From f1c4fb5cf5e425e5a07348ed174f7ed4f5b315c9 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 2 Apr 2003 13:54:06 +0000
Subject: Update ntlm_auth and winbind manpages.

Andrew Bartlett
(This used to be commit 441d6952bdaff94e387a11f5f524359f3bbbeefb)
---
 docs/docbook/manpages/winbindd.8.sgml | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

(limited to 'docs/docbook/manpages/winbindd.8.sgml')

diff --git a/docs/docbook/manpages/winbindd.8.sgml b/docs/docbook/manpages/winbindd.8.sgml
index 0beddf0ea5..e0489c43c4 100644
--- a/docs/docbook/manpages/winbindd.8.sgml
+++ b/docs/docbook/manpages/winbindd.8.sgml
@@ -316,12 +316,6 @@ auth       required     /lib/security/pam_pwdb.so use_first_pass shadow nullok
 	winbindd</command> to become aware of new trust relationships between 
 	servers, it must be sent a SIGHUP signal. </para>
 
-	<para>Client processes resolving names through the <command>winbindd</command>
-	nsswitch module read an environment variable named <envar>
-	$WINBINDD_DOMAIN</envar>.  If this variable contains a comma separated
-	list of Windows NT domain names, then winbindd will only resolve users
-	and groups within those Windows NT domains. </para>
-
 	<para>PAM is really easy to misconfigure.  Make sure you know what 
 	you are doing when modifying PAM configuration files.  It is possible 
 	to set up PAM such that you can no longer log into your system. </para>
@@ -386,6 +380,21 @@ auth       required     /lib/security/pam_pwdb.so use_first_pass shadow nullok
 		root. </para></listitem>
 		</varlistentry>
 
+		<varlistentry>
+		<term>$LOCKDIR/winbindd_privilaged/pipe</term>
+	        <listitem><para>The UNIX pipe over which 'privilaged' clients 
+                communicate with the <command>winbindd</command> program.  For security 
+                reasons, access to some winbindd functions - like those needed by 
+                the <command>ntlm_auth</command> utility - is restricted.  By default,
+                only users in the 'root' group will get this access, however the administrator
+                may change the group permissions on $LOCKDIR/winbindd_privilaged to allow
+                programs like 'squid' to use ntlm_auth.
+		Note that the winbind client will only attempt to connect to the winbindd daemon 
+		if both the <filename>$LOCKDIR/winbindd_privilaged</filename> directory
+		and <filename>$LOCKDIR/winbindd_privilaged/pipe</filename> file are owned by 
+		root. </para></listitem>
+		</varlistentry>
+
 		<varlistentry>
 		<term>/lib/libnss_winbind.so.X</term>
 		<listitem><para>Implementation of name service switch library.
-- 
cgit