From cc841dde2f26843c2b6ec788337b779ed1abf8ea Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Tue, 27 May 2003 16:46:06 +0000 Subject: A lot of syntax updates, consistency when using certain tags and converting ASCII -> XML (This used to be commit 85434d3144656e6fe587637276d6a2667df1857f) --- docs/docbook/projdoc/winbind.xml | 109 +++++++++++++++++++-------------------- 1 file changed, 54 insertions(+), 55 deletions(-) (limited to 'docs/docbook/projdoc/winbind.xml') diff --git a/docs/docbook/projdoc/winbind.xml b/docs/docbook/projdoc/winbind.xml index b588d162d1..f78f74f780 100644 --- a/docs/docbook/projdoc/winbind.xml +++ b/docs/docbook/projdoc/winbind.xml @@ -10,7 +10,6 @@ &author.tridge; - &author.jht; NaagMummaneni @@ -224,7 +223,9 @@ of that service should be tried and in what order. If the passwd config line is: - passwd: files example + +passwd: files example + then the C library will first load a module called /lib/libnss_files.so followed by @@ -429,17 +430,15 @@ install the development packages in pam-devel-0.74-22. Before starting, it is probably best to kill off all the SAMBA -related daemons running on your server. Kill off all smbd, -nmbd, and winbindd processes that may +related daemons running on your server. Kill off all &smbd;, +&nmbd;, and &winbindd; processes that may be running. To use PAM, you will want to make sure that you have the standard PAM package (for RedHat) which supplies the /etc/pam.d directory structure, including the pam modules are used by pam-aware services, several pam libraries, and the /usr/doc and /usr/man entries for pam. Winbind built better in SAMBA if the pam-devel package was also installed. This package includes -the header files needed to compile pam-aware applications. For instance, -my RedHat system has both pam-0.74-22 and -pam-devel-0.74-22 RPMs installed. +the header files needed to compile pam-aware applications. @@ -451,14 +450,14 @@ The first three steps may not be necessary depending upon whether or not you have previously built the Samba binaries. - -root# autoconf -root# make clean -root# rm config.cache -root# ./configure -root# make -root# make install - + +&rootprompt;autoconf +&rootprompt;make clean +&rootprompt;rm config.cache +&rootprompt;./configure +&rootprompt;make +&rootprompt;make install + @@ -474,12 +473,14 @@ It will also build the winbindd executable and libraries. winbind libraries on Linux and Solaris -The libraries needed to run the winbindd daemon +The libraries needed to run the &winbindd; daemon through nsswitch need to be copied to their proper locations, so -root# cp ../samba/source/nsswitch/libnss_winbind.so /lib + +&rootprompt;cp ../samba/source/nsswitch/libnss_winbind.so /lib + @@ -487,19 +488,19 @@ I also found it necessary to make the following symbolic link: -root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2 +&rootprompt; ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2 And, in the case of Sun solaris: - -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1 -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1 -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2 - + +&rootprompt;ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1 +&rootprompt;ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1 +&rootprompt;ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2 + Now, as root you need to edit /etc/nsswitch.conf to -allow user and group entries to be visible from the winbindd +allow user and group entries to be visible from the &winbindd; daemon. My /etc/nsswitch.conf file look like this after editing: @@ -518,7 +519,7 @@ is faster (and you don't need to reboot) if you do it manually: -root# /sbin/ldconfig -v | grep winbind +&rootprompt;/sbin/ldconfig -v | grep winbind @@ -567,11 +568,11 @@ url="http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixbman/baseadmn/ia Several parameters are needed in the smb.conf file to control -the behavior of winbindd. Configure -smb.conf These are described in more detail in +the behavior of &winbindd;. Configure +&smb.conf; These are described in more detail in the winbindd 8 man page. My -smb.conf file was modified to +&smb.conf; file was modified to include the following entries in the [global] section: @@ -607,7 +608,7 @@ a domain user who has administrative privileges in the domain. -root# /usr/local/samba/bin/net join -S PDC -U Administrator +&rootprompt;/usr/local/samba/bin/net join -S PDC -U Administrator @@ -632,7 +633,7 @@ command as root: -root# /usr/local/samba/bin/winbindd +&rootprompt;/usr/local/samba/bin/winbindd @@ -641,11 +642,11 @@ run as 2 processes. The first will answer all requests from the cache, thus making responses to clients faster. The other will update the cache for the query that the first has just responded. Advantage of this is that responses stay accurate and are faster. -You can enable dual daemon mode by adding '-B' to the commandline: +You can enable dual daemon mode by adding to the commandline: -root# /usr/local/samba/bin/winbindd -B +&rootprompt;/usr/local/samba/bin/winbindd -B @@ -654,14 +655,14 @@ is really running... -root# ps -ae | grep winbindd +&rootprompt;ps -ae | grep winbindd This command should produce output like this, if the daemon is running - + 3025 ? 00:00:00 winbindd - + Now... for the real test, try to get some information about the @@ -669,7 +670,7 @@ users on your PDC -root# /usr/local/samba/bin/wbinfo -u +&rootprompt;/usr/local/samba/bin/wbinfo -u @@ -677,14 +678,14 @@ This should echo back a list of users on your Windows users on your PDC. For example, I get the following response: - + CEO+Administrator CEO+burdell CEO+Guest CEO+jt-ad CEO+krbtgt CEO+TsInternetUser - + Obviously, I have named my domain 'CEO' and my winbind @@ -696,8 +697,8 @@ You can do the same sort of thing to get group information from the PDC: - -root# /usr/local/samba/bin/wbinfo -g + +&rootprompt;/usr/local/samba/bin/wbinfo -g CEO+Domain Admins CEO+Domain Users CEO+Domain Guests @@ -707,7 +708,7 @@ the PDC: CEO+Schema Admins CEO+Enterprise Admins CEO+Group Policy Creator Owners - + The function 'getent' can now be used to get unified @@ -716,7 +717,7 @@ Try the following command: -root# getent passwd +&rootprompt;getent passwd @@ -730,7 +731,7 @@ The same thing can be done for groups with the command -root# getent group +&rootprompt;getent group @@ -743,14 +744,13 @@ The same thing can be done for groups with the command Linux -The winbindd daemon needs to start up after the -smbd and nmbd daemons are running. +The &winbindd; daemon needs to start up after the +&smbd; and &nmbd; daemons are running. To accomplish this task, you need to modify the startup scripts of your system. They are located at /etc/init.d/smb in RedHat and /etc/init.d/samba in Debian. script to add commands to invoke this daemon in the proper sequence. My -startup script starts up smbd, -nmbd, and winbindd from the +startup script starts up &smbd;, &nmbd;, and &winbindd; from the /usr/local/samba/bin directory directly. The 'start' function in the script looks like this: @@ -899,8 +899,7 @@ in the script above with: Restarting -If you restart the smbd, nmbd, -and winbindd daemons at this point, you +If you restart the &smbd;, &nmbd;, and &winbindd; daemons at this point, you should be able to connect to the samba server as a domain member just as if you were a local user. @@ -925,7 +924,7 @@ by invoking the command -root# make nsswitch/pam_winbind.so +&rootprompt;make nsswitch/pam_winbind.so @@ -937,7 +936,7 @@ modules reside in /usr/lib/security. -root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security +&rootprompt;cp ../samba/source/nsswitch/pam_winbind.so /lib/security @@ -982,8 +981,8 @@ For ftp services to work properly, you will also need to either have individual directories for the domain users already present on the server, or change the home directory template to a general directory for all domain users. These can be easily set using -the smb.conf global entry -template homedir. +the &smb.conf; global entry +template homedir. @@ -1023,8 +1022,8 @@ same way. It now looks like this: -In this case, I added the auth sufficient /lib/security/pam_winbind.so -lines as before, but also added the required pam_securetty.so +In this case, I added the auth sufficient /lib/security/pam_winbind.so +lines as before, but also added the required pam_securetty.so above it, to disallow root logins over the network. I also added a sufficient /lib/security/pam_unix.so use_first_pass line after the winbind.so line to get rid of annoying -- cgit