From 06aa63b6f19131071800985746b445dee42d91eb Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Fri, 10 Jun 2005 20:29:09 +0000 Subject: Large number of small fixes to the layout and the build system. (This used to be commit 73fac0653c774a8ed8654b064fd63d4e486f6b0f) --- docs/Samba3-HOWTO/TOSHARG-StandAloneServer.xml | 244 +++++++++++++++++++++++++ 1 file changed, 244 insertions(+) create mode 100644 docs/Samba3-HOWTO/TOSHARG-StandAloneServer.xml (limited to 'docs/Samba3-HOWTO/TOSHARG-StandAloneServer.xml') diff --git a/docs/Samba3-HOWTO/TOSHARG-StandAloneServer.xml b/docs/Samba3-HOWTO/TOSHARG-StandAloneServer.xml new file mode 100644 index 0000000000..ad1b69e79e --- /dev/null +++ b/docs/Samba3-HOWTO/TOSHARG-StandAloneServer.xml @@ -0,0 +1,244 @@ + + + + + &author.jht; + +Stand-alone Servers + + +Stand-alone Servers are independent of Domain Controllers on the network. +They are not Domain Members and function more like workgroup servers. In many +cases a Stand-alone Server is configured with a minimum of security control +with the intent that all data served will be readily accessible to all users. + + + +Features and Benefits + + +Stand-alone Servers can be as secure or as insecure as needs dictate. They can +have simple or complex configurations. Above all, despite the hoopla about +Domain Security they remain a common installation. + + + +If all that is needed is a server for read-only files, or for +printers alone, it may not make sense to effect a complex installation. +For example: A drafting office needs to store old drawings and reference +standards. No-one can write files to the server as it is legislatively +important that all documents remain unaltered. A share mode read-only Stand-alone +Server is an ideal solution. + + + +Another situation that warrants simplicity is an office that has many printers +that are queued off a single central server. Everyone needs to be able to print +to the printers, there is no need to effect any access controls and no files will +be served from the print server. Again, a share mode Stand-alone Server makes +a great solution. + + + + +Background + + +The term Stand-alone Server means that it +will provide local authentication and access control for all resources +that are available from it. In general this means that there will be a +local user database. In more technical terms, it means resources +on the machine will be made available in either SHARE mode or in +USER mode. + + + +No special action is needed other than to create user accounts. Stand-alone +servers do not provide network logon services. This means that machines that +use this server do not perform a domain logon to it. Whatever logon facility +the workstations are subject to is independent of this machine. It is, however, +necessary to accommodate any network user so the logon name they use will +be translated (mapped) locally on the Stand-alone Server to a locally known +user name. There are several ways this can be done. + + + +Samba tends to blur the distinction a little in respect of what is +a Stand-alone Server. This is because the authentication database may be +local or on a remote server, even if from the SMB protocol perspective +the Samba server is not a member of a domain security context. + + + +Through the use of Pluggable Authentication Modules (PAM) and the name service switcher (NSSWITCH), +which maintains the UNIX-user database) the source of authentication may reside on +another server. We would be inclined to call this the authentication server. +This means that the Samba server may use the local UNIX/Linux system password database +(/etc/passwd or /etc/shadow), may use a +local smbpasswd file, or may use an LDAP backend, or even via PAM and Winbind another CIFS/SMB server +for authentication. + + + + + +Example Configuration + + +The examples, Reference Documentation Server, and +Central Print Serving, +are designed to inspire simplicity. It is too easy to attempt a high level of creativity +and to introduce too much complexity in server and network design. + + + +Reference Documentation Server + + +Configuration of a read-only data server that everyone can access is very simple. +Following example is the &smb.conf; file that will do this. Assume that all the reference documents +are stored in the directory /export, and the documents are owned by a user other than +nobody. No home directories are shared, and there are no users in the /etc/passwd +UNIX system database. This is a simple system to administer. + + + +smb.conf for Reference Documentation Server + Global parameters + +&example.workgroup; +&example.server.samba; +SHARE +guest +192.168.1.1 + +Data +/export +Yes + + + +In the example above, the machine name is set to &example.server.samba;, the workgroup is set to the name +of the local workgroup (&example.workgroup;) so the machine will appear together with systems with +which users are familiar. The only password backend required is the guest backend to allow default +unprivileged account names to be used. As there is a WINS server on this network, we of obviously make use of it. + + + + + +Central Print Serving + + +Configuration of a simple print server is easy if you have all the right tools +on your system. + + + + Assumptions: + + The print server must require no administration. + + + + The print spooling and processing system on our print server will be CUPS. + (Please refer to CUPS Printing Support for more information). + + + + The print server will service only network printers. The network administrator + will correctly configure the CUPS environment to support the printers. + + + + All workstations will use only postscript drivers. The printer driver + of choice is the one shipped with the Windows OS for the Apple Color LaserWriter. + + + + +In this example our print server will spool all incoming print jobs to +/var/spool/samba until the job is ready to be submitted by +Samba to the CUPS print processor. Since all incoming connections will be as +the anonymous (guest) user, two things will be required: + + + +Enabling Anonymous Printing + + The UNIX/Linux system must have a guest account. + The default for this is usually the account nobody. + To find the correct name to use for your version of Samba, do the + following: + +&prompt;testparm -s -v | grep "guest account" + + Make sure that this account exists in your system password + database (/etc/passwd). + + + + The directory into which Samba will spool the file must have write + access for the guest account. The following commands will ensure that + this directory is available for use: + +&rootprompt;mkdir /var/spool/samba +&rootprompt;chown nobody.nobody /var/spool/samba +&rootprompt;chmod a+rwt /var/spool/samba + + + + + +The contents of the &smb.conf; file is shown in the next example. + + + + +&smb.conf; for Anonymous Printing + Global parameters + +&example.workgroup; +&example.server.samba; +SHARE +guest +cups +cups + + +All Printers +/var/spool/samba +root +Yes +Yes +Yes +No + + + + + +MIMEraw +raw printing +On CUPS-enabled systems there is a facility to pass raw data directly to the printer without +intermediate processing via CUPS print filters. Where use of this mode of operation is desired, +it is necessary to configure a raw printing device. It is also necessary to enable the raw mime +handler in the /etc/mime.conv and /etc/mime.types +files. Refer to Explicitly Enable raw Printing for +application/octet-stream. + + + + + + + +Common Errors + + +The greatest mistake so often made is to make a network configuration too complex. +It pays to use the simplest solution that will meet the needs of the moment. + + + + -- cgit