From f5b17b7519006bff137f09cb3e18aaae71031c6c Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 28 Feb 2001 14:44:31 +0000 Subject: some updates and reorganization (This used to be commit a6d65d79642d0e2dfc7137d62eb0578c1cec15fb) --- docs/docbook/faq/samba-pdc-faq.sgml | 962 ++++++++++++++++++++++++++++++++ docs/docbook/howto/samba-pdc-howto.sgml | 778 ++++++++++++++++++++++++++ docs/docbook/samba-pdc-faq.sgml | 962 -------------------------------- docs/docbook/samba-pdc-howto.sgml | 778 -------------------------- 4 files changed, 1740 insertions(+), 1740 deletions(-) create mode 100644 docs/docbook/faq/samba-pdc-faq.sgml create mode 100644 docs/docbook/howto/samba-pdc-howto.sgml delete mode 100644 docs/docbook/samba-pdc-faq.sgml delete mode 100644 docs/docbook/samba-pdc-howto.sgml diff --git a/docs/docbook/faq/samba-pdc-faq.sgml b/docs/docbook/faq/samba-pdc-faq.sgml new file mode 100644 index 0000000000..4034987480 --- /dev/null +++ b/docs/docbook/faq/samba-pdc-faq.sgml @@ -0,0 +1,962 @@ + + + +The Samba 2.2 PDC FAQ + + + + DavidBannon + La Trobe University + +
dbannon@samba.org
+ November 2000 + + + +</> + + <para>Comments, corrections and additions to <email>D.Bannon@latrobe.edu.au</email></para> + + <para>This is the FAQ for Samba 2.2 as an NTDomain controller. + This document is derived from the origional FAQ that was built and + maintained by Gerald Carter + from the early days of Samba NTDomain development up until recently. + It is now being updated as significent changes are made to 2.2.0.</para> + + <para>Please note it does not apply to Samba2.2alpha0, Samba2.2alpha1, Samba 2.0.7, TNG nor HEAD branch. + </para> + <para>I'll repeat, it does not apply to the current snapshot [ftp mirror]:/pub/samba/alpha/samba-2.2.0-alpha1.tar.gz, only to the to the current cvs.</para> + +<para> + Also available is a Samba 2.2 PDC <ulink url="samba-pdc-howto.html">HowTo</> that takes you, step + by step, over the process of setting up a very basic Samba 2.2 Primary Domain Controller + </para> + + <note><para>Please read the Introduction for the current <link linkend=stateofplay> state of play</>.</para></> +</dedication> + +<toc></toc> + +<!-- ================ I N T R O D U C T I O N ==================== --> + + +<chapter><title>Introduction</> + +<sect1><title id=stateofplay>State of Play + It should be noted that 2.2.0 in its pre-release form still has a few problems, + I'll try and keep this section current while things are still dynamic. + At the time of this update (December 15, 2000) the current state of play is : + + Comments here about W2K joining the domain apply only to Samba 2.2 from the CVS after November 27th. The + 'snapshot' release Samba2.2alpha1 does not work !!! See below on how to get a CVS tree. + + Known Bug !W2K machines will not successfully join a domain with a name that + is made up from an even number of characters. Yep, thats right ! BIOTEST is OK as is MYDOMAI + but MYDOMAIN will not work until this bug is fixed. Hmm.., we believe + that this bug is fixed, but see below. + + Known Bug !After some bugs were fixed just before + Christmas, W2K SP1 machines cannot join the domain. Expected to be + fixed early in the new year. Whats that ? yeah, samba developers + have a Christmas break too ! + + + Know Bug !NTs (and possibly W2K ?) are not told the logged on user is a domain + admin if the parameter "domain admin users = user" is used. The alternative, "domain admin group" + does work. See the HowTo. + + Client Side creation of Machine accounts does work but is not complete. + Firstly, the add user script runs as the user who's + name was entered, not as root. Secondly, the machine name passed to the script (%U) + has an underscore at the end, not a '$'. One alternative is to use %m and add the $. + This method is documented in the HowTo. + And thirdly, it does not work with NT4ws. + + + A W2K machine can join the domain. See the HowTo + which explains the process. The methods + described are 'work arounds' and should be regarded as temporary. Although I (drb) + have tested these procedures a number of people have had difficulty so there + may be other issues at work. JFM is aware of these + problems and will attend to them when he can. + + A Domain Admin account is required and at present it appears that only root + is a suitable candidate. + + Much of the related code does work. For example, if an NT is removed from the + domain and then rejoins, the Create a Computer Account in the Domain dialog + will let you reset the smbpasswd. That is you don't need to do it from + the unix box. However, at the present, you do need to have root as an + administrator and use the root user name and password. + + Actually I'm + not sure that last paragraph is correct .... + + Policies do work on a W2K machine. MS says that recent builds of + W2K dont observe an NT policy but it appears it does in 'legacy' mode. + + +Introduction</> + <para>This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing with the 'old head' + version of Samba and its NTDomain facilities. It is being rewritten by David Bannon (drb) + so that it addresses more accurately the Samba 2.2 planned for release late 2000. </para> + + <para>This document probably still contains some material that does not apply to + Samba 2.2 but most (all?) of the really misleading stuff has been removed. Some + issues are not dealt with or are dealt with badly. Please send corrections and additions to + David Bannon at D.Bannon@latrobe.edu.au</para> + + <para>Hopefully, as we all become familiar with the Samba 2.2 as a PDC this document will + become much more usefull.</para> + + +</sect1> +</chapter> + +<!-- ============== G E N E R A L I N F O R M A T I O N ============== --> + +<chapter><title>General Information</> + + +<sect1><title>What can we do ? + +What can Samba Primary Domain Controller (PDC) do ?</> + + <para>If you wish to have Samba act as a PDC for Windows NT 3.51.and 4.0 or W2000 client, then you + will need to obtain the 2.2.0 version, currently in pre-release. Release of a stable, + full featured Samba PDC is currently slated for version 3.0. </para> + + <para>The following is a list of included features currently in Samba 2.2:</para> +<itemizedlist> + <listitem><para>The ability to act as a limited PDC for Windows NT and W2000 clients. + This includes adding NT and W2K machines to the domain and authenticating users logging + into the domain.</para></listitem> + <listitem><para>Domain account can be viewed using the User Manager for + Domains ????</para></listitem> + <listitem><para>Viewing resources on the Samba PDC via the Server Manager for Domains + from the NT client. ??</para></listitem> + <listitem><para>Windows 95 clients will allow user level security to be set + but will not currently allow browsing of accounts.</para></listitem> + <listitem><para>Machine account password updates.</para></listitem> + <listitem><para>Changing of user passwords from an NT client.</para></listitem> + <listitem><para>Partial support for Windows NT group and username mapping.</para></listitem> + <listitem><para>Support for a LDAP password database backend.</para></listitem> + <listitem><para>Printing.</para></listitem> +</itemizedlist> + + +<itemizedlist><title>These things are note expected to work in the forseeable future + Trust relationships + PDC and BDC integration + Windows NT ACLs (on the Samba shares) + Offer a list of domain users to User Manager for Domains + (or the Security Tab etc). + + + +Can I have a Windows 2000 client logon to a Samba controlled domain?</> + + <para>The 2.2 release branch of Samba supports Windows 2000 domain + clients in legacy mode, ie as if the PDC is a NTServer, not a + W2K server.</para> +</sect2> + +<sect2><title>What's the status of print spool (spoolss) support in the NTDOM code? </> + + <para>The implementation of support for SPOOLSS pipe is complete and it will be available + in the 2.2.0 release. This means that Samba will support the automatic downloading of printer + drivers for Windows NT clients just as it currently does for Windows 9x clients.</para> +</sect2> +</sect1> + +<sect1><title>CVS + CVS is a programme (publically available) that the Samba developers use to + maintain the central source code. Non developers can get access to the source in + a read only capacity. Many flavours of unix now arrive with cvs installed. + +What are the different Samba branches available in CVS ?</> + + <para>You can find out more about obtaining Samba's via + anonymous CVS from + <ulink url="http://pserver.samba.org/samba/cvs.html"> + http://pserver.samba.org/samba/cvs.html"</>. </para> + +<variablelist><title>There are basically four branches to watch at the moment :</> + <varlistentry> + <term>HEAD</> + <listitem><para>Samba 3.0 ? This code boasts all the main development + work in Samba. Two things that most people are not aware of + which live in the HEAD branch code are winbind NSS module and + Tim Potter's VFS implementation. Due to its developmental + nature, its not really suitable for production work. + </para></listitem></varlistentry> + <varlistentry> + <term>SAMBA_2_0</term> + <listitem><para>This branch contains the current stable release release. + At the moment it contains 2.0.7, a version that will do some + limited PDC stuff. If you are really going to do PDC things then + I (drb) suggest that you consider 2.2 instead. + </para></listitem></varlistentry> + <varlistentry> + <term>SAMBA_2_2</> + <listitem><para>The next stable release, currently in a 'alpha' form. + It provides the Samba developers, testers and interested + people with an approximation of what is to come. This document + addresses only SAMBA_2_2. + </para></listitem></varlistentry> + <varlistentry> + <term>SAMBA_TNG</> + <listitem><para>This branch is no longer maintained from the Samba sites. + Please see <ulink url="http://www.samba-tng.org/"> + http://www.samba-tng.org/</ulink>. It has been requested + that questions about TNG are not posted to the regular Samba mailing + lists including samba-ntdom and samba-technical. + </para></listitem></varlistentry> +</variablelist> +</sect2> + +<sect2><title>What are the CVS commands ?</> + + <para>See <ulink url="http://pserver.samba.org/samba/cvs.html"> + http://pserver.samba.org/samba/cvs.html</></para> + + + <itemizedlist><title>To get the Samba 2.2 version, tag SAMBA_2_2 you would do :</> + <listitem><para> For example : <command>cd /usr/local/src/</></></> + <listitem><para> <command>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot + login</></></> + <listitem><para> When prompted enter a password of <command>cvs</></></> + <listitem><para> <command>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot + co -r SAMBA_2_2 samba</></></> + </itemizedlist> + + <itemizedlist><title>Then to update that directory at some later time,</> + <listitem><para> <command>cd /usr/local/src/samba</></></> + <listitem><para> <command>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login</></></> + <listitem><para> When prompted enter a password of 'cvs'.</></> + <listitem><para> <command>cvs update -d -P</></></> + </itemizedlist> +</sect2> +</sect1> +</chapter> + +<chapter><title>Establishing Connections</> +<sect1><title> + +How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</> + + <para>There is a comprehensive Samba PDC <ulink url="samba-pdc-howto.html">HowTo</> + accessable from the samba web site + under 'Documentation'. Its currently located at <ulink url="http://bioserve.latrobe.edu.au/samba"> + http://bioserve.latrobe.edu.au/samba</>. Read it.</para> +</sect2> + +<sect2><title>What is a 'machine account' ? + Every NT, W2K or Samba machine that joins a Samba controlled domain must be known to + the Samba PDC. There are two entries required, one in (typically) /etc/passwd + and the other in (typically) /usr/local/samba/private/smbpasswd. Under + some circumstances these entries are made manually, the + HowTo discusses ways of creating them automatically. + + + +"The machine account for this computer either does not exist or is not accessable."</> + + <para>When I try to join the domain I get the message "The machine account for this computer + either does not exist or is not accessable". Whats wrong ?</para> + + <para>This problem is caused by the PDC not having a suitable machine account. + If you are using the <command>add user script =</> method to create accounts + then this would indicate that it has not worked. Ensure the domain admin user + system is working.</para> + + <para>Alternatively if you are creating account entries manually then they have not been created + correctly. Make sure that you have the entry correct for the machine account in smbpasswd + file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, + make sure that the account name is the machine netbios name with a '$' appended to it + ( ie. computer_name$ ). There must be an entry in both /etc/passwd and + the smbpasswd file. Some people have reported that + inconsistent subnet masks between the Samba server and the NT client have caused this problem. + Make sure that these are consistent for both client and server.</para> +</sect2> + +<sect2><title id=machineaccounts>How do I create machine accounts manually ? + + This was the only option until recently, now in version 2.2 better means are available. + You might still need to do it manually for a couple of reasons. A machine account + consists of two entries (assuming a standard install and /etc/passwd use), + one in /etc/passwd and the other in /usr/local/samba/private/smbpasswd. The /etc/passwd + entry will list the machine name with a $ appended, won't have a passwd, will have a null + shell and no home directory. For example a machine called 'doppy' would have an /etc/passwd + entry like this : + + doppy$:x:505:501:NTMachine:/dev/null:/bin/false + + On a linux system for example, you would typically add it like this : + + adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n + doppy$ + + Then you need to add that entry to smbpasswd, assuming you have a suitable + path to the smbpasswd programme, do this : + + smbpasswd -a -m doppy$ + + The entry will be created with a well known password, so any machine that + says its doppy could join the domain as long as it gets in first. So don't create + the accounts any earlier than you need them. + + +I cannot include a '$' in a machine name. + + A 'machine name' in (typically) /etc/passwd consists + of the machine name with a '$' appended. FreeBSD (and other BSD systems ?) + won't create a user with a '$' in their name. + + The problem is only in the program used to make the entry, once made, it works + perfectly. So create a user without the '$' and use vipw to edit + the entry, adding the '$'. Or create the whole entry with vipw if you like, + make sure you use a unique uid ! + + +I get told "You already have a connection to the Domain...." when creating a + machine account.</> + + <para>This happens if you try to create a machine account from the machine itself + and use a user name that does not work (for whatever reason) and then try + another (possibly valid) user name. + Exit out of the network applet to close the initial connection and try again.</para> + + <para>Further, if the machine is a already a 'member of a workgroup' that is the + same name as the domain you are joining (bad idea) you will get this message. + Change the workgroup name to something else, it does not matter what, reboot, + and try again.</para> +</sect2> + +<sect2><title>I get told "Cannot join domain, the credentials supplied conflict + with an existing set.."</> + <para>This is the same basic problem as mentioned above, <link linkend=alreadyhaveconnection> + "You already have a connection..."</link></para> +</sect2> + +<sect2><title>"The system can not log you on (C000019B)...."</> + <para>I joined the domain successfully but after upgrading to a newer version of the + Samba code I get the message, "The system can not log you on (C000019B), Please try a + gain or consult your system administrator" when attempting to logon.</para> + + <para>This occurs when the domain SID stored in private/WORKGROUP.SID is changed. + For example, you remove the file and smbd automatically creates a new one. + Or you are swapping back and forth between versions 2.0.7, TNG and the HEAD branch + code (not recommended). The only way to correct the problem is to restore the + original domain SID or remove the domain client from the domain and rejoin.</para> +</sect2> +</sect1> + +</chapter> + + +<!-- ============ U S E R A C C O U N T M A N A G M E N T ============= --> + +<chapter><title>User Account Management +Domain Admins +How do I configure an account as a domain administrator? + + See the NTDom HowTo. + + + +Profiles +Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</> + + <para>Sometimes Windows clients will maintain a connection to the \\homes\ ( or [%U] ) share + even after the user has logged out. Consider the following scenario.</para> +<itemizedlist> + <listitem><para> user1 logs into the Windows NT machine. Therefore the + [homes] share is set to \\server\user1.</para></listitem> + <listitem><para> user1 works for a while and then logs out. </para></listitem> + <listitem><para> user2 logs into the same Windows NT machine.</para></listitem> +</itemizedlist> + + <para>However, since the NT box has maintained a connection to [homes] which was + previously set to \\server\user1, when the operating system attempts to + get the profile and if it can read users1's profile, will get it otherwise it + will return an error. You get the picture.</para> + + <para>A better solution is to use a separate [profiles] share and set the + "logon path = \\%N\profiles\%U" </para> + + + <note><para>Is this still a problem ????</para></note> +</sect2> + + +<sect2><title>Why are all the users listed in the "domain admin users" using the same profile?</> + + <para>You are using a very very old development version of Samba. Upgrade.</para> +</sect2> + + + + + +<sect2><title>The roaming profiles do not seem to be updating on the server. + + There can be several reasons for this. + + Make sure that the time on the client and the PDC are synchronized. You can accomplish + this by executing a net time \\server /set /yes replacing server with the + name of your PDC (or another synchronized SMB server). See + about Setting Time + + Make sure that the + logon path is writeable by the user and make sure that the connection to the logon + path location is by the current user. Sometimes Windows client do not drop the + connection immediately upon logoff. + + Some people have reported that the logon path location should also be browseable. + I (GC) have yet to emperically verify this, but you can try. + + + +Policies + +What are 'Policies' ?. + When a user logs onto the domain via a client machine, the PDC sends + the client machine a list of things contained in the 'policy' (if it exists). + This list may do things like suppress a splach screen, format the dates the way you + like them or perhaps remove locally stored profiles. + + On a samba PDC this list is obtained from a file called ntconfig.pol + and located in the [netlogon]share. The file is created with a policy editor + and must be readable by anyone and writeable by only root. See + below for how to get a suitable editor. + + +I can't get system policies to work. + + There are two possible reasons for system policies not functioning correctly. + Make sure that you have the following parameters set in smb.conf + + + [netlogon] + .... + locking = no + public = no + browseable = yes + .... + + + A policy file must be in the [netlogon] share and must be + readable by everyone and writeable by only root. The file must be created + by an NTServer Policy Editor. + + Last time I (drb) looked in the source, it was + looking for ntconfig.pol first then several other combinations of upper + and lower case. People have reported success using NTconfig.pol, + NTconfig.POL and ntconfig.pol. These are the case + settings that I (GC) use with the + filename ntconfig.pol + + + case sensitive = no + case preserve = yes + default case = yes + + + + +What about Windows NT Policy Editor ? + + To create or edit ntconfig.pol you must use the NT Server + Policy Editor, poledit.exe which is included with NT Server + but not NT Workstation. There is a Policy Editor on a NTws + but it is not suitable for creating Domain Policies. + Further, although the Windows 95 + Policy Editor can be installed on an NT Workstation/Server, it will not + work with NT policies because the registry key that are set by the policy templates. + However, the files from the NT Server will run happily enough on an NTws. + You need poledit.exe, common.adm and winnt.adm. It is convenient + to put the two *.adm files in c:\winnt\inf which is where + the binary will look for them unless told otherwise. Note also that that + directory is 'hidden'. + + The Windows NT policy editor is also included with the + Service Pack 3 (and later) for Windows NT 4.0. Extract the files using + servicepackname /x, ie thats Nt4sp6ai.exe /x + for service pack 6a. + The policy editor, poledt.exe and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the policy editor. Another possible + location is with the Zero Administration Kit available for download from Microsoft. + + + + +Can Win95 do Policies ? + + Install the group policy handler for Win9x to pick up group policies. + Look on the Win98 CD in + \tools\reskit\netadmin\poledit. Install group policies on a Win9x client by double-clicking + grouppol.inf. Log off and on again a couple of times and see if + Win98 picks up group policies. + Unfortunately this needs to be done on every Win9x machine that uses group policies.... + + If group policies don't work one reports suggests getting the updated (read: working) + grouppol.dll for Windows 9x. The group list is grabbed from /etc/group. + + + + + +Passwords + +What is password sync and should I use it ? + + NTws users can change their domain password by pressing Ctrl-Alt-Del and + choosing 'Change Password'. By default however, this does not change the unix password + (typically in /etc/passwd or /etc/shadow). In lots of situations + thats OK, for example : + + The server is only accessible to the user via samba. + Pam_smb or similar is installed so other applications + still refer to the samba password. + + But sometimes you really do need to maintain two seperate password databases and + there are good reasons to keep then in sync. Trying to explain to users + that they need to change their passwords in two seperate places or use + two seperate passwords is not fun. + + However do understand that setting up password sync is not without problems either. + The chief difficulty is the interface between Samba and the passwd command, + it can be a fiddle to set up and if the password the user has entered fails, + the resulting errors are ambiguously reported + and the user is confused. Further, you need to take steps to ensure that users + only ever change their passwords via samba (or use smbpasswd), + otherwise they will only be changing the unix password. + + + + +How do I get remote password (unix and SMB) changing working ?</> + + <para>Have a practice changing a user's password (as root) to see what + discussion takes place and change the text in the 'passwd chat' line below as necessary. The + line as shown works for recent RH Linux but most other systems seem to like to do something + different. The '*' is a wild card and will match anything (or nothing). + </para> + + <para>Add these lines to smb.conf under [Global]</para> + + <programlisting> + + unix password sync = true + passwd program = /usr/bin/passwd %u + passwd chat = *password* %n\n *password* %n\n *successful* + </programlisting> + + <para>As mentioned above, the change to the unix password + happens as root, not as the user, as is indicated in ~/smbd/chgpasswd.c If + you are using NIS, the Samba server must be running on the NIS master machine.</para> +</sect2> + +</sect1> + +</chapter> + +<!-- =================== M I S C E L L A N E O U S ================= --> + +<chapter><title>Miscellaneous + +What editor can I use in DOS/Windows that won't mess with my unix EOF + There are a number of Windows or DOS based editors that will understand, and + leave intact, the unix eof (as opposed to a DOS CL/LF). List members suggested : + + + UltraEdit at www.ultraedit.com + VI for windows at + home.snafu.de/ramo/WinViEn.htm + The author prefers PFE at + www.lancs.ac.uk/people/cpaap/pfe/ but its no longer being developed... + + + + + + +How do I get 'User Manager' and 'Server Manager' + + Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for + Domains', the 'Server Manager' ? + +Microsoft distributes a version of these tools called nexus + for installation on Windows 95 systems. The tools set includes + Server Manager + User Manager for Domains + Event Viewer + + + Click here to download the archived file + + ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE + + The Windows NT 4.0 version of the 'User Manager for Domains' + and 'Server Manager' are available from Microsoft via ftp from + + ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE + + + +The time setting from a Samba server does not work. + If it works OK when you log on as Domain Admin then the problem is that ordinary users + don't have permission to change the time. (The system is running with their permission + at logon time.) This is not a Samba problem, you will have the same problem where ever + you connect. You can give 'everyone' permission to change the time from the User Manager. + + + Anyone know what the registry settings are so this could be done with a Policy ? + + +"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</> + <para>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS." + in the logs. What do I need to do?</para> + + <para>You are using one of the old development versions. Upgrade. + (The message is unimportant, was a reminder to a developer)</para> + +</sect2> + +<sect2><title>How do I get my samba server to become a member ( not PDC ) of an NT domain? + + + In a domain that has a number of servers you only need one password database. + The machines that don't have their own ask the PDC to check for them. + This will work fine for a domain controlled by either a Samba or NT machine. + The following lines in smb.conf are typical, 'password server' points to the + samba machine (or an NT) that has the password list : + + + + [global] + ... + security = domain + workgroup = { Put your domain name here } + password server = { Put the ip of the PDC here } + encrypt passwords = yes + ... + + + The samba server in question will have to 'join the domain', that requires + the domain controller to have a machine account for it. This is no different + to the machine account requirements to allow a NTws to join the domain. For + example, if we want a unix box called sleepy to ask the PDC called grumpy + to do its authentication then grumpy will need an entry in its smbpasswd + (assuming it's also samba) that starts with sleepy$. It would have to be + created manually. + + If the domain is controlled by an NTServer then the "Server Manager for Domains" + tool must be used to add 'sleepy' to the domain list. + + In either case we then join the domain. If the domain is called forest + then on sleepy we would join the domain by typing : + + smbpasswd -j forest + + Note that the directory where the smbpasswd file would be + located should exist as this is where smbd will generate the MACHINE.SID file. This + might be /usr/local/samba/private/FOREST.SLEEPY.SID and + it contains the trust account password for the domain member. The permissions are + (and should remain) "rw------- + + + Note the Samba Servers without the password list will most likely still need an account + for each user, this means a line in its /etc/passwd. Because authentication + is being handled at the domain level the + /etc/passwd line does not need a password. + If the shares being offered are not user specific, ie a common (read only ?) + area or perhaps just printing then the user's + /etc/passwd does not need a home directory. A typical + line in /etc/passwd for a server that allows domain users to + connect to the samba shares but does not offer a home share ('cos that's on the PDC) + and does not allow logon to the unix prompt would be like this : + + jblow:x:542:100:Joe Blow:/dev/null:/bin/false + + Notes :</> + <itemizedlist> + <listitem><para>When removing those 'dummy' users, watch the 'remove user' scripts, + some OS think they should remove a users directory even when its not owned by the user ! + </para></listitem> + + <listitem><para>The <filename>username map = </> parameter might help you to avoid having + all those accounts created.</para></listitem> + + <listitem> + <para>You should investigate the smb.conf parameter + <filename>'add user script'</filename>, it will be used to create accounts on + secondary servers when that account already exists on the PDC. Very nice. + Something like :</para> + + <programlisting> + [Global] + .... + add user script = /usr/sbin/adduser -n -g users -c User -d /dev/null -s /bin/false %U + .... + </programlisting> + </listitem> + </itemizedlist> + </note> + +</sect2> +</sect1> +</chapter> + + +<!-- ======== T R O U B L E S H O O T I N G and B U G R E P O R T I N G ======== --> + + + +<chapter><title>Troubleshooting and Bug Reporting + +Diagnostic tools + +What are some diagnostics tools I can use to debug the domain logon process and where can I + find them? + + One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d + option for both smbd and nmbd to specifiy what 'debug level' at which to run. See the man + pages on smbd, nmbd and smb.conf for more information on debugging options. The debug + level can range from 1 (the default) to around 100 but a debug level of about 20 will + normally help you find any errors that samba is encountering. Another helpful method + of debugging is to compile samba using the gcc -g flag. This will include debug + information in the binaries and allow you to attch gdb to the running smbd / nmbd + process. In order to attach gdb to an smbd process for an NT workstation, first + get the workstation to make the connection. Pressing ctrl-alt-delete and going down + to the domain box is sufficient (at least, on the first time you join the domain) to + generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open + connection, and therefore there will be an smbd process running (assuming that you + haven't set a really short smbd idle timeout) So, in between pressing ctrl alt + delete, and actually typing in your password, you can gdb attach and continue. + + Some usefull samba commands worth investigating:</> + <listitem><para>testparam | more</></> + <listitem><para>smbclient -L //{netbios name of server}</></> + </itemizedlist> + + <para>An SMB enabled version of tcpdump is available from + <ulink url="ftp://samba.org/pub/samba/tcpdump-smb/">ftp://samba.org/pub/samba/tcpdump-smb/ + </ulink></para> + + <para>Capconvert is a small C program for translating output from tcpdump-smb to CAP format + that can be read by netmon. You will need to use the raw output from tcp dump + ( ie. <command>tcpdump -w output.dump</> ). Good news! Now you can convert + Solaris' snoop output as well. The C source code for snoop2cap is available for download. + </para> + + <para>For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available + on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's. + The version of netmon that ships with SMS allows for dumping packets between any two + computers (ie. placing the network interface in promiscuous mode). The version + on the NT Server install CD will only allow monitoring of network traffic directed to the + local NT box and broadcasts on the local subnet.</para> + +</sect2> + +<sect2><title>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box? + + Installing netmon on an NT workstation requires a couple of steps. The following + are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server + 4.0, on Microsoft Windows NT Workstation 4.0. The process should be similar + for other version of Windows NT / Netmon. You will need both the Microsoft Windows + NT Server 4.0 Install CD and the Workstation 4.0 Install CD. + + + Initially you will need to install 'Network Monitor Tools and Agent' on the + NT Server. To do this + + + Goto Start - Settings - Control Panel - Network - Services - Add + Select the 'Network Monitor Tools and Agent' and click on 'OK'. + Click 'OK' on the Network Control Panel. + Insert the Windows NT Server 4.0 install CD when prompted. + + + At this point the Netmon files should exist in %SYSTEMROOT%\System32\netmon\*.*. + Two subdirectories exist as well, parsers\ which contains the necessary DLL's + for parsing the netmon packet dump, and captures\. + + In order to install the Netmon tools on an NT Workstation, you will first need to + install the 'Network Monitor Agent' from the Workstation install CD. + + Goto Start - Settings - Control Panel - Network - Services - Add + Select the 'Network Monitor Agent' and click on 'OK'. + Click 'OK' on the Network Control Panel. + Insert the Windows NT Workstation 4.0 install CD when prompted. + + + + Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to + %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as + you deem appropriate for your site. You will need administrative rights on the + NT box to run netmon. + + To install Netmon on a Windows 9x box install the network monitor agent from + the Windows 9x CD (\admin\nettools\netmon). + There is a readme file located with the netmon driver files on the CD if you need + information on how to do this. Copy the files from a working Netmon installation. + + + + + +What other help can I get ? + + There are many sources of information available in the form of mailing lists, RFC's + and documentation. The docs that come with the samba distribution contain very + good explanations of general SMB topics such as browsing. + +URLs and similar + + + + + Home of Samba site + http://samba.org. We have a mirror near you ! + + The Development document + on the Samba mirrors might mention your problem. If so, + it might mean that the developers are working on it. + + Ignacio Coupeau has a very comprehesive look at LDAP with Samba at + + http://www.unav.es/cti/ldap-smb-howto.html + Be a little carefull however, I suspect that it does not specificly + address samba 2.2.x. The HEAD pre-2.1 may possibly be the best + stream to look at. + + Lars Kneschke's site covers + Samba-TNG at + + http://www.kneschke.de/projekte/samba_tng, but again, a + lot of it does not apply to the main stream Samba. + + See how Scott Merrill simulates a BDC behaviour at + + http://www.skippy.net/linux/smb-howto.html. + + Although 2.0.7 has almost had its day as a PDC, I (drb) will + keep the 2.0.7 PDC pages at + http://bioserve.latrobe.edu.au/samba going for a while yet. + + Misc links to CIFS information + http://samba.org/cifs/ + + NT Domains for Unix + http://mailhost.cb1.com/~lkcl/ntdom/ + + FTP site for older SMB specs: + + ftp://ftp.microsoft.com/developr/drg/CIFS/ + + + + +There are a number of documents that no longer appear to live at their + origional home. Any one know where the following may be found ? + + CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt + CIFS Remote Administration Protocol draft-leach-cifs-rap-spec-00.txt + CIFS Logon and Pass Through Authentication draft-leach-cifs-logon-spec-00.txt + A Common Internet File System (CIFS/1.0) Protocol draft-leach-cifs-v1-spec-01.txt + CIFS Printing Specification draft-leach-cifs-print-spec-00.txt + RFC1001 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Concepts and methods. + http://ds.internic.net/rfc/rfc1001.txt + RFC1002 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Detailed specifications. + http://ds.internic.net/rfc/rfc1002.txt + Microsoft's main CIFS page: http://www.microsoft.com/workshop/networking/cifs/ + + + + + +How do I get help from the mailing lists ? + + There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror + and then click on Support and then click on + Samba related mailing lists. + + For questions relating to Samba TNG go to + http://www.samba-tng.org/ + It has been requested that you don't post questions about Samba-TNG to the + main stream Samba lists. + +If you post a message to one of the lists please + observe the following guide lines : + + Always remember that the developers are volunteers, they are + not paid and they never guarantee to produce a particular feature at + a particular time. Any time lines are 'best guess' and nothing more. + + + Always mention what version of samba you are using and what + operating system its running under. You should probably list the + relevant sections of your smb.conf file, at least the options + in [global] that affect PDC support. + + In addition to the version, if you obtained Samba via + CVS mention the date when you last checked it out. + + Try and make your question clear and brief, lots of long, + convoluted questions get deleted before they are completely read ! + Don't post html encoded messages (if you can select colour or font + size its html). + + If you run one of those niffy 'I'm on holidays' things when + you are away, make sure its configured to not answer mailing lists. + + + Don't cross post. Work out which is the best list to post to + and see what happens, ie don't post to both samba-ntdom and samba-technical. + Many people active on the lists subscribe to more + than one list and get annoyed to see the same message two or more times. + Often someone will see a message and thinking it would be better dealt + with on another, will forward it on for you. + + You might include partial + log files written at a debug level set to as much as 20. + Please don't send the entire log but enough to give the context of the + error messages. + + (Possibly) If you have a complete netmon trace ( from the opening of + the pipe to the error ) you can send the *.CAP file as well. + + Please think carefully before attaching a document to an email. + Consider pasting the relevant parts into the body of the message. The samba + mailing lists go to a huge number of people, do they all need a copy of your + smb.conf in their attach directory ? + + + + + +How do I get off the mailing lists ? + To have your name removed from a samba mailing list, go to the + same place you went to to get on it. Go to http://samba.org, click on your nearest mirror + and then click on Support and then click on + Samba related mailing lists. Or perhaps see + here + + Please don't post messages to the list asking to be removed, you will just + be refered to the above address (unless that process failed in some way...) + + + + + + + + + + + diff --git a/docs/docbook/howto/samba-pdc-howto.sgml b/docs/docbook/howto/samba-pdc-howto.sgml new file mode 100644 index 0000000000..4b8380dd9e --- /dev/null +++ b/docs/docbook/howto/samba-pdc-howto.sgml @@ -0,0 +1,778 @@ + + + + +The Samba 2.2 PDC HowTo + + + + + + DavidBannon + La Trobe University + + November 2000 + + + + + Comments, corrections and additions to dbannon@samba.org + + + This document explains how to setup Samba as a Primary Domain Controller and + applies to version 2.2.0. + Before + using these functions make sure you understand what the controller can and cannot do. + Please read the sections below in the Introduction. + As 2.2.0 is incrementally updated + this document will change or become out of date very quickly, make sure you are + reading the most current version. + + + Please note this document does not apply to Samba2.2alpha0, Samba2.2alpha1, + Samba 2.0.7, TNG nor HEAD branch. + + It does apply to the current (post November 27th) cvs. + + + Also available is an updated version of Jerry Carter's NTDom + FAQ that will answer lots of + the special 'tuning' questions that are not covered here. Over the next couple of weeks + some of the items here will be moved to the FAQ. + + + + + + + + + +Introduction + + +This document will show you one way of making Version 2.2.0 +of Samba perform some of the tasks of a +NT Primary Domain Controller. The facilities described are built into Samba as a result of +development work done over a number of years by a large number of people. These facilities +are only just beginning to be officially supported and although they do appear to work reliably, +if you use them then you take the risks upon your self. This document does not cover the +developmental versions of Samba, particularly +Samba-TNG + + + + + +Note that Samba 2.0.7 + supports significently less of the NT Domain facilities compared with 2.2.0 + + + + This document does not replace the text files DOMAIN_CONTROL.txt, DOMAIN.txt (by + John H Terpstra) or NTDOMAIN.txt (by Luke Kenneth Casson Leighton). Those documents provide + more detail and an insight to the development + cycle and should be considered 'further reading'. + + + + +What can we do ? + + Permit 'domain logons' for Win95/98, NT4 and W2K workstations from one central + password database. WRT W2K, please see the section about adding machine + accounts and the Intro in the FAQ. + Grant Administrator privileges to particular domain users on an + NT or W2K workstation. + Apply policies from a domain policy file to NT and W2K (?) + workstation. + Run the appropriate logon script when a user logs on to the domain + . + Maintain a user's local profile on the server. + Validate a user using another system via smb (such as smb_pam) and + soon winbind (?). + + + + +What can't we do ? + + Become or work with a Backup Domain Controller (a BDC). + Participate in any sort of trust relationship (with either Samba or NT + Servers). + Offer a list of domain users to User Manager for Domains + on the Security Tab etc). + Be a W2K type of Domain Controller. Samba PDC will behave like + an NT PDC, W2K workstations connect in legacy mode. + + + + + + + + +Installing + + Installing consists of the usual download, configure, make and make + install process. These steps are well documented elsewhere. + The FAQ discusses getting pre-release versions via CVS. + Then you need to configure the server. + +Start Up Script + Skip this section if you have a working Samba already. + Everyone has their own favourite startup script. Here is mine, offered with no warrantee + at all ! + + + + #!/bin/sh + # Script to control Samba server, David Bannon, 14-6-96 + # + # + PATH=/bin:/usr/sbin:/usr/bin + export PATH + case "$1" in + 'start') + if [ -f /usr/local/samba/bin/smbd ] + then + /usr/local/samba/bin/smbd -D + /usr/local/samba/bin/nmbd -D + echo "Starting Samba Server" + fi + ;; + 'conf') + if [ -f /usr/local/samba/lib/smb.conf ] + then + vi /usr/local/samba/lib/smb.conf + fi + ;; + 'pw') + if [ -f /usr/local/samba/private/smbpasswd ] + then + vi /usr/local/samba/private/smbpasswd + fi + ;; + 'who') + /usr/local/samba/bin/smbstatus -b + ;; + 'restart') + psline=`/bin/ps x | grep smbd | grep -v grep` + + if [ "$psline" != "" ] + then + while [ "$psline" != "" ] + do + psline=`/bin/ps x | fgrep smbd | grep -v grep` + if [ "$psline" ] + then + set -- $psline + pid=$1 + /bin/kill -HUP $pid + echo "Stopped $pid line = $psline" + sleep 2 + fi + done + fi + echo "Stopped Samba servers" + ;; + 'stop') + psline=`/bin/ps x | grep smbd | grep -v grep` + + if [ "$psline" != "" ] + then + while [ "$psline" != "" ] + do + psline=`/bin/ps x | fgrep smbd | grep -v grep` + if [ "$psline" ] + then + set -- $psline + pid=$1 + /bin/kill -9 $pid + echo "Stopped $pid line = $psline" + sleep 2 + fi + done + fi + echo "Stopped Samba servers" + psline=`/bin/ps x | grep nmbd | grep -v grep` + if [ "$psline" ] + then + set -- $psline + pid=$1 + /bin/kill -9 $pid + echo "Stopped Name Server " + fi + echo "Stopped Name Servers" + ;; + *) + echo "usage: samba {start | restart |stop | conf | pw | who}" + ;; + esac + + + + Use this script, or some other one, you will need to ensure its used while the machine + is booting. (This typically involves /etc/rc.d, we'll be + assuming that there is a script called + samba in /etc/rc.d/init.d further down in this document.) + + + +Config File + +A sample conf file + Here is a fairly minimal config file to do PDC. It will also make the server + become the browse master for the + specified domain (not necessary but usually desirable). You will need to change only + two parameters to make this + file work, wins server and workgroup, plus + you will need to put your own name (not mine!) in the domain admin users fields. + Some of the parameters are discussed further down this document. + + Assuming you have used the default install directories, this file should appear as + /usr/local/samba/lib/smb.conf. It should not be + writable by anyone except root. + + The 'add user script' parameter is a work-around, watch for changes ! + + + + [global] + security = user + status = yes + workgroup = { Your domain name here } + wins server = { ip of a wins server if you have one } + encrypt passwords = yes + domain logons =yes + logon script = scripts\%U.bat + domain admin group = @adm + add user script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %m$ + guest account = ftp + share modes=no + os level=65 + [homes] + guest ok = no + read only = no + create mask = 0700 + directory mask = 0700 + oplocks = false + locking = no + [netlogon] + path = /usr/local/samba/netlogon + writeable = no + guest ok = no + + + + + +PDC Config Parameters + + +There are a huge range of parameters that may appear in a smb.conf file. Some + that may be of interest to a PDC are : + +add user script + This parameter specifies a script (or program) that will be run + to add a user to the system. Here it is being used to add a machine, not a user. + This is probably not very nice and may change. But it does work ! + + For this example, I have a group called 'machines', entries can be added to + /etc/passwd using a programme called /usr/adduser and + the other parameters are chosen as suitable for a machine account. Works for + RH Linux, your system may require changes. + + + + +domain admin group = @adm + This parameter specifies a unix group whose members will be granted + admin privileges on a NT workstation when + logged onto that workstation. See the section called + Domain Admin Accounts. + + + +domain admin users = user1 users2 + It appears that this parameter does not funtion correctly at present. + Use the 'domain admin group' instread. This parameter specifies a unix user who will + be granted admin privileges + on a NT workstation when + logged onto that workstation. See the section called + Domain Admin Accounts. + + + +encrypt passwords = yes + This parameter must be 'yes' to allow any of the recent service pack NTs to logon. There are some reg hacks that + turn off encrypted passwords on the NTws itself but if you are going to use the smbpasswd system (and you + should) you must use encrypted passwords. + + + +logon script = scripts\%U.bat + This will make samba look for a logon script named after the user + (eg joeblow.bat). + See the section further on called Logon Scripts + Note that the slash is like this '\', not like this '/'. + NT is happy with both, win95 is not ! + + + +logon path + Lets you specify where you would like users profiles kept. The default, that is in the users + home directory, does encourage a bit of fiddling. + + + + + + + + + + +Special directories + You need to create a couple of special files and directories. Its nice + to have some of the binaries handy too, so I create links to them. Assuming + you have used the default samba location and have not + changed the locations mentioned in the sample config file, do the following : + + + + mkdir /usr/local/samba/netlogon + mkdir /usr/local/samba/netlogon/scripts + mkdir /usr/local/samba/private + touch /usr/local/samba/private/smbpasswd + chmod go-rwx /usr/local/samba/private/smbpasswd + cd /usr/local/sbin + ln -s /usr/local/samba/bin/smbpasswd + ln -s /usr/local/samba/bin/smbclient + ln -s /etc/rc.d/init.d/samba + + + Make sure permissions are appropriate ! + + OK, if you have used the scripts above and have a path to where the links are do this to start up + the Samba Server : + + samba start + + Instead, you might like to reboot the machine to make sure that you + got the init stuff right. Any way, a quick look in the logs + /usr/local/samba/var/log.smbd and + /usr/local/samba/var/log/nmbd + will give you an idea of what's happening. Assuming all is well, lets create + some accounts... + + + + + +User and Machine Accounts +Logon Accounts + + This section is very nearly out of date already ! It + appears that while you are reading it, Jean Francois Micou is making it + redundant ! Jean Francois is adding facilities to add users + (via User Manager) and machines (when joining the domain) and it looks like these facilities will + make it into the official release of 2.2. + + + Every user and NTws (and other samba servers) that will be on the domain + must have its own passwd entry in both /etc/passwd and + /usr/local/samba/private/smbpasswd . + The /etc/passwd entry is really + only to reserve a user ID. The NT encrypted password is stored in + /usr/local/samba/private/smbpasswd. + (Note that win95/98 machines don't need an account as they don't do + any security aware things.) + + Samba 2.2 will now create these entries for us. Carefull set up is required + and there may well be some changes to this system before its released. + + + +Machine Accounts + + There is an entry in the ntdom FAQ explaining how to create + machine entries manually. + + +<emphasis>At present</> to have the machine accounts created when a machine joins + the domain a number of conditions must be met : + +Only root can do it ! + There must be an entry in /usr/local/samba/private/smbpasswd + for root and root must be mentioned in domain admins. This may + be fixed some time in the future so any 'domain admin' can do it. If you don't + like having root as a windows logon account, make the machine + entries manually (both of them). + + + +Use the add user script + Again, this looks a bit like a 'work around'. Use a suitable + command line to add a machine account see above, + and pass it %m$, that is %m to get machine name plus the '$'. Now, this + means you cannot use the add user script to really add users .... + + + +Only for W2K + This automatic creation of machine accounts does not work for + NT4ws at present. Watch this space. + + + + +Joining the Domain + + You must have either added the machine account entries manually (NT4 ws) + or set up the automatic system (W2K), see Machine Accounts + before proceeding. + + +Windows NT + + (this step may not be necessary some time in the near future). + On the samba server that is the PDC, add a machine account manually + as per the instructions in the FAQ + Then give the command smbpasswd -a -m {machine} substituting in the + client machine name. + Logon to the NTws in question as a local admin, go to the + Control Panel, Network IdentificationTag. + Press the Change button. + Enter the Domain name (from the 'Workgroup' parameter, smb.conf) + in the Domain Field. + + Press OK and after a few seconds you will get a 'Welcome to Whatever Domain'. + Allow to reboot. + + + +Windows 2000 + + Logon to the W2k machine as Administrator, go to the Control + Panel and double click on Network and Dialup Connections. + + Pull down the Advanced menu and choose + Network Identification. Press Properties + . + Choose Domain and enter the domain name. Press 'OK'. + Now enter a user name and password for a Domain Admin + (Who must be root until a pre-release bug is fixed) and press + 'OK'. + Wait for the confirmation, reboot when prompted. + + To remove a W2K machine from the domain, follow the first two steps then + choose Workgroup, enter a work group name (or just WORKGROUP) and follow + the prompts. + + + + + + + +User Accounts + + Again, doing it manually (cos' the auto way is not working pre-release). + + In our simple case every domain user should have an account on the PDC. The + account may have a null shell if they are not allowed to log on to the unix + prompt. Again they need an entry in both the /etc/passwd and + /usr/local/samba/private/smbpasswd. Again a password is + not necessary in /etc/passwd but the location + of the home directory is honoured. + To make an entry for a user called Joe Blow you would typically do the following : + + adduser -g users -c 'Joe Blow' -s /bin/false -n joeblow + + smbpasswd -a joeblow + + And you will prompted to enter a password for Joe. Ideally he will be + hovering over your shoulder and will, when asked, type in a password of + his choice. There are a number of scripts and systems to ease the migration of users + from somewhere to samba. Better start looking ! + + +Domain Admin Accounts + + Certain operations demand that the logged on user has Administrator + privileges, typically installing software and + doing maintenance tasks. It is very simple to appoint some users as Domain Admins, + most likely yourself. Make + sure you trust the appointee ! + + Samba 2.2 recognizes particular users as being + domain admins and tells the NTws when it thinks that it has got one logged on. + In the smb.conf file we declare + that the Domain Admin group = @adm. + Any user who is a menber of the unix group 'adm' is treated as a Domain Admin by a NTws when + logged onto the Domain. They will have full Administrator rights + including the rights to change permissions on files and run the system + utilities such as Disk Administrator. Add users to the group by editing + /etc/group/. You do not need to use the 'adm' group, choose any one you like. + + Further, and this is very new, they will be allowed to create a + new machine account when first connecting a new NT or W2K machine to + the domain. However, at present, ie pre-release, only a Domain Admin who + also happens to be root can do so. + + + + + + +Profiles, Policies and Logon Scripts + +Profiles + + NT Profiles should work if you have followed the setup so far. + A user's profile contains a whole lot of their personal settings, + the contents of their desktop, personal 'My Documents' and so on. + When they log off, all of the profile is copied to their directory + on the server and is downloaded again when they logon on again, possibly + on another client machine. + + Sounds great but can be a bit of a bug bear sometimes. Users let + their profiles get too big and then complain about how long it takes + to log on each time. This sample setup only supports NT profiles, + rumor has it that it is also possible to do the same on Win95, my + users don't know and I'm not telling them. + + There is more info about Profiles (including for W95/98) + in the FAQ. + + +Policies + + Policies are an easy way to make or enforce specific characteristics across your network. You create a ntconfig.pol + file and every time someone logs on with their NTws, the settings you put in ntconfig.pol are applied to the NTws. + Typical setting are things like making the date appear the way you want it (none of these 2 figure years here) or + maybe suppressing one of the splash screens. Perhaps you want to set the NTws so it does not keep users profiles + on the local machine. Cool. The only problem is making the ntconfig.pol file itself. You cannot use the policy editor + that comes with NTws. + + See the FAQ for pointers on how to get a suitable Policy Editor. + + The Policy Editor (and associated files) will create a + ntconfig.pol file using the + parameters Microsoft thought of and parameters you specify by making your own + template file. + + In our example configuration here, Samba will expect to find + the ntconfig.pol file in + /usr/local/samba/netlogon. Needless to say (I hope !), + it is vitally important that ordinary users don't have + write permission to the Policy files. + + +Logon Scripts + + In the sample config file above there is a line + logon script = scripts\%U.bat + + Note that the slash is like this '\' not like this '/'. + NT is happy with both, win95 is not ! + + This allows you to run a dos batch file every time someone logs on. The batch + file is located on the server, in the sample install mentioned here, + its in /usr/local/samba/netlogon/scripts and + is named after the user with .bat appended, eg Joe + Blow's script is called /usr/local/samba/netlogon/scripts/joeblow.bat. + + There is a suggestion that user names longer than 8 characters may cause + problems with some systems being unable to run logon scripts. This is confirmed in earlier + versions when connecting using W95, comments about other combinations ?? + + You could use a line like this logon script = default.bat and samba + will supply /usr/local/samba/netlogon/default.bat for any client and every + user. Maybe you could use %m and get a client machine dependant logon script. + You get the idea... + + Note that the file is a dos batch file not a Unix script. It runs dos commands on the client + computer with the logon user's permissions. It must be a dos file with each line ending with + the dos cr/lf not a nice clean newline. Generally, + its best to create the initial file on a DOS system and copy it across. + + There is lots of very clever uses of the Samba replaceable variables such + ( %U = user, %G = primary group, %H = client machine, see the 'man 5 smb.conf') to + give you control over which script runs when a particular person logs + on. (Gee, it would be nice to have a default.bat run when nothing else is available.) + + Again, it is vitally important that ordinary users don't have write + permission to other peoples, or even probably their own, logon script files. + + A typical logon script is reproduced below. Note that it runs separate + commands for win95 and NT, that's because NT has slightly different behaviour + when using the net use .. command. Its useful for lots of + other situations too. I don't know what syntax to use for win98, I don't use it + here. + + + + rem Default logon script, create links to this file. + + net time \\bioserve /set /yes + @echo off + if %OS%.==Windows_NT. goto WinNT + + :Win95 + net use k: \\trillion\bio_prog + net use p: \\bcfile\homes + goto end + :WinNT + net use k: \\trillion\bio_prog /persistent:no + net use p: \\bcfile\homes /persistent:no + + :end + + + + + +Passwords and Authentication + + So far our configuration assumes that ordinary users don't have unix logon access. A change + to the adduser line above would allow unix logon + but it would be with passwords that may + be different from the NT logon. Clearly that won't suit everyone. Trying to explain to users + that they need to change their passwords in two seperate places is not fun. + Further, even if they cannot do a unix logon there are other processes that + might require authentication. We have a nice securely encrypted password in + /usr/local/samba/private/smbpasswd, why not use it ? + +</> +<sect2><title>Syncing Passwords + + Yes, its possible and seems the easiest way (initially anyway). + The FAQ details how to + do so in the sections What is password sync and should I use it ? and + How do I get remote password (unix and SMB) changing working ? + + + +Using PAM + Pam enabled systems have a much better solution available. The Samba + PDC server will offer to authenticate domain users to other processes + (either on this server or on the domain). With a suitable pam stack + such as Pam_smb + you can get any pam aware application looking to the samba password and + can leave the password field in /etc/shadow + or /etc/passwd invalid. + + +Authenticating other Samba Servers + In a domain that has a number of servers you only need one password database. + The machines that don't have their own ask the PDC to check for them. + This will work fine for a domain controlled by either a Samba or NT machine. + + To do so the Samba machine must be told to refer to the PDC and where the PDC is. + See the section in the NTDom FAQ called How do I get my samba server to + become a member ( not PDC ) of an NT domain? + + + + + + + +Background + + +History + + It might help you understand the limitations of the PDC in Samba if you + read something of its history. Well, the history as I understand it anyway. + + For many years the Samba team have been developing Samba, some time ago + a number of people, possibly lead by Luke Leighton started contributing NT + PDC stuff. This was added to the 'head' stream (that would eventually + become the next version) and later to a seperate stream (NTDom). They did so + much that eventually this development stream was so mutated that it could not + be merged back into the main stream and was abandoned towards the end of 1999. + And that was very sad because many users, myself include had become heavily + dependant on the NTController facilities it offered. Oh well... + + The NTDom team continued on with their new found knowledge however and + built the TNG stream. Intended to be carefully controlled so that it can be + merged back into the main stream and benefiting from what they learnt, it is + a very different product to the origional NTDom product. However, for a + number of reasons, the merge did not take place and now TNG is being developed + at http://www.samba-tng.org. + + Now, the NTDom things that the main strean 2.0.x version does is based more + on the old (initial version) abandoned code than on the TNG ideas. It appears + that version 2.2.0 will also include an improved version of the 2.0.7 domain + controller charactistics, not the TNG ways. The developers have indicated + that 2.2.0 will be further developed incrementally and the ideas from TNG + incorporated into it. + + One more little wriggle is worth mentioning. At one stage the NTDom + stream was called Samba 2.1.0-prealpha and similar names. This is most + unfortunate because at least one book published advises people who want to + use NTDom Samba to get version 2.1.0 or later. As main stream Samba will soon + be called 2.2.0 and NOT officially supporting NTDom Controlling functions, + the potential for confusion is certainly there. + + +The Future + + There is a document on the Samba mirrors called 'Development' + . It offers the 'best guess' of what is planned for future releases + of Samba. + + The future of Samba as a Primary Domain Controller appears rosie, however + be aware that its the future, not the present. The developers are strongly committed + to building a full featured PDC into Samba but it will take time. If this + version does not meet your requirements then you should consider (in no particular + order) : + + + Wait. No, we don't know how long. Repeated asking won't help. + Investigate the development versions, TNG perhaps or HEAD where new code is being added + all the time. Realise that development code is often unstable, poorly documented and subject to change. + You will need to use cvs to download development versions. + Join one of the Samba mailing lists so that you can find out + what is happening on the 'bleeding edge'. + + + +Getting further help + + This document cannot possibly answer all your questions. Please understand that its very + likely that someone has been confrounted by the same problem that you have. The + FAQ + discusses a number of possible paths to take to get further help : + + + + Documents on the Samba Sites. + Other web sites. + Mailing list. + + + There is some discussion about guide lines for using the Mailing Lists on the + accompanying FAQ, + please read them before posting. + + + + + + diff --git a/docs/docbook/samba-pdc-faq.sgml b/docs/docbook/samba-pdc-faq.sgml deleted file mode 100644 index 4034987480..0000000000 --- a/docs/docbook/samba-pdc-faq.sgml +++ /dev/null @@ -1,962 +0,0 @@ - - - -The Samba 2.2 PDC FAQ - - - - DavidBannon - La Trobe University - -
dbannon@samba.org
- November 2000 - - - -</> - - <para>Comments, corrections and additions to <email>D.Bannon@latrobe.edu.au</email></para> - - <para>This is the FAQ for Samba 2.2 as an NTDomain controller. - This document is derived from the origional FAQ that was built and - maintained by Gerald Carter - from the early days of Samba NTDomain development up until recently. - It is now being updated as significent changes are made to 2.2.0.</para> - - <para>Please note it does not apply to Samba2.2alpha0, Samba2.2alpha1, Samba 2.0.7, TNG nor HEAD branch. - </para> - <para>I'll repeat, it does not apply to the current snapshot [ftp mirror]:/pub/samba/alpha/samba-2.2.0-alpha1.tar.gz, only to the to the current cvs.</para> - -<para> - Also available is a Samba 2.2 PDC <ulink url="samba-pdc-howto.html">HowTo</> that takes you, step - by step, over the process of setting up a very basic Samba 2.2 Primary Domain Controller - </para> - - <note><para>Please read the Introduction for the current <link linkend=stateofplay> state of play</>.</para></> -</dedication> - -<toc></toc> - -<!-- ================ I N T R O D U C T I O N ==================== --> - - -<chapter><title>Introduction</> - -<sect1><title id=stateofplay>State of Play - It should be noted that 2.2.0 in its pre-release form still has a few problems, - I'll try and keep this section current while things are still dynamic. - At the time of this update (December 15, 2000) the current state of play is : - - Comments here about W2K joining the domain apply only to Samba 2.2 from the CVS after November 27th. The - 'snapshot' release Samba2.2alpha1 does not work !!! See below on how to get a CVS tree. - - Known Bug !W2K machines will not successfully join a domain with a name that - is made up from an even number of characters. Yep, thats right ! BIOTEST is OK as is MYDOMAI - but MYDOMAIN will not work until this bug is fixed. Hmm.., we believe - that this bug is fixed, but see below. - - Known Bug !After some bugs were fixed just before - Christmas, W2K SP1 machines cannot join the domain. Expected to be - fixed early in the new year. Whats that ? yeah, samba developers - have a Christmas break too ! - - - Know Bug !NTs (and possibly W2K ?) are not told the logged on user is a domain - admin if the parameter "domain admin users = user" is used. The alternative, "domain admin group" - does work. See the HowTo. - - Client Side creation of Machine accounts does work but is not complete. - Firstly, the add user script runs as the user who's - name was entered, not as root. Secondly, the machine name passed to the script (%U) - has an underscore at the end, not a '$'. One alternative is to use %m and add the $. - This method is documented in the HowTo. - And thirdly, it does not work with NT4ws. - - - A W2K machine can join the domain. See the HowTo - which explains the process. The methods - described are 'work arounds' and should be regarded as temporary. Although I (drb) - have tested these procedures a number of people have had difficulty so there - may be other issues at work. JFM is aware of these - problems and will attend to them when he can. - - A Domain Admin account is required and at present it appears that only root - is a suitable candidate. - - Much of the related code does work. For example, if an NT is removed from the - domain and then rejoins, the Create a Computer Account in the Domain dialog - will let you reset the smbpasswd. That is you don't need to do it from - the unix box. However, at the present, you do need to have root as an - administrator and use the root user name and password. - - Actually I'm - not sure that last paragraph is correct .... - - Policies do work on a W2K machine. MS says that recent builds of - W2K dont observe an NT policy but it appears it does in 'legacy' mode. - - -Introduction</> - <para>This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing with the 'old head' - version of Samba and its NTDomain facilities. It is being rewritten by David Bannon (drb) - so that it addresses more accurately the Samba 2.2 planned for release late 2000. </para> - - <para>This document probably still contains some material that does not apply to - Samba 2.2 but most (all?) of the really misleading stuff has been removed. Some - issues are not dealt with or are dealt with badly. Please send corrections and additions to - David Bannon at D.Bannon@latrobe.edu.au</para> - - <para>Hopefully, as we all become familiar with the Samba 2.2 as a PDC this document will - become much more usefull.</para> - - -</sect1> -</chapter> - -<!-- ============== G E N E R A L I N F O R M A T I O N ============== --> - -<chapter><title>General Information</> - - -<sect1><title>What can we do ? - -What can Samba Primary Domain Controller (PDC) do ?</> - - <para>If you wish to have Samba act as a PDC for Windows NT 3.51.and 4.0 or W2000 client, then you - will need to obtain the 2.2.0 version, currently in pre-release. Release of a stable, - full featured Samba PDC is currently slated for version 3.0. </para> - - <para>The following is a list of included features currently in Samba 2.2:</para> -<itemizedlist> - <listitem><para>The ability to act as a limited PDC for Windows NT and W2000 clients. - This includes adding NT and W2K machines to the domain and authenticating users logging - into the domain.</para></listitem> - <listitem><para>Domain account can be viewed using the User Manager for - Domains ????</para></listitem> - <listitem><para>Viewing resources on the Samba PDC via the Server Manager for Domains - from the NT client. ??</para></listitem> - <listitem><para>Windows 95 clients will allow user level security to be set - but will not currently allow browsing of accounts.</para></listitem> - <listitem><para>Machine account password updates.</para></listitem> - <listitem><para>Changing of user passwords from an NT client.</para></listitem> - <listitem><para>Partial support for Windows NT group and username mapping.</para></listitem> - <listitem><para>Support for a LDAP password database backend.</para></listitem> - <listitem><para>Printing.</para></listitem> -</itemizedlist> - - -<itemizedlist><title>These things are note expected to work in the forseeable future - Trust relationships - PDC and BDC integration - Windows NT ACLs (on the Samba shares) - Offer a list of domain users to User Manager for Domains - (or the Security Tab etc). - - - -Can I have a Windows 2000 client logon to a Samba controlled domain?</> - - <para>The 2.2 release branch of Samba supports Windows 2000 domain - clients in legacy mode, ie as if the PDC is a NTServer, not a - W2K server.</para> -</sect2> - -<sect2><title>What's the status of print spool (spoolss) support in the NTDOM code? </> - - <para>The implementation of support for SPOOLSS pipe is complete and it will be available - in the 2.2.0 release. This means that Samba will support the automatic downloading of printer - drivers for Windows NT clients just as it currently does for Windows 9x clients.</para> -</sect2> -</sect1> - -<sect1><title>CVS - CVS is a programme (publically available) that the Samba developers use to - maintain the central source code. Non developers can get access to the source in - a read only capacity. Many flavours of unix now arrive with cvs installed. - -What are the different Samba branches available in CVS ?</> - - <para>You can find out more about obtaining Samba's via - anonymous CVS from - <ulink url="http://pserver.samba.org/samba/cvs.html"> - http://pserver.samba.org/samba/cvs.html"</>. </para> - -<variablelist><title>There are basically four branches to watch at the moment :</> - <varlistentry> - <term>HEAD</> - <listitem><para>Samba 3.0 ? This code boasts all the main development - work in Samba. Two things that most people are not aware of - which live in the HEAD branch code are winbind NSS module and - Tim Potter's VFS implementation. Due to its developmental - nature, its not really suitable for production work. - </para></listitem></varlistentry> - <varlistentry> - <term>SAMBA_2_0</term> - <listitem><para>This branch contains the current stable release release. - At the moment it contains 2.0.7, a version that will do some - limited PDC stuff. If you are really going to do PDC things then - I (drb) suggest that you consider 2.2 instead. - </para></listitem></varlistentry> - <varlistentry> - <term>SAMBA_2_2</> - <listitem><para>The next stable release, currently in a 'alpha' form. - It provides the Samba developers, testers and interested - people with an approximation of what is to come. This document - addresses only SAMBA_2_2. - </para></listitem></varlistentry> - <varlistentry> - <term>SAMBA_TNG</> - <listitem><para>This branch is no longer maintained from the Samba sites. - Please see <ulink url="http://www.samba-tng.org/"> - http://www.samba-tng.org/</ulink>. It has been requested - that questions about TNG are not posted to the regular Samba mailing - lists including samba-ntdom and samba-technical. - </para></listitem></varlistentry> -</variablelist> -</sect2> - -<sect2><title>What are the CVS commands ?</> - - <para>See <ulink url="http://pserver.samba.org/samba/cvs.html"> - http://pserver.samba.org/samba/cvs.html</></para> - - - <itemizedlist><title>To get the Samba 2.2 version, tag SAMBA_2_2 you would do :</> - <listitem><para> For example : <command>cd /usr/local/src/</></></> - <listitem><para> <command>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot - login</></></> - <listitem><para> When prompted enter a password of <command>cvs</></></> - <listitem><para> <command>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot - co -r SAMBA_2_2 samba</></></> - </itemizedlist> - - <itemizedlist><title>Then to update that directory at some later time,</> - <listitem><para> <command>cd /usr/local/src/samba</></></> - <listitem><para> <command>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login</></></> - <listitem><para> When prompted enter a password of 'cvs'.</></> - <listitem><para> <command>cvs update -d -P</></></> - </itemizedlist> -</sect2> -</sect1> -</chapter> - -<chapter><title>Establishing Connections</> -<sect1><title> - -How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</> - - <para>There is a comprehensive Samba PDC <ulink url="samba-pdc-howto.html">HowTo</> - accessable from the samba web site - under 'Documentation'. Its currently located at <ulink url="http://bioserve.latrobe.edu.au/samba"> - http://bioserve.latrobe.edu.au/samba</>. Read it.</para> -</sect2> - -<sect2><title>What is a 'machine account' ? - Every NT, W2K or Samba machine that joins a Samba controlled domain must be known to - the Samba PDC. There are two entries required, one in (typically) /etc/passwd - and the other in (typically) /usr/local/samba/private/smbpasswd. Under - some circumstances these entries are made manually, the - HowTo discusses ways of creating them automatically. - - - -"The machine account for this computer either does not exist or is not accessable."</> - - <para>When I try to join the domain I get the message "The machine account for this computer - either does not exist or is not accessable". Whats wrong ?</para> - - <para>This problem is caused by the PDC not having a suitable machine account. - If you are using the <command>add user script =</> method to create accounts - then this would indicate that it has not worked. Ensure the domain admin user - system is working.</para> - - <para>Alternatively if you are creating account entries manually then they have not been created - correctly. Make sure that you have the entry correct for the machine account in smbpasswd - file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, - make sure that the account name is the machine netbios name with a '$' appended to it - ( ie. computer_name$ ). There must be an entry in both /etc/passwd and - the smbpasswd file. Some people have reported that - inconsistent subnet masks between the Samba server and the NT client have caused this problem. - Make sure that these are consistent for both client and server.</para> -</sect2> - -<sect2><title id=machineaccounts>How do I create machine accounts manually ? - - This was the only option until recently, now in version 2.2 better means are available. - You might still need to do it manually for a couple of reasons. A machine account - consists of two entries (assuming a standard install and /etc/passwd use), - one in /etc/passwd and the other in /usr/local/samba/private/smbpasswd. The /etc/passwd - entry will list the machine name with a $ appended, won't have a passwd, will have a null - shell and no home directory. For example a machine called 'doppy' would have an /etc/passwd - entry like this : - - doppy$:x:505:501:NTMachine:/dev/null:/bin/false - - On a linux system for example, you would typically add it like this : - - adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n - doppy$ - - Then you need to add that entry to smbpasswd, assuming you have a suitable - path to the smbpasswd programme, do this : - - smbpasswd -a -m doppy$ - - The entry will be created with a well known password, so any machine that - says its doppy could join the domain as long as it gets in first. So don't create - the accounts any earlier than you need them. - - -I cannot include a '$' in a machine name. - - A 'machine name' in (typically) /etc/passwd consists - of the machine name with a '$' appended. FreeBSD (and other BSD systems ?) - won't create a user with a '$' in their name. - - The problem is only in the program used to make the entry, once made, it works - perfectly. So create a user without the '$' and use vipw to edit - the entry, adding the '$'. Or create the whole entry with vipw if you like, - make sure you use a unique uid ! - - -I get told "You already have a connection to the Domain...." when creating a - machine account.</> - - <para>This happens if you try to create a machine account from the machine itself - and use a user name that does not work (for whatever reason) and then try - another (possibly valid) user name. - Exit out of the network applet to close the initial connection and try again.</para> - - <para>Further, if the machine is a already a 'member of a workgroup' that is the - same name as the domain you are joining (bad idea) you will get this message. - Change the workgroup name to something else, it does not matter what, reboot, - and try again.</para> -</sect2> - -<sect2><title>I get told "Cannot join domain, the credentials supplied conflict - with an existing set.."</> - <para>This is the same basic problem as mentioned above, <link linkend=alreadyhaveconnection> - "You already have a connection..."</link></para> -</sect2> - -<sect2><title>"The system can not log you on (C000019B)...."</> - <para>I joined the domain successfully but after upgrading to a newer version of the - Samba code I get the message, "The system can not log you on (C000019B), Please try a - gain or consult your system administrator" when attempting to logon.</para> - - <para>This occurs when the domain SID stored in private/WORKGROUP.SID is changed. - For example, you remove the file and smbd automatically creates a new one. - Or you are swapping back and forth between versions 2.0.7, TNG and the HEAD branch - code (not recommended). The only way to correct the problem is to restore the - original domain SID or remove the domain client from the domain and rejoin.</para> -</sect2> -</sect1> - -</chapter> - - -<!-- ============ U S E R A C C O U N T M A N A G M E N T ============= --> - -<chapter><title>User Account Management -Domain Admins -How do I configure an account as a domain administrator? - - See the NTDom HowTo. - - - -Profiles -Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</> - - <para>Sometimes Windows clients will maintain a connection to the \\homes\ ( or [%U] ) share - even after the user has logged out. Consider the following scenario.</para> -<itemizedlist> - <listitem><para> user1 logs into the Windows NT machine. Therefore the - [homes] share is set to \\server\user1.</para></listitem> - <listitem><para> user1 works for a while and then logs out. </para></listitem> - <listitem><para> user2 logs into the same Windows NT machine.</para></listitem> -</itemizedlist> - - <para>However, since the NT box has maintained a connection to [homes] which was - previously set to \\server\user1, when the operating system attempts to - get the profile and if it can read users1's profile, will get it otherwise it - will return an error. You get the picture.</para> - - <para>A better solution is to use a separate [profiles] share and set the - "logon path = \\%N\profiles\%U" </para> - - - <note><para>Is this still a problem ????</para></note> -</sect2> - - -<sect2><title>Why are all the users listed in the "domain admin users" using the same profile?</> - - <para>You are using a very very old development version of Samba. Upgrade.</para> -</sect2> - - - - - -<sect2><title>The roaming profiles do not seem to be updating on the server. - - There can be several reasons for this. - - Make sure that the time on the client and the PDC are synchronized. You can accomplish - this by executing a net time \\server /set /yes replacing server with the - name of your PDC (or another synchronized SMB server). See - about Setting Time - - Make sure that the - logon path is writeable by the user and make sure that the connection to the logon - path location is by the current user. Sometimes Windows client do not drop the - connection immediately upon logoff. - - Some people have reported that the logon path location should also be browseable. - I (GC) have yet to emperically verify this, but you can try. - - - -Policies - -What are 'Policies' ?. - When a user logs onto the domain via a client machine, the PDC sends - the client machine a list of things contained in the 'policy' (if it exists). - This list may do things like suppress a splach screen, format the dates the way you - like them or perhaps remove locally stored profiles. - - On a samba PDC this list is obtained from a file called ntconfig.pol - and located in the [netlogon]share. The file is created with a policy editor - and must be readable by anyone and writeable by only root. See - below for how to get a suitable editor. - - -I can't get system policies to work. - - There are two possible reasons for system policies not functioning correctly. - Make sure that you have the following parameters set in smb.conf - - - [netlogon] - .... - locking = no - public = no - browseable = yes - .... - - - A policy file must be in the [netlogon] share and must be - readable by everyone and writeable by only root. The file must be created - by an NTServer Policy Editor. - - Last time I (drb) looked in the source, it was - looking for ntconfig.pol first then several other combinations of upper - and lower case. People have reported success using NTconfig.pol, - NTconfig.POL and ntconfig.pol. These are the case - settings that I (GC) use with the - filename ntconfig.pol - - - case sensitive = no - case preserve = yes - default case = yes - - - - -What about Windows NT Policy Editor ? - - To create or edit ntconfig.pol you must use the NT Server - Policy Editor, poledit.exe which is included with NT Server - but not NT Workstation. There is a Policy Editor on a NTws - but it is not suitable for creating Domain Policies. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need poledit.exe, common.adm and winnt.adm. It is convenient - to put the two *.adm files in c:\winnt\inf which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. - - The Windows NT policy editor is also included with the - Service Pack 3 (and later) for Windows NT 4.0. Extract the files using - servicepackname /x, ie thats Nt4sp6ai.exe /x - for service pack 6a. - The policy editor, poledt.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. - - - - -Can Win95 do Policies ? - - Install the group policy handler for Win9x to pick up group policies. - Look on the Win98 CD in - \tools\reskit\netadmin\poledit. Install group policies on a Win9x client by double-clicking - grouppol.inf. Log off and on again a couple of times and see if - Win98 picks up group policies. - Unfortunately this needs to be done on every Win9x machine that uses group policies.... - - If group policies don't work one reports suggests getting the updated (read: working) - grouppol.dll for Windows 9x. The group list is grabbed from /etc/group. - - - - - -Passwords - -What is password sync and should I use it ? - - NTws users can change their domain password by pressing Ctrl-Alt-Del and - choosing 'Change Password'. By default however, this does not change the unix password - (typically in /etc/passwd or /etc/shadow). In lots of situations - thats OK, for example : - - The server is only accessible to the user via samba. - Pam_smb or similar is installed so other applications - still refer to the samba password. - - But sometimes you really do need to maintain two seperate password databases and - there are good reasons to keep then in sync. Trying to explain to users - that they need to change their passwords in two seperate places or use - two seperate passwords is not fun. - - However do understand that setting up password sync is not without problems either. - The chief difficulty is the interface between Samba and the passwd command, - it can be a fiddle to set up and if the password the user has entered fails, - the resulting errors are ambiguously reported - and the user is confused. Further, you need to take steps to ensure that users - only ever change their passwords via samba (or use smbpasswd), - otherwise they will only be changing the unix password. - - - - -How do I get remote password (unix and SMB) changing working ?</> - - <para>Have a practice changing a user's password (as root) to see what - discussion takes place and change the text in the 'passwd chat' line below as necessary. The - line as shown works for recent RH Linux but most other systems seem to like to do something - different. The '*' is a wild card and will match anything (or nothing). - </para> - - <para>Add these lines to smb.conf under [Global]</para> - - <programlisting> - - unix password sync = true - passwd program = /usr/bin/passwd %u - passwd chat = *password* %n\n *password* %n\n *successful* - </programlisting> - - <para>As mentioned above, the change to the unix password - happens as root, not as the user, as is indicated in ~/smbd/chgpasswd.c If - you are using NIS, the Samba server must be running on the NIS master machine.</para> -</sect2> - -</sect1> - -</chapter> - -<!-- =================== M I S C E L L A N E O U S ================= --> - -<chapter><title>Miscellaneous - -What editor can I use in DOS/Windows that won't mess with my unix EOF - There are a number of Windows or DOS based editors that will understand, and - leave intact, the unix eof (as opposed to a DOS CL/LF). List members suggested : - - - UltraEdit at www.ultraedit.com - VI for windows at - home.snafu.de/ramo/WinViEn.htm - The author prefers PFE at - www.lancs.ac.uk/people/cpaap/pfe/ but its no longer being developed... - - - - - - -How do I get 'User Manager' and 'Server Manager' - - Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for - Domains', the 'Server Manager' ? - -Microsoft distributes a version of these tools called nexus - for installation on Windows 95 systems. The tools set includes - Server Manager - User Manager for Domains - Event Viewer - - - Click here to download the archived file - - ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE - - The Windows NT 4.0 version of the 'User Manager for Domains' - and 'Server Manager' are available from Microsoft via ftp from - - ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE - - - -The time setting from a Samba server does not work. - If it works OK when you log on as Domain Admin then the problem is that ordinary users - don't have permission to change the time. (The system is running with their permission - at logon time.) This is not a Samba problem, you will have the same problem where ever - you connect. You can give 'everyone' permission to change the time from the User Manager. - - - Anyone know what the registry settings are so this could be done with a Policy ? - - -"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</> - <para>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS." - in the logs. What do I need to do?</para> - - <para>You are using one of the old development versions. Upgrade. - (The message is unimportant, was a reminder to a developer)</para> - -</sect2> - -<sect2><title>How do I get my samba server to become a member ( not PDC ) of an NT domain? - - - In a domain that has a number of servers you only need one password database. - The machines that don't have their own ask the PDC to check for them. - This will work fine for a domain controlled by either a Samba or NT machine. - The following lines in smb.conf are typical, 'password server' points to the - samba machine (or an NT) that has the password list : - - - - [global] - ... - security = domain - workgroup = { Put your domain name here } - password server = { Put the ip of the PDC here } - encrypt passwords = yes - ... - - - The samba server in question will have to 'join the domain', that requires - the domain controller to have a machine account for it. This is no different - to the machine account requirements to allow a NTws to join the domain. For - example, if we want a unix box called sleepy to ask the PDC called grumpy - to do its authentication then grumpy will need an entry in its smbpasswd - (assuming it's also samba) that starts with sleepy$. It would have to be - created manually. - - If the domain is controlled by an NTServer then the "Server Manager for Domains" - tool must be used to add 'sleepy' to the domain list. - - In either case we then join the domain. If the domain is called forest - then on sleepy we would join the domain by typing : - - smbpasswd -j forest - - Note that the directory where the smbpasswd file would be - located should exist as this is where smbd will generate the MACHINE.SID file. This - might be /usr/local/samba/private/FOREST.SLEEPY.SID and - it contains the trust account password for the domain member. The permissions are - (and should remain) "rw------- - - - Note the Samba Servers without the password list will most likely still need an account - for each user, this means a line in its /etc/passwd. Because authentication - is being handled at the domain level the - /etc/passwd line does not need a password. - If the shares being offered are not user specific, ie a common (read only ?) - area or perhaps just printing then the user's - /etc/passwd does not need a home directory. A typical - line in /etc/passwd for a server that allows domain users to - connect to the samba shares but does not offer a home share ('cos that's on the PDC) - and does not allow logon to the unix prompt would be like this : - - jblow:x:542:100:Joe Blow:/dev/null:/bin/false - - Notes :</> - <itemizedlist> - <listitem><para>When removing those 'dummy' users, watch the 'remove user' scripts, - some OS think they should remove a users directory even when its not owned by the user ! - </para></listitem> - - <listitem><para>The <filename>username map = </> parameter might help you to avoid having - all those accounts created.</para></listitem> - - <listitem> - <para>You should investigate the smb.conf parameter - <filename>'add user script'</filename>, it will be used to create accounts on - secondary servers when that account already exists on the PDC. Very nice. - Something like :</para> - - <programlisting> - [Global] - .... - add user script = /usr/sbin/adduser -n -g users -c User -d /dev/null -s /bin/false %U - .... - </programlisting> - </listitem> - </itemizedlist> - </note> - -</sect2> -</sect1> -</chapter> - - -<!-- ======== T R O U B L E S H O O T I N G and B U G R E P O R T I N G ======== --> - - - -<chapter><title>Troubleshooting and Bug Reporting - -Diagnostic tools - -What are some diagnostics tools I can use to debug the domain logon process and where can I - find them? - - One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d - option for both smbd and nmbd to specifiy what 'debug level' at which to run. See the man - pages on smbd, nmbd and smb.conf for more information on debugging options. The debug - level can range from 1 (the default) to around 100 but a debug level of about 20 will - normally help you find any errors that samba is encountering. Another helpful method - of debugging is to compile samba using the gcc -g flag. This will include debug - information in the binaries and allow you to attch gdb to the running smbd / nmbd - process. In order to attach gdb to an smbd process for an NT workstation, first - get the workstation to make the connection. Pressing ctrl-alt-delete and going down - to the domain box is sufficient (at least, on the first time you join the domain) to - generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open - connection, and therefore there will be an smbd process running (assuming that you - haven't set a really short smbd idle timeout) So, in between pressing ctrl alt - delete, and actually typing in your password, you can gdb attach and continue. - - Some usefull samba commands worth investigating:</> - <listitem><para>testparam | more</></> - <listitem><para>smbclient -L //{netbios name of server}</></> - </itemizedlist> - - <para>An SMB enabled version of tcpdump is available from - <ulink url="ftp://samba.org/pub/samba/tcpdump-smb/">ftp://samba.org/pub/samba/tcpdump-smb/ - </ulink></para> - - <para>Capconvert is a small C program for translating output from tcpdump-smb to CAP format - that can be read by netmon. You will need to use the raw output from tcp dump - ( ie. <command>tcpdump -w output.dump</> ). Good news! Now you can convert - Solaris' snoop output as well. The C source code for snoop2cap is available for download. - </para> - - <para>For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available - on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's. - The version of netmon that ships with SMS allows for dumping packets between any two - computers (ie. placing the network interface in promiscuous mode). The version - on the NT Server install CD will only allow monitoring of network traffic directed to the - local NT box and broadcasts on the local subnet.</para> - -</sect2> - -<sect2><title>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box? - - Installing netmon on an NT workstation requires a couple of steps. The following - are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server - 4.0, on Microsoft Windows NT Workstation 4.0. The process should be similar - for other version of Windows NT / Netmon. You will need both the Microsoft Windows - NT Server 4.0 Install CD and the Workstation 4.0 Install CD. - - - Initially you will need to install 'Network Monitor Tools and Agent' on the - NT Server. To do this - - - Goto Start - Settings - Control Panel - Network - Services - Add - Select the 'Network Monitor Tools and Agent' and click on 'OK'. - Click 'OK' on the Network Control Panel. - Insert the Windows NT Server 4.0 install CD when prompted. - - - At this point the Netmon files should exist in %SYSTEMROOT%\System32\netmon\*.*. - Two subdirectories exist as well, parsers\ which contains the necessary DLL's - for parsing the netmon packet dump, and captures\. - - In order to install the Netmon tools on an NT Workstation, you will first need to - install the 'Network Monitor Agent' from the Workstation install CD. - - Goto Start - Settings - Control Panel - Network - Services - Add - Select the 'Network Monitor Agent' and click on 'OK'. - Click 'OK' on the Network Control Panel. - Insert the Windows NT Workstation 4.0 install CD when prompted. - - - - Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to - %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as - you deem appropriate for your site. You will need administrative rights on the - NT box to run netmon. - - To install Netmon on a Windows 9x box install the network monitor agent from - the Windows 9x CD (\admin\nettools\netmon). - There is a readme file located with the netmon driver files on the CD if you need - information on how to do this. Copy the files from a working Netmon installation. - - - - - -What other help can I get ? - - There are many sources of information available in the form of mailing lists, RFC's - and documentation. The docs that come with the samba distribution contain very - good explanations of general SMB topics such as browsing. - -URLs and similar - - - - - Home of Samba site - http://samba.org. We have a mirror near you ! - - The Development document - on the Samba mirrors might mention your problem. If so, - it might mean that the developers are working on it. - - Ignacio Coupeau has a very comprehesive look at LDAP with Samba at - - http://www.unav.es/cti/ldap-smb-howto.html - Be a little carefull however, I suspect that it does not specificly - address samba 2.2.x. The HEAD pre-2.1 may possibly be the best - stream to look at. - - Lars Kneschke's site covers - Samba-TNG at - - http://www.kneschke.de/projekte/samba_tng, but again, a - lot of it does not apply to the main stream Samba. - - See how Scott Merrill simulates a BDC behaviour at - - http://www.skippy.net/linux/smb-howto.html. - - Although 2.0.7 has almost had its day as a PDC, I (drb) will - keep the 2.0.7 PDC pages at - http://bioserve.latrobe.edu.au/samba going for a while yet. - - Misc links to CIFS information - http://samba.org/cifs/ - - NT Domains for Unix - http://mailhost.cb1.com/~lkcl/ntdom/ - - FTP site for older SMB specs: - - ftp://ftp.microsoft.com/developr/drg/CIFS/ - - - - -There are a number of documents that no longer appear to live at their - origional home. Any one know where the following may be found ? - - CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt - CIFS Remote Administration Protocol draft-leach-cifs-rap-spec-00.txt - CIFS Logon and Pass Through Authentication draft-leach-cifs-logon-spec-00.txt - A Common Internet File System (CIFS/1.0) Protocol draft-leach-cifs-v1-spec-01.txt - CIFS Printing Specification draft-leach-cifs-print-spec-00.txt - RFC1001 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Concepts and methods. - http://ds.internic.net/rfc/rfc1001.txt - RFC1002 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Detailed specifications. - http://ds.internic.net/rfc/rfc1002.txt - Microsoft's main CIFS page: http://www.microsoft.com/workshop/networking/cifs/ - - - - - -How do I get help from the mailing lists ? - - There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror - and then click on Support and then click on - Samba related mailing lists. - - For questions relating to Samba TNG go to - http://www.samba-tng.org/ - It has been requested that you don't post questions about Samba-TNG to the - main stream Samba lists. - -If you post a message to one of the lists please - observe the following guide lines : - - Always remember that the developers are volunteers, they are - not paid and they never guarantee to produce a particular feature at - a particular time. Any time lines are 'best guess' and nothing more. - - - Always mention what version of samba you are using and what - operating system its running under. You should probably list the - relevant sections of your smb.conf file, at least the options - in [global] that affect PDC support. - - In addition to the version, if you obtained Samba via - CVS mention the date when you last checked it out. - - Try and make your question clear and brief, lots of long, - convoluted questions get deleted before they are completely read ! - Don't post html encoded messages (if you can select colour or font - size its html). - - If you run one of those niffy 'I'm on holidays' things when - you are away, make sure its configured to not answer mailing lists. - - - Don't cross post. Work out which is the best list to post to - and see what happens, ie don't post to both samba-ntdom and samba-technical. - Many people active on the lists subscribe to more - than one list and get annoyed to see the same message two or more times. - Often someone will see a message and thinking it would be better dealt - with on another, will forward it on for you. - - You might include partial - log files written at a debug level set to as much as 20. - Please don't send the entire log but enough to give the context of the - error messages. - - (Possibly) If you have a complete netmon trace ( from the opening of - the pipe to the error ) you can send the *.CAP file as well. - - Please think carefully before attaching a document to an email. - Consider pasting the relevant parts into the body of the message. The samba - mailing lists go to a huge number of people, do they all need a copy of your - smb.conf in their attach directory ? - - - - - -How do I get off the mailing lists ? - To have your name removed from a samba mailing list, go to the - same place you went to to get on it. Go to http://samba.org, click on your nearest mirror - and then click on Support and then click on - Samba related mailing lists. Or perhaps see - here - - Please don't post messages to the list asking to be removed, you will just - be refered to the above address (unless that process failed in some way...) - - - - - - - - - - - diff --git a/docs/docbook/samba-pdc-howto.sgml b/docs/docbook/samba-pdc-howto.sgml deleted file mode 100644 index 4b8380dd9e..0000000000 --- a/docs/docbook/samba-pdc-howto.sgml +++ /dev/null @@ -1,778 +0,0 @@ - - - - -The Samba 2.2 PDC HowTo - - - - - - DavidBannon - La Trobe University - - November 2000 - - - - - Comments, corrections and additions to dbannon@samba.org - - - This document explains how to setup Samba as a Primary Domain Controller and - applies to version 2.2.0. - Before - using these functions make sure you understand what the controller can and cannot do. - Please read the sections below in the Introduction. - As 2.2.0 is incrementally updated - this document will change or become out of date very quickly, make sure you are - reading the most current version. - - - Please note this document does not apply to Samba2.2alpha0, Samba2.2alpha1, - Samba 2.0.7, TNG nor HEAD branch. - - It does apply to the current (post November 27th) cvs. - - - Also available is an updated version of Jerry Carter's NTDom - FAQ that will answer lots of - the special 'tuning' questions that are not covered here. Over the next couple of weeks - some of the items here will be moved to the FAQ. - - - - - - - - - -Introduction - - -This document will show you one way of making Version 2.2.0 -of Samba perform some of the tasks of a -NT Primary Domain Controller. The facilities described are built into Samba as a result of -development work done over a number of years by a large number of people. These facilities -are only just beginning to be officially supported and although they do appear to work reliably, -if you use them then you take the risks upon your self. This document does not cover the -developmental versions of Samba, particularly -Samba-TNG - - - - - -Note that Samba 2.0.7 - supports significently less of the NT Domain facilities compared with 2.2.0 - - - - This document does not replace the text files DOMAIN_CONTROL.txt, DOMAIN.txt (by - John H Terpstra) or NTDOMAIN.txt (by Luke Kenneth Casson Leighton). Those documents provide - more detail and an insight to the development - cycle and should be considered 'further reading'. - - - - -What can we do ? - - Permit 'domain logons' for Win95/98, NT4 and W2K workstations from one central - password database. WRT W2K, please see the section about adding machine - accounts and the Intro in the FAQ. - Grant Administrator privileges to particular domain users on an - NT or W2K workstation. - Apply policies from a domain policy file to NT and W2K (?) - workstation. - Run the appropriate logon script when a user logs on to the domain - . - Maintain a user's local profile on the server. - Validate a user using another system via smb (such as smb_pam) and - soon winbind (?). - - - - -What can't we do ? - - Become or work with a Backup Domain Controller (a BDC). - Participate in any sort of trust relationship (with either Samba or NT - Servers). - Offer a list of domain users to User Manager for Domains - on the Security Tab etc). - Be a W2K type of Domain Controller. Samba PDC will behave like - an NT PDC, W2K workstations connect in legacy mode. - - - - - - - - -Installing - - Installing consists of the usual download, configure, make and make - install process. These steps are well documented elsewhere. - The FAQ discusses getting pre-release versions via CVS. - Then you need to configure the server. - -Start Up Script - Skip this section if you have a working Samba already. - Everyone has their own favourite startup script. Here is mine, offered with no warrantee - at all ! - - - - #!/bin/sh - # Script to control Samba server, David Bannon, 14-6-96 - # - # - PATH=/bin:/usr/sbin:/usr/bin - export PATH - case "$1" in - 'start') - if [ -f /usr/local/samba/bin/smbd ] - then - /usr/local/samba/bin/smbd -D - /usr/local/samba/bin/nmbd -D - echo "Starting Samba Server" - fi - ;; - 'conf') - if [ -f /usr/local/samba/lib/smb.conf ] - then - vi /usr/local/samba/lib/smb.conf - fi - ;; - 'pw') - if [ -f /usr/local/samba/private/smbpasswd ] - then - vi /usr/local/samba/private/smbpasswd - fi - ;; - 'who') - /usr/local/samba/bin/smbstatus -b - ;; - 'restart') - psline=`/bin/ps x | grep smbd | grep -v grep` - - if [ "$psline" != "" ] - then - while [ "$psline" != "" ] - do - psline=`/bin/ps x | fgrep smbd | grep -v grep` - if [ "$psline" ] - then - set -- $psline - pid=$1 - /bin/kill -HUP $pid - echo "Stopped $pid line = $psline" - sleep 2 - fi - done - fi - echo "Stopped Samba servers" - ;; - 'stop') - psline=`/bin/ps x | grep smbd | grep -v grep` - - if [ "$psline" != "" ] - then - while [ "$psline" != "" ] - do - psline=`/bin/ps x | fgrep smbd | grep -v grep` - if [ "$psline" ] - then - set -- $psline - pid=$1 - /bin/kill -9 $pid - echo "Stopped $pid line = $psline" - sleep 2 - fi - done - fi - echo "Stopped Samba servers" - psline=`/bin/ps x | grep nmbd | grep -v grep` - if [ "$psline" ] - then - set -- $psline - pid=$1 - /bin/kill -9 $pid - echo "Stopped Name Server " - fi - echo "Stopped Name Servers" - ;; - *) - echo "usage: samba {start | restart |stop | conf | pw | who}" - ;; - esac - - - - Use this script, or some other one, you will need to ensure its used while the machine - is booting. (This typically involves /etc/rc.d, we'll be - assuming that there is a script called - samba in /etc/rc.d/init.d further down in this document.) - - - -Config File - -A sample conf file - Here is a fairly minimal config file to do PDC. It will also make the server - become the browse master for the - specified domain (not necessary but usually desirable). You will need to change only - two parameters to make this - file work, wins server and workgroup, plus - you will need to put your own name (not mine!) in the domain admin users fields. - Some of the parameters are discussed further down this document. - - Assuming you have used the default install directories, this file should appear as - /usr/local/samba/lib/smb.conf. It should not be - writable by anyone except root. - - The 'add user script' parameter is a work-around, watch for changes ! - - - - [global] - security = user - status = yes - workgroup = { Your domain name here } - wins server = { ip of a wins server if you have one } - encrypt passwords = yes - domain logons =yes - logon script = scripts\%U.bat - domain admin group = @adm - add user script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %m$ - guest account = ftp - share modes=no - os level=65 - [homes] - guest ok = no - read only = no - create mask = 0700 - directory mask = 0700 - oplocks = false - locking = no - [netlogon] - path = /usr/local/samba/netlogon - writeable = no - guest ok = no - - - - - -PDC Config Parameters - - -There are a huge range of parameters that may appear in a smb.conf file. Some - that may be of interest to a PDC are : - -add user script - This parameter specifies a script (or program) that will be run - to add a user to the system. Here it is being used to add a machine, not a user. - This is probably not very nice and may change. But it does work ! - - For this example, I have a group called 'machines', entries can be added to - /etc/passwd using a programme called /usr/adduser and - the other parameters are chosen as suitable for a machine account. Works for - RH Linux, your system may require changes. - - - - -domain admin group = @adm - This parameter specifies a unix group whose members will be granted - admin privileges on a NT workstation when - logged onto that workstation. See the section called - Domain Admin Accounts. - - - -domain admin users = user1 users2 - It appears that this parameter does not funtion correctly at present. - Use the 'domain admin group' instread. This parameter specifies a unix user who will - be granted admin privileges - on a NT workstation when - logged onto that workstation. See the section called - Domain Admin Accounts. - - - -encrypt passwords = yes - This parameter must be 'yes' to allow any of the recent service pack NTs to logon. There are some reg hacks that - turn off encrypted passwords on the NTws itself but if you are going to use the smbpasswd system (and you - should) you must use encrypted passwords. - - - -logon script = scripts\%U.bat - This will make samba look for a logon script named after the user - (eg joeblow.bat). - See the section further on called Logon Scripts - Note that the slash is like this '\', not like this '/'. - NT is happy with both, win95 is not ! - - - -logon path - Lets you specify where you would like users profiles kept. The default, that is in the users - home directory, does encourage a bit of fiddling. - - - - - - - - - - -Special directories - You need to create a couple of special files and directories. Its nice - to have some of the binaries handy too, so I create links to them. Assuming - you have used the default samba location and have not - changed the locations mentioned in the sample config file, do the following : - - - - mkdir /usr/local/samba/netlogon - mkdir /usr/local/samba/netlogon/scripts - mkdir /usr/local/samba/private - touch /usr/local/samba/private/smbpasswd - chmod go-rwx /usr/local/samba/private/smbpasswd - cd /usr/local/sbin - ln -s /usr/local/samba/bin/smbpasswd - ln -s /usr/local/samba/bin/smbclient - ln -s /etc/rc.d/init.d/samba - - - Make sure permissions are appropriate ! - - OK, if you have used the scripts above and have a path to where the links are do this to start up - the Samba Server : - - samba start - - Instead, you might like to reboot the machine to make sure that you - got the init stuff right. Any way, a quick look in the logs - /usr/local/samba/var/log.smbd and - /usr/local/samba/var/log/nmbd - will give you an idea of what's happening. Assuming all is well, lets create - some accounts... - - - - - -User and Machine Accounts -Logon Accounts - - This section is very nearly out of date already ! It - appears that while you are reading it, Jean Francois Micou is making it - redundant ! Jean Francois is adding facilities to add users - (via User Manager) and machines (when joining the domain) and it looks like these facilities will - make it into the official release of 2.2. - - - Every user and NTws (and other samba servers) that will be on the domain - must have its own passwd entry in both /etc/passwd and - /usr/local/samba/private/smbpasswd . - The /etc/passwd entry is really - only to reserve a user ID. The NT encrypted password is stored in - /usr/local/samba/private/smbpasswd. - (Note that win95/98 machines don't need an account as they don't do - any security aware things.) - - Samba 2.2 will now create these entries for us. Carefull set up is required - and there may well be some changes to this system before its released. - - - -Machine Accounts - - There is an entry in the ntdom FAQ explaining how to create - machine entries manually. - - -<emphasis>At present</> to have the machine accounts created when a machine joins - the domain a number of conditions must be met : - -Only root can do it ! - There must be an entry in /usr/local/samba/private/smbpasswd - for root and root must be mentioned in domain admins. This may - be fixed some time in the future so any 'domain admin' can do it. If you don't - like having root as a windows logon account, make the machine - entries manually (both of them). - - - -Use the add user script - Again, this looks a bit like a 'work around'. Use a suitable - command line to add a machine account see above, - and pass it %m$, that is %m to get machine name plus the '$'. Now, this - means you cannot use the add user script to really add users .... - - - -Only for W2K - This automatic creation of machine accounts does not work for - NT4ws at present. Watch this space. - - - - -Joining the Domain - - You must have either added the machine account entries manually (NT4 ws) - or set up the automatic system (W2K), see Machine Accounts - before proceeding. - - -Windows NT - - (this step may not be necessary some time in the near future). - On the samba server that is the PDC, add a machine account manually - as per the instructions in the FAQ - Then give the command smbpasswd -a -m {machine} substituting in the - client machine name. - Logon to the NTws in question as a local admin, go to the - Control Panel, Network IdentificationTag. - Press the Change button. - Enter the Domain name (from the 'Workgroup' parameter, smb.conf) - in the Domain Field. - - Press OK and after a few seconds you will get a 'Welcome to Whatever Domain'. - Allow to reboot. - - - -Windows 2000 - - Logon to the W2k machine as Administrator, go to the Control - Panel and double click on Network and Dialup Connections. - - Pull down the Advanced menu and choose - Network Identification. Press Properties - . - Choose Domain and enter the domain name. Press 'OK'. - Now enter a user name and password for a Domain Admin - (Who must be root until a pre-release bug is fixed) and press - 'OK'. - Wait for the confirmation, reboot when prompted. - - To remove a W2K machine from the domain, follow the first two steps then - choose Workgroup, enter a work group name (or just WORKGROUP) and follow - the prompts. - - - - - - - -User Accounts - - Again, doing it manually (cos' the auto way is not working pre-release). - - In our simple case every domain user should have an account on the PDC. The - account may have a null shell if they are not allowed to log on to the unix - prompt. Again they need an entry in both the /etc/passwd and - /usr/local/samba/private/smbpasswd. Again a password is - not necessary in /etc/passwd but the location - of the home directory is honoured. - To make an entry for a user called Joe Blow you would typically do the following : - - adduser -g users -c 'Joe Blow' -s /bin/false -n joeblow - - smbpasswd -a joeblow - - And you will prompted to enter a password for Joe. Ideally he will be - hovering over your shoulder and will, when asked, type in a password of - his choice. There are a number of scripts and systems to ease the migration of users - from somewhere to samba. Better start looking ! - - -Domain Admin Accounts - - Certain operations demand that the logged on user has Administrator - privileges, typically installing software and - doing maintenance tasks. It is very simple to appoint some users as Domain Admins, - most likely yourself. Make - sure you trust the appointee ! - - Samba 2.2 recognizes particular users as being - domain admins and tells the NTws when it thinks that it has got one logged on. - In the smb.conf file we declare - that the Domain Admin group = @adm. - Any user who is a menber of the unix group 'adm' is treated as a Domain Admin by a NTws when - logged onto the Domain. They will have full Administrator rights - including the rights to change permissions on files and run the system - utilities such as Disk Administrator. Add users to the group by editing - /etc/group/. You do not need to use the 'adm' group, choose any one you like. - - Further, and this is very new, they will be allowed to create a - new machine account when first connecting a new NT or W2K machine to - the domain. However, at present, ie pre-release, only a Domain Admin who - also happens to be root can do so. - - - - - - -Profiles, Policies and Logon Scripts - -Profiles - - NT Profiles should work if you have followed the setup so far. - A user's profile contains a whole lot of their personal settings, - the contents of their desktop, personal 'My Documents' and so on. - When they log off, all of the profile is copied to their directory - on the server and is downloaded again when they logon on again, possibly - on another client machine. - - Sounds great but can be a bit of a bug bear sometimes. Users let - their profiles get too big and then complain about how long it takes - to log on each time. This sample setup only supports NT profiles, - rumor has it that it is also possible to do the same on Win95, my - users don't know and I'm not telling them. - - There is more info about Profiles (including for W95/98) - in the FAQ. - - -Policies - - Policies are an easy way to make or enforce specific characteristics across your network. You create a ntconfig.pol - file and every time someone logs on with their NTws, the settings you put in ntconfig.pol are applied to the NTws. - Typical setting are things like making the date appear the way you want it (none of these 2 figure years here) or - maybe suppressing one of the splash screens. Perhaps you want to set the NTws so it does not keep users profiles - on the local machine. Cool. The only problem is making the ntconfig.pol file itself. You cannot use the policy editor - that comes with NTws. - - See the FAQ for pointers on how to get a suitable Policy Editor. - - The Policy Editor (and associated files) will create a - ntconfig.pol file using the - parameters Microsoft thought of and parameters you specify by making your own - template file. - - In our example configuration here, Samba will expect to find - the ntconfig.pol file in - /usr/local/samba/netlogon. Needless to say (I hope !), - it is vitally important that ordinary users don't have - write permission to the Policy files. - - -Logon Scripts - - In the sample config file above there is a line - logon script = scripts\%U.bat - - Note that the slash is like this '\' not like this '/'. - NT is happy with both, win95 is not ! - - This allows you to run a dos batch file every time someone logs on. The batch - file is located on the server, in the sample install mentioned here, - its in /usr/local/samba/netlogon/scripts and - is named after the user with .bat appended, eg Joe - Blow's script is called /usr/local/samba/netlogon/scripts/joeblow.bat. - - There is a suggestion that user names longer than 8 characters may cause - problems with some systems being unable to run logon scripts. This is confirmed in earlier - versions when connecting using W95, comments about other combinations ?? - - You could use a line like this logon script = default.bat and samba - will supply /usr/local/samba/netlogon/default.bat for any client and every - user. Maybe you could use %m and get a client machine dependant logon script. - You get the idea... - - Note that the file is a dos batch file not a Unix script. It runs dos commands on the client - computer with the logon user's permissions. It must be a dos file with each line ending with - the dos cr/lf not a nice clean newline. Generally, - its best to create the initial file on a DOS system and copy it across. - - There is lots of very clever uses of the Samba replaceable variables such - ( %U = user, %G = primary group, %H = client machine, see the 'man 5 smb.conf') to - give you control over which script runs when a particular person logs - on. (Gee, it would be nice to have a default.bat run when nothing else is available.) - - Again, it is vitally important that ordinary users don't have write - permission to other peoples, or even probably their own, logon script files. - - A typical logon script is reproduced below. Note that it runs separate - commands for win95 and NT, that's because NT has slightly different behaviour - when using the net use .. command. Its useful for lots of - other situations too. I don't know what syntax to use for win98, I don't use it - here. - - - - rem Default logon script, create links to this file. - - net time \\bioserve /set /yes - @echo off - if %OS%.==Windows_NT. goto WinNT - - :Win95 - net use k: \\trillion\bio_prog - net use p: \\bcfile\homes - goto end - :WinNT - net use k: \\trillion\bio_prog /persistent:no - net use p: \\bcfile\homes /persistent:no - - :end - - - - - -Passwords and Authentication - - So far our configuration assumes that ordinary users don't have unix logon access. A change - to the adduser line above would allow unix logon - but it would be with passwords that may - be different from the NT logon. Clearly that won't suit everyone. Trying to explain to users - that they need to change their passwords in two seperate places is not fun. - Further, even if they cannot do a unix logon there are other processes that - might require authentication. We have a nice securely encrypted password in - /usr/local/samba/private/smbpasswd, why not use it ? - -</> -<sect2><title>Syncing Passwords - - Yes, its possible and seems the easiest way (initially anyway). - The FAQ details how to - do so in the sections What is password sync and should I use it ? and - How do I get remote password (unix and SMB) changing working ? - - - -Using PAM - Pam enabled systems have a much better solution available. The Samba - PDC server will offer to authenticate domain users to other processes - (either on this server or on the domain). With a suitable pam stack - such as Pam_smb - you can get any pam aware application looking to the samba password and - can leave the password field in /etc/shadow - or /etc/passwd invalid. - - -Authenticating other Samba Servers - In a domain that has a number of servers you only need one password database. - The machines that don't have their own ask the PDC to check for them. - This will work fine for a domain controlled by either a Samba or NT machine. - - To do so the Samba machine must be told to refer to the PDC and where the PDC is. - See the section in the NTDom FAQ called How do I get my samba server to - become a member ( not PDC ) of an NT domain? - - - - - - - -Background - - -History - - It might help you understand the limitations of the PDC in Samba if you - read something of its history. Well, the history as I understand it anyway. - - For many years the Samba team have been developing Samba, some time ago - a number of people, possibly lead by Luke Leighton started contributing NT - PDC stuff. This was added to the 'head' stream (that would eventually - become the next version) and later to a seperate stream (NTDom). They did so - much that eventually this development stream was so mutated that it could not - be merged back into the main stream and was abandoned towards the end of 1999. - And that was very sad because many users, myself include had become heavily - dependant on the NTController facilities it offered. Oh well... - - The NTDom team continued on with their new found knowledge however and - built the TNG stream. Intended to be carefully controlled so that it can be - merged back into the main stream and benefiting from what they learnt, it is - a very different product to the origional NTDom product. However, for a - number of reasons, the merge did not take place and now TNG is being developed - at http://www.samba-tng.org. - - Now, the NTDom things that the main strean 2.0.x version does is based more - on the old (initial version) abandoned code than on the TNG ideas. It appears - that version 2.2.0 will also include an improved version of the 2.0.7 domain - controller charactistics, not the TNG ways. The developers have indicated - that 2.2.0 will be further developed incrementally and the ideas from TNG - incorporated into it. - - One more little wriggle is worth mentioning. At one stage the NTDom - stream was called Samba 2.1.0-prealpha and similar names. This is most - unfortunate because at least one book published advises people who want to - use NTDom Samba to get version 2.1.0 or later. As main stream Samba will soon - be called 2.2.0 and NOT officially supporting NTDom Controlling functions, - the potential for confusion is certainly there. - - -The Future - - There is a document on the Samba mirrors called 'Development' - . It offers the 'best guess' of what is planned for future releases - of Samba. - - The future of Samba as a Primary Domain Controller appears rosie, however - be aware that its the future, not the present. The developers are strongly committed - to building a full featured PDC into Samba but it will take time. If this - version does not meet your requirements then you should consider (in no particular - order) : - - - Wait. No, we don't know how long. Repeated asking won't help. - Investigate the development versions, TNG perhaps or HEAD where new code is being added - all the time. Realise that development code is often unstable, poorly documented and subject to change. - You will need to use cvs to download development versions. - Join one of the Samba mailing lists so that you can find out - what is happening on the 'bleeding edge'. - - - -Getting further help - - This document cannot possibly answer all your questions. Please understand that its very - likely that someone has been confrounted by the same problem that you have. The - FAQ - discusses a number of possible paths to take to get further help : - - - - Documents on the Samba Sites. - Other web sites. - Mailing list. - - - There is some discussion about guide lines for using the Mailing Lists on the - accompanying FAQ, - please read them before posting. - - - - - - -- cgit