From 8f8a9f01909ba29e2b781310baeeaaddc3f15f0d Mon Sep 17 00:00:00 2001 From: "Gerald W. Carter" Date: Tue, 22 Apr 2008 10:09:40 -0500 Subject: Moving docs tree to docs-xml to make room for generated docs in the release tarball. (This used to be commit 9f672c26d63955f613088489c6efbdc08b5b2d14) --- .../smbdotconf/ldap/clientldapsaslwrapping.xml | 44 ++++++++++ docs-xml/smbdotconf/ldap/ldapadmindn.xml | 21 +++++ docs-xml/smbdotconf/ldap/ldapdeletedn.xml | 14 ++++ docs-xml/smbdotconf/ldap/ldapgroupsuffix.xml | 16 ++++ docs-xml/smbdotconf/ldap/ldapidmapsuffix.xml | 15 ++++ docs-xml/smbdotconf/ldap/ldapmachinesuffix.xml | 18 +++++ docs-xml/smbdotconf/ldap/ldappasswdsync.xml | 38 +++++++++ docs-xml/smbdotconf/ldap/ldapreplicationsleep.xml | 25 ++++++ docs-xml/smbdotconf/ldap/ldapsameditposix.xml | 93 ++++++++++++++++++++++ docs-xml/smbdotconf/ldap/ldapsamtrusted.xml | 30 +++++++ docs-xml/smbdotconf/ldap/ldapssl.xml | 38 +++++++++ docs-xml/smbdotconf/ldap/ldapsuffix.xml | 18 +++++ docs-xml/smbdotconf/ldap/ldaptimeout.xml | 14 ++++ docs-xml/smbdotconf/ldap/ldapusersuffix.xml | 16 ++++ 14 files changed, 400 insertions(+) create mode 100644 docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapadmindn.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapdeletedn.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapgroupsuffix.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapidmapsuffix.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapmachinesuffix.xml create mode 100644 docs-xml/smbdotconf/ldap/ldappasswdsync.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapreplicationsleep.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapsameditposix.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapsamtrusted.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapssl.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapsuffix.xml create mode 100644 docs-xml/smbdotconf/ldap/ldaptimeout.xml create mode 100644 docs-xml/smbdotconf/ldap/ldapusersuffix.xml (limited to 'docs-xml/smbdotconf/ldap') diff --git a/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml new file mode 100644 index 0000000000..a926cec645 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml @@ -0,0 +1,44 @@ + + + + The defines whether + ldap traffic will be signed or signed and encrypted (sealed). + Possible values are plain, sign + and seal. + + + + The values sign and seal are + only available if Samba has been compiled against a modern + OpenLDAP version (2.3.x or higher). + + + + This option is needed in the case of Domain Controllers enforcing + the usage of signed LDAP connections (e.g. Windows 2000 SP3 or higher). + LDAP sign and seal can be controlled with the registry key + "HKLM\System\CurrentControlSet\Services\ + NTDS\Parameters\LDAPServerIntegrity" + on the Windows server side. + + + + Depending on the used KRB5 library (MIT and older Heimdal versions) + it is possible that the message "integrity only" is not supported. + In this case, sign is just an alias for + seal. + + + + The default value is plain which is not irritable + to KRB5 clock skew errors. That implies synchronizing the time + with the KDC in the case of using sign or + seal. + + +plain + diff --git a/docs-xml/smbdotconf/ldap/ldapadmindn.xml b/docs-xml/smbdotconf/ldap/ldapadmindn.xml new file mode 100644 index 0000000000..442d242679 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapadmindn.xml @@ -0,0 +1,21 @@ + + + + + The defines the Distinguished Name (DN) name used by Samba to contact + the ldap server when retreiving user account information. The is used + in conjunction with the admin dn password stored in the private/secrets.tdb + file. See the smbpasswd 8 + man page for more information on how to accomplish this. + + + + The requires a fully specified DN. The is not appended to the . + + + diff --git a/docs-xml/smbdotconf/ldap/ldapdeletedn.xml b/docs-xml/smbdotconf/ldap/ldapdeletedn.xml new file mode 100644 index 0000000000..48f5c9b65a --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapdeletedn.xml @@ -0,0 +1,14 @@ + + + This parameter specifies whether a delete + operation in the ldapsam deletes the complete entry or only the attributes + specific to Samba. + + + +no + diff --git a/docs-xml/smbdotconf/ldap/ldapgroupsuffix.xml b/docs-xml/smbdotconf/ldap/ldapgroupsuffix.xml new file mode 100644 index 0000000000..8fe033a2f9 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapgroupsuffix.xml @@ -0,0 +1,16 @@ + + + This parameter specifies the suffix that is + used for groups when these are added to the LDAP directory. + If this parameter is unset, the value of will be used instead. The suffix string is pre-pended to the + string so use a partial DN. + + + +ou=Groups + diff --git a/docs-xml/smbdotconf/ldap/ldapidmapsuffix.xml b/docs-xml/smbdotconf/ldap/ldapidmapsuffix.xml new file mode 100644 index 0000000000..e397138741 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapidmapsuffix.xml @@ -0,0 +1,15 @@ + + + + This parameters specifies the suffix that is used when storing idmap mappings. If this parameter + is unset, the value of will be used instead. The suffix + string is pre-pended to the string so use a partial DN. + + + +ou=Idmap + diff --git a/docs-xml/smbdotconf/ldap/ldapmachinesuffix.xml b/docs-xml/smbdotconf/ldap/ldapmachinesuffix.xml new file mode 100644 index 0000000000..b54f6383e8 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapmachinesuffix.xml @@ -0,0 +1,18 @@ + + + + + It specifies where machines should be added to the ldap tree. If this parameter is unset, the value of + will be used instead. The suffix string is pre-pended to the + string so use a partial DN. + + + + +ou=Computers + diff --git a/docs-xml/smbdotconf/ldap/ldappasswdsync.xml b/docs-xml/smbdotconf/ldap/ldappasswdsync.xml new file mode 100644 index 0000000000..864bfc45a0 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldappasswdsync.xml @@ -0,0 +1,38 @@ + + + + + This option is used to define whether or not Samba should sync the LDAP password with the NT + and LM hashes for normal accounts (NOT for workstation, server or domain trusts) on a password + change via SAMBA. + + + + The can be set to one of three values: + + + + + Yes = Try + to update the LDAP, NT and LM passwords and update the pwdLastSet time. + + + + No = Update NT and + LM passwords and update the pwdLastSet time. + + + + Only = Only update + the LDAP password and let the LDAP server do the rest. + + + + +no + diff --git a/docs-xml/smbdotconf/ldap/ldapreplicationsleep.xml b/docs-xml/smbdotconf/ldap/ldapreplicationsleep.xml new file mode 100644 index 0000000000..4710e2b3b3 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapreplicationsleep.xml @@ -0,0 +1,25 @@ + + + + When Samba is asked to write to a read-only LDAP replica, we are redirected to talk to the read-write master server. + This server then replicates our changes back to the 'local' server, however the replication might take some seconds, + especially over slow links. Certain client activities, particularly domain joins, can become confused by the 'success' + that does not immediately change the LDAP back-end's data. + + + + This option simply causes Samba to wait a short time, to allow the LDAP server to catch up. If you have a particularly + high-latency network, you may wish to time the LDAP replication with a network sniffer, and increase this value accordingly. + Be aware that no checking is performed that the data has actually replicated. + + + + The value is specified in milliseconds, the maximum value is 5000 (5 seconds). + + +1000 + diff --git a/docs-xml/smbdotconf/ldap/ldapsameditposix.xml b/docs-xml/smbdotconf/ldap/ldapsameditposix.xml new file mode 100644 index 0000000000..ace6c6c64d --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapsameditposix.xml @@ -0,0 +1,93 @@ + + + + + Editposix is an option that leverages ldapsam:trusted to make it simpler to manage a domain controller + eliminating the need to set up custom scripts to add and manage the posix users and groups. This option + will instead directly manipulate the ldap tree to create, remove and modify user and group entries. + This option also requires a running winbindd as it is used to allocate new uids/gids on user/group + creation. The allocation range must be therefore configured. + + + + To use this option, a basic ldap tree must be provided and the ldap suffix parameters must be properly + configured. On virgin servers the default users and groups (Administrator, Guest, Domain Users, + Domain Admins, Domain Guests) can be precreated with the command net sam + provision. To run this command the ldap server must be running, Winindd must be running and + the smb.conf ldap options must be properly configured. + + The typical ldap setup used with the yes option + is usually sufficient to use yes as well. + + + + An example configuration can be the following: + + + encrypt passwords = true + passdb backend = ldapsam + + ldapsam:trusted=yes + ldapsam:editposix=yes + + ldap admin dn = cn=admin,dc=samba,dc=org + ldap delete dn = yes + ldap group suffix = ou=groups + ldap idmap suffix = ou=idmap + ldap machine suffix = ou=computers + ldap user suffix = ou=users + ldap suffix = dc=samba,dc=org + + idmap backend = ldap:"ldap://localhost" + + idmap uid = 5000-50000 + idmap gid = 5000-50000 + + + This configuration assume the ldap server have been loaded with a base tree like described + in the following ldif: + + + dn: dc=samba,dc=org + objectClass: top + objectClass: dcObject + objectClass: organization + o: samba.org + dc: samba + + dn: cn=admin,dc=samba,dc=org + objectClass: simpleSecurityObject + objectClass: organizationalRole + cn: admin + description: LDAP administrator + userPassword: secret + + dn: ou=users,dc=samba,dc=org + objectClass: top + objectClass: organizationalUnit + ou: users + + dn: ou=groups,dc=samba,dc=org + objectClass: top + objectClass: organizationalUnit + ou: groups + + dn: ou=idmap,dc=samba,dc=org + objectClass: top + objectClass: organizationalUnit + ou: idmap + + dn: ou=computers,dc=samba,dc=org + objectClass: top + objectClass: organizationalUnit + ou: computers + + + + +no + diff --git a/docs-xml/smbdotconf/ldap/ldapsamtrusted.xml b/docs-xml/smbdotconf/ldap/ldapsamtrusted.xml new file mode 100644 index 0000000000..2e4e1dbd7c --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapsamtrusted.xml @@ -0,0 +1,30 @@ + + + + + By default, Samba as a Domain Controller with an LDAP backend needs to use the Unix-style NSS subsystem to + access user and group information. Due to the way Unix stores user information in /etc/passwd and /etc/group + this inevitably leads to inefficiencies. One important question a user needs to know is the list of groups he + is member of. The plain UNIX model involves a complete enumeration of the file /etc/group and its NSS + counterparts in LDAP. UNIX has optimized functions to enumerate group membership. Sadly, other functions that + are used to deal with user and group attributes lack such optimization. + + + + To make Samba scale well in large environments, the yes + option assumes that the complete user and group database that is relevant to Samba is stored in LDAP with the + standard posixAccount/posixGroup attributes. It further assumes that the Samba auxiliary object classes are + stored together with the POSIX data in the same LDAP object. If these assumptions are met, + yes can be activated and Samba can bypass the + NSS system to query user group memberships. Optimized LDAP queries can greatly speed up domain logon and + administration tasks. Depending on the size of the LDAP database a factor of 100 or more for common queries + is easily achieved. + + + +no + diff --git a/docs-xml/smbdotconf/ldap/ldapssl.xml b/docs-xml/smbdotconf/ldap/ldapssl.xml new file mode 100644 index 0000000000..39ed08fe82 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapssl.xml @@ -0,0 +1,38 @@ + + + This option is used to define whether or not Samba should + use SSL when connecting to the ldap server + This is NOT related to + Samba's previous SSL support which was enabled by specifying the + --with-ssl option to the configure + script. + +The can be set to one of three values: + + + Off = Never + use SSL when querying the directory. + + + + Start_tls = Use + the LDAPv3 StartTLS extended operation (RFC2830) for + communicating with the directory server. + + + + On = Use SSL + on the ldaps port when contacting the ldap server. Only available when the + backwards-compatiblity --with-ldapsam option is specified + to configure. See . + + + +start_tls + diff --git a/docs-xml/smbdotconf/ldap/ldapsuffix.xml b/docs-xml/smbdotconf/ldap/ldapsuffix.xml new file mode 100644 index 0000000000..48595139a2 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapsuffix.xml @@ -0,0 +1,18 @@ + + + Specifies the base for all ldap suffixes and for storing the sambaDomain object. + + + The ldap suffix will be appended to the values specified for the , + , , and the + . Each of these should be given only a DN relative to the + . + + + +dc=samba,dc=org + diff --git a/docs-xml/smbdotconf/ldap/ldaptimeout.xml b/docs-xml/smbdotconf/ldap/ldaptimeout.xml new file mode 100644 index 0000000000..cd88494903 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldaptimeout.xml @@ -0,0 +1,14 @@ + + + + When Samba connects to an ldap server that servermay be down or unreachable. To prevent Samba from hanging whilst + waiting for the connection this parameter specifies in seconds how long Samba should wait before failing the + connect. The default is to only wait fifteen seconds for the ldap server to respond to the connect request. + + +15 + diff --git a/docs-xml/smbdotconf/ldap/ldapusersuffix.xml b/docs-xml/smbdotconf/ldap/ldapusersuffix.xml new file mode 100644 index 0000000000..6b4eec378d --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapusersuffix.xml @@ -0,0 +1,16 @@ + + + + This parameter specifies where users are added to the tree. If this parameter is unset, + the value of will be used instead. The suffix + string is pre-pended to the string so use a partial DN. + + + + +ou=people + -- cgit From a307e90f3f274cd307a5e7377bae4b27ae3a5c69 Mon Sep 17 00:00:00 2001 From: Karolin Seeger Date: Tue, 3 Jun 2008 16:44:59 +0200 Subject: man pages: Add documentation for new parameter 'ldap connection timeout'. Karolin (This used to be commit f7bfa1330cef34b1bbe7969bddbce2ff895321ed) --- docs-xml/smbdotconf/ldap/ldapconnectiontimeout.xml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 docs-xml/smbdotconf/ldap/ldapconnectiontimeout.xml (limited to 'docs-xml/smbdotconf/ldap') diff --git a/docs-xml/smbdotconf/ldap/ldapconnectiontimeout.xml b/docs-xml/smbdotconf/ldap/ldapconnectiontimeout.xml new file mode 100644 index 0000000000..31713c9cb5 --- /dev/null +++ b/docs-xml/smbdotconf/ldap/ldapconnectiontimeout.xml @@ -0,0 +1,22 @@ + + + + This parameter tells the LDAP library calls which timeout in seconds + they should honor during initial connection establishments to LDAP servers. + It is very useful in failover scenarios in particular. If one or more LDAP + servers are not reachable at all, we do not have to wait until TCP + timeouts are over. This feature must be supported by your LDAP library. + + + + This parameter is different from + which affects operations on LDAP servers using an existing connection + and not establishing an initial connection. + + +2 + -- cgit From d84aca59bb5bd3612285754219b8c547fee9219a Mon Sep 17 00:00:00 2001 From: Karolin Seeger Date: Fri, 23 May 2008 14:12:05 +0200 Subject: man pages: Fix typo. Karolin (cherry picked from commit 87bcff8dde4302f7b473933f8fddfb98b3c024db) (This used to be commit f0b3df1ff0d423be20723968f15b3543969ff769) --- docs-xml/smbdotconf/ldap/ldaptimeout.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'docs-xml/smbdotconf/ldap') diff --git a/docs-xml/smbdotconf/ldap/ldaptimeout.xml b/docs-xml/smbdotconf/ldap/ldaptimeout.xml index cd88494903..9c34ac8bec 100644 --- a/docs-xml/smbdotconf/ldap/ldaptimeout.xml +++ b/docs-xml/smbdotconf/ldap/ldaptimeout.xml @@ -5,7 +5,7 @@ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> - When Samba connects to an ldap server that servermay be down or unreachable. To prevent Samba from hanging whilst + When Samba connects to an ldap server that server may be down or unreachable. To prevent Samba from hanging whilst waiting for the connection this parameter specifies in seconds how long Samba should wait before failing the connect. The default is to only wait fifteen seconds for the ldap server to respond to the connect request. -- cgit From 7617741e64ddc7db7e0fbf706289a14986a6139a Mon Sep 17 00:00:00 2001 From: Christoph Zauner Date: Wed, 11 Jun 2008 15:17:21 +0200 Subject: man pages: Fix typos. (This used to be commit 881eaa26e071a7fde9c6fc5eb42ae122d0ddd490) --- docs-xml/smbdotconf/ldap/ldapsameditposix.xml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'docs-xml/smbdotconf/ldap') diff --git a/docs-xml/smbdotconf/ldap/ldapsameditposix.xml b/docs-xml/smbdotconf/ldap/ldapsameditposix.xml index ace6c6c64d..c04ecc9cdd 100644 --- a/docs-xml/smbdotconf/ldap/ldapsameditposix.xml +++ b/docs-xml/smbdotconf/ldap/ldapsameditposix.xml @@ -48,8 +48,7 @@ idmap gid = 5000-50000 - This configuration assume the ldap server have been loaded with a base tree like described - in the following ldif: + This configuration assumes a directory layout like described in the following ldif: dn: dc=samba,dc=org -- cgit