From 9c72dd78f25be4a7ffa5af5a242670ec76930d6f Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Sat, 12 Mar 2005 22:34:38 +0000 Subject: Use new definition of , fixes a bunch of validity errors. (This used to be commit 3eb5c35e47951f320f7c2f4cd478a95f6d48236e) --- docs/Samba-HOWTO-Collection/PDC.xml | 82 ++++++++++++++++++------------------- 1 file changed, 41 insertions(+), 41 deletions(-) (limited to 'docs/Samba-HOWTO-Collection/PDC.xml') diff --git a/docs/Samba-HOWTO-Collection/PDC.xml b/docs/Samba-HOWTO-Collection/PDC.xml index dd2f73585b..2e25646822 100644 --- a/docs/Samba-HOWTO-Collection/PDC.xml +++ b/docs/Samba-HOWTO-Collection/PDC.xml @@ -345,7 +345,7 @@ NT4/200x/XP clients: Configuration of basic TCP/IP and MS Windows networking. - Correct designation of the Server Role (securityuser). + Correct designation of the Server Role (user). Consistent configuration of Name ResolutionSee Network Browsing, and Integrating MS Windows Networks with Samba.. Domain logons for Windows NT4/200x/XP Professional clients. @@ -361,7 +361,7 @@ The following provisions are required to serve MS Windows 9x/Me clients: Configuration of basic TCP/IP and MS Windows networking. - Correct designation of the server role (securityuser). + Correct designation of the server role (user). Network Logon Configuration (since Windows 9x/Me/XP Home are not technically domain members, they do not really participate in the security aspects of Domain logons as such). Roaming Profile Configuration. @@ -404,7 +404,7 @@ A Domain Controller is an SMB/CIFS server that: It is rather easy to configure Samba to provide these. Each Samba Domain Controller must provide -the NETLOGON service that Samba calls the domain logons functionality +the NETLOGON service that Samba calls the functionality (after the name of the parameter in the &smb.conf; file). Additionally, one server in a Samba-3 Domain must advertise itself as the Domain Master BrowserSee Network Browsing.. This causes the Primary Domain Controller to claim a domain-specific NetBIOS name that identifies it as a @@ -429,30 +429,30 @@ in &smb.conf;. An example &smb.conf; for acting as a PDC can be found in smb.conf for being a PDC [global] -netbios nameBELERIAND -workgroup&example.workgroup; -passdb backendtdbsam -os level33 -preferred masteryes -domain masteryes -local masteryes -securityuser -domain logonsyes -logon path\\%N\profiles\%U -logon driveH: -logon home\\homeserver\%U\winprofile -logon scriptlogon.cmd +BELERIAND +&example.workgroup; +tdbsam +33 +yes +yes +yes +user +yes +\\%N\profiles\%U +H: +\\homeserver\%U\winprofile +logon.cmd [netlogon] -path/var/lib/samba/netlogon -read onlyyes -write listntadmin +/var/lib/samba/netlogon +yes +ntadmin [profiles] -path/var/lib/samba/profiles -read onlyno -create mask0600 -directory mask0700 +/var/lib/samba/profiles +no +0600 +0700 @@ -521,11 +521,11 @@ of operation. The following &smb.conf; parameters are the essentials alone: -netbios nameBELERIAND -workgroup&example.workgroup; -domain logonsYes -domain masterYes -securityUser +BELERIAND +&example.workgroup; +Yes +Yes +User @@ -573,8 +573,8 @@ an integral part of the essential functionality that is provided by a Domain Con All Domain Controllers must run the netlogon service (domain logons -in Samba). One Domain Controller must be configured with domain masterYes -(the Primary Domain Controller); on all Backup Domain Controllers domain masterNo +in Samba). One Domain Controller must be configured with Yes +(the Primary Domain Controller); on all Backup Domain Controllers No must be set. @@ -584,14 +584,14 @@ must be set. smb.conf for being a PDC [global] -domain logonsYes -domain master(Yes on PDC, No on BDCs) +Yes +(Yes on PDC, No on BDCs) [netlogon] -commentNetwork Logon Service -path/var/lib/samba/netlogon -guest okYes -browseableNo +Network Logon Service +/var/lib/samba/netlogon +Yes +No @@ -791,11 +791,11 @@ For this reason, it is wise to configure the Samba DC as the DMB. Now back to the issue of configuring a Samba DC to use a mode other than -securityuser. If a Samba host is +user. If a Samba host is configured to use another SMB server or DC in order to validate user connection requests, -it is a fact that some other machine on the network (the password server) +it is a fact that some other machine on the network (the ) knows more about the user than the Samba host. About 99% of the time, this other host is -a Domain Controller. Now to operate in domain mode security, the workgroup +a Domain Controller. Now to operate in domain mode security, the parameter must be set to the name of the Windows NT domain (which already has a Domain Controller). If the domain does not already have a Domain Controller, you do not yet have a Domain. @@ -803,7 +803,7 @@ If the domain does not already have a Domain Controller, you do not yet have a D Configuring a Samba box as a DC for a domain that already by definition has a PDC is asking for trouble. Therefore, you should always configure the Samba DC -to be the DMB for its domain and set securityuser. +to be the DMB for its domain and set user. This is the only officially supported mode of operation. @@ -909,7 +909,7 @@ wrong? This problem is caused by the PDC not having a suitable Machine Trust Account. -If you are using the add machine script method to create +If you are using the method to create accounts then this would indicate that it has not worked. Ensure the domain admin user system is working. -- cgit