAME" ->Control Panel -> -Administrative Tools -> Computer Management</TT ->.</P -><DIV -CLASS="PROCEDURE" -><P -><B ->Instructions</B -></P -><OL -TYPE="1" -><LI -><P -> After launching the MMC with the Computer Management snap-in, click on the menu item 'Action', - select 'Connect to another computer'. If you are not logged onto a domain you will be prompted - to enter a domain login user identifier and a password. This will authenticate you to the domain. - If you where already logged in with administrative privilidge this step is not offered.</P -></LI -><LI -><P ->If the Samba server is not shown in the Select Computer box, then type in the name of the target -Samba server in the field 'Name:'. Now click on the [+] next to 'System Tools', then on the [+] -next to 'Shared Folders' in the left panel.</P -></LI -><LI -><P ->Now in the right panel, double-click on the share you wish to set access control permissions on. -Then click on the tab 'Share Permissions'. It is now possible to add access control entities -to the shared folder. Do NOT forget to set what type of access (full control, change, read) you -wish to assign for each entry.</P -></LI -></OL -></DIV -><DIV -CLASS="WARNING" -><P -></P -><TABLE -CLASS="WARNING" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif" -HSPACE="5" -ALT="Warning"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Be careful. If you take away all permissions from the Everyone user without removing this user -then effectively no user will be able to access the share. This is a result of what is known as -ACL precidence. ie: Everyone with NO ACCESS means that MaryK who is part of the group Everyone -will have no access even if this user is given explicit full control access.</P -></TD -></TR -></TABLE -></DIV -></DIV -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2907" ->16.2. Remote Server Administration</A -></H1 -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->How do I get 'User Manager' and 'Server Manager'?</I -></SPAN -></P -><P ->Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', -the 'Server Manager'?</P -><P ->Microsoft distributes a version of these tools called nexus for installation on Windows 9x / Me -systems. The tools set includes:</P -><P -></P -><UL -><LI -><P ->Server Manager</P -></LI -><LI -><P ->User Manager for Domains</P -></LI -><LI -><P ->Event Viewer</P -></LI -></UL -><P ->Click here to download the archived file <A -HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE" -TARGET="_top" ->ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A -></P -><P ->The Windows NT 4.0 version of the 'User Manager for -Domains' and 'Server Manager' are available from Microsoft via ftp -from <A -HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" -TARGET="_top" ->ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A -></P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2924" ->16.3. Network Logon Script Magic</A -></H1 -><P ->This section needs work. Volunteer contributions most welcome. Please send your patches or updates -to <A -HREF="mailto:jht@samba.org" -TARGET="_top" ->John Terpstra</A ->.</P -><P ->There are several opportunities for creating a custom network startup configuration environment.</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->No Logon Script</TD -></TR -><TR -><TD ->Simple universal Logon Script that applies to all users</TD -></TR -><TR -><TD ->Use of a conditional Logon Script that applies per user or per group attirbutes</TD -></TR -><TR -><TD ->Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create - a custom Logon Script and then execute it.</TD -></TR -><TR -><TD ->User of a tool such as KixStart</TD -></TR -></TBODY -></TABLE -><P -></P -><P ->The Samba source code tree includes two logon script generation/execution tools. See <TT -CLASS="FILENAME" ->examples</TT -> directory <TT -CLASS="FILENAME" ->genlogon</TT -> and <TT -CLASS="FILENAME" ->ntlogon</TT -> subdirectories.</P -><P ->The following listings are from the genlogon directory.</P -><P ->This is the genlogon.pl file: - -<PRE -CLASS="PROGRAMLISTING" -> #!/usr/bin/perl - # - # genlogon.pl - # - # Perl script to generate user logon scripts on the fly, when users - # connect from a Windows client. This script should be called from smb.conf - # with the %U, %G and %L parameters. I.e: - # - # root preexec = genlogon.pl %U %G %L - # - # The script generated will perform - # the following: - # - # 1. Log the user connection to /var/log/samba/netlogon.log - # 2. Set the PC's time to the Linux server time (which is maintained - # daily to the National Institute of Standard's Atomic clock on the - # internet. - # 3. Connect the user's home drive to H: (H for Home). - # 4. Connect common drives that everyone uses. - # 5. Connect group-specific drives for certain user groups. - # 6. Connect user-specific drives for certain users. - # 7. Connect network printers. - - # Log client connection - #($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time); - ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time); - open LOG, ">>/var/log/samba/netlogon.log"; - print LOG "$mon/$mday/$year $hour:$min:$sec - User $ARGV[0] logged into $ARGV[1]\n"; - close LOG; - - # Start generating logon script - open LOGON, ">/shared/netlogon/$ARGV[0].bat"; - print LOGON "\@ECHO OFF\r\n"; - - # Connect shares just use by Software Development group - if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev") - { - print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n"; - } - - # Connect shares just use by Technical Support staff - if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support") - { - print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n"; - } - - # Connect shares just used by Administration staff - If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin") - { - print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n"; - print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n"; - } - - # Now connect Printers. We handle just two or three users a little - # differently, because they are the exceptions that have desktop - # printers on LPT1: - all other user's go to the LaserJet on the - # server. - if ($ARGV[0] eq 'jim' - || $ARGV[0] eq 'yvonne') - { - print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n"; - print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n"; - } - else - { - print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n"; - print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n"; - } - - # All done! Close the output file. - close LOGON;</PRE -></P -><P ->Those wishing to use more elaborate or capable logon processing system should check out the following sites:</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->http://www.craigelachie.org/rhacer/ntlogon</TD -></TR -><TR -><TD ->http://www.kixtart.org</TD -></TR -></TBODY -></TABLE -><P -></P -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="winbind.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="policymgmt.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Unified Logons between Windows NT and UNIX using Winbind</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="optional.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->System and Account Policies</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/appendixes.html b/docs/htmldocs/appendixes.html deleted file mode 100644 index 8015702c51..0000000000 --- a/docs/htmldocs/appendixes.html +++ /dev/null @@ -1,140 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Appendixes</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="PREVIOUS" -TITLE="Unicode/Charsets" -HREF="unicode.html"><LINK -REL="NEXT" -TITLE="How to compile SAMBA" -HREF="compiling.html"></HEAD -><BODY -CLASS="PART" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="unicode.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="compiling.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="PART" -><A -NAME="APPENDIXES" -></A -><DIV -CLASS="TITLEPAGE" -><H1 -CLASS="TITLE" ->IV. Appendixes</H1 -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="unicode.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="compiling.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Unicode/Charsets</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -> </TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->How to compile SAMBA</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/browsing-quick.html b/docs/htmldocs/browsing-quick.html deleted file mode 100644 index 4611db7195..0000000000 --- a/docs/htmldocs/browsing-quick.html +++ /dev/null @@ -1,805 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Quick Cross Subnet Browsing / Cross Workgroup Browsing guide</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="General installation" -HREF="introduction.html"><LINK -REL="PREVIOUS" -TITLE="How to Install and Test SAMBA" -HREF="install.html"><LINK -REL="NEXT" -TITLE="User information database" -HREF="passdb.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="install.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="passdb.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="BROWSING-QUICK" -></A ->Chapter 3. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->3.1. <A -HREF="browsing-quick.html#AEN305" ->Discussion</A -></DT -><DT ->3.2. <A -HREF="browsing-quick.html#AEN326" ->How browsing functions and how to deploy stable and -dependable browsing using Samba</A -></DT -><DT ->3.3. <A -HREF="browsing-quick.html#AEN340" ->Use of the <B -CLASS="COMMAND" ->Remote Announce</B -> parameter</A -></DT -><DT ->3.4. <A -HREF="browsing-quick.html#AEN363" ->Use of the <B -CLASS="COMMAND" ->Remote Browse Sync</B -> parameter</A -></DT -><DT ->3.5. <A -HREF="browsing-quick.html#AEN374" ->Use of WINS</A -></DT -><DD -><DL -><DT ->3.5.1. <A -HREF="browsing-quick.html#AEN391" ->WINS Replication</A -></DT -><DT ->3.5.2. <A -HREF="browsing-quick.html#AEN395" ->Static WINS Entries</A -></DT -></DL -></DD -><DT ->3.6. <A -HREF="browsing-quick.html#AEN400" ->Do NOT use more than one (1) protocol on MS Windows machines</A -></DT -><DT ->3.7. <A -HREF="browsing-quick.html#AEN408" ->Name Resolution Order</A -></DT -></DL -></DIV -><P ->This document should be read in conjunction with Browsing and may -be taken as the fast track guide to implementing browsing across subnets -and / or across workgroups (or domains). WINS is the best tool for resolution -of NetBIOS names to IP addesses. WINS is NOT involved in browse list handling -except by way of name to address mapping.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->MS Windows 2000 and later can be configured to operate with NO NetBIOS -over TCP/IP. Samba-3 and later also supports this mode of operation.</P -></TD -></TR -></TABLE -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN305" ->3.1. Discussion</A -></H1 -><P ->Firstly, all MS Windows networking is based on SMB (Server Message -Block) based messaging. SMB messaging may be implemented using NetBIOS or -without NetBIOS. Samba implements NetBIOS by encapsulating it over TCP/IP. -MS Windows products can do likewise. NetBIOS based networking uses broadcast -messaging to affect browse list management. When running NetBIOS over -TCP/IP this uses UDP based messaging. UDP messages can be broadcast or unicast.</P -><P ->Normally, only unicast UDP messaging can be forwarded by routers. The -<B -CLASS="COMMAND" ->remote announce</B -> -parameter to smb.conf helps to project browse announcements -to remote network segments via unicast UDP. Similarly, the -<B -CLASS="COMMAND" ->remote browse sync</B -> parameter of <TT -CLASS="FILENAME" ->smb.conf</TT -> -implements browse list collation using unicast UDP.</P -><P ->Secondly, in those networks where Samba is the only SMB server technology -wherever possible <SPAN -CLASS="APPLICATION" ->nmbd</SPAN -> should be configured on one (1) machine as the WINS -server. This makes it easy to manage the browsing environment. If each network -segment is configured with it's own Samba WINS server, then the only way to -get cross segment browsing to work is by using the -<B -CLASS="COMMAND" ->remote announce</B -> and the <B -CLASS="COMMAND" ->remote browse sync</B -> -parameters to your <TT -CLASS="FILENAME" ->smb.conf</TT -> file.</P -><P ->If only one WINS server is used for an entire multi-segment network then -the use of the <B -CLASS="COMMAND" ->remote announce</B -> and the -<B -CLASS="COMMAND" ->remote browse sync</B -> parameters should NOT be necessary.</P -><P ->As of Samba 3 WINS replication is being worked on. The bulk of the code has -been committed, but it still needs maturation.</P -><P ->Right now samba WINS does not support MS-WINS replication. This means that -when setting up Samba as a WINS server there must only be one <SPAN -CLASS="APPLICATION" ->nmbd</SPAN -> configured -as a WINS server on the network. Some sites have used multiple Samba WINS -servers for redundancy (one server per subnet) and then used -<B -CLASS="COMMAND" ->remote browse sync</B -> and <B -CLASS="COMMAND" ->remote announce</B -> -to affect browse list collation across all -segments. Note that this means clients will only resolve local names, -and must be configured to use DNS to resolve names on other subnets in -order to resolve the IP addresses of the servers they can see on other -subnets. This setup is not recommended, but is mentioned as a practical -consideration (ie: an 'if all else fails' scenario).</P -><P ->Lastly, take note that browse lists are a collection of unreliable broadcast -messages that are repeated at intervals of not more than 15 minutes. This means -that it will take time to establish a browse list and it can take up to 45 -minutes to stabilise, particularly across network segments.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN326" ->3.2. How browsing functions and how to deploy stable and -dependable browsing using Samba</A -></H1 -><P ->As stated above, MS Windows machines register their NetBIOS names -(i.e.: the machine name for each service type in operation) on start -up. Also, as stated above, the exact method by which this name registration -takes place is determined by whether or not the MS Windows client/server -has been given a WINS server address, whether or not LMHOSTS lookup -is enabled, or if DNS for NetBIOS name resolution is enabled, etc.</P -><P ->In the case where there is no WINS server all name registrations as -well as name lookups are done by UDP broadcast. This isolates name -resolution to the local subnet, unless LMHOSTS is used to list all -names and IP addresses. In such situations Samba provides a means by -which the samba server name may be forcibly injected into the browse -list of a remote MS Windows network (using the -<B -CLASS="COMMAND" ->remote announce</B -> parameter).</P -><P ->Where a WINS server is used, the MS Windows client will use UDP -unicast to register with the WINS server. Such packets can be routed -and thus WINS allows name resolution to function across routed networks.</P -><P ->During the startup process an election will take place to create a -local master browser if one does not already exist. On each NetBIOS network -one machine will be elected to function as the domain master browser. This -domain browsing has nothing to do with MS security domain control. -Instead, the domain master browser serves the role of contacting each local -master browser (found by asking WINS or from LMHOSTS) and exchanging browse -list contents. This way every master browser will eventually obtain a complete -list of all machines that are on the network. Every 11-15 minutes an election -is held to determine which machine will be the master browser. By the nature of -the election criteria used, the machine with the highest uptime, or the -most senior protocol version, or other criteria, will win the election -as domain master browser.</P -><P ->Clients wishing to browse the network make use of this list, but also depend -on the availability of correct name resolution to the respective IP -address/addresses. </P -><P ->Any configuration that breaks name resolution and/or browsing intrinsics -will annoy users because they will have to put up with protracted -inability to use the network services.</P -><P ->Samba supports a feature that allows forced synchonisation -of browse lists across routed networks using the <B -CLASS="COMMAND" ->remote -browse sync</B -> parameter in the <TT -CLASS="FILENAME" ->smb.conf</TT -> file. -This causes Samba to contact the local master browser on a remote network and -to request browse list synchronisation. This effectively bridges -two networks that are separated by routers. The two remote -networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the <B -CLASS="COMMAND" ->remote -browse sync</B -> parameter provides browse list synchronisation - and -that is distinct from name to address resolution, in other -words, for cross subnet browsing to function correctly it is -essential that a name to address resolution mechanism be provided. -This mechanism could be via DNS, <TT -CLASS="FILENAME" ->/etc/hosts</TT ->, -and so on.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN340" ->3.3. Use of the <B -CLASS="COMMAND" ->Remote Announce</B -> parameter</A -></H1 -><P ->The <B -CLASS="COMMAND" ->remote announce</B -> parameter of -<TT -CLASS="FILENAME" ->smb.conf</TT -> can be used to forcibly ensure -that all the NetBIOS names on a network get announced to a remote network. -The syntax of the <B -CLASS="COMMAND" ->remote announce</B -> parameter is: -<PRE -CLASS="PROGRAMLISTING" -> remote announce = <VAR -CLASS="REPLACEABLE" ->a.b.c.d [e.f.g.h]</VAR -> ...</PRE -> -_or_ -<PRE -CLASS="PROGRAMLISTING" -> remote announce = <VAR -CLASS="REPLACEABLE" ->a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP]</VAR -> ...</PRE -> - -where: -<P -></P -><DIV -CLASS="VARIABLELIST" -><DL -><DT -><VAR -CLASS="REPLACEABLE" ->a.b.c.d</VAR -> and -<VAR -CLASS="REPLACEABLE" ->e.f.g.h</VAR -></DT -><DD -><P ->is either the LMB (Local Master Browser) IP address -or the broadcst address of the remote network. -ie: the LMB is at 192.168.1.10, or the address -could be given as 192.168.1.255 where the netmask -is assumed to be 24 bits (255.255.255.0). -When the remote announcement is made to the broadcast -address of the remote network every host will receive -our announcements. This is noisy and therefore -undesirable but may be necessary if we do NOT know -the IP address of the remote LMB.</P -></DD -><DT -><VAR -CLASS="REPLACEABLE" ->WORKGROUP</VAR -></DT -><DD -><P ->is optional and can be either our own workgroup -or that of the remote network. If you use the -workgroup name of the remote network then our -NetBIOS machine names will end up looking like -they belong to that workgroup, this may cause -name resolution problems and should be avoided.</P -></DD -></DL -></DIV -></P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN363" ->3.4. Use of the <B -CLASS="COMMAND" ->Remote Browse Sync</B -> parameter</A -></H1 -><P ->The <B -CLASS="COMMAND" ->remote browse sync</B -> parameter of -<TT -CLASS="FILENAME" ->smb.conf</TT -> is used to announce to -another LMB that it must synchronise it's NetBIOS name list with our -Samba LMB. It works ONLY if the Samba server that has this option is -simultaneously the LMB on it's network segment.</P -><P ->The syntax of the <B -CLASS="COMMAND" ->remote browse sync</B -> parameter is: - -<PRE -CLASS="PROGRAMLISTING" ->remote browse sync = <VAR -CLASS="REPLACEABLE" ->a.b.c.d</VAR -></PRE -> - -where <VAR -CLASS="REPLACEABLE" ->a.b.c.d</VAR -> is either the IP address of the remote LMB or else is the network broadcast address of the remote segment.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN374" ->3.5. Use of WINS</A -></H1 -><P ->Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly -recommended. Every NetBIOS machine registers it's name together with a -name_type value for each of of several types of service it has available. -eg: It registers it's name directly as a unique (the type 0x03) name. -It also registers it's name if it is running the lanmanager compatible -server service (used to make shares and printers available to other users) -by registering the server (the type 0x20) name.</P -><P ->All NetBIOS names are up to 15 characters in length. The name_type variable -is added to the end of the name - thus creating a 16 character name. Any -name that is shorter than 15 characters is padded with spaces to the 15th -character. ie: All NetBIOS names are 16 characters long (including the -name_type information).</P -><P ->WINS can store these 16 character names as they get registered. A client -that wants to log onto the network can ask the WINS server for a list -of all names that have registered the NetLogon service name_type. This saves -broadcast traffic and greatly expedites logon processing. Since broadcast -name resolution can not be used across network segments this type of -information can only be provided via WINS _or_ via statically configured -<TT -CLASS="FILENAME" ->lmhosts</TT -> files that must reside on all clients in the -absence of WINS.</P -><P ->WINS also serves the purpose of forcing browse list synchronisation by all -LMB's. LMB's must synchronise their browse list with the DMB (domain master -browser) and WINS helps the LMB to identify it's DMB. By definition this -will work only within a single workgroup. Note that the domain master browser -has NOTHING to do with what is referred to as an MS Windows NT Domain. The -later is a reference to a security environment while the DMB refers to the -master controller for browse list information only.</P -><P ->Use of WINS will work correctly only if EVERY client TCP/IP protocol stack -has been configured to use the WINS server/s. Any client that has not been -configured to use the WINS server will continue to use only broadcast based -name registration so that WINS may NEVER get to know about it. In any case, -machines that have not registered with a WINS server will fail name to address -lookup attempts by other clients and will therefore cause workstation access -errors.</P -><P ->To configure Samba as a WINS server just add -<B -CLASS="COMMAND" ->wins support = yes</B -> to the <TT -CLASS="FILENAME" ->smb.conf</TT -> -file [globals] section.</P -><P ->To configure Samba to register with a WINS server just add -"wins server = a.b.c.d" to your smb.conf file [globals] section.</P -><DIV -CLASS="IMPORTANT" -><P -></P -><TABLE -CLASS="IMPORTANT" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/important.gif" -HSPACE="5" -ALT="Important"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Never use both <B -CLASS="COMMAND" ->wins support = yes</B -> together -with <B -CLASS="COMMAND" ->wins server = a.b.c.d</B -> -particularly not using it's own IP address. -Specifying both will cause <SPAN -CLASS="APPLICATION" ->nmbd</SPAN -> to refuse to start!</P -></TD -></TR -></TABLE -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN391" ->3.5.1. WINS Replication</A -></H2 -><P ->Samba-3 permits WINS replication through the use of the <TT -CLASS="FILENAME" ->wrepld</TT -> utility. -This tool is not currently capable of being used as it is still in active development. -As soon as this tool becomes moderately functional we will prepare man pages and enhance this -section of the documentation to provide usage and technical details.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN395" ->3.5.2. Static WINS Entries</A -></H2 -><P ->New to Samba-3 is a tool called <TT -CLASS="FILENAME" ->winsedit</TT -> that may be used to add -static WINS entries to the WINS database. This tool can be used also to modify entries -existing in the WINS database.</P -><P ->The development of the winsedit tool was made necessary due to the migration -of the older style wins.dat file into a new tdb binary backend data store.</P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN400" ->3.6. Do NOT use more than one (1) protocol on MS Windows machines</A -></H1 -><P ->A very common cause of browsing problems results from installing more than -one protocol on an MS Windows machine.</P -><P ->Every NetBIOS machine takes part in a process of electing the LMB (and DMB) -every 15 minutes. A set of election criteria is used to determine the order -of precidence for winning this election process. A machine running Samba or -Windows NT will be biased so that the most suitable machine will predictably -win and thus retain it's role.</P -><P ->The election process is "fought out" so to speak over every NetBIOS network -interface. In the case of a Windows 9x machine that has both TCP/IP and IPX -installed and has NetBIOS enabled over both protocols the election will be -decided over both protocols. As often happens, if the Windows 9x machine is -the only one with both protocols then the LMB may be won on the NetBIOS -interface over the IPX protocol. Samba will then lose the LMB role as Windows -9x will insist it knows who the LMB is. Samba will then cease to function -as an LMB and thus browse list operation on all TCP/IP only machines will -fail.</P -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Windows 95, 98, 98se, Me are referred to generically as Windows 9x. -The Windows NT4, 2000, XP and 2003 use common protocols. These are roughly -referred to as the WinNT family, but it should be recognised that 2000 and -XP/2003 introduce new protocol extensions that cause them to behave -differently from MS Windows NT4. Generally, where a server does NOT support -the newer or extended protocol, these will fall back to the NT4 protocols.</I -></SPAN -></P -><P ->The safest rule of all to follow it this - USE ONLY ONE PROTOCOL!</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN408" ->3.7. Name Resolution Order</A -></H1 -><P ->Resolution of NetBIOS names to IP addresses can take place using a number -of methods. The only ones that can provide NetBIOS name_type information -are:</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->WINS: the best tool!</TD -></TR -><TR -><TD ->LMHOSTS: is static and hard to maintain.</TD -></TR -><TR -><TD ->Broadcast: uses UDP and can not resolve names across remote segments.</TD -></TR -></TBODY -></TABLE -><P -></P -><P ->Alternative means of name resolution includes:</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->/etc/hosts: is static, hard to maintain, and lacks name_type info</TD -></TR -><TR -><TD ->DNS: is a good choice but lacks essential name_type info.</TD -></TR -></TBODY -></TABLE -><P -></P -><P ->Many sites want to restrict DNS lookups and want to avoid broadcast name -resolution traffic. The "name resolve order" parameter is of great help here. -The syntax of the "name resolve order" parameter is: -<PRE -CLASS="PROGRAMLISTING" ->name resolve order = wins lmhosts bcast host</PRE -> -_or_ -<PRE -CLASS="PROGRAMLISTING" ->name resolve order = wins lmhosts (eliminates bcast and host)</PRE -> -The default is: -<PRE -CLASS="PROGRAMLISTING" ->name resolve order = host lmhost wins bcast</PRE ->. -where "host" refers the the native methods used by the Unix system -to implement the gethostbyname() function call. This is normally -controlled by <TT -CLASS="FILENAME" ->/etc/host.conf</TT ->, <TT -CLASS="FILENAME" ->/etc/nsswitch.conf</TT -> and <TT -CLASS="FILENAME" ->/etc/resolv.conf</TT ->.</P -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="install.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="passdb.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->How to Install and Test SAMBA</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="introduction.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->User information database</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/cups-printing.html b/docs/htmldocs/cups-printing.html deleted file mode 100644 index 8dd4a94f4f..0000000000 --- a/docs/htmldocs/cups-printing.html +++ /dev/null @@ -1,2773 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->CUPS Printing Support</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Advanced Configuration" -HREF="optional.html"><LINK -REL="PREVIOUS" -TITLE="Printing Support" -HREF="printing.html"><LINK -REL="NEXT" -TITLE="Unified Logons between Windows NT and UNIX using Winbind" -HREF="winbind.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="printing.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="winbind.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="CUPS-PRINTING" -></A ->Chapter 14. CUPS Printing Support</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->14.1. <A -HREF="cups-printing.html#AEN2034" ->Introduction</A -></DT -><DT ->14.2. <A -HREF="cups-printing.html#AEN2041" ->Configuring <TT -CLASS="FILENAME" ->smb.conf</TT -> for CUPS</A -></DT -><DT ->14.3. <A -HREF="cups-printing.html#AEN2061" ->CUPS - RAW Print Through Mode</A -></DT -><DT ->14.4. <A -HREF="cups-printing.html#AEN2118" ->CUPS as a network PostScript RIP -- CUPS drivers working on server, Adobe -PostScript driver with CUPS-PPDs downloaded to clients</A -></DT -><DT ->14.5. <A -HREF="cups-printing.html#AEN2139" ->Windows Terminal Servers (WTS) as CUPS clients</A -></DT -><DT ->14.6. <A -HREF="cups-printing.html#AEN2143" ->Setting up CUPS for driver download</A -></DT -><DT ->14.7. <A -HREF="cups-printing.html#AEN2156" ->Sources of CUPS drivers / PPDs</A -></DT -><DT ->14.8. <A -HREF="cups-printing.html#AEN2212" ->The CUPS Filter Chains</A -></DT -><DT ->14.9. <A -HREF="cups-printing.html#AEN2251" ->CUPS Print Drivers and Devices</A -></DT -><DT ->14.10. <A -HREF="cups-printing.html#AEN2328" ->Limiting the number of pages users can print</A -></DT -><DT ->14.11. <A -HREF="cups-printing.html#AEN2424" ->Advanced Postscript Printing from MS Windows</A -></DT -><DT ->14.12. <A -HREF="cups-printing.html#AEN2439" ->Auto-Deletion of CUPS spool files</A -></DT -></DL -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2034" ->14.1. Introduction</A -></H1 -><P ->The Common Unix Print System (CUPS) has become very popular, but to many it is -a very mystical tool. There is a great deal of uncertainty regarding CUPS and how -it works. The result is seen in a large number of posting on the samba mailing lists -expressing frustration when MS Windows printers appear not to work with a CUPS -backr-end.</P -><P ->This is a good time to point out how CUPS can be used and what it does. CUPS is more -than just a print spooling system - it is a complete printer management system that -complies with HTTP and IPP protocols. It can be managed remotely via a web browser -and it can print using http and ipp protocols.</P -><P ->CUPS allows to creation of RAW printers (ie: NO file format translation) as well as -SMART printers (ie: CUPS does file format conversion as required for the printer). In -many ways this gives CUPS similar capabilities to the MS Windows print monitoring -system. Of course, if you are a CUPS advocate, you would agrue that CUPS is better! -In any case, let us now move on to explore how one may configure CUPS for interfacing -with MS Windows print clients via Samba.</P -><P -><A -HREF="http://www.cups.org/" -TARGET="_top" ->CUPS</A -> is a newcomer in the UNIX printing scene, -which has convinced many people upon first trial already. However, it has quite a few -new features, which make it different from other, more traditional printing systems.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2041" ->14.2. Configuring <TT -CLASS="FILENAME" ->smb.conf</TT -> for CUPS</A -></H1 -><P ->Printing with CUPS in the most basic <TT -CLASS="FILENAME" ->smb.conf</TT -> -setup in Samba-3 only needs two settings: <B -CLASS="COMMAND" ->printing = cups</B -> and -<B -CLASS="COMMAND" ->printcap = cups</B ->. While CUPS itself doesn't need a printcap -anymore, the <TT -CLASS="FILENAME" ->cupsd.conf</TT -> configuration file knows two directives -(example: <B -CLASS="COMMAND" ->Printcap /etc/printcap</B -> and <B -CLASS="COMMAND" ->PrintcapFormat -BSD</B ->), which control if such a file should be created for the -convenience of third party applications. Make sure it is set! For details see -<B -CLASS="COMMAND" ->man cupsd.conf</B -> and other CUPS-related documentation.</P -><P ->If SAMBA is compiled against libcups, then <B -CLASS="COMMAND" ->printcap = cups</B -> uses the -CUPS API to list printers, submit jobs, etc. Otherwise it maps to the System V commands -with an additional <VAR -CLASS="PARAMETER" ->-oraw</VAR -> option for printing. On a Linux system, -you can use the <B -CLASS="COMMAND" ->ldd</B -> command to find out details (ldd may not be -present on other OS platforms, or its function may be embodied by a different command):</P -><P -><PRE -CLASS="PROGRAMLISTING" ->transmeta:/home/kurt # ldd `which smbd` - libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000) - libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000) - libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) - libdl.so.2 => /lib/libdl.so.2 (0x401e8000) - libnsl.so.1 => /lib/libnsl.so.1 (0x401ec000) - libpam.so.0 => /lib/libpam.so.0 (0x40202000) - libc.so.6 => /lib/libc.so.6 (0x4020b000) - /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)</PRE -></P -><P ->The line "libcups.so.2 => /usr/lib/libcups.so.2 -(0x40123000)" shows there is CUPS support compiled into this version of -Samba. If this is the case, and <B -CLASS="COMMAND" ->printing = cups</B -> is set, then any -otherwise manually set print command in <TT -CLASS="FILENAME" ->smb.conf</TT -> is ignored.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2061" ->14.3. CUPS - RAW Print Through Mode</A -></H1 -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->When used in raw print through mode is will be necessary to use the printer -vendor's drivers in each Windows client PC.</P -></TD -></TR -></TABLE -></DIV -><P ->When CUPS printers are configured for RAW print-through mode operation it is the -responsibility of the Samba client to fully render the print job (file) in a format -that is suitable for direct delivery to the printer. In this case CUPS will NOT -do any print file format conversion work.</P -><P ->The CUPS files that need to be correctly set for RAW mode printers to work are: - -<P -></P -><UL -><LI -><P -><TT -CLASS="FILENAME" ->/etc/cups/mime.types</TT -></P -></LI -><LI -><P -><TT -CLASS="FILENAME" ->/etc/cups/mime.convs</TT -></P -></LI -></UL -> - -Both contain entries that must be uncommented to allow <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->RAW</I -></SPAN -> mode -operation.</P -><P ->Firstly, to enable CUPS based printing from Samba the following options must be -enabled in your <TT -CLASS="FILENAME" ->smb.conf</TT -> file [globals] section: - -<P -></P -><UL -><LI -><P ->printing = CUPS</P -></LI -><LI -><P ->printcap = CUPS</P -></LI -></UL -> - -When these parameters are specified the print directives in <TT -CLASS="FILENAME" ->smb.conf</TT -> (as well as in -samba itself) will be ignored because samba will directly interface with CUPS through -it's application program interface (API) - so long as Samba has been compiled with -CUPS library (libcups) support. If samba has NOT been compiled with CUPS support then -printing will use the System V AT&T command set with the <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->-oraw</I -></SPAN -> -option automatically passing through.</P -><P ->Cupsomatic (an enhanced printing utility that is part of some CUPS implementations) -on the Samba/CUPS server does *not* add any features if a file is really -printed "raw". However, if you have loaded the driver for the Windows client from -the CUPS server, using the "cupsaddsmb" utility, and if this driver is one using -a "Foomatic" PPD, the PJL header in question is already added on the Windows client, -at the time when the driver initially generated the PostScript data and CUPS in true -"-oraw" manner doesn't remove this PJL header and passes the file "as is" to its -printer communication backend.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->NOTE: editing in the "mime.convs" and the "mime.types" file does not *enforce* -"raw" printing, it only *allows* it.</P -></TD -></TR -></TABLE -></DIV -><P ->Print files that arrive from MS Windows printing are "auto-typed" by CUPS. This aids -the process of determining proper treatment while in the print queue system. - -<P -></P -><UL -><LI -><P -> Files generated by PCL drivers and directed at PCK printers get auto-typed as - <TT -CLASS="FILENAME" ->application/octet-stream</TT ->. Unknown file format types also - get auto-typed with this tag. - </P -></LI -><LI -><P -> Files generated by a Postscript driver and directed at a Postscript printer - are auto-typed depending on the auto-detected most suitable MIME type as: - - <P -></P -><UL -><LI -><P ->* application/postscript</P -></LI -><LI -><P ->* application/vnd.cups-postscript</P -></LI -></UL -> - </P -></LI -></UL -></P -><P ->"application/postscript" first goes thru the "pstops" filter (where the page counting -and accounting takes place). The outcome will be of MIME type -"application/vnd.cups-postscript". The pstopsfilter reads and uses information from -the PPD and inserts user-provided options into the PostScript file. As a consequence, -the filtered file could possibly have an unwanted PJL header.</P -><P ->"application/postscript" will be all files with a ".ps", ".ai", ".eps" suffix or which -have as their first character string one of "%!" or ">04<%".</P -><P ->"application/vnd.cups-postscript" will files which contain the string -"LANGUAGE=POSTSCRIPT" (or similar variations with different capitalization) in the -first 512 bytes, and also contain the "PJL super escape code" in the first 128 bytes -(">1B<%-12345X"). Very likely, most PostScript files generated on Windows using a CUPS -or other PPD, will have to be auto-typed as "vnd.cups-postscript". A file produced -with a "Generic PostScript driver" will just be tagged "application/postscript".</P -><P ->Once the file is in "application/vnd.cups-postscript" format, either "pstoraster" -or "cupsomatic" will take over (depending on the printer configuration, as -determined by the PPD in use).</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->A printer queue with *no* PPD associated to it is a "raw" printer and all files -will go directly there as received by the spooler. The exeptions are file types -"application/octet-stream" which need "passthrough feature" enabled. -"Raw" queues don't do any filtering at all, they hand the file directly to the -CUPS backend. This backend is responsible for the sending of the data to the device -(as in the "device URI" notation as lpd://, socket://, smb://, ipp://, http://, -parallel:/, serial:/, usb:/ etc.)</P -></TD -></TR -></TABLE -></DIV -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->"cupsomatic"/Foomatic are *not* native CUPS drivers and they don't ship with CUPS. -They are a Third Party add-on, developed at Linuxprinting.org. As such, they are -a brilliant hack to make all models (driven by Ghostscript drivers/filters in -traditional spoolers) also work via CUPS, with the same (good or bad!) quality -as in these other spoolers. "cupsomatic" is only a vehicle to execute a ghostscript -commandline at that stage in the CUPS filtering chain, where "normally" the native -CUPS "pstoraster" filter would kick in. cupsomatic by-passes pstoraster, "kidnaps" -the printfile from CUPS away and re-directs it to go through Ghostscipt. CUPS accepts this, -because the associated CUPS-O-Matic-/Foomatic-PPD specifies:</P -><PRE -CLASS="PROGRAMLISTING" -> *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic"</PRE -><P ->This line persuades CUPS to hand the file to cupsomatic, once it has successfully -converted it to the MIME type "application/vnd.cups-postscript". This conversion will not -happen for Jobs arriving from Windows which are auto-typed "application/octet-stream", -with the according changes in "/etc/cups/mime.types" in place.</P -></TD -></TR -></TABLE -></DIV -><P ->CUPS is widely configurable and flexible, even regarding its filtering mechanism. -Another workaround in some situations would be to have -in "/etc/cups/mime.types" entries as follows:</P -><PRE -CLASS="PROGRAMLISTING" -> application/postscript application/vnd.cups-raw 0 - - application/vnd.cups-postscript application/vnd.cups-raw 0 -</PRE -><P ->This would prevent all Postscript files from being filtered (rather, they will go -thru the virtual "nullfilter" denoted with "-"). This could only be useful for -PS printers. If you want to print PS code on non-PS printers an entry as follows -could be useful:</P -><PRE -CLASS="PROGRAMLISTING" -> */* application/vnd.cups-raw 0 -</PRE -><P ->and would effectively send *all* files to the backend without further processing.</P -><P ->Lastly, you could have the following entry:</P -><PRE -CLASS="PROGRAMLISTING" -> application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter</PRE -><P ->You will need to write a "my_PJL_stripping_filter" (could be a shellscript) that -parses the PostScript and removes the unwanted PJL. This would need to conform to -CUPS filter design (mainly, receive and pass the parameters printername, job-id, -username, jobtitle, copies, print options and possibly the filename). It would -be installed as world executable into "/usr/lib/cups/filters/" and will be called -by CUPS if it encounters a MIME type "application/vnd.cups-postscript".</P -><P ->CUPS can handle "-o job-hold-until=indefinite". This keeps the job in the queue -"on hold". It will only be printed upon manual release by the printer operator. -This is a requirement in many "central reproduction departments", where a few -operators manage the jobs of hundreds of users on some big machine, where no -user is allowed to have direct access. (The operators often need to load the -proper paper type before running the 10.000 page job requested by marketing -for the mailing, etc.).</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2118" ->14.4. CUPS as a network PostScript RIP -- CUPS drivers working on server, Adobe -PostScript driver with CUPS-PPDs downloaded to clients</A -></H1 -><P ->CUPS is perfectly able to use PPD files (PostScript -Printer Descriptions). PPDs can control all print device options. They -are usually provided by the manufacturer -- if you own a PostSript printer, -that is. PPD files are always a component of PostScript printer drivers on MS -Windows or Apple Mac OS systems. They are ASCII files containing -user-selectable print options, mapped to appropriate PostScript, PCL or PJL -commands for the target printer. Printer driver GUI dialogs translate these -options "on-the-fly" into buttons and drop-down lists for the user to -select.</P -><P ->CUPS can load, without any conversions, the PPD file from -any Windows (NT is recommended) PostScript driver and handle the options. -There is a web browser interface to the print options (select -http://localhost:631/printers/ and click on one "Configure Printer" button -to see it), a commandline interface (see <B -CLASS="COMMAND" ->man lpoptions</B -> or -try if you have <B -CLASS="COMMAND" ->lphelp</B -> on your system) plus some different GUI frontends on Linux -UNIX, which can present PPD options to the users. PPD options are normally -meant to become evaluated by the PostScript RIP on the real PostScript -printer.</P -><P ->CUPS doesn't stop at "real" PostScript printers in its -usage of PPDs. The CUPS developers have extended the PPD concept, to also -describe available device and driver options for non-PostScript printers -through CUPS-PPDs.</P -><P ->This is logical, as CUPS includes a fully featured -PostScript interpreter (RIP). This RIP is based on Ghostscript. It can -process all received PostScript (and additionally many other file formats) -from clients. All CUPS-PPDs geared to non-PostScript printers contain an -additional line, starting with the keyword <VAR -CLASS="PARAMETER" ->*cupsFilter</VAR ->. -This line -tells the CUPS print system which printer-specific filter to use for the -interpretation of the accompanying PostScript. Thus CUPS lets all its -printers appear as PostScript devices to its clients, because it can act as a -PostScript RIP for those printers, processing the received PostScript code -into a proper raster print format.</P -><P ->CUPS-PPDs can also be used on Windows-Clients, on top of a -PostScript driver (recommended is the Adobe one).</P -><P ->This feature enables CUPS to do a few tricks no other -spooler can do:</P -><P -></P -><UL -><LI -><P ->act as a networked PostScript RIP (Raster Image Processor), handling - printfiles from all client platforms in a uniform way;</P -></LI -><LI -><P ->act as a central accounting and billing server, as all files are passed - through the <B -CLASS="COMMAND" ->pstops</B -> Filter and are therefor logged in - the CUPS <TT -CLASS="FILENAME" ->page_log</TT ->. - <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->NOTE: </I -></SPAN ->this - can not happen with "raw" print jobs, which always remain unfiltered - per definition;</P -></LI -><LI -><P ->enable clients to consolidate on a single PostScript driver, even for - many different target printers.</P -></LI -></UL -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2139" ->14.5. Windows Terminal Servers (WTS) as CUPS clients</A -></H1 -><P ->This setup may be of special interest to people -experiencing major problems in WTS environments. WTS need often a multitude -of non-PostScript drivers installed to run their clients' variety of -different printer models. This often imposes the price of much increased -instability. In many cases, in an attempt to overcome this problem, site -administrators have resorted to restrict the allowed drivers installed on -their WTS to one generic PCL- and one PostScript driver. This however -restricts the clients in the amount of printer options available for them -- -often they can't get out more then simplex prints from one standard paper -tray, while their devices could do much better, if driven by a different -driver!</P -><P ->Using an Adobe PostScript driver, enabled with a CUPS-PPD, -seems to be a very elegant way to overcome all these shortcomings. The -PostScript driver is not known to cause major stability problems on WTS (even -if used with many different PPDs). The clients will be able to (again) chose -paper trays, duplex printing and other settings. However, there is a certain -price for this too: a CUPS server acting as a PostScript RIP for its clients -requires more CPU and RAM than just to act as a "raw spooling" device. Plus, -this setup is not yet widely tested, although the first feedbacks look very -promising...</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2143" ->14.6. Setting up CUPS for driver download</A -></H1 -><P ->The <B -CLASS="COMMAND" ->cupsadsmb</B -> utility (shipped with all current -CUPS versions) makes the sharing of any (or all) installed CUPS printers very -easy. Prior to using it, you need the following settings in <TT -CLASS="FILENAME" ->smb.conf</TT ->:</P -><P -><PRE -CLASS="PROGRAMLISTING" ->[global] - load printers = yes - printing = cups - printcap name = cups - - [printers] - comment = All Printers - path = /var/spool/samba - browseable = no - public = yes - guest ok = yes - writable = no - printable = yes - printer admin = root - - [print$] - comment = Printer Drivers - path = /etc/samba/drivers - browseable = yes - guest ok = no - read only = yes - write list = root - </PRE -></P -><P ->For licensing reasons the necessary files of the Adobe -Postscript driver can not be distributed with either Samba or CUPS. You need -to download them yourself from the Adobe website. Once extracted, create a -<TT -CLASS="FILENAME" ->drivers</TT -> directory in the CUPS data directory (usually -<TT -CLASS="FILENAME" ->/usr/share/cups/</TT ->). Copy the Adobe files using -UPPERCASE filenames, to this directory as follows:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> ADFONTS.MFM - ADOBEPS4.DRV - ADOBEPS4.HLP - ADOBEPS5.DLL - ADOBEPSU.DLL - ADOBEPSU.HLP - DEFPRTR2.PPD - ICONLIB.DLL - </PRE -></P -><P ->Users of the ESP Print Pro software are able to install -their "Samba Drivers" package for this purpose with no problem.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2156" ->14.7. Sources of CUPS drivers / PPDs</A -></H1 -><P ->On the internet you can find now many thousand CUPS-PPD -files (with their companion filters), in many national languages, -supporting more than 1.000 non-PostScript models.</P -><P -></P -><UL -><LI -><P -><A -HREF="http://wwwl.easysw.com/printpro/" -TARGET="_top" ->ESP PrintPro - (http://wwwl.easysw.com/printpro/)</A -> - (commercial, non-Free) is packaged with more than 3.000 PPDs, ready for - successful usage "out of the box" on Linux, IBM-AIX, HP-UX, Sun-Solaris, - SGI-IRIX, Compaq Tru64, Digital Unix and some more commercial Unices (it - is written by the CUPS developers themselves and its sales help finance - the further development of CUPS, as they feed their creators)</P -></LI -><LI -><P ->the <A -HREF="http://gimp-print.sourceforge.net/" -TARGET="_top" ->Gimp-Print-Project - (http://gimp-print.sourceforge.net/)</A -> - (GPL, Free Software) provides around 120 PPDs (supporting nearly 300 - printers, many driven to photo quality output), to be used alongside the - Gimp-Print CUPS filters;</P -></LI -><LI -><P -><A -HREF="http://www.turboprint.com/" -TARGET="_top" ->TurboPrint - (http://www.turboprint.com/)</A -> - (Shareware, non-Freee) supports roughly the same amount of printers in - excellent quality;</P -></LI -><LI -><P -><A -HREF="http://www-124.ibm.com/developerworks/oss/linux/projects/omni/" -TARGET="_top" ->OMNI - (http://www-124.ibm.com/developerworks/oss/linux/projects/omni/)</A -> - (LPGL, Free) is a package made by IBM, now containing support for more - than 400 printers, stemming from the inheritance of IBM OS/2 KnowHow - ported over to Linux (CUPS support is in a Beta-stage at present);</P -></LI -><LI -><P -><A -HREF="http://hpinkjet.sourceforge.net/" -TARGET="_top" ->HPIJS - (http://hpinkjet.sourceforge.net/)</A -> - (BSD-style licnes, Free) supports around 120 of HP's own printers and is - also providing excellent print quality now;</P -></LI -><LI -><P -><A -HREF="http://www.linuxprinting.org/" -TARGET="_top" ->Foomatic/cupsomatic (http://www.linuxprinting.org/)</A -> - (LPGL, Free) from Linuxprinting.org are providing PPDs for practically every - Ghostscript filter known to the world, now usable with CUPS.</P -></LI -></UL -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->NOTE: </I -></SPAN ->the cupsomatic trick from Linuxprinting.org is -working different from the other drivers. While the other drivers take the -generic CUPS raster (produced by CUPS' own pstoraster PostScript RIP) as -their input, cupsomatic "kidnaps" the PostScript inside CUPS, before -RIP-ping, deviates it to an external Ghostscript installation (which now -becomes the RIP) and gives it back to a CUPS backend once Ghostscript is -finished. -- CUPS versions from 1.1.15 and later will provide their pstoraster -PostScript RIP function again inside a system-wide Ghostscript -installation rather than in "their own" pstoraster filter. (This -CUPS-enabling Ghostscript version may be installed either as a -patch to GNU or AFPL Ghostscript, or as a complete ESP Ghostscript package). -However, this will not change the cupsomatic approach of guiding the printjob -along a different path through the filtering system than the standard CUPS -way...</P -><P ->Once you installed a printer inside CUPS with one of the -recommended methods (the lpadmin command, the web browser interface or one of -the available GUI wizards), you can use <B -CLASS="COMMAND" ->cupsaddsmb</B -> to share the -printer via Samba. <B -CLASS="COMMAND" ->cupsaddsmb</B -> prepares the driver files for -comfortable client download and installation upon their first contact with -this printer share.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN2183" ->14.7.1. <B -CLASS="COMMAND" ->cupsaddsmb</B -></A -></H2 -><P ->The <B -CLASS="COMMAND" ->cupsaddsmb</B -> command copies the needed files -for convenient Windows client installations from the previously prepared CUPS -data directory to your [print$] share. Additionally, the PPD -associated with this printer is copied from <TT -CLASS="FILENAME" ->/etc/cups/ppd/</TT -> to -[print$].</P -><P -><PRE -CLASS="PROGRAMLISTING" -><SAMP -CLASS="PROMPT" ->root# </SAMP -> <B -CLASS="COMMAND" ->cupsaddsmb -U root infotec_IS2027</B -> -Password for root required to access localhost via SAMBA: <KBD -CLASS="USERINPUT" ->[type in password 'secret']</KBD -></PRE -></P -><P ->To share all printers and drivers, use the <VAR -CLASS="PARAMETER" ->-a</VAR -> -parameter instead of a printer name.</P -><P ->Probably you want to see what's going on. Use the -<VAR -CLASS="PARAMETER" ->-v</VAR -> parameter to get a more verbose output:</P -><P ->Probably you want to see what's going on. Use the -<VAR -CLASS="PARAMETER" ->-v</VAR -> parameter to get a more verbose output:</P -><P -><PRE -CLASS="PROGRAMLISTING" ->Note: The following line shave been wrapped so that information is not lost. - -<SAMP -CLASS="PROMPT" ->root# </SAMP -> cupsaddsmb -v -U root infotec_IS2027 - Password for root required to access localhost via SAMBA: - Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put - /var/spool/cups/tmp/3cd1cc66376c0 W32X86/infotec_IS2027.PPD;put /usr/share/cups/drivers/ - ADOBEPS5.DLL W32X86/ADOBEPS5.DLL;put /usr/share/cups/drivers/ADOBEPSU.DLLr - W32X86/ADOBEPSU.DLL;put /usr/share/cups/drivers/ADOBEPSU.HLP W32X86/ADOBEPSU.HLP' - added interface ip=10.160.16.45 bcast=10.160.31.255 nmask=255.255.240.0 - added interface ip=192.168.182.1 bcast=192.168.182.255 nmask=255.255.255.0 - added interface ip=172.16.200.1 bcast=172.16.200.255 nmask=255.255.255.0 - Domain=[TUX-NET] OS=[Unix] Server=[Samba 2.2.3a.200204262025cvs] - NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86 - putting file /var/spool/cups/tmp/3cd1cc66376c0 as \W32X86/infotec_IS2027.PPD (17394.6 kb/s) - (average 17395.2 kb/s) - putting file /usr/share/cups/drivers/ADOBEPS5.DLL as \W32X86/ADOBEPS5.DLL (10877.4 kb/s) - (average 11343.0 kb/s) - putting file /usr/share/cups/drivers/ADOBEPSU.DLL as \W32X86/ADOBEPSU.DLL (5095.2 kb/s) - (average 9260.4 kb/s) - putting file /usr/share/cups/drivers/ADOBEPSU.HLP as \W32X86/ADOBEPSU.HLP (8828.7 kb/s) - (average 9247.1 kb/s) - - Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put - /var/spool/cups/tmp/3cd1cc66376c0 WIN40/infotec_IS2027.PPD;put - /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put - /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put - /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put - /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put - /usr/share/cups/drivers/ICONLIB.DLL WIN40/ICONLIB.DLL;put - /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;' - added interface ip=10.160.16.45 bcast=10.160.31.255 nmask=255.255.240.0 - added interface ip=192.168.182.1 bcast=192.168.182.255 nmask=255.255.255.0 - added interface ip=172.16.200.1 bcast=172.16.200.255 nmask=255.255.255.0 - Domain=[TUX-NET] OS=[Unix] Server=[Samba 2.2.3a.200204262025cvs] - NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40 - putting file /var/spool/cups/tmp/3cd1cc66376c0 as \WIN40/infotec_IS2027.PPD (26091.5 kb/s) - (average 26092.8 kb/s) - putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (11241.6 kb/s) - (average 11812.9 kb/s) - putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (16640.6 kb/s) - (average 14679.3 kb/s) - putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (11285.6 kb/s) - (average 14281.5 kb/s) - putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (823.5 kb/s) - (average 12944.0 kb/s) - putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (19226.2 kb/s) - (average 13169.7 kb/s) - putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (18666.1 kb/s) - (average 13266.7 kb/s) - - Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86" - "infotec_IS2027:ADOBEPS5.DLL:infotec_IS2027.PPD:ADOBEPSU.DLL:ADOBEPSU.HLP:NULL:RAW:NULL"' - cmd = adddriver "Windows NT x86" "infotec_IS2027:ADOBEPS5.DLL:infotec_IS2027.PPD:ADOBEPSU.DLL: - ADOBEPSU.HLP:NULL:RAW:NULL" - Printer Driver infotec_IS2027 successfully installed. - - Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0" - "infotec_IS2027:ADOBEPS4.DRV:infotec_IS2027.PPD:NULL:ADOBEPS4.HLP:PSMON.DLL:RAW: - ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"' - cmd = adddriver "Windows 4.0" "infotec_IS2027:ADOBEPS4.DRV:infotec_IS2027.PPD:NULL: - ADOBEPS4.HLP:PSMON.DLL:RAW:ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL" - Printer Driver infotec_IS2027 successfully installed. - - Running command: rpcclient localhost -N -U'root%secret' - -c 'setdriver infotec_IS2027 infotec_IS2027' - cmd = setdriver infotec_IS2027 infotec_IS2027 - Succesfully set infotec_IS2027 to driver infotec_IS2027. - - <SAMP -CLASS="PROMPT" ->root# </SAMP -></PRE -></P -><P ->If you look closely, you'll discover your root password was transfered unencrypted over -the wire, so beware! Also, if you look further her, you'll discover error messages like -<CODE -CLASS="CONSTANT" ->NT_STATUS_OBJECT_NAME_COLLISION</CODE -> in between. They occur, because -the directories <TT -CLASS="FILENAME" ->WIN40</TT -> and <TT -CLASS="FILENAME" ->W32X86</TT -> already -existed in the [print$] driver download share (from a previous driver -installation). They are harmless here.</P -><P ->Now your printer is prepared for the clients to use. From -a client, browse to the CUPS/Samba server, open the "Printers" -share, right-click on this printer and select "Install..." or -"Connect..." (depending on the Windows version you use). Now their -should be a new printer in your client's local "Printers" folder, -named (in my case) "infotec_IS2027 on kdebitshop"</P -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->NOTE: </I -></SPAN -> -<B -CLASS="COMMAND" ->cupsaddsmb</B -> will only reliably work i -with CUPS version 1.1.15 or higher -and Samba from 2.2.4. If it doesn't work, or if the automatic printer -driver download to the clients doesn't succeed, you can still manually -install the CUPS printer PPD on top of the Adobe PostScript driver on -clients and then point the client's printer queue to the Samba printer -share for connection, should you desire to use the CUPS networked -PostScript RIP functions.</P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2212" ->14.8. The CUPS Filter Chains</A -></H1 -><P ->The following diagrams reveal how CUPS handles print jobs.</P -><PRE -CLASS="PROGRAMLISTING" ->######################################################################### -# -# CUPS in and of itself has this (general) filter chain (CAPITAL -# letters are FILE-FORMATS or MIME types, other are filters (this is -# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro): -# -# <VAR -CLASS="REPLACEABLE" ->SOMETHNG</VAR ->-FILEFORMAT -# | -# | -# V -# <VAR -CLASS="REPLACEABLE" ->something</VAR ->tops -# | -# | -# V -# APPLICATION/POSTSCRIPT -# | -# | -# V -# pstops -# | -# | -# V -# APPLICATION/VND.CUPS-POSTSCRIPT -# | -# | -# V -# pstoraster # as shipped with CUPS, independent from any Ghostscipt -# | # installation on the system -# | (= "postscipt interpreter") -# | -# V -# APPLICATION/VND.CUPS-RASTER -# | -# | -# V -# rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> (f.e. Gimp-Print filters may be plugged in here) -# | (= "raster driver") -# | -# V -# SOMETHING-DEVICE-SPECIFIC -# | -# | -# V -# backend -# -# -# ESP PrintPro has some enhanced "rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR ->" filters as compared to -# CUPS, and also a somewhat improved "pstoraster" filter. -# -# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> is noted. -# -#########################################################################</PRE -><PRE -CLASS="PROGRAMLISTING" ->######################################################################### -# -# This is how "cupsomatic" comes into play: -# ========================================= -# -# <VAR -CLASS="REPLACEABLE" ->SOMETHNG</VAR ->-FILEFORMAT -# | -# | -# V -# <VAR -CLASS="REPLACEABLE" ->something</VAR ->tops -# | -# | -# V -# APPLICATION/POSTSCRIPT -# | -# | -# V -# pstops -# | -# | -# V -# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+ -# | | -# | V -# V cupsomatic -# pstoraster (constructs complicated -# | (= "postscipt interpreter") Ghostscript commandline -# | to let the file be -# V processed by a -# APPLICATION/VND.CUPS-RASTER "-sDEVICE=<VAR -CLASS="REPLACEABLE" ->s.th.</VAR ->" -# | call...) -# | | -# V | -# rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> V -# | (= "raster driver") +-------------------------+ -# | | Ghostscript at work.... | -# V | | -# SOMETHING-DEVICE-SPECIFIC *-------------------------+ -# | | -# | | -# V | -# backend >------------------------------------+ -# | -# | -# V -# THE PRINTER -# -# -# Note, that cupsomatic "kidnaps" the printfile after the -# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it through -# the CUPS-external, systemwide Ghostscript installation, bypassing the -# "pstoraster" filter (therefor also bypassing the CUPS-raster-drivers -# "rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR ->", and hands the rasterized file directly to the CUPS -# backend... -# -# cupsomatic is not made by the CUPS developers. It is an independent -# contribution to printing development, made by people from -# Linuxprinting.org. (see also http://www.cups.org/cups-help.html) -# -# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> is noted. -# -#########################################################################</PRE -><PRE -CLASS="PROGRAMLISTING" ->######################################################################### -# -# And this is how it works for ESP PrintPro from 4.3: -# =================================================== -# -# <VAR -CLASS="REPLACEABLE" ->SOMETHNG</VAR ->-FILEFORMAT -# | -# | -# V -# <VAR -CLASS="REPLACEABLE" ->something</VAR ->tops -# | -# | -# V -# APPLICATION/POSTSCRIPT -# | -# | -# V -# pstops -# | -# | -# V -# APPLICATION/VND.CUPS-POSTSCRIPT -# | -# | -# V -# gsrip -# | (= "postscipt interpreter") -# | -# V -# APPLICATION/VND.CUPS-RASTER -# | -# | -# V -# rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> (f.e. Gimp-Print filters may be plugged in here) -# | (= "raster driver") -# | -# V -# SOMETHING-DEVICE-SPECIFIC -# | -# | -# V -# backend -# -# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> is noted. -# -#########################################################################</PRE -><PRE -CLASS="PROGRAMLISTING" ->######################################################################### -# -# This is how "cupsomatic" would come into play with ESP PrintPro: -# ================================================================ -# -# -# <VAR -CLASS="REPLACEABLE" ->SOMETHNG</VAR ->-FILEFORMAT -# | -# | -# V -# <VAR -CLASS="REPLACEABLE" ->something</VAR ->tops -# | -# | -# V -# APPLICATION/POSTSCRIPT -# | -# | -# V -# pstops -# | -# | -# V -# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+ -# | | -# | V -# V cupsomatic -# gsrip (constructs complicated -# | (= "postscipt interpreter") Ghostscript commandline -# | to let the file be -# V processed by a -# APPLICATION/VND.CUPS-RASTER "-sDEVICE=<VAR -CLASS="REPLACEABLE" ->s.th.</VAR ->" -# | call...) -# | | -# V | -# rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> V -# | (= "raster driver") +-------------------------+ -# | | Ghostscript at work.... | -# V | | -# SOMETHING-DEVICE-SPECIFIC *-------------------------+ -# | | -# | | -# V | -# backend >------------------------------------+ -# | -# | -# V -# THE PRINTER -# -# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> is noted. -# -#########################################################################</PRE -><PRE -CLASS="PROGRAMLISTING" ->######################################################################### -# -# And this is how it works for CUPS from 1.1.15: -# ============================================== -# -# <VAR -CLASS="REPLACEABLE" ->SOMETHNG</VAR ->-FILEFORMAT -# | -# | -# V -# <VAR -CLASS="REPLACEABLE" ->something</VAR ->tops -# | -# | -# V -# APPLICATION/POSTSCRIPT -# | -# | -# V -# pstops -# | -# | -# V -# APPLICATION/VND.CUPS-POSTSCRIPT-----+ -# | -# +------------------v------------------------------+ -# | Ghostscript | -# | at work... | -# | (with | -# | "-sDEVICE=cups") | -# | | -# | (= "postscipt interpreter") | -# | | -# +------------------v------------------------------+ -# | -# | -# APPLICATION/VND.CUPS-RASTER >-------+ -# | -# | -# V -# rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> -# | (= "raster driver") -# | -# V -# SOMETHING-DEVICE-SPECIFIC -# | -# | -# V -# backend -# -# -# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to -# Ghostscript. GNU Ghostscript needs to be patched to handle the -# CUPS requirement; ESP Ghostscript has this builtin. In any case, -# "gs -h" needs to show up a "cups" device. pstoraster is now a -# calling an appropriate "gs -sDEVICE=cups..." commandline to do -# the job. It will output "application/vnd.cup-raster", which will -# be finally processed by a CUPS raster driver "rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR ->" -# Note the difference to "cupsomatic", which will *not* output -# CUPS-raster, but a final version of the printfile, ready to be -# sent to the printer. cupsomatic also doesn't use the "cups" -# devicemode in Ghostscript, but one of the classical devicemodes.... -# -# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> is noted. -# -#########################################################################</PRE -><PRE -CLASS="PROGRAMLISTING" ->######################################################################### -# -# And this is how it works for CUPS from 1.1.15, with cupsomatic included: -# ======================================================================== -# -# <VAR -CLASS="REPLACEABLE" ->SOMETHNG</VAR ->-FILEFORMAT -# | -# | -# V -# <VAR -CLASS="REPLACEABLE" ->something</VAR ->tops -# | -# | -# V -# APPLICATION/POSTSCRIPT -# | -# | -# V -# pstops -# | -# | -# V -# APPLICATION/VND.CUPS-POSTSCRIPT-----+ -# | -# +------------------v------------------------------+ -# | Ghostscript . Ghostscript at work.... | -# | at work... . (with "-sDEVICE= | -# | (with . <VAR -CLASS="REPLACEABLE" ->s.th.</VAR ->" | -# | "-sDEVICE=cups") . | -# | . | -# | (CUPS standard) . (cupsomatic) | -# | . | -# | (= "postscript interpreter") | -# | . | -# +------------------v--------------v---------------+ -# | | -# | | -# APPLICATION/VND.CUPS-RASTER >-------+ | -# | | -# | | -# V | -# rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> | -# | (= "raster driver") | -# | | -# V | -# SOMETHING-DEVICE-SPECIFIC >------------------------+ -# | -# | -# V -# backend -# -# -# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rasterto<VAR -CLASS="REPLACEABLE" ->something</VAR -> is noted. -# -##########################################################################</PRE -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2251" ->14.9. CUPS Print Drivers and Devices</A -></H1 -><P ->CUPS ships with good support for HP LaserJet type printers. You can install -the driver as follows: - -<P -></P -><UL -><LI -><P -> lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd - </P -></LI -></UL -> - -(The "-m" switch will retrieve the "laserjet.ppd" from the standard repository -for not-yet-installed-PPDs, which CUPS typically stores in -<TT -CLASS="FILENAME" ->/usr/share/cups/model</TT ->. Alternatively, you may use -"-P /absolute/filesystem/path/to/where/there/is/PPD/your.ppd").</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN2258" ->14.9.1. Further printing steps</A -></H2 -><P ->Always also consult the database on linuxprinting.org for all recommendations -about which driver is best used for each printer:</P -><P -><A -HREF="http://www.linuxprinting.org/printer_list.cgi" -TARGET="_top" ->http://www.linuxprinting.org/printer_list.cgi</A -></P -><P ->There select your model and click on "Show". You'll arrive at a page listing -all drivers working with your model. There will always be *one* -<SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->recommended</I -></SPAN -> one. Try this one first. In your case -("HP LaserJet 4 Plus"), you'll arrive here:</P -><P -><A -HREF="http://www.linuxprinting.org/show_printer.cgi?recnum=75104" -TARGET="_top" ->http://www.linuxprinting.org/show_printer.cgi?recnum=75104</A -></P -><P ->The recommended driver is "ljet4". It has a link to the page for the ljet4 -driver too:</P -><P -><A -HREF="http://www.linuxprinting.org/show_driver.cgi?driver=ljet4" -TARGET="_top" ->http://www.linuxprinting.org/show_driver.cgi?driver=ljet4</A -></P -><P ->On the driver's page, you'll find important and detailed info about how to use -that driver within the various available spoolers. You can generate a PPD for -CUPS. The PPD contains all the info about how to use your model and the driver; -this is, once installed, working transparently for the user -- you'll only -need to choose resolution, paper size etc. from the web-based menu or from -the print dialog GUI or from the commandline...</P -><P ->On the driver's page, choose to use the "PPD-O-Matic" online PPD generator -program. Select your model and click "Generate PPD file". When you safe the -appearing ASCII text file, don't use "cut'n'past" (as it could possiblly corrupt -line endings and tabs), but use "Save as..." in your browser's menu. Save it -at "/some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"</P -><P ->Then install the printer:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> "lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E \ - -P /some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"</PRE -></P -><P ->Note, that for all the "Foomatic-PPDs" from Linuxprinting.org, you also need -a special "CUPS filter" named "cupsomatic". Get the latest version of -"cupsomatic" from:</P -><P -><A -HREF="http://www.linuxprinting.org/cupsomatic" -TARGET="_top" ->http://www.linuxprinting.org/cupsomatic</A -></P -><P ->This needs to be copied to <TT -CLASS="FILENAME" ->/usr/lib/cups/filter/cupsomatic</TT -> -and be made world executable. This filter is needed to read and act upon the -specially encoded Foomatic comments, embedded in the printfile, which in turn -are used to construct (transparently for you, the user) the complicated -ghostscript command line needed for your printer/driver combo.</P -><P ->You can have a look at all the options for the Ghostscript commandline supported -by your printer and the ljet4 driver by going to the section "Execution details", -selecting your model (Laserjet 4 Plus) and clicking on "Show execution details". -This will bring up this web page:</P -><P -><A -HREF="http://www.linuxprinting.org/execution.cgi?driver=ljet4&printer=75104&.submit=Show+execution+details" -TARGET="_top" ->http://www.linuxprinting.org/execution.cgi?driver=ljet4&printer=75104&.submit=Show+execution+details</A -></P -><P ->The ingenious thing is that the database is kept current. If there -is a bug fix and an improvement somewhere in the database, you will -always get the most current and stable and feature-rich driver by following -the steps described above.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Till Kamppeter from MandrakeSoft is doing an excellent job here that too few -people are aware of. (So if you use it often, please send him a note showing -your appreciation).</P -></TD -></TR -></TABLE -></DIV -><P ->The latest and greatest improvement now is support for "custom page sizes" -for all those printers which support it.</P -><P ->"cupsomatic" is documented here:</P -><P -><A -HREF="http://www.linuxprinting.org/cups-doc.html" -TARGET="_top" ->http://www.linuxprinting.org/cups-doc.html</A -></P -><P ->More printing tutorial info may be found here:</P -><P -><A -HREF="http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/" -TARGET="_top" ->http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/</A -></P -><P ->Note, that *all* the Foomatic drivers listed on Linuxprinting.org (now -approaching the "all-time high" number of 1.000 for the supported models) -are using a special filtering chain involving Ghostscript, as described -in this document.</P -><P ->Summary - You need:</P -><P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->A "foomatic+<VAR -CLASS="REPLACEABLE" ->something</VAR ->" PPD is not enough to print with CUPS (but it is *one* important component)</TD -></TR -><TR -><TD ->The "cupsomatic" filter script (Perl) in <TT -CLASS="FILENAME" ->/usr/lib/cups/filters/</TT -></TD -></TR -><TR -><TD ->Perl to make cupsomatic run</TD -></TR -><TR -><TD ->Ghostscript (because it is called and controlled by the PPD/cupsomatic combo in a way to fit your printermodel/driver combo.</TD -></TR -><TR -><TD ->Ghostscript *must*, depending on the driver/model, contain support for a certain "device" (as shown by "gs -h")</TD -></TR -></TBODY -></TABLE -><P -></P -></P -><P ->In the case of the "hpijs" driver, you need a Ghostscript version, which -has "ijs" amongst its supported devices in "gs -h". In the case of -"hpijs+foomatic", a valid ghostscript commandline would be reading like this:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> gs -q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=ijs \ - -sIjsServer=hpijs<VAR -CLASS="REPLACEABLE" ->PageSize</VAR -> -dDuplex=<VAR -CLASS="REPLACEABLE" ->Duplex</VAR -> <VAR -CLASS="REPLACEABLE" ->Model</VAR -> \ - -r<VAR -CLASS="REPLACEABLE" ->Resolution</VAR ->,PS:MediaPosition=<VAR -CLASS="REPLACEABLE" ->InputSlot</VAR -> -dIjsUseOutputFD \ - -sOutputFile=- -</PRE -></P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Note, that with CUPS and the "hpijs+foomatic" PPD (plus Perl and cupsomatic) -you don't need to remember this. You can choose the available print options -thru a GUI print command (like "glp" from ESP's commercially supported -PrintPro software, or KDE's "kprinter", or GNOME's "gtklp" or the independent -"xpp") or the CUPS web interface via human-readable drop-down selection -menus.</P -></TD -></TR -></TABLE -></DIV -><P ->If you use "ESP Ghostscript" (also under the GPL, provided by Easy Software -Products, the makers of CUPS, downloadable from -<A -HREF="http://www.cups.org/software.html" -TARGET="_top" ->http://www.cups.org/software.html</A ->, -co-maintained by the developers of linuxprinting.org), you are guaranteed to -have in use the most uptodate, bug-fixed, enhanced and stable version of a Free -Ghostscript. It contains support for ~300 devices, whereas plain vanilla -GNU Ghostscript 7.05 only has ~200.</P -><P ->If you print only one CUPS test page, from the web interface and when you try to -print a windows test page, it acts like the job was never sent: - -<P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->Can you print "standard" jobs from the CUPS machine?</TD -></TR -><TR -><TD ->Are the jobs from Windows visible in the Web interface on CUPS (http://localhost:631/)?</TD -></TR -><TR -><TD -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Most important:</I -></SPAN -> What kind of printer driver are you using on the Windows clients?</TD -></TR -></TBODY -></TABLE -><P -></P -> - -You can try to get a more detailed debugging info by setting "LogLevel debug" in -<TT -CLASS="FILENAME" ->/etc/cups/cupsd.conf</TT ->, re-start cupsd and investigate <TT -CLASS="FILENAME" ->/var/log/cups/error_log</TT -> -for the whereabouts of your Windows-originating printjobs:</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->what does the "auto-typing" line say? which is the "MIME type" CUPS thinks is arriving from the Windows clients?</TD -></TR -><TR -><TD ->are there "filter" available for this MIME type?</TD -></TR -><TR -><TD ->are there "filter rules" defined in "/etc/cups/mime.convs" for this MIME type?</TD -></TR -></TBODY -></TABLE -><P -></P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2328" ->14.10. Limiting the number of pages users can print</A -></H1 -><P ->The feature you want is dependent on the real print subsystem you're using. -Samba's part is always to receive the job files from the clients (filtered -*or* unfiltered) and hand it over to this printing subsystem.</P -><P ->Of course one could "hack" things with one's own scripts.</P -><P ->But there is CUPS (Common Unix Printing System). CUPS supports "quotas". -Quotas can be based on sizes of jobs or on the number of pages or both, -and are spanning any time period you want.</P -><P ->This is an example command how root would set a print quota in CUPS, -assuming an existing printer named "quotaprinter":</P -><PRE -CLASS="PROGRAMLISTING" -> lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 \ - -o job-page-limit=100</PRE -><P ->This would limit every single user to print 100 pages or 1024 KB of -data (whichever comes first) within the last 604.800 seconds ( = 1 week).</P -><P ->For CUPS to count correctly, the printfile needs to pass the CUPS "pstops" filter, -otherwise it uses a "dummy" count of "1". Some printfiles don't pass it -(eg: image files) but then those are mostly 1 page jobs anyway. This also means, -proprietary drivers for the target printer running on the client computers and -CUPS/Samba then spooling these files as "raw" (i.e. leaving them untouched, not -filtering them), will be counted as "1-pagers" too!</P -><P ->You need to send PostScript from the clients (i.e. run a PostScript driver there) -for having the chance to get accounting done. If the printer is a non-PostScript model, -you need to let CUPS do the job to convert the file to a print-ready format for the -target printer. This will be working for currently ~1.000 different printer models, see</P -><PRE -CLASS="PROGRAMLISTING" -> http://www.linuxprinting.org/printer_list.cgi</PRE -><P ->Before CUPS-1.1.16 your only option was to use the Adobe PostScript -Driver on the Windows clients. The output of this driver was not always -passed thru the "pstops" filter on the CUPS/Samba side, and therefor was -not counted correctly (the reason is that it often --- depending on the -"PPD" being used --- did write a "PJL"-header in front of the real -PostScript which made CUPS to skip the pstops and go directy to -the "pstoraster" stage).</P -><P ->From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver -for Windows NT/2K/XP clients" (it is tagged in the download area of -http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). -It is *not* working for Win9x/ME clients. But it:</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->it guarantees to not write an PJL-header</TD -></TR -><TR -><TD ->it guarantees to still read and support all PJL-options named in the driver PPD with its own means</TD -></TR -><TR -><TD ->it guarantees the file going thru the "pstops" filter on the CUPS/Samba server</TD -></TR -><TR -><TD ->it guarantees to page-count correctly the printfile</TD -></TR -></TBODY -></TABLE -><P -></P -><P ->You can read more about the setup of this combination in the -manpage for "cupsaddsmb" (only present with CUPS installed, only -current with CUPS 1.1.16).</P -><P ->These are the items CUPS logs in the "page_log" for every single *page* of a job:</P -><P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->Printer name</TD -></TR -><TR -><TD ->User name</TD -></TR -><TR -><TD ->Job ID</TD -></TR -><TR -><TD ->Time of printing</TD -></TR -><TR -><TD ->the page number</TD -></TR -><TR -><TD ->the number of copies</TD -></TR -><TR -><TD ->a billing info string (optional)</TD -></TR -></TBODY -></TABLE -><P -></P -></P -><P ->Here is an extract of my CUPS server's page_log file to illustrate -the format and included items:</P -><P -><SAMP -CLASS="COMPUTEROUTPUT" -> infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 1 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 2 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 3 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 4 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 5 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 6 2 #marketing</SAMP -></P -><P ->This was Job ID "40", printed on "infotec_IS2027" by user "kurt", a 6-page job -printed in 2 copies and billed to "#marketing"...</P -><P ->What flaws or shortcomings are there?</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->the ones named above</TD -></TR -><TR -><TD -> CUPS really counts the job pages being *processsed in software* - (going thru the "RIP") rather than the physical sheets successfully - leaving the printing device -- if there is a jam while printing - the 5th sheet out of 1000 and the job is aborted by the printer, - the "page count" will still show the figure of 1000 for that job - </TD -></TR -><TR -><TD -> all quotas are the same for all users (no flexibility to give the - boss a higher quota than the clerk) no support for groups - </TD -></TR -><TR -><TD -> no means to read out the current balance or "used-up" number of current quota - </TD -></TR -><TR -><TD -> a user having used up 99 sheets of 100 quota will still be able to send and print a 1.000 sheet job - </TD -></TR -><TR -><TD -> a user being denied a job because of a filled-up quota doesn't get a meaningful - error message from CUPS other than "client-error-not-possible". - </TD -></TR -></TBODY -></TABLE -><P -></P -><P ->But this is the best system out there currently. And there are -huge improvements under development:</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->page counting will go into the "backends" (these talk - directly to the printer and will increase the count in sync with the - actual printing process -- a jam at the 5th sheet will lead to a stop in the counting)</TD -></TR -><TR -><TD ->quotas will be handled more flexibly</TD -></TR -><TR -><TD ->probably there will be support for users to inquire their "accounts" in advance</TD -></TR -><TR -><TD ->probably there will be support for some other tools around this topic</TD -></TR -></TBODY -></TABLE -><P -></P -><P ->Other than the current stage of the CUPS development, I don't -know any other ready-to-use tool which you could consider.</P -><P ->You can download the driver files from -<A -HREF="http://www.cups.org/software.html" -TARGET="_top" ->http://www.cups.org/software.html</A ->. -It is a separate package from the CUPS base software files, tagged as "CUPS 1.1.16 -Windows NT/2k/XP Printer Driver for SAMBA (tar.gz, 192k)". The filename to -download is "cups-samba-1.1.16.tar.gz". Upon untar-/unzip-ping it will reveal -the files:</P -><P -> <SAMP -CLASS="COMPUTEROUTPUT" -> cups-samba.install - cups-samba.license - cups-samba.readme - cups-samba.remove - cups-samba.ss - </SAMP -> - </P -><P ->These have been packaged with the ESP meta packager software "EPM". The -*.install and *.remove files are simple shell script, which untars the -*.ss (which is nothing else than a tar-archive) and puts its contents -into <TT -CLASS="FILENAME" ->/usr/share/cups/drivers/</TT ->. Its contents are 3 files:</P -><P -> <SAMP -CLASS="COMPUTEROUTPUT" -> cupsdrvr.dll - cupsui.dll - cups.hlp - </SAMP -> - </P -><DIV -CLASS="CAUTION" -><P -></P -><TABLE -CLASS="CAUTION" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/caution.gif" -HSPACE="5" -ALT="Caution"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Due to a bug one CUPS release puts the <TT -CLASS="FILENAME" ->cups.hlp</TT -> -into <TT -CLASS="FILENAME" ->/usr/share/drivers/</TT -> instead of -<TT -CLASS="FILENAME" ->/usr/share/cups/drivers/</TT ->. To work around this, copy/move -the file after running the "./cups-samba.install" script manually to the right place:</P -><P -> <KBD -CLASS="USERINPUT" -> cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/ - </KBD -> - </P -></TD -></TR -></TABLE -></DIV -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->This new CUPS PostScript driver is currently binary-only, but free -no source code is provided (yet). The reason is this: it has -been developed with the help of the Microsoft Driver Developer Kit (DDK) -and compiled with Microsoft Visual Studio 6. It is not clear to the driver -developers if they are allowed to distribute the whole of the source code -as Free Software. However, they will likely release the "diff" in source -code under the GPL, so anybody with a license of Visual Studio and a DDK -will be able to compile for him/herself.</P -><P ->Once you have run the install script (and possibly manually moved the -"cups.hlp" file to "/usr/share/cups/drivers/"), the driver is ready to be -put into Samba's [print$] share (which often maps to "/etc/samba/drivers/" -and contains a subdir tree with WIN40 and W32X86 branches), by running -"cupsaddsmb" (see also "man cupsaddsmb" for CUPS 1.1.16). [Don't forget to -put root into the smbpasswd file by running "smbpasswd" should you run -this whole procedure for the first time.] Once the driver files are in the -[print$] share, they are ready to be downloaded and installed by the -Win NT/2k/XP clients.</P -></TD -></TR -></TABLE -></DIV -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P -> Win 9x/ME clients won't work with this driver. For these you'd - still need to use the ADOBE*.* drivers as previously. - </P -></TD -></TR -></TABLE -></DIV -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P -> It is not harming if you've still the ADOBE*.* driver files from - previous installations in the "/usr/share/cups/drivers/" directory. - The new cupsaddsmb (from 1.1.16) will automatically use the - "newest" installed driver (which here then is the CUPS drivers). - </P -></TD -></TR -></TABLE -></DIV -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P -> Should your Win clients have had the old ADOBE*.* files and the - Adobe PostScript drivers installed, the download and installation - of the new CUPS PostScript driver for Windows NT/2k/XP will fail - at first. - </P -><P -> It is not enough to "delete" the printer (as the driver files - will still be kept by the clients and re-used if you try to - re-install the printer). To really get rid of the Adobe driver - files on the clients, open the "Printers" folder (possibly via - "Start --> Settings --> Control Panel --> Printers"), right-click - onto the folder background and select "Server Properties". A - new dialog opens; select the "Drivers" tab; on the list select - the driver you want to delete and click on the "Delete" button. - (This will only work if there is no single printer left which - uses that particular driver -- you need to "delete" all printers - using this driver in the "Printers" folder first.) - </P -></TD -></TR -></TABLE -></DIV -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P -> Once you have successfully downloaded the CUPS PostScript driver - to a client, you can easily switch all printers to this one - by proceeding as described elsewhere in the "Samba HOWTO - Collection" to change a driver for an existing printer. - </P -></TD -></TR -></TABLE -></DIV -><P ->What are the benefits with the "CUPS PostScript driver for Windows NT/2k/XP" -as compared to the Adobe drivers?</P -><P -><P -></P -><UL -><LI -><P -> no hassle with the Adobe EULA - </P -></LI -><LI -><P -> no hassle with the question "where do I get the ADOBE*.* driver files from?" - </P -></LI -><LI -><P -> the Adobe drivers (depending on the printer PPD associated with them) - often put a PJL header in front of the core PostScript part of the print - file (thus the file starts with "<VAR -CLASS="REPLACEABLE" ->1B</VAR ->%-12345X" or "<VAR -CLASS="REPLACEABLE" ->escape</VAR ->%-12345X" - instead of "%!PS"). This leads to the CUPS daemon autotyping the - arriving file as a print-ready file, not requiring a pass thru the - "pstops" filter (to speak more technical, it is not regarded as the - generic MIME type "application/postscript", but as the more special - MIME type "application/cups.vnd-postscript"), which therefore also - leads to the page accounting in "/var/log/cups/page_log" not receiving - the exact mumber of pages; instead the dummy page number of "1" is - logged in a standard setup) - </P -></LI -><LI -><P -> the Adobe driver has more options to "mis-configure" the PostScript - generated by it (like setting it inadvertedly to "Optimize for Speed", - instead of "Optimize for Portability", which could lead to CUPS being - unable to process it) - </P -></LI -><LI -><P -> the CUPS PostScript driver output sent by Windows clients to the CUPS - server will be guaranteed to be auto-typed as generic MIME type - "application/postscript", thusly passing thru the CUPS "pstops" filter - and logging the correct number of pages in the page_log for accounting - and quota purposes - </P -></LI -><LI -><P -> the CUPS PostScript driver supports the sending of additional print - options by the Win NT/2k/XP clients, such as naming the CUPS standard - banner pages (or the custom ones, should they be installed at the time - of driver download), using the CUPS "page-label" option, setting a - job-priority and setting the scheduled time of printing (with the option - to support additional useful IPP job attributes in the future). - </P -></LI -><LI -><P -> the CUPS PostScript driver supports the inclusion of the new - "*cupsJobTicket" comments at the beginnig of the PostScript file (which - could be used in the future for all sort of beneficial extensions on - the CUPS side, but which will not disturb any other application as those - will regard it as a comment and simply ignore it). - </P -></LI -><LI -><P -> the CUPS PostScript driver will be the heart of the fully fledged CUPS - IPP client for Windows NT/2k/XP to be released soon (probably alongside - the first Beta release for CUPS 1.2). - </P -></LI -></UL -></P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2424" ->14.11. Advanced Postscript Printing from MS Windows</A -></H1 -><P ->Let the Windows Clients use a PostScript driver to deliver poistscript to -the samba print server (just like any Linux or Unix Client would also use -PostScript to send to the server)</P -><P ->Make the Unix printing subsystem to which Samba sends the job convert the -incoming PostScript files to the native print format of the target printers -(would be PCL if you have an HP printer)</P -><P ->Now if you are afraid that this would just mean using a *Generic* PostScript -driver for the clients that has no Simplex/Duplex selection, and no paper tray -choice, but you need them to be able to set up print jobs, with all the bells -and whistles of your printers:-</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->Not possible with traditional spooling systems</TD -></TR -><TR -><TD -> But perfectly supported by CUPS (which uses "PPD" files to - describe how to control the print options for PostScript and - non-PostScript devices alike... - </TD -></TR -></TBODY -></TABLE -><P -></P -><P ->CUPS PPDs are working perfectly on Windows clients who use Adobe PostScript -drivers (or the new CUPS PostScript driver for Windows NT/2K/XP). Clients can use -them to setup the job to their liking and CUPS will use the received job options -to make the (PCL-, ESC/P- or PostScript-) printer behave as required.</P -><P ->If you want to have the additional benefit of page count logging and accounting -then the CUPS PostScript driver is the best choice (better than the Adobe one).</P -><P ->If you want to make the drivers downloadable for the clients then "cupsaddsmb" is -your friend. It will setup the [print$] share on the Samba host to be ready to serve -the clients for a "point and print" driver installation.</P -><DIV -CLASS="WARNING" -><P -></P -><TABLE -CLASS="WARNING" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif" -HSPACE="5" -ALT="Warning"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->What strings are attached?</P -></TD -></TR -></TABLE -></DIV -><P ->There are some. But, given the sheer CPU power you can buy nowadays, -these can be overcome easily. The strings:</P -><P ->Well, if the CUPS/Samba side will have to print to many printers serving many users, -you probably will need to set up a second server (which can do automatic load balancing -with the first one, plus a degree of fail-over mechanism). Converting the incoming -PostScript jobs, "interpreting" them for non-PostScript printers, amounts to the work -of a "RIP" (Raster Image Processor) done in software. This requires more CPU and RAM -than for the mere "raw spooling" task your current setup is solving. It all depends -on the avarage and peak printing load the server should be able to handle.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2439" ->14.12. Auto-Deletion of CUPS spool files</A -></H1 -><P ->Samba print files pass thru two "spool" directories. One the incoming directory -managed by Samba, (set eg: in the <B -CLASS="COMMAND" ->path = /var/spool/samba</B -> directive in the [printers] -section of <TT -CLASS="FILENAME" ->smb.conf</TT ->). Second is the spool directory of your UNIX print subsystem. -For CUPS it is normally "/var/spool/cups/", as set by the cupsd.conf directive -"RequestRoot /var/spool/cups".</P -><P ->I am not sure, which one of your directories keeps the files. From what you say, -it is most likely the Samba part.</P -><P ->For the CUPS part, you may want to consult:</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->http://localhost:631/sam.html#PreserveJobFiles</TD -></TR -><TR -><TD ->http://localhost:631/sam.html#PreserveJobHistory</TD -></TR -><TR -><TD ->http://localhost:631/sam.html#MaxJobs</TD -></TR -></TBODY -></TABLE -><P -></P -><P ->There are the settings described for your CUPS daemon, which could lead to completed -job files not being deleted.</P -><P ->"PreserveJobHistory Yes" -- keeps some details of jobs in -cupsd's mind (well it keeps the "c12345", "c12346" etc. files -in the CUPS spool directory, which do a similar job as the -old-fashioned BSD-LPD control files). This is set to "Yes" -as a default.</P -><P ->"PreserveJobFiles Yes" -- keeps the job files themselves in -cupsd's mind (well it keeps the "d12345", "d12346" etc. files -in the CUPS spool directory...). This is set to "No" as the -CUPS default.</P -><P ->"MaxJobs 500" -- this directive controls the maximum number -of jobs that are kept in memory. Once the number of jobs -reaches the limit, the oldest completed job is automatically -purged from the system to make room for the new one. If all -of the known jobs are still pending or active then the new -job will be rejected. Setting the maximum to 0 disables this -functionality. The default setting is 0.</P -><P ->(There are also additional settings for "MaxJobsPerUser" and -"MaxJobsPerPrinter"...)</P -><P ->For everything to work as announced, you need to have three things:</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD -> a Samba-<SPAN -CLASS="APPLICATION" ->smbd</SPAN -> which is compiled against "libcups" (Check on Linux by running <KBD -CLASS="USERINPUT" ->ldd `which smbd`</KBD ->) - </TD -></TR -><TR -><TD -> a Samba-<TT -CLASS="FILENAME" ->smb.conf</TT -> setting of <B -CLASS="COMMAND" ->printing = cups</B -> - </TD -></TR -><TR -><TD -> another Samba-<TT -CLASS="FILENAME" ->smb.conf</TT -> setting of <B -CLASS="COMMAND" ->printcap = cups</B -> - </TD -></TR -></TBODY -></TABLE -><P -></P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Note, that in this case all other manually set printing-related -commands (like "print command", "lpq command", "lprm command", -"lppause command" or "lpresume command") are ignored and they -should normally have no influence what-so-ever on your printing.</P -></TD -></TR -></TABLE -></DIV -><P ->If you want to do things manually, replace the "printing = cups" -by "printing = bsd". Then your manually set commands may work -(haven't tested this), and a "print command = lp -d %P %s; rm %s" -may do what you need.</P -><P ->You forgot to mention the CUPS version you're using. If you did -set things up as described in the man pages, then the Samba -spool files should be deleted. Otherwise it may be a bug. On -the CUPS side, you can control the behaviour as described -above.</P -><P ->If you have more problems, post the output of these commands:</P -><P -><KBD -CLASS="USERINPUT" -> grep -v ^# /etc/cups/cupsd.conf | grep -v ^$ - grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"</KBD -></P -><P ->(adapt paths as needed). These commands sanitize the files -and cut out the empty lines and lines with comments, providing -the "naked settings" in a compact way.</P -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="printing.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="winbind.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Printing Support</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="optional.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Unified Logons between Windows NT and UNIX using Winbind</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/domain-security.html b/docs/htmldocs/domain-security.html deleted file mode 100644 index ddbc4624b8..0000000000 --- a/docs/htmldocs/domain-security.html +++ /dev/null @@ -1,427 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Samba as a NT4 or Win2k domain member</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Type of installation" -HREF="type.html"><LINK -REL="PREVIOUS" -TITLE="Samba as a ADS domain member" -HREF="ads.html"><LINK -REL="NEXT" -TITLE="Advanced Configuration" -HREF="optional.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="ads.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="optional.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="DOMAIN-SECURITY" -></A ->Chapter 9. Samba as a NT4 or Win2k domain member</H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN1439" ->9.1. Joining an NT Domain with Samba 3.0</A -></H1 -><P ->Assume you have a Samba 3.0 server with a NetBIOS name of - <CODE -CLASS="CONSTANT" ->SERV1</CODE -> and are joining an or Win2k NT domain called - <CODE -CLASS="CONSTANT" ->DOM</CODE ->, which has a PDC with a NetBIOS name - of <CODE -CLASS="CONSTANT" ->DOMPDC</CODE -> and two backup domain controllers - with NetBIOS names <CODE -CLASS="CONSTANT" ->DOMBDC1</CODE -> and <CODE -CLASS="CONSTANT" ->DOMBDC2 - </CODE ->.</P -><P ->Firstly, you must edit your <TT -CLASS="FILENAME" ->smb.conf</TT -> file to tell Samba it should - now use domain security.</P -><P ->Change (or add) your <A -HREF="smb.conf.5.html#SECURITY" -TARGET="_top" -> <VAR -CLASS="PARAMETER" ->security =</VAR -></A -> line in the [global] section - of your <TT -CLASS="FILENAME" ->smb.conf</TT -> to read:</P -><P -><B -CLASS="COMMAND" ->security = domain</B -></P -><P ->Next change the <A -HREF="smb.conf.5.html#WORKGROUP" -TARGET="_top" -><VAR -CLASS="PARAMETER" -> workgroup =</VAR -></A -> line in the [global] section to read: </P -><P -><B -CLASS="COMMAND" ->workgroup = DOM</B -></P -><P ->as this is the name of the domain we are joining. </P -><P ->You must also have the parameter <A -HREF="smb.conf.5.html#ENCRYPTPASSWORDS" -TARGET="_top" -> <VAR -CLASS="PARAMETER" ->encrypt passwords</VAR -></A -> set to <CODE -CLASS="CONSTANT" ->yes - </CODE -> in order for your users to authenticate to the NT PDC.</P -><P ->Finally, add (or modify) a <A -HREF="smb.conf.5.html#PASSWORDSERVER" -TARGET="_top" -> <VAR -CLASS="PARAMETER" ->password server =</VAR -></A -> line in the [global] - section to read: </P -><P -><B -CLASS="COMMAND" ->password server = DOMPDC DOMBDC1 DOMBDC2</B -></P -><P ->These are the primary and backup domain controllers Samba - will attempt to contact in order to authenticate users. Samba will - try to contact each of these servers in order, so you may want to - rearrange this list in order to spread out the authentication load - among domain controllers.</P -><P ->Alternatively, if you want smbd to automatically determine - the list of Domain controllers to use for authentication, you may - set this line to be :</P -><P -><B -CLASS="COMMAND" ->password server = *</B -></P -><P ->This method, allows Samba to use exactly the same - mechanism that NT does. This - method either broadcasts or uses a WINS database in order to - find domain controllers to authenticate against.</P -><P ->In order to actually join the domain, you must run this - command:</P -><P -><SAMP -CLASS="PROMPT" ->root# </SAMP -><KBD -CLASS="USERINPUT" ->net rpc join -S DOMPDC - -U<VAR -CLASS="REPLACEABLE" ->Administrator%password</VAR -></KBD -></P -><P ->as we are joining the domain DOM and the PDC for that domain - (the only machine that has write access to the domain SAM database) - is DOMPDC. The <VAR -CLASS="REPLACEABLE" ->Administrator%password</VAR -> is - the login name and password for an account which has the necessary - privilege to add machines to the domain. If this is successful - you will see the message:</P -><P -><SAMP -CLASS="COMPUTEROUTPUT" ->Joined domain DOM.</SAMP -> - or <SAMP -CLASS="COMPUTEROUTPUT" ->Joined 'SERV1' to realm 'MYREALM'</SAMP -> - </P -><P ->in your terminal window. See the <A -HREF="net.8.html" -TARGET="_top" -> net(8)</A -> man page for more details.</P -><P ->This process joins the server to thedomain - without having to create the machine trust account on the PDC - beforehand.</P -><P ->This command goes through the machine account password - change protocol, then writes the new (random) machine account - password for this Samba server into a file in the same directory - in which an smbpasswd file would be stored - normally :</P -><P -><TT -CLASS="FILENAME" ->/usr/local/samba/private/secrets.tdb</TT -></P -><P ->This file is created and owned by root and is not - readable by any other user. It is the key to the domain-level - security for your system, and should be treated as carefully - as a shadow password file.</P -><P ->Finally, restart your Samba daemons and get ready for - clients to begin using domain security!</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN1493" ->9.2. Why is this better than security = server?</A -></H1 -><P ->Currently, domain security in Samba doesn't free you from - having to create local Unix users to represent the users attaching - to your server. This means that if domain user <CODE -CLASS="CONSTANT" ->DOM\fred - </CODE -> attaches to your domain security Samba server, there needs - to be a local Unix user fred to represent that user in the Unix - filesystem. This is very similar to the older Samba security mode - <A -HREF="smb.conf.5.html#SECURITYEQUALSSERVER" -TARGET="_top" ->security = server</A ->, - where Samba would pass through the authentication request to a Windows - NT server in the same way as a Windows 95 or Windows 98 server would. - </P -><P ->Please refer to the <A -HREF="winbind.html" -TARGET="_top" ->Winbind - paper</A -> for information on a system to automatically - assign UNIX uids and gids to Windows NT Domain users and groups. - This code is available in development branches only at the moment, - but will be moved to release branches soon.</P -><P ->The advantage to domain-level security is that the - authentication in domain-level security is passed down the authenticated - RPC channel in exactly the same way that an NT server would do it. This - means Samba servers now participate in domain trust relationships in - exactly the same way NT servers do (i.e., you can add Samba servers into - a resource domain and have the authentication passed on from a resource - domain PDC to an account domain PDC.</P -><P ->In addition, with <B -CLASS="COMMAND" ->security = server</B -> every Samba - daemon on a server has to keep a connection open to the - authenticating server for as long as that daemon lasts. This can drain - the connection resources on a Microsoft NT server and cause it to run - out of available connections. With <B -CLASS="COMMAND" ->security = domain</B ->, - however, the Samba daemons connect to the PDC/BDC only for as long - as is necessary to authenticate the user, and then drop the connection, - thus conserving PDC connection resources.</P -><P ->And finally, acting in the same manner as an NT server - authenticating to a PDC means that as part of the authentication - reply, the Samba server gets the user identification information such - as the user SID, the list of NT groups the user belongs to, etc. </P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P -> Much of the text of this document - was first published in the Web magazine <A -HREF="http://www.linuxworld.com" -TARGET="_top" -> - LinuxWorld</A -> as the article <A -HREF="http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html" -TARGET="_top" ->Doing - the NIS/NT Samba</A ->.</P -></TD -></TR -></TABLE -></DIV -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="ads.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="optional.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Samba as a ADS domain member</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="type.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Advanced Configuration</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/groupprofiles.html b/docs/htmldocs/groupprofiles.html deleted file mode 100644 index 9c25717238..0000000000 --- a/docs/htmldocs/groupprofiles.html +++ /dev/null @@ -1,568 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Creating Group Prolicy Files</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Optional configuration" -HREF="optional.html"><LINK -REL="PREVIOUS" -TITLE="Samba performance issues" -HREF="speed.html"><LINK -REL="NEXT" -TITLE="Securing Samba" -HREF="securing-samba.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="speed.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="securing-samba.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="GROUPPROFILES" -></A ->Chapter 21. Creating Group Prolicy Files</H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3410" ->21.1. Windows '9x</A -></H1 -><P ->You need the Win98 Group Policy Editor to -set Group Profiles up under Windows '9x. It can be found on the Original -full product Win98 installation CD under -<TT -CLASS="FILENAME" ->tools/reskit/netadmin/poledit</TT ->. You install this -using the Add/Remove Programs facility and then click on the 'Have Disk' -tab.</P -><P ->Use the Group Policy Editor to create a policy file that specifies the -location of user profiles and/or the <TT -CLASS="FILENAME" ->My Documents</TT -> etc. -stuff. You then save these settings in a file called -<TT -CLASS="FILENAME" ->Config.POL</TT -> that needs to be placed in -the root of the [NETLOGON] share. If your Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the -Win9x/Me registry of the machine that is logging on.</P -><P ->All of this is covered in the Win98 Resource Kit documentation.</P -><P ->If you do not do it this way, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings.</P -><P ->The following all refers to Windows NT/200x profile migration - not to policies. -We need a separate section on policies (NTConfig.Pol) for NT4/200x.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3420" ->21.2. Windows NT 4</A -></H1 -><P ->Unfortunately, the Resource Kit info is Win NT4 or 200x specific.</P -><P ->Here is a quick guide:</P -><P -></P -><UL -><LI -><P ->On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'.</P -></LI -><LI -><P ->Select a user profile you want to migrate and click on it.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="90%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->I am using the term "migrate" lossely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC.</P -></TD -></TR -></TABLE -></DIV -></LI -><LI -><P ->Click the 'Copy To' button.</P -></LI -><LI -><P ->In the box labelled 'Copy Profile to' add your new path, eg: -<TT -CLASS="FILENAME" ->c:\temp\foobar</TT -></P -></LI -><LI -><P ->Click on the button labelled 'Change' in the "Permitted to use" box.</P -></LI -><LI -><P ->Click on the group 'Everyone' and then click OK. This closes the -'chose user' box.</P -></LI -><LI -><P ->Now click OK.</P -></LI -></UL -><P ->Follow the above for every profile you need to migrate.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3443" ->21.2.1. Side bar Notes</A -></H2 -><P ->You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.</P -><P ->With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3447" ->21.2.2. Mandatory profiles</A -></H2 -><P ->The above method can be used to create mandatory profiles also. To convert -a group profile into a mandatory profile simply locate the NTUser.DAT file -in the copied profile and rename it to NTUser.MAN.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3450" ->21.2.3. moveuser.exe</A -></H2 -><P ->The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3453" ->21.2.4. Get SID</A -></H2 -><P ->You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit.</P -><P ->Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList</P -><P ->Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath.</P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3458" ->21.3. Windows 2000/XP</A -></H1 -><P ->You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows:</P -><P -></P -><UL -><LI -><P ->Log on as the LOCAL workstation administrator.</P -></LI -><LI -><P ->Right click on the 'My Computer' Icon, select 'Properties'</P -></LI -><LI -><P ->Click on the 'User Profiles' tab</P -></LI -><LI -><P ->Select the profile you wish to convert (click on it once)</P -></LI -><LI -><P ->Click on the button 'Copy To'</P -></LI -><LI -><P ->In the "Permitted to use" box, click on the 'Change' button.</P -></LI -><LI -><P ->Click on the 'Look in" area that lists the machine name, when you click -here it will open up a selection box. Click on the domain to which the -profile must be accessible.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="90%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->You will need to log on if a logon box opens up. Eg: In the connect -as: MIDEARTH\root, password: mypassword.</P -></TD -></TR -></TABLE -></DIV -></LI -><LI -><P ->To make the profile capable of being used by anyone select 'Everyone'</P -></LI -><LI -><P ->Click OK. The Selection box will close.</P -></LI -><LI -><P ->Now click on the 'Ok' button to create the profile in the path you -nominated.</P -></LI -></UL -><P ->Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Under NT/2K the use of mandotory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable.</P -></TD -></TR -></TABLE -></DIV -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P -></P -><UL -><LI -><P ->This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is:</P -><P ->"Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders"</P -><P ->...and it should be set to "Enabled". -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this.</P -><P ->If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy):</P -></LI -><LI -><P ->On the XP workstation log in with an Administrator account.</P -></LI -><LI -><P ->Click: "Start", "Run"</P -></LI -><LI -><P ->Type: "mmc"</P -></LI -><LI -><P ->Click: "OK"</P -></LI -><LI -><P ->A Microsoft Management Console should appear.</P -></LI -><LI -><P ->Click: File, "Add/Remove Snap-in...", "Add"</P -></LI -><LI -><P ->Double-Click: "Group Policy"</P -></LI -><LI -><P ->Click: "Finish", "Close"</P -></LI -><LI -><P ->Click: "OK"</P -></LI -><LI -><P ->In the "Console Root" window:</P -></LI -><LI -><P ->Expand: "Local Computer Policy", "Computer Configuration",</P -></LI -><LI -><P ->"Administrative Templates", "System", "User Profiles"</P -></LI -><LI -><P ->Double-Click: "Do not check for user ownership of Roaming Profile</P -></LI -><LI -><P ->Folders"</P -></LI -><LI -><P ->Select: "Enabled"</P -></LI -><LI -><P ->Click: OK"</P -></LI -><LI -><P ->Close the whole console. You do not need to save the settings (this -refers to the console settings rather than the policies you have -changed).</P -></LI -><LI -><P ->Reboot</P -></LI -></UL -></TD -></TR -></TABLE -></DIV -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="speed.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="securing-samba.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Samba performance issues</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="optional.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Securing Samba</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/improved-browsing.html b/docs/htmldocs/improved-browsing.html deleted file mode 100644 index 209dfaaf54..0000000000 --- a/docs/htmldocs/improved-browsing.html +++ /dev/null @@ -1,1094 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Improved browsing in samba</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Advanced Configuration" -HREF="optional.html"><LINK -REL="PREVIOUS" -TITLE="Integrating MS Windows networks with Samba" -HREF="integrate-ms-networks.html"><LINK -REL="NEXT" -TITLE="Securing Samba" -HREF="securing-samba.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="integrate-ms-networks.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="securing-samba.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="IMPROVED-BROWSING" -></A ->Chapter 24. Improved browsing in samba</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->24.1. <A -HREF="improved-browsing.html#AEN3874" ->Overview of browsing</A -></DT -><DT ->24.2. <A -HREF="improved-browsing.html#AEN3880" ->Browsing support in samba</A -></DT -><DT ->24.3. <A -HREF="improved-browsing.html#AEN3895" ->Problem resolution</A -></DT -><DT ->24.4. <A -HREF="improved-browsing.html#AEN3907" ->Browsing across subnets</A -></DT -><DT ->24.5. <A -HREF="improved-browsing.html#AEN3948" ->Setting up a WINS server</A -></DT -><DT ->24.6. <A -HREF="improved-browsing.html#AEN3971" ->Setting up Browsing in a WORKGROUP</A -></DT -><DT ->24.7. <A -HREF="improved-browsing.html#AEN3997" ->Setting up Browsing in a DOMAIN</A -></DT -><DT ->24.8. <A -HREF="improved-browsing.html#BROWSE-FORCE-MASTER" ->Forcing samba to be the master</A -></DT -><DT ->24.9. <A -HREF="improved-browsing.html#AEN4032" ->Making samba the domain master</A -></DT -><DT ->24.10. <A -HREF="improved-browsing.html#AEN4054" ->Note about broadcast addresses</A -></DT -><DT ->24.11. <A -HREF="improved-browsing.html#AEN4057" ->Multiple interfaces</A -></DT -></DL -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3874" ->24.1. Overview of browsing</A -></H1 -><P ->SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called <B -CLASS="COMMAND" ->browse list</B ->. This list -contains machines that are ready to offer file and/or print services -to other machines within the network. Thus it does not include -machines which aren't currently able to do server tasks. The browse -list is heavily used by all SMB clients. Configuration of SMB -browsing has been problematic for some Samba users, hence this -document.</P -><P ->MS Windows 2000 and later, as with Samba 3 and later, can be -configured to not use NetBIOS over TCP/IP. When configured this way -it is imperative that name resolution (using DNS/LDAP/ADS) be correctly -configured and operative. Browsing will NOT work if name resolution -from SMB machine names to IP addresses does not function correctly.</P -><P ->Where NetBIOS over TCP/IP is enabled use of a WINS server is highly -recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. -WINS allows remote segment clients to obtain NetBIOS name_type information -that can NOT be provided by any other means of name resolution.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3880" ->24.2. Browsing support in samba</A -></H1 -><P ->Samba facilitates browsing. The browsing is supported by <SPAN -CLASS="APPLICATION" ->nmbd</SPAN -> -and is also controlled by options in the <TT -CLASS="FILENAME" ->smb.conf</TT -> file. -Samba can act as a local browse master for a workgroup and the ability -for samba to support domain logons and scripts is now available.</P -><P ->Samba can also act as a domain master browser for a workgroup. This -means that it will collate lists from local browse masters into a -wide area network server list. In order for browse clients to -resolve the names they may find in this list, it is recommended that -both samba and your clients use a WINS server.</P -><P ->Note that you should NOT set Samba to be the domain master for a -workgroup that has the same name as an NT Domain: on each wide area -network, you must only ever have one domain master browser per workgroup, -regardless of whether it is NT, Samba or any other type of domain master -that is providing this service.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Nmbd can be configured as a WINS server, but it is not -necessary to specifically use samba as your WINS server. MS Windows -NT4, Server or Advanced Server 2000 or 2003 can be configured as -your WINS server. In a mixed NT/2000/2003 server and samba environment on -a Wide Area Network, it is recommended that you use the Microsoft -WINS server capabilities. In a samba-only environment, it is -recommended that you use one and only one Samba server as your WINS server.</P -></TD -></TR -></TABLE -></DIV -><P ->To get browsing to work you need to run nmbd as usual, but will need -to use the <B -CLASS="COMMAND" ->workgroup</B -> option in <TT -CLASS="FILENAME" ->smb.conf</TT -> -to control what workgroup Samba becomes a part of.</P -><P ->Samba also has a useful option for a Samba server to offer itself for -browsing on another subnet. It is recommended that this option is only -used for 'unusual' purposes: announcements over the internet, for -example. See <B -CLASS="COMMAND" ->remote announce</B -> in the -<TT -CLASS="FILENAME" ->smb.conf</TT -> man page. </P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3895" ->24.3. Problem resolution</A -></H1 -><P ->If something doesn't work then hopefully the log.nmb file will help -you track down the problem. Try a debug level of 2 or 3 for finding -problems. Also note that the current browse list usually gets stored -in text form in a file called <TT -CLASS="FILENAME" ->browse.dat</TT ->.</P -><P ->Note that if it doesn't work for you, then you should still be able to -type the server name as <TT -CLASS="FILENAME" ->\\SERVER</TT -> in filemanager then -hit enter and filemanager should display the list of available shares.</P -><P ->Some people find browsing fails because they don't have the global -<B -CLASS="COMMAND" ->guest account</B -> set to a valid account. Remember that the -IPC$ connection that lists the shares is done as guest, and thus you must -have a valid guest account.</P -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->MS Windows 2000 and upwards (as with Samba) can be configured to disallow -anonymous (ie: Guest account) access to the IPC$ share. In that case, the -MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the -name of the currently logged in user to query the IPC$ share. MS Windows -9X clients are not able to do this and thus will NOT be able to browse -server resources.</I -></SPAN -></P -><P ->The other big problem people have is that their broadcast address, -netmask or IP address is wrong (specified with the "interfaces" option -in <TT -CLASS="FILENAME" ->smb.conf</TT ->)</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3907" ->24.4. Browsing across subnets</A -></H1 -><P ->Since the release of Samba 1.9.17(alpha1) Samba has been -updated to enable it to support the replication of browse lists -across subnet boundaries. New code and options have been added to -achieve this. This section describes how to set this feature up -in different settings.</P -><P ->To see browse lists that span TCP/IP subnets (ie. networks separated -by routers that don't pass broadcast traffic) you must set up at least -one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing -NetBIOS name to IP address translation to be done by doing a direct -query of the WINS server. This is done via a directed UDP packet on -port 137 to the WINS server machine. The reason for a WINS server is -that by default, all NetBIOS name to IP address translation is done -by broadcasts from the querying machine. This means that machines -on one subnet will not be able to resolve the names of machines on -another subnet without using a WINS server.</P -><P ->Remember, for browsing across subnets to work correctly, all machines, -be they Windows 95, Windows NT, or Samba servers must have the IP address -of a WINS server given to them by a DHCP server, or by manual configuration -(for Win95 and WinNT, this is in the TCP/IP Properties, under Network -settings) for Samba this is in the <TT -CLASS="FILENAME" ->smb.conf</TT -> file.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3913" ->24.4.1. How does cross subnet browsing work ?</A -></H2 -><P ->Cross subnet browsing is a complicated dance, containing multiple -moving parts. It has taken Microsoft several years to get the code -that achieves this correct, and Samba lags behind in some areas. -Samba is capable of cross subnet browsing when configured correctly.</P -><P ->Consider a network set up as follows :</P -><P -><PRE -CLASS="PROGRAMLISTING" -> (DMB) - N1_A N1_B N1_C N1_D N1_E - | | | | | - ------------------------------------------------------- - | subnet 1 | - +---+ +---+ - |R1 | Router 1 Router 2 |R2 | - +---+ +---+ - | | - | subnet 2 subnet 3 | - -------------------------- ------------------------------------ - | | | | | | | | - N2_A N2_B N2_C N2_D N3_A N3_B N3_C N3_D - (WINS)</PRE -></P -><P ->Consisting of 3 subnets (1, 2, 3) connected by two routers -(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines -on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume -for the moment that all these machines are configured to be in the -same workgroup (for simplicities sake). Machine N1_C on subnet 1 -is configured as Domain Master Browser (ie. it will collate the -browse lists for the workgroup). Machine N2_D is configured as -WINS server and all the other machines are configured to register -their NetBIOS names with it.</P -><P ->As all these machines are booted up, elections for master browsers -will take place on each of the three subnets. Assume that machine -N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on -subnet 3 - these machines are known as local master browsers for -their particular subnet. N1_C has an advantage in winning as the -local master browser on subnet 1 as it is set up as Domain Master -Browser.</P -><P ->On each of the three networks, machines that are configured to -offer sharing services will broadcast that they are offering -these services. The local master browser on each subnet will -receive these broadcasts and keep a record of the fact that -the machine is offering a service. This list of records is -the basis of the browse list. For this case, assume that -all the machines are configured to offer services so all machines -will be on the browse list.</P -><P ->For each network, the local master browser on that network is -considered 'authoritative' for all the names it receives via -local broadcast. This is because a machine seen by the local -master browser via a local broadcast must be on the same -network as the local master browser and thus is a 'trusted' -and 'verifiable' resource. Machines on other networks that -the local master browsers learn about when collating their -browse lists have not been directly seen - these records are -called 'non-authoritative'.</P -><P ->At this point the browse lists look as follows (these are -the machines you would see in your network neighborhood if -you looked in it on a particular network right now).</P -><P -><PRE -CLASS="PROGRAMLISTING" ->Subnet Browse Master List ------- ------------- ---- -Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E - -Subnet2 N2_B N2_A, N2_B, N2_C, N2_D - -Subnet3 N3_D N3_A, N3_B, N3_C, N3_D</PRE -></P -><P ->Note that at this point all the subnets are separate, no -machine is seen across any of the subnets.</P -><P ->Now examine subnet 2. As soon as N2_B has become the local -master browser it looks for a Domain master browser to synchronize -its browse list with. It does this by querying the WINS server -(N2_D) for the IP address associated with the NetBIOS name -WORKGROUP>1B<. This name was registerd by the Domain master -browser (N1_C) with the WINS server as soon as it was booted.</P -><P ->Once N2_B knows the address of the Domain master browser it -tells it that is the local master browser for subnet 2 by -sending a MasterAnnouncement packet as a UDP port 138 packet. -It then synchronizes with it by doing a NetServerEnum2 call. This -tells the Domain Master Browser to send it all the server -names it knows about. Once the domain master browser receives -the MasterAnnouncement packet it schedules a synchronization -request to the sender of that packet. After both synchronizations -are done the browse lists look like :</P -><P -><PRE -CLASS="PROGRAMLISTING" ->Subnet Browse Master List ------- ------------- ---- -Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, - N2_A(*), N2_B(*), N2_C(*), N2_D(*) - -Subnet2 N2_B N2_A, N2_B, N2_C, N2_D - N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) - -Subnet3 N3_D N3_A, N3_B, N3_C, N3_D - -Servers with a (*) after them are non-authoritative names.</PRE -></P -><P ->At this point users looking in their network neighborhood on -subnets 1 or 2 will see all the servers on both, users on -subnet 3 will still only see the servers on their own subnet.</P -><P ->The same sequence of events that occured for N2_B now occurs -for the local master browser on subnet 3 (N3_D). When it -synchronizes browse lists with the domain master browser (N1_A) -it gets both the server entries on subnet 1, and those on -subnet 2. After N3_D has synchronized with N1_C and vica-versa -the browse lists look like.</P -><P -><PRE -CLASS="PROGRAMLISTING" ->Subnet Browse Master List ------- ------------- ---- -Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, - N2_A(*), N2_B(*), N2_C(*), N2_D(*), - N3_A(*), N3_B(*), N3_C(*), N3_D(*) - -Subnet2 N2_B N2_A, N2_B, N2_C, N2_D - N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) - -Subnet3 N3_D N3_A, N3_B, N3_C, N3_D - N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), - N2_A(*), N2_B(*), N2_C(*), N2_D(*) - -Servers with a (*) after them are non-authoritative names.</PRE -></P -><P ->At this point users looking in their network neighborhood on -subnets 1 or 3 will see all the servers on all sunbets, users on -subnet 2 will still only see the servers on subnets 1 and 2, but not 3.</P -><P ->Finally, the local master browser for subnet 2 (N2_B) will sync again -with the domain master browser (N1_C) and will recieve the missing -server entries. Finally - and as a steady state (if no machines -are removed or shut off) the browse lists will look like :</P -><P -><PRE -CLASS="PROGRAMLISTING" ->Subnet Browse Master List ------- ------------- ---- -Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, - N2_A(*), N2_B(*), N2_C(*), N2_D(*), - N3_A(*), N3_B(*), N3_C(*), N3_D(*) - -Subnet2 N2_B N2_A, N2_B, N2_C, N2_D - N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) - N3_A(*), N3_B(*), N3_C(*), N3_D(*) - -Subnet3 N3_D N3_A, N3_B, N3_C, N3_D - N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), - N2_A(*), N2_B(*), N2_C(*), N2_D(*) - -Servers with a (*) after them are non-authoritative names.</PRE -></P -><P ->Synchronizations between the domain master browser and local -master browsers will continue to occur, but this should be a -steady state situation.</P -><P ->If either router R1 or R2 fails the following will occur:</P -><P -></P -><OL -TYPE="1" -><LI -><P -> Names of computers on each side of the inaccessible network fragments - will be maintained for as long as 36 minutes, in the network neighbourhood - lists. - </P -></LI -><LI -><P -> Attempts to connect to these inaccessible computers will fail, but the - names will not be removed from the network neighbourhood lists. - </P -></LI -><LI -><P -> If one of the fragments is cut off from the WINS server, it will only - be able to access servers on its local subnet, by using subnet-isolated - broadcast NetBIOS name resolution. The effects are similar to that of - losing access to a DNS server. - </P -></LI -></OL -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3948" ->24.5. Setting up a WINS server</A -></H1 -><P ->Either a Samba machine or a Windows NT Server machine may be set up -as a WINS server. To set a Samba machine to be a WINS server you must -add the following option to the <TT -CLASS="FILENAME" ->smb.conf</TT -> file on the selected machine : -in the [globals] section add the line </P -><P -><B -CLASS="COMMAND" -> wins support = yes</B -></P -><P ->Versions of Samba prior to 1.9.17 had this parameter default to -yes. If you have any older versions of Samba on your network it is -strongly suggested you upgrade to a recent version, or at the very -least set the parameter to 'no' on all these machines.</P -><P ->Machines with <B -CLASS="COMMAND" ->wins support = yes</B -> will keep a list of -all NetBIOS names registered with them, acting as a DNS for NetBIOS names.</P -><P ->You should set up only ONE wins server. Do NOT set the -<B -CLASS="COMMAND" ->wins support = yes</B -> option on more than one Samba -server.</P -><P ->To set up a Windows NT Server as a WINS server you need to set up -the WINS service - see your NT documentation for details. Note that -Windows NT WINS Servers can replicate to each other, allowing more -than one to be set up in a complex subnet environment. As Microsoft -refuse to document these replication protocols Samba cannot currently -participate in these replications. It is possible in the future that -a Samba->Samba WINS replication protocol may be defined, in which -case more than one Samba machine could be set up as a WINS server -but currently only one Samba server should have the -<B -CLASS="COMMAND" ->wins support = yes</B -> parameter set.</P -><P ->After the WINS server has been configured you must ensure that all -machines participating on the network are configured with the address -of this WINS server. If your WINS server is a Samba machine, fill in -the Samba machine IP address in the "Primary WINS Server" field of -the "Control Panel->Network->Protocols->TCP->WINS Server" dialogs -in Windows 95 or Windows NT. To tell a Samba server the IP address -of the WINS server add the following line to the [global] section of -all <TT -CLASS="FILENAME" ->smb.conf</TT -> files :</P -><P -><B -CLASS="COMMAND" ->wins server = >name or IP address<</B -></P -><P ->where >name or IP address< is either the DNS name of the WINS server -machine or its IP address.</P -><P ->Note that this line MUST NOT BE SET in the <TT -CLASS="FILENAME" ->smb.conf</TT -> file of the Samba -server acting as the WINS server itself. If you set both the -<B -CLASS="COMMAND" ->wins support = yes</B -> option and the -<B -CLASS="COMMAND" ->wins server = <name></B -> option then -nmbd will fail to start.</P -><P ->There are two possible scenarios for setting up cross subnet browsing. -The first details setting up cross subnet browsing on a network containing -Windows 95, Samba and Windows NT machines that are not configured as -part of a Windows NT Domain. The second details setting up cross subnet -browsing on networks that contain NT Domains.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3971" ->24.6. Setting up Browsing in a WORKGROUP</A -></H1 -><P ->To set up cross subnet browsing on a network containing machines -in up to be in a WORKGROUP, not an NT Domain you need to set up one -Samba server to be the Domain Master Browser (note that this is *NOT* -the same as a Primary Domain Controller, although in an NT Domain the -same machine plays both roles). The role of a Domain master browser is -to collate the browse lists from local master browsers on all the -subnets that have a machine participating in the workgroup. Without -one machine configured as a domain master browser each subnet would -be an isolated workgroup, unable to see any machines on any other -subnet. It is the presense of a domain master browser that makes -cross subnet browsing possible for a workgroup.</P -><P ->In an WORKGROUP environment the domain master browser must be a -Samba server, and there must only be one domain master browser per -workgroup name. To set up a Samba server as a domain master browser, -set the following option in the [global] section of the <TT -CLASS="FILENAME" ->smb.conf</TT -> file :</P -><P -><B -CLASS="COMMAND" ->domain master = yes</B -></P -><P ->The domain master browser should also preferrably be the local master -browser for its own subnet. In order to achieve this set the following -options in the [global] section of the <TT -CLASS="FILENAME" ->smb.conf</TT -> file :</P -><P -><PRE -CLASS="PROGRAMLISTING" ->domain master = yes -local master = yes -preferred master = yes -os level = 65</PRE -></P -><P ->The domain master browser may be the same machine as the WINS -server, if you require.</P -><P ->Next, you should ensure that each of the subnets contains a -machine that can act as a local master browser for the -workgroup. Any MS Windows NT/2K/XP/2003 machine should be -able to do this, as will Windows 9x machines (although these -tend to get rebooted more often, so it's not such a good idea -to use these). To make a Samba server a local master browser -set the following options in the [global] section of the -<TT -CLASS="FILENAME" ->smb.conf</TT -> file :</P -><P -><PRE -CLASS="PROGRAMLISTING" ->domain master = no -local master = yes -preferred master = yes -os level = 65</PRE -></P -><P ->Do not do this for more than one Samba server on each subnet, -or they will war with each other over which is to be the local -master browser.</P -><P ->The <B -CLASS="COMMAND" ->local master</B -> parameter allows Samba to act as a -local master browser. The <B -CLASS="COMMAND" ->preferred master</B -> causes nmbd -to force a browser election on startup and the <B -CLASS="COMMAND" ->os level</B -> -parameter sets Samba high enough so that it should win any browser elections.</P -><P ->If you have an NT machine on the subnet that you wish to -be the local master browser then you can disable Samba from -becoming a local master browser by setting the following -options in the <B -CLASS="COMMAND" ->[global]</B -> section of the -<TT -CLASS="FILENAME" ->smb.conf</TT -> file :</P -><P -><PRE -CLASS="PROGRAMLISTING" ->domain master = no -local master = no -preferred master = no -os level = 0</PRE -></P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3997" ->24.7. Setting up Browsing in a DOMAIN</A -></H1 -><P ->If you are adding Samba servers to a Windows NT Domain then -you must not set up a Samba server as a domain master browser. -By default, a Windows NT Primary Domain Controller for a Domain -name is also the Domain master browser for that name, and many -things will break if a Samba server registers the Domain master -browser NetBIOS name (<VAR -CLASS="REPLACEABLE" ->DOMAIN</VAR -><1B>) -with WINS instead of the PDC.</P -><P ->For subnets other than the one containing the Windows NT PDC -you may set up Samba servers as local master browsers as -described. To make a Samba server a local master browser set -the following options in the <B -CLASS="COMMAND" ->[global]</B -> section -of the <TT -CLASS="FILENAME" ->smb.conf</TT -> file :</P -><P -><PRE -CLASS="PROGRAMLISTING" ->domain master = no -local master = yes -preferred master = yes -os level = 65</PRE -></P -><P ->If you wish to have a Samba server fight the election with machines -on the same subnet you may set the <B -CLASS="COMMAND" ->os level</B -> parameter -to lower levels. By doing this you can tune the order of machines that -will become local master browsers if they are running. For -more details on this see the section <A -HREF="improved-browsing.html#BROWSE-FORCE-MASTER" ->Forcing samba to be the master browser</A -> -below.</P -><P ->If you have Windows NT machines that are members of the domain -on all subnets, and you are sure they will always be running then -you can disable Samba from taking part in browser elections and -ever becoming a local master browser by setting following options -in the <B -CLASS="COMMAND" ->[global]</B -> section of the <TT -CLASS="FILENAME" ->smb.conf</TT -> -file :</P -><P -><B -CLASS="COMMAND" -> domain master = no - local master = no - preferred master = no - os level = 0</B -></P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="BROWSE-FORCE-MASTER" ->24.8. Forcing samba to be the master</A -></H1 -><P ->Who becomes the <B -CLASS="COMMAND" ->master browser</B -> is determined by an election -process using broadcasts. Each election packet contains a number of parameters -which determine what precedence (bias) a host should have in the -election. By default Samba uses a very low precedence and thus loses -elections to just about anyone else.</P -><P ->If you want Samba to win elections then just set the <B -CLASS="COMMAND" ->os level</B -> global -option in <TT -CLASS="FILENAME" ->smb.conf</TT -> to a higher number. It defaults to 0. Using 34 -would make it win all elections over every other system (except other -samba systems!)</P -><P ->A <B -CLASS="COMMAND" ->os level</B -> of 2 would make it beat WfWg and Win95, but not MS Windows -NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.</P -><P ->The maximum os level is 255</P -><P ->If you want samba to force an election on startup, then set the -<B -CLASS="COMMAND" ->preferred master</B -> global option in <TT -CLASS="FILENAME" ->smb.conf</TT -> to "yes". Samba will -then have a slight advantage over other potential master browsers -that are not preferred master browsers. Use this parameter with -care, as if you have two hosts (whether they are windows 95 or NT or -samba) on the same local subnet both set with <B -CLASS="COMMAND" ->preferred master</B -> to -"yes", then periodically and continually they will force an election -in order to become the local master browser.</P -><P ->If you want samba to be a <B -CLASS="COMMAND" ->domain master browser</B ->, then it is -recommended that you also set <B -CLASS="COMMAND" ->preferred master</B -> to "yes", because -samba will not become a domain master browser for the whole of your -LAN or WAN if it is not also a local master browser on its own -broadcast isolated subnet.</P -><P ->It is possible to configure two samba servers to attempt to become -the domain master browser for a domain. The first server that comes -up will be the domain master browser. All other samba servers will -attempt to become the domain master browser every 5 minutes. They -will find that another samba server is already the domain master -browser and will fail. This provides automatic redundancy, should -the current domain master browser fail.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4032" ->24.9. Making samba the domain master</A -></H1 -><P ->The domain master is responsible for collating the browse lists of -multiple subnets so that browsing can occur between subnets. You can -make samba act as the domain master by setting <B -CLASS="COMMAND" ->domain master = yes</B -> -in <TT -CLASS="FILENAME" ->smb.conf</TT ->. By default it will not be a domain master.</P -><P ->Note that you should NOT set Samba to be the domain master for a -workgroup that has the same name as an NT Domain.</P -><P ->When samba is the domain master and the master browser it will listen -for master announcements (made roughly every twelve minutes) from local -master browsers on other subnets and then contact them to synchronise -browse lists.</P -><P ->If you want samba to be the domain master then I suggest you also set -the <B -CLASS="COMMAND" ->os level</B -> high enough to make sure it wins elections, and set -<B -CLASS="COMMAND" ->preferred master</B -> to "yes", to get samba to force an election on -startup.</P -><P ->Note that all your servers (including samba) and clients should be -using a WINS server to resolve NetBIOS names. If your clients are only -using broadcasting to resolve NetBIOS names, then two things will occur:</P -><P -></P -><OL -TYPE="1" -><LI -><P -> your local master browsers will be unable to find a domain master - browser, as it will only be looking on the local subnet. - </P -></LI -><LI -><P -> if a client happens to get hold of a domain-wide browse list, and - a user attempts to access a host in that list, it will be unable to - resolve the NetBIOS name of that host. - </P -></LI -></OL -><P ->If, however, both samba and your clients are using a WINS server, then:</P -><P -></P -><OL -TYPE="1" -><LI -><P -> your local master browsers will contact the WINS server and, as long as - samba has registered that it is a domain master browser with the WINS - server, your local master browser will receive samba's ip address - as its domain master browser. - </P -></LI -><LI -><P -> when a client receives a domain-wide browse list, and a user attempts - to access a host in that list, it will contact the WINS server to - resolve the NetBIOS name of that host. as long as that host has - registered its NetBIOS name with the same WINS server, the user will - be able to see that host. - </P -></LI -></OL -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4054" ->24.10. Note about broadcast addresses</A -></H1 -><P ->If your network uses a "0" based broadcast address (for example if it -ends in a 0) then you will strike problems. Windows for Workgroups -does not seem to support a 0's broadcast and you will probably find -that browsing and name lookups won't work.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4057" ->24.11. Multiple interfaces</A -></H1 -><P ->Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the <B -CLASS="COMMAND" ->interfaces</B -> -option in <TT -CLASS="FILENAME" ->smb.conf</TT -> to configure them. </P -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="integrate-ms-networks.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="securing-samba.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Integrating MS Windows networks with Samba</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="optional.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Securing Samba</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/index.html b/docs/htmldocs/index.html deleted file mode 100755 index f7bc47b7c8..0000000000 --- a/docs/htmldocs/index.html +++ /dev/null @@ -1,76 +0,0 @@ -<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>SAMBA Project Documentation</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><meta name="description" content=" -This book is a collection of HOWTOs added to Samba documentation over the years. -Samba is always under development, and so is its' documentation. This release of the -documentation represents a major revision or layout as well as contents. -The most recent version of this document can be found at -http://www.samba.org/ -on the "Documentation" page. Please send updates to -Jelmer Vernooij, -John H. Terpstra or -Gerald (Jerry) Carter. - -The Samba-Team would like to express sincere thanks to the many people who have with -or without their knowledge contributed to this update. The size and scope of this -project would not have been possible without significant community contribution. A not -insignificant number of ideas for inclusion (if not content itself) has been obtained -from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. -Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and -application knowledge that is most to be desired by many Samba users and administrators. -"><link rel="home" href="index.html" title="SAMBA Project Documentation"><link rel="next" href="introduction.html" title="Part I. General Installation"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">SAMBA Project Documentation</th></tr><tr><td width="20%" align="left"> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="introduction.html">Next</a></td></tr></table><hr></div><div class="book" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="Samba-HOWTO-Collection"></a>SAMBA Project Documentation</h1></div><div><div class="authorgroup"><h4 class="editedby">Edited by</h4><h3 class="editor"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><h3 class="editor"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><h3 class="editor"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3></div></div><div><div class="legalnotice"><p> -This documentation is distributed under the GNU General Public License (GPL) -version 2. A copy of the license is included with the Samba source -distribution. A copy can be found on-line at <a href="http://www.fsf.org/licenses/gpl.txt" target="_top">http://www.fsf.org/licenses/gpl.txt</a> -</p><p><b>Attributions. </b> - </p><div class="variablelist"><dl><dt><span class="term"><a href="IntroSMB.html" title="Chapter 1. Introduction to Samba">Introduction to Samba</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>David Lechnyr <<a href="mailto:david@lechnyr.com" target="_top">david@lechnyr.com</a>></p></li></ul></div></dd><dt><span class="term"><a href="install.html" title="Chapter 2. How to Install and Test SAMBA">How to Install and Test SAMBA</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Karl Auer</p></li></ul></div></dd><dt><span class="term"><a href="FastStart.html" title="Chapter 3. Fast Start for the Impatient">Fast Start for the Impatient</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="ServerType.html" title="Chapter 4. Server Types and Security Modes">Server Types and Security Modes</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="samba-pdc.html" title="Chapter 5. Domain Control">Domain Control</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li><li><p>David Bannon <<a href="mailto:dbannon@samba.org" target="_top">dbannon@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="samba-bdc.html" title="Chapter 6. Backup Domain Control">Backup Domain Control</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Volker Lendecke <<a href="mailto:Volker.Lendecke@SerNet.DE" target="_top">Volker.Lendecke@SerNet.DE</a>></p></li></ul></div></dd><dt><span class="term"><a href="domain-member.html" title="Chapter 7. Domain Membership">Domain Membership</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Jeremy Allison <<a href="mailto:jra@samba.org" target="_top">jra@samba.org</a>></p></li><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="StandAloneServer.html" title="Chapter 8. Stand-Alone Servers">Stand-Alone Servers</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="ClientConfig.html" title="Chapter 9. MS Windows Network Configuration Guide">MS Windows Network Configuration Guide</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="NetworkBrowsing.html" title="Chapter 10. Samba / MS Windows Network Browsing Guide">Samba / MS Windows Network Browsing Guide</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="passdb.html" title="Chapter 11. Account Information Databases">Account Information Databases</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li><li><p>Jeremy Allison <<a href="mailto:jra@samba.org" target="_top">jra@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Olivier (lem) Lemaire <<a href="mailto:olem@IDEALX.org" target="_top">olem@IDEALX.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="groupmapping.html" title="Chapter 12. Mapping MS Windows and Unix Groups">Mapping MS Windows and Unix Groups</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jean François Micouleau</p></li><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="AccessControls.html" title="Chapter 13. File, Directory and Share Access Controls">File, Directory and Share Access Controls</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Jeremy Allison <<a href="mailto:jra@samba.org" target="_top">jra@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="locking.html" title="Chapter 14. File and Record Locking">File and Record Locking</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jeremy Allison <<a href="mailto:jra@samba.org" target="_top">jra@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Eric Roseme <<a href="mailto:eric.roseme@hp.com" target="_top">eric.roseme@hp.com</a>></p></li></ul></div></dd><dt><span class="term"><a href="securing-samba.html" title="Chapter 15. Securing Samba">Securing Samba</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="InterdomainTrusts.html" title="Chapter 16. Interdomain Trust Relationships">Interdomain Trust Relationships</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Rafal Szczesniak <<a href="mailto:mimir@samba.org" target="_top">mimir@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="msdfs.html" title="Chapter 17. Hosting a Microsoft Distributed File System tree on Samba">Hosting a Microsoft Distributed File System tree on Samba</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Shirish Kalele <<a href="mailto:samba@samba.org" target="_top">samba@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="printing.html" title="Chapter 18. Classical Printing Support">Classical Printing Support</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Kurt Pfeifle <<a href="mailto:kpfeifle@danka.de" target="_top">kpfeifle@danka.de</a>></p></li><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="CUPS-printing.html" title="Chapter 19. CUPS Printing Support in Samba 3.0">CUPS Printing Support in Samba 3.0</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Kurt Pfeifle <<a href="mailto:kpfeifle@danka.de" target="_top">kpfeifle@danka.de</a>></p></li><li><p>Ciprian Vizitiu <<a href="mailto:CVizitiu@gbif.org" target="_top">CVizitiu@gbif.org</a>> (drawings) </p></li></ul></div></dd><dt><span class="term"><a href="VFS.html" title="Chapter 20. Stackable VFS modules">Stackable VFS modules</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Tim Potter</p></li><li><p>Simo Sorce (original vfs_skel README) </p></li><li><p>Alexander Bokovoy (original vfs_netatalk docs) </p></li><li><p>Stefan Metzmacher (Update for multiple modules) </p></li></ul></div></dd><dt><span class="term"><a href="winbind.html" title="Chapter 21. Integrated Logon Support using Winbind">Integrated Logon Support using Winbind</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Tim Potter <<a href="mailto:tpot@linuxcare.com.au" target="_top">tpot@linuxcare.com.au</a>></p></li><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>Naag Mummaneni <<a href="mailto:getnag@rediffmail.com" target="_top">getnag@rediffmail.com</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="AdvancedNetworkManagement.html" title="Chapter 22. Advanced Network Management">Advanced Network Management</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="PolicyMgmt.html" title="Chapter 23. System and Account Policies">System and Account Policies</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="ProfileMgmt.html" title="Chapter 24. Desktop Profile Management">Desktop Profile Management</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="pam.html" title="Chapter 25. PAM based Distributed Authentication">PAM based Distributed Authentication</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Stephen Langasek <<a href="mailto:vorlon@netexpress.net" target="_top">vorlon@netexpress.net</a>></p></li></ul></div></dd><dt><span class="term"><a href="integrate-ms-networks.html" title="Chapter 26. Integrating MS Windows networks with Samba">Integrating MS Windows networks with Samba</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="unicode.html" title="Chapter 27. Unicode/Charsets">Unicode/Charsets</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>TAKAHASHI Motonobu <<a href="mailto:monyo@home.monyo.com" target="_top">monyo@home.monyo.com</a>></p></li></ul></div></dd><dt><span class="term"><a href="Backup.html" title="Chapter 28. Samba Backup Techniques">Samba Backup Techniques</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="SambaHA.html" title="Chapter 29. High Availability Options">High Availability Options</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="upgrading-to-3.0.html" title="Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0">Upgrading from Samba-2.x to Samba-3.0.0</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="NT4Migration.html" title="Chapter 31. Migration from NT4 PDC to Samba-3 PDC">Migration from NT4 PDC to Samba-3 PDC</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="SWAT.html" title="Chapter 32. SWAT - The Samba Web Administration Tool">SWAT - The Samba Web Administration Tool</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="diagnosis.html" title="Chapter 33. The Samba checklist">The Samba checklist</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="problems.html" title="Chapter 34. Analysing and solving samba problems">Analysing and solving samba problems</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>David Bannon <<a href="mailto:dbannon@samba.org" target="_top">dbannon@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="bugreport.html" title="Chapter 35. Reporting Bugs">Reporting Bugs</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p> Someone; Tridge or Karl Auer perhaps?</p></li></ul></div></dd><dt><span class="term"><a href="compiling.html" title="Chapter 36. How to compile SAMBA">How to compile SAMBA</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p> Someone; Jerry perhaps?</p></li></ul></div></dd><dt><span class="term"><a href="Portability.html" title="Chapter 37. Portability">Portability</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="Other-Clients.html" title="Chapter 38. Samba and other CIFS clients">Samba and other CIFS clients</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jim McDonough <<a href="mailto:jmcd@us.ibm.com" target="_top">jmcd@us.ibm.com</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="speed.html" title="Chapter 39. Samba Performance Tuning">Samba Performance Tuning</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Paul Cochrane <<a href="mailto:paulc@dth.scot.nhs.uk" target="_top">paulc@dth.scot.nhs.uk</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="DNSDHCP.html" title="Chapter 40. DNS and DHCP Configuration Guide">DNS and DHCP Configuration Guide</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="Further-Resources.html" title="Chapter 41. Further Resources">Further Resources</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>David Lechnyr <<a href="mailto:david@lechnyr.com" target="_top">david@lechnyr.com</a>></p></li></ul></div></dd></dl></div><p> - - </p></div></div><div><p class="pubdate">Monday April 21, 2003</p></div><div><div class="abstract"><p class="title"><b>Abstract</b></p><p> -This book is a collection of HOWTOs added to Samba documentation over the years. -Samba is always under development, and so is its' documentation. This release of the -documentation represents a major revision or layout as well as contents. -The most recent version of this document can be found at -<a href="http://www.samba.org/" target="_top">http://www.samba.org/</a> -on the "Documentation" page. Please send updates to -<a href="mailto:jelmer@samba.org" target="_top">Jelmer Vernooij</a>, -<a href="mailto:jht@samba.org" target="_top">John H. Terpstra</a> or -<a href="mailto:jerry@samba.org" target="_top">Gerald (Jerry) Carter</a>. -</p><p> -The Samba-Team would like to express sincere thanks to the many people who have with -or without their knowledge contributed to this update. The size and scope of this -project would not have been possible without significant community contribution. A not -insignificant number of ideas for inclusion (if not content itself) has been obtained -from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. -Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and -application knowledge that is most to be desired by many Samba users and administrators. -</p></div></div></div><div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt>I. <a href="introduction.html">General Installation</a></dt><dd><dl><dt>1. <a href="IntroSMB.html">Introduction to Samba</a></dt><dd><dl><dt><a href="IntroSMB.html#id2885613">Background</a></dt><dt><a href="IntroSMB.html#id2885824">Terminology</a></dt><dt><a href="IntroSMB.html#id2885978">Related Projects</a></dt><dt><a href="IntroSMB.html#id2886047">SMB Methodology</a></dt><dt><a href="IntroSMB.html#id2886135">Epilogue</a></dt><dt><a href="IntroSMB.html#id2886209">Miscellaneous</a></dt></dl></dd><dt>2. <a href="install.html">How to Install and Test SAMBA</a></dt><dd><dl><dt><a href="install.html#id2886868">Obtaining and installing samba</a></dt><dt><a href="install.html#id2886909">Configuring samba (smb.conf)</a></dt><dd><dl><dt><a href="install.html#id2886946">Example Configuration</a></dt><dt><a href="install.html#id2887096">SWAT</a></dt></dl></dd><dt><a href="install.html#id2887140">Try listing the shares available on your - server</a></dt><dt><a href="install.html#id2887191">Try connecting with the unix client</a></dt><dt><a href="install.html#id2887292">Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client</a></dt><dt><a href="install.html#id2887355">What If Things Don't Work?</a></dt><dt><a href="install.html#id2887388">Common Errors</a></dt><dd><dl><dt><a href="install.html#id2887401">Why are so many smbd processes eating memory?</a></dt><dt><a href="install.html#id2887617">I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs</a></dt></dl></dd></dl></dd><dt>3. <a href="FastStart.html">Fast Start for the Impatient</a></dt><dd><dl><dt><a href="FastStart.html#id2886744">Note</a></dt></dl></dd></dl></dd><dt>II. <a href="type.html">Server Configuration Basics</a></dt><dd><dl><dt>4. <a href="ServerType.html">Server Types and Security Modes</a></dt><dd><dl><dt><a href="ServerType.html#id2888767">Features and Benefits</a></dt><dt><a href="ServerType.html#id2888862">Server Types</a></dt><dt><a href="ServerType.html#id2888947">Samba Security Modes</a></dt><dd><dl><dt><a href="ServerType.html#id2889062">User Level Security</a></dt><dt><a href="ServerType.html#id2889195">Share Level Security</a></dt><dt><a href="ServerType.html#id2889317">Domain Security Mode (User Level Security)</a></dt><dt><a href="ServerType.html#id2889568">ADS Security Mode (User Level Security)</a></dt><dt><a href="ServerType.html#id2889655">Server Security (User Level Security)</a></dt></dl></dd><dt><a href="ServerType.html#id2889880">Seamless Windows Network Integration</a></dt><dt><a href="ServerType.html#id2890056">Common Errors</a></dt><dd><dl><dt><a href="ServerType.html#id2890084">What makes Samba a SERVER?</a></dt><dt><a href="ServerType.html#id2890117">What makes Samba a Domain Controller?</a></dt><dt><a href="ServerType.html#id2890146">What makes Samba a Domain Member?</a></dt><dt><a href="ServerType.html#id2890179">Constantly Losing Connections to Password Server</a></dt></dl></dd></dl></dd><dt>5. <a href="samba-pdc.html">Domain Control</a></dt><dd><dl><dt><a href="samba-pdc.html#id2891986">Features and Benefits</a></dt><dt><a href="samba-pdc.html#id2892290">Basics of Domain Control</a></dt><dd><dl><dt><a href="samba-pdc.html#id2892306">Domain Controller Types</a></dt><dt><a href="samba-pdc.html#id2892517">Preparing for Domain Control</a></dt></dl></dd><dt><a href="samba-pdc.html#id2892837">Domain Control - Example Configuration</a></dt><dt><a href="samba-pdc.html#id2893136">Samba ADS Domain Control</a></dt><dt><a href="samba-pdc.html#id2893157">Domain and Network Logon Configuration</a></dt><dd><dl><dt><a href="samba-pdc.html#id2893173">Domain Network Logon Service</a></dt><dt><a href="samba-pdc.html#id2893499">Security Mode and Master Browsers</a></dt></dl></dd><dt><a href="samba-pdc.html#id2893607">Common Problems and Errors</a></dt><dd><dl><dt><a href="samba-pdc.html#id2893614">I cannot include a '$' in a machine name</a></dt><dt><a href="samba-pdc.html#id2893653">I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.</a></dt><dt><a href="samba-pdc.html#id2893703">The system can not log you on (C000019B)....</a></dt><dt><a href="samba-pdc.html#id2893773">The machine trust account for this computer either does not -exist or is not accessible.</a></dt><dt><a href="samba-pdc.html#id2893836">When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.</a></dt><dt><a href="samba-pdc.html#id2893863">Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"</a></dt></dl></dd></dl></dd><dt>6. <a href="samba-bdc.html">Backup Domain Control</a></dt><dd><dl><dt><a href="samba-bdc.html#id2896028">Features And Benefits</a></dt><dt><a href="samba-bdc.html#id2896201">Essential Background Information</a></dt><dd><dl><dt><a href="samba-bdc.html#id2896230">MS Windows NT4 Style Domain Control</a></dt><dt><a href="samba-bdc.html#id2896450">Active Directory Domain Control</a></dt><dt><a href="samba-bdc.html#id2896471">What qualifies a Domain Controller on the network?</a></dt><dt><a href="samba-bdc.html#id2896497">How does a Workstation find its domain controller?</a></dt></dl></dd><dt><a href="samba-bdc.html#id2896542">Backup Domain Controller Configuration</a></dt><dd><dl><dt><a href="samba-bdc.html#id2896645">Example Configuration</a></dt></dl></dd><dt><a href="samba-bdc.html#id2896706">Common Errors</a></dt><dd><dl><dt><a href="samba-bdc.html#id2896719">Machine Accounts keep expiring, what can I do?</a></dt><dt><a href="samba-bdc.html#id2896750">Can Samba be a Backup Domain Controller to an NT4 PDC?</a></dt><dt><a href="samba-bdc.html#id2896783">How do I replicate the smbpasswd file?</a></dt><dt><a href="samba-bdc.html#id2896828">Can I do this all with LDAP?</a></dt></dl></dd></dl></dd><dt>7. <a href="domain-member.html">Domain Membership</a></dt><dd><dl><dt><a href="domain-member.html#id2897897">Features and Benefits</a></dt><dt><a href="domain-member.html#id2898012">MS Windows Workstation/Server Machine Trust Accounts</a></dt><dd><dl><dt><a href="domain-member.html#id2898188">Manual Creation of Machine Trust Accounts</a></dt><dt><a href="domain-member.html#id2898440">Using NT4 Server Manager to Add Machine Accounts to the Domain</a></dt><dt><a href="domain-member.html#id2898636">"On-the-Fly" Creation of Machine Trust Accounts</a></dt><dt><a href="domain-member.html#id2898699">Making an MS Windows Workstation or Server a Domain Member</a></dt></dl></dd><dt><a href="domain-member.html#domain-member-server">Domain Member Server</a></dt><dd><dl><dt><a href="domain-member.html#id2898901">Joining an NT4 type Domain with Samba-3</a></dt><dt><a href="domain-member.html#id2899283">Why is this better than security = server?</a></dt></dl></dd><dt><a href="domain-member.html#ads-member">Samba ADS Domain Membership</a></dt><dd><dl><dt><a href="domain-member.html#id2899424">Setup your smb.conf</a></dt><dt><a href="domain-member.html#id2899508">Setup your /etc/krb5.conf</a></dt><dt><a href="domain-member.html#ads-create-machine-account">Create the computer account</a></dt><dt><a href="domain-member.html#ads-test-server">Test your server setup</a></dt><dt><a href="domain-member.html#ads-test-smbclient">Testing with smbclient</a></dt><dt><a href="domain-member.html#id2899872">Notes</a></dt></dl></dd><dt><a href="domain-member.html#id2899892">Common Errors</a></dt><dd><dl><dt><a href="domain-member.html#id2899919">Can Not Add Machine Back to Domain</a></dt><dt><a href="domain-member.html#id2899951">Adding Machine to Domain Fails</a></dt></dl></dd></dl></dd><dt>8. <a href="StandAloneServer.html">Stand-Alone Servers</a></dt><dd><dl><dt><a href="StandAloneServer.html#id2902304">Features and Benefits</a></dt><dt><a href="StandAloneServer.html#id2902501">Background</a></dt><dt><a href="StandAloneServer.html#id2902573">Example Configuration</a></dt><dd><dl><dt><a href="StandAloneServer.html#id2902588">Reference Documentation Server</a></dt><dt><a href="StandAloneServer.html#id2902638">Central Print Serving</a></dt></dl></dd><dt><a href="StandAloneServer.html#id2902852">Common Errors</a></dt></dl></dd><dt>9. <a href="ClientConfig.html">MS Windows Network Configuration Guide</a></dt><dd><dl><dt><a href="ClientConfig.html#id2901966">Note</a></dt></dl></dd></dl></dd><dt>III. <a href="optional.html">Advanced Configuration</a></dt><dd><dl><dt>10. <a href="NetworkBrowsing.html">Samba / MS Windows Network Browsing Guide</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2903558">Features and Benefits</a></dt><dt><a href="NetworkBrowsing.html#id2903637">What is Browsing?</a></dt><dt><a href="NetworkBrowsing.html#id2903747">Discussion</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2903764">NetBIOS over TCP/IP</a></dt><dt><a href="NetworkBrowsing.html#id2903926">TCP/IP - without NetBIOS</a></dt><dt><a href="NetworkBrowsing.html#id2904058">DNS and Active Directory</a></dt></dl></dd><dt><a href="NetworkBrowsing.html#id2904194">How Browsing Functions</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2904320">Setting up WORKGROUP Browsing</a></dt><dt><a href="NetworkBrowsing.html#id2904541">Setting up DOMAIN Browsing</a></dt><dt><a href="NetworkBrowsing.html#browse-force-master">Forcing Samba to be the master</a></dt><dt><a href="NetworkBrowsing.html#id2904811">Making Samba the domain master</a></dt><dt><a href="NetworkBrowsing.html#id2904967">Note about broadcast addresses</a></dt><dt><a href="NetworkBrowsing.html#id2904984">Multiple interfaces</a></dt><dt><a href="NetworkBrowsing.html#id2905013">Use of the Remote Announce parameter</a></dt><dt><a href="NetworkBrowsing.html#id2905122">Use of the Remote Browse Sync parameter</a></dt></dl></dd><dt><a href="NetworkBrowsing.html#id2905183">WINS - The Windows Internetworking Name Server</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2905341">Setting up a WINS server</a></dt><dt><a href="NetworkBrowsing.html#id2905540">WINS Replication</a></dt><dt><a href="NetworkBrowsing.html#id2905565">Static WINS Entries</a></dt></dl></dd><dt><a href="NetworkBrowsing.html#id2905650">Helpful Hints</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2905663">Windows Networking Protocols</a></dt><dt><a href="NetworkBrowsing.html#id2905730">Name Resolution Order</a></dt></dl></dd><dt><a href="NetworkBrowsing.html#id2905867">Technical Overview of browsing</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2905914">Browsing support in Samba</a></dt><dt><a href="NetworkBrowsing.html#id2906021">Problem resolution</a></dt><dt><a href="NetworkBrowsing.html#id2906100">Browsing across subnets</a></dt></dl></dd><dt><a href="NetworkBrowsing.html#id2906720">Common Errors</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2906735">How can one flush the Samba NetBIOS name cache without restarting Samba?</a></dt><dt><a href="NetworkBrowsing.html#id2906764">My client reports "This server is not configured to list shared resources"</a></dt></dl></dd></dl></dd><dt>11. <a href="passdb.html">Account Information Databases</a></dt><dd><dl><dt><a href="passdb.html#id2910308">Features and Benefits</a></dt><dt><a href="passdb.html#id2910636">Technical Information</a></dt><dd><dl><dt><a href="passdb.html#id2910700">Important Notes About Security</a></dt><dt><a href="passdb.html#id2910954">Mapping User Identifiers between MS Windows and Unix</a></dt></dl></dd><dt><a href="passdb.html#id2911009">Account Management Tools</a></dt><dd><dl><dt><a href="passdb.html#id2911041">The smbpasswd Command</a></dt><dt><a href="passdb.html#id2911306">The pdbedit Command</a></dt></dl></dd><dt><a href="passdb.html#id2911458">Password Backends</a></dt><dd><dl><dt><a href="passdb.html#id2911494">Plain Text</a></dt><dt><a href="passdb.html#id2911534">smbpasswd - Encrypted Password Database</a></dt><dt><a href="passdb.html#id2911641">tdbsam</a></dt><dt><a href="passdb.html#id2911668">ldapsam</a></dt><dt><a href="passdb.html#id2913185">MySQL</a></dt><dt><a href="passdb.html#XMLpassdb">XML</a></dt></dl></dd><dt><a href="passdb.html#id2913989">Common Errors</a></dt><dd><dl><dt><a href="passdb.html#id2913997">Users can not logon - Users not in Samba SAM</a></dt><dt><a href="passdb.html#id2914012">Users are being added to the wrong backend database</a></dt><dt><a href="passdb.html#id2914072">auth methods does not work</a></dt></dl></dd></dl></dd><dt>12. <a href="groupmapping.html">Mapping MS Windows and Unix Groups</a></dt><dd><dl><dt><a href="groupmapping.html#id2921449">Features and Benefits</a></dt><dt><a href="groupmapping.html#id2921551">Discussion</a></dt><dd><dl><dt><a href="groupmapping.html#id2921742">Example Configuration</a></dt></dl></dd><dt><a href="groupmapping.html#id2921806">Configuration Scripts</a></dt><dd><dl><dt><a href="groupmapping.html#id2921820">Sample smb.conf add group script</a></dt><dt><a href="groupmapping.html#id2921889">Script to configure Group Mapping</a></dt></dl></dd><dt><a href="groupmapping.html#id2921981">Common Errors</a></dt><dd><dl><dt><a href="groupmapping.html#id2921997">Adding Groups Fails</a></dt><dt><a href="groupmapping.html#id2922057">Adding MS Windows Groups to MS Windows Groups Fails</a></dt></dl></dd></dl></dd><dt>13. <a href="AccessControls.html">File, Directory and Share Access Controls</a></dt><dd><dl><dt><a href="AccessControls.html#id2920271">Features and Benefits</a></dt><dt><a href="AccessControls.html#id2920308">File System Access Controls</a></dt><dd><dl><dt><a href="AccessControls.html#id2920326">MS Windows NTFS Comparison with Unix File Systems</a></dt><dt><a href="AccessControls.html#id2920583">Managing Directories</a></dt><dt><a href="AccessControls.html#id2920678">File and Directory Access Control</a></dt></dl></dd><dt><a href="AccessControls.html#id2920894">Share Definition Access Controls</a></dt><dd><dl><dt><a href="AccessControls.html#id2922074">User and Group Based Controls</a></dt><dt><a href="AccessControls.html#id2922346">File and Directory Permissions Based Controls</a></dt><dt><a href="AccessControls.html#id2922591">Miscellaneous Controls</a></dt></dl></dd><dt><a href="AccessControls.html#id2922807">Access Controls on Shares</a></dt><dd><dl><dt><a href="AccessControls.html#id2922879">Share Permissions Management</a></dt></dl></dd><dt><a href="AccessControls.html#id2923178">MS Windows Access Control Lists and Unix Interoperability</a></dt><dd><dl><dt><a href="AccessControls.html#id2923186">Managing UNIX permissions Using NT Security Dialogs</a></dt><dt><a href="AccessControls.html#id2923224">Viewing File Security on a Samba Share</a></dt><dt><a href="AccessControls.html#id2923303">Viewing file ownership</a></dt><dt><a href="AccessControls.html#id2923425">Viewing File or Directory Permissions</a></dt><dt><a href="AccessControls.html#id2923653">Modifying file or directory permissions</a></dt><dt><a href="AccessControls.html#id2923805">Interaction with the standard Samba create mask - parameters</a></dt><dt><a href="AccessControls.html#id2924134">Interaction with the standard Samba file attribute - mapping</a></dt></dl></dd><dt><a href="AccessControls.html#id2924210">Common Errors</a></dt><dd><dl><dt><a href="AccessControls.html#id2924224">Users can not write to a public share</a></dt><dt><a href="AccessControls.html#id2924604">I have set force user and Samba still makes root the owner of all the files - I touch!</a></dt></dl></dd></dl></dd><dt>14. <a href="locking.html">File and Record Locking</a></dt><dd><dl><dt><a href="locking.html#id2928216">Features and Benefits</a></dt><dt><a href="locking.html#id2928272">Discussion</a></dt><dd><dl><dt><a href="locking.html#id2928403">Opportunistic Locking Overview</a></dt></dl></dd><dt><a href="locking.html#id2929049">Samba Opportunistic Locking Control</a></dt><dd><dl><dt><a href="locking.html#id2929159">Example Configuration</a></dt></dl></dd><dt><a href="locking.html#id2929419">MS Windows Opportunistic Locking and Caching Controls</a></dt><dd><dl><dt><a href="locking.html#id2929649">Workstation Service Entries</a></dt><dt><a href="locking.html#id2929676">Server Service Entries</a></dt></dl></dd><dt><a href="locking.html#id2929755">Persistent Data Corruption</a></dt><dt><a href="locking.html#id2929785">Common Errors</a></dt><dd><dl><dt><a href="locking.html#id2929859">locking.tdb error messages</a></dt></dl></dd><dt><a href="locking.html#id2929890">Additional Reading</a></dt></dl></dd><dt>15. <a href="securing-samba.html">Securing Samba</a></dt><dd><dl><dt><a href="securing-samba.html#id2931943">Introduction</a></dt><dt><a href="securing-samba.html#id2931976">Features and Benefits</a></dt><dt><a href="securing-samba.html#id2932050">Technical Discussion of Protective Measures and Issues</a></dt><dd><dl><dt><a href="securing-samba.html#id2932069">Using host based protection</a></dt><dt><a href="securing-samba.html#id2932140">User based protection</a></dt><dt><a href="securing-samba.html#id2932191">Using interface protection</a></dt><dt><a href="securing-samba.html#id2932244">Using a firewall</a></dt><dt><a href="securing-samba.html#id2932300">Using a IPC$ share deny</a></dt><dt><a href="securing-samba.html#id2932362">NTLMv2 Security</a></dt></dl></dd><dt><a href="securing-samba.html#id2932402">Upgrading Samba</a></dt><dt><a href="securing-samba.html#id2932426">Common Errors</a></dt><dd><dl><dt><a href="securing-samba.html#id2932444">Smbclient works on localhost, but the network is dead</a></dt><dt><a href="securing-samba.html#id2932469">Why can users access home directories of other users?</a></dt></dl></dd></dl></dd><dt>16. <a href="InterdomainTrusts.html">Interdomain Trust Relationships</a></dt><dd><dl><dt><a href="InterdomainTrusts.html#id2933376">Features and Benefits</a></dt><dt><a href="InterdomainTrusts.html#id2933404">Trust Relationship Background</a></dt><dt><a href="InterdomainTrusts.html#id2933488">Native MS Windows NT4 Trusts Configuration</a></dt><dd><dl><dt><a href="InterdomainTrusts.html#id2933501">NT4 as the Trusting Domain (ie. creating the trusted account)</a></dt><dt><a href="InterdomainTrusts.html#id2933586">NT4 as the Trusted Domain (ie. creating trusted account's password)</a></dt></dl></dd><dt><a href="InterdomainTrusts.html#id2933622">Configuring Samba NT-style Domain Trusts</a></dt><dd><dl><dt><a href="InterdomainTrusts.html#id2933649">Samba-3 as the Trusting Domain</a></dt><dt><a href="InterdomainTrusts.html#id2933790">Samba-3 as the Trusted Domain</a></dt></dl></dd><dt><a href="InterdomainTrusts.html#id2933922">Common Errors</a></dt><dd><dl><dt><a href="InterdomainTrusts.html#id2933937">Tell me about Trust Relationships using Samba</a></dt></dl></dd></dl></dd><dt>17. <a href="msdfs.html">Hosting a Microsoft Distributed File System tree on Samba</a></dt><dd><dl><dt><a href="msdfs.html#id2933279">Features and Benefits</a></dt><dt><a href="msdfs.html#id2934931">Common Errors</a></dt></dl></dd><dt>18. <a href="printing.html">Classical Printing Support</a></dt><dd><dl><dt><a href="printing.html#id2934522">Features and Benefits</a></dt><dt><a href="printing.html#id2934590">Technical Introduction</a></dt><dd><dl><dt><a href="printing.html#id2934627">What happens if you send a Job from a Client</a></dt><dt><a href="printing.html#id2934698">Printing Related Configuration Parameters</a></dt><dt><a href="printing.html#id2935615">Parameters Recommended for Use</a></dt><dt><a href="printing.html#id2935946">Parameters for Backwards Compatibility</a></dt><dt><a href="printing.html#id2936054">Parameters no longer in use</a></dt></dl></dd><dt><a href="printing.html#id2936147">A simple Configuration to Print with Samba-3</a></dt><dd><dl><dt><a href="printing.html#id2936216">Verification of "Settings in Use" with testparm</a></dt><dt><a href="printing.html#id2936305">A little Experiment to warn you</a></dt></dl></dd><dt><a href="printing.html#id2936612">Extended Sample Configuration to Print with Samba-3</a></dt><dt><a href="printing.html#id2936715">Detailed Explanation of the Example's Settings</a></dt><dd><dl><dt><a href="printing.html#id2936728">The [global] Section</a></dt><dt><a href="printing.html#id2937111">The [printers] Section</a></dt><dt><a href="printing.html#id2937440">Any [my_printer_name] Section</a></dt><dt><a href="printing.html#id2937660">Print Commands</a></dt><dt><a href="printing.html#id2937711">Default Print Commands for various Unix Print Subsystems</a></dt><dt><a href="printing.html#id2938236">Setting up your own Print Commands</a></dt></dl></dd><dt><a href="printing.html#id2938516">Innovations in Samba Printing since 2.2</a></dt><dd><dl><dt><a href="printing.html#id2938681">Client Drivers on Samba Server for Point'n'Print</a></dt><dt><a href="printing.html#id2938833">The [printer$] Section is removed from Samba-3</a></dt><dt><a href="printing.html#id2938945">Creating the [print$] Share</a></dt><dt><a href="printing.html#id2939016">Parameters in the [print$] Section</a></dt><dt><a href="printing.html#id2939247">Subdirectory Structure in [print$]</a></dt></dl></dd><dt><a href="printing.html#id2939408">Installing Drivers into [print$]</a></dt><dd><dl><dt><a href="printing.html#id2939503">Setting Drivers for existing Printers with a Client GUI</a></dt><dt><a href="printing.html#id2939686">Setting Drivers for existing Printers with -rpcclient</a></dt></dl></dd><dt><a href="printing.html#id2941408">"The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)</a></dt><dd><dl><dt><a href="printing.html#id2941428">The first Client Driver Installation</a></dt><dt><a href="printing.html#id2941626">IMPORTANT! Setting Device Modes on new Printers</a></dt><dt><a href="printing.html#id2941915">Further Client Driver Install Procedures</a></dt><dt><a href="printing.html#id2942010">Always make first Client Connection as root or "printer admin"</a></dt></dl></dd><dt><a href="printing.html#id2942152">Other Gotchas</a></dt><dd><dl><dt><a href="printing.html#id2942185">Setting Default Print Options for the Client Drivers</a></dt><dt><a href="printing.html#id2942622">Supporting large Numbers of Printers</a></dt><dt><a href="printing.html#id2942924">Adding new Printers with the Windows NT APW</a></dt><dt><a href="printing.html#id2943168">Weird Error Message Cannot connect under a -different Name</a></dt><dt><a href="printing.html#id2943267">Be careful when assembling Driver Files</a></dt><dt><a href="printing.html#id2943612">Samba and Printer Ports</a></dt><dt><a href="printing.html#id2943683">Avoiding the most common Misconfigurations of the Client Driver</a></dt></dl></dd><dt><a href="printing.html#id2943705">The Imprints Toolset</a></dt><dd><dl><dt><a href="printing.html#id2943751">What is Imprints?</a></dt><dt><a href="printing.html#id2943792">Creating Printer Driver Packages</a></dt><dt><a href="printing.html#id2943811">The Imprints Server</a></dt><dt><a href="printing.html#id2943835">The Installation Client</a></dt></dl></dd><dt><a href="printing.html#id2943987">Add Network Printers at Logon without User Interaction</a></dt><dt><a href="printing.html#id2944316">The addprinter command</a></dt><dt><a href="printing.html#id2944362">Migration of "Classical" printing to Samba-3</a></dt><dt><a href="printing.html#id2944531">Publishing Printer Information in Active Directory or LDAP</a></dt><dt><a href="printing.html#id2944545">Common Errors and Problems</a></dt><dd><dl><dt><a href="printing.html#id2944558">I give my root password but I don't get access</a></dt><dt><a href="printing.html#id2944591">My printjobs get spooled into the spooling directory, but then get lost</a></dt></dl></dd></dl></dd><dt>19. <a href="CUPS-printing.html">CUPS Printing Support in Samba 3.0</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2953785">Introduction</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2953792">Features and Benefits</a></dt><dt><a href="CUPS-printing.html#id2953845">Overview</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2953900">Basic Configuration of CUPS support</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2953979">Linking of smbd with libcups.so</a></dt><dt><a href="CUPS-printing.html#id2954122">Simple smb.conf Settings for CUPS</a></dt><dt><a href="CUPS-printing.html#id2954205">More complex smb.conf Settings for -CUPS</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2954322">Advanced Configuration</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2954343">Central spooling vs. "Peer-to-Peer" printing</a></dt><dt><a href="CUPS-printing.html#id2954370">CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients</a></dt><dt><a href="CUPS-printing.html#id2954406">Driver Installation Methods on Windows Clients</a></dt><dt><a href="CUPS-printing.html#id2954465">Explicitly enable "raw" printing for -application/octet-stream!</a></dt><dt><a href="CUPS-printing.html#id2954626">Three familiar Methods for driver upload plus a new one</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2954719">Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2954794">GDI on Windows -- PostScript on Unix</a></dt><dt><a href="CUPS-printing.html#id2954839">Windows Drivers, GDI and EMF</a></dt><dt><a href="CUPS-printing.html#id2954940">Unix Printfile Conversion and GUI Basics</a></dt><dt><a href="CUPS-printing.html#id2955028">PostScript and Ghostscript</a></dt><dt><a href="CUPS-printing.html#id2955125">Ghostscript -- the Software RIP for non-PostScript Printers</a></dt><dt><a href="CUPS-printing.html#id2955238">PostScript Printer Description (PPD) Specification</a></dt><dt><a href="CUPS-printing.html#id2955308">CUPS can use all Windows-formatted Vendor PPDs</a></dt><dt><a href="CUPS-printing.html#id2955397">CUPS also uses PPDs for non-PostScript Printers</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2955420">The CUPS Filtering Architecture</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2955560">MIME types and CUPS Filters</a></dt><dt><a href="CUPS-printing.html#id2955747">MIME type Conversion Rules</a></dt><dt><a href="CUPS-printing.html#id2955864">Filter Requirements</a></dt><dt><a href="CUPS-printing.html#id2956034">Prefilters</a></dt><dt><a href="CUPS-printing.html#id2956120">pstops</a></dt><dt><a href="CUPS-printing.html#id2956222">pstoraster</a></dt><dt><a href="CUPS-printing.html#id2956377">imagetops and imagetoraster</a></dt><dt><a href="CUPS-printing.html#id2956434">rasterto [printers specific]</a></dt><dt><a href="CUPS-printing.html#id2956519">CUPS Backends</a></dt><dt><a href="CUPS-printing.html#id2956831">cupsomatic/Foomatic -- how do they fit into the Picture?</a></dt><dt><a href="CUPS-printing.html#id2956944">The Complete Picture</a></dt><dt><a href="CUPS-printing.html#id2956960">mime.convs</a></dt><dt><a href="CUPS-printing.html#id2957012">"Raw" printing</a></dt><dt><a href="CUPS-printing.html#id2957066">"application/octet-stream" printing</a></dt><dt><a href="CUPS-printing.html#id2957282">PostScript Printer Descriptions (PPDs) for non-PS Printers</a></dt><dt><a href="CUPS-printing.html#id2957510">Difference between cupsomatic/foomatic-rip and -native CUPS printing</a></dt><dt><a href="CUPS-printing.html#id2957666">Examples for filtering Chains</a></dt><dt><a href="CUPS-printing.html#id2957897">Sources of CUPS drivers / PPDs</a></dt><dt><a href="CUPS-printing.html#id2958024">Printing with Interface Scripts</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2958100">Network printing (purely Windows)</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2958116">From Windows Clients to an NT Print Server</a></dt><dt><a href="CUPS-printing.html#id2958155">Driver Execution on the Client</a></dt><dt><a href="CUPS-printing.html#id2958227">Driver Execution on the Server</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2958289">Network Printing (Windows clients -- UNIX/Samba Print -Servers)</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2958310">From Windows Clients to a CUPS/Samba Print Server</a></dt><dt><a href="CUPS-printing.html#id2958474">Samba receiving Jobfiles and passing them to CUPS</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2958550">Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2958605">PPDs for non-PS Printers on UNIX</a></dt><dt><a href="CUPS-printing.html#id2958646">PPDs for non-PS Printers on Windows</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2958712">Windows Terminal Servers (WTS) as CUPS Clients</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2958729">Printer Drivers running in "Kernel Mode" cause many -Problems</a></dt><dt><a href="CUPS-printing.html#id2958763">Workarounds impose Heavy Limitations</a></dt><dt><a href="CUPS-printing.html#id2958784">CUPS: a "Magical Stone"?</a></dt><dt><a href="CUPS-printing.html#id2958811">PostScript Drivers with no major problems -- even in Kernel -Mode</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2958865"> Setting up CUPS for driver Download</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2958884">cupsaddsmb: the unknown Utility</a></dt><dt><a href="CUPS-printing.html#id2958976">Prepare your smb.conf for -cupsaddsmb</a></dt><dt><a href="CUPS-printing.html#id2959022">CUPS Package of "PostScript Driver for WinNT/2k/XP"</a></dt><dt><a href="CUPS-printing.html#id2959220">Recognize the different Driver Files</a></dt><dt><a href="CUPS-printing.html#id2959278">Acquiring the Adobe Driver Files</a></dt><dt><a href="CUPS-printing.html#id2959310">ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"</a></dt><dt><a href="CUPS-printing.html#id2959360">Caveats to be considered</a></dt><dt><a href="CUPS-printing.html#id2959582">What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?</a></dt><dt><a href="CUPS-printing.html#id2959764">Run "cupsaddsmb" (quiet Mode)</a></dt><dt><a href="CUPS-printing.html#id2959865">Run "cupsaddsmb" with verbose Output</a></dt><dt><a href="CUPS-printing.html#id2960092">Understanding cupsaddsmb</a></dt><dt><a href="CUPS-printing.html#id2960186">How to recognize if cupsaddsm completed successfully</a></dt><dt><a href="CUPS-printing.html#id2960273">cupsaddsmb with a Samba PDC</a></dt><dt><a href="CUPS-printing.html#id2960308">cupsaddsmb Flowchart</a></dt><dt><a href="CUPS-printing.html#id2960361">Installing the PostScript Driver on a Client</a></dt><dt><a href="CUPS-printing.html#id2960474">Avoiding critical PostScript Driver Settings on the -Client</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2960608">Installing PostScript Driver Files manually (using -rpcclient)</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2960723">A Check of the rpcclient man Page</a></dt><dt><a href="CUPS-printing.html#id2960836">Understanding the rpcclient man Page</a></dt><dt><a href="CUPS-printing.html#id2960925">Producing an Example by querying a Windows Box</a></dt><dt><a href="CUPS-printing.html#id2961015">What is required for adddriver and setdriver to succeed</a></dt><dt><a href="CUPS-printing.html#id2961177">Manual Commandline Driver Installation in 15 little Steps</a></dt><dt><a href="CUPS-printing.html#id2961830">Troubleshooting revisited</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2961930">The printing *.tdb Files</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2962033">Trivial DataBase Files</a></dt><dt><a href="CUPS-printing.html#id2962103">Binary Format</a></dt><dt><a href="CUPS-printing.html#id2962165">Losing *.tdb Files</a></dt><dt><a href="CUPS-printing.html#id2962224">Using tdbbackup</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2962290">CUPS Print Drivers from Linuxprinting.org</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2962398">foomatic-rip and Foomatic explained</a></dt><dt><a href="CUPS-printing.html#id2963027">foomatic-rip and Foomatic-PPD Download and Installation</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2963488">Page Accounting with CUPS</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2963519">Setting up Quotas</a></dt><dt><a href="CUPS-printing.html#id2963551">Correct and incorrect Accounting</a></dt><dt><a href="CUPS-printing.html#id2963592">Adobe and CUPS PostScript Drivers for Windows Clients</a></dt><dt><a href="CUPS-printing.html#id2963663">The page_log File Syntax</a></dt><dt><a href="CUPS-printing.html#id2963765">Possible Shortcomings</a></dt><dt><a href="CUPS-printing.html#id2963836">Future Developments</a></dt><dt><a href="CUPS-printing.html#id2963884">Other Accounting Tools</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2963899">Additional Material</a></dt><dt><a href="CUPS-printing.html#id2964092">Auto-Deletion or Preservation of CUPS Spool Files</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2964138">CUPS Configuration Settings explained</a></dt><dt><a href="CUPS-printing.html#id2964221">Pre-conditions</a></dt><dt><a href="CUPS-printing.html#id2964281">Manual Configuration</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2964299">When not to use Samba to print to -CUPS</a></dt><dt><a href="CUPS-printing.html#id2964316">In Case of Trouble.....</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2964352">Where to find Documentation</a></dt><dt><a href="CUPS-printing.html#id2964364">How to ask for Help</a></dt><dt><a href="CUPS-printing.html#id2964377">Where to find Help</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2964391">Appendix</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2964398">Printing from CUPS to Windows attached -Printers</a></dt><dt><a href="CUPS-printing.html#id2964612">More CUPS filtering Chains</a></dt><dt><a href="CUPS-printing.html#id2964919">Trouble Shooting Guidelines to fix typical Samba printing -Problems</a></dt><dt><a href="CUPS-printing.html#id2966041">An Overview of the CUPS Printing Processes</a></dt></dl></dd></dl></dd><dt>20. <a href="VFS.html">Stackable VFS modules</a></dt><dd><dl><dt><a href="VFS.html#id2978211">Features and Benefits</a></dt><dt><a href="VFS.html#id2978229">Discussion</a></dt><dt><a href="VFS.html#id2978320">Included modules</a></dt><dd><dl><dt><a href="VFS.html#id2978327">audit</a></dt><dt><a href="VFS.html#id2978365">extd_audit</a></dt><dt><a href="VFS.html#id2978489">fake_perms</a></dt><dt><a href="VFS.html#id2978508">recycle</a></dt><dt><a href="VFS.html#id2978645">netatalk</a></dt></dl></dd><dt><a href="VFS.html#id2978690">VFS modules available elsewhere</a></dt><dd><dl><dt><a href="VFS.html#id2978712">DatabaseFS</a></dt><dt><a href="VFS.html#id2978768">vscan</a></dt></dl></dd><dt><a href="VFS.html#id2978797">Common Errors</a></dt></dl></dd><dt>21. <a href="winbind.html">Integrated Logon Support using Winbind</a></dt><dd><dl><dt><a href="winbind.html#id2979695">Features and Benefits</a></dt><dt><a href="winbind.html#id2979724">Introduction</a></dt><dt><a href="winbind.html#id2979795">What Winbind Provides</a></dt><dd><dl><dt><a href="winbind.html#id2979856">Target Uses</a></dt></dl></dd><dt><a href="winbind.html#id2979886">How Winbind Works</a></dt><dd><dl><dt><a href="winbind.html#id2979914">Microsoft Remote Procedure Calls</a></dt><dt><a href="winbind.html#id2979949">Microsoft Active Directory Services</a></dt><dt><a href="winbind.html#id2979971">Name Service Switch</a></dt><dt><a href="winbind.html#id2980108">Pluggable Authentication Modules</a></dt><dt><a href="winbind.html#id2980179">User and Group ID Allocation</a></dt><dt><a href="winbind.html#id2980214">Result Caching</a></dt></dl></dd><dt><a href="winbind.html#id2980242">Installation and Configuration</a></dt><dd><dl><dt><a href="winbind.html#id2980271">Introduction</a></dt><dt><a href="winbind.html#id2980346">Requirements</a></dt><dt><a href="winbind.html#id2980438">Testing Things Out</a></dt></dl></dd><dt><a href="winbind.html#id2982058">Conclusion</a></dt><dt><a href="winbind.html#id2982077">Common Errors</a></dt></dl></dd><dt>22. <a href="AdvancedNetworkManagement.html">Advanced Network Management</a></dt><dd><dl><dt><a href="AdvancedNetworkManagement.html#id2984570">Features and Benefits</a></dt><dt><a href="AdvancedNetworkManagement.html#id2984759">Remote Server Administration</a></dt><dt><a href="AdvancedNetworkManagement.html#id2984858">Remote Desktop Management</a></dt><dd><dl><dt><a href="AdvancedNetworkManagement.html#id2984876">Remote Management from NoMachines.Com</a></dt></dl></dd><dt><a href="AdvancedNetworkManagement.html#id2985087">Network Logon Script Magic</a></dt><dd><dl><dt><a href="AdvancedNetworkManagement.html#id2985283">Adding printers without user intervention</a></dt></dl></dd><dt><a href="AdvancedNetworkManagement.html#id2985316">Common Errors</a></dt></dl></dd><dt>23. <a href="PolicyMgmt.html">System and Account Policies</a></dt><dd><dl><dt><a href="PolicyMgmt.html#id2984380">Features and Benefits</a></dt><dt><a href="PolicyMgmt.html#id2984435">Creating and Managing System Policies</a></dt><dd><dl><dt><a href="PolicyMgmt.html#id2986217">Windows 9x/Me Policies</a></dt><dt><a href="PolicyMgmt.html#id2986312">Windows NT4 Style Policy Files</a></dt><dt><a href="PolicyMgmt.html#id2986445">MS Windows 200x / XP Professional Policies</a></dt></dl></dd><dt><a href="PolicyMgmt.html#id2986697">Managing Account/User Policies</a></dt><dd><dl><dt><a href="PolicyMgmt.html#id2986798">Samba Editreg Toolset</a></dt><dt><a href="PolicyMgmt.html#id2986819">Windows NT4/200x</a></dt><dt><a href="PolicyMgmt.html#id2986839">Samba PDC</a></dt></dl></dd><dt><a href="PolicyMgmt.html#id2986883">System Startup and Logon Processing Overview</a></dt><dt><a href="PolicyMgmt.html#id2987030">Common Errors</a></dt><dd><dl><dt><a href="PolicyMgmt.html#id2987044">Policy Does Not Work</a></dt></dl></dd></dl></dd><dt>24. <a href="ProfileMgmt.html">Desktop Profile Management</a></dt><dd><dl><dt><a href="ProfileMgmt.html#id2988251">Features and Benefits</a></dt><dt><a href="ProfileMgmt.html#id2988285">Roaming Profiles</a></dt><dd><dl><dt><a href="ProfileMgmt.html#id2988326">Samba Configuration for Profile Handling</a></dt><dt><a href="ProfileMgmt.html#id2988731">Windows Client Profile Configuration Information</a></dt><dt><a href="ProfileMgmt.html#id2989902">Sharing Profiles between W9x/Me and NT4/200x/XP workstations</a></dt><dt><a href="ProfileMgmt.html#id2989967">Profile Migration from Windows NT4/200x Server to Samba</a></dt></dl></dd><dt><a href="ProfileMgmt.html#id2990232">Mandatory profiles</a></dt><dt><a href="ProfileMgmt.html#id2990290">Creating/Managing Group Profiles</a></dt><dt><a href="ProfileMgmt.html#id2990336">Default Profile for Windows Users</a></dt><dd><dl><dt><a href="ProfileMgmt.html#id2990356">MS Windows 9x/Me</a></dt><dt><a href="ProfileMgmt.html#id2990504">MS Windows NT4 Workstation</a></dt><dt><a href="ProfileMgmt.html#id2991058">MS Windows 200x/XP</a></dt></dl></dd><dt><a href="ProfileMgmt.html#id2991562">Common Errors</a></dt><dd><dl><dt><a href="ProfileMgmt.html#id2991575">How does one set up roaming profiles for just one (or a few) user/s or group/s?</a></dt><dt><a href="ProfileMgmt.html#id2991638">Can NOT use Roaming Profiles</a></dt><dt><a href="ProfileMgmt.html#id2991859">Changing the default profile</a></dt></dl></dd></dl></dd><dt>25. <a href="pam.html">PAM based Distributed Authentication</a></dt><dd><dl><dt><a href="pam.html#id2995804">Features and Benefits</a></dt><dt><a href="pam.html#id2996071">Technical Discussion</a></dt><dd><dl><dt><a href="pam.html#id2996089">PAM Configuration Syntax</a></dt><dt><a href="pam.html#id2996760">Example System Configurations</a></dt><dt><a href="pam.html#id2997062">smb.conf PAM Configuration</a></dt><dt><a href="pam.html#id2997119">Remote CIFS Authentication using winbindd.so</a></dt><dt><a href="pam.html#id2997203">Password Synchronization using pam_smbpass.so</a></dt></dl></dd><dt><a href="pam.html#id2997570">Common Errors</a></dt><dd><dl><dt><a href="pam.html#id2997583">pam_winbind problem</a></dt></dl></dd></dl></dd><dt>26. <a href="integrate-ms-networks.html">Integrating MS Windows networks with Samba</a></dt><dd><dl><dt><a href="integrate-ms-networks.html#id2999705">Features and Benefits</a></dt><dt><a href="integrate-ms-networks.html#id2999730">Background Information</a></dt><dt><a href="integrate-ms-networks.html#id2999775">Name Resolution in a pure Unix/Linux world</a></dt><dd><dl><dt><a href="integrate-ms-networks.html#id2999831">/etc/hosts</a></dt><dt><a href="integrate-ms-networks.html#id2999956">/etc/resolv.conf</a></dt><dt><a href="integrate-ms-networks.html#id3000000">/etc/host.conf</a></dt><dt><a href="integrate-ms-networks.html#id3000042">/etc/nsswitch.conf</a></dt></dl></dd><dt><a href="integrate-ms-networks.html#id3000130">Name resolution as used within MS Windows networking</a></dt><dd><dl><dt><a href="integrate-ms-networks.html#id3000278">The NetBIOS Name Cache</a></dt><dt><a href="integrate-ms-networks.html#id3000323">The LMHOSTS file</a></dt><dt><a href="integrate-ms-networks.html#id3000567">HOSTS file</a></dt><dt><a href="integrate-ms-networks.html#id3000600">DNS Lookup</a></dt><dt><a href="integrate-ms-networks.html#id3000624">WINS Lookup</a></dt></dl></dd><dt><a href="integrate-ms-networks.html#id3000695">Common Errors</a></dt><dd><dl><dt><a href="integrate-ms-networks.html#id3000711">My Boomerang Won't Come Back</a></dt><dt><a href="integrate-ms-networks.html#id3000742">Very Slow Network Connections</a></dt><dt><a href="integrate-ms-networks.html#id3000794">Samba server name change problem</a></dt></dl></dd></dl></dd><dt>27. <a href="unicode.html">Unicode/Charsets</a></dt><dd><dl><dt><a href="unicode.html#id3001913">Features and Benefits</a></dt><dt><a href="unicode.html#id3002114">What are charsets and unicode?</a></dt><dt><a href="unicode.html#id3002184">Samba and charsets</a></dt><dt><a href="unicode.html#id3002284">Conversion from old names</a></dt><dt><a href="unicode.html#id3002329">Japanese charsets</a></dt></dl></dd><dt>28. <a href="Backup.html">Samba Backup Techniques</a></dt><dd><dl><dt><a href="Backup.html#id3001533">Note</a></dt><dt><a href="Backup.html#id3001557">Features and Benefits</a></dt></dl></dd><dt>29. <a href="SambaHA.html">High Availability Options</a></dt><dd><dl><dt><a href="SambaHA.html#id3003099">Note</a></dt></dl></dd></dl></dd><dt>IV. <a href="migration.html">Migration and Updating</a></dt><dd><dl><dt>30. <a href="upgrading-to-3.0.html">Upgrading from Samba-2.x to Samba-3.0.0</a></dt><dd><dl><dt><a href="upgrading-to-3.0.html#id3001684">Charsets</a></dt><dt><a href="upgrading-to-3.0.html#id3001709">Obsolete configuration options</a></dt><dt><a href="upgrading-to-3.0.html#id3003319">Password Backend</a></dt></dl></dd><dt>31. <a href="NT4Migration.html">Migration from NT4 PDC to Samba-3 PDC</a></dt><dd><dl><dt><a href="NT4Migration.html#id3001339">Planning and Getting Started</a></dt><dd><dl><dt><a href="NT4Migration.html#id3001368">Objectives</a></dt><dt><a href="NT4Migration.html#id3004043">Steps In Migration Process</a></dt></dl></dd><dt><a href="NT4Migration.html#id3004381">Migration Options</a></dt><dd><dl><dt><a href="NT4Migration.html#id3004462">Planning for Success</a></dt><dt><a href="NT4Migration.html#id3004704">Samba Implementation Choices</a></dt></dl></dd></dl></dd><dt>32. <a href="SWAT.html">SWAT - The Samba Web Administration Tool</a></dt><dd><dl><dt><a href="SWAT.html#id3003929">Features and Benefits</a></dt><dd><dl><dt><a href="SWAT.html#id3003963">Enabling SWAT for use</a></dt><dt><a href="SWAT.html#id3006322">Securing SWAT through SSL</a></dt><dt><a href="SWAT.html#id3006435">The SWAT Home Page</a></dt><dt><a href="SWAT.html#id3006499">Global Settings</a></dt><dt><a href="SWAT.html#id3006604">Share Settings</a></dt><dt><a href="SWAT.html#id3006669">Printers Settings</a></dt><dt><a href="SWAT.html#id3006733">The SWAT Wizard</a></dt><dt><a href="SWAT.html#id3006781">The Status Page</a></dt><dt><a href="SWAT.html#id3006833">The View Page</a></dt><dt><a href="SWAT.html#id3006856">The Password Change Page</a></dt></dl></dd></dl></dd></dl></dd><dt>V. <a href="troubleshooting.html">Troubleshooting</a></dt><dd><dl><dt>33. <a href="diagnosis.html">The Samba checklist</a></dt><dd><dl><dt><a href="diagnosis.html#id3006072">Introduction</a></dt><dt><a href="diagnosis.html#id3007931">Assumptions</a></dt><dt><a href="diagnosis.html#id3008108">The tests</a></dt><dt><a href="diagnosis.html#id3009283">Still having troubles?</a></dt></dl></dd><dt>34. <a href="problems.html">Analysing and solving samba problems</a></dt><dd><dl><dt><a href="problems.html#id3010907">Diagnostics tools</a></dt><dt><a href="problems.html#id3011048">Installing 'Network Monitor' on an NT Workstation or a Windows 9x box</a></dt><dt><a href="problems.html#id3011333">Useful URLs</a></dt><dt><a href="problems.html#id3011378">Getting help from the mailing lists</a></dt><dt><a href="problems.html#id3011530">How to get off the mailing lists</a></dt></dl></dd><dt>35. <a href="bugreport.html">Reporting Bugs</a></dt><dd><dl><dt><a href="bugreport.html#id3012269">Introduction</a></dt><dt><a href="bugreport.html#id3012491">General info</a></dt><dt><a href="bugreport.html#id3012528">Debug levels</a></dt><dt><a href="bugreport.html#id3012670">Internal errors</a></dt><dt><a href="bugreport.html#id3012778">Attaching to a running process</a></dt><dt><a href="bugreport.html#id3012825">Patches</a></dt></dl></dd></dl></dd><dt>VI. <a href="Appendixes.html">Appendixes</a></dt><dd><dl><dt>36. <a href="compiling.html">How to compile SAMBA</a></dt><dd><dl><dt><a href="compiling.html#id3012145">Access Samba source code via CVS</a></dt><dd><dl><dt><a href="compiling.html#id3012152">Introduction</a></dt><dt><a href="compiling.html#id3012182">CVS Access to samba.org</a></dt></dl></dd><dt><a href="compiling.html#id3013701">Accessing the samba sources via rsync and ftp</a></dt><dt><a href="compiling.html#id3013750">Verifying Samba's PGP signature</a></dt><dt><a href="compiling.html#id3013886">Building the Binaries</a></dt><dd><dl><dt><a href="compiling.html#id3014023">Compiling samba with Active Directory support</a></dt></dl></dd><dt><a href="compiling.html#id3014188">Starting the smbd and nmbd</a></dt><dd><dl><dt><a href="compiling.html#id3014280">Starting from inetd.conf</a></dt><dt><a href="compiling.html#id3014484">Alternative: starting it as a daemon</a></dt></dl></dd><dt><a href="compiling.html#id3014579">Common Errors</a></dt></dl></dd><dt>37. <a href="Portability.html">Portability</a></dt><dd><dl><dt><a href="Portability.html#id3013478">HPUX</a></dt><dt><a href="Portability.html#id3016009">SCO Unix</a></dt><dt><a href="Portability.html#id3016039">DNIX</a></dt><dt><a href="Portability.html#id3016210">RedHat Linux Rembrandt-II</a></dt><dt><a href="Portability.html#id3016254">AIX</a></dt><dd><dl><dt><a href="Portability.html#id3016261">Sequential Read Ahead</a></dt></dl></dd><dt><a href="Portability.html#id3016287">Solaris</a></dt><dd><dl><dt><a href="Portability.html#id3016294">Locking improvements</a></dt><dt><a href="Portability.html#winbind-solaris9">Winbind on Solaris 9</a></dt></dl></dd></dl></dd><dt>38. <a href="Other-Clients.html">Samba and other CIFS clients</a></dt><dd><dl><dt><a href="Other-Clients.html#id3015663">Macintosh clients?</a></dt><dt><a href="Other-Clients.html#id3017016">OS2 Client</a></dt><dd><dl><dt><a href="Other-Clients.html#id3017023">How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?</a></dt><dt><a href="Other-Clients.html#id3017102">How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?</a></dt><dt><a href="Other-Clients.html#id3017164">How do I get printer driver download working - for OS/2 clients?</a></dt></dl></dd><dt><a href="Other-Clients.html#id3017260">Windows for Workgroups</a></dt><dd><dl><dt><a href="Other-Clients.html#id3017268">Use latest TCP/IP stack from Microsoft</a></dt><dt><a href="Other-Clients.html#id3017357">Delete .pwl files after password change</a></dt><dt><a href="Other-Clients.html#id3017388">Configure WfW password handling</a></dt><dt><a href="Other-Clients.html#id3017433">Case handling of passwords</a></dt><dt><a href="Other-Clients.html#id3017464">Use TCP/IP as default protocol</a></dt><dt><a href="Other-Clients.html#id3017481">Speed improvement</a></dt></dl></dd><dt><a href="Other-Clients.html#id3017528">Windows '95/'98</a></dt><dd><dl><dt><a href="Other-Clients.html#id3017601">Speed improvement</a></dt></dl></dd><dt><a href="Other-Clients.html#id3017625">Windows 2000 Service Pack 2</a></dt><dt><a href="Other-Clients.html#id3017736">Windows NT 3.1</a></dt></dl></dd><dt>39. <a href="speed.html">Samba Performance Tuning</a></dt><dd><dl><dt><a href="speed.html#id3018768">Comparisons</a></dt><dt><a href="speed.html#id3018812">Socket options</a></dt><dt><a href="speed.html#id3018887">Read size</a></dt><dt><a href="speed.html#id3018931">Max xmit</a></dt><dt><a href="speed.html#id3018984">Log level</a></dt><dt><a href="speed.html#id3019007">Read raw</a></dt><dt><a href="speed.html#id3019064">Write raw</a></dt><dt><a href="speed.html#id3019106">Slow Logins</a></dt><dt><a href="speed.html#id3019127">Client tuning</a></dt><dt><a href="speed.html#id3019154">Samba performance problem due changing kernel</a></dt><dt><a href="speed.html#id3019185">Corrupt tdb Files</a></dt></dl></dd><dt>40. <a href="DNSDHCP.html">DNS and DHCP Configuration Guide</a></dt><dd><dl><dt><a href="DNSDHCP.html#id3018605">Note</a></dt></dl></dd><dt>41. <a href="Further-Resources.html">Further Resources</a></dt><dd><dl><dt><a href="Further-Resources.html#id3018765">Websites</a></dt><dt><a href="Further-Resources.html#id3020416">Related updates from Microsoft</a></dt><dt><a href="Further-Resources.html#id3020431">Books</a></dt></dl></dd></dl></dd><dt><a href="ix01.html">Index</a></dt></dl></div><div class="list-of-figures"><p><b>List of Figures</b></p><dl><dt>19.1. <a href="CUPS-printing.html#id2954904">Windows Printing to a local Printer</a></dt><dt>19.2. <a href="CUPS-printing.html#id2955075">Printing to a Postscript Printer</a></dt><dt>19.3. <a href="CUPS-printing.html#id2955155">Ghostscript as a RIP for non-postscript printers</a></dt><dt>19.4. <a href="CUPS-printing.html#id2956084">Prefiltering in CUPS to form Postscript</a></dt><dt>19.5. <a href="CUPS-printing.html#id2956149">Adding Device-specific Print Options</a></dt><dt>19.6. <a href="CUPS-printing.html#id2956251">Postscript to intermediate Raster format</a></dt><dt>19.7. <a href="CUPS-printing.html#id2956304">CUPS-raster production using Ghostscript</a></dt><dt>19.8. <a href="CUPS-printing.html#id2956398">Image format to CUPS-raster format conversion</a></dt><dt>19.9. <a href="CUPS-printing.html#id2956484">Raster to Printer Specific formats</a></dt><dt>19.10. <a href="CUPS-printing.html#id2957561">cupsomatic/foomatic processing versus Native CUPS</a></dt><dt>19.11. <a href="CUPS-printing.html#id2958191">Print Driver execution on the Client</a></dt><dt>19.12. <a href="CUPS-printing.html#id2958249">Print Driver execution on the Server</a></dt><dt>19.13. <a href="CUPS-printing.html#id2958439">Printing via CUPS/samba server</a></dt><dt>19.14. <a href="CUPS-printing.html#id2960326">cupsaddsmb flowchart</a></dt><dt>19.15. <a href="CUPS-printing.html#id2966052">CUPS Printing Overview</a></dt></dl></div><div class="list-of-tables"><p><b>List of Tables</b></p><dl><dt>7.1. <a href="domain-member.html#id2898912">Assumptions</a></dt><dt>10.1. <a href="NetworkBrowsing.html#id2906267">Browse subnet example 1</a></dt><dt>10.2. <a href="NetworkBrowsing.html#id2906382">Browse subnet example 2</a></dt><dt>10.3. <a href="NetworkBrowsing.html#id2906481">Browse subnet example 3</a></dt><dt>10.4. <a href="NetworkBrowsing.html#id2906581">Browse subnet example 4</a></dt><dt>11.1. <a href="passdb.html#id2912659">Attributes in the sambaSamAccount objectclass (LDAP)</a></dt><dt>11.2. <a href="passdb.html#id2913346">Basic smb.conf options for MySQL passdb backend</a></dt><dt>11.3. <a href="passdb.html#id2913471">MySQL field names for MySQL passdb backend</a></dt><dt>13.1. <a href="AccessControls.html#id2920603">Managing directories with unix and windows</a></dt><dt>13.2. <a href="AccessControls.html#id2922134">User and Group Based Controls</a></dt><dt>13.3. <a href="AccessControls.html#id2922367">File and Directory Permission Based Controls</a></dt><dt>13.4. <a href="AccessControls.html#id2922614">Other Controls</a></dt><dt>20.1. <a href="VFS.html#id2978406">Extended Auditing Log Information</a></dt><dt>24.1. <a href="ProfileMgmt.html#id2990854">User Shell Folder registry keys default values</a></dt><dt>24.2. <a href="ProfileMgmt.html#id2990998">Defaults of profile settings registry keys</a></dt><dt>24.3. <a href="ProfileMgmt.html#id2991253">Defaults of default user profile paths registry keys</a></dt><dt>25.1. <a href="pam.html#id2997236">Options recognized by pam_smbpass</a></dt><dt>31.1. <a href="NT4Migration.html#id3004398">The 3 Major Site Types</a></dt><dt>31.2. <a href="NT4Migration.html#id3004535">Nature of the Conversion Choices</a></dt></dl></div><div class="list-of-examples"><p><b>List of Examples</b></p><dl><dt>12.1. <a href="groupmapping.html#id2921843">smbgrpadd.sh</a></dt><dt>13.1. <a href="AccessControls.html#id2920816">Example File</a></dt></dl></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="introduction.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"> </td><td width="20%" align="center"> </td><td width="40%" align="right" valign="top"> Part I. General Installation</td></tr></table></div></body></html> diff --git a/docs/htmldocs/interdomaintrusts.html b/docs/htmldocs/interdomaintrusts.html deleted file mode 100644 index c9fe4a533f..0000000000 --- a/docs/htmldocs/interdomaintrusts.html +++ /dev/null @@ -1,451 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Interdomain Trust Relationships</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Advanced Configuration" -HREF="optional.html"><LINK -REL="PREVIOUS" -TITLE="Desktop Profile Management" -HREF="profilemgmt.html"><LINK -REL="NEXT" -TITLE="PAM Configuration for Centrally Managed Authentication" -HREF="pam.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="profilemgmt.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="pam.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="INTERDOMAINTRUSTS" -></A ->Chapter 19. Interdomain Trust Relationships</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->19.1. <A -HREF="interdomaintrusts.html#AEN3446" ->Trust Relationship Background</A -></DT -><DT ->19.2. <A -HREF="interdomaintrusts.html#AEN3455" ->Native MS Windows NT4 Trusts Configuration</A -></DT -><DD -><DL -><DT ->19.2.1. <A -HREF="interdomaintrusts.html#AEN3458" ->NT4 as the Trusting Domain (ie. creating the trusted account)</A -></DT -><DT ->19.2.2. <A -HREF="interdomaintrusts.html#AEN3461" ->NT4 as the Trusted Domain (ie. creating trusted account's password)</A -></DT -></DL -></DD -><DT ->19.3. <A -HREF="interdomaintrusts.html#AEN3464" ->Configuring Samba NT-style Domain Trusts</A -></DT -><DD -><DL -><DT ->19.3.1. <A -HREF="interdomaintrusts.html#AEN3468" ->Samba-3 as the Trusting Domain</A -></DT -><DT ->19.3.2. <A -HREF="interdomaintrusts.html#AEN3480" ->Samba-3 as the Trusted Domain</A -></DT -></DL -></DD -></DL -></DIV -><P ->Samba-3 supports NT4 style domain trust relationships. This is feature that many sites -will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to -adopt Active Directory or an LDAP based authentication back end. This section explains -some background information regarding trust relationships and how to create them. It is now -possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts.</P -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3446" ->19.1. Trust Relationship Background</A -></H1 -><P ->MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. -The limitations of this architecture as it affects the scalability of MS Windows networking -in large organisations is well known. Additionally, the flat-name space that results from -this design significantly impacts the delegation of administrative responsibilities in -large and diverse organisations.</P -><P ->Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means -of circumventing the limitations of the older technologies. Not every organisation is ready -or willing to embrace ADS. For small companies the older NT4 style domain security paradigm -is quite adequate, there thus remains an entrenched user base for whom there is no direct -desire to go through a disruptive change to adopt ADS.</P -><P ->Microsoft introduced with MS Windows NT the ability to allow differing security domains -to affect a mechanism so that users from one domain may be given access rights and privileges -in another domain. The language that describes this capability is couched in terms of -<SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Trusts</I -></SPAN ->. Specifically, one domain will <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->trust</I -></SPAN -> the users -from another domain. The domain from which users are available to another security domain is -said to be a trusted domain. The domain in which those users have assigned rights and privileges -is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only, -thus if users in both domains are to have privileges and rights in each others' domain, then it is -necessary to establish two (2) relationships, one in each direction.</P -><P ->In an NT4 style MS security domain, all trusts are non-transitive. This means that if there -are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust -relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no -implied trust between the RED and BLUE domains. ie: Relationships are explicit and not -transitive.</P -><P ->New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way -by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE -domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is -an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 -style Interdomain trusts and interoperates with MS Windows 200x ADS -security domains in similar manner to MS Windows NT4 style domains.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3455" ->19.2. Native MS Windows NT4 Trusts Configuration</A -></H1 -><P ->There are two steps to creating an interdomain trust relationship.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3458" ->19.2.1. NT4 as the Trusting Domain (ie. creating the trusted account)</A -></H2 -><P ->For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager. -To affect a two way trust relationship it is necessary for each domain administrator to make -available (for use by an external domain) it's security resources. This is done from the Domain -User Manager Policies entry on the menu bar. From the Policy menu, select Trust Relationships, then -next to the lower box that is labelled "Permitted to Trust this Domain" are two buttons, "Add" and -"Remove". The "Add" button will open a panel in which needs to be entered the remote domain that -will be able to assign user rights to your domain. In addition it is necessary to enter a password -that is specific to this trust relationship. The password needs to be -typed twice (for standard confirmation).</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3461" ->19.2.2. NT4 as the Trusted Domain (ie. creating trusted account's password)</A -></H2 -><P ->A trust relationship will work only when the other (trusting) domain makes the appropriate connections -with the trusted domain. To consumate the trust relationship the administrator will launch the -Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the -"Add" button that is next to the box that is labelled "Trusted Domains". A panel will open in -which must be entered the name of the remote domain as well as the password assigned to that trust.</P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3464" ->19.3. Configuring Samba NT-style Domain Trusts</A -></H1 -><P ->This description is meant to be a fairly short introduction about how to set up a Samba server so -that it could participate in interdomain trust relationships. Trust relationship support in Samba -is in its early stage, so lot of things don't work yet.</P -><P ->Each of the procedures described below is treated as they were performed with Windows NT4 Server on -one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after -reading this document, that combining Samba-specific parts of what's written below leads to trust -between domains in purely Samba environment.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3468" ->19.3.1. Samba-3 as the Trusting Domain</A -></H2 -><P ->In order to set Samba PDC to be trusted party of the relationship first you need -to create special account for the domain that will be the trusting party. To do that, -you can use the 'smbpasswd' utility. Creating the trusted domain account is very -similiar to creating a trusted machine account. Suppose, your domain is -called SAMBA, and the remote domain is called RUMBA. The first step -will be to issue this command from your favourite shell:</P -><P -><PRE -CLASS="SCREEN" -> <SAMP -CLASS="PROMPT" ->deity#</SAMP -> <KBD -CLASS="USERINPUT" ->smbpasswd -a -i rumba</KBD -> - New SMB password: XXXXXXXX - Retype SMB password: XXXXXXXX - Added user rumba$</PRE -> - -where <VAR -CLASS="PARAMETER" ->-a</VAR -> means to add a new account into the -passdb database and <VAR -CLASS="PARAMETER" ->-i</VAR -> means: ''create this -account with the InterDomain trust flag''</P -><P ->The account name will be 'rumba$' (the name of the remote domain)</P -><P ->After issuing this command you'll be asked to enter the password for -the account. You can use any password you want, but be aware that Windows NT will -not change this password until 7 days following account creation. -After the command returns successfully, you can look at the entry for new account -(in the way depending on your configuration) and see that account's name is -really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm -the trust by establishing it from Windows NT Server.</P -><P ->Open 'User Manager for Domains' and from menu 'Policies' select 'Trust Relationships...'. -Right beside 'Trusted domains' list box press 'Add...' button. You will be prompted for -the trusted domain name and the relationship password. Type in SAMBA, as this is -your domain name, and the password used at the time of account creation. -Press OK and, if everything went without incident, you will see 'Trusted domain relationship -successfully established' message.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3480" ->19.3.2. Samba-3 as the Trusted Domain</A -></H2 -><P ->This time activities are somewhat reversed. Again, we'll assume that your domain -controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA.</P -><P ->The very first thing requirement is to add an account for the SAMBA domain on RUMBA's PDC.</P -><P ->Launch the Domain User Manager, then from the menu select 'Policies', 'Trust Relationships'. -Now, next to 'Trusted Domains' box press the 'Add' button, and type in the name of the trusted -domain (SAMBA) and password securing the relationship.</P -><P ->The password can be arbitrarily chosen. It is easy to change it the password -from Samba server whenever you want. After confirming the password your account is -ready for use. Now it's Samba's turn.</P -><P ->Using your favourite shell while being logged in as root, issue this command:</P -><P -><SAMP -CLASS="PROMPT" ->deity# </SAMP -><KBD -CLASS="USERINPUT" ->net rpc trustdom establish rumba</KBD -></P -><P ->You will be prompted for the password you just typed on your Windows NT4 Server box. -Don not worry if you see an error message that mentions a returned code of -<SPAN -CLASS="ERRORNAME" ->NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT</SPAN ->. It means the -password you gave is correct and the NT4 Server says the account is -ready for interdomain connection and not for ordinary -connection. After that, be patient it can take a while (especially -in large networks), you should see the 'Success' message. Congratulations! Your trust -relationship has just been established.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Note that you have to run this command as root because you must have write access to -the <TT -CLASS="FILENAME" ->secrets.tdb</TT -> file.</P -></TD -></TR -></TABLE -></DIV -></DIV -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="profilemgmt.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="pam.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Desktop Profile Management</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="optional.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->PAM Configuration for Centrally Managed Authentication</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/introsmb.html b/docs/htmldocs/introsmb.html deleted file mode 100644 index 52db6a8a95..0000000000 --- a/docs/htmldocs/introsmb.html +++ /dev/null @@ -1,659 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Introduction to Samba</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="General installation" -HREF="introduction.html"><LINK -REL="PREVIOUS" -TITLE="General installation" -HREF="introduction.html"><LINK -REL="NEXT" -TITLE="How to Install and Test SAMBA" -HREF="install.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="introduction.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="install.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="INTROSMB" -></A ->Chapter 1. Introduction to Samba</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->1.1. <A -HREF="introsmb.html#AEN61" ->Background</A -></DT -><DT ->1.2. <A -HREF="introsmb.html#AEN67" ->Terminology</A -></DT -><DT ->1.3. <A -HREF="introsmb.html#AEN91" ->Related Projects</A -></DT -><DT ->1.4. <A -HREF="introsmb.html#AEN100" ->SMB Methodology</A -></DT -><DT ->1.5. <A -HREF="introsmb.html#AEN115" ->Additional Resources</A -></DT -><DT ->1.6. <A -HREF="introsmb.html#AEN151" ->Epilogue</A -></DT -><DT ->1.7. <A -HREF="introsmb.html#AEN162" ->Miscellaneous</A -></DT -></DL -></DIV -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->"If you understand what you're doing, you're not learning anything." --- Anonymous</I -></SPAN -></P -><P ->Samba is a file and print server for Windows-based clients using TCP/IP as the underlying -transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of Samba's big -strengths is that you can use it to blend your mix of Windows and Linux machines together -without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed -by a global team of about 30 active programmers and was originally developed by Andrew Tridgell.</P -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN61" ->1.1. Background</A -></H1 -><P ->Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed -Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was -originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only -ran over UDP. When there was a need to run it over TCP so that it would be compatible -with DECnet 3.0, it was redesigned, submitted to The Open Group, and officially became -known as DCE/RPC. Microsoft came along and decided, rather than pay $20 per seat to -license this technology, to reimplement DCE/RPC themselves as MSRPC. From this, the -concept continued in the form of SMB (Server Message Block, or the "what") using the -NetBIOS (Network Basic Input/Output System, or the "how") compatibility layer. You can -run SMB (i.e., transport) over several different protocols; many different implementations -arose as a result, including NBIPX (NetBIOS over IPX, NwLnkNb, or NWNBLink) and NBT -(NetBIOS over TCP/IP, or NetBT). As the years passed, NBT became the most common form -of implementation until the advance of "Direct-Hosted TCP" -- the Microsoft marketing -term for eliminating NetBIOS entirely and running SMB by itself across TCP port 445 -only. As of yet, direct-hosted TCP has yet to catch on.</P -><P ->Perhaps the best summary of the origins of SMB are voiced in the 1997 article titled, CIFS: -Common Insecurities Fail Scrutiny:</P -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Several megabytes of NT-security archives, random whitepapers, RFCs, the CIFS spec, the Samba -stuff, a few MS knowledge-base articles, strings extracted from binaries, and packet dumps have -been dutifully waded through during the information-gathering stages of this project, and there -are *still* many missing pieces... While often tedious, at least the way has been generously -littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they -thinking?</I -></SPAN -></P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN67" ->1.2. Terminology</A -></H1 -><P -></P -><UL -><LI -><P -> SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol. - </P -></LI -><LI -><P -> CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently - decided that SMB needed the word "Internet" in it, so they changed it to CIFS. - </P -></LI -><LI -><P -> Direct-Hosted: A method of providing file/printer sharing services over port 445/tcp - only using DNS for name resolution instead of WINS. - </P -></LI -><LI -><P -> IPC: Acronym for "Inter-Process Communication". A method to communicate specific - information between programs. - </P -></LI -><LI -><P -> Marshalling: - A method of serializing (i.e., sequential ordering of) variable data - suitable for transmission via a network connection or storing in a file. The source - data can be re-created using a similar process called unmarshalling. - </P -></LI -><LI -><P -> NetBIOS: Acronym for "Network Basic Input/Output System". This is not a protocol; - it is a method of communication across an existing protocol. This is a standard which - was originally developed for IBM by Sytek in 1983. To exaggerate the analogy a bit, - it can help to think of this in comparison your computer's BIOS -- it controls the - essential functions of your input/output hardware -- whereas NetBIOS controls the - essential functions of your input/output traffic via the network. Again, this is a bit - of an exaggeration but it should help that paradigm shift. What is important to realize - is that NetBIOS is a transport standard, not a protocol. Unfortunately, even technically - brilliant people tend to interchange NetBIOS with terms like NetBEUI without a second - thought; this will cause no end (and no doubt) of confusion. - </P -></LI -><LI -><P -> NetBEUI: Acronym for the "NetBIOS Extended User Interface". Unlike NetBIOS, NetBEUI - is a protocol, not a standard. It is also not routable, so traffic on one side of a - router will be unable to communicate with the other side. Understanding NetBEUI is - not essential to deciphering SMB; however it helps to point out that it is not the - same as NetBIOS and to improve your score in trivia at parties. NetBEUI was originally - referred to by Microsoft as "NBF", or "The Windows NT NetBEUI Frame protocol driver". - It is not often heard from these days. - </P -></LI -><LI -><P -> NBT: Acronym for "NetBIOS over TCP"; also known as "NetBT". Allows the continued use - of NetBIOS traffic proxied over TCP/IP. As a result, NetBIOS names are made - to IP addresses and NetBIOS name types are conceptually equivalent to TCP/IP ports. - This is how file and printer sharing are accomplished in Windows 95/98/ME. They - traditionally rely on three ports: NetBIOS Name Service (nbname) via UDP port 137, - NetBIOS Datagram Service (nbdatagram) via UDP port 138, and NetBIOS Session Service - (nbsession) via TCP port 139. All name resolution is done via WINS, NetBIOS broadcasts, - and DNS. NetBIOS over TCP is documented in RFC 1001 (Concepts and methods) and RFC 1002 - (Detailed specifications). - </P -></LI -><LI -><P -> W2K: Acronym for Windows 2000 Professional or Server - </P -></LI -><LI -><P -> W3K: Acronym for Windows 2003 Server - </P -></LI -></UL -><P ->If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at -http://www.samba.org). Optionally, you could just search mailing.unix.samba at http://groups.google.com</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN91" ->1.3. Related Projects</A -></H1 -><P ->Currently, there are two projects that are directly related to Samba: SMBFS and CIFS network -client file systems for Linux, both available in the Linux kernel itself.</P -><P -></P -><UL -><LI -><P -> SMBFS (Server Message Block File System) allows you to mount SMB shares (the protocol - that Microsoft Windows and OS/2 Lan Manager use to share files and printers - over local networks) and access them just like any other Unix directory. This is useful - if you just want to mount such filesystems without being a SMBFS server. - </P -></LI -><LI -><P -> CIFS (Common Internet File System) is the successor to SMB, and is actively being worked - on in the upcoming version of the Linux kernel. The intent of this module is to - provide advanced network file system functionality including support for dfs (heirarchical - name space), secure per-user session establishment, safe distributed caching (oplock), - optional packet signing, Unicode and other internationalization improvements, and optional - Winbind (nsswitch) integration. - </P -></LI -></UL -><P ->Again, it's important to note that these are implementations for client filesystems, and have -nothing to do with acting as a file and print server for SMB/CIFS clients.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN100" ->1.4. SMB Methodology</A -></H1 -><P ->Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns), -UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS -session service, or netbios-ssn). Anyone looking at their network with a good -packet sniffer will be amazed at the amount of traffic generated by just opening -up a single file. In general, SMB sessions are established in the following order:</P -><P -></P -><UL -><LI -><P -> "TCP Connection" - establish 3-way handshake (connection) to port 139/tcp - or 445/tcp. - </P -></LI -><LI -><P -> "NetBIOS Session Request" - using the following "Calling Names": The local - machine's NetBIOS name plus the 16th character 0x00; The server's NetBIOS - name plus the 16th character 0x20 - </P -></LI -><LI -><P -> "SMB Negotiate Protocol" - determine the protocol dialect to use, which will - be one of the following: PC Network Program 1.0 (Core) - share level security - mode only; Microsoft Networks 1.03 (Core Plus) - share level security - mode only; Lanman1.0 (LAN Manager 1.0) - uses Challenge/Response - Authentication; Lanman2.1 (LAN Manager 2.1) - uses Challenge/Response - Authentication; NT LM 0.12 (NT LM 0.12) - uses Challenge/Response - Authentication - </P -></LI -><LI -><P -> SMB Session Startup. Passwords are encrypted (or not) according to one of - the following methods: Null (no encryption); Cleartext (no encryption); LM - and NTLM; NTLM; NTLMv2 - </P -></LI -><LI -><P -> SMB Tree Connect: Connect to a share name (e.g., \\servername\share); Connect - to a service type (e.g., IPC$ named pipe) - </P -></LI -></UL -><P ->A good way to examine this process in depth is to try out SecurityFriday's SWB program -at http://www.securityfriday.com/ToolDownload/SWB/swb_doc.html. It allows you to -walk through the establishment of a SMB/CIFS session step by step.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN115" ->1.5. Additional Resources</A -></H1 -><P -></P -><UL -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->CIFS: Common Insecurities Fail Scrutiny</I -></SPAN -> by "Hobbit", - http://hr.uoregon.edu/davidrl/cifs.txt - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Doing the Samba on Windows</I -></SPAN -> by Financial Review, - http://afr.com/it/2002/10/01/FFXDF43AP6D.html - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Implementing CIFS</I -></SPAN -> by Christopher R. Hertel, - http://ubiqx.org/cifs/ - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Just What Is SMB?</I -></SPAN -> by Richard Sharpe, - http://samba.anu.edu.au/cifs/docs/what-is-smb.html - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Opening Windows Everywhere</I -></SPAN -> by Mike Warfield, - http://www.linux-mag.com/1999-05/samba_01.html - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->SMB HOWTO</I -></SPAN -> by David Wood, - http://www.tldp.org/HOWTO/SMB-HOWTO.html - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->SMB/CIFS by The Root</I -></SPAN -> by "ledin", - http://www.phrack.org/phrack/60/p60-0x0b.txt - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->The Story of Samba</I -></SPAN -> by Christopher R. Hertel, - http://www.linux-mag.com/1999-09/samba_01.html - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->The Unofficial Samba HOWTO</I -></SPAN -> by David Lechnyr, - http://hr.uoregon.edu/davidrl/samba/ - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Understanding the Network Neighborhood</I -></SPAN -> by Christopher R. Hertel, - http://www.linux-mag.com/2001-05/smb_01.html - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Using Samba as a PDC</I -></SPAN -> by Andrew Bartlett, - http://www.linux-mag.com/2002-02/samba_01.html - </P -></LI -></UL -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN151" ->1.6. Epilogue</A -></H1 -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->"What's fundamentally wrong is that nobody ever had any taste when they -did it. Microsoft has been very much into making the user interface look good, -but internally it's just a complete mess. And even people who program for Microsoft -and who have had years of experience, just don't know how it works internally. -Worse, nobody dares change it. Nobody dares to fix bugs because it's such a -mess that fixing one bug might just break a hundred programs that depend on -that bug. And Microsoft isn't interested in anyone fixing bugs -- they're interested -in making money. They don't have anybody who takes pride in Windows 95 as an -operating system.</I -></SPAN -></P -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->People inside Microsoft know it's a bad operating system and they still -continue obviously working on it because they want to get the next version out -because they want to have all these new features to sell more copies of the -system.</I -></SPAN -></P -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->The problem with that is that over time, when you have this kind of approach, -and because nobody understands it, because nobody REALLY fixes bugs (other than -when they're really obvious), the end result is really messy. You can't trust -it because under certain circumstances it just spontaneously reboots or just -halts in the middle of something that shouldn't be strange. Normally it works -fine and then once in a blue moon for some completely unknown reason, it's dead, -and nobody knows why. Not Microsoft, not the experienced user and certainly -not the completely clueless user who probably sits there shivering thinking -"What did I do wrong?" when they didn't do anything wrong at all.</I -></SPAN -></P -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->That's what's really irritating to me."</I -></SPAN -></P -><P ->-- Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 -(http://hr.uoregon.edu/davidrl/boot.txt)</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN162" ->1.7. Miscellaneous</A -></H1 -><P ->This chapter was lovingly handcrafted on a Dell Latitude C400 laptop running Slackware Linux 9.0, -in case anyone asks.</P -><P ->This chapter is Copyright © 2003 David Lechnyr (david at lechnyr dot com). -Permission is granted to copy, distribute and/or modify this document under the terms -of the GNU Free Documentation License, Version 1.2 or any later version published by the Free -Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt.</P -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="introduction.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="install.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->General installation</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="introduction.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->How to Install and Test SAMBA</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/nt4migration.html b/docs/htmldocs/nt4migration.html deleted file mode 100644 index 2079c1b6c4..0000000000 --- a/docs/htmldocs/nt4migration.html +++ /dev/null @@ -1,356 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Migration from NT4 PDC to Samba-3 PDC</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Appendixes" -HREF="appendixes.html"><LINK -REL="PREVIOUS" -TITLE="How to compile SAMBA" -HREF="compiling.html"><LINK -REL="NEXT" -TITLE="Portability" -HREF="portability.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="compiling.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="portability.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="NT4MIGRATION" -></A ->Chapter 28. Migration from NT4 PDC to Samba-3 PDC</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->28.1. <A -HREF="nt4migration.html#AEN4396" ->Planning and Getting Started</A -></DT -><DD -><DL -><DT ->28.1.1. <A -HREF="nt4migration.html#AEN4400" ->Objectives</A -></DT -><DT ->28.1.2. <A -HREF="nt4migration.html#AEN4426" ->Steps In Migration Process</A -></DT -></DL -></DD -><DT ->28.2. <A -HREF="nt4migration.html#AEN4429" ->Managing Samba-3 Domain Control</A -></DT -></DL -></DIV -><P ->This is a rough guide to assist those wishing to migrate from NT4 domain control to -Samba-3 based domain control.</P -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4396" ->28.1. Planning and Getting Started</A -></H1 -><P ->In the IT world there is often a saying that all problems are encountered because of -poor planning. The corrollary to this saying is that not all problems can be anticpated -and planned for. Then again, good planning will anticpate most show stopper type situations.</P -><P ->Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control -environment would do well to develop a detailed migration plan. So here are a few pointers to -help migration get under way.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4400" ->28.1.1. Objectives</A -></H2 -><P ->The key objective for most organisations will be to make the migration from MS Windows NT4 -to Samba-3 domain control as painless as possible. One of the challenges you may experience -in your migration process may well be one of convincing management that the new environment -should remain in place. Many who have introduced open source technologies have experienced -pressure to return to a Microsoft based platform solution at the first sign of trouble. </P -><P ->It is strongly advised that before attempting a migration to a Samba-3 controlled network -that every possible effort be made to gain all-round commitment to the change. Firstly, you -should know precisely <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->why</I -></SPAN -> the change is important for the organisation. -Possible motivations to make a change include:</P -><P -></P -><UL -><LI -><P ->Improve network manageability</P -></LI -><LI -><P ->Obtain better user level functionality</P -></LI -><LI -><P ->Reduce network operating costs</P -></LI -><LI -><P ->Reduce exposure caused by Microsoft withdrawal of NT4 support</P -></LI -><LI -><P ->Avoid MS License 6 implications</P -></LI -><LI -><P ->Reduce organisation's dependency on Microsoft</P -></LI -></UL -><P ->It is vital that oit be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers -an alternative solution that is both different from MS Windows NT4 and that offers some -advantages compared with it. It should also be recognised that Samba-3 lacks many of the -features that Microsoft has promoted as core values in migration from MS Windows NT4 to -MS Windows 2000 and beyond (with or without Active Directory services).</P -><P ->What are the features the Samba-3 can NOT provide?</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->Active Directory Server</TD -></TR -><TR -><TD ->Group Policy Objects (in Active Direcrtory)</TD -></TR -><TR -><TD ->Machine Policy objects</TD -></TR -><TR -><TD ->Logon Scripts in Active Directorty</TD -></TR -><TR -><TD ->Software Application and Access Controls in Active Directory</TD -></TR -></TBODY -></TABLE -><P -></P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4426" ->28.1.2. Steps In Migration Process</A -></H2 -><P ->This is not a definitive ste-by-step process yet - just a place holder so the info -is not lost. - -1. You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated - -2. Samba-3 set up as a DC with netlogon share, profile share, etc. - -3. Process: - a. Create a BDC account for the samba server using NT Server Manager - - Samba must NOT be running - - b. rpcclient NT4PDC -U Administrator%passwd - lsaquery - - Note the SID returned by step b. - - c. net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd - - Note the SID in step c. - - d. net getlocalsid - - Note the SID, now check that all three SIDS reported are the same! - - e. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd - - f. net rpc vampire -S NT4PDC -U administrator%passwd - - g. pdbedit -l - - Note - did the users migrate? - - h. initGrps.sh DOMNAME - - i. smbgroupedit -v - - Now check that all groups are recognised - - j. net rpc campire -S NT4PDC -U administrator%passwd - - k. pdbedit -lv - - Note - check that all group membership has been migrated. - - -Now it is time to migrate all the profiles, then migrate all policy files. - -Moe later.</P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4429" ->28.2. Managing Samba-3 Domain Control</A -></H1 -><P ->Lots of blah blah here.</P -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="compiling.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="portability.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->How to compile SAMBA</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="appendixes.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Portability</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/other-clients.html b/docs/htmldocs/other-clients.html deleted file mode 100644 index 36513c672a..0000000000 --- a/docs/htmldocs/other-clients.html +++ /dev/null @@ -1,734 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Samba and other CIFS clients</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Appendixes" -HREF="appendixes.html"><LINK -REL="PREVIOUS" -TITLE="Portability" -HREF="portability.html"><LINK -REL="NEXT" -TITLE="SWAT - The Samba Web Admininistration Tool" -HREF="swat.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="portability.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="swat.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="OTHER-CLIENTS" -></A ->Chapter 30. Samba and other CIFS clients</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->30.1. <A -HREF="other-clients.html#AEN4522" ->Macintosh clients?</A -></DT -><DT ->30.2. <A -HREF="other-clients.html#AEN4531" ->OS2 Client</A -></DT -><DD -><DL -><DT ->30.2.1. <A -HREF="other-clients.html#AEN4533" ->How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?</A -></DT -><DT ->30.2.2. <A -HREF="other-clients.html#AEN4548" ->How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?</A -></DT -><DT ->30.2.3. <A -HREF="other-clients.html#AEN4557" ->Are there any other issues when OS/2 (any version) - is used as a client?</A -></DT -><DT ->30.2.4. <A -HREF="other-clients.html#AEN4561" ->How do I get printer driver download working - for OS/2 clients?</A -></DT -></DL -></DD -><DT ->30.3. <A -HREF="other-clients.html#AEN4571" ->Windows for Workgroups</A -></DT -><DD -><DL -><DT ->30.3.1. <A -HREF="other-clients.html#AEN4573" ->Use latest TCP/IP stack from Microsoft</A -></DT -><DT ->30.3.2. <A -HREF="other-clients.html#AEN4578" ->Delete .pwl files after password change</A -></DT -><DT ->30.3.3. <A -HREF="other-clients.html#AEN4583" ->Configure WfW password handling</A -></DT -><DT ->30.3.4. <A -HREF="other-clients.html#AEN4587" ->Case handling of passwords</A -></DT -><DT ->30.3.5. <A -HREF="other-clients.html#AEN4592" ->Use TCP/IP as default protocol</A -></DT -></DL -></DD -><DT ->30.4. <A -HREF="other-clients.html#AEN4595" ->Windows '95/'98</A -></DT -><DT ->30.5. <A -HREF="other-clients.html#AEN4611" ->Windows 2000 Service Pack 2</A -></DT -><DT ->30.6. <A -HREF="other-clients.html#AEN4628" ->Windows NT 3.1</A -></DT -></DL -></DIV -><P ->This chapter contains client-specific information.</P -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4522" ->30.1. Macintosh clients?</A -></H1 -><P ->Yes. <A -HREF="http://www.thursby.com/" -TARGET="_top" ->Thursby</A -> now have a CIFS Client / Server called DAVE - see</P -><P ->They test it against Windows 95, Windows NT and samba for -compatibility issues. At the time of writing, DAVE was at version -1.0.1. The 1.0.0 to 1.0.1 update is available as a free download from -the Thursby web site (the speed of finder copies has been greatly -enhanced, and there are bug-fixes included).</P -><P -> -Alternatives - There are two free implementations of AppleTalk for -several kinds of UNIX machnes, and several more commercial ones. -These products allow you to run file services and print services -natively to Macintosh users, with no additional support required on -the Macintosh. The two free omplementations are -<A -HREF="http://www.umich.edu/~rsug/netatalk/" -TARGET="_top" ->Netatalk</A ->, and -<A -HREF="http://www.cs.mu.oz.au/appletalk/atalk.html" -TARGET="_top" ->CAP</A ->. -What Samba offers MS -Windows users, these packages offer to Macs. For more info on these -packages, Samba, and Linux (and other UNIX-based systems) see -<A -HREF="http://www.eats.com/linux_mac_win.html" -TARGET="_top" ->http://www.eats.com/linux_mac_win.html</A -></P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4531" ->30.2. OS2 Client</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4533" ->30.2.1. How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?</A -></H2 -><P ->A more complete answer to this question can be - found on <A -HREF="http://carol.wins.uva.nl/~leeuw/samba/warp.html" -TARGET="_top" -> http://carol.wins.uva.nl/~leeuw/samba/warp.html</A ->.</P -><P ->Basically, you need three components:</P -><P -></P -><UL -><LI -><P ->The File and Print Client ('IBM Peer') - </P -></LI -><LI -><P ->TCP/IP ('Internet support') - </P -></LI -><LI -><P ->The "NetBIOS over TCP/IP" driver ('TCPBEUI') - </P -></LI -></UL -><P ->Installing the first two together with the base operating - system on a blank system is explained in the Warp manual. If Warp - has already been installed, but you now want to install the - networking support, use the "Selective Install for Networking" - object in the "System Setup" folder.</P -><P ->Adding the "NetBIOS over TCP/IP" driver is not described - in the manual and just barely in the online documentation. Start - MPTS.EXE, click on OK, click on "Configure LAPS" and click - on "IBM OS/2 NETBIOS OVER TCP/IP" in 'Protocols'. This line - is then moved to 'Current Configuration'. Select that line, - click on "Change number" and increase it from 0 to 1. Save this - configuration.</P -><P ->If the Samba server(s) is not on your local subnet, you - can optionally add IP names and addresses of these servers - to the "Names List", or specify a WINS server ('NetBIOS - Nameserver' in IBM and RFC terminology). For Warp Connect you - may need to download an update for 'IBM Peer' to bring it on - the same level as Warp 4. See the webpage mentioned above.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4548" ->30.2.2. How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?</A -></H2 -><P ->You can use the free Microsoft LAN Manager 2.2c Client - for OS/2 from - <A -HREF="ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/" -TARGET="_top" -> ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/</A ->. - See <A -HREF="http://carol.wins.uva.nl/~leeuw/lanman.html" -TARGET="_top" -> http://carol.wins.uva.nl/~leeuw/lanman.html</A -> for - more information on how to install and use this client. In - a nutshell, edit the file \OS2VER in the root directory of - the OS/2 boot partition and add the lines:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> 20=setup.exe - 20=netwksta.sys - 20=netvdd.sys - </PRE -></P -><P ->before you install the client. Also, don't use the - included NE2000 driver because it is buggy. Try the NE2000 - or NS2000 driver from - <A -HREF="ftp://ftp.cdrom.com/pub/os2/network/ndis/" -TARGET="_top" -> ftp://ftp.cdrom.com/pub/os2/network/ndis/</A -> instead. - </P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4557" ->30.2.3. Are there any other issues when OS/2 (any version) - is used as a client?</A -></H2 -><P ->When you do a NET VIEW or use the "File and Print - Client Resource Browser", no Samba servers show up. This can - be fixed by a patch from <A -HREF="http://carol.wins.uva.nl/~leeuw/samba/fix.html" -TARGET="_top" -> http://carol.wins.uva.nl/~leeuw/samba/fix.html</A ->. - The patch will be included in a later version of Samba. It also - fixes a couple of other problems, such as preserving long - filenames when objects are dragged from the Workplace Shell - to the Samba server. </P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4561" ->30.2.4. How do I get printer driver download working - for OS/2 clients?</A -></H2 -><P ->First, create a share called [PRINTDRV] that is - world-readable. Copy your OS/2 driver files there. Note - that the .EA_ files must still be separate, so you will need - to use the original install files, and not copy an installed - driver from an OS/2 system.</P -><P ->Install the NT driver first for that printer. Then, - add to your smb.conf a parameter, os2 driver map = - <VAR -CLASS="REPLACEABLE" ->filename</VAR ->". Then, in the file - specified by <VAR -CLASS="REPLACEABLE" ->filename</VAR ->, map the - name of the NT driver name to the OS/2 driver name as - follows:</P -><P -><B -CLASS="COMMAND" ->nt driver name = os2 "driver - name"."device name"</B ->, e.g.: - HP LaserJet 5L = LASERJET.HP LaserJet 5L</P -><P ->You can have multiple drivers mapped in this file.</P -><P ->If you only specify the OS/2 driver name, and not the - device name, the first attempt to download the driver will - actually download the files, but the OS/2 client will tell - you the driver is not available. On the second attempt, it - will work. This is fixed simply by adding the device name - to the mapping, after which it will work on the first attempt. - </P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4571" ->30.3. Windows for Workgroups</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4573" ->30.3.1. Use latest TCP/IP stack from Microsoft</A -></H2 -><P ->Use the latest TCP/IP stack from microsoft if you use Windows -for workgroups.</P -><P ->The early TCP/IP stacks had lots of bugs.</P -><P -> -Microsoft has released an incremental upgrade to their TCP/IP 32-Bit -VxD drivers. The latest release can be found on their ftp site at -ftp.microsoft.com, located in /peropsys/windows/public/tcpip/wfwt32.exe. -There is an update.txt file there that describes the problems that were -fixed. New files include WINSOCK.DLL, TELNET.EXE, WSOCK.386, VNBT.386, -WSTCP.386, TRACERT.EXE, NETSTAT.EXE, and NBTSTAT.EXE.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4578" ->30.3.2. Delete .pwl files after password change</A -></H2 -><P ->WfWg does a lousy job with passwords. I find that if I change my -password on either the unix box or the PC the safest thing to do is to -delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password.</P -><P -> -If you don't do this you may find that WfWg remembers and uses the old -password, even if you told it a new one.</P -><P -> -Often WfWg will totally ignore a password you give it in a dialog box.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4583" ->30.3.3. Configure WfW password handling</A -></H2 -><P ->There is a program call admincfg.exe -on the last disk (disk 8) of the WFW 3.11 disk set. To install it -type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE Then add an icon -for it via the "Progam Manager" "New" Menu. This program allows you -to control how WFW handles passwords. ie disable Password Caching etc -for use with <B -CLASS="COMMAND" ->security = user</B -></P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4587" ->30.3.4. Case handling of passwords</A -></H2 -><P ->Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the <A -HREF="smb.conf.5.html" -TARGET="_top" ->smb.conf(5)</A -> information on <B -CLASS="COMMAND" ->password level</B -> to specify what characters samba should try to uppercase when checking.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4592" ->30.3.5. Use TCP/IP as default protocol</A -></H2 -><P ->To support print queue reporting you may find -that you have to use TCP/IP as the default protocol under -WfWg. For some reason if you leave Netbeui as the default -it may break the print queue reporting on some systems. -It is presumably a WfWg bug.</P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4595" ->30.4. Windows '95/'98</A -></H1 -><P ->When using Windows 95 OEM SR2 the following updates are recommended where Samba -is being used. Please NOTE that the above change will affect you once these -updates have been installed.</P -><P -> -There are more updates than the ones mentioned here. You are referred to the -Microsoft Web site for all currently available updates to your specific version -of Windows 95.</P -><P -></P -><OL -TYPE="1" -><LI -><P ->Kernel Update: KRNLUPD.EXE</P -></LI -><LI -><P ->Ping Fix: PINGUPD.EXE</P -></LI -><LI -><P ->RPC Update: RPCRTUPD.EXE</P -></LI -><LI -><P ->TCP/IP Update: VIPUPD.EXE</P -></LI -><LI -><P ->Redirector Update: VRDRUPD.EXE</P -></LI -></OL -><P ->Also, if using MS OutLook it is desirable to install the OLEUPD.EXE fix. This -fix may stop your machine from hanging for an extended period when exiting -OutLook and you may also notice a significant speedup when accessing network -neighborhood services.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4611" ->30.5. Windows 2000 Service Pack 2</A -></H1 -><P -> -There are several annoyances with Windows 2000 SP2. One of which -only appears when using a Samba server to host user profiles -to Windows 2000 SP2 clients in a Windows domain. This assumes -that Samba is a member of the domain, but the problem will -likely occur if it is not.</P -><P -> -In order to server profiles successfully to Windows 2000 SP2 -clients (when not operating as a PDC), Samba must have -<B -CLASS="COMMAND" ->nt acl support = no</B -> -added to the file share which houses the roaming profiles. -If this is not done, then the Windows 2000 SP2 client will -complain about not being able to access the profile (Access -Denied) and create multiple copies of it on disk (DOMAIN.user.001, -DOMAIN.user.002, etc...). See the -<A -HREF="smb.conf.5.html" -TARGET="_top" ->smb.conf(5)</A -> man page -for more details on this option. Also note that the -<B -CLASS="COMMAND" ->nt acl support</B -> parameter was formally a global parameter in -releases prior to Samba 2.2.2.</P -><P -> -The following is a minimal profile share:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> [profile] - path = /export/profile - create mask = 0600 - directory mask = 0700 - nt acl support = no - read only = no</PRE -></P -><P ->The reason for this bug is that the Win2k SP2 client copies -the security descriptor for the profile which contains -the Samba server's SID, and not the domain SID. The client -compares the SID for SAMBA\user and realizes it is -different that the one assigned to DOMAIN\user. Hence the reason -for the "access denied" message.</P -><P ->By disabling the <B -CLASS="COMMAND" ->nt acl support</B -> parameter, Samba will send -the Win2k client a response to the QuerySecurityDescriptor -trans2 call which causes the client to set a default ACL -for the profile. This default ACL includes </P -><P -><B -CLASS="COMMAND" ->DOMAIN\user "Full Control"</B -></P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->This bug does not occur when using winbind to -create accounts on the Samba host for Domain users.</P -></TD -></TR -></TABLE -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4628" ->30.6. Windows NT 3.1</A -></H1 -><P ->If you have problems communicating across routers with Windows -NT 3.1 workstations, read <A -HREF="http://support.microsoft.com/default.aspx?scid=kb;[LN];Q103765" -TARGET="_top" ->this Microsoft Knowledge Base article</A ->. </P -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="portability.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="swat.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Portability</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="appendixes.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->SWAT - The Samba Web Admininistration Tool</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/policymgmt.html b/docs/htmldocs/policymgmt.html deleted file mode 100644 index 5d0c9b19f9..0000000000 --- a/docs/htmldocs/policymgmt.html +++ /dev/null @@ -1,758 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->System and Account Policies</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Advanced Configuration" -HREF="optional.html"><LINK -REL="PREVIOUS" -TITLE="Advanced Network Manangement" -HREF="advancednetworkmanagement.html"><LINK -REL="NEXT" -TITLE="Desktop Profile Management" -HREF="profilemgmt.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="advancednetworkmanagement.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="profilemgmt.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="POLICYMGMT" -></A ->Chapter 17. System and Account Policies</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->17.1. <A -HREF="policymgmt.html#AEN2958" ->Creating and Managing System Policies</A -></DT -><DD -><DL -><DT ->17.1.1. <A -HREF="policymgmt.html#AEN2972" ->Windows 9x/Me Policies</A -></DT -><DT ->17.1.2. <A -HREF="policymgmt.html#AEN2984" ->Windows NT4 Style Policy Files</A -></DT -><DT ->17.1.3. <A -HREF="policymgmt.html#AEN3002" ->MS Windows 200x / XP Professional Policies</A -></DT -></DL -></DD -><DT ->17.2. <A -HREF="policymgmt.html#AEN3030" ->Managing Account/User Policies</A -></DT -><DD -><DL -><DT ->17.2.1. <A -HREF="policymgmt.html#AEN3045" ->With Windows NT4/200x</A -></DT -><DT ->17.2.2. <A -HREF="policymgmt.html#AEN3048" ->With a Samba PDC</A -></DT -></DL -></DD -><DT ->17.3. <A -HREF="policymgmt.html#AEN3052" ->System Startup and Logon Processing Overview</A -></DT -></DL -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN2958" ->17.1. Creating and Managing System Policies</A -></H1 -><P ->Under MS Windows platforms, particularly those following the release of MS Windows -NT4 and MS Windows 95) it is possible to create a type of file that would be placed -in the NETLOGON share of a domain controller. As the client logs onto the network -this file is read and the contents initiate changes to the registry of the client -machine. This file allows changes to be made to those parts of the registry that -affect users, groups of users, or machines.</P -><P ->For MS Windows 9x/Me this file must be called <TT -CLASS="FILENAME" ->Config.POL</TT -> and may -be generated using a tool called <TT -CLASS="FILENAME" ->poledit.exe</TT ->, better known as the -Policy Editor. The policy editor was provided on the Windows 98 installation CD, but -dissappeared again with the introduction of MS Windows Me (Millenium Edition). From -comments from MS Windows network administrators it would appear that this tool became -a part of the MS Windows Me Resource Kit.</P -><P ->MS Windows NT4 Server products include the <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->System Policy Editor</I -></SPAN -> -under the <TT -CLASS="FILENAME" ->Start -> Programs -> Administrative Tools</TT -> menu item. -For MS Windows NT4 and later clients this file must be called <TT -CLASS="FILENAME" ->NTConfig.POL</TT ->.</P -><P ->New with the introduction of MS Windows 2000 was the Microsoft Management Console -or MMC. This tool is the new wave in the ever changing landscape of Microsoft -methods for management of network access and security. Every new Microsoft product -or technology seems to obsolete the old rules and to introduce newer and more -complex tools and methods. To Microsoft's credit though, the MMC does appear to -be a step forward, but improved functionality comes at a great price.</P -><P ->Before embarking on the configuration of network and system policies it is highly -advisable to read the documentation available from Microsoft's web site regarding -<A -HREF="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp" -TARGET="_top" ->Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp</A -> available from Microsoft. -There are a large number of documents in addition to this old one that should also -be read and understood. Try searching on the Microsoft web site for "Group Policies".</P -><P ->What follows is a very brief discussion with some helpful notes. The information provided -here is incomplete - you are warned.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN2972" ->17.1.1. Windows 9x/Me Policies</A -></H2 -><P ->You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. -It can be found on the Original full product Win98 installation CD under -<TT -CLASS="FILENAME" ->tools/reskit/netadmin/poledit</TT ->. Install this using the -Add/Remove Programs facility and then click on the 'Have Disk' tab.</P -><P ->Use the Group Policy Editor to create a policy file that specifies the location of -user profiles and/or the <TT -CLASS="FILENAME" ->My Documents</TT -> etc. stuff. Then -save these settings in a file called <TT -CLASS="FILENAME" ->Config.POL</TT -> that needs to -be placed in the root of the [NETLOGON] share. If Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the Win9x/Me registry -of the machine as it logs on.</P -><P ->Further details are covered in the Win98 Resource Kit documentation.</P -><P ->If you do not take the right steps, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings.</P -><P ->Install the group policy handler for Win9x to pick up group policies. Look on the -Win98 CD in <TT -CLASS="FILENAME" ->\tools\reskit\netadmin\poledit</TT ->. -Install group policies on a Win9x client by double-clicking -<TT -CLASS="FILENAME" ->grouppol.inf</TT ->. Log off and on again a couple of times and see -if Win98 picks up group policies. Unfortunately this needs to be done on every -Win9x/Me machine that uses group policies.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN2984" ->17.1.2. Windows NT4 Style Policy Files</A -></H2 -><P ->To create or edit <TT -CLASS="FILENAME" ->ntconfig.pol</TT -> you must use the NT Server -Policy Editor, <B -CLASS="COMMAND" ->poledit.exe</B -> which is included with NT4 Server -but <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->not NT Workstation</I -></SPAN ->. There is a Policy Editor on a NT4 -Workstation but it is not suitable for creating <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Domain Policies</I -></SPAN ->. -Further, although the Windows 95 Policy Editor can be installed on an NT4 -Workstation/Server, it will not work with NT clients. However, the files from -the NT Server will run happily enough on an NT4 Workstation.</P -><P ->You need <TT -CLASS="FILENAME" ->poledit.exe, common.adm</TT -> and <TT -CLASS="FILENAME" ->winnt.adm</TT ->. -It is convenient to put the two *.adm files in the <TT -CLASS="FILENAME" ->c:\winnt\inf</TT -> -directory which is where the binary will look for them unless told otherwise. Note also that that -directory is normally 'hidden'.</P -><P ->The Windows NT policy editor is also included with the Service Pack 3 (and -later) for Windows NT 4.0. Extract the files using <B -CLASS="COMMAND" ->servicepackname /x</B ->, -i.e. that's <B -CLASS="COMMAND" ->Nt4sp6ai.exe /x</B -> for service pack 6a. The policy editor, -<B -CLASS="COMMAND" ->poledit.exe</B -> and the associated template files (*.adm) should -be extracted as well. It is also possible to downloaded the policy template -files for Office97 and get a copy of the policy editor. Another possible -location is with the Zero Administration Kit available for download from Microsoft.</P -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN2999" ->17.1.2.1. Registry Tattoos</A -></H3 -><P -> With NT4 style registry based policy changes, a large number of settings are not - automatically reversed as the user logs off. Since the settings that were in the - NTConfig.POL file were applied to the client machine registry and that apply to the - hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known - as tattooing. It can have serious consequences down-stream and the administrator must - be extremely careful not to lock out the ability to manage the machine at a later date. - </P -></DIV -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3002" ->17.1.3. MS Windows 200x / XP Professional Policies</A -></H2 -><P ->Windows NT4 System policies allows setting of registry parameters specific to -users, groups and computers (client workstations) that are members of the NT4 -style domain. Such policy file will work with MS Windows 2000 / XP clients also.</P -><P ->New to MS Windows 2000 Microsoft introduced a new style of group policy that confers -a superset of capabilities compared with NT4 style policies. Obviously, the tool used -to create them is different, and the mechanism for implementing them is much changed.</P -><P ->The older NT4 style registry based policies are known as <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Administrative Templates</I -></SPAN -> -in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security -configurations, enforce Internet Explorer browser settings, change and redirect aspects of the -users' desktop (including: the location of <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->My Documents</I -></SPAN -> files (directory), as -well as intrinsics of where menu items will appear in the Start menu). An additional new -feature is the ability to make available particular software Windows applications to particular -users and/or groups.</P -><P ->Remember: NT4 policy files are named <TT -CLASS="FILENAME" ->NTConfig.POL</TT -> and are stored in the root -of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password -and selects the domain name to which the logon will attempt to take place. During the logon -process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating -server, modifies the local registry values according to the settings in this file.</P -><P ->Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of -a Windows 200x policy file is stored in the Active Directory itself and the other part is stored -in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active -Directory domain controllers. The part that is stored in the Active Directory itself is called the -group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is -known as the group policy template (GPT).</P -><P ->With NT4 clients the policy file is read and executed upon only aas each user log onto the network. -MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine -startup (machine specific part) and when the user logs onto the network the user specific part -is applied. In MS Windows 200x style policy management each machine and/or user may be subject -to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows -the administrator to also set filters over the policy settings. No such equivalent capability -exists with NT4 style policy files.</P -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3013" ->17.1.3.1. Administration of Win2K / XP Policies</A -></H3 -><DIV -CLASS="PROCEDURE" -><P -><B ->Instructions</B -></P -><P ->Instead of using the tool called "The System Policy Editor", commonly called Poledit (from the -executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console -(MMC) snap-in as follows:</P -><OL -TYPE="1" -><LI -><P ->Go to the Windows 200x / XP menu <TT -CLASS="FILENAME" ->Start->Programs->Administrative Tools</TT -> - and select the MMC snap-in called "Active Directory Users and Computers"</P -></LI -><LI -><P ->Select the domain or organizational unit (OU) that you wish to manage, then right click -to open the context menu for that object, select the properties item.</P -></LI -><LI -><P ->Now left click on the Group Policy tab, then left click on the New tab. Type a name -for the new policy you will create.</P -></LI -><LI -><P ->Now left click on the Edit tab to commence the steps needed to create the GPO.</P -></LI -></OL -></DIV -><P ->All policy configuration options are controlled through the use of policy administrative -templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. -Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x. -The later introduces many new features as well as extended definition capabilities. It is -well beyond the scope of this documentation to explain how to program .adm files, for that -the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular -version of MS Windows.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used -to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you -use this powerful tool. Please refer to the resource kit manuals for specific usage information.</P -></TD -></TR -></TABLE -></DIV -></DIV -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3030" ->17.2. Managing Account/User Policies</A -></H1 -><P ->Policies can define a specific user's settings or the settings for a group of users. The resulting -policy file contains the registry settings for all users, groups, and computers that will be using -the policy file. Separate policy files for each user, group, or computer are not not necessary.</P -><P ->If you create a policy that will be automatically downloaded from validating domain controllers, -you should name the file NTconfig.POL. As system administrator, you have the option of renaming the -policy file and, by modifying the Windows NT-based workstation, directing the computer to update -the policy from a manual path. You can do this by either manually changing the registry or by using -the System Policy Editor. This path can even be a local path such that each machine has its own policy file, -but if a change is necessary to all machines, this change must be made individually to each workstation.</P -><P ->When a Windows NT4/200x/XP machine logs onto the network the NETLOGON share on the authenticating domain -controller for the presence of the NTConfig.POL file. If one exists it is downloaded, parsed and then -applied to the user's part of the registry.</P -><P ->MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally, -acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory -itself. The key benefit of using AS GPOs is that they impose no registry <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->tatooing</I -></SPAN -> effect. -This has considerable advanage compared with the use of NTConfig.POL (NT4) style policy updates.</P -><P ->Inaddition to user access controls that may be imposed or applied via system and/or group policies -in a manner that works in conjunction with user profiles, the user management environment under -MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. -Common restrictions that are frequently used includes:</P -><P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->Logon Hours</TD -></TR -><TR -><TD ->Password Aging</TD -></TR -><TR -><TD ->Permitted Logon from certain machines only</TD -></TR -><TR -><TD ->Account type (Local or Global)</TD -></TR -><TR -><TD ->User Rights</TD -></TR -></TBODY -></TABLE -><P -></P -></P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3045" ->17.2.1. With Windows NT4/200x</A -></H2 -><P ->The tools that may be used to configure these types of controls from the MS Windows environment are: -The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). -Under MS Windows 200x/XP this is done using the Microsoft Managment Console (MMC) with approapriate -"snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3048" ->17.2.2. With a Samba PDC</A -></H2 -><P ->With a Samba Domain Controller, the new tools for managing of user account and policy information includes: -<TT -CLASS="FILENAME" ->smbpasswd, pdbedit, smbgroupedit, net, rpcclient.</TT ->. The administrator should read the -man pages for these tools and become familiar with their use.</P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3052" ->17.3. System Startup and Logon Processing Overview</A -></H1 -><P ->The following attempts to document the order of processing of system and user policies following a system -reboot and as part of the user logon:</P -><P -></P -><OL -TYPE="1" -><LI -><P -> Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming - Convention Provider (MUP) start - </P -></LI -><LI -><P -> Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded - and applied. The list may include GPOs that: -<P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->Apply to the location of machines in a Directory</TD -></TR -><TR -><TD ->Apply only when settings have changed</TD -></TR -><TR -><TD ->Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.</TD -></TR -></TBODY -></TABLE -><P -></P -> - No desktop user interface is presented until the above have been processed. - </P -></LI -><LI -><P -> Execution of start-up scripts (hidden and synchronous by defaut). - </P -></LI -><LI -><P -> A keyboard action to affect start of logon (Ctrl-Alt-Del). - </P -></LI -><LI -><P -> User credentials are validated, User profile is loaded (depends on policy settings). - </P -></LI -><LI -><P -> An ordered list of User GPOs is obtained. The list contents depends on what is configured in respsect of: - -<P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->Is user a domain member, thus subject to particular policies</TD -></TR -><TR -><TD ->Loopback enablement, and the state of the loopback policy (Merge or Replace)</TD -></TR -><TR -><TD ->Location of the Active Directory itself</TD -></TR -><TR -><TD ->Has the list of GPOs changed. No processing is needed if not changed.</TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -></LI -><LI -><P -> User Policies are applied from Active Directory. Note: There are several types. - </P -></LI -><LI -><P -> Logon scripts are run. New to Win2K and Active Directory, logon scripts may be obtained based on Group - Policy objects (hidden and executed synchronously). NT4 style logon scripts are then run in a normal - window. - </P -></LI -><LI -><P -> The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 - Domain) machine (system) policies are applied at start-up, User policies are applied at logon. - </P -></LI -></OL -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="advancednetworkmanagement.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="profilemgmt.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Advanced Network Manangement</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="optional.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Desktop Profile Management</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/portability.html b/docs/htmldocs/portability.html deleted file mode 100644 index ac3e5b9adb..0000000000 --- a/docs/htmldocs/portability.html +++ /dev/null @@ -1,418 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Portability</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Appendixes" -HREF="appendixes.html"><LINK -REL="PREVIOUS" -TITLE="Migration from NT4 PDC to Samba-3 PDC" -HREF="nt4migration.html"><LINK -REL="NEXT" -TITLE="Samba and other CIFS clients" -HREF="other-clients.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="nt4migration.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="other-clients.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="PORTABILITY" -></A ->Chapter 29. Portability</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->29.1. <A -HREF="portability.html#AEN4444" ->HPUX</A -></DT -><DT ->29.2. <A -HREF="portability.html#AEN4450" ->SCO Unix</A -></DT -><DT ->29.3. <A -HREF="portability.html#AEN4454" ->DNIX</A -></DT -><DT ->29.4. <A -HREF="portability.html#AEN4483" ->RedHat Linux Rembrandt-II</A -></DT -><DT ->29.5. <A -HREF="portability.html#AEN4489" ->AIX</A -></DT -><DT ->29.6. <A -HREF="portability.html#AEN4495" ->Solaris</A -></DT -></DL -></DIV -><P ->Samba works on a wide range of platforms but the interface all the -platforms provide is not always compatible. This chapter contains -platform-specific information about compiling and using samba.</P -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4444" ->29.1. HPUX</A -></H1 -><P ->HP's implementation of supplementary groups is, er, non-standard (for -hysterical reasons). There are two group files, /etc/group and -/etc/logingroup; the system maps UIDs to numbers using the former, but -initgroups() reads the latter. Most system admins who know the ropes -symlink /etc/group to /etc/logingroup (hard link doesn't work for reasons -too stupid to go into here). initgroups() will complain if one of the -groups you're in in /etc/logingroup has what it considers to be an invalid -ID, which means outside the range [0..UID_MAX], where UID_MAX is (I think) -60000 currently on HP-UX. This precludes -2 and 65534, the usual 'nobody' -GIDs.</P -><P ->If you encounter this problem, make sure that the programs that are failing -to initgroups() be run as users not in any groups with GIDs outside the -allowed range.</P -><P ->This is documented in the HP manual pages under setgroups(2) and passwd(4).</P -><P ->On HPUX you must use gcc or the HP Ansi compiler. The free compiler -that comes with HP-UX is not Ansi compliant and cannot compile -Samba.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4450" ->29.2. SCO Unix</A -></H1 -><P -> -If you run an old version of SCO Unix then you may need to get important -TCP/IP patches for Samba to work correctly. Without the patch, you may -encounter corrupt data transfers using samba.</P -><P ->The patch you need is UOD385 Connection Drivers SLS. It is available from -SCO (ftp.sco.com, directory SLS, files uod385a.Z and uod385a.ltr.Z).</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4454" ->29.3. DNIX</A -></H1 -><P ->DNIX has a problem with seteuid() and setegid(). These routines are -needed for Samba to work correctly, but they were left out of the DNIX -C library for some reason.</P -><P ->For this reason Samba by default defines the macro NO_EID in the DNIX -section of includes.h. This works around the problem in a limited way, -but it is far from ideal, some things still won't work right.</P -><P -> -To fix the problem properly you need to assemble the following two -functions and then either add them to your C library or link them into -Samba.</P -><P -> -put this in the file <TT -CLASS="FILENAME" ->setegid.s</TT ->:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> .globl _setegid -_setegid: - moveq #47,d0 - movl #100,a0 - moveq #1,d1 - movl 4(sp),a1 - trap #9 - bccs 1$ - jmp cerror -1$: - clrl d0 - rts</PRE -></P -><P ->put this in the file <TT -CLASS="FILENAME" ->seteuid.s</TT ->:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> .globl _seteuid -_seteuid: - moveq #47,d0 - movl #100,a0 - moveq #0,d1 - movl 4(sp),a1 - trap #9 - bccs 1$ - jmp cerror -1$: - clrl d0 - rts</PRE -></P -><P ->after creating the above files you then assemble them using</P -><P -><B -CLASS="COMMAND" ->as seteuid.s</B -></P -><P -><B -CLASS="COMMAND" ->as setegid.s</B -></P -><P ->that should produce the files <TT -CLASS="FILENAME" ->seteuid.o</TT -> and -<TT -CLASS="FILENAME" ->setegid.o</TT -></P -><P ->then you need to add these to the LIBSM line in the DNIX section of -the Samba Makefile. Your LIBSM line will then look something like this:</P -><P -><PRE -CLASS="PROGRAMLISTING" ->LIBSM = setegid.o seteuid.o -ln</PRE -></P -><P -> -You should then remove the line:</P -><P -><PRE -CLASS="PROGRAMLISTING" ->#define NO_EID</PRE -></P -><P ->from the DNIX section of <TT -CLASS="FILENAME" ->includes.h</TT -></P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4483" ->29.4. RedHat Linux Rembrandt-II</A -></H1 -><P ->By default RedHat Rembrandt-II during installation adds an -entry to /etc/hosts as follows: -<PRE -CLASS="PROGRAMLISTING" -> 127.0.0.1 loopback "hostname"."domainname"</PRE -></P -><P ->This causes Samba to loop back onto the loopback interface. -The result is that Samba fails to communicate correctly with -the world and therefor may fail to correctly negotiate who -is the master browse list holder and who is the master browser.</P -><P ->Corrective Action: Delete the entry after the word loopback - in the line starting 127.0.0.1</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4489" ->29.5. AIX</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4491" ->29.5.1. Sequential Read Ahead</A -></H2 -><P ->Disabling Sequential Read Ahead using <KBD -CLASS="USERINPUT" ->vmtune -r 0</KBD -> improves -samba performance significally.</P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4495" ->29.6. Solaris</A -></H1 -><P ->Some people have been experiencing problems with F_SETLKW64/fcntl -when running samba on solaris. The built in file locking mechanism was -not scalable. Performance would degrade to the point where processes would -get into loops of trying to lock a file. It woul try a lock, then fail, -then try again. The lock attempt was failing before the grant was -occurring. So the visible manifestation of this would be a handful of -processes stealing all of the CPU, and when they were trussed they would -be stuck if F_SETLKW64 loops.</P -><P ->Sun released patches for Solaris 2.6, 8, and 9. The patch for Solaris 7 -has not been released yet.</P -><P ->The patch revision for 2.6 is 105181-34 -for 8 is 108528-19 -and for 9 is 112233-04</P -><P ->After the install of these patches it is recommended to reconfigure -and rebuild samba.</P -><P ->Thanks to Joe Meslovich for reporting</P -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="nt4migration.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="other-clients.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Migration from NT4 PDC to Samba-3 PDC</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="appendixes.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Samba and other CIFS clients</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/profilemgmt.html b/docs/htmldocs/profilemgmt.html deleted file mode 100644 index 7357336193..0000000000 --- a/docs/htmldocs/profilemgmt.html +++ /dev/null @@ -1,1753 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Desktop Profile Management</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Advanced Configuration" -HREF="optional.html"><LINK -REL="PREVIOUS" -TITLE="System and Account Policies" -HREF="policymgmt.html"><LINK -REL="NEXT" -TITLE="Interdomain Trust Relationships" -HREF="interdomaintrusts.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="policymgmt.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="interdomaintrusts.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="PROFILEMGMT" -></A ->Chapter 18. Desktop Profile Management</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->18.1. <A -HREF="profilemgmt.html#AEN3095" ->Roaming Profiles</A -></DT -><DD -><DL -><DT ->18.1.1. <A -HREF="profilemgmt.html#AEN3102" ->Samba Configuration for Profile Handling</A -></DT -><DD -><DL -><DT ->18.1.1.1. <A -HREF="profilemgmt.html#AEN3105" ->NT4/200x User Profiles</A -></DT -><DT ->18.1.1.2. <A -HREF="profilemgmt.html#AEN3115" ->Windows 9x / Me User Profiles</A -></DT -><DT ->18.1.1.3. <A -HREF="profilemgmt.html#AEN3130" ->Mixed Windows 9x / Me and Windows NT4/200x User Profiles</A -></DT -></DL -></DD -><DT ->18.1.2. <A -HREF="profilemgmt.html#AEN3137" ->Windows Client Profile Configuration Information</A -></DT -><DD -><DL -><DT ->18.1.2.1. <A -HREF="profilemgmt.html#AEN3139" ->Windows 9x / Me Profile Setup</A -></DT -><DT ->18.1.2.2. <A -HREF="profilemgmt.html#AEN3175" ->Windows NT4 Workstation</A -></DT -><DT ->18.1.2.3. <A -HREF="profilemgmt.html#AEN3184" ->Windows 2000/XP Professional</A -></DT -></DL -></DD -><DT ->18.1.3. <A -HREF="profilemgmt.html#AEN3257" ->Sharing Profiles between W9x/Me and NT4/200x/XP workstations</A -></DT -><DT ->18.1.4. <A -HREF="profilemgmt.html#AEN3264" ->Profile Migration from Windows NT4/200x Server to Samba</A -></DT -><DD -><DL -><DT ->18.1.4.1. <A -HREF="profilemgmt.html#AEN3267" ->Windows NT4 Profile Management Tools</A -></DT -><DT ->18.1.4.2. <A -HREF="profilemgmt.html#AEN3290" ->Side bar Notes</A -></DT -><DT ->18.1.4.3. <A -HREF="profilemgmt.html#AEN3294" ->moveuser.exe</A -></DT -><DT ->18.1.4.4. <A -HREF="profilemgmt.html#AEN3297" ->Get SID</A -></DT -></DL -></DD -></DL -></DD -><DT ->18.2. <A -HREF="profilemgmt.html#AEN3302" ->Mandatory profiles</A -></DT -><DT ->18.3. <A -HREF="profilemgmt.html#AEN3309" ->Creating/Managing Group Profiles</A -></DT -><DT ->18.4. <A -HREF="profilemgmt.html#AEN3315" ->Default Profile for Windows Users</A -></DT -><DD -><DL -><DT ->18.4.1. <A -HREF="profilemgmt.html#AEN3318" ->MS Windows 9x/Me</A -></DT -><DT ->18.4.2. <A -HREF="profilemgmt.html#AEN3330" ->MS Windows NT4 Workstation</A -></DT -><DT ->18.4.3. <A -HREF="profilemgmt.html#AEN3384" ->MS Windows 200x/XP</A -></DT -></DL -></DD -></DL -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3095" ->18.1. Roaming Profiles</A -></H1 -><DIV -CLASS="WARNING" -><P -></P -><TABLE -CLASS="WARNING" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif" -HSPACE="5" -ALT="Warning"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Roaming profiles support is different for Win9x / Me and Windows NT4/200x.</P -></TD -></TR -></TABLE -></DIV -><P ->Before discussing how to configure roaming profiles, it is useful to see how -Windows 9x / Me and Windows NT4/200x clients implement these features.</P -><P ->Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's -profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X/Me -profiles are restricted to being stored in the user's home directory.</P -><P ->Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, -including a separate field for the location of the user's profiles.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3102" ->18.1.1. Samba Configuration for Profile Handling</A -></H2 -><P ->This section documents how to configure Samba for MS Windows client profile support.</P -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3105" ->18.1.1.1. NT4/200x User Profiles</A -></H3 -><P ->To support Windowns NT4/200x clients, in the [global] section of smb.conf set the -following (for example):</P -><P -><PRE -CLASS="PROGRAMLISTING" -> logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</PRE -> - - This is typically implemented like: - -<PRE -CLASS="PROGRAMLISTING" -> logon path = \\%L\Profiles\%u</PRE -> -where %L translates to the name of the Samba server and %u translates to the user name</P -><P ->The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. -The \\N%\%U service is created automatically by the [homes] service. If you are using -a samba server for the profiles, you _must_ make the share specified in the logon path -browseable. Please refer to the man page for smb.conf in respect of the different -symantics of %L and %N, as well as %U and %u.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the <B -CLASS="COMMAND" ->homes</B -> -meta-service name as part of the profile share path.</P -></TD -></TR -></TABLE -></DIV -></DIV -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3115" ->18.1.1.2. Windows 9x / Me User Profiles</A -></H3 -><P ->To support Windows 9x / Me clients, you must use the "logon home" parameter. Samba has -now been fixed so that <KBD -CLASS="USERINPUT" ->net use /home</KBD -> now works as well, and it, too, relies -on the <B -CLASS="COMMAND" ->logon home</B -> parameter.</P -><P ->By using the logon home parameter, you are restricted to putting Win9x / Me -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the <B -CLASS="COMMAND" ->[global]</B -> section of your <TT -CLASS="FILENAME" ->smb.conf</TT -> file:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> logon home = \\%L\%U\.profiles</PRE -></P -><P ->then your Windows 9x / Me clients will dutifully put their clients in a subdirectory -of your home directory called <TT -CLASS="FILENAME" ->.profiles</TT -> (thus making them hidden).</P -><P ->Not only that, but <KBD -CLASS="USERINPUT" ->net use/home</KBD -> will also work, because of a feature in -Windows 9x / Me. It removes any directory stuff off the end of the home directory area -and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for <B -CLASS="COMMAND" ->logon home</B ->.</P -></DIV -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3130" ->18.1.1.3. Mixed Windows 9x / Me and Windows NT4/200x User Profiles</A -></H3 -><P ->You can support profiles for both Win9X and WinNT clients by setting both the -<B -CLASS="COMMAND" ->logon home</B -> and <B -CLASS="COMMAND" ->logon path</B -> parameters. For example:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> logon home = \\%L\%u\.profiles - logon path = \\%L\profiles\%u</PRE -></P -></DIV -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3137" ->18.1.2. Windows Client Profile Configuration Information</A -></H2 -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3139" ->18.1.2.1. Windows 9x / Me Profile Setup</A -></H3 -><P ->When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts -in any of the profile folders.</P -><P ->The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file.</P -><P -></P -><OL -TYPE="1" -><LI -><P -> On the Windows 9x / Me machine, go to Control Panel -> Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. - </P -></LI -><LI -><P -> On the Windows 9x / Me machine, go to Control Panel -> Network -> - Client for Microsoft Networks -> Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer - to reboot. - </P -></LI -></OL -><P ->Under Windows 9x / Me Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, it would seem!</P -><P ->You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password.</P -><P ->Once the user has been successfully validated, the Windows 9x / Me machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'.</P -><P ->Once the Windows 9x / Me client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created.</P -><P ->These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set.</P -><P ->If you have made the folders / files read-only on the samba server, -then you will get errors from the Windows 9x / Me machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the Windows 9x / Me machine, check the Unix file -permissions and ownership rights on the profile directory contents, -on the samba server.</P -><P ->If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time".</P -><P -></P -><OL -TYPE="1" -><LI -><P -> instead of logging in under the [user, password, domain] dialog, - press escape. - </P -></LI -><LI -><P -> run the regedit.exe program, and look in: - </P -><P -> HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList - </P -><P -> you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. - - [Exit the registry editor]. - - </P -></LI -><LI -><P -> <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->WARNING</I -></SPAN -> - before deleting the contents of the - directory listed in the ProfilePath (this is likely to be - <TT -CLASS="FILENAME" ->c:\windows\profiles\username)</TT ->, ask them if they - have any important files stored on their desktop or in their start menu. - Delete the contents of the directory ProfilePath (making a backup if any - of the files are needed). - </P -><P -> This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. - </P -></LI -><LI -><P -> search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. - </P -></LI -><LI -><P -> log off the windows 9x / Me client. - </P -></LI -><LI -><P -> check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. - </P -></LI -></OL -><P ->If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as ethereal or netmon.exe, and -look for error messages.</P -><P ->If you have access to an Windows NT4/200x server, then first set up roaming profiles -and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine -the example packet traces provided with Windows NT4/200x server, and see what the -differences are with the equivalent samba trace.</P -></DIV -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3175" ->18.1.2.2. Windows NT4 Workstation</A -></H3 -><P ->When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter.</P -><P ->There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to <TT -CLASS="FILENAME" ->H:</TT -> or any other drive, and -should be used in conjunction with the new "logon home" parameter.</P -><P ->The entry for the NT4 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension -for those situations where it might be created.)</P -><P ->In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. -It creates "Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown.</P -><P ->You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one.</P -><P ->The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN.</P -></DIV -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3184" ->18.1.2.3. Windows 2000/XP Professional</A -></H3 -><P ->You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows:</P -><P -></P -><UL -><LI -><P -> Log on as the LOCAL workstation administrator. - </P -></LI -><LI -><P -> Right click on the 'My Computer' Icon, select 'Properties' - </P -></LI -><LI -><P -> Click on the 'User Profiles' tab - </P -></LI -><LI -><P -> Select the profile you wish to convert (click on it once) - </P -></LI -><LI -><P -> Click on the button 'Copy To' - </P -></LI -><LI -><P -> In the "Permitted to use" box, click on the 'Change' button. - </P -></LI -><LI -><P -> Click on the 'Look in" area that lists the machine name, when you click - here it will open up a selection box. Click on the domain to which the - profile must be accessible. - </P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="90%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->You will need to log on if a logon box opens up. Eg: In the connect - as: MIDEARTH\root, password: mypassword.</P -></TD -></TR -></TABLE -></DIV -></LI -><LI -><P -> To make the profile capable of being used by anyone select 'Everyone' - </P -></LI -><LI -><P -> Click OK. The Selection box will close. - </P -></LI -><LI -><P -> Now click on the 'Ok' button to create the profile in the path you - nominated. - </P -></LI -></UL -><P ->Done. You now have a profile that can be editted using the samba-3.0.0 -<TT -CLASS="FILENAME" ->profiles</TT -> tool.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Under NT/2K the use of mandotory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable.</P -></TD -></TR -></TABLE -></DIV -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P -></P -><UL -><LI -><P ->This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is:</P -><P ->"Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders"</P -><P ->...and it should be set to "Enabled". -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this.</P -><P ->If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy):</P -></LI -><LI -><P ->On the XP workstation log in with an Administrator account.</P -></LI -><LI -><P ->Click: "Start", "Run"</P -></LI -><LI -><P ->Type: "mmc"</P -></LI -><LI -><P ->Click: "OK"</P -></LI -><LI -><P ->A Microsoft Management Console should appear.</P -></LI -><LI -><P ->Click: File, "Add/Remove Snap-in...", "Add"</P -></LI -><LI -><P ->Double-Click: "Group Policy"</P -></LI -><LI -><P ->Click: "Finish", "Close"</P -></LI -><LI -><P ->Click: "OK"</P -></LI -><LI -><P ->In the "Console Root" window:</P -></LI -><LI -><P ->Expand: "Local Computer Policy", "Computer Configuration",</P -></LI -><LI -><P ->"Administrative Templates", "System", "User Profiles"</P -></LI -><LI -><P ->Double-Click: "Do not check for user ownership of Roaming Profile</P -></LI -><LI -><P ->Folders"</P -></LI -><LI -><P ->Select: "Enabled"</P -></LI -><LI -><P ->Click: OK"</P -></LI -><LI -><P ->Close the whole console. You do not need to save the settings (this - refers to the console settings rather than the policies you have - changed).</P -></LI -><LI -><P ->Reboot</P -></LI -></UL -></TD -></TR -></TABLE -></DIV -></DIV -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3257" ->18.1.3. Sharing Profiles between W9x/Me and NT4/200x/XP workstations</A -></H2 -><P ->Sharing of desktop profiles between Windows versions is NOT recommended. -Desktop profiles are an evolving phenomenon and profiles for later versions -of MS Windows clients add features that may interfere with earlier versions -of MS Windows clients. Probably the more salient reason to NOT mix profiles -is that when logging off an earlier version of MS Windows the older format -of profile contents may overwrite information that belongs to the newer -version resulting in loss of profile information content when that user logs -on again with the newer version of MS Windows.</P -><P ->If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->logon path</I -></SPAN -> and -<SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->logon home</I -></SPAN ->.</P -><P ->If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3264" ->18.1.4. Profile Migration from Windows NT4/200x Server to Samba</A -></H2 -><P ->There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords.</P -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3267" ->18.1.4.1. Windows NT4 Profile Management Tools</A -></H3 -><P ->Unfortunately, the Resource Kit information is specific to the version of MS Windows -NT4/200x. The correct resource kit is required for each platform.</P -><P ->Here is a quick guide:</P -><P -></P -><UL -><LI -><P ->On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'.</P -></LI -><LI -><P ->Select a user profile you want to migrate and click on it.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="90%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->I am using the term "migrate" lossely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC.</P -></TD -></TR -></TABLE -></DIV -></LI -><LI -><P ->Click the 'Copy To' button.</P -></LI -><LI -><P ->In the box labelled 'Copy Profile to' add your new path, eg: - <TT -CLASS="FILENAME" ->c:\temp\foobar</TT -></P -></LI -><LI -><P ->Click on the button labelled 'Change' in the "Permitted to use" box.</P -></LI -><LI -><P ->Click on the group 'Everyone' and then click OK. This closes the - 'chose user' box.</P -></LI -><LI -><P ->Now click OK.</P -></LI -></UL -><P ->Follow the above for every profile you need to migrate.</P -></DIV -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3290" ->18.1.4.2. Side bar Notes</A -></H3 -><P ->You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.</P -><P ->With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users.</P -></DIV -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3294" ->18.1.4.3. moveuser.exe</A -></H3 -><P ->The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change.</P -></DIV -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3297" ->18.1.4.4. Get SID</A -></H3 -><P ->You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit.</P -><P ->Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList</P -><P ->Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath.</P -></DIV -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3302" ->18.2. Mandatory profiles</A -></H1 -><P ->A Mandatory Profile is a profile that the user does NOT have the ability to overwrite. -During the user's session it may be possible to change the desktop environment, but -as the user logs out all changes made will be lost. If it is desired to NOT allow the -user any ability to change the desktop environment then this must be done through -policy settings. See previous chapter.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->Under NO circumstances should the profile directory (or it's contents) be made read-only -as this may render the profile un-usable.</P -></TD -></TR -></TABLE -></DIV -><P ->For MS Windows NT4/200x/XP the above method can be used to create mandatory profiles -also. To convert a group profile into a mandatory profile simply locate the NTUser.DAT -file in the copied profile and rename it to NTUser.MAN.</P -><P ->For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to -affect a mandatory profile.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3309" ->18.3. Creating/Managing Group Profiles</A -></H1 -><P ->Most organisations are arranged into departments. There is a nice benenfit in -this fact since usually most users in a department will require the same desktop -applications and the same desktop layout. MS Windows NT4/200x/XP will allow the -use of Group Profiles. A Group Profile is a profile that is created firstly using -a template (example) user. Then using the profile migration tool (see above) the -profile is assigned access rights for the user group that needs to be given access -to the group profile.</P -><P ->The next step is rather important. PLEASE NOTE: Instead of assigning a group profile -to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned -the now modified profile.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P -> Be careful with group profiles, if the user who is a member of a group also - has a personal profile, then the result will be a fusion (merge) of the two. - </P -></TD -></TR -></TABLE -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3315" ->18.4. Default Profile for Windows Users</A -></H1 -><P ->MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom -a profile does not already exist. Armed with a knowledge of where the default profile -is located on the Windows workstation, and knowing which registry keys affect the path -from which the default profile is created, it is possible to modify the default profile -to one that has been optimised for the site. This has significant administrative -advantages.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3318" ->18.4.1. MS Windows 9x/Me</A -></H2 -><P ->To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System -Policy Editor or change the registry directly.</P -><P ->To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then -select File -> Open Registry, then click on the Local Computer icon, click on Windows 98 System, -select User Profiles, click on the enable box. Do not forget to save the registry changes.</P -><P ->To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive -<TT -CLASS="FILENAME" ->HKEY_LOCAL_MACHINE\Network\Logon</TT ->. Now add a DWORD type key with the name -"User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0.</P -><DIV -CLASS="SECT3" -><H3 -CLASS="SECT3" -><A -NAME="AEN3324" ->18.4.1.1. How User Profiles Are Handled in Windows 9x / Me?</A -></H3 -><P ->When a user logs on to a Windows 9x / Me machine, the local profile path, -<TT -CLASS="FILENAME" ->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList</TT ->, is checked -for an existing entry for that user:</P -><P ->If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached -version of the user profile. Windows 9x / Me also checks the user's home directory (or other -specified directory if the location has been modified) on the server for the User Profile. -If a profile exists in both locations, the newer of the two is used. If the User Profile exists -on the server, but does not exist on the local machine, the profile on the server is downloaded -and used. If the User Profile only exists on the local machine, that copy is used.</P -><P ->If a User Profile is not found in either location, the Default User Profile from the Windows 9x / Me -machine is used and is copied to a newly created folder for the logged on user. At log off, any -changes that the user made are written to the user's local profile. If the user has a roaming -profile, the changes are written to the user's profile on the server.</P -></DIV -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3330" ->18.4.2. MS Windows NT4 Workstation</A -></H2 -><P ->On MS Windows NT4 the default user profile is obtained from the location -<TT -CLASS="FILENAME" ->%SystemRoot%\Profiles</TT -> which in a default installation will translate to -<TT -CLASS="FILENAME" ->C:\WinNT\Profiles</TT ->. Under this directory on a clean install there will be -three (3) directories: <TT -CLASS="FILENAME" ->Administrator, All Users, Default User</TT ->.</P -><P ->The <TT -CLASS="FILENAME" ->All Users</TT -> directory contains menu settings that are common across all -system users. The <TT -CLASS="FILENAME" ->Default User</TT -> directory contains menu entries that are -customisable per user depending on the profile settings chosen/created.</P -><P ->When a new user first logs onto an MS Windows NT4 machine a new profile is created from:</P -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->All Users settings</TD -></TR -><TR -><TD ->Default User settings (contains the default NTUser.DAT file)</TD -></TR -></TBODY -></TABLE -><P -></P -><P ->When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain -the following steps are followed in respect of profile handling:</P -><P -></P -><OL -TYPE="1" -><LI -><P -> The users' account information which is obtained during the logon process contains - the location of the users' desktop profile. The profile path may be local to the - machine or it may be located on a network share. If there exists a profile at the location - of the path from the user account, then this profile is copied to the location - <TT -CLASS="FILENAME" ->%SystemRoot%\Profiles\%USERNAME%</TT ->. This profile then inherits the - settings in the <TT -CLASS="FILENAME" ->All Users</TT -> profile in the <TT -CLASS="FILENAME" ->%SystemRoot%\Profiles</TT -> - location. - </P -></LI -><LI -><P -> If the user account has a profile path, but at it's location a profile does not exist, - then a new profile is created in the <TT -CLASS="FILENAME" ->%SystemRoot%\Profiles\%USERNAME%</TT -> - directory from reading the <TT -CLASS="FILENAME" ->Default User</TT -> profile. - </P -></LI -><LI -><P -> If the NETLOGON share on the authenticating server (logon server) contains a policy file - (<TT -CLASS="FILENAME" ->NTConfig.POL</TT ->) then it's contents are applied to the <TT -CLASS="FILENAME" ->NTUser.DAT</TT -> - which is applied to the <TT -CLASS="FILENAME" ->HKEY_CURRENT_USER</TT -> part of the registry. - </P -></LI -><LI -><P -> When the user logs out, if the profile is set to be a roaming profile it will be written - out to the location of the profile. The <TT -CLASS="FILENAME" ->NTuser.DAT</TT -> file is then - re-created from the contents of the <TT -CLASS="FILENAME" ->HKEY_CURRENT_USER</TT -> contents. - Thus, should there not exist in the NETLOGON share an <TT -CLASS="FILENAME" ->NTConfig.POL</TT -> at the - next logon, the effect of the provious <TT -CLASS="FILENAME" ->NTConfig.POL</TT -> will still be held - in the profile. The effect of this is known as <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->tatooing</I -></SPAN ->. - </P -></LI -></OL -><P ->MS Windows NT4 profiles may be <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Local</I -></SPAN -> or <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Roaming</I -></SPAN ->. A Local profile -will stored in the <TT -CLASS="FILENAME" ->%SystemRoot%\Profiles\%USERNAME%</TT -> location. A roaming profile will -also remain stored in the same way, unless the following registry key is created:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\ - "DeleteRoamingCache"=dword:00000001</PRE -> - -In which case, the local copy (in <TT -CLASS="FILENAME" ->%SystemRoot%\Profiles\%USERNAME%</TT ->) will be -deleted on logout.</P -><P ->Under MS Windows NT4 default locations for common resources (like <TT -CLASS="FILENAME" ->My Documents</TT -> -may be redirected to a network share by modifying the following registry keys. These changes may be affected -via use of the System Policy Editor (to do so may require that you create your owns template extension -for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first -creating a default user profile, then while logged in as that user, run regedt32 to edit the key settings.</P -><P ->The Registry Hive key that affects the behaviour of folders that are part of the default user profile -are controlled by entries on Windows NT4 is:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> HKEY_CURRENT_USER - \Software - \Microsoft - \Windows - \CurrentVersion - \Explorer - \User Shell Folders\</PRE -></P -><P ->The above hive key contains a list of automatically managed folders. The default entries are:</P -><P -> <PRE -CLASS="PROGRAMLISTING" -> Name Default Value - -------------- ----------------------------------------- - AppData %USERPROFILE%\Application Data - Desktop %USERPROFILE%\Desktop - Favorites %USERPROFILE%\Favorites - NetHood %USERPROFILE%\NetHood - PrintHood %USERPROFILE%\PrintHood - Programs %USERPROFILE%\Start Menu\Programs - Recent %USERPROFILE%\Recent - SendTo %USERPROFILE%\SendTo - Start Menu %USERPROFILE%\Start Menu - Startup %USERPROFILE%\Start Menu\Programs\Startup - </PRE -> - </P -><P ->The registry key that contains the location of the default profile settings is: - -<PRE -CLASS="PROGRAMLISTING" -> HKEY_LOCAL_MACHINE - \SOFTWARE - \Microsoft - \Windows - \CurrentVersion - \Explorer - \User Shell Folders</PRE -> - -The default entries are: - -<PRE -CLASS="PROGRAMLISTING" -> Common Desktop %SystemRoot%\Profiles\All Users\Desktop - Common Programs %SystemRoot%\Profiles\All Users\Programs - Common Start Menu %SystemRoot%\Profiles\All Users\Start Menu - Common Startu p %SystemRoot%\Profiles\All Users\Start Menu\Progams\Startup</PRE -></P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3384" ->18.4.3. MS Windows 200x/XP</A -></H2 -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P -> MS Windows XP Home Edition does use default per user profiles, but can not participate - in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile - only from itself. While there are benefits in doing this the beauty of those MS Windows - clients that CAN participate in domain logon processes allows the administrator to create - a global default profile and to enforce it through the use of Group Policy Objects (GPOs). - </P -></TD -></TR -></TABLE -></DIV -><P ->When a new user first logs onto MS Windows 200x/XP machine the default profile is obtained from -<TT -CLASS="FILENAME" ->C:\Documents and Settings\Default User</TT ->. The administrator can modify (or change -the contents of this location and MS Windows 200x/XP will gladly user it. This is far from the optimum -arrangement since it will involve copying a new default profile to every MS Windows 200x/XP client -workstation. </P -><P ->When MS Windows 200x/XP participate in a domain security context, and if the default user -profile is not found, then the client will search for a default profile in the NETLOGON share -of the authenticating server. ie: In MS Windows parlance: -<TT -CLASS="FILENAME" ->%LOGONSERVER%\NETLOGON\Default User</TT -> and if one exits there it will copy this -to the workstation to the <TT -CLASS="FILENAME" ->C:\Documents and Settings\</TT -> under the Windows -login name of the user.</P -><DIV -CLASS="NOTE" -><P -></P -><TABLE -CLASS="NOTE" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P -> This path translates, in Samba parlance, to the smb.conf [NETLOGON] share. The directory - should be created at the root of this share and msut be called <TT -CLASS="FILENAME" ->Default Profile</TT ->. - </P -></TD -></TR -></TABLE -></DIV -><P ->If a default profile does not exist in this location then MS Windows 200x/XP will use the local -default profile.</P -><P ->On loging out, the users' desktop profile will be stored to the location specified in the registry -settings that pertain to the user. If no specific policies have been created, or passed to the client -during the login process (as Samba does automatically), then the user's profile will be written to -the local machine only under the path <TT -CLASS="FILENAME" ->C:\Documents and Settings\%USERNAME%</TT ->.</P -><P ->Those wishing to modify the default behaviour can do so through up to three methods:</P -><P -></P -><UL -><LI -><P -> Modify the registry keys on the local machine manually and place the new default profile in the - NETLOGON share root - NOT recommended as it is maintenance intensive. - </P -></LI -><LI -><P -> Create an NT4 style NTConfig.POL file that specified this behaviour and locate this file - in the root of the NETLOGON share along with the new default profile. - </P -></LI -><LI -><P -> Create a GPO that enforces this through Active Directory, and place the new default profile - in the NETLOGON share. - </P -></LI -></UL -><P ->The Registry Hive key that affects the behaviour of folders that are part of the default user profile -are controlled by entries on Windows 200x/XP is:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> HKEY_CURRENT_USER - \Software - \Microsoft - \Windows - \CurrentVersion - \Explorer - \User Shell Folders\</PRE -></P -><P ->The above hive key contains a list of automatically managed folders. The default entries are:</P -><P -> <PRE -CLASS="PROGRAMLISTING" -> Name Default Value - -------------- ----------------------------------------- - AppData %USERPROFILE%\Application Data - Cache %USERPROFILE%\Local Settings\Temporary Internet Files - Cookies %USERPROFILE%\Cookies - Desktop %USERPROFILE%\Desktop - Favorites %USERPROFILE%\Favorites - History %USERPROFILE%\Local Settings\History - Local AppData %USERPROFILE%\Local Settings\Application Data - Local Settings %USERPROFILE%\Local Settings - My Pictures %USERPROFILE%\My Documents\My Pictures - NetHood %USERPROFILE%\NetHood - Personal %USERPROFILE%\My Documents - PrintHood %USERPROFILE%\PrintHood - Programs %USERPROFILE%\Start Menu\Programs - Recent %USERPROFILE%\Recent - SendTo %USERPROFILE%\SendTo - Start Menu %USERPROFILE%\Start Menu - Startup %USERPROFILE%\Start Menu\Programs\Startup - Templates %USERPROFILE%\Templates - </PRE -> - </P -><P ->There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all -the others are of type REG_EXPAND_SZ.</P -><P ->It makes a huge difference to the speed of handling roaming user profiles if all the folders are -stored on a dedicated location on a network server. This means that it will NOT be necessary to -write Outlook PST file over the network for every login and logout.</P -><P ->To set this to a network location you could use the following examples: - -<PRE -CLASS="PROGRAMLISTING" -> %LOGONSERVER%\%USERNAME%\Default Folders</PRE -> - -This would store the folders in the user's home directory under a directory called "Default Folders" - -You could also use: - -<PRE -CLASS="PROGRAMLISTING" -> \\SambaServer\FolderShare\%USERNAME%</PRE -> - -in which case the default folders will be stored in the server named <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->SambaServer</I -></SPAN -> -in the share called <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->FolderShare</I -></SPAN -> under a directory that has the name of the MS Windows -user as seen by the Linux/Unix file system.</P -><P ->Please note that once you have created a default profile share, you MUST migrate a user's profile -(default or custom) to it.</P -><P ->MS Windows 200x/XP profiles may be <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Local</I -></SPAN -> or <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Roaming</I -></SPAN ->. -A roaming profile will be cached locally unless the following registry key is created:</P -><P -><PRE -CLASS="PROGRAMLISTING" -> HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\ - "DeleteRoamingCache"=dword:00000001</PRE -> - -In which case, the local cache copy will be deleted on logout.</P -></DIV -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="policymgmt.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="interdomaintrusts.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->System and Account Policies</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="optional.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Interdomain Trust Relationships</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/samba-howto-collection.html b/docs/htmldocs/samba-howto-collection.html deleted file mode 100644 index 3d2a95873e..0000000000 --- a/docs/htmldocs/samba-howto-collection.html +++ /dev/null @@ -1,1394 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->SAMBA Project Documentation</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="NEXT" -TITLE="General installation" -HREF="introduction.html"></HEAD -><BODY -CLASS="BOOK" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="BOOK" -><A -NAME="SAMBA-HOWTO-COLLECTION" -></A -><DIV -CLASS="TITLEPAGE" -><H1 -CLASS="TITLE" -><A -NAME="SAMBA-HOWTO-COLLECTION" ->SAMBA Project Documentation</A -></H1 -><H3 -CLASS="AUTHOR" -><A -NAME="AEN4" -></A ->SAMBA Team</H3 -><DIV -CLASS="AFFILIATION" -><DIV -CLASS="ADDRESS" -><P -CLASS="ADDRESS" -><CODE -CLASS="EMAIL" -><<A -HREF="mailto:samba@samba.org" ->samba@samba.org</A ->></CODE -></P -></DIV -></DIV -><H4 -CLASS="EDITEDBY" ->Edited by</H4 -><H3 -CLASS="EDITOR" ->Jelmer R. Vernooij</H3 -><H3 -CLASS="EDITOR" ->John H. Terpstra</H3 -><H3 -CLASS="EDITOR" ->Gerald (Jerry) Carter</H3 -><DIV -><DIV -CLASS="ABSTRACT" -><P -></P -><A -NAME="AEN34" -></A -><P ->This book is a collection of HOWTOs added to Samba documentation over the years. -Samba is always under development, and so is it's documentation. -The most recent version of this document -can be found at <A -HREF="http://www.samba.org/" -TARGET="_top" ->http://www.samba.org/</A -> -on the "Documentation" page. Please send updates to <A -HREF="mailto:jerry@samba.org" -TARGET="_top" ->jerry@samba.org</A -> or -<A -HREF="mailto:jelmer@samba.org" -TARGET="_top" ->jelmer@samba.org</A ->.</P -><P -></P -></DIV -></DIV -><DIV -CLASS="LEGALNOTICE" -><P -></P -><A -NAME="AEN39" -></A -><P ->This documentation is distributed under the GNU General Public License (GPL) -version 2. A copy of the license is included with the Samba source -distribution. A copy can be found on-line at <A -HREF="http://www.fsf.org/licenses/gpl.txt" -TARGET="_top" ->http://www.fsf.org/licenses/gpl.txt</A -></P -><P -></P -></DIV -><HR></DIV -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->I. <A -HREF="introduction.html" ->General installation</A -></DT -><DD -><DL -><DT ->1. <A -HREF="introsmb.html" ->Introduction to Samba</A -></DT -><DD -><DL -><DT ->1.1. <A -HREF="introsmb.html#AEN61" ->Background</A -></DT -><DT ->1.2. <A -HREF="introsmb.html#AEN67" ->Terminology</A -></DT -><DT ->1.3. <A -HREF="introsmb.html#AEN91" ->Related Projects</A -></DT -><DT ->1.4. <A -HREF="introsmb.html#AEN100" ->SMB Methodology</A -></DT -><DT ->1.5. <A -HREF="introsmb.html#AEN115" ->Additional Resources</A -></DT -><DT ->1.6. <A -HREF="introsmb.html#AEN151" ->Epilogue</A -></DT -><DT ->1.7. <A -HREF="introsmb.html#AEN162" ->Miscellaneous</A -></DT -></DL -></DD -><DT ->2. <A -HREF="install.html" ->How to Install and Test SAMBA</A -></DT -><DD -><DL -><DT ->2.1. <A -HREF="install.html#AEN187" ->Obtaining and installing samba</A -></DT -><DT ->2.2. <A -HREF="install.html#AEN193" ->Configuring samba</A -></DT -><DT ->2.3. <A -HREF="install.html#AEN229" ->Try listing the shares available on your - server</A -></DT -><DT ->2.4. <A -HREF="install.html#AEN238" ->Try connecting with the unix client</A -></DT -><DT ->2.5. <A -HREF="install.html#AEN259" ->Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client</A -></DT -><DT ->2.6. <A -HREF="install.html#AEN272" ->What If Things Don't Work?</A -></DT -></DL -></DD -><DT ->3. <A -HREF="browsing-quick.html" ->Quick Cross Subnet Browsing / Cross Workgroup Browsing guide</A -></DT -><DD -><DL -><DT ->3.1. <A -HREF="browsing-quick.html#AEN305" ->Discussion</A -></DT -><DT ->3.2. <A -HREF="browsing-quick.html#AEN326" ->How browsing functions and how to deploy stable and -dependable browsing using Samba</A -></DT -><DT ->3.3. <A -HREF="browsing-quick.html#AEN340" ->Use of the <B -CLASS="COMMAND" ->Remote Announce</B -> parameter</A -></DT -><DT ->3.4. <A -HREF="browsing-quick.html#AEN363" ->Use of the <B -CLASS="COMMAND" ->Remote Browse Sync</B -> parameter</A -></DT -><DT ->3.5. <A -HREF="browsing-quick.html#AEN374" ->Use of WINS</A -></DT -><DT ->3.6. <A -HREF="browsing-quick.html#AEN400" ->Do NOT use more than one (1) protocol on MS Windows machines</A -></DT -><DT ->3.7. <A -HREF="browsing-quick.html#AEN408" ->Name Resolution Order</A -></DT -></DL -></DD -><DT ->4. <A -HREF="passdb.html" ->User information database</A -></DT -><DD -><DL -><DT ->4.1. <A -HREF="passdb.html#AEN468" ->Introduction</A -></DT -><DT ->4.2. <A -HREF="passdb.html#AEN475" ->Important Notes About Security</A -></DT -><DT ->4.3. <A -HREF="passdb.html#AEN513" ->The smbpasswd Command</A -></DT -><DT ->4.4. <A -HREF="passdb.html#AEN544" ->Plain text</A -></DT -><DT ->4.5. <A -HREF="passdb.html#AEN549" ->TDB</A -></DT -><DT ->4.6. <A -HREF="passdb.html#AEN552" ->LDAP</A -></DT -><DT ->4.7. <A -HREF="passdb.html#AEN765" ->MySQL</A -></DT -><DT ->4.8. <A -HREF="passdb.html#AEN807" ->XML</A -></DT -></DL -></DD -></DL -></DD -><DT ->II. <A -HREF="type.html" ->Type of installation</A -></DT -><DD -><DL -><DT ->5. <A -HREF="servertype.html" ->Nomenclature of Server Types</A -></DT -><DD -><DL -><DT ->5.1. <A -HREF="servertype.html#AEN846" ->Stand Alone Server</A -></DT -><DT ->5.2. <A -HREF="servertype.html#AEN853" ->Domain Member Server</A -></DT -><DT ->5.3. <A -HREF="servertype.html#AEN859" ->Domain Controller</A -></DT -></DL -></DD -><DT ->6. <A -HREF="securitylevels.html" ->Samba as Stand-Alone Server</A -></DT -><DD -><DL -><DT ->6.1. <A -HREF="securitylevels.html#AEN896" ->User and Share security level</A -></DT -></DL -></DD -><DT ->7. <A -HREF="samba-pdc.html" ->Samba as an NT4 or Win2k Primary Domain Controller</A -></DT -><DD -><DL -><DT ->7.1. <A -HREF="samba-pdc.html#AEN1009" ->Prerequisite Reading</A -></DT -><DT ->7.2. <A -HREF="samba-pdc.html#AEN1013" ->Background</A -></DT -><DT ->7.3. <A -HREF="samba-pdc.html#AEN1053" ->Configuring the Samba Domain Controller</A -></DT -><DT ->7.4. <A -HREF="samba-pdc.html#AEN1095" ->Creating Machine Trust Accounts and Joining Clients to the Domain</A -></DT -><DT ->7.5. <A -HREF="samba-pdc.html#AEN1211" ->Common Problems and Errors</A -></DT -><DT ->7.6. <A -HREF="samba-pdc.html#AEN1240" ->Domain Control for Windows 9x/ME</A -></DT -></DL -></DD -><DT ->8. <A -HREF="samba-bdc.html" ->Samba Backup Domain Controller to Samba Domain Control</A -></DT -><DD -><DL -><DT ->8.1. <A -HREF="samba-bdc.html#AEN1293" ->Prerequisite Reading</A -></DT -><DT ->8.2. <A -HREF="samba-bdc.html#AEN1297" ->Background</A -></DT -><DT ->8.3. <A -HREF="samba-bdc.html#AEN1305" ->What qualifies a Domain Controller on the network?</A -></DT -><DT ->8.4. <A -HREF="samba-bdc.html#AEN1314" ->Can Samba be a Backup Domain Controller to an NT PDC?</A -></DT -><DT ->8.5. <A -HREF="samba-bdc.html#AEN1319" ->How do I set up a Samba BDC?</A -></DT -></DL -></DD -><DT ->9. <A -HREF="ads.html" ->Samba as a ADS domain member</A -></DT -><DD -><DL -><DT ->9.1. <A -HREF="ads.html#AEN1363" ->Setup your <TT -CLASS="FILENAME" ->smb.conf</TT -></A -></DT -><DT ->9.2. <A -HREF="ads.html#AEN1376" ->Setup your <TT -CLASS="FILENAME" ->/etc/krb5.conf</TT -></A -></DT -><DT ->9.3. <A -HREF="ads.html#ADS-CREATE-MACHINE-ACCOUNT" ->Create the computer account</A -></DT -><DT ->9.4. <A -HREF="ads.html#ADS-TEST-SERVER" ->Test your server setup</A -></DT -><DT ->9.5. <A -HREF="ads.html#ADS-TEST-SMBCLIENT" ->Testing with <SPAN -CLASS="APPLICATION" ->smbclient</SPAN -></A -></DT -><DT ->9.6. <A -HREF="ads.html#AEN1424" ->Notes</A -></DT -></DL -></DD -><DT ->10. <A -HREF="domain-member.html" ->Samba as a NT4 or Win2k domain member</A -></DT -><DD -><DL -><DT ->10.1. <A -HREF="domain-member.html#AEN1447" ->Joining an NT Domain with Samba 3.0</A -></DT -><DT ->10.2. <A -HREF="domain-member.html#AEN1501" ->Why is this better than security = server?</A -></DT -></DL -></DD -></DL -></DD -><DT ->III. <A -HREF="optional.html" ->Advanced Configuration</A -></DT -><DD -><DL -><DT ->11. <A -HREF="unix-permissions.html" ->UNIX Permission Bits and Windows NT Access Control Lists</A -></DT -><DD -><DL -><DT ->11.1. <A -HREF="unix-permissions.html#AEN1533" ->Viewing and changing UNIX permissions using the NT - security dialogs</A -></DT -><DT ->11.2. <A -HREF="unix-permissions.html#AEN1539" ->How to view file security on a Samba share</A -></DT -><DT ->11.3. <A -HREF="unix-permissions.html#AEN1550" ->Viewing file ownership</A -></DT -><DT ->11.4. <A -HREF="unix-permissions.html#AEN1570" ->Viewing file or directory permissions</A -></DT -><DT ->11.5. <A -HREF="unix-permissions.html#AEN1606" ->Modifying file or directory permissions</A -></DT -><DT ->11.6. <A -HREF="unix-permissions.html#AEN1628" ->Interaction with the standard Samba create mask - parameters</A -></DT -><DT ->11.7. <A -HREF="unix-permissions.html#AEN1681" ->Interaction with the standard Samba file attribute - mapping</A -></DT -></DL -></DD -><DT ->12. <A -HREF="groupmapping.html" ->Configuring Group Mapping</A -></DT -><DT ->13. <A -HREF="printing.html" ->Printing Support</A -></DT -><DD -><DL -><DT ->13.1. <A -HREF="printing.html#AEN1744" ->Introduction</A -></DT -><DT ->13.2. <A -HREF="printing.html#AEN1766" ->Configuration</A -></DT -><DT ->13.3. <A -HREF="printing.html#AEN1878" ->The Imprints Toolset</A -></DT -><DT ->13.4. <A -HREF="printing.html#AEN1921" ->Diagnosis</A -></DT -></DL -></DD -><DT ->14. <A -HREF="cups-printing.html" ->CUPS Printing Support</A -></DT -><DD -><DL -><DT ->14.1. <A -HREF="cups-printing.html#AEN2034" ->Introduction</A -></DT -><DT ->14.2. <A -HREF="cups-printing.html#AEN2041" ->Configuring <TT -CLASS="FILENAME" ->smb.conf</TT -> for CUPS</A -></DT -><DT ->14.3. <A -HREF="cups-printing.html#AEN2061" ->CUPS - RAW Print Through Mode</A -></DT -><DT ->14.4. <A -HREF="cups-printing.html#AEN2118" ->CUPS as a network PostScript RIP -- CUPS drivers working on server, Adobe -PostScript driver with CUPS-PPDs downloaded to clients</A -></DT -><DT ->14.5. <A -HREF="cups-printing.html#AEN2139" ->Windows Terminal Servers (WTS) as CUPS clients</A -></DT -><DT ->14.6. <A -HREF="cups-printing.html#AEN2143" ->Setting up CUPS for driver download</A -></DT -><DT ->14.7. <A -HREF="cups-printing.html#AEN2156" ->Sources of CUPS drivers / PPDs</A -></DT -><DT ->14.8. <A -HREF="cups-printing.html#AEN2212" ->The CUPS Filter Chains</A -></DT -><DT ->14.9. <A -HREF="cups-printing.html#AEN2251" ->CUPS Print Drivers and Devices</A -></DT -><DT ->14.10. <A -HREF="cups-printing.html#AEN2328" ->Limiting the number of pages users can print</A -></DT -><DT ->14.11. <A -HREF="cups-printing.html#AEN2424" ->Advanced Postscript Printing from MS Windows</A -></DT -><DT ->14.12. <A -HREF="cups-printing.html#AEN2439" ->Auto-Deletion of CUPS spool files</A -></DT -></DL -></DD -><DT ->15. <A -HREF="winbind.html" ->Unified Logons between Windows NT and UNIX using Winbind</A -></DT -><DD -><DL -><DT ->15.1. <A -HREF="winbind.html#AEN2515" ->Abstract</A -></DT -><DT ->15.2. <A -HREF="winbind.html#AEN2519" ->Introduction</A -></DT -><DT ->15.3. <A -HREF="winbind.html#AEN2532" ->What Winbind Provides</A -></DT -><DT ->15.4. <A -HREF="winbind.html#AEN2543" ->How Winbind Works</A -></DT -><DT ->15.5. <A -HREF="winbind.html#AEN2586" ->Installation and Configuration</A -></DT -><DT ->15.6. <A -HREF="winbind.html#AEN2843" ->Limitations</A -></DT -><DT ->15.7. <A -HREF="winbind.html#AEN2853" ->Conclusion</A -></DT -></DL -></DD -><DT ->16. <A -HREF="advancednetworkmanagement.html" ->Advanced Network Manangement</A -></DT -><DD -><DL -><DT ->16.1. <A -HREF="advancednetworkmanagement.html#AEN2869" ->Configuring Samba Share Access Controls</A -></DT -><DT ->16.2. <A -HREF="advancednetworkmanagement.html#AEN2907" ->Remote Server Administration</A -></DT -><DT ->16.3. <A -HREF="advancednetworkmanagement.html#AEN2924" ->Network Logon Script Magic</A -></DT -></DL -></DD -><DT ->17. <A -HREF="policymgmt.html" ->System and Account Policies</A -></DT -><DD -><DL -><DT ->17.1. <A -HREF="policymgmt.html#AEN2958" ->Creating and Managing System Policies</A -></DT -><DT ->17.2. <A -HREF="policymgmt.html#AEN3030" ->Managing Account/User Policies</A -></DT -><DT ->17.3. <A -HREF="policymgmt.html#AEN3052" ->System Startup and Logon Processing Overview</A -></DT -></DL -></DD -><DT ->18. <A -HREF="profilemgmt.html" ->Desktop Profile Management</A -></DT -><DD -><DL -><DT ->18.1. <A -HREF="profilemgmt.html#AEN3095" ->Roaming Profiles</A -></DT -><DT ->18.2. <A -HREF="profilemgmt.html#AEN3302" ->Mandatory profiles</A -></DT -><DT ->18.3. <A -HREF="profilemgmt.html#AEN3309" ->Creating/Managing Group Profiles</A -></DT -><DT ->18.4. <A -HREF="profilemgmt.html#AEN3315" ->Default Profile for Windows Users</A -></DT -></DL -></DD -><DT ->19. <A -HREF="interdomaintrusts.html" ->Interdomain Trust Relationships</A -></DT -><DD -><DL -><DT ->19.1. <A -HREF="interdomaintrusts.html#AEN3446" ->Trust Relationship Background</A -></DT -><DT ->19.2. <A -HREF="interdomaintrusts.html#AEN3455" ->Native MS Windows NT4 Trusts Configuration</A -></DT -><DT ->19.3. <A -HREF="interdomaintrusts.html#AEN3464" ->Configuring Samba NT-style Domain Trusts</A -></DT -></DL -></DD -><DT ->20. <A -HREF="pam.html" ->PAM Configuration for Centrally Managed Authentication</A -></DT -><DD -><DL -><DT ->20.1. <A -HREF="pam.html#AEN3507" ->Samba and PAM</A -></DT -><DT ->20.2. <A -HREF="pam.html#AEN3558" ->Distributed Authentication</A -></DT -><DT ->20.3. <A -HREF="pam.html#AEN3563" ->PAM Configuration in smb.conf</A -></DT -></DL -></DD -><DT ->21. <A -HREF="vfs.html" ->Stackable VFS modules</A -></DT -><DD -><DL -><DT ->21.1. <A -HREF="vfs.html#AEN3600" ->Introduction and configuration</A -></DT -><DT ->21.2. <A -HREF="vfs.html#AEN3609" ->Included modules</A -></DT -><DT ->21.3. <A -HREF="vfs.html#AEN3667" ->VFS modules available elsewhere</A -></DT -></DL -></DD -><DT ->22. <A -HREF="msdfs.html" ->Hosting a Microsoft Distributed File System tree on Samba</A -></DT -><DD -><DL -><DT ->22.1. <A -HREF="msdfs.html#AEN3695" ->Instructions</A -></DT -></DL -></DD -><DT ->23. <A -HREF="integrate-ms-networks.html" ->Integrating MS Windows networks with Samba</A -></DT -><DD -><DL -><DT ->23.1. <A -HREF="integrate-ms-networks.html#AEN3758" ->Name Resolution in a pure Unix/Linux world</A -></DT -><DT ->23.2. <A -HREF="integrate-ms-networks.html#AEN3821" ->Name resolution as used within MS Windows networking</A -></DT -></DL -></DD -><DT ->24. <A -HREF="improved-browsing.html" ->Improved browsing in samba</A -></DT -><DD -><DL -><DT ->24.1. <A -HREF="improved-browsing.html#AEN3874" ->Overview of browsing</A -></DT -><DT ->24.2. <A -HREF="improved-browsing.html#AEN3880" ->Browsing support in samba</A -></DT -><DT ->24.3. <A -HREF="improved-browsing.html#AEN3895" ->Problem resolution</A -></DT -><DT ->24.4. <A -HREF="improved-browsing.html#AEN3907" ->Browsing across subnets</A -></DT -><DT ->24.5. <A -HREF="improved-browsing.html#AEN3948" ->Setting up a WINS server</A -></DT -><DT ->24.6. <A -HREF="improved-browsing.html#AEN3971" ->Setting up Browsing in a WORKGROUP</A -></DT -><DT ->24.7. <A -HREF="improved-browsing.html#AEN3997" ->Setting up Browsing in a DOMAIN</A -></DT -><DT ->24.8. <A -HREF="improved-browsing.html#BROWSE-FORCE-MASTER" ->Forcing samba to be the master</A -></DT -><DT ->24.9. <A -HREF="improved-browsing.html#AEN4032" ->Making samba the domain master</A -></DT -><DT ->24.10. <A -HREF="improved-browsing.html#AEN4054" ->Note about broadcast addresses</A -></DT -><DT ->24.11. <A -HREF="improved-browsing.html#AEN4057" ->Multiple interfaces</A -></DT -></DL -></DD -><DT ->25. <A -HREF="securing-samba.html" ->Securing Samba</A -></DT -><DD -><DL -><DT ->25.1. <A -HREF="securing-samba.html#AEN4073" ->Introduction</A -></DT -><DT ->25.2. <A -HREF="securing-samba.html#AEN4076" ->Using host based protection</A -></DT -><DT ->25.3. <A -HREF="securing-samba.html#AEN4086" ->Using interface protection</A -></DT -><DT ->25.4. <A -HREF="securing-samba.html#AEN4094" ->Using a firewall</A -></DT -><DT ->25.5. <A -HREF="securing-samba.html#AEN4101" ->Using a IPC$ share deny</A -></DT -><DT ->25.6. <A -HREF="securing-samba.html#AEN4110" ->Upgrading Samba</A -></DT -></DL -></DD -><DT ->26. <A -HREF="unicode.html" ->Unicode/Charsets</A -></DT -><DD -><DL -><DT ->26.1. <A -HREF="unicode.html#AEN4132" ->What are charsets and unicode?</A -></DT -><DT ->26.2. <A -HREF="unicode.html#AEN4141" ->Samba and charsets</A -></DT -><DT ->26.3. <A -HREF="unicode.html#AEN4160" ->Conversion from old names</A -></DT -><DT ->26.4. <A -HREF="unicode.html#AEN4168" ->Japanese charsets</A -></DT -></DL -></DD -></DL -></DD -><DT ->IV. <A -HREF="appendixes.html" ->Appendixes</A -></DT -><DD -><DL -><DT ->27. <A -HREF="compiling.html" ->How to compile SAMBA</A -></DT -><DD -><DL -><DT ->27.1. <A -HREF="compiling.html#AEN4204" ->Access Samba source code via CVS</A -></DT -><DT ->27.2. <A -HREF="compiling.html#AEN4247" ->Accessing the samba sources via rsync and ftp</A -></DT -><DT ->27.3. <A -HREF="compiling.html#AEN4253" ->Verifying Samba's PGP signature</A -></DT -><DT ->27.4. <A -HREF="compiling.html#AEN4265" ->Building the Binaries</A -></DT -><DT ->27.5. <A -HREF="compiling.html#AEN4322" ->Starting the smbd and nmbd</A -></DT -></DL -></DD -><DT ->28. <A -HREF="nt4migration.html" ->Migration from NT4 PDC to Samba-3 PDC</A -></DT -><DD -><DL -><DT ->28.1. <A -HREF="nt4migration.html#AEN4396" ->Planning and Getting Started</A -></DT -><DT ->28.2. <A -HREF="nt4migration.html#AEN4429" ->Managing Samba-3 Domain Control</A -></DT -></DL -></DD -><DT ->29. <A -HREF="portability.html" ->Portability</A -></DT -><DD -><DL -><DT ->29.1. <A -HREF="portability.html#AEN4444" ->HPUX</A -></DT -><DT ->29.2. <A -HREF="portability.html#AEN4450" ->SCO Unix</A -></DT -><DT ->29.3. <A -HREF="portability.html#AEN4454" ->DNIX</A -></DT -><DT ->29.4. <A -HREF="portability.html#AEN4483" ->RedHat Linux Rembrandt-II</A -></DT -><DT ->29.5. <A -HREF="portability.html#AEN4489" ->AIX</A -></DT -><DT ->29.6. <A -HREF="portability.html#AEN4495" ->Solaris</A -></DT -></DL -></DD -><DT ->30. <A -HREF="other-clients.html" ->Samba and other CIFS clients</A -></DT -><DD -><DL -><DT ->30.1. <A -HREF="other-clients.html#AEN4522" ->Macintosh clients?</A -></DT -><DT ->30.2. <A -HREF="other-clients.html#AEN4531" ->OS2 Client</A -></DT -><DT ->30.3. <A -HREF="other-clients.html#AEN4571" ->Windows for Workgroups</A -></DT -><DT ->30.4. <A -HREF="other-clients.html#AEN4595" ->Windows '95/'98</A -></DT -><DT ->30.5. <A -HREF="other-clients.html#AEN4611" ->Windows 2000 Service Pack 2</A -></DT -><DT ->30.6. <A -HREF="other-clients.html#AEN4628" ->Windows NT 3.1</A -></DT -></DL -></DD -><DT ->31. <A -HREF="swat.html" ->SWAT - The Samba Web Admininistration Tool</A -></DT -><DD -><DL -><DT ->31.1. <A -HREF="swat.html#AEN4645" ->SWAT Features and Benefits</A -></DT -></DL -></DD -><DT ->32. <A -HREF="speed.html" ->Samba performance issues</A -></DT -><DD -><DL -><DT ->32.1. <A -HREF="speed.html#AEN4687" ->Comparisons</A -></DT -><DT ->32.2. <A -HREF="speed.html#AEN4693" ->Socket options</A -></DT -><DT ->32.3. <A -HREF="speed.html#AEN4700" ->Read size</A -></DT -><DT ->32.4. <A -HREF="speed.html#AEN4705" ->Max xmit</A -></DT -><DT ->32.5. <A -HREF="speed.html#AEN4710" ->Log level</A -></DT -><DT ->32.6. <A -HREF="speed.html#AEN4713" ->Read raw</A -></DT -><DT ->32.7. <A -HREF="speed.html#AEN4718" ->Write raw</A -></DT -><DT ->32.8. <A -HREF="speed.html#AEN4722" ->Slow Clients</A -></DT -><DT ->32.9. <A -HREF="speed.html#AEN4726" ->Slow Logins</A -></DT -><DT ->32.10. <A -HREF="speed.html#AEN4729" ->Client tuning</A -></DT -></DL -></DD -><DT ->33. <A -HREF="diagnosis.html" ->The samba checklist</A -></DT -><DD -><DL -><DT ->33.1. <A -HREF="diagnosis.html#AEN4781" ->Introduction</A -></DT -><DT ->33.2. <A -HREF="diagnosis.html#AEN4786" ->Assumptions</A -></DT -><DT ->33.3. <A -HREF="diagnosis.html#AEN4805" ->The tests</A -></DT -><DT ->33.4. <A -HREF="diagnosis.html#AEN4972" ->Still having troubles?</A -></DT -></DL -></DD -><DT ->34. <A -HREF="problems.html" ->Analysing and solving samba problems</A -></DT -><DD -><DL -><DT ->34.1. <A -HREF="problems.html#AEN5004" ->Diagnostics tools</A -></DT -><DT ->34.2. <A -HREF="problems.html#AEN5019" ->Installing 'Network Monitor' on an NT Workstation or a Windows 9x box</A -></DT -><DT ->34.3. <A -HREF="problems.html#AEN5048" ->Useful URL's</A -></DT -><DT ->34.4. <A -HREF="problems.html#AEN5072" ->Getting help from the mailing lists</A -></DT -><DT ->34.5. <A -HREF="problems.html#AEN5102" ->How to get off the mailinglists</A -></DT -></DL -></DD -><DT ->35. <A -HREF="bugreport.html" ->Reporting Bugs</A -></DT -><DD -><DL -><DT ->35.1. <A -HREF="bugreport.html#AEN5125" ->Introduction</A -></DT -><DT ->35.2. <A -HREF="bugreport.html#AEN5135" ->General info</A -></DT -><DT ->35.3. <A -HREF="bugreport.html#AEN5141" ->Debug levels</A -></DT -><DT ->35.4. <A -HREF="bugreport.html#AEN5162" ->Internal errors</A -></DT -><DT ->35.5. <A -HREF="bugreport.html#AEN5176" ->Attaching to a running process</A -></DT -><DT ->35.6. <A -HREF="bugreport.html#AEN5184" ->Patches</A -></DT -></DL -></DD -></DL -></DD -></DL -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -> </TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -> </TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="introduction.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -> </TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -> </TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->General installation</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/securitylevels.html b/docs/htmldocs/securitylevels.html deleted file mode 100644 index ddfb22536b..0000000000 --- a/docs/htmldocs/securitylevels.html +++ /dev/null @@ -1,212 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> -<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. Samba as Stand-Alone Server</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.59.1"><link rel="home" href="index.html" title="SAMBA Project Documentation"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="previous" href="ServerType.html" title="Chapter 3. Nomenclature of Server Types"><link rel="next" href="samba-pdc.html" title="Chapter 5. -Samba as an NT4 or Win2k Primary Domain Controller -"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. Samba as Stand-Alone Server</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ServerType.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="samba-pdc.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><h2 class="title"><a name="securitylevels"></a>Chapter 4. Samba as Stand-Alone Server</h2></div><div><div class="author"><h3 class="author">Andrew Tridgell</h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt><<a href="mailto:tridge@samba.org">tridge@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author">Jelmer R. Vernooij</h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="securitylevels.html#id2807692">User and Share security level</a></dt><dd><dl><dt><a href="securitylevels.html#id2807727">User Level Security</a></dt><dt><a href="securitylevels.html#id2810322">Share Level Security</a></dt><dt><a href="securitylevels.html#id2812328">Server Level Security</a></dt><dt><a href="securitylevels.html#id2876991">Domain Level Security</a></dt><dt><a href="securitylevels.html#id2877129">ADS Level Security</a></dt></dl></dd></dl></div><p> -In this section the function and purpose of Samba's <span class="emphasis"><em>security</em></span> -modes are described. -</p><div class="sect1" lang="en"><div class="titlepage"><div><h2 class="title" style="clear: both"><a name="id2807692"></a>User and Share security level</h2></div></div><p> -A SMB server tells the client at startup what "security level" it is -running. There are two options "share level" and "user level". Which -of these two the client receives affects the way the client then tries -to authenticate itself. It does not directly affect (to any great -extent) the way the Samba server does security. I know this is -strange, but it fits in with the client/server approach of SMB. In SMB -everything is initiated and controlled by the client, and the server -can only tell the client what is available and whether an action is -allowed. -</p><div class="sect2" lang="en"><div class="titlepage"><div><h3 class="title"><a name="id2807727"></a>User Level Security</h3></div></div><p> -I'll describe user level security first, as its simpler. In user level -security the client will send a "session setup" command directly after -the protocol negotiation. This contains a username and password. The -server can either accept or reject that username/password -combination. Note that at this stage the server has no idea what -share the client will eventually try to connect to, so it can't base -the "accept/reject" on anything other than: -</p><div class="orderedlist"><ol type="1"><li><p>the username/password</p></li><li><p>the machine that the client is coming from</p></li></ol></div><p> -If the server accepts the username/password then the client expects to -be able to mount any share (using a "tree connection") without -specifying a password. It expects that all access rights will be as -the username/password specified in the "session setup". -</p><p> -It is also possible for a client to send multiple "session setup" -requests. When the server responds it gives the client a "uid" to use -as an authentication tag for that username/password. The client can -maintain multiple authentication contexts in this way (WinDD is an -example of an application that does this) -</p></div><div class="sect2" lang="en"><div class="titlepage"><div><h3 class="title"><a name="id2810322"></a>Share Level Security</h3></div></div><p> -Ok, now for share level security. In share level security the client -authenticates itself separately for each share. It will send a -password along with each "tree connection" (share mount). It does not -explicitly send a username with this operation. The client is -expecting a password to be associated with each share, independent of -the user. This means that samba has to work out what username the -client probably wants to use. It is never explicitly sent the -username. Some commercial SMB servers such as NT actually associate -passwords directly with shares in share level security, but samba -always uses the unix authentication scheme where it is a -username/password that is authenticated, not a "share/password". -</p><p> -Many clients send a "session setup" even if the server is in share -level security. They normally send a valid username but no -password. Samba records this username in a list of "possible -usernames". When the client then does a "tree connection" it also adds -to this list the name of the share they try to connect to (useful for -home directories) and any users listed in the <b>user =</b> <tt>smb.conf</tt> -line. The password is then checked in turn against these "possible -usernames". If a match is found then the client is authenticated as -that user. -</p></div><div class="sect2" lang="en"><div class="titlepage"><div><h3 class="title"><a name="id2812328"></a>Server Level Security</h3></div></div><p> -Finally "server level" security. In server level security the samba -server reports to the client that it is in user level security. The -client then does a "session setup" as described earlier. The samba -server takes the username/password that the client sends and attempts -to login to the "password server" by sending exactly the same -username/password that it got from the client. If that server is in -user level security and accepts the password then samba accepts the -clients connection. This allows the samba server to use another SMB -server as the "password server". -</p><p> -You should also note that at the very start of all this, where the -server tells the client what security level it is in, it also tells -the client if it supports encryption. If it does then it supplies the -client with a random "cryptkey". The client will then send all -passwords in encrypted form. You have to compile samba with encryption -enabled to support this feature, and you have to maintain a separate -smbpasswd file with SMB style encrypted passwords. It is -cryptographically impossible to translate from unix style encryption -to SMB style encryption, although there are some fairly simple management -schemes by which the two could be kept in sync. -</p><p> -"security = server" means that Samba reports to clients that -it is running in "user mode" but actually passes off all authentication -requests to another "user mode" server. This requires an additional -parameter "password server =" that points to the real authentication server. -That real authentication server can be another Samba server or can be a -Windows NT server, the later natively capable of encrypted password support. -</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> -<span class="emphasis"><em>Server</em></span> level security is incompatible with what is known -as <span class="emphasis"><em>schannel</em></span> or "sign and seal" protocols. This means that -if you want to use <span class="emphasis"><em>server</em></span> level security you must disable -the use of "sign and seal" on all machines on your network. -</p></div><div class="sect3" lang="en"><div class="titlepage"><div><h4 class="title"><a name="id2876754"></a>Configuring Samba for Seemless Windows Network Integration</h4></div></div><p> -MS Windows clients may use encrypted passwords as part of a challenege/response -authentication model (a.k.a. NTLMv1) or alone, or clear text strings for simple -password based authentication. It should be realized that with the SMB protocol -the password is passed over the network either in plain text or encrypted, but -not both in the same authentication request. -</p><p> -When encrypted passwords are used a password that has been entered by the user -is encrypted in two ways: -</p><div class="itemizedlist"><ul type="disc"><li><p>An MD4 hash of the UNICODE of the password - string. This is known as the NT hash. - </p></li><li><p>The password is converted to upper case, - and then padded or trucated to 14 bytes. This string is - then appended with 5 bytes of NULL characters and split to - form two 56 bit DES keys to encrypt a "magic" 8 byte value. - The resulting 16 bytes for the LanMan hash. - </p></li></ul></div><p> -MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 -pre-service pack 3 will use either mode of password authentication. All -versions of MS Windows that follow these versions no longer support plain -text passwords by default. -</p><p> -MS Windows clients have a habit of dropping network mappings that have been idle -for 10 minutes or longer. When the user attempts to use the mapped drive -connection that has been dropped, the client re-establishes the connection using -a cached copy of the password. -</p><p> -When Microsoft changed the default password mode, support was dropped for caching -of the plain text password. This means that when the registry parameter is changed -to re-enable use of plain text passwords it appears to work, but when a dropped -service connection mapping attempts to revalidate it will fail if the remote -authentication server does not support encrypted passwords. This means that it -is definitely not a good idea to re-enable plain text password support in such clients. -</p><p> -The following parameters can be used to work around the issue of Windows 9x client -upper casing usernames and password before transmitting them to the SMB server -when using clear text authentication. -</p><pre class="programlisting"> - <a href="smb.conf.5.html#PASSWORDLEVEL" target="_top">passsword level</a> = <i><tt>integer</tt></i> - <a href="smb.conf.5.html#USERNAMELEVEL" target="_top">username level</a> = <i><tt>integer</tt></i> -</pre><p> -By default Samba will lower case the username before attempting to lookup the user -in the database of local system accounts. Because UNIX usernames conventionally -only contain lower case character, the <i><tt>username level</tt></i> parameter -is rarely needed. -</p><p> -However, passwords on UNIX systems often make use of mixed case characters. -This means that in order for a user on a Windows 9x client to connect to a Samba -server using clear text authentication, the <i><tt>password level</tt></i> -must be set to the maximum number of upper case letter which <span class="emphasis"><em>could</em></span> -appear is a password. Note that the server OS uses the traditional DES version -of crypt(), a <i><tt>password level</tt></i> of 8 will result in case -insensitive passwords as seen from Windows users. This will also result in longer -login times as Samba has to compute the permutations of the password string and -try them one by one until a match is located (or all combinations fail). -</p><p> -The best option to adopt is to enable support for encrypted passwords -where ever Samba is used. There are three configuration possibilities -for support of encrypted passwords: -</p></div><div class="sect3" lang="en"><div class="titlepage"><div><h4 class="title"><a name="id2876930"></a>Use MS Windows NT as an authentication server</h4></div></div><p> -This method involves the additions of the following parameters in the <tt>smb.conf</tt> file: -</p><pre class="programlisting"> - encrypt passwords = Yes - security = server - password server = "NetBIOS_name_of_PDC" -</pre><p> -There are two ways of identifying whether or not a username and -password pair was valid or not. One uses the reply information provided -as part of the authentication messaging process, the other uses -just an error code. -</p><p> -The down-side of this mode of configuration is the fact that -for security reasons Samba will send the password server a bogus -username and a bogus password and if the remote server fails to -reject the username and password pair then an alternative mode -of identification of validation is used. Where a site uses password -lock out after a certain number of failed authentication attempts -this will result in user lockouts. -</p><p> -Use of this mode of authentication does require there to be -a standard Unix account for the user, this account can be blocked -to prevent logons by other than MS Windows clients. -</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><h3 class="title"><a name="id2876991"></a>Domain Level Security</h3></div></div><p> -When samba is operating in <span class="emphasis"><em>security = domain</em></span> mode this means that -the Samba server has a domain security trust account (a machine account) and will cause -all authentication requests to be passed through to the domain controllers. -</p><div class="sect3" lang="en"><div class="titlepage"><div><h4 class="title"><a name="id2877011"></a>Samba as a member of an MS Windows NT security domain</h4></div></div><p> -This method involves addition of the following parameters in the <tt>smb.conf</tt> file: -</p><pre class="programlisting"> - encrypt passwords = Yes - security = domain - workgroup = "name of NT domain" - password server = * -</pre><p> -The use of the "*" argument to <b>password server</b> will cause samba to locate the -domain controller in a way analogous to the way this is done within MS Windows NT. -This is the default behaviour. -</p><p> -In order for this method to work the Samba server needs to join the -MS Windows NT security domain. This is done as follows: -</p><div class="itemizedlist"><ul type="disc"><li><p>On the MS Windows NT domain controller using - the Server Manager add a machine account for the Samba server. - </p></li><li><p>Next, on the Linux system execute: - <b>smbpasswd -r PDC_NAME -j DOMAIN_NAME</b> (samba 2.x) - - <b>net join -U administrator%password</b> (samba-3) - </p></li></ul></div><p> -Use of this mode of authentication does require there to be a standard Unix account -for the user in order to assign a uid once the account has been authenticated by -the remote Windows DC. This account can be blocked to prevent logons by clients other than -MS Windows through things such as setting an invalid shell in the -<tt>/etc/passwd</tt> entry. -</p><p> -An alternative to assigning UIDs to Windows users on a Samba member server is -presented in the <a href="winbind.html" title="Chapter 15. Unified Logons between Windows NT and UNIX using Winbind">Winbind Overview</a> chapter -in this HOWTO collection. -</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><h3 class="title"><a name="id2877129"></a>ADS Level Security</h3></div></div><p> -For information about the configuration option please refer to the entire section entitled -<span class="emphasis"><em>Samba as an ADS Domain Member.</em></span> -</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ServerType.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="type.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="samba-pdc.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 3. Nomenclature of Server Types </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 5. -Samba as an NT4 or Win2k Primary Domain Controller -</td></tr></table></div></body></html> diff --git a/docs/htmldocs/servertype.html b/docs/htmldocs/servertype.html deleted file mode 100644 index 42a7604797..0000000000 --- a/docs/htmldocs/servertype.html +++ /dev/null @@ -1,368 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Nomenclature of Server Types</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Type of installation" -HREF="type.html"><LINK -REL="PREVIOUS" -TITLE="Type of installation" -HREF="type.html"><LINK -REL="NEXT" -TITLE="Samba as Stand-Alone Server" -HREF="securitylevels.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="type.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="securitylevels.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="SERVERTYPE" -></A ->Chapter 5. Nomenclature of Server Types</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->5.1. <A -HREF="servertype.html#AEN846" ->Stand Alone Server</A -></DT -><DT ->5.2. <A -HREF="servertype.html#AEN853" ->Domain Member Server</A -></DT -><DT ->5.3. <A -HREF="servertype.html#AEN859" ->Domain Controller</A -></DT -></DL -></DIV -><P ->Adminstrators of Microsoft networks often refer to there being three -different type of servers:</P -><P -></P -><UL -><LI -><P ->Stand Alone Server</P -></LI -><LI -><P ->Domain Member Server</P -></LI -><LI -><P ->Domain Controller</P -><P -></P -><UL -><LI -><P ->Primary Domain Controller</P -></LI -><LI -><P ->Backup Domain Controller</P -></LI -><LI -><P ->ADS Domain Controller</P -></LI -></UL -></LI -></UL -><P ->A network administrator who is familiar with these terms and who -wishes to migrate to or use Samba will want to know what these terms mean -within a Samba context.</P -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN846" ->5.1. Stand Alone Server</A -></H1 -><P ->The term <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->stand alone server</I -></SPAN -> means that the server -will provide local authentication and access control for all resources -that are available from it. In general this means that there will be a -local user database. In more technical terms, it means that resources -on the machine will either be made available in either SHARE mode or in -USER mode. SHARE mode and USER mode security are documented under -discussions regarding "security mode". The smb.conf configuration parameters -that control security mode are: "security = user" and "security = share".</P -><P ->No special action is needed other than to create user accounts. Stand-alone -servers do NOT provide network logon services, meaning that machines that -use this server do NOT perform a domain logon but instead make use only of -the MS Windows logon which is local to the MS Windows workstation/server.</P -><P ->Samba tends to blur the distinction a little in respect of what is -a stand alone server. This is because the authentication database may be -local or on a remote server, even if from the samba protocol perspective -the samba server is NOT a member of a domain security context.</P -><P ->Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher) the source of authentication may reside on -another server. We would be inclined to call this the authentication server. -This means that the samba server may use the local Unix/Linux system -password database (/etc/passwd or /etc/shadow), may use a local smbpasswd -file (/etc/samba/smbpasswd or /usr/local/samba/lib/private/smbpasswd), or -may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB -server for authentication.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN853" ->5.2. Domain Member Server</A -></H1 -><P ->This mode of server operation involves the samba machine being made a member -of a domain security context. This means by definition that all user authentication -will be done from a centrally defined authentication regime. The authentication -regime may come from an NT3/4 style (old domain technology) server, or it may be -provided from an Active Directory server (ADS) running on MS Windows 2000 or later.</P -><P -><SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Of course it should be clear that the authentication back end itself could be from any -distributed directory architecture server that is supported by Samba. This can be -LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory Server, etc.</I -></SPAN -></P -><P ->Please refer to the section on Howto configure Samba as a Primary Domain Controller -and for more information regarding how to create a domain machine account for a -domain member server as well as for information regading how to enable the samba -domain member machine to join the domain and to be fully trusted by it.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN859" ->5.3. Domain Controller</A -></H1 -><P ->Over the years public perceptions of what Domain Control really is has taken on an -almost mystical nature. Before we branch into a brief overview of what Domain Control -is the following types of controller are known:</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN862" ->5.3.1. Domain Controller Types</A -></H2 -><P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->Primary Domain Controller</TD -></TR -><TR -><TD ->Backup Domain Controller</TD -></TR -><TR -><TD ->ADS Domain Controller</TD -></TR -></TBODY -></TABLE -><P -></P -><P ->The <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Primary Domain Controller</I -></SPAN -> or PDC plays an important role in the MS -Windows NT3 and NT4 Domain Control architecture, but not in the manner that so many -expect. The PDC seeds the Domain Control database (a part of the Windows registry) and -it plays a key part in synchronisation of the domain authentication database. </P -><P ->New to Samba-3.0.0 is the ability to use a back-end file that holds the same type of data as -the NT4 style SAM (Security Account Manager) database (one of the registry files). -The samba-3.0.0 SAM can be specified via the smb.conf file parameter "passwd backend" and -valid options include <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" -> smbpasswd tdbsam ldapsam nisplussam plugin unixsam</I -></SPAN ->. -The smbpasswd, tdbsam and ldapsam options can have a "_nua" suffix to indicate that No Unix -Accounts need to be created. In other words, the Samba SAM will be independant of Unix/Linux -system accounts, provided a uid range is defined from which SAM accounts can be created.</P -><P ->The <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->Backup Domain Controller</I -></SPAN -> or BDC plays a key role in servicing network -authentication requests. The BDC is biased to answer logon requests so that on a network segment -that has a BDC and a PDC the BDC will be most likely to service network logon requests. The PDC will -answer network logon requests when the BDC is too busy (high load). A BDC can be promoted to -a PDC. If the PDC is on line at the time that the BDC is promoted to PDC the previous PDC is -automatically demoted to a BDC.</P -><P ->At this time Samba is NOT capable of acting as an <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->ADS Domain Controller</I -></SPAN ->.</P -></DIV -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="type.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="securitylevels.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Type of installation</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="type.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Samba as Stand-Alone Server</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/swat.html b/docs/htmldocs/swat.html deleted file mode 100644 index e70fac5403..0000000000 --- a/docs/htmldocs/swat.html +++ /dev/null @@ -1,233 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->SWAT - The Samba Web Admininistration Tool</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Appendixes" -HREF="appendixes.html"><LINK -REL="PREVIOUS" -TITLE="Samba and other CIFS clients" -HREF="other-clients.html"><LINK -REL="NEXT" -TITLE="Samba performance issues" -HREF="speed.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="other-clients.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="speed.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="SWAT" -></A ->Chapter 31. SWAT - The Samba Web Admininistration Tool</H1 -><P ->This is a rough guide to SWAT.</P -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN4645" ->31.1. SWAT Features and Benefits</A -></H1 -><P ->You must use at least the following ...</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4648" ->31.1.1. The SWAT Home Page</A -></H2 -><P ->Blah blah here.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4651" ->31.1.2. Global Settings</A -></H2 -><P ->Document steps right here!</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4654" ->31.1.3. The SWAT Wizard</A -></H2 -><P ->Lots of blah blah here.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4657" ->31.1.4. Share Settings</A -></H2 -><P ->Document steps right here!</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4660" ->31.1.5. Printing Settings</A -></H2 -><P ->Document steps right here!</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4663" ->31.1.6. The Status Page</A -></H2 -><P ->Document steps right here!</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN4666" ->31.1.7. The Password Change Page</A -></H2 -><P ->Document steps right here!</P -></DIV -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="other-clients.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="speed.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->Samba and other CIFS clients</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="appendixes.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Samba performance issues</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file diff --git a/docs/htmldocs/unix-permissions.html b/docs/htmldocs/unix-permissions.html deleted file mode 100644 index e9a3b5e671..0000000000 --- a/docs/htmldocs/unix-permissions.html +++ /dev/null @@ -1,194 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> -<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.59.1"><link rel="home" href="index.html" title="SAMBA Project Documentation"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="previous" href="passdb.html" title="Chapter 10. User information database"><link rel="next" href="groupmapping.html" title="Chapter 12. Configuring Group Mapping"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="passdb.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="groupmapping.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><h2 class="title"><a name="unix-permissions"></a>Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists</h2></div><div><div class="author"><h3 class="author">Jeremy Allison</h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt><<a href="mailto:jra@samba.org">jra@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">12 Apr 1999</p></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="unix-permissions.html#id2881950">Viewing and changing UNIX permissions using the NT - security dialogs</a></dt><dt><a href="unix-permissions.html#id2881832">How to view file security on a Samba share</a></dt><dt><a href="unix-permissions.html#id2885176">Viewing file ownership</a></dt><dt><a href="unix-permissions.html#id2885297">Viewing file or directory permissions</a></dt><dd><dl><dt><a href="unix-permissions.html#id2885379">File Permissions</a></dt><dt><a href="unix-permissions.html#id2885483">Directory Permissions</a></dt></dl></dd><dt><a href="unix-permissions.html#id2885533">Modifying file or directory permissions</a></dt><dt><a href="unix-permissions.html#id2885693">Interaction with the standard Samba create mask - parameters</a></dt><dt><a href="unix-permissions.html#id2886008">Interaction with the standard Samba file attribute - mapping</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><h2 class="title" style="clear: both"><a name="id2881950"></a>Viewing and changing UNIX permissions using the NT - security dialogs</h2></div></div><p>Windows NT clients can use their native security settings - dialog box to view and modify the underlying UNIX permissions.</p><p>Note that this ability is careful not to compromise - the security of the UNIX host Samba is running on, and - still obeys all the file permission rules that a Samba - administrator can set.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> - All access to Unix/Linux system file via Samba is controlled at - the operating system file access control level. When trying to - figure out file access problems it is vitally important to identify - the identity of the Windows user as it is presented by Samba at - the point of file access. This can best be determined from the - Samba log files. - </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><h2 class="title" style="clear: both"><a name="id2881832"></a>How to view file security on a Samba share</h2></div></div><p>From an NT4/2000/XP client, single-click with the right - mouse button on any file or directory in a Samba mounted - drive letter or UNC path. When the menu pops-up, click - on the <span class="emphasis"><em>Properties</em></span> entry at the bottom of - the menu. This brings up the file properties dialog - box. Click on the tab <span class="emphasis"><em>Security</em></span> and you - will see three buttons, <span class="emphasis"><em>Permissions</em></span>, - <span class="emphasis"><em>Auditing</em></span>, and <span class="emphasis"><em>Ownership</em></span>. - The <span class="emphasis"><em>Auditing</em></span> button will cause either - an error message A requested privilege is not held - by the client to appear if the user is not the - NT Administrator, or a dialog which is intended to allow an - Administrator to add auditing requirements to a file if the - user is logged on as the NT Administrator. This dialog is - non-functional with a Samba share at this time, as the only - useful button, the <b>Add</b> button will not currently - allow a list of users to be seen.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><h2 class="title" style="clear: both"><a name="id2885176"></a>Viewing file ownership</h2></div></div><p>Clicking on the <b>"Ownership"</b> button - brings up a dialog box telling you who owns the given file. The - owner name will be of the form :</p><p><b>"SERVER\user (Long name)"</b></p><p>Where <i><tt>SERVER</tt></i> is the NetBIOS name of - the Samba server, <i><tt>user</tt></i> is the user name of - the UNIX user who owns the file, and <i><tt>(Long name)</tt></i> - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database). Click on the <b>Close - </b> button to remove this dialog.</p><p>If the parameter <i><tt>nt acl support</tt></i> - is set to <tt>false</tt> then the file owner will - be shown as the NT user <b>"Everyone"</b>.</p><p>The <b>Take Ownership</b> button will not allow - you to change the ownership of this file to yourself (clicking on - it will display a dialog box complaining that the user you are - currently logged onto the NT client cannot be found). The reason - for this is that changing the ownership of a file is a privileged - operation in UNIX, available only to the <span class="emphasis"><em>root</em></span> - user. As clicking on this button causes NT to attempt to change - the ownership of a file to the current user logged into the NT - client this will not work with Samba at this time.</p><p>There is an NT chown command that will work with Samba - and allow a user with Administrator privilege connected - to a Samba server as root to change the ownership of - files on both a local NTFS filesystem or remote mounted NTFS - or Samba drive. This is available as part of the <span class="emphasis"><em>Seclib - </em></span> NT security library written by Jeremy Allison of - the Samba Team, available from the main Samba ftp site.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><h2 class="title" style="clear: both"><a name="id2885297"></a>Viewing file or directory permissions</h2></div></div><p>The third button is the <b>"Permissions"</b> - button. Clicking on this brings up a dialog box that shows both - the permissions and the UNIX owner of the file or directory. - The owner is displayed in the form :</p><p><b>"SERVER\user (Long name)"</b></p><p>Where <i><tt>SERVER</tt></i> is the NetBIOS name of - the Samba server, <i><tt>user</tt></i> is the user name of - the UNIX user who owns the file, and <i><tt>(Long name)</tt></i> - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database).</p><p>If the parameter <i><tt>nt acl support</tt></i> - is set to <tt>false</tt> then the file owner will - be shown as the NT user <b>"Everyone"</b> and the - permissions will be shown as NT "Full Control".</p><p>The permissions field is displayed differently for files - and directories, so I'll describe the way file permissions - are displayed first.</p><div class="sect2" lang="en"><div class="titlepage"><div><h3 class="title"><a name="id2885379"></a>File Permissions</h3></div></div><p>The standard UNIX user/group/world triple and - the corresponding "read", "write", "execute" permissions - triples are mapped by Samba into a three element NT ACL - with the 'r', 'w', and 'x' bits mapped into the corresponding - NT permissions. The UNIX world permissions are mapped into - the global NT group <b>Everyone</b>, followed - by the list of permissions allowed for UNIX world. The UNIX - owner and group permissions are displayed as an NT - <b>user</b> icon and an NT <b>local - group</b> icon respectively followed by the list - of permissions allowed for the UNIX user and group.</p><p>As many UNIX permission sets don't map into common - NT names such as <b>"read"</b>, <b> - "change"</b> or <b>"full control"</b> then - usually the permissions will be prefixed by the words <b> - "Special Access"</b> in the NT display list.</p><p>But what happens if the file has no permissions allowed - for a particular UNIX user group or world component ? In order - to allow "no permissions" to be seen and modified then Samba - overloads the NT <b>"Take Ownership"</b> ACL attribute - (which has no meaning in UNIX) and reports a component with - no permissions as having the NT <b>"O"</b> bit set. - This was chosen of course to make it look like a zero, meaning - zero permissions. More details on the decision behind this will - be given below.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><h3 class="title"><a name="id2885483"></a>Directory Permissions</h3></div></div><p>Directories on an NT NTFS file system have two - different sets of permissions. The first set of permissions - is the ACL set on the directory itself, this is usually displayed - in the first set of parentheses in the normal <b>"RW"</b> - NT style. This first set of permissions is created by Samba in - exactly the same way as normal file permissions are, described - above, and is displayed in the same way.</p><p>The second set of directory permissions has no real meaning - in the UNIX permissions world and represents the <b> - "inherited"</b> permissions that any file created within - this directory would inherit.</p><p>Samba synthesises these inherited permissions for NT by - returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><h2 class="title" style="clear: both"><a name="id2885533"></a>Modifying file or directory permissions</h2></div></div><p>Modifying file and directory permissions is as simple - as changing the displayed permissions in the dialog box, and - clicking the <b>OK</b> button. However, there are - limitations that a user needs to be aware of, and also interactions - with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.</p><p>If the parameter <i><tt>nt acl support</tt></i> - is set to <tt>false</tt> then any attempt to set - security permissions will fail with an <b>"Access Denied" - </b> message.</p><p>The first thing to note is that the <b>"Add"</b> - button will not return a list of users in Samba (it will give - an error message of <b>"The remote procedure call failed - and did not execute"</b>). This means that you can only - manipulate the current user/group/world permissions listed in - the dialog box. This actually works quite well as these are the - only permissions that UNIX actually has.</p><p>If a permission triple (either user, group, or world) - is removed from the list of permissions in the NT dialog box, - then when the <b>"OK"</b> button is pressed it will - be applied as "no permissions" on the UNIX side. If you then - view the permissions again the "no permissions" entry will appear - as the NT <b>"O"</b> flag, as described above. This - allows you to add permissions back to a file or directory once - you have removed them from a triple component.</p><p>As UNIX supports only the "r", "w" and "x" bits of - an NT ACL then if other NT security attributes such as "Delete - access" are selected then they will be ignored when applied on - the Samba server.</p><p>When setting permissions on a directory the second - set of permissions (in the second set of parentheses) is - by default applied to all files within that directory. If this - is not what you want you must uncheck the <b>"Replace - permissions on existing files"</b> checkbox in the NT - dialog before clicking <b>"OK"</b>.</p><p>If you wish to remove all permissions from a - user/group/world component then you may either highlight the - component and click the <b>"Remove"</b> button, - or set the component to only have the special <b>"Take - Ownership"</b> permission (displayed as <b>"O" - </b>) highlighted.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><h2 class="title" style="clear: both"><a name="id2885693"></a>Interaction with the standard Samba create mask - parameters</h2></div></div><p>There are four parameters - to control interaction with the standard Samba create mask parameters. - These are :</p><p><i><tt>security mask</tt></i></p><p><i><tt>force security mode</tt></i></p><p><i><tt>directory security mask</tt></i></p><p><i><tt>force directory security mode</tt></i></p><p>Once a user clicks <b>"OK"</b> to apply the - permissions Samba maps the given permissions into a user/group/world - r/w/x triple set, and then will check the changed permissions for a - file against the bits set in the <a href="smb.conf.5.html#SECURITYMASK" target="_top"> - <i><tt>security mask</tt></i></a> parameter. Any bits that - were changed that are not set to '1' in this parameter are left alone - in the file permissions.</p><p>Essentially, zero bits in the <i><tt>security mask</tt></i> - mask may be treated as a set of bits the user is <span class="emphasis"><em>not</em></span> - allowed to change, and one bits are those the user is allowed to change. - </p><p>If not set explicitly this parameter is set to the same value as - the <a href="smb.conf.5.html#CREATEMASK" target="_top"><i><tt>create mask - </tt></i></a> parameter. To allow a user to modify all the - user/group/world permissions on a file, set this parameter - to 0777.</p><p>Next Samba checks the changed permissions for a file against - the bits set in the <a href="smb.conf.5.html#FORCESECURITYMODE" target="_top"> - <i><tt>force security mode</tt></i></a> parameter. Any bits - that were changed that correspond to bits set to '1' in this parameter - are forced to be set.</p><p>Essentially, bits set in the <i><tt>force security mode - </tt></i> parameter may be treated as a set of bits that, when - modifying security on a file, the user has always set to be 'on'.</p><p>If not set explicitly this parameter is set to the same value - as the <a href="smb.conf.5.html#FORCECREATEMODE" target="_top"><i><tt>force - create mode</tt></i></a> parameter. - To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000.</p><p>The <i><tt>security mask</tt></i> and <i><tt>force - security mode</tt></i> parameters are applied to the change - request in that order.</p><p>For a directory Samba will perform the same operations as - described above for a file except using the parameter <i><tt> - directory security mask</tt></i> instead of <i><tt>security - mask</tt></i>, and <i><tt>force directory security mode - </tt></i> parameter instead of <i><tt>force security mode - </tt></i>.</p><p>The <i><tt>directory security mask</tt></i> parameter - by default is set to the same value as the <i><tt>directory mask - </tt></i> parameter and the <i><tt>force directory security - mode</tt></i> parameter by default is set to the same value as - the <i><tt>force directory mode</tt></i> parameter. </p><p>In this way Samba enforces the permission restrictions that - an administrator can set on a Samba share, whilst still allowing users - to modify the permission bits within that restriction.</p><p>If you want to set up a share that allows users full control - in modifying the permission bits on their files and directories and - doesn't force any particular bits to be set 'on', then set the following - parameters in the <tt>smb.conf</tt> file in that share specific section :</p><p><i><tt>security mask = 0777</tt></i></p><p><i><tt>force security mode = 0</tt></i></p><p><i><tt>directory security mask = 0777</tt></i></p><p><i><tt>force directory security mode = 0</tt></i></p></div><div class="sect1" lang="en"><div class="titlepage"><div><h2 class="title" style="clear: both"><a name="id2886008"></a>Interaction with the standard Samba file attribute - mapping</h2></div></div><p>Samba maps some of the DOS attribute bits (such as "read - only") into the UNIX permissions of a file. This means there can - be a conflict between the permission bits set via the security - dialog and the permission bits set by the file attribute mapping. - </p><p>One way this can show up is if a file has no UNIX read access - for the owner it will show up as "read only" in the standard - file attributes tabbed dialog. Unfortunately this dialog is - the same one that contains the security info in another tab.</p><p>What this can mean is that if the owner changes the permissions - to allow themselves read access using the security dialog, clicks - <b>"OK"</b> to get back to the standard attributes tab - dialog, and then clicks <b>"OK"</b> on that dialog, then - NT will set the file permissions back to read-only (as that is what - the attributes still say in the dialog). This means that after setting - permissions and clicking <b>"OK"</b> to get back to the - attributes dialog you should always hit <b>"Cancel"</b> - rather than <b>"OK"</b> to ensure that your changes - are not overridden.</p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="passdb.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="groupmapping.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 10. User information database </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 12. Configuring Group Mapping</td></tr></table></div></body></html> diff --git a/docs/htmldocs/vfs.html b/docs/htmldocs/vfs.html deleted file mode 100644 index fcaca133fe..0000000000 --- a/docs/htmldocs/vfs.html +++ /dev/null @@ -1,490 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<HTML -><HEAD -><TITLE ->Stackable VFS modules</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK -REL="HOME" -TITLE="SAMBA Project Documentation" -HREF="samba-howto-collection.html"><LINK -REL="UP" -TITLE="Advanced Configuration" -HREF="optional.html"><LINK -REL="PREVIOUS" -TITLE="PAM Configuration for Centrally Managed Authentication" -HREF="pam.html"><LINK -REL="NEXT" -TITLE="Hosting a Microsoft Distributed File System tree on Samba" -HREF="msdfs.html"></HEAD -><BODY -CLASS="CHAPTER" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="NAVHEADER" -><TABLE -SUMMARY="Header navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TH -COLSPAN="3" -ALIGN="center" ->SAMBA Project Documentation</TH -></TR -><TR -><TD -WIDTH="10%" -ALIGN="left" -VALIGN="bottom" -><A -HREF="pam.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="80%" -ALIGN="center" -VALIGN="bottom" -></TD -><TD -WIDTH="10%" -ALIGN="right" -VALIGN="bottom" -><A -HREF="msdfs.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -></TABLE -><HR -ALIGN="LEFT" -WIDTH="100%"></DIV -><DIV -CLASS="CHAPTER" -><H1 -><A -NAME="VFS" -></A ->Chapter 21. Stackable VFS modules</H1 -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->21.1. <A -HREF="vfs.html#AEN3600" ->Introduction and configuration</A -></DT -><DT ->21.2. <A -HREF="vfs.html#AEN3609" ->Included modules</A -></DT -><DD -><DL -><DT ->21.2.1. <A -HREF="vfs.html#AEN3611" ->audit</A -></DT -><DT ->21.2.2. <A -HREF="vfs.html#AEN3619" ->extd_audit</A -></DT -><DT ->21.2.3. <A -HREF="vfs.html#AEN3623" ->recycle</A -></DT -><DT ->21.2.4. <A -HREF="vfs.html#AEN3660" ->netatalk</A -></DT -></DL -></DD -><DT ->21.3. <A -HREF="vfs.html#AEN3667" ->VFS modules available elsewhere</A -></DT -><DD -><DL -><DT ->21.3.1. <A -HREF="vfs.html#AEN3671" ->DatabaseFS</A -></DT -><DT ->21.3.2. <A -HREF="vfs.html#AEN3679" ->vscan</A -></DT -></DL -></DD -></DL -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3600" ->21.1. Introduction and configuration</A -></H1 -><P ->Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. -Samba passes each request to access the unix file system thru the loaded VFS modules. -This chapter covers all the modules that come with the samba source and references to -some external modules.</P -><P ->You may have problems to compile these modules, as shared libraries are -compiled and linked in different ways on different systems. -They currently have been tested against GNU/linux and IRIX.</P -><P ->To use the VFS modules, create a share similar to the one below. The -important parameter is the <B -CLASS="COMMAND" ->vfs object</B -> parameter which must point to -the exact pathname of the shared library objects. For example, to log all access -to files and use a recycle bin: - -<PRE -CLASS="PROGRAMLISTING" -> [audit] - comment = Audited /data directory - path = /data - vfs object = /path/to/audit.so /path/to/recycle.so - writeable = yes - browseable = yes</PRE -></P -><P ->The modules are used in the order they are specified.</P -><P ->Further documentation on writing VFS modules for Samba can be found in -the Samba Developers Guide.</P -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3609" ->21.2. Included modules</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3611" ->21.2.1. audit</A -></H2 -><P ->A simple module to audit file access to the syslog -facility. The following operations are logged: -<P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->share</TD -></TR -><TR -><TD ->connect/disconnect</TD -></TR -><TR -><TD ->directory opens/create/remove</TD -></TR -><TR -><TD ->file open/close/rename/unlink/chmod</TD -></TR -></TBODY -></TABLE -><P -></P -></P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3619" ->21.2.2. extd_audit</A -></H2 -><P ->This module is identical with the <SPAN -CLASS="emphasis" -><I -CLASS="EMPHASIS" ->audit</I -></SPAN -> module above except -that it sends audit logs to both syslog as well as the smbd log file/s. The -loglevel for this module is set in the smb.conf file. At loglevel = 0, only file -and directory deletions and directory and file creations are logged. At loglevel = 1 -file opens are renames and permission changes are logged , while at loglevel = 2 file -open and close calls are logged also.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3623" ->21.2.3. recycle</A -></H2 -><P ->A recycle-bin like modules. When used any unlink call -will be intercepted and files moved to the recycle -directory instead of beeing deleted.</P -><P ->Supported options: -<P -></P -><DIV -CLASS="VARIABLELIST" -><DL -><DT ->vfs_recycle_bin:repository</DT -><DD -><P ->FIXME</P -></DD -><DT ->vfs_recycle_bin:keeptree</DT -><DD -><P ->FIXME</P -></DD -><DT ->vfs_recycle_bin:versions</DT -><DD -><P ->FIXME</P -></DD -><DT ->vfs_recycle_bin:touch</DT -><DD -><P ->FIXME</P -></DD -><DT ->vfs_recycle_bin:maxsize</DT -><DD -><P ->FIXME</P -></DD -><DT ->vfs_recycle_bin:exclude</DT -><DD -><P ->FIXME</P -></DD -><DT ->vfs_recycle_bin:exclude_dir</DT -><DD -><P ->FIXME</P -></DD -><DT ->vfs_recycle_bin:noversions</DT -><DD -><P ->FIXME</P -></DD -></DL -></DIV -></P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3660" ->21.2.4. netatalk</A -></H2 -><P ->A netatalk module, that will ease co-existence of samba and -netatalk file sharing services.</P -><P ->Advantages compared to the old netatalk module: -<P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->it doesn't care about creating of .AppleDouble forks, just keeps ones in sync</TD -></TR -><TR -><TD ->if share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically</TD -></TR -></TBODY -></TABLE -><P -></P -></P -></DIV -></DIV -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN3667" ->21.3. VFS modules available elsewhere</A -></H1 -><P ->This section contains a listing of various other VFS modules that -have been posted but don't currently reside in the Samba CVS -tree for one reason ot another (e.g. it is easy for the maintainer -to have his or her own CVS tree).</P -><P ->No statemets about the stability or functionality any module -should be implied due to its presence here.</P -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3671" ->21.3.1. DatabaseFS</A -></H2 -><P ->URL: <A -HREF="http://www.css.tayloru.edu/~elorimer/databasefs/index.php" -TARGET="_top" ->http://www.css.tayloru.edu/~elorimer/databasefs/index.php</A -></P -><P ->By <A -HREF="mailto:elorimer@css.tayloru.edu" -TARGET="_top" ->Eric Lorimer</A ->.</P -><P ->I have created a VFS module which implements a fairly complete read-only -filesystem. It presents information from a database as a filesystem in -a modular and generic way to allow different databases to be used -(originally designed for organizing MP3s under directories such as -"Artists," "Song Keywords," etc... I have since applied it to a student -roster database very easily). The directory structure is stored in the -database itself and the module makes no assumptions about the database -structure beyond the table it requires to run.</P -><P ->Any feedback would be appreciated: comments, suggestions, patches, -etc... If nothing else, hopefully it might prove useful for someone -else who wishes to create a virtual filesystem.</P -></DIV -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN3679" ->21.3.2. vscan</A -></H2 -><P ->URL: <A -HREF="http://www.openantivirus.org/" -TARGET="_top" ->http://www.openantivirus.org/</A -></P -><P ->samba-vscan is a proof-of-concept module for Samba, which -uses the VFS (virtual file system) features of Samba 2.2.x/3.0 -alphaX. Of couse, Samba has to be compiled with VFS support. -samba-vscan supports various virus scanners and is maintained -by Rainer Link.</P -></DIV -></DIV -></DIV -><DIV -CLASS="NAVFOOTER" -><HR -ALIGN="LEFT" -WIDTH="100%"><TABLE -SUMMARY="Footer navigation table" -WIDTH="100%" -BORDER="0" -CELLPADDING="0" -CELLSPACING="0" -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" -><A -HREF="pam.html" -ACCESSKEY="P" ->Prev</A -></TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="samba-howto-collection.html" -ACCESSKEY="H" ->Home</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" -><A -HREF="msdfs.html" -ACCESSKEY="N" ->Next</A -></TD -></TR -><TR -><TD -WIDTH="33%" -ALIGN="left" -VALIGN="top" ->PAM Configuration for Centrally Managed Authentication</TD -><TD -WIDTH="34%" -ALIGN="center" -VALIGN="top" -><A -HREF="optional.html" -ACCESSKEY="U" ->Up</A -></TD -><TD -WIDTH="33%" -ALIGN="right" -VALIGN="top" ->Hosting a Microsoft Distributed File System tree on Samba</TD -></TR -></TABLE -></DIV -></BODY -></HTML ->
\ No newline at end of file |