SAMBA Project Documentation

Try listing the shares available on your - server

Example Configuration
SWAT

Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client

3. FastStart for the Impatient

Why are so many smbd processes eating memory?
I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Note

II. Server Configuration Basics

4. Server Types and Security Modes

Seamless Windows Network Integration

Server Types

Samba Security Modes

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

5. Domain Control

Basics of Domain Control

Domain Controller Types
Preparing for Domain Control

Domain Control - Example Configuration

Samba ADS Domain Control

Domain and Network Logon Configuration

Domain Network Logon Service
Security Mode and Master Browsers

Common Problems and Errors

I cannot include a '$' in a machine name
I get told "You already have a connection to the Domain...." +

Table of Contents

I. General Installation

1. Introduction to Samba

Background
Terminology
Related Projects
SMB Methodology
Epilogue
Miscellaneous

2. How to Install and Test SAMBA

Try listing the shares available on your + server

Example Configuration
SWAT

Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client

3. Fast Start for the Impatient

Why are so many smbd processes eating memory?
I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Note

II. Server Configuration Basics

4. Server Types and Security Modes

Seamless Windows Network Integration

Server Types

Samba Security Modes

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

5. Domain Control

Basics of Domain Control

Domain Controller Types
Preparing for Domain Control

Domain Control - Example Configuration

Samba ADS Domain Control

Domain and Network Logon Configuration

Domain Network Logon Service
Security Mode and Master Browsers

Common Problems and Errors

I cannot include a '$' in a machine name
I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
The system can not log you on (C000019B)....
The machine trust account for this computer either does not -exist or is not accessible.
When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

6. Backup Domain Control

Features And Benefits

Essential Background Information

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Backup Domain Controller Configuration

Example Configuration

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

7. Domain Membership

MS Windows Workstation/Server Machine Trust Accounts

Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member

Domain Member Server

Joining an NT4 type Domain with Samba-3
Why is this better than security = server?

Samba ADS Domain Membership

Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes

Can Not Add Machine Back to Domain
Adding Machine to Domain Fails

8. Stand-Alone Servers

Example Configuration

Background

Reference Documentation Server
Central Print Serving

9. MS Windows Network Configuration Guide

Note

III. Advanced Configuration

10. Samba / MS Windows Network Browsing Guide

What is Browsing?

How Browsing Functions

NetBIOS over TCP/IP
TCP/IP - without NetBIOS
DNS and Active Directory

Setting up WORKGROUP Browsing
Setting up DOMAIN Browsing
Forcing samba to be the master
Making samba the domain master
Note about broadcast addresses
Multiple interfaces
Use of the Remote Announce parameter
Use of the Remote Browse Sync parameter

WINS - The Windows Internetworking Name Server

Setting up a WINS server
WINS Replication
Static WINS Entries

Helpful Hints

Windows Networking Protocols
Name Resolution Order

Technical Overview of browsing

Browsing support in samba
Problem resolution
Browsing across subnets

How can one flush the Samba NetBIOS name cache without restarting samba?
My client reports "This server is not configured to list shared resources"

11. Account Information Databases

Technical Information

Important Notes About Security
Mapping User Identifiers between MS Windows and Unix

Account Management Tools

The smbpasswd Command
The pdbedit Command

Password Backends

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon - Users not in Samba SAM
Users are being added to the wrong backend database
auth methods does not work

12. Mapping MS Windows and Unix Groups

Configuration Scripts

Example Configuration

Sample smb.conf add group script
Script to configure Group Mapping

13. File, Directory and Share Access Controls

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails

File System Access Controls

MS Windows NTFS Comparison with Unix File Systems
Managing Directories
File and Directory Access Control

Share Definition Access Controls

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

Access Controls on Shares

Share Permissions Management

MS Windows Access Control Lists and Unix Interoperability

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask - parameters
Interaction with the standard Samba file attribute - mapping

Users can not write to a public share
I have set force user and samba still makes root the owner of all the files - I touch!

14. File and Record Locking

Samba Opportunistic Locking Control

Opportunistic Locking Overview

Example Configuration

MS Windows Opportunistic Locking and Caching Controls

Workstation Service Entries
Server Service Entries

Persistent Data Corruption

locking.tdb error messages

Additional Reading

15. Securing Samba

Technical Discussion of Protective Measures and Issues

Using host based protection
User based protection
Using interface protection
Using a firewall
Using a IPC$ share deny
NTLMv2 Security

Upgrading Samba

Smbclient works on localhost, but the network is dead
Why can users access home directories of other users?

16. Interdomain Trust Relationships

Trust Relationship Background

Native MS Windows NT4 Trusts Configuration

NT4 as the Trusting Domain (ie. creating the trusted account)
NT4 as the Trusted Domain (ie. creating trusted account's password)

Configuring Samba NT-style Domain Trusts

Samba-3 as the Trusting Domain
Samba-3 as the Trusted Domain

17. Hosting a Microsoft Distributed File System tree on Samba

Tell me about Trust Relationships using Samba

Features and Benefits
Common Errors

18. Classical Printing Support

Technical Introduction

What happens if you send a Job from a Client
Printing Related Configuration Parameters
Parameters Recommended for Use
Parameters for Backwards Compatibility
Parameters no longer in use

A simple Configuration to Print with Samba-3

Verification of "Settings in Use" with testparm
A little Experiment to warn you

Extended Sample Configuration to Print with Samba-3

Detailed Explanation of the Example's Settings

The [global] Section
The [printers] Section
Any [my_printer_name] Section
Print Commands
Default Print Commands for various Unix Print Subsystems
Setting up your own Print Commands

Innovations in Samba Printing since 2.2

Client Drivers on Samba Server for Point'n'Print
The [printer$] Section is removed from Samba-3
Creating the [print$] Share
Parameters in the [print$] Section
Subdirectory Structure in [print$]

Installing Drivers into [print$]

Setting Drivers for existing Printers with a Client GUI
Setting Drivers for existing Printers with -rpcclient

"The Proof of the Pudding lies in the Eating" (Client Driver Insta -Procedure)

The first Client Driver Installation
IMPORTANT! Setting Device Modes on new Printers
Further Client Driver Install Procedures
Always make first Client Connection as root or "printer admin"

Other Gotchas

Setting Default Print Options for the Client Drivers
Supporting large Numbers of Printers
Adding new Printers with the Windows NT APW
Weird Error Message Cannot connect under a -different Name
Be careful when assembling Driver Files
Samba and Printer Ports
Avoiding the most common Misconfigurations of the Client Driver

The Imprints Toolset

What is Imprints?
Creating Printer Driver Packages
The Imprints Server
The Installation Client

Add Network Printers at Logon without User Interaction

The addprinter command

Migration of "Classical" printing to Samba-3

Publishing Printer Information in Active Directory or LDAP

Common Errors and Problems

I give my root password but I don't get access
My printjobs get spooled into the spooling directory, but then get lost

19. CUPS Printing Support in Samba 3.0

Basic Configuration of CUPS support

Features and Benefits
Overview

Linking of smbd with libcups.so
Simple smb.conf Settings for CUPS
More complex smb.conf Settings for -CUPS

Advanced Configuration

Central spooling vs. "Peer-to-Peer" printing
CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
Driver Installation Methods on Windows Clients
Explicitly enable "raw" printing for -application/octet-stream!
Three familiar Methods for driver upload plus a new one

Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download

GDI on Windows -- PostScript on Unix
Windows Drivers, GDI and EMF
Unix Printfile Conversion and GUI Basics
PostScript and Ghostscript
Ghostscript -- the Software RIP for non-PostScript Printers
PostScript Printer Description (PPD) Specification
CUPS can use all Windows-formatted Vendor PPDs
CUPS also uses PPDs for non-PostScript Printers

The CUPS Filtering Architecture

MIME types and CUPS Filters
MIME type Conversion Rules
Filter Requirements
Prefilters
pstops
pstoraster
imagetops and imagetoraster
rasterto [printerspecific]
CUPS Backends
cupsomatic/Foomatic -- how do they fit into the Picture?
The Complete Picture
mime.convs
"Raw" printing
"application/octet-stream" printing
PostScript Printer Descriptions (PPDs) for non-PS Printers
Difference between cupsomatic/foomatic-rip and -native CUPS printing
Examples for filtering Chains
Sources of CUPS drivers / PPDs
Printing with Interface Scripts

Network printing (purely Windows)

From Windows Clients to an NT Print Server
Driver Execution on the Client
Driver Execution on the Server

Network Printing (Windows clients -- UNIX/Samba Print -Servers)

From Windows Clients to a CUPS/Samba Print Server
Samba receiving Jobfiles and passing them to CUPS

Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs

PPDs for non-PS Printers on UNIX
PPDs for non-PS Printers on Windows

Windows Terminal Servers (WTS) as CUPS Clients

Printer Drivers running in "Kernel Mode" cause many -Problems
Workarounds impose Heavy Limitations
CUPS: a "Magical Stone"?
PostScript Drivers with no major problems -- even in Kernel -Mode

Setting up CUPS for driver Download

cupsaddsmb: the unknown Utility
Prepare your smb.conf for -cupsaddsmb
CUPS Package of "PostScript Driver for WinNT/2k/XP"
Recognize the different Driver Files
Acquiring the Adobe Driver Files
ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
Caveats to be considered
What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
Run "cupsaddsmb" (quiet Mode)
Run "cupsaddsmb" with verbose Output
Understanding cupsaddsmb
How to recognize if cupsaddsm completed successfully
cupsaddsmb with a Samba PDC
cupsaddsmb Flowchart
Installing the PostScript Driver on a Client
Avoiding critical PostScript Driver Settings on the -Client

Installing PostScript Driver Files manually (using -rpcclient)

A Check of the rpcclient man Page
Understanding the rpcclient man Page
Producing an Example by querying a Windows Box
What is required for adddriver and setdriver to succeed
Manual Commandline Driver Installation in 15 little Steps
Troubleshooting revisited

The printing *.tdb Files

Trivial DataBase Files
Binary Format
Losing *.tdb Files
Using tdbbackup

CUPS Print Drivers from Linuxprinting.org

foomatic-rip and Foomatic explained
foomatic-rip and Foomatic-PPD Download and Installation

Page Accounting with CUPS

Setting up Quotas
Correct and incorrect Accounting
Adobe and CUPS PostScript Drivers for Windows Clients
The page_log File Syntax
Possible Shortcomings
Future Developments
Other Accounting Tools

Additional Material

Auto-Deletion or Preservation of CUPS Spool Files

CUPS Configuration Settings explained
Pre-conditions
Manual Configuration

When not to use Samba to print to -CUPS

In Case of Trouble.....

Where to find Documentation
How to ask for Help
Where to find Help

Appendix

Printing from CUPS to Windows attached -Printers
More CUPS filtering Chains
Trouble Shooting Guidelines to fix typical Samba printing -Problems
An Overview of the CUPS Printing Processes

20. Stackable VFS modules

VFS modules available elsewhere

Included modules

audit
extd_audit
fake_perms
recycle
netatalk

DatabaseFS
vscan

21. Integrated Logon Support using Winbind

What Winbind Provides

Target Uses

How Winbind Works

Microsoft Remote Procedure Calls
Microsoft Active Directory Services
Name Service Switch
Pluggable Authentication Modules
User and Group ID Allocation
Result Caching

Installation and Configuration

Introduction
Requirements
Testing Things Out

Conclusion

22. Advanced Network Manangement

Remote Server Administration

Remote Desktop Management

Remote Management from NoMachines.Com

Network Logon Script Magic

Adding printers without user intervention

23. System and Account Policies

Creating and Managing System Policies

Windows 9x/Me Policies
Windows NT4 Style Policy Files
MS Windows 200x / XP Professional Policies

Managing Account/User Policies

Samba Editreg Toolset
Windows NT4/200x
Samba PDC

System Startup and Logon Processing Overview

Policy Does Not Work

24. Desktop Profile Management

Creating/Managing Group Profiles

Roaming Profiles

Samba Configuration for Profile Handling
Windows Client Profile Configuration Information
Sharing Profiles between W9x/Me and NT4/200x/XP workstations
Profile Migration from Windows NT4/200x Server to Samba

Mandatory profiles

Default Profile for Windows Users

MS Windows 9x/Me
MS Windows NT4 Workstation
MS Windows 200x/XP

25. PAM based Distributed Authentication

How does one set up roaming profiles for just one (or a few) user/s or group/s?
Can NOT use Roaming Profiles
Changing the default profile

Technical Discussion

PAM Configuration Syntax
Example System Configurations
smb.conf PAM Configuration
Remote CIFS Authentication using winbindd.so
Password Synchronization using pam_smbpass.so

26. Integrating MS Windows networks with Samba

pam_winbind problem

Background Information

Name Resolution in a pure Unix/Linux world

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

Name resolution as used within MS Windows networking

The NetBIOS Name Cache
The LMHOSTS file
HOSTS file
DNS Lookup
WINS Lookup

30. Upgrading from Samba-2.x to Samba-3.0.0

My Boomerang Won't Come Back
Very Slow Network Connections
Samba server name change problem

27. Unicode/Charsets

Features and Benefits
What are charsets and unicode?
Samba and charsets
Conversion from old names
Japanese charsets

28. Samba Backup Techniques

Note
Features and Benefits

29. High Availability Options

Note

IV. Migration and Updating

Charsets
Obsolete configuration options
Password Backend

31. Migration from NT4 PDC to Samba-3 PDC

Planning and Getting Started

Objectives
Steps In Migration Process

Migration Options

Planning for Success
Samba Implementation Choices

32. SWAT - The Samba Web Administration Tool

34. Analysing and solving samba problems

Enabling SWAT for use
Securing SWAT through SSL
The SWAT Home Page
Global Settings
Share Settings
Printers Settings
The SWAT Wizard
The Status Page
The View Page
The Password Change Page

V. Troubleshooting

33. The samba checklist

Introduction
Assumptions
The tests
Still having troubles?

Diagnostics tools
Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
Useful URL's
Getting help from the mailing lists
How to get off the mailinglists

35. Reporting Bugs

Introduction
General info
Debug levels
Internal errors
Attaching to a running process
Patches

VI. Appendixes

36. How to compile SAMBA

Access Samba source code via CVS

Introduction
CVS Access to samba.org

Accessing the samba sources via rsync and ftp

Verifying Samba's PGP signature

Building the Binaries

Compiling samba with Active Directory support

Starting the smbd and nmbd

Starting from inetd.conf
Alternative: starting it as a daemon

37. Portability

RedHat Linux Rembrandt-II

AIX

Sequential Read Ahead

Solaris

Locking improvements
Winbind on Solaris 9

38. Samba and other CIFS clients

Macintosh clients?

OS2 Client

How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
How do I get printer driver download working - for OS/2 clients?

Windows for Workgroups

Use latest TCP/IP stack from Microsoft
Delete .pwl files after password change
Configure WfW password handling
Case handling of passwords
Use TCP/IP as default protocol
Speed improvement

Windows '95/'98

Speed improvement

Windows 2000 Service Pack 2

Windows NT 3.1

39. Samba Performance Tuning

Comparisons
Socket options
Read size
Max xmit
Log level
Read raw
Write raw
Slow Logins
LDAP
Client tuning
Samba performance problem due changing kernel
Corrupt tdb Files

40. DNS and DHCP Configuration Guide

Note

41. Further Resources

Websites
Related updates from microsoft
Books

Index

List of Figures

19.1. Windows Printing to a local Printer
19.2. Printing to a Postscript Printer
19.3. Ghostscript as a RIP for non-postscript printers
19.4. Prefiltering in CUPS to form Postscript
19.5. Adding Device-specific Print Options
19.6. Postscript to intermediate Raster format
19.7. CUPS-raster production using Ghostscript
19.8. Image format to CUPS-raster format conversion
19.9. Raster to Printer Specific formats
19.10. cupsomatic/foomatic processing versus Native CUPS
19.11. Print Driver execution on the Client
19.12. Print Driver execution on the Server
19.13. Printing via CUPS/samba server
19.14. cupsaddsmb flowchart
19.15. CUPS Printing Overview

List of Tables

7.1. Assumptions
10.1. Browse subnet example 1
10.2. Browse subnet example 2
10.3. Browse subnet example 3
10.4. Browse subnet example 4
11.1. Attributes in the sambaAccount objectclass (LDAP)
11.2. Basic smb.conf options for MySQL passdb backend
11.3. MySQL field names for MySQL passdb backend
13.1. Managing directories with unix and windows
13.2. User and Group Based Controls
13.3. File and Directory Permission Based Controls
13.4. Other Controls
20.1. Extended Auditing Log Information
24.1. User Shell Folder registry keys default values
24.2. Defaults of profile settings registry keys
24.3. Defaults of default user profile paths registry keys
25.1. Options recognized by pam_smbpass
31.1. The 3 Major Site Types
31.2. Nature of the Conversion Choices

List of Examples

12.1. smbgrpadd.sh
13.1. Example File

General Installation

Preparing Samba for Configuration

This section of the Samba-HOWTO-Collection contains general info on how to install samba +existing set.." when creating a machine trust account.

The system can not log you on (C000019B)....

The machine trust account for this computer either does not +exist or is not accessible.

When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.

Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

6. Backup Domain Control

Features And Benefits

Essential Background Information

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Backup Domain Controller Configuration

Example Configuration

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

7. Domain Membership

MS Windows Workstation/Server Machine Trust Accounts

Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member

Domain Member Server

Joining an NT4 type Domain with Samba-3
Why is this better than security = server?

Samba ADS Domain Membership

Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes

Can Not Add Machine Back to Domain
Adding Machine to Domain Fails

8. Stand-Alone Servers

Example Configuration

Background

Reference Documentation Server
Central Print Serving

9. MS Windows Network Configuration Guide

Note

III. Advanced Configuration

10. Samba / MS Windows Network Browsing Guide

What is Browsing?

How Browsing Functions

NetBIOS over TCP/IP
TCP/IP - without NetBIOS
DNS and Active Directory

Setting up WORKGROUP Browsing
Setting up DOMAIN Browsing
Forcing Samba to be the master
Making Samba the domain master
Note about broadcast addresses
Multiple interfaces
Use of the Remote Announce parameter
Use of the Remote Browse Sync parameter

WINS - The Windows Internetworking Name Server

Setting up a WINS server
WINS Replication
Static WINS Entries

Helpful Hints

Windows Networking Protocols
Name Resolution Order

Technical Overview of browsing

Browsing support in Samba
Problem resolution
Browsing across subnets

How can one flush the Samba NetBIOS name cache without restarting Samba?
My client reports "This server is not configured to list shared resources"

11. Account Information Databases

Technical Information

Important Notes About Security
Mapping User Identifiers between MS Windows and Unix

Account Management Tools

The smbpasswd Command
The pdbedit Command

Password Backends

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon - Users not in Samba SAM
Users are being added to the wrong backend database
auth methods does not work

12. Mapping MS Windows and Unix Groups

Configuration Scripts

Example Configuration

Sample smb.conf add group script
Script to configure Group Mapping

13. File, Directory and Share Access Controls

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails

File System Access Controls

MS Windows NTFS Comparison with Unix File Systems
Managing Directories
File and Directory Access Control

Share Definition Access Controls

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

Access Controls on Shares

Share Permissions Management

MS Windows Access Control Lists and Unix Interoperability

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask + parameters
Interaction with the standard Samba file attribute + mapping

Users can not write to a public share
I have set force user and Samba still makes root the owner of all the files + I touch!

14. File and Record Locking

Samba Opportunistic Locking Control

Opportunistic Locking Overview

Example Configuration

MS Windows Opportunistic Locking and Caching Controls

Workstation Service Entries
Server Service Entries

Persistent Data Corruption

locking.tdb error messages

Additional Reading

15. Securing Samba

Technical Discussion of Protective Measures and Issues

Using host based protection
User based protection
Using interface protection
Using a firewall
Using a IPC$ share deny
NTLMv2 Security

Upgrading Samba

Smbclient works on localhost, but the network is dead
Why can users access home directories of other users?

16. Interdomain Trust Relationships

Trust Relationship Background

Native MS Windows NT4 Trusts Configuration

NT4 as the Trusting Domain (ie. creating the trusted account)
NT4 as the Trusted Domain (ie. creating trusted account's password)

Configuring Samba NT-style Domain Trusts

Samba-3 as the Trusting Domain
Samba-3 as the Trusted Domain

17. Hosting a Microsoft Distributed File System tree on Samba

Tell me about Trust Relationships using Samba

Features and Benefits
Common Errors

18. Classical Printing Support

Technical Introduction

What happens if you send a Job from a Client
Printing Related Configuration Parameters
Parameters Recommended for Use
Parameters for Backwards Compatibility
Parameters no longer in use

A simple Configuration to Print with Samba-3

Verification of "Settings in Use" with testparm
A little Experiment to warn you

Extended Sample Configuration to Print with Samba-3

Detailed Explanation of the Example's Settings

The [global] Section
The [printers] Section
Any [my_printer_name] Section
Print Commands
Default Print Commands for various Unix Print Subsystems
Setting up your own Print Commands

Innovations in Samba Printing since 2.2

Client Drivers on Samba Server for Point'n'Print
The [printer$] Section is removed from Samba-3
Creating the [print$] Share
Parameters in the [print$] Section
Subdirectory Structure in [print$]

Installing Drivers into [print$]

Setting Drivers for existing Printers with a Client GUI
Setting Drivers for existing Printers with +rpcclient

"The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure)

The first Client Driver Installation
IMPORTANT! Setting Device Modes on new Printers
Further Client Driver Install Procedures
Always make first Client Connection as root or "printer admin"

Other Gotchas

Setting Default Print Options for the Client Drivers
Supporting large Numbers of Printers
Adding new Printers with the Windows NT APW
Weird Error Message Cannot connect under a +different Name
Be careful when assembling Driver Files
Samba and Printer Ports
Avoiding the most common Misconfigurations of the Client Driver

The Imprints Toolset

What is Imprints?
Creating Printer Driver Packages
The Imprints Server
The Installation Client

Add Network Printers at Logon without User Interaction

The addprinter command

Migration of "Classical" printing to Samba-3

Publishing Printer Information in Active Directory or LDAP

Common Errors and Problems

I give my root password but I don't get access
My printjobs get spooled into the spooling directory, but then get lost

19. CUPS Printing Support in Samba 3.0

Basic Configuration of CUPS support

Features and Benefits
Overview

Linking of smbd with libcups.so
Simple smb.conf Settings for CUPS
More complex smb.conf Settings for +CUPS

Advanced Configuration

Central spooling vs. "Peer-to-Peer" printing
CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
Driver Installation Methods on Windows Clients
Explicitly enable "raw" printing for +application/octet-stream!
Three familiar Methods for driver upload plus a new one

Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download

GDI on Windows -- PostScript on Unix
Windows Drivers, GDI and EMF
Unix Printfile Conversion and GUI Basics
PostScript and Ghostscript
Ghostscript -- the Software RIP for non-PostScript Printers
PostScript Printer Description (PPD) Specification
CUPS can use all Windows-formatted Vendor PPDs
CUPS also uses PPDs for non-PostScript Printers

The CUPS Filtering Architecture

MIME types and CUPS Filters
MIME type Conversion Rules
Filter Requirements
Prefilters
pstops
pstoraster
imagetops and imagetoraster
rasterto [printers specific]
CUPS Backends
cupsomatic/Foomatic -- how do they fit into the Picture?
The Complete Picture
mime.convs
"Raw" printing
"application/octet-stream" printing
PostScript Printer Descriptions (PPDs) for non-PS Printers
Difference between cupsomatic/foomatic-rip and +native CUPS printing
Examples for filtering Chains
Sources of CUPS drivers / PPDs
Printing with Interface Scripts

Network printing (purely Windows)

From Windows Clients to an NT Print Server
Driver Execution on the Client
Driver Execution on the Server

Network Printing (Windows clients -- UNIX/Samba Print +Servers)

From Windows Clients to a CUPS/Samba Print Server
Samba receiving Jobfiles and passing them to CUPS

Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs

PPDs for non-PS Printers on UNIX
PPDs for non-PS Printers on Windows

Windows Terminal Servers (WTS) as CUPS Clients

Printer Drivers running in "Kernel Mode" cause many +Problems
Workarounds impose Heavy Limitations
CUPS: a "Magical Stone"?
PostScript Drivers with no major problems -- even in Kernel +Mode

Setting up CUPS for driver Download

cupsaddsmb: the unknown Utility
Prepare your smb.conf for +cupsaddsmb
CUPS Package of "PostScript Driver for WinNT/2k/XP"
Recognize the different Driver Files
Acquiring the Adobe Driver Files
ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
Caveats to be considered
What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?
Run "cupsaddsmb" (quiet Mode)
Run "cupsaddsmb" with verbose Output
Understanding cupsaddsmb
How to recognize if cupsaddsm completed successfully
cupsaddsmb with a Samba PDC
cupsaddsmb Flowchart
Installing the PostScript Driver on a Client
Avoiding critical PostScript Driver Settings on the +Client

Installing PostScript Driver Files manually (using +rpcclient)

A Check of the rpcclient man Page
Understanding the rpcclient man Page
Producing an Example by querying a Windows Box
What is required for adddriver and setdriver to succeed
Manual Commandline Driver Installation in 15 little Steps
Troubleshooting revisited

The printing *.tdb Files

Trivial DataBase Files
Binary Format
Losing *.tdb Files
Using tdbbackup

CUPS Print Drivers from Linuxprinting.org

foomatic-rip and Foomatic explained
foomatic-rip and Foomatic-PPD Download and Installation

Page Accounting with CUPS

Setting up Quotas
Correct and incorrect Accounting
Adobe and CUPS PostScript Drivers for Windows Clients
The page_log File Syntax
Possible Shortcomings
Future Developments
Other Accounting Tools

Additional Material

Auto-Deletion or Preservation of CUPS Spool Files

CUPS Configuration Settings explained
Pre-conditions
Manual Configuration

When not to use Samba to print to +CUPS

In Case of Trouble.....

Where to find Documentation
How to ask for Help
Where to find Help

Appendix

Printing from CUPS to Windows attached +Printers
More CUPS filtering Chains
Trouble Shooting Guidelines to fix typical Samba printing +Problems
An Overview of the CUPS Printing Processes

20. Stackable VFS modules

VFS modules available elsewhere

Included modules

audit
extd_audit
fake_perms
recycle
netatalk

DatabaseFS
vscan

21. Integrated Logon Support using Winbind

What Winbind Provides

Target Uses

How Winbind Works

Microsoft Remote Procedure Calls
Microsoft Active Directory Services
Name Service Switch
Pluggable Authentication Modules
User and Group ID Allocation
Result Caching

Installation and Configuration

Introduction
Requirements
Testing Things Out

Conclusion

22. Advanced Network Management

Remote Server Administration

Remote Desktop Management

Remote Management from NoMachines.Com

Network Logon Script Magic

Adding printers without user intervention

23. System and Account Policies

Creating and Managing System Policies

Windows 9x/Me Policies
Windows NT4 Style Policy Files
MS Windows 200x / XP Professional Policies

Managing Account/User Policies

Samba Editreg Toolset
Windows NT4/200x
Samba PDC

System Startup and Logon Processing Overview

Policy Does Not Work

24. Desktop Profile Management

Creating/Managing Group Profiles

Roaming Profiles

Samba Configuration for Profile Handling
Windows Client Profile Configuration Information
Sharing Profiles between W9x/Me and NT4/200x/XP workstations
Profile Migration from Windows NT4/200x Server to Samba

Mandatory profiles

Default Profile for Windows Users

MS Windows 9x/Me
MS Windows NT4 Workstation
MS Windows 200x/XP

25. PAM based Distributed Authentication

How does one set up roaming profiles for just one (or a few) user/s or group/s?
Can NOT use Roaming Profiles
Changing the default profile

Technical Discussion

PAM Configuration Syntax
Example System Configurations
smb.conf PAM Configuration
Remote CIFS Authentication using winbindd.so
Password Synchronization using pam_smbpass.so

26. Integrating MS Windows networks with Samba

pam_winbind problem

Background Information

Name Resolution in a pure Unix/Linux world

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

Name resolution as used within MS Windows networking

The NetBIOS Name Cache
The LMHOSTS file
HOSTS file
DNS Lookup
WINS Lookup

30. Upgrading from Samba-2.x to Samba-3.0.0

My Boomerang Won't Come Back
Very Slow Network Connections
Samba server name change problem

27. Unicode/Charsets

Features and Benefits
What are charsets and unicode?
Samba and charsets
Conversion from old names
Japanese charsets

28. Samba Backup Techniques

Note
Features and Benefits

29. High Availability Options

Note

IV. Migration and Updating

Charsets
Obsolete configuration options
Password Backend

31. Migration from NT4 PDC to Samba-3 PDC

Planning and Getting Started

Objectives
Steps In Migration Process

Migration Options

Planning for Success
Samba Implementation Choices

32. SWAT - The Samba Web Administration Tool

34. Analysing and solving samba problems

Enabling SWAT for use
Securing SWAT through SSL
The SWAT Home Page
Global Settings
Share Settings
Printers Settings
The SWAT Wizard
The Status Page
The View Page
The Password Change Page

V. Troubleshooting

33. The Samba checklist

Introduction
Assumptions
The tests
Still having troubles?

Diagnostics tools
Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
Useful URLs
Getting help from the mailing lists
How to get off the mailing lists

35. Reporting Bugs

Introduction
General info
Debug levels
Internal errors
Attaching to a running process
Patches

VI. Appendixes

36. How to compile SAMBA

Access Samba source code via CVS

Introduction
CVS Access to samba.org

Accessing the samba sources via rsync and ftp

Verifying Samba's PGP signature

Building the Binaries

Compiling samba with Active Directory support

Starting the smbd and nmbd

Starting from inetd.conf
Alternative: starting it as a daemon

37. Portability

RedHat Linux Rembrandt-II

AIX

Sequential Read Ahead

Solaris

Locking improvements
Winbind on Solaris 9

38. Samba and other CIFS clients

Macintosh clients?

OS2 Client

How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?
How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?
How do I get printer driver download working + for OS/2 clients?

Windows for Workgroups

Use latest TCP/IP stack from Microsoft
Delete .pwl files after password change
Configure WfW password handling
Case handling of passwords
Use TCP/IP as default protocol
Speed improvement

Windows '95/'98

Speed improvement

Windows 2000 Service Pack 2

Windows NT 3.1

39. Samba Performance Tuning

Comparisons
Socket options
Read size
Max xmit
Log level
Read raw
Write raw
Slow Logins
Client tuning
Samba performance problem due changing kernel
Corrupt tdb Files

40. DNS and DHCP Configuration Guide

Note

41. Further Resources

Websites
Related updates from Microsoft
Books

Index

List of Figures

19.1. Windows Printing to a local Printer
19.2. Printing to a Postscript Printer
19.3. Ghostscript as a RIP for non-postscript printers
19.4. Prefiltering in CUPS to form Postscript
19.5. Adding Device-specific Print Options
19.6. Postscript to intermediate Raster format
19.7. CUPS-raster production using Ghostscript
19.8. Image format to CUPS-raster format conversion
19.9. Raster to Printer Specific formats
19.10. cupsomatic/foomatic processing versus Native CUPS
19.11. Print Driver execution on the Client
19.12. Print Driver execution on the Server
19.13. Printing via CUPS/samba server
19.14. cupsaddsmb flowchart
19.15. CUPS Printing Overview

List of Tables

7.1. Assumptions
10.1. Browse subnet example 1
10.2. Browse subnet example 2
10.3. Browse subnet example 3
10.4. Browse subnet example 4
11.1. Attributes in the sambaSamAccount objectclass (LDAP)
11.2. Basic smb.conf options for MySQL passdb backend
11.3. MySQL field names for MySQL passdb backend
13.1. Managing directories with unix and windows
13.2. User and Group Based Controls
13.3. File and Directory Permission Based Controls
13.4. Other Controls
20.1. Extended Auditing Log Information
24.1. User Shell Folder registry keys default values
24.2. Defaults of profile settings registry keys
24.3. Defaults of default user profile paths registry keys
25.1. Options recognized by pam_smbpass
31.1. The 3 Major Site Types
31.2. Nature of the Conversion Choices

List of Examples

12.1. smbgrpadd.sh
13.1. Example File

General Installation

Preparing Samba for Configuration

This section of the Samba-HOWTO-Collection contains general info on how to install samba and how to configure the parts of samba you will most likely need. -PLEASE read this.

Chapter 1. Introduction to Samba

David Lechnyr

Unofficial HOWTO

<david@lechnyr.com>

April 14, 2003

Table of Contents

Background
Terminology
Related Projects
SMB Methodology
Epilogue
Miscellaneous

“ +PLEASE read this.

Chapter 1. Introduction to Samba

David Lechnyr

Unofficial HOWTO

<david@lechnyr.com>

April 14, 2003

Table of Contents

Background
Terminology
Related Projects
SMB Methodology
Epilogue
Miscellaneous

“ "If you understand what you're doing, you're not learning anything." -- Anonymous ”

@@ -86,7 +86,7 @@ transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of strengths is that you can use it to blend your mix of Windows and Linux machines together without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed by a global team of about 30 active programmers and was originally developed by Andrew Tridgell. -

Background

Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only @@ -112,7 +112,7 @@ been dutifully waded through during the information-gathering stages of this pro are *still* many missing pieces... While often tedious, at least the way has been generously littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they thinking? -

Terminology

SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol.
CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently @@ -162,7 +162,7 @@ thinking? W3K: Acronym for Windows 2003 Server

If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at http://www.samba.org). -

Related Projects

There are currently two network filesystem client projects for Linux that are directly related to Samba: SMBFS and CIFS VFS. These are both available in the Linux kernel itself.

@@ -173,7 +173,7 @@ related to Samba: SMBFS and CIFS VFS. These are both available in the Linux ker
CIFS VFS (Common Internet File System Virtual File System) is the successor to SMBFS, and is being actively developed for the upcoming version of the Linux kernel. The intent of this module - is to provide advanced network file system functionality including support for dfs (heirarchical + is to provide advanced network file system functionality including support for dfs (hierarchical name space), secure per-user session establishment, safe distributed caching (oplock), optional packet signing, Unicode and other internationalization improvements, and optional Winbind (nsswitch) integration. @@ -184,7 +184,7 @@ nothing to do with acting as a file and print server for SMB/CIFS clients. There are other Open Source CIFS client implementations, such as the jCIFS project which provides an SMB client toolkit written in Java. -

SMB Methodology

Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns), UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS session service, or netbios-ssn). Anyone looking at their network with a good @@ -216,7 +216,7 @@ up a single file. In general, SMB sessions are established in the following orde A good way to examine this process in depth is to try out SecurityFriday's SWB program. It allows you to walk through the establishment of a SMB/CIFS session step by step. -

Epilogue

“ +

Epilogue

“ What's fundamentally wrong is that nobody ever had any taste when they did it. Microsoft has been very much into making the user interface look good, but internally it's just a complete mess. And even people who program for Microsoft @@ -245,14 +245,14 @@ not the completely clueless user who probably sits there shivering thinking That's what's really irritating to me." ”

-- Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 -

Miscellaneous

This chapter is Copyright 2003 David Lechnyr (david at lechnyr dot com). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt. -

Chapter 2. How to Install and Test SAMBA

Andrew Tridgell

Samba Team

<tridge@samba.org>

Jelmer R. Vernooij

The Samba Team

<jelmer@samba.org>

John H. Terpstra

Samba Team

<jht@samba.org>

Karl Auer

Table of Contents

Try listing the shares available on your - server

Example Configuration
SWAT

Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client

Why are so many smbd processes eating memory?
I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Obtaining and installing samba

Chapter 2. How to Install and Test SAMBA

Andrew Tridgell

Samba Team

<tridge@samba.org>

Jelmer R. Vernooij

The Samba Team

<jelmer@samba.org>

John H. Terpstra

Samba Team

<jht@samba.org>

Karl Auer

Table of Contents

Try listing the shares available on your + server

Example Configuration
SWAT

Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client

Why are so many smbd processes eating memory?
I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Obtaining and installing samba

Binary packages of samba are included in almost any Linux or Unix distribution. There are also some packages available at the samba homepage. @@ -260,41 +260,41 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li appropriate appendix chapter.

If you have already installed samba, or if your operating system was pre-installed with samba, then you may not need to bother with this chapter. On the other hand, you may want to read this chapter anyhow - for information about updating samba.

Configuring samba (smb.conf)

+ for information about updating samba.

Configuring samba (smb.conf)

Samba's configuration is stored in the smb.conf file, that usually resides in /etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical tools that are available, such as the web-based interface swat, that is included with samba. -

Example Configuration

There are sample configuration files in the examples subdirectory in the distribution. I suggest you read them carefully so you can see how the options go together in practice. See the man page for all the options.

The simplest useful configuration file would be something like this: -

+	

+	
 	[global]
 		workgroup = MYGROUP
 
 	[homes]
 		guest ok = no
 		read only = no
-	

-	
+

This will allow connections by anyone with an account on the server, using either their login name or "homes" as the service name. (Note that the workgroup that Samba must also be set.)

Make sure you put the smb.conf file in the same place - you specified in theMakefile (the default is to + you specified in the Makefile (the default is to look for it in /usr/local/samba/lib/).

For more information about security settings for the [homes] share please refer to the chapter Securing Samba. -

Test your config file with testparm

It's important that you test the validity of your smb.conf file using the testparm program. If testparm runs OK then it will list the loaded services. If not it will give an error message. @@ -302,7 +302,7 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li Make sure it runs OK and that the services look reasonable before proceeding.

Always run testparm again when you change smb.conf! -

SWAT

SWAT is a web-based interface that helps you configure samba. SWAT might not be available in the samba package on your platform, but in a separate package. Please read the swat manpage @@ -318,7 +318,7 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent in the clear over the wire. -

Try listing the shares available on your +

Try listing the shares available on your server

$ smbclient -L yourhostname

You should get back a list of shares available on your server. If you don't then something is incorrectly setup. @@ -328,7 +328,7 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li See the smbclient man page for details. (you can force it to list the shares without a password by adding the option -U% to the command line. This will not work - with non-Samba servers)

Try connecting with the unix client

$ smbclient + with non-Samba servers)

`Try connecting with the unix client`

$ smbclient //yourhostname/aservice

Typically the yourhostname would be the name of the host where you installed smbd. The aservice is @@ -337,18 +337,18 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li section in smb.conf.

For example if your unix host is bambi and your login name is fred you would type:

$ smbclient //bambi/fred -

`Try connecting from a DOS, WfWg, Win9x, WinNT, +`

Try connecting from a DOS, WfWg, Win9x, WinNT, Win2k, OS/2, etc... client

Try mounting disks. eg:

C:\WINDOWS\> net use d: \\servername\service

Try printing. eg:

C:\WINDOWS\> net use lpt1: \\servername\spoolservice

C:\WINDOWS\> print filename -

What If Things Don't Work?

Then you might read the file chapter - Diagnosis and the +

What If Things Don't Work?

Then you might read the file chapter + Diagnosis and the FAQ. If you are still stuck then try to follow the Analysing and Solving Problems chapter Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it.

Common Errors

+ so maybe someone else has hit your problem and has overcome it.

Common Errors

The following questions and issues get raised on the samba mailing list over and over again. -

Why are so many smbd processes eating memory?

“ Site that is running Samba on an AIX box. They are sharing out about 2 terabytes using samba. Samba was installed using smitty and the binaries. We seem to be experiencing a memory problem @@ -360,8 +360,8 @@ processes of smbd running: Is samba suppose to start this many different smbd processes? Or does it run as one smbd process? Also is it normal for it to be taking up this much memory? ” -

-
+
+
Inuse * 4096 = amount of memory being used by this process Pid Command Inuse Pin Pgsp Virtual 64-bit Mthrd @@ -388,8 +388,8 @@ Inuse * 4096 = amount of memory being used by this process 19110 smbd 8404 1906 181 4862 N N Total memory used: 841,592,832 bytes -
-
+
+
Samba consists on three core programs: nmbd, smbd, winbindd. nmbd is the name server message daemon, smbd is the server message daemon, winbindd is the daemon that @@ -404,22 +404,22 @@ connection made. That is why you are seeing so many of them, one (1) per client
winbindd will run as one or two daemons, depending on whether or not it is being run in "split mode" (in which case there will be two instances). -

I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Your loopback device isn't working correctly. Make sure it's running.

Chapter 3. FastStart for the Impatient

John H. Terpstra

Samba Team
<jht@samba.org>

Table of Contents

Note

Note

I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Your loopback device isn't working correctly. Make sure it's running.

Chapter 3. Fast Start for the Impatient

John H. Terpstra

Samba Team
<jht@samba.org>

Table of Contents

Note

Note

This chapter did not make it into this release. It is planned for the published release of this document. -

Server Configuration Basics

First Steps in Server Configuration

Server Configuration Basics

First Steps in Server Configuration

Samba can operate in various modes within SMB networks. This HOWTO section contains information on configuring samba to function as the type of server your network requires. Please read this section carefully. -

Table of Contents

4. Server Types and Security Modes

Samba Security Modes

Server Types

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

Seamless Windows Network Integration

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

5. Domain Control

Basics of Domain Control

Domain Controller Types
Preparing for Domain Control

Domain Control - Example Configuration

Samba ADS Domain Control

Domain and Network Logon Configuration

Domain Network Logon Service
Security Mode and Master Browsers

Common Problems and Errors

I cannot include a '$' in a machine name
I get told "You already have a connection to the Domain...." +
Table of Contents
4. Server Types and Security Modes
Features and Benefits
Server Types
Samba Security Modes
User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)
Seamless Windows Network Integration
Common Errors
What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server
5. Domain Control
Features and Benefits
Basics of Domain Control
Domain Controller Types
Preparing for Domain Control
Domain Control - Example Configuration
Samba ADS Domain Control
Domain and Network Logon Configuration
Domain Network Logon Service
Security Mode and Master Browsers
Common Problems and Errors
I cannot include a '$' in a machine name
I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
The system can not log you on (C000019B)....
The machine trust account for this computer either does not -exist or is not accessible.
When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"
6. Backup Domain Control
Features And Benefits
Essential Background Information
MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?
Backup Domain Controller Configuration
Example Configuration
Common Errors
Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?
7. Domain Membership
Features and Benefits
MS Windows Workstation/Server Machine Trust Accounts
Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member
Domain Member Server
Joining an NT4 type Domain with Samba-3
Why is this better than security = server?
Samba ADS Domain Membership
Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes
Common Errors
Can Not Add Machine Back to Domain
Adding Machine to Domain Fails
8. Stand-Alone Servers
Features and Benefits
Background
Example Configuration
Reference Documentation Server
Central Print Serving
Common Errors
9. MS Windows Network Configuration Guide
Note

Chapter 4. Server Types and Security Modes

Andrew Tridgell

Samba Team
<tridge@samba.org>

Jelmer R. Vernooij

The Samba Team
<jelmer@samba.org>

John H. Terpstra

Samba Team
<jht@samba.org>

Table of Contents

Samba Security Modes

Server Types

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

Seamless Windows Network Integration

Features And Benefits

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

+existing set.." when creating a machine trust account.

The system can not log you on (C000019B)....

The machine trust account for this computer either does not +exist or is not accessible.

When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.

Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

6. Backup Domain Control

Essential Background Information

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Backup Domain Controller Configuration

Example Configuration

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

7. Domain Membership

MS Windows Workstation/Server Machine Trust Accounts

Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member

Domain Member Server

Joining an NT4 type Domain with Samba-3
Why is this better than security = server?

Samba ADS Domain Membership

Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes

Can Not Add Machine Back to Domain
Adding Machine to Domain Fails

8. Stand-Alone Servers

Example Configuration

Background

Reference Documentation Server
Central Print Serving

9. MS Windows Network Configuration Guide

Note

Chapter 4. Server Types and Security Modes

Andrew Tridgell

Samba Team
<tridge@samba.org>

Jelmer R. Vernooij

The Samba Team
<jelmer@samba.org>

John H. Terpstra

Samba Team
<jht@samba.org>

Table of Contents

Samba Security Modes

Server Types

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

Seamless Windows Network Integration

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

This chapter provides information regarding the types of server that Samba may be configured to be. A Microsoft network administrator who wishes to migrate to or to use Samba will want to know what, within a Samba context, terms familiar to MS Windows -adminstrator mean. This means that it is essential also to define how critical security +administrator mean. This means that it is essential also to define how critical security modes function BEFORE we get into the details of how to configure the server itself.

The chapter provides an overview of the security modes of which Samba is capable @@ -428,9 +428,9 @@ and how these relate to MS Windows servers and clients. Firstly we should recognise the question so often asked, "Why would I want to use Samba?" So, in those chapters where the answer may be important you will see a section that highlights features and benefits. These may be for or against Samba. -

Features and Benefits

Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It -hurt his toe and lodged in his sandle. He took the stone out and cursed it with a passion +hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I can turn that into a precious gem and some day it will make a princess very happy!

@@ -464,13 +464,13 @@ So now, what are the benefits of features mentioned in this chapter? greater flexibility than MS Windows NT4 and in many cases a significantly higher utility than Active Directory domains with MS Windows 200x. -

Server Types

Adminstrators of Microsoft networks often refer to three +

Server Types

Administrators of Microsoft networks often refer to three different type of servers:

Domain Controller
Primary Domain Controller
Backup Domain Controller
ADS Domain Controller
Domain Member Server
Active Directory Member Server
NT4 Style Domain Member Server
Stand Alone Server

The chapters covering Domain Control, Backup Domain Control and Domain Membership provide pertinent information regarding Samba-3 configuration for each of these server roles. The reader is strongly encouraged to become intimately familiar with the information presented. -

Samba Security Modes

In this section the function and purpose of Samba's security modes are described. An accurate understanding of how Samba implements each security mode as well as how to configure MS Windows clients for each mode will significantly @@ -494,7 +494,7 @@ the way the client then tries to authenticate itself. It does not directly affec but it fits in with the client/server approach of SMB. In SMB everything is initiated and controlled by the client, and the server can only tell the client what is available and whether an action is allowed. -

User Level Security

We will describe user level security first, as it's simpler. In user level security, the client will send a session setup command directly after the protocol negotiation. @@ -512,13 +512,13 @@ It is also possible for a client to send multiple ses requests. When the server responds, it gives the client a uid to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this). -

Example Configuration

The smb.conf parameter that sets User Level Security is:

 	security = user

This is the default setting since samba-2.2.x. -

Share Level Security

Ok, now for share level security. In share level security, the client authenticates itself separately for each share. It will send a password along with each tree connection (share mount). It does not explicitly send a @@ -541,18 +541,18 @@ of the share they try to connect to (useful for home directories) and any users listed in the user = smb.conf line. The password is then checked in turn against these possible usernames. If a match is found then the client is authenticated as that user. -

Example Configuration

The smb.conf parameter that sets Share Level Security is:

 	security = share

Please note that there are reports that recent MS Windows clients do not like to work with share mode security servers. You are strongly discouraged from using share level security. -

Domain Security Mode (User Level Security)

When Samba is operating in security = domain mode, the Samba server has a domain security trust account (a machine account) and will cause all authentication requests to be passed through to the domain controllers. -

Example Configuration

Samba as a Domain Member Server

This method involves addition of the following parameters in the smb.conf file: @@ -564,20 +564,20 @@ In order for this method to work, the Samba server needs to join the MS Windows security domain. This is done as follows:

On the MS Windows NT domain controller, using the Server Manager, add a machine account for the Samba server. -
Next, on the Unix/Linux system execute:
root# smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x)
root# net join -U administrator%password (samba-3)

Note

+
Next, on the Unix/Linux system execute:
root# smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x)
root# net join -U administrator%password (samba-3)

Note

As of Samba-2.2.4 the Samba 2.2.x series can auto-join a Windows NT4 style Domain just by executing: -

+
 root# smbpasswd -j DOMAIN_NAME -r PDC_NAME -U Administrator%password
-

+

As of Samba-3 the same can be done by executing: -

+
 root# net join -U Administrator%password
-

+

It is not necessary with Samba-3 to specify the DOMAIN_NAME or the PDC_NAME as it figures this out from the smb.conf file settings. -

Use of this mode of authentication does require there to be a standard Unix account for each user in order to assign a uid once the account has been authenticated by the remote Windows DC. This account can be blocked to prevent logons by clients other than @@ -590,7 +590,7 @@ in this HOWTO collection.

For more information of being a domain member, see the Domain Member section of this Howto. -

ADS Security Mode (User Level Security)

Both Samba 2.2 and 3.0 can join an Active Directory domain. This is possible even if the domain is run in native mode. Active Directory in native mode perfectly allows NT4-style domain members, contrary to @@ -604,7 +604,7 @@ authentication protocols. All your machines are running Windows 2000 and above and all use full Kerberos. In this case Samba as a NT4-style domain would still require NT-compatible authentication data. Samba in AD-member mode can accept Kerberos. -

Example Configuration

+
Example Configuration
 	realm = your.kerberos.REALM
 	security = ADS
 

@@ -614,7 +614,7 @@ AD-member mode can accept Kerberos.

Please refer to the Domain Membership and Active Directory Membership sections for more information regarding this configuration option. -

Server Security (User Level Security)

Server security mode is a left over from the time when Samba was not capable of acting as a domain member server. It is highly recommended NOT to use this feature. Server security mode has many draw backs. The draw backs include: @@ -646,7 +646,7 @@ lookups because the choice of the target authentication server is arbitrary and be determined from a domain name. In essence, a Samba server that is in server security mode is operating in what used to be known as workgroup mode. -

Example Configuration

Using MS Windows NT as an authentication server

This method involves the additions of the following parameters in the smb.conf file: @@ -667,7 +667,7 @@ certain number of failed authentication attempts this will result in user lockou

Use of this mode of authentication does require there to be a standard Unix account for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. -

Seamless Windows Network Integration

MS Windows clients may use encrypted passwords as part of a challenge/response authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple password based authentication. It should be realized that with the SMB protocol, @@ -679,7 +679,7 @@ is encrypted in two ways:

An MD4 hash of the UNICODE of the password string. This is known as the NT hash.
The password is converted to upper case, - and then padded or trucated to 14 bytes. This string is + and then padded or truncated to 14 bytes. This string is then appended with 5 bytes of NULL characters and split to form two 56 bit DES keys to encrypt a "magic" 8 byte value. The resulting 16 bytes form the LanMan hash. @@ -705,7 +705,7 @@ The following parameters can be used to work around the issue of Windows 9x clie upper casing usernames and password before transmitting them to the SMB server when using clear text authentication.
```
-        passsword level = integer
+        password level = integer
         username level = integer
 
```
By default Samba will lower case the username before attempting to lookup the user @@ -726,29 +726,29 @@ try them one by one until a match is located (or all combinations fail). The best option to adopt is to enable support for encrypted passwords where ever Samba is used. Most attempts to apply the registry change to re-enable plain text passwords will eventually lead to user complaints and unhappiness. -

Common Errors

We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake made in a developmental test lab is expected.

Here we look at common mistakes and misapprehensions that have been the subject of discussions on the Samba mailing lists. Many of these are avoidable by doing you homework before attempting -a Samba implementation. Some are the result of misundertanding of the English language. The +a Samba implementation. Some are the result of misunderstanding of the English language. The English language has many turns of phrase that are potentially vague and may be highly confusing to those for whom English is not their native tongue. -

What makes Samba a SERVER?

To some the nature of the Samba security mode is very obvious, but entirely wrong all the same. It is assumed that security = server means that Samba will act as a server. Not so! See above - this setting means that Samba will try to use another SMB server as its source of user authentication alone. -

What makes Samba a Domain Controller?

The smb.conf parameter security = domain does NOT really make Samba behave as a Domain Controller! This setting means we want Samba to be a domain member! -

What makes Samba a Domain Member?

Guess! So many others do. But whatever you do, do NOT think that security = user makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See the Domain Member section of this Howto for more information. -

Constantly Losing Connections to Password Server

Why does server_validate() simply give up rather than re-establishing its connection to the password server? Though I am not fluent in the SMB protocol, perhaps the cluster server process passes along to its client workstation the session key it receives from the password @@ -757,11 +757,11 @@ connection, whose session key would be different. So server_validate() must giv

Indeed. That's why security = server is at best a nasty hack. Please use security = domain. security = server mode is also known as pass-through authentication. -

Chapter 5. Domain Control

John H. Terpstra

Samba Team
<jht@samba.org>

Gerald (Jerry) Carter

Samba Team
<jerry@samba.org>

David Bannon

Samba Team
<dbannon@samba.org>

Table of Contents

Basics of Domain Control

Domain Controller Types
Preparing for Domain Control

Domain Control - Example Configuration

Samba ADS Domain Control

Domain and Network Logon Configuration

Domain Network Logon Service
Security Mode and Master Browsers

Common Problems and Errors

I cannot include a '$' in a machine name
I get told "You already have a connection to the Domain...." +

Chapter 5. Domain Control

John H. Terpstra

Samba Team
<jht@samba.org>

Gerald (Jerry) Carter

Samba Team
<jerry@samba.org>

David Bannon

Samba Team
<dbannon@samba.org>

Table of Contents

Basics of Domain Control

Domain Controller Types
Preparing for Domain Control

Domain Control - Example Configuration

Samba ADS Domain Control

Domain and Network Logon Configuration

Domain Network Logon Service
Security Mode and Master Browsers

Common Problems and Errors

I cannot include a '$' in a machine name
I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
The system can not log you on (C000019B)....
The machine trust account for this computer either does not -exist or is not accessible.
When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

The Essence of Learning: +existing set.." when creating a machine trust account.

The system can not log you on (C000019B)....

The machine trust account for this computer either does not +exist or is not accessible.

When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.

Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

The Essence of Learning: There are many who approach MS Windows networking with incredible misconceptions. That's OK, because it gives the rest of us plenty of opportunity to be of assistance. Those who really want help would be well advised to become familiar with information @@ -774,7 +774,7 @@ of persistent niggles that may be caused by broken network or system configurati To a great many people however, MS Windows networking starts with a domain controller that in some magical way is expected to solve all ills.

-From the Samba mailing list one can readilly identify many common networking issues. +From the Samba mailing list one can readily identify many common networking issues. If you are not clear on the following subjects, then it will do much good to read the sections of this HOWTO that deal with it. These are the most common causes of MS Windows networking problems: @@ -791,7 +791,7 @@ burden on an organisation. Where is the right place to make mistakes? Only out of harm's way! If you are going to make mistakes, then please do this on a test network, away from users and in such a way as to not inflict pain on others. Do your learning on a test network. -

Features and Benefits

What is the key benefit of Microsoft Domain security?

In a word, Single Sign On, or SSO for short. To many, this is the holy @@ -854,7 +854,7 @@ Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to user and machine trust account information in a suitable backend data store. With Samba-3 there can be multiple back-ends for this including:

- smbpasswd - the plain ascii file stored used by + smbpasswd - the plain ASCII file stored used by earlier versions of Samba. This file configuration option requires a Unix/Linux system account for EVERY entry (ie: both for user and for machine accounts). This file will be located in the private @@ -863,7 +863,7 @@ there can be multiple back-ends for this including: tdbsam - a binary database backend that will be stored in the private directory in a file called passdb.tdb. The key benefit of this binary format - file is that it can store binary objects that can not be accomodated + file is that it can store binary objects that can not be accommodated in the traditional plain text smbpasswd file. These permit the extended account controls that MS Windows NT4 and later also have.
@@ -889,11 +889,11 @@ per user settings for many parameters, over-riding global settings given in the Thus, with samba-3 it is possible to have a default system configuration for profiles, and on a per user basis to over-ride this for those users who should not be subject to the default configuration. -

Basics of Domain Control

Over the years, public perceptions of what Domain Control really is has taken on an almost mystical nature. Before we branch into a brief overview of Domain Control, there are three basic types of domain controllers: -

Domain Controller Types

Primary Domain Controller
Backup Domain Controller
ADS Domain Controller

Domain Controller Types

Primary Domain Controller
Backup Domain Controller
ADS Domain Controller

The Primary Domain Controller or PDC plays an important role in the MS Windows NT4 and Windows 200x Domain Control architecture, but not in the manner that so many expect. There is folk lore that dictates that because of it's role in the MS Windows @@ -908,7 +908,7 @@ part in NT4 type domain user authentication and in synchronisation of the domain database with Backup Domain Controllers.

With MS Windows 200x Server based Active Directory domains, one domain controller seeds a potential -hierachy of domain controllers, each with their own area of delegated control. The master domain +hierarchy of domain controllers, each with their own area of delegated control. The master domain controller has the ability to override any down-stream controller, but a down-line controller has control only over it's down-line. With Samba-3 this functionality can be implemented using an LDAP based user and machine account back end. @@ -925,10 +925,10 @@ On a network segment that has a BDC and a PDC the BDC will be most likely to ser logon requests. The PDC will answer network logon requests when the BDC is too busy (high load). A BDC can be promoted to a PDC. If the PDC is on line at the time that a BDC is promoted to PDC, the previous PDC is automatically demoted to a BDC. With Samba-3 this is NOT an automatic -operation; the PDB and BDC must be manually configured and changes need to be made likewise. +operation; the PDC and BDC must be manually configured and changes need to be made likewise.

With MS Windows NT4, it is an install time decision what type of machine the server will be. -It is possible to change the promote a BDC to a PDC and vica versa only, but the only way +It is possible to change the promote a BDC to a PDC and vice versa only, but the only way to convert a domain controller to a domain member server or a stand-alone server is to reinstall it. The install time choices offered are:

Primary Domain Controller - The one that seeds the domain SAM
Backup Domain Controller - One that obtains a copy of the domain SAM
Domain Member Server - One that has NO copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls.
Stand-Alone Server - One that plays NO part is SAM synchronisation, has it's own authentication database and plays no role in Domain security.

@@ -945,7 +945,7 @@ At this time any appearance that Samba-3 is capable of acting as an This functionality should not be used until the Samba-Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all configuration and management requirements. -

Preparing for Domain Control

There are two ways that MS Windows machines may interact with each other, with other servers, and with Domain Controllers: Either as Stand-Alone systems, more commonly called Workgroup members, or as full participants in a security system, @@ -977,7 +977,7 @@ NT4 / 200x / XP clients. MS Windows network Integration)Domain logons for Windows NT4 / 200x / XP Professional clientsConfiguration of Roaming Profiles or explicit configuration to force local profile usageConfiguration of Network/System PoliciesAdding and managing domain user accountsConfiguring MS Windows client machines to become domain members

The following provisions are required to serve MS Windows 9x / Me Clients:

Configuration of basic TCP/IP and MS Windows Networking

Correct designation of the Server Role (security = user)

Network Logon Configuration (Since Windows 9x / XP Home are not technically domain - members, they do not really particpate in the security aspects of Domain logons as such)

Roaming Profile Configuration

Configuration of System Policy handling

Installation of the Network driver "Client for MS Windows Networks" and configuration + members, they do not really participate in the security aspects of Domain logons as such)

Roaming Profile Configuration

Configuration of System Policy handling

Installation of the Network driver "Client for MS Windows Networks" and configuration to log onto the domain

Placing Windows 9x / Me clients in user level security - if it is desired to allow all client share access to be controlled according to domain user / group identities.

Adding and managing domain user accounts

Note

Roaming Profiles and System/Network policies are advanced network administration topics @@ -1006,7 +1006,7 @@ domain/workgroup. Local master browsers in the same domain/workgroup on broadcas then ask for a complete copy of the browse list for the whole wide area network. Browser clients will then contact their local master browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet. -

Domain Control - Example Configuration

The first step in creating a working Samba PDC is to understand the parameters necessary in smb.conf. Here we attempt to explain the parameters that are covered in the smb.conf man page. @@ -1060,20 +1060,20 @@ Here is an example smb.conf for acting as a PDC: read only = no create mask = 0600 directory mask = 0700 -

Note

+
Note
The above parameters make for a full set of parameters that may define the server's mode of operation. The following parameters are the essentials alone: -
+
workgroup = NARNIA domain logons = Yes domain master = Yes security = User -
+
The additional parameters shown in the longer listing above just makes for a more complete environment. -
+

There are a couple of points to emphasize in the above configuration.

Encrypted passwords must be enabled. For more details on how @@ -1086,23 +1086,23 @@ There are a couple of points to emphasize in the above configuration. client to locate the server as a DC. Please refer to the various Network Browsing documentation included with this distribution for details. -

Samba ADS Domain Control

Samba-3 is not and can not act as an Active Directory Server. It can not truly function as an Active Directory Primary Domain Controller. The protocols for some of the functionality the Active Directory Domain Controllers is have been partially implemented on an experimental only basis. Please do NOT expect Samba-3 to support these protocols - nor should you depend on any such functionality either now or in the future. The Samba-Team may well remove such -experiemental features or may change their behaviour. -

Domain and Network Logon Configuration

+experimental features or may change their behaviour. +

Domain and Network Logon Configuration

The subject of Network or Domain Logons is discussed here because it rightly forms an integral part of the essential functionality that is provided by a Domain Controller. -

Domain Network Logon Service

All Domain Controllers must run the netlogon service (domain logons in Samba). One Domain Controller must be configured with domain master = Yes (the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No must be set. -

Example Configuration

-	[globals]
+
Example Configuration
+	[global]
 		domain logons = Yes
 		domain master = (Yes on PDC, No on BDCs)
 
@@ -1111,7 +1111,7 @@ must be set.
 		path = /var/lib/samba/netlogon
 		guest ok = Yes
 		browseable = No
-
The Special Case of MS Windows XP Home Edition
Note

+

The Special Case of MS Windows XP Home Edition

Note

MS Windows XP Home Edition does not have the ability to join any type of Domain security facility. Unlike, MS Windows 9x / Me, MS Windows XP Home Edition also completely lacks the ability to log onto a network. @@ -1123,7 +1123,7 @@ MS Windows XP Professional.

Now that this has been said, please do NOT ask the mailing list, or email any of the Samba-Team members with your questions asking how to make this work. It can't be done. -

The Special Case of Windows 9x / Me

A domain and a workgroup are exactly the same thing in terms of network browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a @@ -1203,7 +1203,7 @@ The main difference between a PDC and a Windows 9x logon server configuration is

A Samba PDC will act as a Windows 9x logon server; after all, it does provide the network logon services that MS Windows 9x / Me expect to find. -

Security Mode and Master Browsers

There are a few comments to make in order to tie up some loose ends. There has been much debate over the issue of whether or not it is ok to configure Samba as a Domain Controller in security @@ -1237,7 +1237,7 @@ Configuring a Samba box as a DC for a domain that already by definition has a PDC is asking for trouble. Therefore, you should always configure the Samba DC to be the DMB for its domain and set security = user. This is the only officially supported mode of operation. -

Common Problems and Errors

I cannot include a '$' in a machine name

Common Problems and Errors

I cannot include a '$' in a machine name

A 'machine account', (typically) stored in /etc/passwd, takes the form of the machine name with a '$' appended. FreeBSD (and other BSD systems?) won't create a user with a '$' in their name. @@ -1245,7 +1245,7 @@ systems?) won't create a user with a '$' in their name. The problem is only in the program used to make the entry. Once made, it works perfectly. Create a user without the '$'. Then use vipw to edit the entry, adding the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! -

I get told "You already have a connection to the Domain...." +

I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an existing set.." when creating a machine trust account.

This happens if you try to create a machine trust account from the @@ -1259,7 +1259,7 @@ Further, if the machine is already a 'member of a workgroup' that is the same name as the domain you are joining (bad idea) you will get this message. Change the workgroup name to something else, it does not matter what, reboot, and try again. -

The system can not log you on (C000019B)....

I joined the domain successfully but after upgrading +

The system can not log you on (C000019B)....

I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message, The system can not log you on (C000019B), Please try again or consult your system administrator when attempting to logon. @@ -1270,14 +1270,14 @@ the domain name and/or the server name (NetBIOS name) is changed. The only way to correct the problem is to restore the original domain SID or remove the domain client from the domain and rejoin. The domain SID may be reset using either the net or rpcclient utilities. -

+
The reset or change the domain SID you can use the net command as follows: -
+
root# net getlocalsid 'OLDNAME' root# net setlocalsid 'SID' -
-

The machine trust account for this computer either does not +
+

The machine trust account for this computer either does not exist or is not accessible.

When I try to join the domain I get the message The machine account for this computer either does not exist or is not accessible. What's @@ -1290,7 +1290,7 @@ admin user system is working.

Alternatively if you are creating account entries manually then they have not been created correctly. Make sure that you have the entry -correct for the machine trust account in smbpasswd file on the Samba PDC. +correct for the machine trust account in smbpasswd file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure that the account name is the machine NetBIOS name with a '$' appended to it ( i.e. computer_name$ ). There must be an entry @@ -1300,20 +1300,20 @@ Some people have also reported that inconsistent subnet masks between the Samba server and the NT client can cause this problem. Make sure that these are consistent for both client and server. -

When I attempt to login to a Samba Domain from a NT4/W2K workstation, +

When I attempt to login to a Samba Domain from a NT4/W2K workstation, I get a message about my account being disabled.

Enable the user accounts with smbpasswd -e username, this is normally done as an account is created. -

Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

A domain controller has to announce on the network who it is. This usually takes a while. -

Chapter 6. Backup Domain Control

John H. Terpstra

Samba Team
<jht@samba.org>

Volker Lendecke

Samba Team
<Volker.Lendecke@SerNet.DE>

Table of Contents

Features And Benefits

Essential Background Information

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Backup Domain Controller Configuration

Example Configuration

Features And Benefits

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

Chapter 6. Backup Domain Control

John H. Terpstra

Samba Team
<jht@samba.org>

Volker Lendecke

Samba Team
<Volker.Lendecke@SerNet.DE>

Table of Contents

Essential Background Information

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Backup Domain Controller Configuration

Example Configuration

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

Before you continue reading in this section, please make sure that you are comfortable with configuring a Samba Domain Controller as described in the -Domain Control Chapter. -

Features And Benefits

-This is one of the most difficult chapters to summarise. It matters not what we say here +Domain Control chapter. +

Features And Benefits

+This is one of the most difficult chapters to summarise. It does not matter what we say here for someone will still draw conclusions and / or approach the Samba-Team with expectations -that are either not yet capable of being delivered, or that can be achieved for more +that are either not yet capable of being delivered, or that can be achieved far more effectively using a totally different approach. Since this HOWTO is already so large and extensive, we have taken the decision to provide sufficient (but not comprehensive) information regarding Backup Domain Control. In the event that you should have a persistent @@ -1334,7 +1334,7 @@ The use of a non-LDAP backend SAM database is particularly problematic because D servers and workstations periodically change the machine trust account password. The new password is then stored only locally. This means that in the absence of a centrally stored accounts database (such as that provided with an LDAP based solution) if Samba-3 is running -as a BDC, the PDC instance of the Domain member trust account password will not reach the +as a BDC, the BDC instance of the Domain member trust account password will not reach the PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs this results in overwriting of the SAM that contains the updated (changed) trust account password with resulting breakage of the domain trust. @@ -1349,7 +1349,7 @@ lets consider each possible option and look at the pro's and con's for each theo

Arguments Against: Complexity

- Passdb Backend is tdbsam based, BDCs use cron based "net rcp vampire" to + Passdb Backend is tdbsam based, BDCs use cron based "net rpc vampire" to suck down the Accounts database from the PDC

Arguments For: It would be a nice solution @@ -1371,22 +1371,22 @@ lets consider each possible option and look at the pro's and con's for each theo Arguments Against: All machine trust accounts and user accounts will be locally maintained. Domain users will NOT be able to roam from office to office. This is a broken and flawed solution. Do NOT do this. -

Essential Background Information

A Domain Controller is a machine that is able to answer logon requests from network workstations. Microsoft LanManager and IBM LanServer were two early products that provided this capability. The technology has become known as the LanMan Netlogon service.

-When MS Windows NT3.10 was first released it supported an new style of Domain Control +When MS Windows NT3.10 was first released, it supported an new style of Domain Control and with it a new form of the network logon service that has extended functionality. This service became known as the NT NetLogon Service. The nature of this service has changed with the evolution of MS Windows NT and today provides a very complex array of services that are implemented over a complex spectrum of technologies. -

MS Windows NT4 Style Domain Control

-Whenever a user logs into a Windows NT4 / 200x / XP Profresional Workstation, +

MS Windows NT4 Style Domain Control

+Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation, the workstation connects to a Domain Controller (authentication server) to validate the username and password that the user entered are valid. If the information entered does not validate against the account information that has been stored in the Domain -Control database (the SAM, or Security Accounts Manager database) then a set of error +Control database (the SAM, or Security Account Manager database) then a set of error codes is returned to the workstation that has made the authentication request.

When the username / password pair has been validated, the Domain Controller @@ -1408,7 +1408,7 @@ Controllers are present on the network.

There are two situations in which it is desirable to install Backup Domain Controllers:

- On the local network that the Primary Domain Controller is on if there are many + On the local network that the Primary Domain Controller is on, if there are many workstations and/or where the PDC is generally very busy. In this case the BDCs will pick up network logon requests and help to add robustness to network services.
@@ -1424,7 +1424,7 @@ has the PDC, the change will likely be made directly to the PDC instance of the copy of the SAM. In the event that this update may be performed in a branch office the change will likely be stored in a delta file on the local BDC. The BDC will then send a trigger to the PDC to commence the process of SAM synchronisation. The PDC will then -request the delta from the BDC and apply it to the master SAM. THe PDC will then contact +request the delta from the BDC and apply it to the master SAM. The PDC will then contact all the BDCs in the Domain and trigger them to obtain the update and then apply that to their own copy of the SAM.
@@ -1439,7 +1439,7 @@ one of the BDCs can be promoted to a PDC. If this happens while the original PDC line then it is automatically demoted to a BDC. This is an important aspect of Domain Controller management. The tool that is used to affect a promotion or a demotion is the Server Manager for Domains. -
Example PDC Configuration
+
Example PDC Configuration
Since version 2.2 Samba officially supports domain logons for all current Windows Clients, including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some parameters in the [global]-section of the smb.conf have to be set: @@ -1450,29 +1450,29 @@ parameters in the [global]-section of the
Several other things like a [homes] and a [netlogon] share also need to be set along with settings for the profile path, the users home drive, etc.. This will not be covered in this -chapter, for more information please refer to the chapter on Domain Control. -
Active Directory Domain Control
+chapter, for more information please refer to the chapter on Domain Control. +

`Active Directory Domain Control`

As of the release of MS Windows 2000 and Active Directory, this information is now stored in a directory that can be replicated and for which partial or full administrative control can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT -act as a Backup Domain Contoller to an Active Directory Domain Controller. -

`What qualifies a Domain Controller on the network?`

+act as a Backup Domain Controller to an Active Directory Domain Controller. +

`What qualifies a Domain Controller on the network?`

Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network. The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server. The name type <#1b> name is normally reserved for the Domain Master Browser, a role that has nothing to do with anything related to authentication, but the Microsoft Domain implementation requires the domain master browser to be on the same machine as the PDC. -

`How does a Workstation find its domain controller?`

+

`How does a Workstation find its domain controller?`

An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a local user to be authenticated has to find the domain controller for SAMBA. It does this by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each of the machines it gets back from the queries is a domain controller and can answer logon requests. To not open security holes both the workstation and the selected domain controller authenticate each other. After that the workstation sends the user's credentials (name and -password) to the local Domain Controller, for valdation. -

`Backup Domain Controller Configuration`

+password) to the local Domain Controller, for validation. +

`Backup Domain Controller Configuration`

Several things have to be done:

The domain SID has to be the same on the PDC and the BDC. This used to @@ -1483,25 +1483,31 @@ Several things have to be done: generate a new SID for itself and override the domain SID with this new BDC SID.
To retrieve the domain SID from the PDC or an existing BDC and store it in the - secrets.tdb, execute 'net rpc getsid' on the BDC. -
+ secrets.tdb, execute: +
```
+	root# net rpc getsid
+	
```
The Unix user database has to be synchronized from the PDC to the BDC. This means that both the /etc/passwd and /etc/group have to be replicated from the PDC to the BDC. This can be done manually whenever changes are made, or the PDC is set up as a NIS master server and the BDC as a NIS slave server. To set up the BDC as a mere NIS client would not be enough, as the BDC would not be able to - access its user database in case of a PDC failure. + access its user database in case of a PDC failure. NIS is by no means + the only method to synchronize passwords. An LDAP solution would work + as well.
- The Samba password database in the file private/smbpasswd has to be - replicated from the PDC to the BDC. This is a bit tricky, see the - next section. + The Samba password database has to be replicated from the PDC to the BDC. + As said above, though possible to synchronise the smbpasswd + file with rsync and ssh, this method is broken and flawed, and is + therefore not recommended. A better solution is to set up slave LDAP + servers for each BDC and a master LDAP server for the PDC.
Any netlogon share has to be replicated from the PDC to the BDC. This can be done manually whenever login scripts are changed, or it can be done automatically together with the smbpasswd synchronization. -

`Example Configuration`

+

`Example Configuration`

Finally, the BDC has to be found by the workstations. This can be done by setting:

 	workgroup = SAMBA
@@ -1514,18 +1520,21 @@ problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to
 be registered by more than one machine. The parameter 'domain master =
 no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS
 name is reserved for the Primary Domain Controller.
-

`Common Errors`

+

`Common Errors`

As this is a rather new area for Samba there are not many examples that we may refer to. Keep watching for updates to this section. -

`Machine Accounts keep expiring, what can I do?`

+

`Machine Accounts keep expiring, what can I do?`

This problem will occur when occur when the passdb (SAM) files are copied from a central server but the local Backup Domain Controllers. Local machine trust account password updates are not copied back to the central server. The newer machine account password is then over written when the SAM is copied from the PDC. The result is that the Domain member machine on start up will find that it's passwords does not match the one now in the database and since the startup security check will now fail, this machine will not allow logon attempts -to procede and the account expiry error will be reported. -

`Can Samba be a Backup Domain Controller to an NT4 PDC?`

+to proceed and the account expiry error will be reported. +

+The solution: use a more robust passdb backend, such as the ldapsam backend, setting up +an slave LDAP server for each BDC, and a master LDAP server for the PDC. +

`Can Samba be a Backup Domain Controller to an NT4 PDC?`

With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully implemented. The Samba Team is working on understanding and implementing the protocols, but this work has not been finished for version 2.2. @@ -1536,7 +1545,7 @@ mechanism has progressed, and some form of NT4 BDC support is expected soon. Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to service logon requests whenever the PDC is down. -

`How do I replicate the smbpasswd file?`

+

`How do I replicate the smbpasswd file?`

Replication of the smbpasswd file is sensitive. It has to be done whenever changes to the SAM are made. Every user's password change is done in the smbpasswd file and has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. @@ -1544,14 +1553,18 @@ has to be replicated to the BDC. So replicating the smbpasswd file very often is As the smbpasswd file contains plain text password equivalents, it must not be sent unencrypted over the wire. The best way to set up smbpasswd replication from the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. -Ssh itself can be set up to accept *only* rsync transfer without requiring the user +Ssh itself can be set up to accept only rsync transfer without requiring the user to type a password. -

`Can I do this all with LDAP?`

+

+As said a few times before, use of this method is broken and flawed. Machine trust +accounts will go out of sync, resulting in a very broken domain. This method is +not recommended. Try using LDAP instead. +

`Can I do this all with LDAP?`

The simple answer is YES. Samba's pdb_ldap code supports binding to a replica LDAP server, and will also follow referrals and rebind to the master if it ever needs to make a modification to the database. (Normally BDCs are read only, so this will not occur often). -

`Chapter 7. Domain Membership`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Jeremy Allison`

Samba Team <jra@samba.org>

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`Andrew Tridgell`

Samba Team <tridge@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

Table of Contents

MS Windows Workstation/Server Machine Trust Accounts

Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member

Domain Member Server

Joining an NT4 type Domain with Samba-3
Why is this better than security = server?

Samba ADS Domain Membership

Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes

Can Not Add Machine Back to Domain
Adding Machine to Domain Fails

+

`Chapter 7. Domain Membership`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Jeremy Allison`

Samba Team <jra@samba.org>

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`Andrew Tridgell`

Samba Team <tridge@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

Table of Contents

MS Windows Workstation/Server Machine Trust Accounts

Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member

Domain Member Server

Joining an NT4 type Domain with Samba-3
Why is this better than security = server?

Samba ADS Domain Membership

Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes

Can Not Add Machine Back to Domain
Adding Machine to Domain Fails

Domain Membership is a subject of vital concern, Samba must be able to participate as a member server in a Microsoft Domain security context, and Samba must be capable of providing Domain machine member trust accounts, @@ -1564,7 +1577,7 @@ within the current MS Windows networking world and particularly in the Unix/Linux networking and administration world, a considerable level of mis-information, incorrect understanding, and a lack of knowledge. Hopefully this chapter will fill the voids. -

`Features and Benefits`

+

`Features and Benefits`

MS Windows workstations and servers that want to participate in domain security need to be made Domain members. Participating in Domain security is often called @@ -1582,7 +1595,7 @@ Domain membership has many advantages: MS Windows workstation users get the benefit of SSO

Domain user access rights and file ownership / access controls can be set - from the single Domain SAM (Security Accounts Management) database + from the single Domain SAM (Security Account Manager) database (works with Domain member servers as well as with MS Windows workstations that are domain members)

@@ -1593,7 +1606,7 @@ Domain membership has many advantages: Domain Member workstations can be better controlled through the use of Policy files (NTConfig.POL) and Desktop Profiles.

- Through the use of logon scripts users can be given transparent access to network + Through the use of logon scripts, users can be given transparent access to network applications that run off application servers

Network administrators gain better application and user access management @@ -1601,7 +1614,7 @@ Domain membership has many advantages: client or server, other than the central Domain database (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an LDAP directory, or via an Active Directory infrastructure) -

`MS Windows Workstation/Server Machine Trust Accounts`

+

`MS Windows Workstation/Server Machine Trust Accounts`

A machine trust account is an account that is used to authenticate a client machine (rather than a user) to the Domain Controller server. In Windows terminology, @@ -1620,11 +1633,11 @@ shared secret with the domain controller. A Windows NT4 PDC stores each machine trust account in the Windows Registry. The introduction of MS Windows 2000 saw the introduction of Active Directory, the new repository for machine trust accounts. -

+ A Samba PDC, however, stores each machine trust account in two parts, as follows: - + A Domain Security Account (stored in the passdb backend that has been configured in the smb.conf file. The precise nature of the account information that is @@ -1644,8 +1657,8 @@ as follows: /etc/passwd. Work is in progress to allow a simplified mode of operation that does not require Unix user accounts, but this may not be a feature of the early releases of Samba-3. - - + + There are three ways to create machine trust accounts: Manual creation from the Unix/Linux command line. Here, both the Samba and @@ -1660,7 +1673,7 @@ There are three ways to create machine trust accounts: created by Samba at the time the client is joined to the domain. (For security, this is the recommended method.) The corresponding Unix account may be created automatically or manually. - Manual Creation of Machine Trust Accounts + Manual Creation of Machine Trust Accounts The first step in manually creating a machine trust account is to manually create the corresponding Unix account in /etc/passwd. This can be done using vipw or another 'add user' command @@ -1692,11 +1705,11 @@ Now that the corresponding Unix account has been created, the next step is to cr the Samba account for the client containing the well-known initial machine trust account password. This can be done using the smbpasswd(8) command as shown here: - -+ + root# smbpasswd -a -m machine_name - > - + + where machine_name is the machine's NetBIOS name. The RID of the new machine account is generated from the UID of the corresponding Unix account. @@ -1709,7 +1722,7 @@ the corresponding Unix account. your domain using a machine with the same NetBIOS name. A PDC inherently trusts members of the domain and will serve out a large degree of user information to such clients. You have been warned! -

`Using NT4 Server Manager to Add Machine Accounts to the Domain`

+

`Using NT4 Server Manager to Add Machine Accounts to the Domain`

If the machine from which you are trying to manage the domain is an MS Windows NT4 workstation then the tool of choice is the package called SRVTOOLS.EXE. @@ -1740,7 +1753,7 @@ Launch the srvmgr.exe (Server Manager for Domains) and fo Add NT Workstation of Server, then enter the machine name in the field provided, then click the Add button. -

`"On-the-Fly" Creation of Machine Trust Accounts`

+

`"On-the-Fly" Creation of Machine Trust Accounts`

The second (and recommended) way of creating machine trust accounts is simply to allow the Samba server to create them as needed when the client is joined to the domain. @@ -1755,10 +1768,10 @@ Below is an example for a RedHat Linux system. [global] # <...remainder of parameters...> add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u -

`Making an MS Windows Workstation or Server a Domain Member`

+

`Making an MS Windows Workstation or Server a Domain Member`

The procedure for making an MS Windows workstation of server a member of the domain varies with the version of Windows: -

`Windows 200x XP Professional`

+

`Windows 200x XP Professional`

When the user elects to make the client a domain member, Windows 200x prompts for an account and password that has privileges to create machine accounts in the domain. A Samba administrative account (i.e., a Samba account that has root privileges on the @@ -1778,7 +1791,7 @@ with the version of Windows: encryption key for setting the password of the machine trust account. The machine trust account will be created on-the-fly, or updated if it already exists. -

`Windows NT4`

+

`Windows NT4`

If the machine trust account was created manually, on the Identification Changes menu enter the domain name, but do not check the box Create a Computer Account in the Domain. @@ -1791,10 +1804,10 @@ with the version of Windows: Domain. In this case, joining the domain proceeds as above for Windows 2000 (i.e., you must supply a Samba administrative account when prompted). -

`Samba`

Joining a samba client to a domain is documented in - the Domain Member chapter. -

`Domain Member Server`

-This mode of server operation involves the samba machine being made a member +

`Samba`

Joining a Samba client to a domain is documented in + the Domain Member Server section of this chapter chapter. +

`Domain Member Server`

+This mode of server operation involves the Samba machine being made a member of a domain security context. This means by definition that all user authentication will be done from a centrally defined authentication regime. The authentication regime may come from an NT3/4 style (old domain technology) @@ -1811,30 +1824,30 @@ Server, etc. Please refer to the Domain Control chapter for more information regarding how to create a domain machine account for a domain member server as well as for information -regarding how to enable the samba domain member machine to join the domain and +regarding how to enable the Samba domain member machine to join the domain and to be fully trusted by it. -

`Joining an NT4 type Domain with Samba-3`

- Table 7.1. Assumptions NetBIOS name: SERV1 Win2K/NT domain name: DOM Domain's PDC NetBIOS name: DOMPDC Domain's BDC NetBIOS names: DOMBDC1 and DOMBDC2 - + Joining an NT4 type Domain with Samba-3 + Table 7.1. Assumptions NetBIOS name: SERV1 Win2K/NT domain name: DOM Domain's PDC NetBIOS name: DOMPDC Domain's BDC NetBIOS names: DOMBDC1 and DOMBDC2 + First, you must edit your smb.conf file to tell Samba it should now use domain security. Change (or add) your security line in the [global] section of your smb.conf to read: - -+ + security = domain - - + + Next change the workgroup line in the [global] section to read: - -+ + workgroup = DOM - - + + as this is the name of the domain we are joining. You must also have the parameter @@ -1844,11 +1857,11 @@ You must also have the parameter password server line in the [global] section to read: - -+ + password server = DOMPDC DOMBDC1 DOMBDC2 - - + + These are the primary and backup domain controllers Samba will attempt to contact in order to authenticate users. Samba will try to contact each of these servers in order, so you may want to @@ -1858,27 +1871,28 @@ among domain controllers. Alternatively, if you want smbd to automatically determine the list of Domain controllers to use for authentication, you may set this line to be: - -+ + password server = * - - -This method, allows Samba to use exactly the same mechanism that NT does. This + + +This method allows Samba to use exactly the same mechanism that NT does. This method either broadcasts or uses a WINS database in order to find domain controllers to authenticate against. In order to actually join the domain, you must run this command: - -+ + root# net join -S DOMPDC -UAdministrator%password - - + + If the -S DOMPDC argument is not given then the domain name will be obtained from smb.conf. As we are joining the domain DOM and the PDC for that domain (the only machine that has write access to the domain SAM database) -is DOMPDC. The Administrator%password is +is DOMPDC, we use it for the -S option. +The Administrator%password is the login name and password for an account which has the necessary privilege to add machines to the domain. If this is successful you will see the message: @@ -1895,7 +1909,7 @@ trust account on the PDC beforehand. This command goes through the machine account password change protocol, then writes the new (random) machine account password for this Samba server into a file in the same directory -in which an smbpasswd file would be stored - normally : +in which an smbpasswd file would be stored - normally: /usr/local/samba/private/secrets.tdb @@ -1906,7 +1920,7 @@ as a shadow password file. Finally, restart your Samba daemons and get ready for clients to begin using domain security! - Why is this better than security = server? + Why is this better than security = server? Currently, domain security in Samba doesn't free you from having to create local Unix users to represent the users attaching to your server. This means that if domain user DOM\fred @@ -1917,8 +1931,8 @@ filesystem. This is very similar to the older Samba security mode where Samba would pass through the authentication request to a Windows NT server in the same way as a Windows 95 or Windows 98 server would. -Please refer to the Winbind -paper for information on a system to automatically +Please refer to the Winbind chapter +for information on a system to automatically assign UNIX uids and gids to Windows NT Domain users and groups. The advantage to domain-level security is that the @@ -1948,27 +1962,27 @@ was first published in the Web magazine LinuxWorld as the article Doing the NIS/NT Samba.

`Samba ADS Domain Membership`

-This is a rough guide to setting up Samba 3.0 with kerberos authentication against a -Windows2000 KDC. -

`Setup your smb.conf`

+This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a +Windows2000 KDC. A familiarity with Kerberos is assumed. +

`Setup your smb.conf`

You must use at least the following 3 options in smb.conf:

 	realm = your.kerberos.REALM
 	security = ADS
 	encrypt passwords = yes
-

+ In case samba can't figure out your ads server using your realm name, use the ads server option in smb.conf: - + ads server = your.kerberos.server - -Note + + Note You do not need a smbpasswd file, and older clients will be authenticated as if security = domain, although it won't do any harm and allows you to have local users not in the domain. It is expected that the above required options will change soon when active directory integration will get better. -

`Setup your /etc/krb5.conf`

+

`Setup your /etc/krb5.conf`

The minimal configuration for krb5.conf is:

 	[realms]
@@ -1981,7 +1995,7 @@ Test your config by doing a kinit
 making sure that your password is accepted by the Win2000 KDC.
 
Note

 The realm must be uppercase or you will get Cannot find KDC for
-requested realm while getting initial credentials error
+requested realm while getting initial credentials error.
 
Note

 Time between the two servers must be synchronized.  You will get a
 kinit(v5): Clock skew too great while getting initial credentials
@@ -1989,70 +2003,70 @@ if the time difference is more than five minutes.
 

 You also must ensure that you can do a reverse DNS lookup on the IP
 address of your KDC. Also, the name that this reverse lookup maps to
-must either be the netbios name of the KDC (ie. the hostname with no
-domain attached) or it can alternatively be the netbios name
+must either be the NetBIOS name of the KDC (ie. the hostname with no
+domain attached) or it can alternatively be the NetBIOS name
 followed by the realm. 
 

 The easiest way to ensure you get this right is to add a 
 /etc/hosts entry mapping the IP address of your KDC to 
-its netbios name. If you don't get this right then you will get a 
+its NetBIOS name. If you don't get this right then you will get a 
 local error when you try to join the realm.
 

-If all you want is kerberos support in smbclient then you can skip
+If all you want is Kerberos support in smbclient then you can skip
 straight to Test with smbclient now. 
 Creating a computer account 
 and testing your servers
-is only needed if you want kerberos support for smbd and winbindd.
-

`Create the computer account`

+is only needed if you want Kerberos support for smbd and winbindd. +

`Create the computer account`

As a user that has write permission on the Samba private directory (usually root) run: -

-	net join -U Administrator%password
-

-Possible errors -ADS support not compiled in Samba must be reconfigured (remove config.cache) and recompiled - (make clean all install) after the kerberos libs and headers are installed. + + root# net join -U Administrator%password + + Possible errors + ADS support not compiled in Samba must be reconfigured (remove config.cache) and recompiled + (make clean all install) after the Kerberos libs and headers are installed. net join prompts for user name You need to login to the domain using kinit USERNAME@REALM. USERNAME must be a user who has rights to add a machine - to the domain. - Test your server setup + to the domain. +

`Test your server setup`

If the join was successful, you will see a new computer account with the NetBIOS name of your Samba server in Active Directory (in the "Computers" folder under Users and Computers.

On a Windows 2000 client try net use * \\server\share. You should -be logged in with kerberos without needing to know a password. If +be logged in with Kerberos without needing to know a password. If this fails then run klist tickets. Did you get a ticket for the server? Does it have an encoding type of DES-CBC-MD5 ?

`Testing with smbclient`

On your Samba server try to login to a Win2000 server or your Samba -server using smbclient and kerberos. Use smbclient as usual, but -specify the -k option to choose kerberos authentication. -

`Notes`

+server using smbclient and Kerberos. Use smbclient as usual, but +specify the -k option to choose Kerberos authentication. +

`Notes`

You must change administrator password at least once after DC install, to create the right encoding types

W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in their defaults DNS setup. Maybe fixed in service packs? -

`Common Errors`

+

`Common Errors`

In the process of adding / deleting / re-adding domain member machine accounts there are -many traps for the unwary player and there are many "little" things that can go wrong. +many traps for the unwary player and there are many “little” things that can go wrong. It is particularly interesting how often subscribers on the samba mailing list have concluded after repeated failed attempts to add a machine account that it is necessary to "re-install" MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type of problem. The real solution is often very simple, and with understanding of how MS Windows networking functions. easily overcome. -

`Can Not Add Machine Back to Domain`

+

`Can Not Add Machine Back to Domain`

Problem: A Windows workstation was reinstalled. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already -exists on the network - I know it doen't. Why is this failing? +exists on the network - I know it doesn't. Why is this failing?

The original name is still in the NetBIOS name cache and must expire after machine account deletion BEFORE adding that same name as a domain member again. The best advice is to delete the old account and then to add the machine with a new name. -

`Adding Machine to Domain Fails`

+

`Adding Machine to Domain Fails`

Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a message that, The machine could not be added at this time, there is a network problem. Please try again later. Why? @@ -2077,12 +2091,12 @@ Possible causes include: then make sure that the machine name you are trying to add can be added using this tool. Useradd on some systems will not allow any upper case characters nor will it allow spaces in the name. -

`Chapter 8. Stand-Alone Servers`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Background

Example Configuration

Reference Documentation Server
Central Print Serving

-Stand-Alone servers are independant of Domain Controllers on the network. +

`Chapter 8. Stand-Alone Servers`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Background

Example Configuration

Reference Documentation Server
Central Print Serving

+Stand-Alone servers are independent of Domain Controllers on the network. They are NOT domain members and function more like workgroup servers. In many cases a stand-alone server is configured with a minimum of security control -with the intent that all data served will be readilly accessible to all users. -

`Features and Benefits`

+with the intent that all data served will be readily accessible to all users. +

`Features and Benefits`

Stand-Alone servers can be as secure or as insecure as needs dictate. They can have simple or complex configurations. Above all, despite the hoopla about Domain security they remain a very common installation. @@ -2099,7 +2113,7 @@ that are queued off a single central server. Everyone needs to be able to print to the printers, there is no need to affect any access controls and no files will be served from the print server. Again a share mode stand-alone server makes a great solution. -

`Background`

+

`Background`

The term stand-alone server means that the server will provide local authentication and access control for all resources that are available from it. In general this means that there will be a @@ -2109,30 +2123,30 @@ USER mode.

No special action is needed other than to create user accounts. Stand-alone servers do NOT provide network logon services. This means that machines that -use this server do NOT perform a domain log onto it. Whatever logon facility -the workstations are subject to is independant of this machine. It is however -necessary to accomodate any network user so that the logon name they use will +use this server do NOT perform a domain logon to it. Whatever logon facility +the workstations are subject to is independent of this machine. It is however +necessary to accommodate any network user so that the logon name they use will be translated (mapped) locally on the stand-alone server to a locally known -user name. There are several ways this cane be done. +user name. There are several ways this can be done.

Samba tends to blur the distinction a little in respect of what is a stand-alone server. This is because the authentication database may be -local or on a remote server, even if from the samba protocol perspective -the samba server is NOT a member of a domain security context. +local or on a remote server, even if from the Samba protocol perspective +the Samba server is NOT a member of a domain security context.

Through the use of PAM (Pluggable Authentication Modules) and nsswitch (the name service switcher) the source of authentication may reside on another server. We would be inclined to call this the authentication server. -This means that the samba server may use the local Unix/Linux system password database +This means that the Samba server may use the local Unix/Linux system password database (/etc/passwd or /etc/shadow), may use a local smbpasswd file, or may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB server for authentication. -

`Example Configuration`

+

`Example Configuration`

The following examples are designed to inspire simplicity. It is too easy to attempt a high level of creativity and to introduce too much complexity in server and network design. -

`Reference Documentation Server`

+

`Reference Documentation Server`

Configuration of a read-only data server that EVERYONE can access is very simple. Here is the smb.conf file that will do this. Assume that all the reference documents are stored in the directory /export, that the documents are owned by a user other than @@ -2155,18 +2169,18 @@ Unix system database. This is a very simple system to administer. In the above example the machine name is set to REFDOCS, the workgroup is set to the name of the local workgroup so that the machine will appear in with systems users are familiar with. The only password backend required is the "guest" backend so as to allow default -unprivilidged account names to be used. Given that there is a WINS server on this network +unprivileged account names to be used. Given that there is a WINS server on this network we do use it. -

`Central Print Serving`

+

`Central Print Serving`

Configuration of a simple print server is very simple if you have all the right tools on your system.

Assumptions:

The print server must require no administration
The print spooling and processing system on our print server will be CUPS. - (Please refer to the chapter on printing for more information). + (Please refer to the CUPS Printing chapter for more information).
- All printers will that the print server will service will be network + All printers that the print server will service will be network printers. They will be correctly configured, by the administrator, in the CUPS environment.
@@ -2175,29 +2189,29 @@ on your system.

In this example our print server will spool all incoming print jobs to /var/spool/samba until the job is ready to be submitted by -samba to the CUPS print processor. Since all incoming connections will be as -the anonymous (guest) user two things will be required: -

Enablement for Anonymous Printing

+Samba to the CUPS print processor. Since all incoming connections will be as +the anonymous (guest) user, two things will be required: + Enabling Anonymous Printing The Unix/Linux system must have a guest account. The default for this is usually the account nobody. To find the correct name to use for your version of Samba do the following: - + $ testparm -s -v | grep "guest account" - + Then make sure that this account exists in your system password database (/etc/passwd). - + The directory into which Samba will spool the file must have write access for the guest account. The following commands will ensure that this directory is available for use: - + root# mkdir /var/spool/samba root# chown nobody.nobody /var/spool/samba root# chmod a+rwt /var/spool/samba - - -+ +

+

 	# Global parameters
 	[global]
 		workgroup = MYGROUP
@@ -2215,42 +2229,42 @@ the anonymous (guest) user two things will be required:
 		printing = cups
 		use client driver = Yes
 		browseable = No
-

-

`Common Errors`

+

`Common Errors`

The greatest mistake so often made is to make a network configuration too complex. It pays to use the simplest solution that will meet the needs of the moment. -

`Chapter 9. MS Windows Network Configuration Guide`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Note

`Note`

+

`Chapter 9. MS Windows Network Configuration Guide`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Note

`Note`

This chapter did not make it into this release. It is planned for the published release of this document. -

`Advanced Configuration`

`Valuable Nuts and Bolts Information`

+

`Advanced Configuration`

`Valuable Nuts and Bolts Information`

Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features. -

Table of Contents

10. Samba / MS Windows Network Browsing Guide

What is Browsing?

WINS - The Windows Internetworking Name Server

NetBIOS over TCP/IP
TCP/IP - without NetBIOS
DNS and Active Directory

How Browsing Functions

Setting up WORKGROUP Browsing
Setting up DOMAIN Browsing
Forcing samba to be the master
Making samba the domain master
Note about broadcast addresses
Multiple interfaces
Use of the Remote Announce parameter
Use of the Remote Browse Sync parameter

Setting up a WINS server
WINS Replication
Static WINS Entries

Helpful Hints

Windows Networking Protocols
Name Resolution Order

Technical Overview of browsing

Browsing support in samba
Problem resolution
Browsing across subnets

How can one flush the Samba NetBIOS name cache without restarting samba?
My client reports "This server is not configured to list shared resources"

11. Account Information Databases

Important Notes About Security
Mapping User Identifiers between MS Windows and Unix

The smbpasswd Command
The pdbedit Command

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon - Users not in Samba SAM
Users are being added to the wrong backend database
auth methods does not work

12. Mapping MS Windows and Unix Groups

Example Configuration

Sample smb.conf add group script
Script to configure Group Mapping

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails

13. File, Directory and Share Access Controls

MS Windows NTFS Comparison with Unix File Systems
Managing Directories
File and Directory Access Control

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

MS Windows Access Control Lists and Unix Interoperability

Share Permissions Management

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask - parameters
Interaction with the standard Samba file attribute - mapping

Users can not write to a public share
I have set force user and samba still makes root the owner of all the files - I touch!

14. File and Record Locking

Opportunistic Locking Overview

MS Windows Opportunistic Locking and Caching Controls

Example Configuration

Workstation Service Entries
Server Service Entries

locking.tdb error messages

15. Securing Samba

Technical Discussion of Protective Measures and Issues

Using host based protection
User based protection
Using interface protection
Using a firewall
Using a IPC$ share deny
NTLMv2 Security

Upgrading Samba

Smbclient works on localhost, but the network is dead
Why can users access home directories of other users?

16. Interdomain Trust Relationships

Native MS Windows NT4 Trusts Configuration

Trust Relationship Background

NT4 as the Trusting Domain (ie. creating the trusted account)
NT4 as the Trusted Domain (ie. creating trusted account's password)

Configuring Samba NT-style Domain Trusts

Samba-3 as the Trusting Domain
Samba-3 as the Trusted Domain

Tell me about Trust Relationships using Samba

17. Hosting a Microsoft Distributed File System tree on Samba

Features and Benefits
Common Errors

18. Classical Printing Support

A simple Configuration to Print with Samba-3

Technical Introduction

What happens if you send a Job from a Client
Printing Related Configuration Parameters
Parameters Recommended for Use
Parameters for Backwards Compatibility
Parameters no longer in use

Verification of "Settings in Use" with testparm
A little Experiment to warn you

Extended Sample Configuration to Print with Samba-3

Detailed Explanation of the Example's Settings

The [global] Section
The [printers] Section
Any [my_printer_name] Section
Print Commands
Default Print Commands for various Unix Print Subsystems
Setting up your own Print Commands

Innovations in Samba Printing since 2.2

Client Drivers on Samba Server for Point'n'Print
The [printer$] Section is removed from Samba-3
Creating the [print$] Share
Parameters in the [print$] Section
Subdirectory Structure in [print$]

Installing Drivers into [print$]

Setting Drivers for existing Printers with a Client GUI
Setting Drivers for existing Printers with -rpcclient

"The Proof of the Pudding lies in the Eating" (Client Driver Insta -Procedure)

The first Client Driver Installation
IMPORTANT! Setting Device Modes on new Printers
Further Client Driver Install Procedures
Always make first Client Connection as root or "printer admin"

Other Gotchas

Setting Default Print Options for the Client Drivers
Supporting large Numbers of Printers
Adding new Printers with the Windows NT APW
Weird Error Message Cannot connect under a -different Name
Be careful when assembling Driver Files
Samba and Printer Ports
Avoiding the most common Misconfigurations of the Client Driver

The Imprints Toolset

What is Imprints?
Creating Printer Driver Packages
The Imprints Server
The Installation Client

Add Network Printers at Logon without User Interaction

The addprinter command

Migration of "Classical" printing to Samba-3

Publishing Printer Information in Active Directory or LDAP

Common Errors and Problems

I give my root password but I don't get access
My printjobs get spooled into the spooling directory, but then get lost

19. CUPS Printing Support in Samba 3.0

Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download

Features and Benefits
Overview

Basic Configuration of CUPS support

Linking of smbd with libcups.so
Simple smb.conf Settings for CUPS
More complex smb.conf Settings for -CUPS

Advanced Configuration

Central spooling vs. "Peer-to-Peer" printing
CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
Driver Installation Methods on Windows Clients
Explicitly enable "raw" printing for -application/octet-stream!
Three familiar Methods for driver upload plus a new one

GDI on Windows -- PostScript on Unix
Windows Drivers, GDI and EMF
Unix Printfile Conversion and GUI Basics
PostScript and Ghostscript
Ghostscript -- the Software RIP for non-PostScript Printers
PostScript Printer Description (PPD) Specification
CUPS can use all Windows-formatted Vendor PPDs
CUPS also uses PPDs for non-PostScript Printers

The CUPS Filtering Architecture

MIME types and CUPS Filters
MIME type Conversion Rules
Filter Requirements
Prefilters
pstops
pstoraster
imagetops and imagetoraster
rasterto [printerspecific]
CUPS Backends
cupsomatic/Foomatic -- how do they fit into the Picture?
The Complete Picture
mime.convs
"Raw" printing
"application/octet-stream" printing
PostScript Printer Descriptions (PPDs) for non-PS Printers
Difference between cupsomatic/foomatic-rip and -native CUPS printing
Examples for filtering Chains
Sources of CUPS drivers / PPDs
Printing with Interface Scripts

Network printing (purely Windows)

From Windows Clients to an NT Print Server
Driver Execution on the Client
Driver Execution on the Server

Network Printing (Windows clients -- UNIX/Samba Print -Servers)

From Windows Clients to a CUPS/Samba Print Server
Samba receiving Jobfiles and passing them to CUPS

Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs

PPDs for non-PS Printers on UNIX
PPDs for non-PS Printers on Windows

Windows Terminal Servers (WTS) as CUPS Clients

Printer Drivers running in "Kernel Mode" cause many -Problems
Workarounds impose Heavy Limitations
CUPS: a "Magical Stone"?
PostScript Drivers with no major problems -- even in Kernel -Mode

Setting up CUPS for driver Download

cupsaddsmb: the unknown Utility
Prepare your smb.conf for -cupsaddsmb
CUPS Package of "PostScript Driver for WinNT/2k/XP"
Recognize the different Driver Files
Acquiring the Adobe Driver Files
ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
Caveats to be considered
What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
Run "cupsaddsmb" (quiet Mode)
Run "cupsaddsmb" with verbose Output
Understanding cupsaddsmb
How to recognize if cupsaddsm completed successfully
cupsaddsmb with a Samba PDC
cupsaddsmb Flowchart
Installing the PostScript Driver on a Client
Avoiding critical PostScript Driver Settings on the -Client

Installing PostScript Driver Files manually (using -rpcclient)

A Check of the rpcclient man Page
Understanding the rpcclient man Page
Producing an Example by querying a Windows Box
What is required for adddriver and setdriver to succeed
Manual Commandline Driver Installation in 15 little Steps
Troubleshooting revisited

The printing *.tdb Files

Trivial DataBase Files
Binary Format
Losing *.tdb Files
Using tdbbackup

CUPS Print Drivers from Linuxprinting.org

foomatic-rip and Foomatic explained
foomatic-rip and Foomatic-PPD Download and Installation

Page Accounting with CUPS

Setting up Quotas
Correct and incorrect Accounting
Adobe and CUPS PostScript Drivers for Windows Clients
The page_log File Syntax
Possible Shortcomings
Future Developments
Other Accounting Tools

Additional Material

Auto-Deletion or Preservation of CUPS Spool Files

CUPS Configuration Settings explained
Pre-conditions
Manual Configuration

When not to use Samba to print to -CUPS

In Case of Trouble.....

Where to find Documentation
How to ask for Help
Where to find Help

Appendix

Printing from CUPS to Windows attached -Printers
More CUPS filtering Chains
Trouble Shooting Guidelines to fix typical Samba printing -Problems
An Overview of the CUPS Printing Processes

20. Stackable VFS modules

Included modules

audit
extd_audit
fake_perms
recycle
netatalk

VFS modules available elsewhere

DatabaseFS
vscan

21. Integrated Logon Support using Winbind

What Winbind Provides

Target Uses

How Winbind Works

Microsoft Remote Procedure Calls
Microsoft Active Directory Services
Name Service Switch
Pluggable Authentication Modules
User and Group ID Allocation
Result Caching

Installation and Configuration

Introduction
Requirements
Testing Things Out

Conclusion

22. Advanced Network Manangement

Remote Server Administration

Remote Desktop Management

Remote Management from NoMachines.Com

Network Logon Script Magic

Adding printers without user intervention

23. System and Account Policies

Creating and Managing System Policies

Windows 9x/Me Policies
Windows NT4 Style Policy Files
MS Windows 200x / XP Professional Policies

Managing Account/User Policies

Samba Editreg Toolset
Windows NT4/200x
Samba PDC

System Startup and Logon Processing Overview

Policy Does Not Work

24. Desktop Profile Management

Roaming Profiles

Samba Configuration for Profile Handling
Windows Client Profile Configuration Information
Sharing Profiles between W9x/Me and NT4/200x/XP workstations
Profile Migration from Windows NT4/200x Server to Samba

Mandatory profiles

Creating/Managing Group Profiles

Default Profile for Windows Users

MS Windows 9x/Me
MS Windows NT4 Workstation
MS Windows 200x/XP

How does one set up roaming profiles for just one (or a few) user/s or group/s?
Can NOT use Roaming Profiles
Changing the default profile

25. PAM based Distributed Authentication

Technical Discussion

PAM Configuration Syntax
Example System Configurations
smb.conf PAM Configuration
Remote CIFS Authentication using winbindd.so
Password Synchronization using pam_smbpass.so

pam_winbind problem

26. Integrating MS Windows networks with Samba

Name Resolution in a pure Unix/Linux world

Background Information

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

Name resolution as used within MS Windows networking

The NetBIOS Name Cache
The LMHOSTS file
HOSTS file
DNS Lookup
WINS Lookup

My Boomerang Won't Come Back
Very Slow Network Connections
Samba server name change problem

27. Unicode/Charsets

Features and Benefits
What are charsets and unicode?
Samba and charsets
Conversion from old names
Japanese charsets

28. Samba Backup Techniques

Note
Features and Benefits

29. High Availability Options

Note

`Chapter 10. Samba / MS Windows Network Browsing Guide`

`John H. Terpstra`

Samba Team <jht@samba.org>

July 5, 1998

Updated: April 21, 2003

+

Table of Contents

10. Samba / MS Windows Network Browsing Guide

What is Browsing?

WINS - The Windows Internetworking Name Server

NetBIOS over TCP/IP
TCP/IP - without NetBIOS
DNS and Active Directory

How Browsing Functions

Setting up WORKGROUP Browsing
Setting up DOMAIN Browsing
Forcing Samba to be the master
Making Samba the domain master
Note about broadcast addresses
Multiple interfaces
Use of the Remote Announce parameter
Use of the Remote Browse Sync parameter

Setting up a WINS server
WINS Replication
Static WINS Entries

Helpful Hints

Windows Networking Protocols
Name Resolution Order

Technical Overview of browsing

Browsing support in Samba
Problem resolution
Browsing across subnets

How can one flush the Samba NetBIOS name cache without restarting Samba?
My client reports "This server is not configured to list shared resources"

11. Account Information Databases

Important Notes About Security
Mapping User Identifiers between MS Windows and Unix

The smbpasswd Command
The pdbedit Command

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon - Users not in Samba SAM
Users are being added to the wrong backend database
auth methods does not work

12. Mapping MS Windows and Unix Groups

Example Configuration

Sample smb.conf add group script
Script to configure Group Mapping

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails

13. File, Directory and Share Access Controls

MS Windows NTFS Comparison with Unix File Systems
Managing Directories
File and Directory Access Control

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

MS Windows Access Control Lists and Unix Interoperability

Share Permissions Management

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask + parameters
Interaction with the standard Samba file attribute + mapping

Users can not write to a public share
I have set force user and Samba still makes root the owner of all the files + I touch!

14. File and Record Locking

Opportunistic Locking Overview

MS Windows Opportunistic Locking and Caching Controls

Example Configuration

Workstation Service Entries
Server Service Entries

locking.tdb error messages

15. Securing Samba

Technical Discussion of Protective Measures and Issues

Using host based protection
User based protection
Using interface protection
Using a firewall
Using a IPC$ share deny
NTLMv2 Security

Upgrading Samba

Smbclient works on localhost, but the network is dead
Why can users access home directories of other users?

16. Interdomain Trust Relationships

Native MS Windows NT4 Trusts Configuration

Trust Relationship Background

NT4 as the Trusting Domain (ie. creating the trusted account)
NT4 as the Trusted Domain (ie. creating trusted account's password)

Configuring Samba NT-style Domain Trusts

Samba-3 as the Trusting Domain
Samba-3 as the Trusted Domain

Tell me about Trust Relationships using Samba

17. Hosting a Microsoft Distributed File System tree on Samba

Features and Benefits
Common Errors

18. Classical Printing Support

A simple Configuration to Print with Samba-3

Technical Introduction

What happens if you send a Job from a Client
Printing Related Configuration Parameters
Parameters Recommended for Use
Parameters for Backwards Compatibility
Parameters no longer in use

Verification of "Settings in Use" with testparm
A little Experiment to warn you

Extended Sample Configuration to Print with Samba-3

Detailed Explanation of the Example's Settings

The [global] Section
The [printers] Section
Any [my_printer_name] Section
Print Commands
Default Print Commands for various Unix Print Subsystems
Setting up your own Print Commands

Innovations in Samba Printing since 2.2

Client Drivers on Samba Server for Point'n'Print
The [printer$] Section is removed from Samba-3
Creating the [print$] Share
Parameters in the [print$] Section
Subdirectory Structure in [print$]

Installing Drivers into [print$]

Setting Drivers for existing Printers with a Client GUI
Setting Drivers for existing Printers with +rpcclient

"The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure)

The first Client Driver Installation
IMPORTANT! Setting Device Modes on new Printers
Further Client Driver Install Procedures
Always make first Client Connection as root or "printer admin"

Other Gotchas

Setting Default Print Options for the Client Drivers
Supporting large Numbers of Printers
Adding new Printers with the Windows NT APW
Weird Error Message Cannot connect under a +different Name
Be careful when assembling Driver Files
Samba and Printer Ports
Avoiding the most common Misconfigurations of the Client Driver

The Imprints Toolset

What is Imprints?
Creating Printer Driver Packages
The Imprints Server
The Installation Client

Add Network Printers at Logon without User Interaction

The addprinter command

Migration of "Classical" printing to Samba-3

Publishing Printer Information in Active Directory or LDAP

Common Errors and Problems

I give my root password but I don't get access
My printjobs get spooled into the spooling directory, but then get lost

19. CUPS Printing Support in Samba 3.0

Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download

Features and Benefits
Overview

Basic Configuration of CUPS support

Linking of smbd with libcups.so
Simple smb.conf Settings for CUPS
More complex smb.conf Settings for +CUPS

Advanced Configuration

Central spooling vs. "Peer-to-Peer" printing
CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
Driver Installation Methods on Windows Clients
Explicitly enable "raw" printing for +application/octet-stream!
Three familiar Methods for driver upload plus a new one

GDI on Windows -- PostScript on Unix
Windows Drivers, GDI and EMF
Unix Printfile Conversion and GUI Basics
PostScript and Ghostscript
Ghostscript -- the Software RIP for non-PostScript Printers
PostScript Printer Description (PPD) Specification
CUPS can use all Windows-formatted Vendor PPDs
CUPS also uses PPDs for non-PostScript Printers

The CUPS Filtering Architecture

MIME types and CUPS Filters
MIME type Conversion Rules
Filter Requirements
Prefilters
pstops
pstoraster
imagetops and imagetoraster
rasterto [printers specific]
CUPS Backends
cupsomatic/Foomatic -- how do they fit into the Picture?
The Complete Picture
mime.convs
"Raw" printing
"application/octet-stream" printing
PostScript Printer Descriptions (PPDs) for non-PS Printers
Difference between cupsomatic/foomatic-rip and +native CUPS printing
Examples for filtering Chains
Sources of CUPS drivers / PPDs
Printing with Interface Scripts

Network printing (purely Windows)

From Windows Clients to an NT Print Server
Driver Execution on the Client
Driver Execution on the Server

Network Printing (Windows clients -- UNIX/Samba Print +Servers)

From Windows Clients to a CUPS/Samba Print Server
Samba receiving Jobfiles and passing them to CUPS

Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs

PPDs for non-PS Printers on UNIX
PPDs for non-PS Printers on Windows

Windows Terminal Servers (WTS) as CUPS Clients

Printer Drivers running in "Kernel Mode" cause many +Problems
Workarounds impose Heavy Limitations
CUPS: a "Magical Stone"?
PostScript Drivers with no major problems -- even in Kernel +Mode

Setting up CUPS for driver Download

cupsaddsmb: the unknown Utility
Prepare your smb.conf for +cupsaddsmb
CUPS Package of "PostScript Driver for WinNT/2k/XP"
Recognize the different Driver Files
Acquiring the Adobe Driver Files
ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
Caveats to be considered
What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?
Run "cupsaddsmb" (quiet Mode)
Run "cupsaddsmb" with verbose Output
Understanding cupsaddsmb
How to recognize if cupsaddsm completed successfully
cupsaddsmb with a Samba PDC
cupsaddsmb Flowchart
Installing the PostScript Driver on a Client
Avoiding critical PostScript Driver Settings on the +Client

Installing PostScript Driver Files manually (using +rpcclient)

A Check of the rpcclient man Page
Understanding the rpcclient man Page
Producing an Example by querying a Windows Box
What is required for adddriver and setdriver to succeed
Manual Commandline Driver Installation in 15 little Steps
Troubleshooting revisited

The printing *.tdb Files

Trivial DataBase Files
Binary Format
Losing *.tdb Files
Using tdbbackup

CUPS Print Drivers from Linuxprinting.org

foomatic-rip and Foomatic explained
foomatic-rip and Foomatic-PPD Download and Installation

Page Accounting with CUPS

Setting up Quotas
Correct and incorrect Accounting
Adobe and CUPS PostScript Drivers for Windows Clients
The page_log File Syntax
Possible Shortcomings
Future Developments
Other Accounting Tools

Additional Material

Auto-Deletion or Preservation of CUPS Spool Files

CUPS Configuration Settings explained
Pre-conditions
Manual Configuration

When not to use Samba to print to +CUPS

In Case of Trouble.....

Where to find Documentation
How to ask for Help
Where to find Help

Appendix

Printing from CUPS to Windows attached +Printers
More CUPS filtering Chains
Trouble Shooting Guidelines to fix typical Samba printing +Problems
An Overview of the CUPS Printing Processes

20. Stackable VFS modules

Included modules

audit
extd_audit
fake_perms
recycle
netatalk

VFS modules available elsewhere

DatabaseFS
vscan

21. Integrated Logon Support using Winbind

What Winbind Provides

Target Uses

How Winbind Works

Microsoft Remote Procedure Calls
Microsoft Active Directory Services
Name Service Switch
Pluggable Authentication Modules
User and Group ID Allocation
Result Caching

Installation and Configuration

Introduction
Requirements
Testing Things Out

Conclusion

22. Advanced Network Management

Remote Server Administration

Remote Desktop Management

Remote Management from NoMachines.Com

Network Logon Script Magic

Adding printers without user intervention

23. System and Account Policies

Creating and Managing System Policies

Windows 9x/Me Policies
Windows NT4 Style Policy Files
MS Windows 200x / XP Professional Policies

Managing Account/User Policies

Samba Editreg Toolset
Windows NT4/200x
Samba PDC

System Startup and Logon Processing Overview

Policy Does Not Work

24. Desktop Profile Management

Roaming Profiles

Samba Configuration for Profile Handling
Windows Client Profile Configuration Information
Sharing Profiles between W9x/Me and NT4/200x/XP workstations
Profile Migration from Windows NT4/200x Server to Samba

Mandatory profiles

Creating/Managing Group Profiles

Default Profile for Windows Users

MS Windows 9x/Me
MS Windows NT4 Workstation
MS Windows 200x/XP

How does one set up roaming profiles for just one (or a few) user/s or group/s?
Can NOT use Roaming Profiles
Changing the default profile

25. PAM based Distributed Authentication

Technical Discussion

PAM Configuration Syntax
Example System Configurations
smb.conf PAM Configuration
Remote CIFS Authentication using winbindd.so
Password Synchronization using pam_smbpass.so

pam_winbind problem

26. Integrating MS Windows networks with Samba

Name Resolution in a pure Unix/Linux world

Background Information

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

Name resolution as used within MS Windows networking

The NetBIOS Name Cache
The LMHOSTS file
HOSTS file
DNS Lookup
WINS Lookup

My Boomerang Won't Come Back
Very Slow Network Connections
Samba server name change problem

27. Unicode/Charsets

Features and Benefits
What are charsets and unicode?
Samba and charsets
Conversion from old names
Japanese charsets

28. Samba Backup Techniques

Note
Features and Benefits

29. High Availability Options

Note

`Chapter 10. Samba / MS Windows Network Browsing Guide`

`John H. Terpstra`

Samba Team <jht@samba.org>

July 5, 1998

Updated: April 21, 2003

This document contains detailed information as well as a fast track guide to implementing browsing across subnets and / or across workgroups (or domains). -WINS is the best tool for resolution of NetBIOS names to IP addesses. WINS is +WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is NOT involved in browse list handling except by way of name to address resolution.

`Note`

MS Windows 2000 and later can be configured to operate with NO NetBIOS @@ -2258,15 +2272,15 @@ over TCP/IP. Samba-3 and later also supports this mode of operation. When the use of NetBIOS over TCP/IP has been disabled then the primary means for resolution of MS Windows machine names is via DNS and Active Directory. The following information assumes that your site is running NetBIOS over TCP/IP. -

`Features and Benefits`

+

`Features and Benefits`

Someone once referred to the past in terms of: They were the worst of times, they were the best of times. The more we look back, them more we long for what was and hope it never returns!.

-For many MS Windows network administrators that statement sums up their feelings about -NetBIOS networking precisely. For those who mastered NetBIOS networking it's fickle -nature was just par for the course. For those who never quite managed to tame it's -lusty features NetBIOS is like Paterson's Curse. +For many MS Windows network administrators, that statement sums up their feelings about +NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle +nature was just par for the course. For those who never quite managed to tame its +lusty features, NetBIOS is like Paterson's Curse.

For those not familiar with botanical problems in Australia: Paterson's curse, Echium plantagineum, was introduced to Australia from Europe during the mid-nineteenth @@ -2276,7 +2290,7 @@ ability to germinate at any time of year, given the right conditions, are some o features which make it such a persistent weed.

In this chapter we explore vital aspects of SMB (Server Message Block) networking with -a particular focus on SMB as implmented through running NetBIOS (Network Basic +a particular focus on SMB as implemented through running NetBIOS (Network Basic Input / Output System) over TCP/IP. Since Samba does NOT implement SMB or NetBIOS over any other protocols we need to know how to configure our network environment and simply remember to use nothing but TCP/IP on all our MS Windows network clients. @@ -2291,7 +2305,7 @@ support for NetBIOS, in which case WINS is of no relevance. Samba-3 supports thi

For those networks on which NetBIOS has been disabled (ie: WINS is NOT required) the use of DNS is necessary for host name resolution. -

`What is Browsing?`

+

`What is Browsing?`

To most people browsing means that they can see the MS Windows and Samba servers in the Network Neighborhood, and when the computer icon for a particular server is clicked, it opens up and shows the shares and printers available on the target server. @@ -2299,7 +2313,7 @@ clicked, it opens up and shows the shares and printers available on the target s What seems so simple is in fact a very complex interaction of different technologies. The technologies (or methods) employed in making all of this work includes:

MS Windows machines register their presence to the network

Machines announce themselves to other machines on the network

One or more machine on the network collates the local announcements

The client machine finds the machine that has the collated list of machines

The client machine is able to resolve the machine names to IP addresses

The client machine is able to connect to a target machine

-The samba application that controls/manages browse list management and name resolution is +The Samba application that controls browse list management and name resolution is called nmbd. The configuration parameters involved in nmbd's operation are:

 		
@@ -2326,18 +2340,18 @@ called nmbd. The configuration parameters involved in
 		* wins support
 		  wins hook

-For Samba the WINS Server and WINS Support are mutually exclusive options. Those marked with +For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with an '*' are the only options that commonly MAY need to be modified. Even if not one of these -parameters is set nmbd will still do it's job. -

`Discussion`

+parameters is set nmbd will still do it's job. +

`Discussion`

Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging. SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports -NetBIOS over TCP/IP for backwards compatibility. Microsoft are intent on phasing out NetBIOS +NetBIOS over TCP/IP for backwards compatibility. Microsoft is intent on phasing out NetBIOS support. -

`NetBIOS over TCP/IP`

+

`NetBIOS over TCP/IP`

Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP. MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to -affect browse list management. When running NetBIOS over TCP/IP this uses UDP based messaging. +affect browse list management. When running NetBIOS over TCP/IP, this uses UDP based messaging. UDP messages can be broadcast or unicast.

Normally, only unicast UDP messaging can be forwarded by routers. The @@ -2346,7 +2360,7 @@ to remote network segments via unicast UDP. Similarly, the remote browse sync parameter of smb.conf implements browse list collation using unicast UDP.

-Secondly, in those networks where Samba is the only SMB server technology +Secondly, in those networks where Samba is the only SMB server technology, wherever possible nmbd should be configured on one (1) machine as the WINS server. This makes it easy to manage the browsing environment. If each network segment is configured with it's own Samba WINS server, then the only way to @@ -2361,9 +2375,9 @@ the use of the remote announce and the As of Samba 3 WINS replication is being worked on. The bulk of the code has been committed, but it still needs maturation. This is NOT a supported feature of the Samba-3.0.0 release. Hopefully, this will become a supported feature -of one of the samba-3 release series. +of one of the Samba-3 release series.

-Right now samba WINS does not support MS-WINS replication. This means that +Right now Samba WINS does not support MS-WINS replication. This means that when setting up Samba as a WINS server there must only be one nmbd configured as a WINS server on the network. Some sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used @@ -2378,7 +2392,7 @@ Lastly, take note that browse lists are a collection of unreliable broadcast messages that are repeated at intervals of not more than 15 minutes. This means that it will take time to establish a browse list and it can take up to 45 minutes to stabilise, particularly across network segments. -

`TCP/IP - without NetBIOS`

+

`TCP/IP - without NetBIOS`

All TCP/IP using systems use various forms of host name resolution. The primary methods for TCP/IP hostname resolutions involves either a static file (/etc/hosts ) or DNS (the Domain Name System). DNS is the technology that makes @@ -2407,14 +2421,14 @@ force register with a Dynamic DNS server in Windows 200x / XP using: ipconfig /registerdns

With Active Directory (ADS), a correctly functioning DNS server is absolutely -essential. In the absence of a working DNS server that has been correctly configured +essential. In the absence of a working DNS server that has been correctly configured, MS Windows clients and servers will be totally unable to locate each other, consequently network services will be severely impaired.

The use of Dynamic DNS is highly recommended with Active Directory, in which case the use of BIND9 is preferred for it's ability to adequately support the SRV (service) records that are needed for Active Directory. -

`DNS and Active Directory`

+

`DNS and Active Directory`

Occasionally we hear from Unix network administrators who want to use a Unix based Dynamic DNS server in place of the Microsoft DNS server. While this might be desirable to some, the MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible @@ -2434,9 +2448,9 @@ The following are some of the default service records that Active Directory requ Entry used by MS Windows clients to locate machines using the Global Unique Identifier.

_ldap._tcp.Site.gc.ms-dcs.DomainTree

- Used by MS Windows clients to locate site configuration dependant + Used by MS Windows clients to locate site configuration dependent Global Catalog server. -

`How Browsing Functions`

+

`How Browsing Functions`

MS Windows machines register their NetBIOS names (ie: the machine name for each service type in operation) on start up. The exact method by which this name registration @@ -2444,11 +2458,11 @@ takes place is determined by whether or not the MS Windows client/server has been given a WINS server address, whether or not LMHOSTS lookup is enabled, or if DNS for NetBIOS name resolution is enabled, etc.

-In the case where there is no WINS server all name registrations as +In the case where there is no WINS server, all name registrations as well as name lookups are done by UDP broadcast. This isolates name resolution to the local subnet, unless LMHOSTS is used to list all names and IP addresses. In such situations Samba provides a means by -which the samba server name may be forcibly injected into the browse +which the Samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the remote announce parameter).

@@ -2477,7 +2491,7 @@ Any configuration that breaks name resolution and/or browsing intrinsics will annoy users because they will have to put up with protracted inability to use the network services.

-Samba supports a feature that allows forced synchonisation +Samba supports a feature that allows forced synchronisation of browse lists across routed networks using the remote browse sync parameter in the smb.conf file. This causes Samba to contact the local master browser on a remote network and @@ -2491,7 +2505,7 @@ words, for cross subnet browsing to function correctly it is essential that a name to address resolution mechanism be provided. This mechanism could be via DNS, /etc/hosts, and so on. -

`Setting up WORKGROUP Browsing`

+

`Setting up WORKGROUP Browsing`

To set up cross subnet browsing on a network containing machines in up to be in a WORKGROUP, not an NT Domain you need to set up one Samba server to be the Domain Master Browser (note that this is *NOT* @@ -2501,7 +2515,7 @@ to collate the browse lists from local master browsers on all the subnets that have a machine participating in the workgroup. Without one machine configured as a domain master browser each subnet would be an isolated workgroup, unable to see any machines on any other -subnet. It is the presense of a domain master browser that makes +subnet. It is the presence of a domain master browser that makes cross subnet browsing possible for a workgroup.

In an WORKGROUP environment the domain master browser must be a @@ -2509,22 +2523,22 @@ Samba server, and there must only be one domain master browser per workgroup name. To set up a Samba server as a domain master browser, set the following option in the [global] section of the smb.conf file : -

-+ + domain master = yes - - + + The domain master browser should also preferrably be the local master browser for its own subnet. In order to achieve this set the following options in the [global] section of the smb.conf file : - -+ + domain master = yes local master = yes preferred master = yes os level = 65 - - + + The domain master browser may be the same machine as the WINS server, if you require. @@ -2536,14 +2550,14 @@ tend to get rebooted more often, so it's not such a good idea to use these). To make a Samba server a local master browser set the following options in the [global] section of the smb.conf file : - -+ + domain master = no local master = yes preferred master = yes os level = 65 - - + + Do not do this for more than one Samba server on each subnet, or they will war with each other over which is to be the local master browser. @@ -2558,18 +2572,18 @@ be the local master browser then you can disable Samba from becoming a local master browser by setting the following options in the [global] section of the smb.conf file : - -+ + domain master = no local master = no preferred master = no os level = 0 - -

`Setting up DOMAIN Browsing`

+

`Setting up DOMAIN Browsing`

If you are adding Samba servers to a Windows NT Domain then you must not set up a Samba server as a domain master browser. -By default, a Windows NT Primary Domain Controller for a Domain -name is also the Domain master browser for that name, and many +By default, a Windows NT Primary Domain Controller for a domain +is also the Domain master browser for that domain, and many things will break if a Samba server registers the Domain master browser NetBIOS name (DOMAIN<1B>) with WINS instead of the PDC. @@ -2579,20 +2593,20 @@ you may set up Samba servers as local master browsers as described. To make a Samba server a local master browser set the following options in the [global] section of the smb.conf file : -

-+ + domain master = no local master = yes preferred master = yes os level = 65 - - + + If you wish to have a Samba server fight the election with machines on the same subnet you may set the os level parameter to lower levels. By doing this you can tune the order of machines that will become local master browsers if they are running. For -more details on this see the section -Forcing samba to be the master browser +more details on this see the section +Forcing Samba to be the master browser below. If you have Windows NT machines that are members of the domain @@ -2601,14 +2615,14 @@ you can disable Samba from taking part in browser elections and ever becoming a local master browser by setting following options in the [global] section of the smb.conf file : - -+ + domain master = no local master = no preferred master = no os level = 0 - -

`Forcing samba to be the master`

+

`Forcing Samba to be the master`

Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters which determine what precedence (bias) a host should have in the @@ -2623,48 +2637,48 @@ samba systems!) A os level of 2 would make it beat WfWg and Win95, but not MS Windows NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.

The maximum os level is 255

-If you want samba to force an election on startup, then set the +If you want Samba to force an election on startup, then set the preferred master global option in smb.conf to yes. Samba will then have a slight advantage over other potential master browsers that are not preferred master browsers. Use this parameter with -care, as if you have two hosts (whether they are windows 95 or NT or -samba) on the same local subnet both set with preferred master to +care, as if you have two hosts (whether they are Windows 95 or NT or +Samba) on the same local subnet both set with preferred master to yes, then periodically and continually they will force an election in order to become the local master browser.

- If you want samba to be a domain master browser, then it is +If you want Samba to be a domain master browser, then it is recommended that you also set preferred master to yes, because -samba will not become a domain master browser for the whole of your +Samba will not become a domain master browser for the whole of your LAN or WAN if it is not also a local master browser on its own broadcast isolated subnet.

-It is possible to configure two samba servers to attempt to become +It is possible to configure two Samba servers to attempt to become the domain master browser for a domain. The first server that comes -up will be the domain master browser. All other samba servers will +up will be the domain master browser. All other Samba servers will attempt to become the domain master browser every 5 minutes. They -will find that another samba server is already the domain master +will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should the current domain master browser fail. -

`Making samba the domain master`

+

`Making Samba the domain master`

The domain master is responsible for collating the browse lists of multiple subnets so that browsing can occur between subnets. You can -make samba act as the domain master by setting domain master = yes +make Samba act as the domain master by setting domain master = yes in smb.conf. By default it will not be a domain master.

Note that you should not set Samba to be the domain master for a workgroup that has the same name as an NT Domain.

-When samba is the domain master and the master browser it will listen +When Samba is the domain master and the master browser, it will listen for master announcements (made roughly every twelve minutes) from local master browsers on other subnets and then contact them to synchronise browse lists.

-If you want samba to be the domain master then I suggest you also set +If you want Samba to be the domain master then I suggest you also set the os level high enough to make sure it wins elections, and set -preferred master to yes, to get samba to force an election on +preferred master to yes, to get Samba to force an election on startup.

-Note that all your servers (including samba) and clients should be +Note that all your servers (including Samba) and clients should be using a WINS server to resolve NetBIOS names. If your clients are only using broadcasting to resolve NetBIOS names, then two things will occur:

@@ -2675,11 +2689,11 @@ using broadcasting to resolve NetBIOS names, then two things will occur: a user attempts to access a host in that list, it will be unable to resolve the NetBIOS name of that host.

-If, however, both samba and your clients are using a WINS server, then: +If, however, both Samba and your clients are using a WINS server, then:

your local master browsers will contact the WINS server and, as long as - samba has registered that it is a domain master browser with the WINS - server, your local master browser will receive samba's ip address + Samba has registered that it is a domain master browser with the WINS + server, your local master browser will receive Samba's IP address as its domain master browser.
when a client receives a domain-wide browse list, and a user attempts @@ -2687,37 +2701,37 @@ If, however, both samba and your clients are using a WINS server, then: resolve the NetBIOS name of that host. as long as that host has registered its NetBIOS name with the same WINS server, the user will be able to see that host. -

`Note about broadcast addresses`

+

`Note about broadcast addresses`

If your network uses a "0" based broadcast address (for example if it ends in a 0) then you will strike problems. Windows for Workgroups does not seem to support a 0's broadcast and you will probably find that browsing and name lookups won't work. -

`Multiple interfaces`

+

`Multiple interfaces`

Samba now supports machines with multiple network interfaces. If you have multiple interfaces then you will need to use the interfaces option in smb.conf to configure them. -

`Use of the Remote Announce parameter`

+

`Use of the Remote Announce parameter`

The remote announce parameter of smb.conf can be used to forcibly ensure that all the NetBIOS names on a network get announced to a remote network. The syntax of the remote announce parameter is: -

+
 	remote announce = a.b.c.d [e.f.g.h] ...
-

-_or_
-+

+or
+
 	remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...
-

+

where: -

a.b.c.d and + a.b.c.d and e.f.g.h is either the LMB (Local Master Browser) IP address -or the broadcst address of the remote network. +or the broadcast address of the remote network. ie: the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask is assumed to be 24 bits (255.255.255.0). When the remote announcement is made to the broadcast -address of the remote network every host will receive +address of the remote network, every host will receive our announcements. This is noisy and therefore undesirable but may be necessary if we do NOT know the IP address of the remote LMB. WORKGROUP is optional and can be either our own workgroup @@ -2726,28 +2740,28 @@ workgroup name of the remote network then our NetBIOS machine names will end up looking like they belong to that workgroup, this may cause name resolution problems and should be avoided. - -

`Use of the Remote Browse Sync parameter`

+

`Use of the Remote Browse Sync parameter`

The remote browse sync parameter of smb.conf is used to announce to -another LMB that it must synchronise it's NetBIOS name list with our +another LMB that it must synchronise its NetBIOS name list with our Samba LMB. It works ONLY if the Samba server that has this option is -simultaneously the LMB on it's network segment. -

+simultaneously the LMB on its network segment. + The syntax of the remote browse sync parameter is: - + remote browse sync = a.b.c.d - + where a.b.c.d is either the IP address of the remote LMB or else is the network broadcast address of the remote segment. -

`WINS - The Windows Internetworking Name Server`

-Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly +

`WINS - The Windows Internetworking Name Server`

+Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly recommended. Every NetBIOS machine registers its name together with a -name_type value for each of of several types of service it has available. +name_type value for each of several types of service it has available. eg: It registers its name directly as a unique (the type 0x03) name. -It also registers its name if it is running the lanmanager compatible +It also registers its name if it is running the LanManager compatible server service (used to make shares and printers available to other users) by registering the server (the type 0x20) name.

@@ -2762,7 +2776,7 @@ that wants to log onto the network can ask the WINS server for a list of all names that have registered the NetLogon service name_type. This saves broadcast traffic and greatly expedites logon processing. Since broadcast name resolution can not be used across network segments this type of -information can only be provided via WINS _or_ via statically configured +information can only be provided via WINS or via statically configured lmhosts files that must reside on all clients in the absence of WINS.

@@ -2793,16 +2807,16 @@ Never use both wins support = yes together with wins server = a.b.c.d particularly not using it's own IP address. Specifying both will cause nmbd to refuse to start! -

`Setting up a WINS server`

+

`Setting up a WINS server`

Either a Samba machine or a Windows NT Server machine may be set up as a WINS server. To set a Samba machine to be a WINS server you must add the following option to the smb.conf file on the selected machine : in the [globals] section add the line -

-+ + wins support = yes - - + + Versions of Samba prior to 1.9.17 had this parameter default to yes. If you have any older versions of Samba on your network it is strongly suggested you upgrade to a recent version, or at the very @@ -2811,7 +2825,7 @@ least set the parameter to 'no' on all these machines. Machines with wins support = yes will keep a list of all NetBIOS names registered with them, acting as a DNS for NetBIOS names. -You should set up only ONE wins server. Do NOT set the +You should set up only ONE WINS server. Do NOT set the wins support = yes option on more than one Samba server. @@ -2819,7 +2833,7 @@ To set up a Windows NT Server as a WINS server you need to set up the WINS service - see your NT documentation for details. Note that Windows NT WINS Servers can replicate to each other, allowing more than one to be set up in a complex subnet environment. As Microsoft -refuse to document these replication protocols Samba cannot currently +refuses to document these replication protocols, Samba cannot currently participate in these replications. It is possible in the future that a Samba->Samba WINS replication protocol may be defined, in which case more than one Samba machine could be set up as a WINS server @@ -2834,11 +2848,11 @@ the Control Panel->Network->Protocols->TCP->W in Windows 95 or Windows NT. To tell a Samba server the IP address of the WINS server add the following line to the [global] section of all smb.conf files : - -+ + wins server = <name or IP address> - - + + where <name or IP address> is either the DNS name of the WINS server machine or its IP address. @@ -2853,22 +2867,45 @@ The first details setting up cross subnet browsing on a network containing Windows 95, Samba and Windows NT machines that are not configured as part of a Windows NT Domain. The second details setting up cross subnet browsing on networks that contain NT Domains. -

`WINS Replication`

+

`WINS Replication`

Samba-3 permits WINS replication through the use of the wrepld utility. This tool is not currently capable of being used as it is still in active development. As soon as this tool becomes moderately functional we will prepare man pages and enhance this section of the documentation to provide usage and technical details. -

`Static WINS Entries`

-New to Samba-3 is a tool called winsedit that may be used to add -static WINS entries to the WINS database. This tool can be used also to modify entries -existing in the WINS database. -

-The development of the winsedit tool was made necessary due to the migration -of the older style wins.dat file into a new tdb binary backend data store. -

`Helpful Hints`

+

`Static WINS Entries`

+Adding static entries to your Samba-3 WINS server is actually fairly easy. +All you have to do is add a line to wins.dat, typically +located in /usr/local/samba/var/locks. +

+Entries in wins.dat take the form of + +

+"NAME#TYPE" TTL ADDRESS+ FLAGS
+

+ +where NAME is the NetBIOS name, TYPE is the NetBIOS type, TTL is the +time-to-live as an absolute time in seconds, ADDRESS+ is one or more +addresses corresponding to the registration and FLAGS are the NetBIOS +flags for the registration. +

+A typical dynamic entry looks like: +

+"MADMAN#03" 1055298378 192.168.1.2 66R
+

+ +To make it static, all that has to be done is set the TTL to 0: + +

+"MADMAN#03" 0 192.168.1.2 66R
+

+

+Though this method works with early Samba-3 versions, there's a +possibility that it may change in future versions if WINS replication +is added. +

`Helpful Hints`

The following hints should be carefully considered as they are stumbling points for many new network administrators. -

`Windows Networking Protocols`

`Warning`

+

`Windows Networking Protocols`

`Warning`

Do NOT use more than one (1) protocol on MS Windows machines

A very common cause of browsing problems results from installing more than @@ -2876,7 +2913,7 @@ one protocol on an MS Windows machine.

Every NetBIOS machine takes part in a process of electing the LMB (and DMB) every 15 minutes. A set of election criteria is used to determine the order -of precidence for winning this election process. A machine running Samba or +of precedence for winning this election process. A machine running Samba or Windows NT will be biased so that the most suitable machine will predictably win and thus retain it's role.

@@ -2898,29 +2935,32 @@ differently from MS Windows NT4. Generally, where a server does NOT support the newer or extended protocol, these will fall back to the NT4 protocols.

The safest rule of all to follow it this - USE ONLY ONE PROTOCOL! -

`Name Resolution Order`

+

`Name Resolution Order`

Resolution of NetBIOS names to IP addresses can take place using a number of methods. The only ones that can provide NetBIOS name_type information -are:

WINS: the best tool!

LMHOSTS: is static and hard to maintain.

Broadcast: uses UDP and can not resolve names across remote segments.

-Alternative means of name resolution includes:

/etc/hosts: is static, hard to maintain, and lacks name_type info

DNS: is a good choice but lacks essential name_type info.

+are: + WINS: the best tool! LMHOSTS: is static and hard to maintain. Broadcast: uses UDP and can not resolve names across remote segments. +Alternative means of name resolution includes: + /etc/hosts: is static, hard to maintain, and lacks name_type info DNS: is a good choice but lacks essential name_type info. Many sites want to restrict DNS lookups and want to avoid broadcast name -resolution traffic. The "name resolve order" parameter is of great help here. -The syntax of the "name resolve order" parameter is: - +resolution traffic. The name resolve order parameter is +of great help here. The syntax of the name resolve order +parameter is: + name resolve order = wins lmhosts bcast host - -_or_ -+ +or + name resolve order = wins lmhosts (eliminates bcast and host) - + The default is: - -name resolve order = host lmhost wins bcast - + +name resolve order = host lmhost wins bcast + where "host" refers the the native methods used by the Unix system to implement the gethostbyname() function call. This is normally controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. -

`Technical Overview of browsing`

+

`Technical Overview of browsing`

SMB networking provides a mechanism by which clients can access a list of machines in a network, a so-called browse list. This list contains machines that are ready to offer file and/or print services @@ -2931,7 +2971,7 @@ browsing has been problematic for some Samba users, hence this document.

MS Windows 2000 and later, as with Samba 3 and later, can be -configured to not use NetBIOS over TCP/IP. When configured this way +configured to not use NetBIOS over TCP/IP. When configured this way, it is imperative that name resolution (using DNS/LDAP/ADS) be correctly configured and operative. Browsing will NOT work if name resolution from SMB machine names to IP addresses does not function correctly. @@ -2940,7 +2980,7 @@ Where NetBIOS over TCP/IP is enabled use of a WINS server is highly recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. WINS allows remote segment clients to obtain NetBIOS name_type information that can NOT be provided by any other means of name resolution. -

`Browsing support in samba`

+

`Browsing support in Samba`

Samba facilitates browsing. The browsing is supported by nmbd and is also controlled by options in the smb.conf file. Samba can act as a local browse master for a workgroup and the ability @@ -2950,7 +2990,7 @@ Samba can also act as a domain master browser for a workgroup. This means that it will collate lists from local browse masters into a wide area network server list. In order for browse clients to resolve the names they may find in this list, it is recommended that -both samba and your clients use a WINS server. +both Samba and your clients use a WINS server.

Note that you should NOT set Samba to be the domain master for a workgroup that has the same name as an NT Domain: on each wide area @@ -2959,11 +2999,11 @@ regardless of whether it is NT, Samba or any other type of domain master that is providing this service.

`Note`

Nmbd can be configured as a WINS server, but it is not -necessary to specifically use samba as your WINS server. MS Windows +necessary to specifically use Samba as your WINS server. MS Windows NT4, Server or Advanced Server 2000 or 2003 can be configured as -your WINS server. In a mixed NT/2000/2003 server and samba environment on +your WINS server. In a mixed NT/2000/2003 server and Samba environment on a Wide Area Network, it is recommended that you use the Microsoft -WINS server capabilities. In a samba-only environment, it is +WINS server capabilities. In a Samba-only environment, it is recommended that you use one and only one Samba server as your WINS server.

To get browsing to work you need to run nmbd as usual, but will need @@ -2975,8 +3015,8 @@ browsing on another subnet. It is recommended that this option is only used for 'unusual' purposes: announcements over the internet, for example. See remote announce in the smb.conf man page. -

`Problem resolution`

-If something doesn't work then hopefully the log.nmb file will help +

`Problem resolution`

+If something doesn't work then hopefully the log.nmbd file will help you track down the problem. Try a debug level of 2 or 3 for finding problems. Also note that the current browse list usually gets stored in text form in a file called browse.dat. @@ -3000,15 +3040,13 @@ server resources. The other big problem people have is that their broadcast address, netmask or IP address is wrong (specified with the "interfaces" option in smb.conf) -

`Browsing across subnets`

-Since the release of Samba 1.9.17(alpha1) Samba has been -updated to enable it to support the replication of browse lists -across subnet boundaries. New code and options have been added to -achieve this. This section describes how to set this feature up -in different settings. +

`Browsing across subnets`

+Since the release of Samba 1.9.17(alpha1), Samba has supported the +replication of browse lists across subnet boundaries. This section +describes how to set this feature up in different settings.

To see browse lists that span TCP/IP subnets (ie. networks separated -by routers that don't pass broadcast traffic) you must set up at least +by routers that don't pass broadcast traffic), you must set up at least one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing NetBIOS name to IP address translation to be done by doing a direct query of the WINS server. This is done via a directed UDP packet on @@ -3023,16 +3061,16 @@ be they Windows 95, Windows NT, or Samba servers must have the IP address of a WINS server given to them by a DHCP server, or by manual configuration (for Win95 and WinNT, this is in the TCP/IP Properties, under Network settings) for Samba this is in the smb.conf file. -

`How does cross subnet browsing work ?`

+

`How does cross subnet browsing work ?`

Cross subnet browsing is a complicated dance, containing multiple moving parts. It has taken Microsoft several years to get the code that achieves this correct, and Samba lags behind in some areas. Samba is capable of cross subnet browsing when configured correctly.

Consider a network set up as follows : -

+ - + (DMB) N1_A N1_B N1_C N1_D N1_E | | | | | @@ -3047,8 +3085,8 @@ Consider a network set up as follows : | | | | | | | | N2_A N2_B N2_C N2_D N3_A N3_B N3_C N3_D (WINS) - - + + Consisting of 3 subnets (1, 2, 3) connected by two routers (R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume @@ -3089,9 +3127,9 @@ called 'non-authoritative'. At this point the browse lists look as follows (these are the machines you would see in your network neighborhood if you looked in it on a particular network right now). - -Table 10.1. Browse subnet example 1 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E Subnet2 N2_B N2_A, N2_B, N2_C, N2_D Subnet3 N3_D N3_A, N3_B, N3_C, N3_D - + + Table 10.1. Browse subnet example 1 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E Subnet2 N2_B N2_A, N2_B, N2_C, N2_D Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + Note that at this point all the subnets are separate, no machine is seen across any of the subnets. @@ -3111,11 +3149,11 @@ names it knows about. Once the domain master browser receives the MasterAnnouncement packet it schedules a synchronization request to the sender of that packet. After both synchronizations are done the browse lists look like : - -Table 10.2. Browse subnet example 2 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + + Table 10.2. Browse subnet example 2 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D Servers with a (*) after them are non-authoritative names. - + At this point users looking in their network neighborhood on subnets 1 or 2 will see all the servers on both, users on subnet 3 will still only see the servers on their own subnet. @@ -3126,24 +3164,24 @@ synchronizes browse lists with the domain master browser (N1_A) it gets both the server entries on subnet 1, and those on subnet 2. After N3_D has synchronized with N1_C and vica-versa the browse lists look like. - -Table 10.3. Browse subnet example 3 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) + + Table 10.3. Browse subnet example 3 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) Servers with a (*) after them are non-authoritative names. - + At this point users looking in their network neighborhood on -subnets 1 or 3 will see all the servers on all sunbets, users on +subnets 1 or 3 will see all the servers on all subnets, users on subnet 2 will still only see the servers on subnets 1 and 2, but not 3. Finally, the local master browser for subnet 2 (N2_B) will sync again -with the domain master browser (N1_C) and will recieve the missing +with the domain master browser (N1_C) and will receive the missing server entries. Finally - and as a steady state (if no machines are removed or shut off) the browse lists will look like : - -Table 10.4. Browse subnet example 4 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) + + Table 10.4. Browse subnet example 4 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) Servers with a (*) after them are non-authoritative names. - + Synchronizations between the domain master browser and local master browsers will continue to occur, but this should be a steady state situation. @@ -3161,13 +3199,13 @@ If either router R1 or R2 fails the following will occur: be able to access servers on its local subnet, by using subnet-isolated broadcast NetBIOS name resolution. The effects are similar to that of losing access to a DNS server. -

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(), N2_B(), N2_C(), N2_D()
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(*)
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(), N2_B(), N2_C(), N2_D()
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(*)
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(), N2_B(), N2_C(), N2_D(), N3_A(), N3_B(), N3_C(), N3_D()
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(*)
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(), N2_A(), N2_B(), N2_C(), N2_D(*)

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(), N2_B(), N2_C(), N2_D(), N3_A(), N3_B(), N3_C(), N3_D()
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(*)
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(), N2_A(), N2_B(), N2_C(), N2_D(*)

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(), N2_B(), N2_C(), N2_D(), N3_A(), N3_B(), N3_C(), N3_D()
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(), N3_A(), N3_B(), N3_C(), N3_D(*)
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(), N2_A(), N2_B(), N2_C(), N2_D(*)

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(), N2_B(), N2_C(), N2_D(), N3_A(), N3_B(), N3_C(), N3_D()
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(), N3_A(), N3_B(), N3_C(), N3_D(*)
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(), N2_A(), N2_B(), N2_C(), N2_D(*)

`Common Errors`

-Many questions are sked on the mailing lists regarding browsing. The majority of browsing +

`Common Errors`

+Many questions are asked on the mailing lists regarding browsing. The majority of browsing problems originate out of incorrect configuration of NetBIOS name resolution. Some are of particular note. -

`How can one flush the Samba NetBIOS name cache without restarting samba?`

+

`How can one flush the Samba NetBIOS name cache without restarting Samba?`

Samba's nmbd process controls all browse list handling. Under normal circumstances it is -safe to restart nmbd. This will effectively flush the samba NetBIOS name cache and cause it +safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear in the browse list. When nmbd is taken out of service another machine on the network will become the browse master. This new list may still have the rogue entry in it. If you really @@ -3175,29 +3213,29 @@ want to clear a rogue machine from the list then every machine on the network wi shut down and restarted at after all machines are down. Failing a complete restart, the only other thing you can do is wait until the entry times out and is then flushed from the list. This may take a long time on some networks (months). -

`My client reports "This server is not configured to list shared resources"`

+

`My client reports "This server is not configured to list shared resources"`

Your guest account is probably invalid for some reason. Samba uses the guest account for browsing in smbd. Check that your guest account is valid. -

See also guest account in the smb.conf man page.

`Chapter 11. Account Information Databases`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`Jeremy Allison`

Samba Team <jra@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

`Olivier (lem) Lemaire`

IDEALX <olem@IDEALX.org>

May 24, 2003

Table of Contents

Important Notes About Security
Mapping User Identifiers between MS Windows and Unix

The smbpasswd Command
The pdbedit Command

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon - Users not in Samba SAM
Users are being added to the wrong backend database
auth methods does not work

-Samba-3 implements a new capability to work concurrently with mulitple account backends. +

See also guest account in the smb.conf man page.

`Chapter 11. Account Information Databases`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`Jeremy Allison`

Samba Team <jra@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

`Olivier (lem) Lemaire`

IDEALX <olem@IDEALX.org>

May 24, 2003

Table of Contents

Important Notes About Security
Mapping User Identifiers between MS Windows and Unix

The smbpasswd Command
The pdbedit Command

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon - Users not in Samba SAM
Users are being added to the wrong backend database
auth methods does not work

+Samba-3 implements a new capability to work concurrently with multiple account backends. The possible new combinations of password backends allows Samba-3 a degree of flexibility and scalability that previously could be achieved only with MS Windows Active Directory. This chapter describes the new functionality and how to get the most out of it.

-In the course of development of Samba-3 a number of requests were received to provide the +In the course of development of Samba-3, a number of requests were received to provide the ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide matching Unix/Linux accounts. We called this the Non Unix Accounts (NUA) capability. The intent was that an administrator could decide to use the tdbsam backend and by simply specifying "passdb backend = tdbsam_nua, guest" this would allow Samba-3 to implement a solution that did not use Unix accounts per se. Late -in the development cycle the team doing this work hit upon some obstacles that prevents this +in the development cycle, the team doing this work hit upon some obstacles that prevents this solution from being used. Given the delays with Samba-3 release a decision was made to NOT deliver this functionality until a better method of recognising NT Group SIDs from NT User SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series.

`Note`

Samba-3.0.0 does NOT support Non-Unix Account (NUA) operation. -

`Features and Benefits`

+

`Features and Benefits`

Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality as follows:

Backwards Compatibility Backends

Plain Text:

@@ -3217,7 +3255,7 @@ as follows:

This backend should be used only for backwards compatibility with older versions of Samba. It may be deprecated in future releases. -

ldapsam_compat (Samba-2.2 LDAP Compatibilty):

+

ldapsam_compat (Samba-2.2 LDAP Compatibility):

There is a password backend option that allows continued operation with a existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. This option is provided primarily as a migration tool, although there is @@ -3247,11 +3285,11 @@ Samba-3 introduces the following new password backend capabilities: for sites that have fewer than 250 users. For larger sites or implementations the use of OpenLDAP or of Active Directory integration is strongly recommended.

ldapsam:

- This provides a rich directory backend for distributed account installation + This provides a rich directory backend for distributed account installation.

Samba-3 has a new and extended LDAP implementation that requires configuration of OpenLDAP with a new format samba schema. The new format schema file is - included in the ~samba/examples/LDAP directory. + included in the examples/LDAP directory of the Samba distribution.

The new LDAP implementation significantly expands the control abilities that were possible with prior versions of Samba. It is now possible to specify @@ -3274,7 +3312,7 @@ Samba-3 introduces the following new password backend capabilities:

nisplussam:

The NIS+ based passdb backend. Takes name NIS domain as an optional argument. Only works with Sun NIS+ servers. -

`Technical Information`

+

`Technical Information`

Old windows clients send plain text passwords over the wire. Samba can check these passwords by crypting them and comparing them to the hash stored in the unix user database.

@@ -3282,7 +3320,7 @@ Samba-3 introduces the following new password backend capabilities: the wire, instead of plain text passwords. The newest clients will send only encrypted passwords and refuse to send plain text passwords, unless their registry is tweaked.

- These passwords can't be converted to unix style encrypted passwords. Because of that + These passwords can't be converted to unix style encrypted passwords. Because of that, you can't use the standard unix user database, and you have to store the Lanman and NT hashes somewhere else.

@@ -3292,7 +3330,7 @@ Samba-3 introduces the following new password backend capabilities: information using a passdb backend. Commonly available backends are LDAP, plain text file, MySQL and nisplus. For more information, see the man page for smb.conf regarding the passdb backend parameter. -

`Important Notes About Security`

+

`Important Notes About Security`

The unix and SMB password encryption techniques seem similar on the surface. This similarity is, however, only skin deep. The unix scheme typically sends clear text passwords over the network when logging in. This is bad. The SMB encryption scheme @@ -3334,7 +3372,7 @@ Samba-3 introduces the following new password backend capabilities: (broken) only the cached (encrypted) password will be sent to the resource server to affect a auto-reconnect. If the resource server does not support encrypted passwords the auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED. -

`Advantages of Encrypted Passwords`

Plain text passwords are not passed across +
Advantages of Encrypted Passwords
- Plain text passwords are not passed across the network. Someone using a network sniffer cannot just record passwords going to the SMB server.
- Plain text passwords are not stored anywhere in memory or on disk.
- WinNT doesn't like talking to a server @@ -3345,38 +3383,38 @@ Samba-3 introduces the following new password backend capabilities: only things you can do to stop this is to use SMB encryption.
- Encrypted password support allows automatic share (resource) reconnects.
- Encrypted passwords are essential for PDC/BDC - operation.
Advantages of non-encrypted passwords
- Plain text passwords are not kept + operation.
Advantages of non-encrypted passwords
- Plain text passwords are not kept on disk, and are NOT cached in memory.
- Uses same password file as other unix services such as login and ftp
- Use of other services (such as telnet and ftp) which send plain text passwords over the net, so sending them for SMB - isn't such a big deal.

`Mapping User Identifiers between MS Windows and Unix`

+ isn't such a big deal.

`Mapping User Identifiers between MS Windows and Unix`

Every operation in Unix/Linux requires a user identifier (UID), just as in MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides two means for mapping an MS Windows user to a Unix/Linux UID.

- Firstly, all Samba SAM (Security Account Management database) accounts require + Firstly, all Samba SAM (Security Account Manager database) accounts require a Unix/Linux UID that the account will map to. As users are added to the account - information database samba-3 will call the add user script - interface to add the account to the Samba host OS. In essence all accounts in + information database, Samba-3 will call the add user script + interface to add the account to the Samba host OS. In essence, all accounts in the local SAM require a local user account.

The second way to affect Windows SID to Unix UID mapping is via the idmap uid, idmap gid parameters in smb.conf. Please refer to the man page for information about these parameters. These parameters are essential when mapping users from a remote SAM server. -

`Account Management Tools`

+

`Account Management Tools`

Samba-3 provides two (2) tools for management of User and machine accounts. These tools are -called smbpasswd and pdbedit. A third tool is under +called smbpasswd and pdbedit. A third tool is under development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will -be announced in time for samba-3.0.1 release timing. -

`The smbpasswd Command`

+be announced in time for the Samba-3.0.1 release. +

`The smbpasswd Command`

The smbpasswd utility is a utility similar to the passwd or yppasswd programs. It maintains the two 32 byte password fields in the passdb backend.

smbpasswd works in a client-server mode where it contacts the - local smbd to change the user's password on its behalf.This has enormous benefits + local smbd to change the user's password on its behalf. This has enormous benefits as follows:

smbpasswd has the capability to change passwords on Windows NT @@ -3386,18 +3424,18 @@ be announced in time for samba-3.0.1 release timing. smbpasswd can be used to:

add user or machine accounts

delete user or machine accounts

enable user or machine accounts

disable user or machine accounts

set to NULL user passwords

manage interdomain trust accounts

To run smbpasswd as a normal user just type: -

- + + $ smbpasswd Old SMB password: secret - + For secret type old value here - or hit return if there was no old password - + New SMB Password: new secret Repeat New SMB Password: new secret - - + + If the old value does not match the current value stored for that user, or the two new values do not match each other, then the password will not be changed. @@ -3416,7 +3454,7 @@ be announced in time for samba-3.0.1 release timing. For more details on using smbpasswd refer to the man page (the definitive reference). -

`The pdbedit Command`

+

`The pdbedit Command`

pdbedit is a tool that can be used only by root. It is used to manage the passdb backend. pdbedit can be used to:

add, remove or modify user accounts

listing user accounts

migrate user accounts

@@ -3452,29 +3490,29 @@ be announced in time for samba-3.0.1 release timing. Password last set: Sat, 14 Dec 2002 14:37:03 GMT Password can change: Sat, 14 Dec 2002 14:37:03 GMT Password must change: Mon, 18 Jan 2038 20:14:07 GMT -

`Password Backends`

+

`Password Backends`

Samba-3 offers the greatest flexibility in backend account database design of any SMB/CIFS server technology available today. The flexibility is immediately obvious as one begins to explore this capability.

It is possible to specify not only multiple different password backends, but even multiple backends of the same type. For example, to use two different tdbsam databases: -

-+ + [globals] passdb backend = tdbsam:/etc/samba/passdb.tdb, \ tdbsam:/etc/samba/old-passdb.tdb, guest - -Plain Text - Older versions of samba retrieved user information from the unix user database + + Plain Text + Older versions of Samba retrieved user information from the unix user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd. When password encryption is disabled, no - SMB specific data is stored at all. Instead all operations are conduected via the way - that the samba host OS will access it's /etc/passwd database. + SMB specific data is stored at all. Instead all operations are conducted via the way + that the Samba host OS will access its /etc/passwd database. eg: On Linux systems that is done via PAM. - smbpasswd - Encrypted Password Database - Traditionally, when configuring "encrypt - passwords = yes" in Samba's smb.conf file, user account + smbpasswd - Encrypted Password Database + Traditionally, when configuring encrypt + passwords = yes in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account flags have been stored in the smbpasswd(5) file. There are several disadvantages to this approach for sites with very large numbers of users (counted @@ -3503,15 +3541,15 @@ backends of the same type. For example, to use two different tdbsam databases: Samba-3 provides an enhanced set of passdb backends that overcome the deficiencies of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. Of these ldapsam will be of most interest to large corporate or enterprise sites. - tdbsam Samba can store user and machine account data in a "TDB" (Trivial Database). + tdbsam Samba can store user and machine account data in a "TDB" (Trivial Database). Using this backend doesn't require any additional configuration. This backend is recommended for new installations that do not require LDAP. - As a general guide the Samba-Team do NOT recommend using the tdbsam backend for sites + As a general guide the Samba-Team does NOT recommend using the tdbsam backend for sites that have 250 or more users. Additionally, tdbsam is not capable of scaling for use - in sites that require PDB/BDC implmentations that requires replication of the account - database. Clearly, for reason of scalability the use of ldapsam should be encouraged. - ldapsam + in sites that require PDB/BDC implementations that requires replication of the account + database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. + ldapsam There are a few points to stress that the ldapsam does not provide. The LDAP support referred to in the this documentation does not include: A means of retrieving user account information from @@ -3524,7 +3562,10 @@ backends of the same type. For example, to use two different tdbsam databases: Refer to http://safari.oreilly.com/?XmlId=1-56592-491-6 for those who might wish to know more about configuration and administration of an OpenLDAP server. - + Note + This section is outdated for Samba-3 schema. Samba-3 introduces a new schema + that has not been documented at the time of this publication. + This document describes how to use an LDAP directory for storing Samba user account information traditionally stored in the smbpasswd(5) file. It is assumed that the reader already has a basic understanding of LDAP concepts @@ -3536,25 +3577,25 @@ backends of the same type. For example, to use two different tdbsam databases: The Samba-PDC-LDAP-HOWTO maintained by Ignacio Coupeau. The NT migration scripts from IDEALX that are geared to manage users and group in such a Samba-LDAP Domain Controller configuration. - Supported LDAP Servers + Supported LDAP Servers The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs. These should not be hard to fix. Please submit fixes via Bug reporting facility. - Schema and Relationship to the RFC 2307 posixAccount + Schema and Relationship to the RFC 2307 posixAccount Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in - examples/LDAP/samba.schema. The sambaAccount objectclass is given here: - --objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY - DESC 'Samba Auxilary Account' + examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: + + +objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY + DESC 'Samba Auxiliary Account' MUST ( uid $ rid ) MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $ logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $ displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $ description $ userWorkstations $ primaryGroupID $ domain )) - - + + The samba.schema file has been formatted for OpenLDAP 2.0/2.1. The OID's are owned by the Samba Team and as such is legal to be openly published. If you translate the schema to be used with Netscape DS, please @@ -3562,55 +3603,55 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY jerry@samba.org. Just as the smbpasswd file is meant to store information which supplements a - user's /etc/passwd entry, so is the sambaAccount object - meant to supplement the UNIX user account information. A sambaAccount is a + user's /etc/passwd entry, so is the sambaSamAccount object + meant to supplement the UNIX user account information. A sambaSamAccount is a STRUCTURAL objectclass so it can be stored individually in the directory. However, there are several fields (e.g. uid) which overlap with the posixAccount objectclass outlined in RFC2307. This is by design. In order to store all user account information (UNIX and Samba) in the directory, - it is necessary to use the sambaAccount and posixAccount objectclasses in + it is necessary to use the sambaSamAccount and posixAccount objectclasses in combination. However, smbd will still obtain the user's UNIX account information via the standard C library calls (e.g. getpwnam(), et. al.). This means that the Samba server must also have the LDAP NSS library installed and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure. - OpenLDAP configuration - To include support for the sambaAccount object in an OpenLDAP directory + OpenLDAP configuration + To include support for the sambaSamAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory. The samba.schema file can be found in the directory examples/LDAP in the samba source distribution. - -+ + root# cp samba.schema /etc/openldap/schema/ - - + + Next, include the samba.schema file in slapd.conf. - The sambaAccount object contains two attributes which depend upon other schema + The sambaSamAccount object contains two attributes which depend upon other schema files. The 'uid' attribute is defined in cosine.schema and the 'displayName' attribute is defined in the inetorgperson.schema file. Both of these must be included before the samba.schema file. - -+ + ## /etc/openldap/slapd.conf ## schema files (core.schema is required by default) include /etc/openldap/schema/core.schema -## needed for sambaAccount +## needed for sambaSamAccount include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/nis.schema .... - - - It is recommended that you maintain some indices on some of the most usefull attributes, - like in the following example, to speed up searches made on sambaAccount objectclasses + + + It is recommended that you maintain some indices on some of the most useful attributes, + like in the following example, to speed up searches made on sambaSamAccount objectclasses (and possibly posixAccount and posixGroup as well). - -+ + # Indices to maintain ## required by OpenLDAP index objectclass eq @@ -3632,25 +3673,25 @@ index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub - - + + Create the new index by executing: - -+ + ./sbin/slapindex -f slapd.conf - - + + Remember to restart slapd after making these changes: - -+ + root# /etc/init.d/slapd restart - - Initialise the LDAP database + + Initialise the LDAP database Before you can add accounts to the LDAP database you must create the account containers that they will be stored in. The following LDIF file should be modified to match your needs (ie: Your DNS entries, etc.). - -+ + # Organization for Samba Base dn: dc=plainjoe,dc=org objectclass: dcObject @@ -3678,26 +3719,26 @@ objectclass: top objectclass: organizationalRole objectclass: simpleSecurityObject userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz - - + + The userPassword shown above should be generated using slappasswd. The following command will then load the contents of the LDIF file into the LDAP database. - -+ + $ slapadd -v -l initldap.dif - - + + Do not forget to secure your LDAP server with an adequate access control list, as well as an admin password. - Note - Before Samba can access the LDAP server you need to stoe the LDAP admin password + Note + Before Samba can access the LDAP server you need to store the LDAP admin password into the Samba-3 secrets.tdb database by: - + root# smbpasswd -w secret - - Configuring Samba + + Configuring Samba The following parameters are available in smb.conf only if your version of samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found. @@ -3705,8 +3746,8 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz These are described in the smb.conf man page and so will not be repeated here. However, a sample smb.conf file for use with an LDAP directory could appear as - -+ + ## /usr/local/samba/lib/smb.conf [global] security = user @@ -3735,7 +3776,7 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz ldap delete dn = no # the machine and user suffix added to the base suffix - # wrote WITHOUT quotes. NULL siffixes by default + # wrote WITHOUT quotes. NULL suffixes by default ldap user suffix = ou=People ldap machine suffix = ou=Systems @@ -3747,27 +3788,27 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz ldap suffix = "ou=people,dc=samba,dc=org" # generally the default ldap search filter is ok - # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))" - - Accounts and Groups management - As users accounts are managed thru the sambaAccount objectclass, you should - modify your existing administration tools to deal with sambaAccount attributes. + # ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))" + + Accounts and Groups management + As users accounts are managed through the sambaSamAccount objectclass, you should + modify your existing administration tools to deal with sambaSamAccount attributes. - Machines accounts are managed with the sambaAccount objectclass, just - like users accounts. However, it's up to you to store thoses accounts + Machines accounts are managed with the sambaSamAccount objectclass, just + like users accounts. However, it's up to you to store those accounts in a different tree of your LDAP namespace: you should use "ou=Groups,dc=plainjoe,dc=org" to store groups and "ou=People,dc=plainjoe,dc=org" to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration file). - In Samba release 3.0, the group management system is based on posix - groups. This means that Samba makes usage of the posixGroup objectclass. + In Samba release 3.0, the group management system is based on POSIX + groups. This means that Samba makes use of the posixGroup objectclass. For now, there is no NT-like group system management (global and local groups). - Security and sambaAccount + Security and sambaSamAccount There are two important points to remember when discussing the security - of sambaAccount entries in the directory. + of sambaSamAccount entries in the directory. Never retrieve the lmPassword or ntPassword attribute values over an unencrypted LDAP session. Never allow non-admin users to view the lmPassword or ntPassword attribute values. @@ -3776,7 +3817,7 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz on the details of LM/NT password hashes, refer to the Account Information Database section of this chapter. - To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults + To remedy the first security issue, the ldap ssl smb.conf parameter defaults to require an encrypted session (ldap ssl = on) using the default port of 636 when contacting the directory server. When using an OpenLDAP server, it @@ -3791,19 +3832,19 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz The second security precaution is to prevent non-administrative users from harvesting password hashes from the directory. This can be done using the following ACL in slapd.conf: - -+ + ## allow the "ldap admin dn" access, but deny everyone else access to attrs=lmPassword,ntPassword by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write by * none - - LDAP special attributes for sambaAccounts - The sambaAccount objectclass is composed of the following attributes: - - Table 11.1. Attributes in the sambaAccount objectclass (LDAP) lmPassword the LANMAN password 16-byte hash stored as a character - representation of a hexidecimal string. ntPassword the NT password hash 16-byte stored as a character - representation of a hexidecimal string. pwdLastSet The integer time in seconds since 1970 when the + + LDAP special attributes for sambaSamAccounts + The sambaSamAccount objectclass is composed of the following attributes: + + Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP) lmPassword the LANMAN password 16-byte hash stored as a character + representation of a hexadecimal string. ntPassword the NT password hash 16-byte stored as a character + representation of a hexadecimal string. pwdLastSet The integer time in seconds since 1970 when the lmPassword and ntPassword attributes were last set. acctFlags string of 11 characters surrounded by square brackets [] representing account flags such as U (user), W(workstation), X(no password expiration), @@ -3824,14 +3865,14 @@ access to attrs=lmPassword,ntPassword userWorkstation character string value currently unused. rid the integer representation of the user's relative identifier (RID). primaryGroupID the relative identifier (RID) of the primary group - of the user. domain domain the user is part of. - + of the user. domain domain the user is part of. + The majority of these parameters are only used when Samba is acting as a PDC of a domain (refer to the Samba as a primary domain controller chapter for details on how to configure Samba as a Primary Domain Controller). The following four attributes - are only stored with the sambaAccount entry if the values are non-default values: + are only stored with the sambaSamAccount entry if the values are non-default values: smbHome scriptPath logonPath homeDrive - These attributes are only stored with the sambaAccount entry if + These attributes are only stored with the sambaSamAccount entry if the values are non-default values. For example, assume TASHTEGO has now been configured as a PDC and that logon home = \\%L\%u was defined in its smb.conf file. When a user named "becky" logons to the domain, @@ -3841,10 +3882,10 @@ access to attrs=lmPassword,ntPassword of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is something other than the default (e.g. \\MOBY\becky). - Example LDIF Entries for a sambaAccount + Example LDIF Entries for a sambaSamAccount The following is a working LDIF with the inclusion of the posixAccount objectclass: - - + + dn: uid=guest2, ou=people,dc=plainjoe,dc=org ntPassword: 878D8014606CDA29677A44EFA1353FC7 pwdMustChange: 2147483647 @@ -3852,26 +3893,26 @@ access to attrs=lmPassword,ntPassword lmPassword: 552902031BEDE9EFAAD3B435B51404EE pwdLastSet: 1010179124 logonTime: 0 - objectClass: sambaAccount + objectClass: sambaSamAccount uid: guest2 kickoffTime: 2147483647 acctFlags: [UX ] logoffTime: 2147483647 rid: 19006 pwdCanChange: 0 - - - The following is an LDIF entry for using both the sambaAccount and + + + The following is an LDIF entry for using both the sambaSamAccount and posixAccount objectclasses: - - + + dn: uid=gcarter, ou=people,dc=plainjoe,dc=org logonTime: 0 displayName: Gerald Carter lmPassword: 552902031BEDE9EFAAD3B435B51404EE primaryGroupID: 1201 objectClass: posixAccount - objectClass: sambaAccount + objectClass: sambaSamAccount acctFlags: [UX ] userPassword: {crypt}BpM2ej8Rkzogo uid: gcarter @@ -3887,56 +3928,53 @@ access to attrs=lmPassword,ntPassword pwdCanChange: 0 pwdMustChange: 2147483647 ntPassword: 878D8014606CDA29677A44EFA1353FC7 - - Password synchronisation + + Password synchronisation Since version 3.0 samba can update the non-samba (LDAP) password stored with an account. When using pam_ldap, this allows changing both unix and windows passwords at once. The ldap passwd sync options can have the following values: yes When the user changes his password, update ntPassword, lmPassword and the password fields. no Only update ntPassword and lmPassword. only Only update the LDAP password and let the LDAP server worry - about the other fields. This option is only available when - the LDAP library supports LDAP_EXOP_X_MODIFY_PASSWD. More information can be found in the smb.conf manpage. - ldap trust ids - LDAP Performance can be improved by using the ldap trust ids parameter. - See the smb.conf manpage for details. - MySQL + about the other fields. This option is only available when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD. More information can be found in the smb.conf manpage. +

`MySQL`

Every so often someone will come along with a great new idea. Storing of user accounts in an SQL backend is one of them. Those who want to do this are in the best position to know what the specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt to document every nitty little detail why certain things of marginal utility to the bulk of Samba users might make sense to the rest. In any case, the following instructions should help the determined SQL user to implement a working system. -

`Creating the database`

+ Creating the database You either can set up your own table and specify the field names to pdb_mysql (see below for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump contains the correct queries to create the required tables. Use the command : - $ mysql -uusername -hhostname -ppassword databasename > /path/to/samba/examples/pdb/mysql/mysql.dump - Configuring This plugin lacks some good documentation, but here is some short info: Add a the following to the passdb backend variable in your smb.conf: - + $ mysql -uusername -hhostname -ppassword \ +databasename < /path/to/samba/examples/pdb/mysql/mysql.dump + Configuring This plugin lacks some good documentation, but here is some short info: Add a the following to the passdb backend variable in your smb.conf: + passdb backend = [other-plugins] mysql:identifier [other-plugins] - - The identifier can be any string you like, as long as it doesn't collide with + + The identifier can be any string you like, as long as it doesn't collide with the identifiers of other plugins or other instances of pdb_mysql. If you specify multiple pdb_mysql.so entries in passdb backend, you also need to use different identifiers! - Additional options can be given thru the smb.conf file in the [global] section. - - Table 11.2. Basic smb.conf options for MySQL passdb backend Field Contents identifier:mysql host host name, defaults to 'localhost' identifier:mysql password identifier:mysql user defaults to 'samba' identifier:mysql database defaults to 'samba' identifier:mysql port defaults to 3306 identifier:table Name of the table containing users - Warning - Since the password for the mysql user is stored in the + Additional options can be given through the smb.conf file in the [global] section. + + Table 11.2. Basic smb.conf options for MySQL passdb backend Field Contents identifier:mysql host host name, defaults to 'localhost' identifier:mysql password identifier:mysql user defaults to 'samba' identifier:mysql database defaults to 'samba' identifier:mysql port defaults to 3306 identifier:table Name of the table containing users + Warning + Since the password for the MySQL user is stored in the smb.conf file, you should make the the smb.conf file - readable only to the user that runs samba. This is considered a security + readable only to the user that runs Samba This is considered a security bug and will be fixed soon. - Names of the columns in this table(I've added column types those columns should have first): - Table 11.3. MySQL field names for MySQL passdb backend Field Type Contents identifier:logon time column int(9) identifier:logoff time column int(9) identifier:kickoff time column int(9) identifier:pass last set time column int(9) identifier:pass can change time column int(9) identifier:pass must change time column int(9) identifier:username column varchar(255) unix username identifier:domain column varchar(255) NT domain user is part of identifier:nt username column varchar(255) NT username identifier:fullname column varchar(255) Full name of user identifier:home dir column varchar(255) Unix homedir path identifier:dir drive column varchar(2) Directory drive path (eg: 'H:') identifier:logon script column varchar(255) Batch file to run on client side when logging on identifier:profile path column varchar(255) Path of profile identifier:acct desc column varchar(255) Some ASCII NT user data identifier:workstations column varchar(255) Workstations user can logon to (or NULL for all) identifier:unknown string column varchar(255) unknown string identifier:munged dial column varchar(255) ? identifier:user sid column varchar(255) NT user SID identifier:group sid column varchar(255) NT group ID identifier:lanman pass column varchar(255) encrypted lanman password identifier:nt pass column varchar(255) encrypted nt passwd identifier:plain pass column varchar(255) plaintext password identifier:acct control column int(9) nt user data identifier:unknown 3 column int(9) unknown identifier:logon divs column int(9) ? identifier:hours len column int(9) ? identifier:unknown 5 column int(9) unknown identifier:unknown 6 column int(9) unknown - + Names of the columns in this table (I've added column types those columns should have first): + Table 11.3. MySQL field names for MySQL passdb backend Field Type Contents identifier:logon time column int(9) identifier:logoff time column int(9) identifier:kickoff time column int(9) identifier:pass last set time column int(9) identifier:pass can change time column int(9) identifier:pass must change time column int(9) identifier:username column varchar(255) unix username identifier:domain column varchar(255) NT domain user is part of identifier:nt username column varchar(255) NT username identifier:fullname column varchar(255) Full name of user identifier:home dir column varchar(255) Unix homedir path identifier:dir drive column varchar(2) Directory drive path (eg: 'H:') identifier:logon script column varchar(255) Batch file to run on client side when logging on identifier:profile path column varchar(255) Path of profile identifier:acct desc column varchar(255) Some ASCII NT user data identifier:workstations column varchar(255) Workstations user can logon to (or NULL for all) identifier:unknown string column varchar(255) unknown string identifier:munged dial column varchar(255) ? identifier:user sid column varchar(255) NT user SID identifier:group sid column varchar(255) NT group ID identifier:lanman pass column varchar(255) encrypted lanman password identifier:nt pass column varchar(255) encrypted nt passwd identifier:plain pass column varchar(255) plaintext password identifier:acct control column int(9) nt user data identifier:unknown 3 column int(9) unknown identifier:logon divs column int(9) ? identifier:hours len column int(9) ? identifier:unknown 5 column int(9) unknown identifier:unknown 6 column int(9) unknown + Eventually, you can put a colon (:) after the name of each column, which should specify the column to update when updating the table. You can also specify nothing behind the colon - then the data from the field will not be updated. - Using plaintext passwords or encrypted password + Using plaintext passwords or encrypted password I strongly discourage the use of plaintext passwords, however, you can use them: If you would like to use plaintext passwords, set @@ -3946,7 +3984,7 @@ access to attrs=lmPassword,ntPassword If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default. - Getting non-column data from the table + Getting non-column data from the table It is possible to have not all data in the database and making some 'constant'. For example, you can set 'identifier:fullname column' to : @@ -3955,42 +3993,42 @@ access to attrs=lmPassword,ntPassword Or, set 'identifier:workstations column' to : NULL See the MySQL documentation for more language constructs.

Field	Contents
identifier:mysql host	host name, defaults to 'localhost'
identifier:mysql password
identifier:mysql user	defaults to 'samba'
identifier:mysql database	defaults to 'samba'
identifier:mysql port	defaults to 3306
identifier:table	Name of the table containing users

Field	Contents
identifier:mysql host	host name, defaults to 'localhost'
identifier:mysql password
identifier:mysql user	defaults to 'samba'
identifier:mysql database	defaults to 'samba'
identifier:mysql port	defaults to 3306
identifier:table	Name of the table containing users

Field	Type	Contents
identifier:logon time column	int(9)
identifier:logoff time column	int(9)
identifier:kickoff time column	int(9)
identifier:pass last set time column	int(9)
identifier:pass can change time column	int(9)
identifier:pass must change time column	int(9)
identifier:username column	varchar(255)	unix username
identifier:domain column	varchar(255)	NT domain user is part of
identifier:nt username column	varchar(255)	NT username
identifier:fullname column	varchar(255)	Full name of user
identifier:home dir column	varchar(255)	Unix homedir path
identifier:dir drive column	varchar(2)	Directory drive path (eg: 'H:')
identifier:logon script column	varchar(255)	Batch file to run on client side when logging on
identifier:profile path column	varchar(255)	Path of profile
identifier:acct desc column	varchar(255)	Some ASCII NT user data
identifier:workstations column	varchar(255)	Workstations user can logon to (or NULL for all)
identifier:unknown string column	varchar(255)	unknown string
identifier:munged dial column	varchar(255)	?
identifier:user sid column	varchar(255)	NT user SID
identifier:group sid column	varchar(255)	NT group ID
identifier:lanman pass column	varchar(255)	encrypted lanman password
identifier:nt pass column	varchar(255)	encrypted nt passwd
identifier:plain pass column	varchar(255)	plaintext password
identifier:acct control column	int(9)	nt user data
identifier:unknown 3 column	int(9)	unknown
identifier:logon divs column	int(9)	?
identifier:hours len column	int(9)	?
identifier:unknown 5 column	int(9)	unknown
identifier:unknown 6 column	int(9)	unknown

Field	Type	Contents
identifier:logon time column	int(9)
identifier:logoff time column	int(9)
identifier:kickoff time column	int(9)
identifier:pass last set time column	int(9)
identifier:pass can change time column	int(9)
identifier:pass must change time column	int(9)
identifier:username column	varchar(255)	unix username
identifier:domain column	varchar(255)	NT domain user is part of
identifier:nt username column	varchar(255)	NT username
identifier:fullname column	varchar(255)	Full name of user
identifier:home dir column	varchar(255)	Unix homedir path
identifier:dir drive column	varchar(2)	Directory drive path (eg: 'H:')
identifier:logon script column	varchar(255)	Batch file to run on client side when logging on
identifier:profile path column	varchar(255)	Path of profile
identifier:acct desc column	varchar(255)	Some ASCII NT user data
identifier:workstations column	varchar(255)	Workstations user can logon to (or NULL for all)
identifier:unknown string column	varchar(255)	unknown string
identifier:munged dial column	varchar(255)	?
identifier:user sid column	varchar(255)	NT user SID
identifier:group sid column	varchar(255)	NT group ID
identifier:lanman pass column	varchar(255)	encrypted lanman password
identifier:nt pass column	varchar(255)	encrypted nt passwd
identifier:plain pass column	varchar(255)	plaintext password
identifier:acct control column	int(9)	nt user data
identifier:unknown 3 column	int(9)	unknown
identifier:logon divs column	int(9)	?
identifier:hours len column	int(9)	?
identifier:unknown 5 column	int(9)	unknown
identifier:unknown 6 column	int(9)	unknown

`XML`

This module requires libxml2 to be installed.

The usage of pdb_xml is pretty straightforward. To export data, use:

- $ pdbedit -e xml:filename + $ pdbedit -e xml:filename

(where filename is the name of the file to put the data in)

To import data, use: - $ pdbedit -i xml:filename -

`Common Errors`

`Users can not logon - Users not in Samba SAM`

- People forget to put their users in their backend and then complain samba won't authorize them. -

`Users are being added to the wrong backend database`

- A few complaints have been recieved from users that just moved to samba-3. The following + $ pdbedit -i xml:filename +

`Common Errors`

`Users can not logon - Users not in Samba SAM`

+ People forget to put their users in their backend and then complain Samba won't authorize them. +

`Users are being added to the wrong backend database`

+ A few complaints have been received from users that just moved to Samba-3. The following smb.conf file entries were causing problems, new accounts were being added to the old smbpasswd file, not to the tdbsam passdb.tdb file: -

- + + [globals] ... passdb backend = smbpasswd, tdbsam, guest ... - - + + Samba will add new accounts to the first entry in the passdb backend parameter entry. If you want to update to the tdbsam, then change the entry to: - - + + [globals] ... passdb backend = tdbsam, smbpasswd, guest ... - -

`auth methods does not work`

+

`auth methods does not work`

If you explicitly set an 'auth methods' parameter, guest must be specified as the first entry on the line. Eg: auth methods = guest sam.

This is the exact opposite of the requirement for the passdb backed option, where it must be the LAST parameter on the line. -

`Chapter 12. Mapping MS Windows and Unix Groups`

`Jean François Micouleau`

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Example Configuration

Sample smb.conf add group script
Script to configure Group Mapping

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails

+

`Chapter 12. Mapping MS Windows and Unix Groups`

`Jean François Micouleau`

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Example Configuration

Sample smb.conf add group script
Script to configure Group Mapping

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails

Starting with Samba-3, new group mapping functionality is available to create associations between Windows group SIDs and UNIX groups. The groupmap subcommand included with the net tool can be used to manage these associations. @@ -4000,12 +4038,12 @@ access to attrs=lmPassword,ntPassword be specified in smb.conf. This parameter was used to give the listed users membership in the Domain Admins Windows group which gave local admin rights on their workstations (in default configurations). -

`Features and Benefits`

+

`Features and Benefits`

Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to arbitrarily associate them with Unix/Linux group accounts.

Group accounts can be managed using the MS Windows NT4 or MS Windows 200x MMC tools - so long as appropriate interface scripts have been provided to smb.conf + so long as appropriate interface scripts have been provided to smb.conf.

Administrators should be aware that where smb.conf group interface scripts make direct calls to the Unix/Linux system tools (eg: the shadow utilities, groupadd, @@ -4018,43 +4056,43 @@ access to attrs=lmPassword,ntPassword There are several possible work-arounds for the operating system tools limitation. One method is to use a script that generates a name for the Unix/Linux system group that fits the operating system limits, and that then just passes the Unix/Linux group id (GID) - back to the calling samba interface. This will provide a dynamic work-around solution. + back to the calling Samba interface. This will provide a dynamic work-around solution.

Another work-around is to manually create a Unix/Linux group, then manually create the MS Windows NT4 / 200x group on the Samba server and then use the net groupmap tool to connect the two to each other. -

`Discussion`

+

`Discussion`

When installing MS Windows NT4 / 200x on a computer, the installation - program creates default users and groups. Notably the Administrators group, - and gives to that group privileges necessary privilidges to perform essential system tasks. - eg: Ability to change the date and time or to kill any process (or close too) running on the + program creates default users and groups, notably the Administrators group, + and gives that group privileges necessary privileges to perform essential system tasks. + eg: Ability to change the date and time or to kill (or close) any process running on the local machine.

The 'Administrator' user is a member of the 'Administrators' group, and thus inherits 'Administrators' group privileges. If a 'joe' user is created to be a member of the 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'.

- When an MS Windows NT4 / W200x is made a domain member, the "Domain Adminis" group of the + When an MS Windows NT4 / W200x is made a domain member, the "Domain Admins" group of the PDC is added to the local 'Administrators' group of the workstation. Every member of the 'Domain Administrators' group inherits the rights of the local 'Administrators' group when logging on the workstation.

- The following steps describe how to make samba PDC users members of the 'Domain Admins' group? + The following steps describe how to make Samba PDC users members of the 'Domain Admins' group?

create a unix group (usually in /etc/group), let's call it domadm -
add to this group the users that must be Administrators. For example - if you want joe,john and mary, your entry in /etc/group will +
add to this group the users that must be Administrators. For example + if you want joe, john and mary, your entry in /etc/group will look like:
```
 		domadm:x:502:joe,john,mary
-		
```
-
+
+

Map this domadm group to the "Domain Admins" group by running the command: -

- + + root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm - - + + The quotes around "Domain Admins" are necessary due to the space in the group name. Also make sure to leave no whitespace surrounding the equal character (=).

@@ -4064,36 +4102,36 @@ access to attrs=lmPassword,ntPassword making any UNIX group a Windows domain group. For example, if you wanted to include a UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, you would flag that group as a domain group by running the following on the Samba PDC: -

- + + root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct - - - Be aware that the RID parmeter is a unsigned 32 bit integer that should + + + Be aware that the RID parameter is a unsigned 32 bit integer that should normally start at 1000. However, this rid must not overlap with any RID assigned to a user. Verifying this is done differently depending on on the passdb backend you are using. Future versions of the tools may perform the verification automatically, but for now the burden is on you. - Example Configuration + Example Configuration You can list the various groups in the mapping database by executing net groupmap list. Here is an example: - - + + root# net groupmap list System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest - - + + For complete details on net groupmap, refer to the net(8) man page. - Configuration Scripts +

`Configuration Scripts`

Everyone needs tools. Some of us like to create our own, others prefer to use canned tools (ie: prepared by someone else for general use). -

`Sample smb.conf add group script`

- A script to great complying group names for use by the samba group interfaces: -

-Example 12.1. smbgrpadd.sh + Sample smb.conf add group script + A script to great complying group names for use by the Samba group interfaces: + + Example 12.1. smbgrpadd.sh #!/bin/bash @@ -4103,22 +4141,23 @@ groupadd smbtmpgrp00 thegid=`cat /etc/group | grep smbtmpgrp00 | cut -d ":" -f3` # Now change the name to what we want for the MS Windows networking end -cat /etc/group | sed s/smbtmpgrp00/$1/g > /etc/group +cp /etc/group /etc/group.bak +cat /etc/group.bak | sed s/smbtmpgrp00/$1/g > /etc/group # Now return the GID as would normally happen. echo $thegid exit 0 - - + + The smb.conf entry for the above script would look like: - + add group script = /path_to_tool/smbgrpadd.sh %g - -

`Script to configure Group Mapping`

+

`Script to configure Group Mapping`

In our example we have created a Unix/Linux group called ntadmin. Our script will create the additional groups Engineers, Marketoids, Gnomes: -

-+ + #!/bin/bash net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin @@ -4141,21 +4180,21 @@ net groupmap modify ntgroup="Power Users" unixgroup=sys #net groupmap add ntgroup="Engineers" unixgroup=Engineers type=d #net groupmap add ntgroup="Marketoids" unixgroup=Marketoids type=d #net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d - - - Of course it is expected that the admininstrator will modify this to suit local needs. + + + Of course it is expected that the administrator will modify this to suit local needs. For information regarding the use of the net groupmap tool please refer to the man page. -

`Common Errors`

+

`Common Errors`

At this time there are many little surprises for the unwary administrator. In a real sense it is imperative that every step of automated control scripts must be carefully tested manually before putting them into active service. -

`Adding Groups Fails`

+

`Adding Groups Fails`

This is a common problem when the groupadd is called directly - by the samba interface script for the add group script in + by the Samba interface script for the add group script in the smb.conf file.

- The most common cause of failure is an attempt to add an MS Windows group acocunt + The most common cause of failure is an attempt to add an MS Windows group account that has either an upper case character and/or a space character in it.

There are three possible work-arounds. Firstly, use only group names that comply @@ -4164,15 +4203,15 @@ manually before putting them into active service. third option is to manually create a Unix/Linux group account that can substitute for the MS Windows group name, then use the procedure listed above to map that group to the MS Windows group. -

`Adding MS Windows Groups to MS Windows Groups Fails`

+

`Adding MS Windows Groups to MS Windows Groups Fails`

Samba-3 does NOT support nested groups from the MS Windows control environment. -

`Chapter 13. File, Directory and Share Access Controls`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Jeremy Allison`

Samba Team <jra@samba.org>

May 10, 2003

Table of Contents

MS Windows NTFS Comparison with Unix File Systems
Managing Directories
File and Directory Access Control

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

MS Windows Access Control Lists and Unix Interoperability

Share Permissions Management

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask - parameters
Interaction with the standard Samba file attribute - mapping

Users can not write to a public share
I have set force user and samba still makes root the owner of all the files +

`Chapter 13. File, Directory and Share Access Controls`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Jeremy Allison`

Samba Team <jra@samba.org>

May 10, 2003

Table of Contents

MS Windows NTFS Comparison with Unix File Systems
Managing Directories
File and Directory Access Control

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

MS Windows Access Control Lists and Unix Interoperability

Share Permissions Management

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask + parameters
Interaction with the standard Samba file attribute + mapping

Users can not write to a public share
I have set force user and Samba still makes root the owner of all the files I touch!

Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network -adminstrators are often confused regarding network access controls and what is the best way to +administrators are often confused regarding network access controls and what is the best way to provide users with the type of access they need while protecting resources from the consequences of untoward access capabilities.

@@ -4198,9 +4237,9 @@ This is an opportune point to mention that it should be borne in mind that Samba provide a means of interoperability and interchange of data between two operating environments that are quite different. It was never the intent to make Unix/Linux like MS Windows NT. Instead the purpose was an is to provide a sufficient level of exchange of data between the two environments. -What is available today extends well beyond early plans and expections, yet the gap continues to +What is available today extends well beyond early plans and expectations, yet the gap continues to shrink. -

`Features and Benefits`

+

`Features and Benefits`

Samba offers a lot of flexibility in file system access management. These are the key access control facilities present in Samba today:

Samba Access Control Facilities

@@ -4237,15 +4276,15 @@ shrink. operating system supports them. If not, then this option will not be available to you. Current Unix technology platforms have native support for POSIX ACLs. There are patches for the Linux kernel that provide - this also. Sadly, few Linux paltforms ship today with native ACLs and + this also. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information for users of platforms that support them. -

`File System Access Controls`

+

`File System Access Controls`

Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP implement a totally divergent file system technology from what is provided in the Unix operating system environment. Firstly we should consider what the most significant differences are, then we shall look at how Samba helps to bridge the differences. -

`MS Windows NTFS Comparison with Unix File Systems`

+

`MS Windows NTFS Comparison with Unix File Systems`

Samba operates on top of the Unix file system. This means it is subject to Unix file system conventions and permissions. It also means that if the MS Windows networking environment requires file system behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating @@ -4253,7 +4292,7 @@ at how Samba helps to bridge the differences.

It is good news that Samba does this to a very large extent and on top of that provides a high degree of optional configuration to over-ride the default behaviour. We will look at some of these over-rides, - but for the greater part we will stay withing the bounds of default behaviour. Those wishing to explore + but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore to depths of control ability should review the smb.conf man page.

File System Feature Comparison

Name Space: MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, Unix file names @@ -4304,24 +4343,24 @@ at how Samba helps to bridge the differences. Symbolic links are files in Unix that contain the actual location of the data (file OR directory). An operation (like read or write) will operate directly on the file referenced. Symbolic links are also referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows - one physical file to be known simulataneously by more than one file name. + one physical file to be known simultaneously by more than one file name.

There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort in the process of becoming familiar with Unix/Linux. These are best left for a text that is dedicated to the purpose of Unix/Linux training/education. -

`Managing Directories`

+

`Managing Directories`

There are three basic operations for managing directories, create, delete, rename. -

Table 13.1. Managing directories with unix and windows Action MS Windows Command Unix Command create md folder mkdir folder delete rd folder rmdir folder rename rename oldname newname mv oldname newname

Action	MS Windows Command	Unix Command
create	md folder	mkdir folder
delete	rd folder	rmdir folder
rename	rename oldname newname	mv oldname newname

-

`File and Directory Access Control`

+

Action	MS Windows Command	Unix Command
create	md folder	mkdir folder
delete	rd folder	rmdir folder
rename	rename oldname newname	mv oldname newname

`File and Directory Access Control`

The network administrator is strongly advised to read foundational training manuals and reference materials regarding file and directory permissions maintenance. Much can be achieved with the basic Unix permissions without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended Attributes (EAs). -

- Unix/Linux file and directory access permissions invloves setting three (3) primary sets of data and one (1) control set. + + Unix/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. A Unix file listing looks as follows:- - + jht@frodo:~/stuff> ls -la total 632 drwxr-xr-x 13 jht users 816 2003-05-12 22:56 . @@ -4344,13 +4383,13 @@ at how Samba helps to bridge the differences. -rw-rw-rw- 1 jht users 41105 2003-05-12 22:32 mydata06.lst -rwxrwxrwx 1 jht users 19312 2003-05-12 22:32 mydata07.lst jht@frodo:~/stuff> - - + + The columns above represent (from left to right): permissions, no blocks used, owner, group, size (bytes), access date, access time, file name. - + The permissions field is made up of: - + JRV: Put this into a diagram of some sort [ type ] [ users ] [ group ] [ others ] [File, Directory Permissions] [ d | l ] [ r w x ] [ r w x ] [ r w x ] @@ -4366,20 +4405,20 @@ at how Samba helps to bridge the differences. | | |-----------------------------> Can Read, Read files | |-----------------------------------> Is a symbolic Link |---------------------------------------> Is a directory - - + + Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character. - Example 13.1. Example File + Example 13.1. Example File -rwxr-x--- Means: The owner (user) can read, write, execute the group can read and execute everyone else can NOT do anything with it - + - - Additional posibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket. - The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x),r + Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket. + + The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x), execute only if the file is a directory or already has execute permission for some user (X), set user or group ID on execution (s), sticky (t). @@ -4396,10 +4435,10 @@ at how Samba helps to bridge the differences. the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then group members will be able to write to (or delete) them. -

`Share Definition Access Controls`

+

`Share Definition Access Controls`

The following parameters in the smb.conf file sections that define a share control or affect access controls. Before using any of the following options please refer to the man page for smb.conf. -

`User and Group Based Controls`

+

`User and Group Based Controls`

User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all file system operations as if a single user is doing this, the use of the force user and force group behaviour will achieve this. In other situations it may be necessary to affect a @@ -4411,7 +4450,7 @@ Before using any of the following options please refer to the man page for

Table 13.2. User and Group Based Controls Control Parameter Description - Action - Notes admin users + Table 13.2. User and Group Based Controls Control Parameter Description - Action - Notes admin users List of users who will be granted administrative privileges on the share. They will do all file operations as the super-user (root). Any user in this list will be able to do anything they like on the share, @@ -4438,12 +4477,12 @@ Before using any of the following options please refer to the man page for write list List of users that are given read-write access to a service. - File and Directory Permissions Based Controls +

`File and Directory Permissions Based Controls`

The following file and directory permission based controls, if misused, can result in considerable difficulty to diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually - re-instroduce them in a controlled fashion. -

Table 13.3. File and Directory Permission Based Controls Control Parameter Description - Action - Notes create mask + re-introduce them in a controlled fashion. + Table 13.3. File and Directory Permission Based Controls Control Parameter Description - Action - Notes create mask Refer to the smb.conf man page. directory mask The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. @@ -4459,17 +4498,17 @@ Before using any of the following options please refer to the man page for force security mode Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. hide unreadable - Prevents clients from seeing the existance of files that cannot be read. + Prevents clients from seeing the existence of files that cannot be read. hide unwriteable files - Prevents clients from seeing the existance of files that cannot be written to. Unwriteable directories are shown as usual. + Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. nt acl support This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. security mask Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. - Miscellaneous Controls +

`Miscellaneous Controls`

The following are documented because of the prevalence of administrators creating inadvertant barriers to file access by not understanding the full implications of smb.conf file settings. -

Table 13.4. Other Controls Control Parameter Description - Action - Notes case sensitive, default case, short preserve case + Table 13.4. Other Controls Control Parameter Description - Action - Notes case sensitive, default case, short preserve case This means that all file name lookup will be done in a case sensitive manner. Files will be created with the precise filename Samba received from the MS Windows client. csc policy @@ -4490,9 +4529,9 @@ Before using any of the following options please refer to the man page for veto files List of files and directories that are neither visible nor accessible. - Access Controls on Shares +

`Access Controls on Shares`

This section deals with how to configure Samba per share access control restrictions. - By default samba sets no restrictions on the share itself. Restrictions on the share itself + By default, Samba sets no restrictions on the share itself. Restrictions on the share itself can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can connect to a share. In the absence of specific restrictions the default setting is to allow the global user Everyone Full Control (ie: Full control, Change and Read). @@ -4504,12 +4543,12 @@ Before using any of the following options please refer to the man page for

Samba stores the per share access control settings in a file called share_info.tdb. The location of this file on your system will depend on how samba was compiled. The default location - for samba's tdb files is under /usr/local/samba/var. If the tdbdump - utility has been compiled and installed on your system then you can examine the contents of this file + for Samba's tdb files is under /usr/local/samba/var. If the tdbdump + utility has been compiled and installed on your system, then you can examine the contents of this file by: tdbdump share_info.tdb. -

`Share Permissions Management`

- The best tool for the task is platform dependant. Choose the best tool for your environmemt. -

`Windows NT4 Workstation/Server`

+

`Share Permissions Management`

+ The best tool for the task is platform dependant. Choose the best tool for your environment. +

`Windows NT4 Workstation/Server`

The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. @@ -4519,7 +4558,7 @@ Before using any of the following options please refer to the man page for

Now click on the share that you wish to manage, then click on the Properties tab, next click on the Permissions tab. Now you can add or change access control settings as you wish. -

`Windows 200x/XP`

+

`Windows 200x/XP`

On MS Windows NT4/200x/XP system access control lists on the share itself are set using native tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, then select Sharing, then click on Permissions. The default @@ -4532,7 +4571,7 @@ Before using any of the following options please refer to the man page for Action, select Connect to another computer. If you are not logged onto a domain you will be prompted to enter a domain login user identifier and a password. This will authenticate you to the domain. - If you where already logged in with administrative privilidge this step is not offered. + If you where already logged in with administrative privilege this step is not offered.

If the Samba server is not shown in the Select Computer box, then type in the name of the target Samba server in the field Name:. Now click on the [+] next to @@ -4548,7 +4587,7 @@ Before using any of the following options please refer to the man page for no access means that MaryK who is part of the group Everyone will have no access even if this user is given explicit full control access. -

`MS Windows Access Control Lists and Unix Interoperability`

`Managing UNIX permissions Using NT Security Dialogs`

Windows NT clients can use their native security settings +

`MS Windows Access Control Lists and Unix Interoperability`

`Managing UNIX permissions Using NT Security Dialogs`

Windows NT clients can use their native security settings dialog box to view and modify the underlying UNIX permissions.

Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and still obeys all the file permission rules that a Samba @@ -4559,7 +4598,7 @@ Before using any of the following options please refer to the man page for

`Viewing File Security on a Samba Share`

From an NT4/2000/XP client, single-click with the right +

`Viewing File Security on a Samba Share`

From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba mounted drive letter or UNC path. When the menu pops-up, click on the Properties entry at the bottom of @@ -4575,7 +4614,7 @@ Before using any of the following options please refer to the man page for Add button will not currently - allow a list of users to be seen.

`Viewing file ownership`

Clicking on the Ownership button + allow a list of users to be seen.

`Viewing file ownership`

Clicking on the Ownership button brings up a dialog box telling you who owns the given file. The owner name will be of the form :

"SERVER\user (Long name)"

Where SERVER is the NetBIOS name of the Samba server, user is the user name of @@ -4598,7 +4637,7 @@ Before using any of the following options please refer to the man page for Seclib NT security library written by Jeremy Allison of - the Samba Team, available from the main Samba ftp site.

`Viewing File or Directory Permissions`

The third button is the Permissions + the Samba Team, available from the main Samba ftp site.

`Viewing File or Directory Permissions`

The third button is the Permissions button. Clicking on this brings up a dialog box that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed in the form :

"SERVER\ @@ -4612,9 +4651,9 @@ Before using any of the following options please refer to the man page for "Everyone" and the permissions will be shown as NT "Full Control".

The permissions field is displayed differently for files and directories, so I'll describe the way file permissions - are displayed first.

`File Permissions`

The standard UNIX user/group/world triple and + are displayed first.

`File Permissions`

The standard UNIX user/group/world triplet and the corresponding "read", "write", "execute" permissions - triples are mapped by Samba into a three element NT ACL + triplets are mapped by Samba into a three element NT ACL with the 'r', 'w', and 'x' bits mapped into the corresponding NT permissions. The UNIX world permissions are mapped into the global NT group Everyone, followed @@ -4634,7 +4673,7 @@ Before using any of the following options please refer to the man page for "O" bit set. This was chosen of course to make it look like a zero, meaning zero permissions. More details on the decision behind this will - be given below.

`Directory Permissions`

Directories on an NT NTFS file system have two + be given below.

`Directory Permissions`

Directories on an NT NTFS file system have two different sets of permissions. The first set of permissions is the ACL set on the directory itself, this is usually displayed in the first set of parentheses in the normal "RW" @@ -4645,7 +4684,7 @@ Before using any of the following options please refer to the man page for permissions that any file created within this directory would inherit.

Samba synthesises these inherited permissions for NT by returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

`Modifying file or directory permissions`

Modifying file and directory permissions is as simple + created by Samba on this share would receive.

`Modifying file or directory permissions`

Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and clicking the OK button. However, there are limitations that a user needs to be aware of, and also interactions @@ -4659,14 +4698,14 @@ Before using any of the following options please refer to the man page for ). This means that you can only manipulate the current user/group/world permissions listed in the dialog box. This actually works quite well as these are the - only permissions that UNIX actually has.

If a permission triple (either user, group, or world) + only permissions that UNIX actually has.

If a permission triplet (either user, group, or world) is removed from the list of permissions in the NT dialog box, then when the OK button is pressed it will be applied as "no permissions" on the UNIX side. If you then view the permissions again the "no permissions" entry will appear as the NT "O" flag, as described above. This allows you to add permissions back to a file or directory once - you have removed them from a triple component.

As UNIX supports only the "r", "w" and "x" bits of + you have removed them from a triplet component.

As UNIX supports only the "r", "w" and "x" bits of an NT ACL then if other NT security attributes such as "Delete access" are selected then they will be ignored when applied on the Samba server.

When setting permissions on a directory the second @@ -4679,16 +4718,16 @@ Before using any of the following options please refer to the man page for Remove button, or set the component to only have the special Take Ownership permission (displayed as "O" - ) highlighted.

`Interaction with the standard Samba create mask - parameters`

There are four parameters + ) highlighted.

`Interaction with the standard Samba create mask + parameters`

There are four parameters to control interaction with the standard Samba create mask parameters. These are : - security mask force security mode directory security mask force directory security mode +

security mask

force security mode

directory security mask

force directory security mode

-

Once a user clicks OK to apply the +

Once a user clicks OK to apply the permissions Samba maps the given permissions into a user/group/world - r/w/x triple set, and then will check the changed permissions for a + r/w/x triplet set, and then will check the changed permissions for a file against the bits set in the security mask parameter. Any bits that were changed that are not set to '1' in this parameter are left alone @@ -4726,7 +4765,7 @@ Before using any of the following options please refer to the man page for smb.conf file in that share specific section : -

security mask = 0777

force security mode = 0

directory security mask = 0777

force directory security mode = 0

`Interaction with the standard Samba file attribute + security mask = 0777 force security mode = 0 directory security mask = 0777 force directory security mode = 0`

`Interaction with the standard Samba file attribute mapping`

Samba maps some of the DOS attribute bits (such as "read only") into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security @@ -4743,13 +4782,13 @@ Before using any of the following options please refer to the man page for OK to get back to the attributes dialog you should always hit Cancel rather than OK to ensure that your changes - are not overridden.

`Common Errors`

+ are not overridden.

`Common Errors`

File, Directory and Share access problems are very common on the mailing list. The following are examples taken from the mailing list in recent times. -

`Users can not write to a public share`

+

`Users can not write to a public share`

“ We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), - and theres a public share, on which everyone needs to have permission to create / modify files, but only + and there's a public share, on which everyone needs to have permission to create / modify files, but only root can change the file, no one else can. We need to constantly go to server to chgrp -R users * and chown -R nobody * to allow others users to change the file. ” @@ -4757,78 +4796,78 @@ are examples taken from the mailing list in recent times. There are many ways to solve this problem, here are a few hints:

Procedure 13.3. Example Solution:

Go to the top of the directory that is shared -
+

Set the ownership to what ever public owner and group you want -

+			
 			find 'directory_name' -type d -exec chown user.group {}\;
 			find 'directory_name' -type d -exec chmod 6775 'directory_name'
 			find 'directory_name' -type f -exec chmod 0775 {} \;
 			find 'directory_name' -type f -exec chown user.group {}\;
-			

-			Note

+

+

`Note`

The above will set the 'sticky bit' on all directories. Read your Unix/Linux man page on what that does. It causes the OS to assign to all files created in the directories the ownership of the directory. -

+

Directory is: /foodbar -

+			
 				$ chown jack.engr /foodbar
-			

-			Note

-				This is the same as doing:

-				+			

+			
Note

+				
This is the same as doing:

+				
 					$ chown jack /foodbar
 					$ chgrp engr /foodbar
-				

-

Now do: + +

Now do: -

+			
 				$ chmod 6775 /foodbar
 				$ ls -al /foodbar/..
-			

+

- You should see: -

+			
You should see:
+			
 				drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
-			

-

Now do: - + +

Now do: +

 				$ su - jill
 				$ cd /foodbar
 				$ touch Afile
 				$ ls -al
-

- + + You should see that the file Afile created by Jill will have ownership and permissions of Jack, as follows: - + -rw-r--r-- 1 jack engr 0 2003-02-04 09:57 Afile - -

+ +

Now in your smb.conf for the share add: -

+		
 		force create mode = 0775
-		force direcrtory mode = 6775
-		

-		Note

+		force directory mode = 6775
+

+

`Note`

The above are only needed if your users are not members of the group you have used. ie: Within the OS do not have write permission on the directory. -

+

An alternative is to set in the smb.conf entry for the share: -

+		
 		force user = jack
 		force group = engr
-		

-

`I have set force user and samba still makes root the owner of all the files + +`

`I have set force user and Samba still makes root the owner of all the files I touch!`

- When you have a user in 'admin users', samba will always do file operations for + When you have a user in 'admin users', Samba will always do file operations for this user as root, even if force user has been set. -

`Chapter 14. File and Record Locking`

`Jeremy Allison`

Samba Team <jra@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

`Eric Roseme`

HP Oplocks Usage Recommendations Whitepaper <eric.roseme@hp.com>

Table of Contents

Opportunistic Locking Overview

MS Windows Opportunistic Locking and Caching Controls

Example Configuration

Workstation Service Entries
Server Service Entries

locking.tdb error messages

+

`Chapter 14. File and Record Locking`

`Jeremy Allison`

Samba Team <jra@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

`Eric Roseme`

HP Oplocks Usage Recommendations Whitepaper <eric.roseme@hp.com>

Table of Contents

Opportunistic Locking Overview

MS Windows Opportunistic Locking and Caching Controls

Example Configuration

Workstation Service Entries
Server Service Entries

locking.tdb error messages