From 4a090ba06a54f5da179ac02bb307cc03d08831bf Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 16 Jul 2003 05:34:56 +0000 Subject: trying to get HEAD building again. If you want the code prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE (This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad) --- docs/docbook/smbdotconf/filename/mangledstack.xml | 2 +- docs/docbook/smbdotconf/filename/mangleprefix.xml | 2 +- docs/docbook/smbdotconf/generate-context.xsl | 8 +--- docs/docbook/smbdotconf/generate-file-list.sh | 8 ++-- docs/docbook/smbdotconf/logging/debuglevel.xml | 2 +- docs/docbook/smbdotconf/printing/printcommand.xml | 2 +- .../smbdotconf/protocol/nameresolveorder.xml | 24 +++++++--- docs/docbook/smbdotconf/protocol/usespnego.xml | 2 +- docs/docbook/smbdotconf/security/authmethods.xml | 14 +++++- docs/docbook/smbdotconf/security/lanmanauth.xml | 16 +++++++ docs/docbook/smbdotconf/security/ntlmauth.xml | 12 +++-- docs/docbook/smbdotconf/security/passdbbackend.xml | 51 ++++++++-------------- .../docbook/smbdotconf/security/passwordserver.xml | 32 ++++++++------ .../smbdotconf/security/restrictanonymous.xml | 15 +++++-- docs/docbook/smbdotconf/security/security.xml | 28 +++++++++--- docs/docbook/smbdotconf/vfs/vfsobject.xml | 12 ++--- docs/docbook/smbdotconf/winbind/winbindgid.xml | 2 + docs/docbook/smbdotconf/winbind/winbinduid.xml | 11 ++--- .../smbdotconf/winbind/winbindusedefaultdomain.xml | 2 +- docs/docbook/smbdotconf/wins/winspartners.xml | 2 +- 20 files changed, 150 insertions(+), 97 deletions(-) (limited to 'docs/docbook/smbdotconf') diff --git a/docs/docbook/smbdotconf/filename/mangledstack.xml b/docs/docbook/smbdotconf/filename/mangledstack.xml index 42083d13a2..5f28e76dd9 100644 --- a/docs/docbook/smbdotconf/filename/mangledstack.xml +++ b/docs/docbook/smbdotconf/filename/mangledstack.xml @@ -1,4 +1,4 @@ - diff --git a/docs/docbook/smbdotconf/filename/mangleprefix.xml b/docs/docbook/smbdotconf/filename/mangleprefix.xml index 5476ed1f08..cbd41f973d 100644 --- a/docs/docbook/smbdotconf/filename/mangleprefix.xml +++ b/docs/docbook/smbdotconf/filename/mangleprefix.xml @@ -1,4 +1,4 @@ - diff --git a/docs/docbook/smbdotconf/generate-context.xsl b/docs/docbook/smbdotconf/generate-context.xsl index 13fb216700..4afba52a86 100644 --- a/docs/docbook/smbdotconf/generate-context.xsl +++ b/docs/docbook/smbdotconf/generate-context.xsl @@ -24,17 +24,11 @@ - - Processing samba:parameter ( - - ) - - - + diff --git a/docs/docbook/smbdotconf/generate-file-list.sh b/docs/docbook/smbdotconf/generate-file-list.sh index 3495f50c43..84c3d5d2fc 100755 --- a/docs/docbook/smbdotconf/generate-file-list.sh +++ b/docs/docbook/smbdotconf/generate-file-list.sh @@ -1,8 +1,8 @@ #!/bin/sh echo "" -find . -type f -name '*.xml' -mindepth 2 | sort -t/ -k3 | - while read ; do - echo "" - done +for I in `find . -type f -name '*.xml' -mindepth 2 | sort -t/ -k3 | xargs` +do + echo "" +done echo "" diff --git a/docs/docbook/smbdotconf/logging/debuglevel.xml b/docs/docbook/smbdotconf/logging/debuglevel.xml index 8bd4b4e0b5..622fbf21a2 100644 --- a/docs/docbook/smbdotconf/logging/debuglevel.xml +++ b/docs/docbook/smbdotconf/logging/debuglevel.xml @@ -1,4 +1,4 @@ - diff --git a/docs/docbook/smbdotconf/printing/printcommand.xml b/docs/docbook/smbdotconf/printing/printcommand.xml index 5444309053..4b9904f6a8 100644 --- a/docs/docbook/smbdotconf/printing/printcommand.xml +++ b/docs/docbook/smbdotconf/printing/printcommand.xml @@ -15,7 +15,7 @@ The print command is simply a text string. It will be used verbatim after macro substitutions have been made: - %s, %p - the path to the spool + %s, %f - the path to the spool file name %p - the appropriate printer diff --git a/docs/docbook/smbdotconf/protocol/nameresolveorder.xml b/docs/docbook/smbdotconf/protocol/nameresolveorder.xml index 897d04ad1c..4e88495489 100644 --- a/docs/docbook/smbdotconf/protocol/nameresolveorder.xml +++ b/docs/docbook/smbdotconf/protocol/nameresolveorder.xml @@ -5,7 +5,8 @@ This option is used by the programs in the Samba suite to determine what naming services to use and in what order - to resolve host names to IP addresses. The option takes a space + to resolve host names to IP addresses. Its main purpose to is to + control how netbios name resolution is performed. The option takes a space separated string of name resolution options. The options are: "lmhosts", "host", @@ -16,7 +17,8 @@ lmhosts : Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has - no name type attached to the NetBIOS name (see the lmhosts(5) for details) then + no name type attached to the NetBIOS name (see the lmhosts(5) for details) then any name type matches for lookup. @@ -26,9 +28,10 @@ , NIS, or DNS lookups. This method of name resolution is operating system depended for instance on IRIX or Solaris this may be controlled by the /etc/nsswitch.conf - file. Note that this method is only used if the NetBIOS name - type being queried is the 0x20 (server) name type, otherwise - it is ignored. + file. Note that this method is used only if the NetBIOS name + type being queried is the 0x20 (server) name type or 0x1c (domain controllers). + The latter case is only useful for active directory domains and results in a DNS + query for the SRV RR entry matching _ldap._tcp.domain. @@ -50,9 +53,18 @@ Default: name resolve order = lmhosts host wins bcast Example: name resolve order = lmhosts bcast host - + This will cause the local lmhosts file to be examined first, followed by a broadcast attempt, followed by a normal system hostname lookup. + + When Samba is functioning in ADS security mode (security = ads) + it is advised to use following settings for name resolve order: + + name resolve order = wins bcast + + DC lookups will still be done via DNS, but fallbacks to netbios names will + not inundate your DNS servers with needless querys for DOMAIN<0x1c> lookups. + diff --git a/docs/docbook/smbdotconf/protocol/usespnego.xml b/docs/docbook/smbdotconf/protocol/usespnego.xml index 88c9f1df7a..7dddbd3f74 100644 --- a/docs/docbook/smbdotconf/protocol/usespnego.xml +++ b/docs/docbook/smbdotconf/protocol/usespnego.xml @@ -5,7 +5,7 @@ This variable controls controls whether samba will try to use Simple and Protected NEGOciation (as specified by rfc2478) with - WindowsXP and Windows2000sp2 clients to agree upon an authentication mechanism. + WindowsXP and Windows2000 clients to agree upon an authentication mechanism. Unless further issues are discovered with our SPNEGO implementation, there is no reason this should ever be disabled. diff --git a/docs/docbook/smbdotconf/security/authmethods.xml b/docs/docbook/smbdotconf/security/authmethods.xml index 0b7965d55b..7c0f5a71e1 100644 --- a/docs/docbook/smbdotconf/security/authmethods.xml +++ b/docs/docbook/smbdotconf/security/authmethods.xml @@ -6,14 +6,24 @@ This option allows the administrator to chose what authentication methods smbd will use when authenticating a user. This option defaults to sensible values based on - security. + security. This should be considered + a developer option and used only in rare circumstances. In the majority (if not all) + of production servers, the default setting should be adequate. Each entry in the list attempts to authenticate the user in turn, until the user authenticates. In practice only one method will ever actually be able to complete the authentication. + Possible options include guest (anonymous access), + sam (lookups in local list of accounts based on netbios + name or domain name), winbind (relay authentication requests + for remote users through winbindd), ntdomain (pre-winbindd + method of authentication for remote domain users; deprecated in favour of winbind method), + trustdomain (authenticate trusted users by contacting the + remote DC directly from smbd; deprecated in favour of winbind method). + Default: auth methods = <empty string> - Example: auth methods = guest sam ntdomain + Example: auth methods = guest sam winbind diff --git a/docs/docbook/smbdotconf/security/lanmanauth.xml b/docs/docbook/smbdotconf/security/lanmanauth.xml index e293242472..0a8fdd3ef3 100644 --- a/docs/docbook/smbdotconf/security/lanmanauth.xml +++ b/docs/docbook/smbdotconf/security/lanmanauth.xml @@ -8,7 +8,23 @@ using the LANMAN password hash. If disabled, only clients which support NT password hashes (e.g. Windows NT/2000 clients, smbclient, etc... but not Windows 95/98 or the MS DOS network client) will be able to connect to the Samba host. + + The LANMAN encrypted response is easily broken, due to it's + case-insensitive nature, and the choice of algorithm. Servers + without Windows 95/98 or MS DOS clients are advised to disable + this option. + Unlike the encypt + passwords option, this parameter cannot alter client + behaviour, and the LANMAN response will still be sent over the + network. See the client lanman + auth to disable this for Samba's clients (such as smbclient) + + If this option, and ntlm + auth are both disabled, then only NTLMv2 logins will be + permited. Not all clients support NTLMv2, and most will require + special configuration to us it. + Default : lanman auth = yes diff --git a/docs/docbook/smbdotconf/security/ntlmauth.xml b/docs/docbook/smbdotconf/security/ntlmauth.xml index b0b3179ab7..96092152c9 100644 --- a/docs/docbook/smbdotconf/security/ntlmauth.xml +++ b/docs/docbook/smbdotconf/security/ntlmauth.xml @@ -4,11 +4,15 @@ xmlns:samba="http://samba.org/common"> This parameter determines whether or not smbd - 8 will attempt to authenticate users using the NTLM password hash. - If disabled, only the lanman password hashes will be used. + 8 will attempt to + authenticate users using the NTLM encrypted password response. + If disabled, either the lanman password hash or an NTLMv2 response + will need to be sent by the client. - Please note that at least this option or lanman auth should - be enabled in order to be able to log in. + If this option, and lanman + auth are both disabled, then only NTLMv2 logins will be + permited. Not all clients support NTLMv2, and most will require + special configuration to us it. Default : ntlm auth = yes diff --git a/docs/docbook/smbdotconf/security/passdbbackend.xml b/docs/docbook/smbdotconf/security/passdbbackend.xml index d755cfc313..1a3a83946a 100644 --- a/docs/docbook/smbdotconf/security/passdbbackend.xml +++ b/docs/docbook/smbdotconf/security/passdbbackend.xml @@ -23,15 +23,6 @@ - - smbpasswd_nua - The smbpasswd - backend, but with support for 'not unix accounts'. - Takes a path to the smbpasswd file as an optional argument. - - See also - non unix account range - - tdbsam - The TDB based password storage backend. Takes a path to the TDB as an optional argument (defaults to passdb.tdb @@ -39,33 +30,11 @@ private dir directory. - - tdbsam_nua - The TDB based password storage - backend, with non unix account support. Takes a path to the TDB as an optional argument (defaults to passdb.tdb - in the - private dir directory. - - See also - non unix account range - - ldapsam - The LDAP based passdb backend. Takes an LDAP URL as an optional argument (defaults to ldap://localhost) - - - ldapsam_nua - The LDAP based passdb - backend, with non unix account support. Takes an LDAP URL as an optional argument (defaults to - ldap://localhost) - - Note: In this module, any account without a matching POSIX account is regarded - as 'non unix'. - - See also - non unix account range - LDAP connections should be secured where possible. This may be done using either Start-TLS (see ldap ssl) or by specifying ldaps:// in @@ -79,15 +48,29 @@ + + mysql - + The MySQL based passdb backend. Takes an identifier as + argument. Read the Samba HOWTO Collection for configuration + details. + + + + guest - + Very simple backend that only provides one user: the guest user. + Only maps the NT guest user to the guest account. + Required in pretty much all situations. + + - Default: passdb backend = smbpasswd unixsam + Default: passdb backend = smbpasswd Example: passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd guest - Example: passdb backend = ldapsam_nua:ldaps://ldap.example.com guest + Example: passdb backend = ldapsam:ldaps://ldap.example.com guest - Example: passdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb + Example: passdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb guest diff --git a/docs/docbook/smbdotconf/security/passwordserver.xml b/docs/docbook/smbdotconf/security/passwordserver.xml index e40ff32b75..f854027041 100644 --- a/docs/docbook/smbdotconf/security/passwordserver.xml +++ b/docs/docbook/smbdotconf/security/passwordserver.xml @@ -3,18 +3,22 @@ advanced="1" wizard="1" developer="1" xmlns:samba="http://samba.org/common"> - By specifying the name of another SMB server (such - as a WinNT box) with this option, and using security = domain - or security = server you can get Samba - to do all its username/password validation via a remote server. + By specifying the name of another SMB server + or Active Directory domain controller with this option, + and using security = [ads|domain|server] + it is possible to get Samba to + to do all its username/password validation using a specific remote server. - This option sets the name of the password server to use. - It must be a NetBIOS name, so if the machine's NetBIOS name is - different from its Internet name then you may have to add its NetBIOS - name to the lmhosts file which is stored in the same directory - as the smb.conf file. + This option sets the name or IP address of the password server to use. + New syntax has been added to support defining the port to use when connecting + to the server the case of an ADS realm. To define a port other than the + default LDAP port of 389, add the port number using a colon after the + name or IP address (e.g. 192.168.1.100:389). If you do not specify a port, + Samba will use the standard LDAP port of tcp/389. Note that port numbers + have no effect on password servers for Windows NT 4.0 domains or netbios + connections. - The name of the password server is looked up using the + If parameter is a name, it is looked up using the parameter name resolve order and so may resolved by any method and order described in that parameter. @@ -38,14 +42,14 @@ trust your clients, and you had better restrict them with hosts allow! If the security parameter is set to - domain, then the list of machines in this + domain or ads, then the list of machines in this option must be a list of Primary or Backup Domain controllers for the Domain or the character '*', as the Samba server is effectively in that domain, and will use cryptographically authenticated RPC calls to authenticate the user logging on. The advantage of using security = domain is that if you list several hosts in the password server option then smbd - will try each in turn till it finds one that responds. This + will try each in turn till it finds one that responds. This is useful in case your primary server goes down. If the password server option is set @@ -55,7 +59,7 @@ and then contacting each server returned in the list of IP addresses from the name resolution source. - If the list of servers contains both names and the '*' + If the list of servers contains both names/IP's and the '*' character, the list is treated as a list of preferred domain controllers, but an auto lookup of all remaining DC's will be added to the list as well. Samba will not attempt to optimize @@ -93,6 +97,8 @@ Example: password server = NT-PDC, NT-BDC1, NT-BDC2, * + Example: password server = windc.mydomain.com:389 192.168.1.101 * + Example: password server = * diff --git a/docs/docbook/smbdotconf/security/restrictanonymous.xml b/docs/docbook/smbdotconf/security/restrictanonymous.xml index 803bc06b2b..25d2ba0df6 100644 --- a/docs/docbook/smbdotconf/security/restrictanonymous.xml +++ b/docs/docbook/smbdotconf/security/restrictanonymous.xml @@ -14,12 +14,21 @@ Windows 2000/XP and Samba, no anonymous connections are allowed at all. This can break third party and Microsoft applications which expect to be allowed to perform - operations anonymously. + operations anonymously. + The security advantage of using restrict anonymous = 1 is dubious, as user and group list information can be obtained using other - means. - + means. + + + + + The security advantage of using restrict anonymous = 2 is removed + by setting guest + ok = yes on any share. + + Default: restrict anonymous = 0 diff --git a/docs/docbook/smbdotconf/security/security.xml b/docs/docbook/smbdotconf/security/security.xml index 68c5f2cdd2..030abc1de1 100644 --- a/docs/docbook/smbdotconf/security/security.xml +++ b/docs/docbook/smbdotconf/security/security.xml @@ -212,10 +212,9 @@ does not support them. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid smbpasswd file to check - users against. See the documentation file in the docs/ directory - ENCRYPTION.txt for details on how to set this up. + users against. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up. - Note this mode of operation has + This mode of operation has significant pitfalls, due to the fact that is activly initiates a man-in-the-middle attack on the remote SMB server. In particular, this mode of operation can cause significant resource consuption on @@ -223,13 +222,13 @@ of the user's session. Furthermore, if this connection is lost, there is no way to reestablish it, and futher authenticaions to the Samba server may fail. (From a single client, till it disconnects). - + - Note that from the client's point of + From the client's point of view security = server is the same as security = user. It only affects how the server deals with the authentication, it does - not in any way affect what the client sees. + not in any way affect what the client sees. Note that the name of the resource being requested is not sent to the server until after @@ -246,6 +245,23 @@ See also the password server parameter and the encrypted passwords parameter. + + SECURITY = ADS + + In this mode, Samba will act as a domain member in an ADS realm. To operate + in this mode, the machine running Samba will need to have Kerberos installed + and configured and Samba will need to be joined to the ADS realm using the + net utility. + + Note that this mode does NOT make Samba operate as a Active Directory Domain + Controller. + + Read the chapter about Domain Membership in the HOWTO for details. + + See also the ads server + parameter, the realm + paramter and the + encrypted passwords parameter. Default: security = USER Example: security = DOMAIN diff --git a/docs/docbook/smbdotconf/vfs/vfsobject.xml b/docs/docbook/smbdotconf/vfs/vfsobject.xml index c68e8d0135..1a45e36c40 100644 --- a/docs/docbook/smbdotconf/vfs/vfsobject.xml +++ b/docs/docbook/smbdotconf/vfs/vfsobject.xml @@ -1,12 +1,12 @@ - This parameter specifies a shared object files that - are used for Samba VFS I/O operations. By default, normal - disk I/O operations are used but these can be overloaded - with one or more VFS objects. - - Default: no value + Synonym for + + vfs objects + . + diff --git a/docs/docbook/smbdotconf/winbind/winbindgid.xml b/docs/docbook/smbdotconf/winbind/winbindgid.xml index a8414e9e8c..e00e576389 100644 --- a/docs/docbook/smbdotconf/winbind/winbindgid.xml +++ b/docs/docbook/smbdotconf/winbind/winbindgid.xml @@ -3,6 +3,8 @@ advanced="1" developer="1" hide="1" xmlns:samba="http://samba.org/common"> + This parameter is now an alias for idmap gid + The winbind gid parameter specifies the range of group ids that are allocated by the winbindd 8 daemon. This range of group ids should have no diff --git a/docs/docbook/smbdotconf/winbind/winbinduid.xml b/docs/docbook/smbdotconf/winbind/winbinduid.xml index 6fee40fcb8..0f61bac13c 100644 --- a/docs/docbook/smbdotconf/winbind/winbinduid.xml +++ b/docs/docbook/smbdotconf/winbind/winbinduid.xml @@ -3,11 +3,12 @@ advanced="1" developer="1" hide="1" xmlns:samba="http://samba.org/common"> - The winbind gid parameter specifies the range of group - ids that are allocated by the winbindd - 8 daemon. This range of ids should have no - existing local or NIS users within it as strange conflicts can - occur otherwise. + This parameter is now an alias for idmap uid + + The winbind gid parameter specifies the range of user ids that are allocated by the + winbindd 8 + daemon. This range of ids should have no existing local or NIS users within it as strange + conflicts can occur otherwise. Default: winbind uid = <empty string> diff --git a/docs/docbook/smbdotconf/winbind/winbindusedefaultdomain.xml b/docs/docbook/smbdotconf/winbind/winbindusedefaultdomain.xml index 5c31a7f9b0..8112331f5e 100644 --- a/docs/docbook/smbdotconf/winbind/winbindusedefaultdomain.xml +++ b/docs/docbook/smbdotconf/winbind/winbindusedefaultdomain.xml @@ -1,4 +1,4 @@ - diff --git a/docs/docbook/smbdotconf/wins/winspartners.xml b/docs/docbook/smbdotconf/wins/winspartners.xml index 9ec277ed2d..13e252b2c0 100644 --- a/docs/docbook/smbdotconf/wins/winspartners.xml +++ b/docs/docbook/smbdotconf/wins/winspartners.xml @@ -1,4 +1,4 @@ - -- cgit