SAMBA Project Documentation

Try listing the shares available on your - server

Example Configuration
SWAT

Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client

3. Fast Start for the Impatient

Why are so many smbd processes eating memory?
I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Note

II. Server Configuration Basics

Seamless Windows Network Integration

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

Domain Controller Types
Preparing for Domain Control

Common Problems and Errors

Domain Network Logon Service
Security Mode and Master Browsers

I cannot include a '$' in a machine name
I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
The system can not log you on (C000019B)....
The machine trust account for this computer either does not -exist or is not accessible.
When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Example Configuration

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

MS Windows Workstation/Server Machine Trust Accounts

Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member

Joining an NT4 type Domain with Samba-3
Why is this better than security = server?

Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes

Can Not Add Machine Back to Domain
Adding Machine to Domain Fails

Reference Documentation Server
Central Print Serving

10. Samba / MS Windows Network Browsing Guide

Note

III. Advanced Configuration

What is Browsing?

How Browsing Functions

NetBIOS over TCP/IP
TCP/IP - without NetBIOS
DNS and Active Directory

Setting up WORKGROUP Browsing
Setting up DOMAIN Browsing
Forcing Samba to be the master
Making Samba the domain master
Note about broadcast addresses
Multiple interfaces
Use of the Remote Announce parameter
Use of the Remote Browse Sync parameter

WINS - The Windows Internetworking Name Server

Setting up a WINS server
WINS Replication
Static WINS Entries

Helpful Hints

Windows Networking Protocols
Name Resolution Order

Technical Overview of browsing

Browsing support in Samba
Problem resolution
Browsing across subnets

How can one flush the Samba NetBIOS name cache without restarting Samba?
My client reports "This server is not configured to list shared resources"

11. Account Information Databases

Technical Information

Important Notes About Security
Mapping User Identifiers between MS Windows and Unix

Account Management Tools

The smbpasswd Command
The pdbedit Command

Password Backends

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon - Users not in Samba SAM
Users are being added to the wrong backend database
auth methods does not work

12. Mapping MS Windows and Unix Groups

Configuration Scripts

Example Configuration

Sample smb.conf add group script
Script to configure Group Mapping

13. File, Directory and Share Access Controls

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails

File System Access Controls

MS Windows NTFS Comparison with Unix File Systems
Managing Directories
File and Directory Access Control

Share Definition Access Controls

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

Access Controls on Shares

Share Permissions Management

MS Windows Access Control Lists and Unix Interoperability

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask - parameters
Interaction with the standard Samba file attribute - mapping

Users can not write to a public share
I have set force user and Samba still makes root the owner of all the files - I touch!

14. File and Record Locking

Samba Opportunistic Locking Control

Opportunistic Locking Overview

Example Configuration

MS Windows Opportunistic Locking and Caching Controls

Workstation Service Entries
Server Service Entries

Persistent Data Corruption

locking.tdb error messages

Additional Reading

15. Securing Samba

Technical Discussion of Protective Measures and Issues

Using host based protection
User based protection
Using interface protection
Using a firewall
Using a IPC$ share deny
NTLMv2 Security

Upgrading Samba

Smbclient works on localhost, but the network is dead
Why can users access home directories of other users?

16. Interdomain Trust Relationships

Trust Relationship Background

Native MS Windows NT4 Trusts Configuration

NT4 as the Trusting Domain (ie. creating the trusted account)
NT4 as the Trusted Domain (ie. creating trusted account's password)

Configuring Samba NT-style Domain Trusts

Samba-3 as the Trusting Domain
Samba-3 as the Trusted Domain

17. Hosting a Microsoft Distributed File System tree on Samba

Tell me about Trust Relationships using Samba

Features and Benefits
Common Errors

18. Classical Printing Support

Technical Introduction

What happens if you send a Job from a Client
Printing Related Configuration Parameters
Parameters Recommended for Use
Parameters for Backwards Compatibility
Parameters no longer in use

A simple Configuration to Print with Samba-3

Verification of "Settings in Use" with testparm
A little Experiment to warn you

Extended Sample Configuration to Print with Samba-3

Detailed Explanation of the Example's Settings

The [global] Section
The [printers] Section
Any [my_printer_name] Section
Print Commands
Default Print Commands for various Unix Print Subsystems
Setting up your own Print Commands

Innovations in Samba Printing since 2.2

Client Drivers on Samba Server for Point'n'Print
The [printer$] Section is removed from Samba-3
Creating the [print$] Share
Parameters in the [print$] Section
Subdirectory Structure in [print$]

Installing Drivers into [print$]

Setting Drivers for existing Printers with a Client GUI
Setting Drivers for existing Printers with -rpcclient

"The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)

The first Client Driver Installation
IMPORTANT! Setting Device Modes on new Printers
Further Client Driver Install Procedures
Always make first Client Connection as root or "printer admin"

Other Gotchas

Setting Default Print Options for the Client Drivers
Supporting large Numbers of Printers
Adding new Printers with the Windows NT APW
Weird Error Message Cannot connect under a -different Name
Be careful when assembling Driver Files
Samba and Printer Ports
Avoiding the most common Misconfigurations of the Client Driver

The Imprints Toolset

What is Imprints?
Creating Printer Driver Packages
The Imprints Server
The Installation Client

Add Network Printers at Logon without User Interaction

The addprinter command

Migration of "Classical" printing to Samba-3

Publishing Printer Information in Active Directory or LDAP

Common Errors and Problems

I give my root password but I don't get access
My printjobs get spooled into the spooling directory, but then get lost

19. CUPS Printing Support in Samba 3.0

Basic Configuration of CUPS support

Features and Benefits
Overview

Linking of smbd with libcups.so
Simple smb.conf Settings for CUPS
More complex smb.conf Settings for -CUPS

Advanced Configuration

Central spooling vs. "Peer-to-Peer" printing
CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
Driver Installation Methods on Windows Clients
Explicitly enable "raw" printing for -application/octet-stream!
Three familiar Methods for driver upload plus a new one

Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download

GDI on Windows -- PostScript on Unix
Windows Drivers, GDI and EMF
Unix Printfile Conversion and GUI Basics
PostScript and Ghostscript
Ghostscript -- the Software RIP for non-PostScript Printers
PostScript Printer Description (PPD) Specification
CUPS can use all Windows-formatted Vendor PPDs
CUPS also uses PPDs for non-PostScript Printers

The CUPS Filtering Architecture

MIME types and CUPS Filters
MIME type Conversion Rules
Filter Requirements
Prefilters
pstops
pstoraster
imagetops and imagetoraster
rasterto [printers specific]
CUPS Backends
cupsomatic/Foomatic -- how do they fit into the Picture?
The Complete Picture
mime.convs
"Raw" printing
"application/octet-stream" printing
PostScript Printer Descriptions (PPDs) for non-PS Printers
Difference between cupsomatic/foomatic-rip and -native CUPS printing
Examples for filtering Chains
Sources of CUPS drivers / PPDs
Printing with Interface Scripts

Network printing (purely Windows)

From Windows Clients to an NT Print Server
Driver Execution on the Client
Driver Execution on the Server

Network Printing (Windows clients -- UNIX/Samba Print -Servers)

From Windows Clients to a CUPS/Samba Print Server
Samba receiving Jobfiles and passing them to CUPS

Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs

PPDs for non-PS Printers on UNIX
PPDs for non-PS Printers on Windows

Windows Terminal Servers (WTS) as CUPS Clients

Printer Drivers running in "Kernel Mode" cause many -Problems
Workarounds impose Heavy Limitations
CUPS: a "Magical Stone"?
PostScript Drivers with no major problems -- even in Kernel -Mode

Setting up CUPS for driver Download

cupsaddsmb: the unknown Utility
Prepare your smb.conf for -cupsaddsmb
CUPS Package of "PostScript Driver for WinNT/2k/XP"
Recognize the different Driver Files
Acquiring the Adobe Driver Files
ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
Caveats to be considered
What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
Run "cupsaddsmb" (quiet Mode)
Run "cupsaddsmb" with verbose Output
Understanding cupsaddsmb
How to recognize if cupsaddsm completed successfully
cupsaddsmb with a Samba PDC
cupsaddsmb Flowchart
Installing the PostScript Driver on a Client
Avoiding critical PostScript Driver Settings on the -Client

Installing PostScript Driver Files manually (using -rpcclient)

A Check of the rpcclient man Page
Understanding the rpcclient man Page
Producing an Example by querying a Windows Box
What is required for adddriver and setdriver to succeed
Manual Commandline Driver Installation in 15 little Steps
Troubleshooting revisited

The printing *.tdb Files

Trivial DataBase Files
Binary Format
Losing *.tdb Files
Using tdbbackup

CUPS Print Drivers from Linuxprinting.org

foomatic-rip and Foomatic explained
foomatic-rip and Foomatic-PPD Download and Installation

Page Accounting with CUPS

Setting up Quotas
Correct and incorrect Accounting
Adobe and CUPS PostScript Drivers for Windows Clients
The page_log File Syntax
Possible Shortcomings
Future Developments
Other Accounting Tools

Additional Material

Auto-Deletion or Preservation of CUPS Spool Files

CUPS Configuration Settings explained
Pre-conditions
Manual Configuration

When not to use Samba to print to -CUPS

In Case of Trouble.....

Where to find Documentation
How to ask for Help
Where to find Help

Appendix

Printing from CUPS to Windows attached -Printers
More CUPS filtering Chains
Trouble Shooting Guidelines to fix typical Samba printing -Problems
An Overview of the CUPS Printing Processes

20. Stackable VFS modules

VFS modules available elsewhere

Included modules

audit
extd_audit
fake_perms
recycle
netatalk

DatabaseFS
vscan

21. Integrated Logon Support using Winbind

What Winbind Provides

Target Uses

How Winbind Works

Microsoft Remote Procedure Calls
Microsoft Active Directory Services
Name Service Switch
Pluggable Authentication Modules
User and Group ID Allocation
Result Caching

Installation and Configuration

Introduction
Requirements
Testing Things Out

Conclusion

22. Advanced Network Management

Remote Server Administration

Remote Desktop Management

Remote Management from NoMachines.Com

Network Logon Script Magic

Adding printers without user intervention

23. System and Account Policies

Creating and Managing System Policies

Windows 9x/Me Policies
Windows NT4 Style Policy Files
MS Windows 200x / XP Professional Policies

Managing Account/User Policies

Samba Editreg Toolset
Windows NT4/200x
Samba PDC

System Startup and Logon Processing Overview

Policy Does Not Work

24. Desktop Profile Management

Creating/Managing Group Profiles

Roaming Profiles

Samba Configuration for Profile Handling
Windows Client Profile Configuration Information
Sharing Profiles between W9x/Me and NT4/200x/XP workstations
Profile Migration from Windows NT4/200x Server to Samba

Mandatory profiles

Default Profile for Windows Users

MS Windows 9x/Me
MS Windows NT4 Workstation
MS Windows 200x/XP

25. PAM based Distributed Authentication

How does one set up roaming profiles for just one (or a few) user/s or group/s?
Can NOT use Roaming Profiles
Changing the default profile

Technical Discussion

PAM Configuration Syntax
Example System Configurations
smb.conf PAM Configuration
Remote CIFS Authentication using winbindd.so
Password Synchronization using pam_smbpass.so

26. Integrating MS Windows networks with Samba

pam_winbind problem

Background Information

Name Resolution in a pure Unix/Linux world

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

Name resolution as used within MS Windows networking

The NetBIOS Name Cache
The LMHOSTS file
HOSTS file
DNS Lookup
WINS Lookup

30. Upgrading from Samba-2.x to Samba-3.0.0

My Boomerang Won't Come Back
Very Slow Network Connections
Samba server name change problem

27. Unicode/Charsets

Features and Benefits
What are charsets and unicode?
Samba and charsets
Conversion from old names
Japanese charsets

28. Samba Backup Techniques

Note
Features and Benefits

29. High Availability Options

Note

IV. Migration and Updating

Charsets
Obsolete configuration options
Password Backend

31. Migration from NT4 PDC to Samba-3 PDC

Planning and Getting Started

Objectives
Steps In Migration Process

Migration Options

Planning for Success
Samba Implementation Choices

32. SWAT - The Samba Web Administration Tool

34. Analysing and solving samba problems

Enabling SWAT for use
Securing SWAT through SSL
The SWAT Home Page
Global Settings
Share Settings
Printers Settings
The SWAT Wizard
The Status Page
The View Page
The Password Change Page

V. Troubleshooting

33. The Samba checklist

Introduction
Assumptions
The tests
Still having troubles?

Diagnostics tools
Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
Useful URLs
Getting help from the mailing lists
How to get off the mailing lists

35. Reporting Bugs

Introduction
General info
Debug levels
Internal errors
Attaching to a running process
Patches

VI. Appendixes

36. How to compile SAMBA

Access Samba source code via CVS

Introduction
CVS Access to samba.org

Accessing the samba sources via rsync and ftp

Verifying Samba's PGP signature

Building the Binaries

Compiling samba with Active Directory support

Starting the smbd and nmbd

Starting from inetd.conf
Alternative: starting it as a daemon

37. Portability

RedHat Linux Rembrandt-II

AIX

Sequential Read Ahead

Solaris

Locking improvements
Winbind on Solaris 9

38. Samba and other CIFS clients

Macintosh clients?

OS2 Client

How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
How do I get printer driver download working - for OS/2 clients?

Windows for Workgroups

Use latest TCP/IP stack from Microsoft
Delete .pwl files after password change
Configure WfW password handling
Case handling of passwords
Use TCP/IP as default protocol
Speed improvement

Windows '95/'98

Speed improvement

Windows 2000 Service Pack 2

Windows NT 3.1

39. Samba Performance Tuning

Comparisons
Socket options
Read size
Max xmit
Log level
Read raw
Write raw
Slow Logins
Client tuning
Samba performance problem due changing kernel
Corrupt tdb Files

40. DNS and DHCP Configuration Guide

Note

41. Further Resources

Websites
Related updates from Microsoft
Books

Index

List of Figures

19.1. Windows Printing to a local Printer
19.2. Printing to a Postscript Printer
19.3. Ghostscript as a RIP for non-postscript printers
19.4. Prefiltering in CUPS to form Postscript
19.5. Adding Device-specific Print Options
19.6. Postscript to intermediate Raster format
19.7. CUPS-raster production using Ghostscript
19.8. Image format to CUPS-raster format conversion
19.9. Raster to Printer Specific formats
19.10. cupsomatic/foomatic processing versus Native CUPS
19.11. Print Driver execution on the Client
19.12. Print Driver execution on the Server
19.13. Printing via CUPS/samba server
19.14. cupsaddsmb flowchart
19.15. CUPS Printing Overview

List of Tables

7.1. Assumptions
10.1. Browse subnet example 1
10.2. Browse subnet example 2
10.3. Browse subnet example 3
10.4. Browse subnet example 4
11.1. Attributes in the sambaSamAccount objectclass (LDAP)
11.2. Basic smb.conf options for MySQL passdb backend
11.3. MySQL field names for MySQL passdb backend
13.1. Managing directories with unix and windows
13.2. User and Group Based Controls
13.3. File and Directory Permission Based Controls
13.4. Other Controls
20.1. Extended Auditing Log Information
24.1. User Shell Folder registry keys default values
24.2. Defaults of profile settings registry keys
24.3. Defaults of default user profile paths registry keys
25.1. Options recognized by pam_smbpass
31.1. The 3 Major Site Types
31.2. Nature of the Conversion Choices

List of Examples

12.1. smbgrpadd.sh
13.1. Example File

General Installation

Preparing Samba for Configuration

This section of the Samba-HOWTO-Collection contains general info on how to install samba +

Table of Contents

Legal Notice

Attributions

I. General Installation

1. Introduction to Samba

Background
Terminology
Related Projects
SMB Methodology
Epilogue
Miscellaneous

2. How to Install and Test SAMBA

Try listing the shares available on your + server

Example Configuration
SWAT

Try connecting from another SMB client

3. Fast Start for the Impatient

Large number of smbd processes
"open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
"The network name cannot be found"

Note

II. Server Configuration Basics

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

Password checking

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

Domain Controller Types
Preparing for Domain Control

Domain Network Logon Service
Security Mode and Master Browsers

'$' cannot be included in machine name
Joining domain fails because of existing machine account
The system can not log you on (C000019B)....
The machine trust account not accessible
Account disabled
Domain Controller Unavailable
Can not log onto domain member workstation after joining domain

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Example Configuration

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

MS Windows Workstation/Server Machine Trust Accounts

Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member

Joining an NT4 type Domain with Samba-3
Why is this better than security = server?

Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes

Can Not Add Machine Back to Domain
Adding Machine to Domain Fails
I can't join a Windows 2003 PDC

Reference Documentation Server
Central Print Serving

10. Samba / MS Windows Network Browsing Guide

Note

III. Advanced Configuration

What is Browsing?

How Browsing Functions

NetBIOS over TCP/IP
TCP/IP - without NetBIOS
DNS and Active Directory

Setting up WORKGROUP Browsing
Setting up DOMAIN Browsing
Forcing Samba to be the master
Making Samba the domain master
Note about broadcast addresses
Multiple interfaces
Use of the Remote Announce parameter
Use of the Remote Browse Sync parameter

WINS - The Windows Internetworking Name Server

Setting up a WINS server
WINS Replication
Static WINS Entries

Helpful Hints

Windows Networking Protocols
Name Resolution Order

Technical Overview of browsing

Browsing support in Samba
Problem resolution
Browsing across subnets

How can one flush the Samba NetBIOS name cache without restarting Samba?
My client reports "This server is not configured to list shared resources"
I get an Unable to browse the network error

11. Account Information Databases

Technical Information

Backwards Compatibility Backends
New Backends

Important Notes About Security
Mapping User Identifiers between MS Windows and UNIX
Mapping Common UIDs/GIDs on Distributed Machines

Account Management Tools

The smbpasswd Command
The pdbedit Command

Password Backends

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon
Users being added to wrong backend database
auth methods does not work

12. Mapping MS Windows and UNIX Groups

Configuration Scripts

Example Configuration

Sample smb.conf add group script
Script to configure Group Mapping

13. File, Directory and Share Access Controls

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails
Adding Domain Users to the Power Users group

File System Access Controls

MS Windows NTFS Comparison with UNIX File Systems
Managing Directories
File and Directory Access Control

Share Definition Access Controls

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

Access Controls on Shares

Share Permissions Management

MS Windows Access Control Lists and UNIX Interoperability

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask + parameters
Interaction with the standard Samba file attribute mapping

Users can not write to a public share
I have set force user but Samba still makes root the owner of all the files I touch!
MS Word with Samba changes owner of file

14. File and Record Locking

Samba Opportunistic Locking Control

Opportunistic Locking Overview

Example Configuration

MS Windows Opportunistic Locking and Caching Controls

Workstation Service Entries
Server Service Entries

Persistent Data Corruption

locking.tdb error messages
Problems saving files in MS Office on Windows XP
Long delays deleting files over network with XP SP1

Additional Reading

15. Securing Samba

Technical Discussion of Protective Measures and Issues

Using host based protection
User based protection
Using interface protection
Using a firewall
Using a IPC$ share deny
NTLMv2 Security

Upgrading Samba

Smbclient works on localhost, but the network is dead
Why can users access home directories of other users?

16. Interdomain Trust Relationships

Trust Relationship Background

Native MS Windows NT4 Trusts Configuration

Creating an NT4 Domain Trust
Completing an NT4 Domain Trust
Inter-Domain Trust Facilities

Configuring Samba NT-style Domain Trusts

Samba as the Trusted Domain
Samba as the Trusting Domain

NT4-style Domain Trusts with Windows 2000

17. Hosting a Microsoft Distributed File System tree on Samba

Features and Benefits
Common Errors

18. Classical Printing Support

Technical Introduction

What happens if you send a Job from a Client
Printing Related Configuration Parameters
Parameters Recommended for Use

A simple Configuration to Print

Verification of "Settings in Use" with testparm
A little Experiment to warn you

Extended Sample Configuration to Print

Detailed Explanation of the Example's Settings

The [global] Section
The [printers] Section
Any [my_printer_name] Section
Print Commands
Default Print Commands for various UNIX Print Subsystems
Setting up your own Print Commands

Innovations in Samba Printing since 2.2

Client Drivers on Samba Server for Point'n'Print
The [printer$] Section is removed from Samba 3
Creating the [print$] Share
Parameters in the [print$] Section
Subdirectory Structure in [print$]

Installing Drivers into [print$]

Setting Drivers for existing Printers with a Client GUI
Setting Drivers for existing Printers with +rpcclient

Client Driver Install Procedure

The first Client Driver Installation
IMPORTANT! Setting Device Modes on new Printers
Further Client Driver Install Procedures
Always make first Client Connection as root or "printer admin"

Other Gotchas

Setting Default Print Options for the Client Drivers
Supporting large Numbers of Printers
Adding new Printers with the Windows NT APW
Weird Error Message Cannot connect under a +different Name
Be careful when assembling Driver Files
Samba and Printer Ports
Avoiding the most common Misconfigurations of the Client Driver

The Imprints Toolset

What is Imprints?
Creating Printer Driver Packages
The Imprints Server
The Installation Client

Add Network Printers at Logon without User Interaction

The addprinter command

Migration of "Classical" printing to Samba

Publishing Printer Information in Active Directory or LDAP

I give my root password but I don't get access
My printjobs get spooled into the spooling directory, but then get lost

19. CUPS Printing Support in Samba 3.0

Basic Configuration of CUPS support

Features and Benefits
Overview

Linking of smbd with libcups.so
Simple smb.conf Settings for CUPS
More complex smb.conf Settings for +CUPS

Advanced Configuration

Central spooling vs. "Peer-to-Peer" printing
CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
Driver Installation Methods on Windows Clients
Explicitly enable "raw" printing for +application/octet-stream!
Three familiar Methods for driver upload plus a new one

Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download

GDI on Windows -- PostScript on UNIX
Windows Drivers, GDI and EMF
UNIX Printfile Conversion and GUI Basics
PostScript and Ghostscript
Ghostscript -- the Software RIP for non-PostScript Printers
PostScript Printer Description (PPD) Specification
CUPS can use all Windows-formatted Vendor PPDs
CUPS also uses PPDs for non-PostScript Printers

The CUPS Filtering Architecture

MIME types and CUPS Filters
MIME type Conversion Rules
Filter Requirements
Prefilters
pstops
pstoraster
imagetops and imagetoraster
rasterto [printers specific]
CUPS Backends
cupsomatic/Foomatic -- how do they fit into the Picture?
The Complete Picture
mime.convs
"Raw" printing
"application/octet-stream" printing
PostScript Printer Descriptions (PPDs) for non-PS Printers
Difference between cupsomatic/foomatic-rip and +native CUPS printing
Examples for filtering Chains
Sources of CUPS drivers / PPDs
Printing with Interface Scripts

Network printing (purely Windows)

From Windows Clients to an NT Print Server
Driver Execution on the Client
Driver Execution on the Server

Network Printing (Windows clients -- UNIX/Samba Print +Servers)

From Windows Clients to a CUPS/Samba Print Server
Samba receiving Jobfiles and passing them to CUPS

Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs

PPDs for non-PS Printers on UNIX
PPDs for non-PS Printers on Windows

Windows Terminal Servers (WTS) as CUPS Clients

Printer Drivers running in "Kernel Mode" cause many +Problems
Workarounds impose Heavy Limitations
CUPS: a "Magical Stone"?
PostScript Drivers with no major problems -- even in Kernel +Mode

Setting up CUPS for driver Download

cupsaddsmb: the unknown Utility
Prepare your smb.conf for cupsaddsmb
CUPS Package of "PostScript Driver for WinNT/2k/XP"
Recognize the different Driver Files
Acquiring the Adobe Driver Files
ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
Caveats to be considered
Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
Run "cupsaddsmb" (quiet Mode)
Run "cupsaddsmb" with verbose Output
Understanding cupsaddsmb
How to recognize if cupsaddsmb completed successfully
cupsaddsmb with a Samba PDC
cupsaddsmb Flowchart
Installing the PostScript Driver on a Client
Avoiding critical PostScript Driver Settings on the +Client

Installing PostScript Driver Files manually (using +rpcclient)

A Check of the rpcclient man Page
Understanding the rpcclient man page
Producing an Example by querying a Windows Box
What is required for adddriver and setdriver to succeed
Manual Driver Installation in 15 Steps
Troubleshooting revisited

The printing *.tdb Files

Trivial DataBase Files
Binary Format
Losing *.tdb Files
Using tdbbackup

CUPS Print Drivers from Linuxprinting.org

foomatic-rip and Foomatic explained
foomatic-rip and Foomatic-PPD Download and Installation

Page Accounting with CUPS

Setting up Quotas
Correct and incorrect Accounting
Adobe and CUPS PostScript Drivers for Windows Clients
The page_log File Syntax
Possible Shortcomings
Future Developments
Other Accounting Tools

Additional Material

Auto-Deletion or Preservation of CUPS Spool Files

CUPS Configuration Settings explained
Pre-conditions
Manual Configuration

In Case of Trouble.....

Printing from CUPS to Windows attached +Printers

More CUPS filtering Chains

An Overview of the CUPS Printing Processes

Win9x client can't install driver
"cupsaddsmb" keeps asking for root password in + neverending loop
"cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present
Client can't connect to Samba printer
Can't reconnect to Samba under new account + from Win2K/XP
Avoid being connected to the Samba server as the + "wrong" user
Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems
Can't use "cupsaddsmb" on Samba server which is + a PDC
Deleted Win2K printer driver is still shown
Win2K/XP "Local Security + Policies"
WinXP clients: "Administrator can not install + printers for all local users"
"Print Change Notify" functions on + NT-clients
WinXP-SP1
Print options for all users can't be set on Win2K/XP
Most common blunders in driver + settings on Windows clients
cupsaddsmb does not work + with newly installed printer
Permissions on +/var/spool/samba/ get reset after each +reboot
Printer named "lp" +intermittently swallows jobs and spits out completely different +ones
Location of Adobe PostScript driver files necessary for "cupsaddsmb"

20. Stackable VFS modules

VFS modules available elsewhere

Included modules

audit
extd_audit
fake_perms
recycle
netatalk

DatabaseFS
vscan

21. Winbind: Use of Domain Accounts

What Winbind Provides

Target Uses

How Winbind Works

Microsoft Remote Procedure Calls
Microsoft Active Directory Services
Name Service Switch
Pluggable Authentication Modules
User and Group ID Allocation
Result Caching

Installation and Configuration

Introduction
Requirements
Testing Things Out

Conclusion

NSCD Problem Warning

22. Advanced Network Management

Remote Server Administration

Remote Desktop Management

Remote Management from NoMachines.Com

Network Logon Script Magic

Adding printers without user intervention

23. System and Account Policies

Creating and Managing System Policies

Windows 9x/Me Policies
Windows NT4 Style Policy Files
MS Windows 200x / XP Professional Policies

Managing Account/User Policies

Samba Editreg Toolset
Windows NT4/200x
Samba PDC

System Startup and Logon Processing Overview

Policy Does Not Work

24. Desktop Profile Management

Creating/Managing Group Profiles

Roaming Profiles

Samba Configuration for Profile Handling
Windows Client Profile Configuration Information
Sharing Profiles between W9x/Me and NT4/200x/XP workstations
Profile Migration from Windows NT4/200x Server to Samba

Mandatory profiles

Default Profile for Windows Users

MS Windows 9x/Me
MS Windows NT4 Workstation
MS Windows 200x/XP

25. PAM based Distributed Authentication

Setting up roaming profiles for just a few user's or group's?
Can NOT use Roaming Profiles
Changing the default profile

Technical Discussion

PAM Configuration Syntax
Example System Configurations
smb.conf PAM Configuration
Remote CIFS Authentication using winbindd.so
Password Synchronization using pam_smbpass.so

26. Integrating MS Windows networks with Samba

pam_winbind problem
Winbind is not resolving users and groups

Background Information

Name Resolution in a pure UNIX/Linux world

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

Name resolution as used within MS Windows networking

The NetBIOS Name Cache
The LMHOSTS file
HOSTS file
DNS Lookup
WINS Lookup

Pinging works only in one way
Very Slow Network Connections
Samba server name change problem

27. Unicode/Charsets

What are charsets and unicode?

Samba and charsets

Conversion from old names

Japanese charsets

Common errors

CP850.so can't be found

28. Samba Backup Techniques

Note
Features and Benefits

29. High Availability Options

Note

IV. Migration and Updating

30. Upgrading from Samba-2.x to Samba-3.0.0

New Features in Samba-3

Configuration Parameter Changes

Removed Parameters
New Parameters
Modified Parameters (changes in behavior):

New Functionality

Databases
Changes in Behavior
Charsets
Passdb Backends and Authentication
Charsets
LDAP

31. Migration from NT4 PDC to Samba-3 PDC

Planning and Getting Started

Objectives
Steps In Migration Process

Migration Options

Planning for Success
Samba-3 Implementation Choices

32. SWAT - The Samba Web Administration Tool

34. Analysing and solving samba problems

Enabling SWAT for use
Securing SWAT through SSL
The SWAT Home Page
Global Settings
Share Settings
Printers Settings
The SWAT Wizard
The Status Page
The View Page
The Password Change Page

V. Troubleshooting

33. The Samba checklist

Introduction
Assumptions
The tests

Diagnostics tools

Debugging with Samba itself
Tcpdump
Ethereal
The Windows Network Monitor

Useful URLs

Getting help from the mailing lists

How to get off the mailing lists

35. Reporting Bugs

Introduction
General info
Debug levels
Internal errors
Attaching to a running process
Patches

VI. Appendixes

36. How to compile Samba

Access Samba source code via CVS

Introduction
CVS Access to samba.org

Accessing the samba sources via rsync and ftp

Verifying Samba's PGP signature

Building the Binaries

Compiling samba with Active Directory support

Starting the smbd and nmbd

Starting from inetd.conf
Alternative: starting it as a daemon

37. Portability

HPUX

SCO UNIX

DNIX

RedHat Linux Rembrandt-II

AIX

Sequential Read Ahead

Solaris

Locking improvements
Winbind on Solaris 9

38. Samba and other CIFS clients

Macintosh clients?

OS2 Client

Configuring OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba
Configuring OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba
Printer driver download for for OS/2 clients?

Windows for Workgroups

Latest TCP/IP stack from Microsoft
Delete .pwl files after password change
Configuring WfW password handling
Case handling of passwords
Use TCP/IP as default protocol
Speed improvement

Windows '95/'98

Speed improvement

Windows 2000 Service Pack 2

Windows NT 3.1

39. Samba Performance Tuning

Comparisons
Socket options
Read size
Max xmit
Log level
Read raw
Write raw
Slow Logins
Client tuning
Samba performance problem due changing kernel
Corrupt tdb Files

40. DNS and DHCP Configuration Guide

Note

41. Further Resources

Websites
Related updates from Microsoft

Index

List of Figures

5.1. An Example Domain
10.1. Cross subnet browsing example
11.1. IDMAP
12.1. IDMAP groups
13.1. Overview of unix permissions field
16.1. Trusts overview
19.1. Windows Printing to a local Printer
19.2. Printing to a Postscript Printer
19.3. Ghostscript as a RIP for non-postscript printers
19.4. Prefiltering in CUPS to form Postscript
19.5. Adding Device-specific Print Options
19.6. Postscript to intermediate Raster format
19.7. CUPS-raster production using Ghostscript
19.8. Image format to CUPS-raster format conversion
19.9. Raster to Printer Specific formats
19.10. cupsomatic/foomatic processing versus Native CUPS
19.11. PDF to socket chain
19.12. PDF to USB chain
19.13. Print Driver execution on the Client
19.14. Print Driver execution on the Server
19.15. Printing via CUPS/samba server
19.16. cupsaddsmb flowchart
19.17. Filtering chain 1
19.18. Filtering chain with cupsomatic
19.19. CUPS Printing Overview

List of Tables

7.1. Assumptions
10.1. Browse subnet example 1
10.2. Browse subnet example 2
10.3. Browse subnet example 3
10.4. Browse subnet example 4
11.1. Attributes in the sambaSamAccount objectclass (LDAP)
11.2. Basic smb.conf options for MySQL passdb backend
11.3. MySQL field names for MySQL passdb backend
13.1. Managing directories with unix and windows
13.2. User and Group Based Controls
13.3. File and Directory Permission Based Controls
13.4. Other Controls
19.1. PPD's shipped with CUPS
20.1. Extended Auditing Log Information
24.1. User Shell Folder registry keys default values
24.2. Defaults of profile settings registry keys
24.3. Defaults of default user profile paths registry keys
25.1. Options recognized by pam_smbpass
26.1. Unique NetBIOS names
26.2. Group Names
30.1. TDB File Descriptions
31.1. The 3 Major Site Types
31.2. Nature of the Conversion Choices

List of Examples

2.1. Simplest possible smb.conf file
5.1. smb.conf for being a PDC
5.2. smb.conf for being a PDC
6.1. Minimal smb.conf for being a PDC
6.2. Minimal setup for being a BDC
8.1. smb.conf for Reference Documentation Server
8.2. smb.conf for anonymous printing
10.1. Domain master browser smb.conf
10.2. Local master browser smb.conf
10.3. smb.conf for not being a master browser
10.4. Local master browser smb.conf
10.5. smb.conf for not being a master browser
11.1.
11.2. Configuration with LDAP
12.1. smbgrpadd.sh
13.1. Example File
14.1. Share with some files oplocked
14.2.
17.1. smb.conf with DFS configured
18.1. Simple configuration with BSD printing
18.2. Extended configuration with BSD printing
18.3. [print\$] example
19.1. Simplest printing-related smb.conf
19.2. Overriding global CUPS settings for one printer
19.3. smb.conf for cupsaddsmb usage
20.1. smb.conf with VFS modules
20.2. smb.conf with multiple VFS modules
21.1. smb.conf for winbind set-up
33.1. smb.conf with [tmp] share
38.1. Minimal profile share

Legal Notice

+This documentation is distributed under the GNU General Public License (GPL) +version 2. A copy of the license is included with the Samba source +distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt +

Attributions

Introduction to Samba

David Lechnyr <david@lechnyr.com>

How to Install and Test SAMBA

Andrew Tridgell <tridge@samba.org>
Jelmer R. Vernooij <jelmer@samba.org>
John H. Terpstra <jht@samba.org>
Karl Auer

Fast Start for the Impatient

John H. Terpstra <jht@samba.org>

Server Types and Security Modes

Andrew Tridgell <tridge@samba.org>
Jelmer R. Vernooij <jelmer@samba.org>
John H. Terpstra <jht@samba.org>

Domain Control

John H. Terpstra <jht@samba.org>
Gerald (Jerry) Carter <jerry@samba.org>
David Bannon <dbannon@samba.org>

Backup Domain Control

John H. Terpstra <jht@samba.org>
Volker Lendecke <Volker.Lendecke@SerNet.DE>

Domain Membership

John H. Terpstra <jht@samba.org>
Jeremy Allison <jra@samba.org>
Gerald (Jerry) Carter <jerry@samba.org>
Andrew Tridgell <tridge@samba.org>
Jelmer R. Vernooij <jelmer@samba.org>

Stand-Alone Servers

John H. Terpstra <jht@samba.org>

MS Windows Network Configuration Guide

John H. Terpstra <jht@samba.org>

Samba / MS Windows Network Browsing Guide

John H. Terpstra <jht@samba.org>
Jelmer R. Vernooij <jelmer@samba.org>

Account Information Databases

Jelmer R. Vernooij <jelmer@samba.org>
Gerald (Jerry) Carter <jerry@samba.org>
Jeremy Allison <jra@samba.org>
John H. Terpstra <jht@samba.org>
Olivier (lem) Lemaire <olem@IDEALX.org>

Mapping MS Windows and UNIX Groups

Jean François Micouleau
Gerald (Jerry) Carter <jerry@samba.org>
John H. Terpstra <jht@samba.org>

File, Directory and Share Access Controls

John H. Terpstra <jht@samba.org>
Jeremy Allison <jra@samba.org>
Jelmer R. Vernooij <jelmer@samba.org> (drawing)

File and Record Locking

Jeremy Allison <jra@samba.org>
Jelmer R. Vernooij <jelmer@samba.org>
John H. Terpstra <jht@samba.org>
Eric Roseme <eric.roseme@hp.com>

Securing Samba

Andrew Tridgell <tridge@samba.org>
John H. Terpstra <jht@samba.org>

Interdomain Trust Relationships

John H. Terpstra <jht@samba.org>
Rafal Szczesniak <mimir@samba.org>
Jelmer R. Vernooij <jelmer@samba.org> (drawing)
Stephen Langasek <vorlon@netexpress.net>

Hosting a Microsoft Distributed File System tree on Samba

Shirish Kalele <samba@samba.org>

Classical Printing Support

Kurt Pfeifle <kpfeifle@danka.de>
Gerald (Jerry) Carter <jerry@samba.org>

CUPS Printing Support in Samba 3.0

Kurt Pfeifle <kpfeifle@danka.de>
Ciprian Vizitiu <CVizitiu@gbif.org> (drawings)
Jelmer R. Vernooij <jelmer@samba.org> (drawings)

Stackable VFS modules

Jelmer R. Vernooij <jelmer@samba.org>
John H. Terpstra <jht@samba.org>
Tim Potter
Simo Sorce (original vfs_skel README)
Alexander Bokovoy (original vfs_netatalk docs)
Stefan Metzmacher (Update for multiple modules)

Advanced Network Management

John H. Terpstra <jht@samba.org>

System and Account Policies

John H. Terpstra <jht@samba.org>

Desktop Profile Management

John H. Terpstra <jht@samba.org>

PAM based Distributed Authentication

John H. Terpstra <jht@samba.org>
Stephen Langasek <vorlon@netexpress.net>

Integrating MS Windows networks with Samba

John H. Terpstra <jht@samba.org>

Unicode/Charsets

Jelmer R. Vernooij <jelmer@samba.org>
TAKAHASHI Motonobu <monyo@home.monyo.com>

Samba Backup Techniques

John H. Terpstra <jht@samba.org>

High Availability Options

John H. Terpstra <jht@samba.org>

Upgrading from Samba-2.x to Samba-3.0.0

Jelmer R. Vernooij <jelmer@samba.org>
John H. Terpstra <jht@samba.org>
Gerald (Jerry) Carter <jerry@samba.org>

Migration from NT4 PDC to Samba-3 PDC

John H. Terpstra <jht@samba.org>

SWAT - The Samba Web Administration Tool

John H. Terpstra <jht@samba.org>

The Samba checklist

Andrew Tridgell <tridge@samba.org>
Jelmer R. Vernooij <jelmer@samba.org>

Analysing and solving samba problems

Gerald (Jerry) Carter <jerry@samba.org>
Jelmer R. Vernooij <jelmer@samba.org>
David Bannon <dbannon@samba.org>

Reporting Bugs

Jelmer R. Vernooij <jelmer@samba.org>
Andrew Tridgell <tridge@samba.org>

How to compile Samba

Jelmer R. Vernooij <jelmer@samba.org>
Andrew Tridgell <tridge@samba.org>

Portability

Jelmer R. Vernooij <jelmer@samba.org>

Samba and other CIFS clients

Jelmer R. Vernooij <jelmer@samba.org>
Jim McDonough <jmcd@us.ibm.com> (OS/2)

Samba Performance Tuning

Paul Cochrane <paulc@dth.scot.nhs.uk>
Jelmer R. Vernooij <jelmer@samba.org>
John H. Terpstra <jht@samba.org>

DNS and DHCP Configuration Guide

John H. Terpstra <jht@samba.org>

Further Resources

Jelmer R. Vernooij <jelmer@samba.org>

General Installation

Preparing Samba for Configuration

This section of the Samba-HOWTO-Collection contains general info on how to install samba and how to configure the parts of samba you will most likely need. -PLEASE read this.

Chapter 1. Introduction to Samba

David Lechnyr

Unofficial HOWTO

<david@lechnyr.com>

April 14, 2003

Table of Contents

Background
Terminology
Related Projects
SMB Methodology
Epilogue
Miscellaneous

“ +PLEASE read this.

Chapter 1. Introduction to Samba

David Lechnyr

Unofficial HOWTO

<david@lechnyr.com>

April 14, 2003

Table of Contents

Background
Terminology
Related Projects
SMB Methodology
Epilogue
Miscellaneous

“ "If you understand what you're doing, you're not learning anything." -- Anonymous ”

@@ -86,7 +85,7 @@ transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of strengths is that you can use it to blend your mix of Windows and Linux machines together without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed by a global team of about 30 active programmers and was originally developed by Andrew Tridgell. -

Background

Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only @@ -112,7 +111,7 @@ been dutifully waded through during the information-gathering stages of this pro are *still* many missing pieces... While often tedious, at least the way has been generously littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they thinking? -

Terminology

SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol.
CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently @@ -162,7 +161,7 @@ thinking? W3K: Acronym for Windows 2003 Server

If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at http://www.samba.org). -

Related Projects

There are currently two network filesystem client projects for Linux that are directly related to Samba: SMBFS and CIFS VFS. These are both available in the Linux kernel itself.

@@ -184,7 +183,7 @@ nothing to do with acting as a file and print server for SMB/CIFS clients. There are other Open Source CIFS client implementations, such as the jCIFS project which provides an SMB client toolkit written in Java. -

SMB Methodology

Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns), UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS session service, or netbios-ssn). Anyone looking at their network with a good @@ -216,7 +215,7 @@ up a single file. In general, SMB sessions are established in the following orde A good way to examine this process in depth is to try out SecurityFriday's SWB program. It allows you to walk through the establishment of a SMB/CIFS session step by step. -

Epilogue

“ +

Epilogue

“ What's fundamentally wrong is that nobody ever had any taste when they did it. Microsoft has been very much into making the user interface look good, but internally it's just a complete mess. And even people who program for Microsoft @@ -245,56 +244,47 @@ not the completely clueless user who probably sits there shivering thinking That's what's really irritating to me." ”

-- Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 -

Miscellaneous

This chapter is Copyright 2003 David Lechnyr (david at lechnyr dot com). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt. -

Chapter 2. How to Install and Test SAMBA

Andrew Tridgell

Samba Team

Jelmer R. Vernooij

The Samba Team

John H. Terpstra

Samba Team

Karl Auer

Table of Contents

Try listing the shares available on your - server

Example Configuration
SWAT

Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client

Why are so many smbd processes eating memory?
I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Obtaining and installing samba

Chapter 2. How to Install and Test SAMBA

Andrew Tridgell

Samba Team

Jelmer R. Vernooij

The Samba Team

John H. Terpstra

Samba Team

Karl Auer

Table of Contents

Try listing the shares available on your + server

Example Configuration
SWAT

Try connecting from another SMB client

Large number of smbd processes
"open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
"The network name cannot be found"

Obtaining and installing samba

Binary packages of samba are included in almost any Linux or - Unix distribution. There are also some packages available at + UNIX distribution. There are also some packages available at the samba homepage. -

If you need to compile samba from source, check the - appropriate appendix chapter.

If you have already installed samba, or if your operating system +

If you need to compile samba from source, check + the chapter about compiling samba from scratch.

If you have already installed samba, or if your operating system was pre-installed with samba, then you may not need to bother with this chapter. On the other hand, you may want to read this chapter anyhow - for information about updating samba.

Configuring samba (smb.conf)

+ for information about updating samba.

Configuring samba (smb.conf)

Samba's configuration is stored in the smb.conf file, that usually resides in /etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical tools that are available, such as the web-based interface swat, that is included with samba. -

Example Configuration

There are sample configuration files in the examples subdirectory in the distribution. I suggest you read them carefully so you can see how the options go together in practice. See the man page for all the options.

The simplest useful configuration file would be something like this: -

-	[global]
-		workgroup = MYGROUP
-
-	[homes]
-		guest ok = no
-		read only = no
-

Example 2.1. Simplest possible smb.conf file

[global]

workgroup = MIDEARTH

[homes]

guest ok = no

read only = no

This will allow connections by anyone with an account on the server, using either - their login name or "homes" as the service name. + their login name or homes" as the service name. (Note that the workgroup that Samba must also be set.)

- Make sure you put the smb.conf file in the same place - you specified in the Makefile (the default is to - look for it in /usr/local/samba/lib/). + Make sure you put the smb.conf file in the correct place + (usually in /etc/samba).

For more information about security settings for the - [homes] share please refer to the chapter - Securing Samba. -

Test your config file with testparm

+ [homes] share please refer to + "Securing Samba". +

Test your config file with testparm

It's important that you test the validity of your smb.conf file using the testparm program. If testparm runs OK then it will list the loaded services. If not it will give an error message. @@ -302,7 +292,7 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li Make sure it runs OK and that the services look reasonable before proceeding.

Always run testparm again when you change smb.conf! -

SWAT

SWAT is a web-based interface that helps you configure samba. SWAT might not be available in the samba package on your platform, but in a separate package. Please read the swat manpage @@ -318,9 +308,10 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent in the clear over the wire. -

Try listing the shares available on your - server

$ smbclient -L - yourhostname

You should get back a list of shares available on +

Try listing the shares available on your + server

+$ smbclient -L yourhostname
+

You should get back a list of shares available on your server. If you don't then something is incorrectly setup. Note that this method can also be used to see what shares are available on other LanManager clients (such as WfWg).

If you choose user level security then you may find @@ -328,68 +319,31 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li See the smbclient man page for details. (you can force it to list the shares without a password by adding the option -U% to the command line. This will not work - with non-Samba servers)

Try connecting with the unix client

$ smbclient - //yourhostname/aservice

Typically the yourhostname + with non-Samba servers)

Try connecting with the unix client

+$ smbclient  //yourhostname/aservice
+

Typically the yourhostname would be the name of the host where you installed smbd. The aservice is any service you have defined in the smb.conf file. Try your user name if you just have a [homes] section in smb.conf.

For example if your unix host is bambi - and your login name is fred you would type:

$ smbclient //bambi/fred -

Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client

Try mounting disks. eg:

C:\WINDOWS\> net use d: \\servername\service -

Try printing. eg:

C:\WINDOWS\> net use lpt1: - \\servername\spoolservice

C:\WINDOWS\> print filename -

What If Things Don't Work?

Then you might read the file chapter - Diagnosis and the - FAQ. If you are still stuck then try to follow - the Analysing and Solving Problems chapter + and your login name is fred you would type:

+$ smbclient //bambi/fred
+

Try connecting from another SMB client

Try mounting disks. from a DOS, Windows or OS/2 client, eg:

+C:\> net use d: \\servername\service
+

Try printing. eg:

+C:\> net use lpt1:	\\servername\spoolservice
+

C:\> print filename
+

What If Things Don't Work?

Then you might read the file chapter diagnosis + and the FAQ. If you are still stuck then refer to "Analysing and solving problems". Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it.

Common Errors

+ so maybe someone else has hit your problem and has overcome it.

Common Errors

The following questions and issues get raised on the samba mailing list over and over again. -

Why are so many smbd processes eating memory?

-“ -Site that is running Samba on an AIX box. They are sharing out about 2 terabytes using samba. -Samba was installed using smitty and the binaries. We seem to be experiencing a memory problem -with this box. When I do a svmon -Pu the monitoring program shows that smbd has several -processes of smbd running: -” -

- “ -Is samba suppose to start this many different smbd processes? Or does it run as one smbd process? Also -is it normal for it to be taking up this much memory? -” -

-Inuse * 4096 = amount of memory being used by this process
-
-     Pid Command        Inuse      Pin     Pgsp  Virtual   64-bit    Mthrd
-   20950 smbd           33098     1906      181     5017        N        N
-   22262 smbd            9104     1906      5410
-   21060 smbd            9048     1906      181     5479        N        N
-   25972 smbd            8678     1906      181     5109        N        N
-   24524 smbd            8674     1906      181     5105        N        N
-   19262 smbd            8582     1906      181     5013        N        N
-   20722 smbd            8572     1906      181     5003        N        N
-   21454 smbd            8572     1906      181     5003        N        N
-   28946 smbd            8567     1906      181     4996        N        N
-   24076 smbd            8566     1906      181     4996        N        N
-   20138 smbd            8566     1906      181     4996        N        N
-   17608 smbd            8565     1906      181     4996        N        N
-   21820 smbd            8565     1906      181     4996        N        N
-   26940 smbd            8565     1906      181     4996        N        N
-   19884 smbd            8565     1906      181     4996        N        N
-    9912 smbd            8565     1906      181     4996        N        N
-   25800 smbd            8564     1906      181     4995        N        N
-   20452 smbd            8564     1906      181     4995        N        N
-   18592 smbd            8562     1906      181     4993        N        N
-   28216 smbd            8521     1906      181     4954        N        N
-   19110 smbd            8404     1906      181     4862        N        N
-
-   Total memory used:  841,592,832 bytes
-

Large number of smbd processes

Samba consists on three core programs: nmbd, smbd, winbindd. nmbd is the name server message daemon, smbd is the server message daemon, winbindd is the daemon that @@ -404,18 +358,19 @@ connection made. That is why you are seeing so many of them, one (1) per client

winbindd will run as one or two daemons, depending on whether or not it is being run in "split mode" (in which case there will be two instances). -

I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Your loopback device isn't working correctly. Make sure it's running.

Chapter 3. Fast Start for the Impatient

John H. Terpstra

Samba Team

Table of Contents

Note

Note

"open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"

Your loopback device isn't working correctly. Make sure it's configured properly. The loopback device is an internal (virtual) network device with + the ip address 127.0.0.1. Read your OS documentation for details + on how to configure the loopback on your system.

"The network name cannot be found"

+ This error can be caused by one of these misconfigurations: +

You specified an nonexisting path for the share in smb.conf
The user you are trying to access the share with does not + have sufficient permissions to access the path for the share. Both read (r) and access (x) should be possible.
The share you are trying to access does not exist.

Chapter 3. Fast Start for the Impatient

John H. Terpstra

Samba Team

Table of Contents

Note

Note

This chapter did not make it into this release. It is planned for the published release of this document. -

Server Configuration Basics

First Steps in Server Configuration

Server Configuration Basics

First Steps in Server Configuration

Samba can operate in various modes within SMB networks. This HOWTO section contains information on configuring samba to function as the type of server your network requires. Please read this section carefully. -

Table of Contents

Seamless Windows Network Integration

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

Domain Controller Types
Preparing for Domain Control

Common Problems and Errors

Domain Network Logon Service
Security Mode and Master Browsers

I cannot include a '$' in a machine name
I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
The system can not log you on (C000019B)....
The machine trust account for this computer either does not -exist or is not accessible.
When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Example Configuration

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

MS Windows Workstation/Server Machine Trust Accounts

Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member

Joining an NT4 type Domain with Samba-3
Why is this better than security = server?

Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes

Can Not Add Machine Back to Domain
Adding Machine to Domain Fails

Reference Documentation Server
Central Print Serving

Note

Chapter 4. Server Types and Security Modes

Andrew Tridgell

Samba Team

Jelmer R. Vernooij

The Samba Team

John H. Terpstra

Samba Team

Table of Contents

Seamless Windows Network Integration

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

Table of Contents

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

Password checking

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

Domain Controller Types
Preparing for Domain Control

Domain Network Logon Service
Security Mode and Master Browsers

'$' cannot be included in machine name
Joining domain fails because of existing machine account
The system can not log you on (C000019B)....
The machine trust account not accessible
Account disabled
Domain Controller Unavailable
Can not log onto domain member workstation after joining domain

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Example Configuration

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

MS Windows Workstation/Server Machine Trust Accounts

Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member

Joining an NT4 type Domain with Samba-3
Why is this better than security = server?

Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes

Can Not Add Machine Back to Domain
Adding Machine to Domain Fails
I can't join a Windows 2003 PDC

Reference Documentation Server
Central Print Serving

Note

Chapter 4. Server Types and Security Modes

Andrew Tridgell

Samba Team

Jelmer R. Vernooij

The Samba Team

John H. Terpstra

Samba Team

Table of Contents

User Level Security
Share Level Security
Domain Security Mode (User Level Security)
ADS Security Mode (User Level Security)
Server Security (User Level Security)

Password checking

Features and Benefits

What makes Samba a SERVER?
What makes Samba a Domain Controller?
What makes Samba a Domain Member?
Constantly Losing Connections to Password Server

This chapter provides information regarding the types of server that Samba may be configured to be. A Microsoft network administrator who wishes to migrate to or to use Samba will want to know what, within a Samba context, terms familiar to MS Windows @@ -425,10 +380,11 @@ modes function BEFORE we get into the details of how to configure the server its The chapter provides an overview of the security modes of which Samba is capable and how these relate to MS Windows servers and clients.

-Firstly we should recognise the question so often asked, "Why would I want to use Samba?" -So, in those chapters where the answer may be important you will see a section that highlights -features and benefits. These may be for or against Samba. -

Features and Benefits

+A question often asked is, "Why would I want to use Samba?" Most chapters contain a section +that highlights features and benefits. We hope that the information provided will help to +answer this question. Be warned though, we want to be fair and reasonable, so not all +features are positive towards Samba so the benefit may be on the side of our competition. +

Features and Benefits

Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I @@ -440,7 +396,7 @@ pleasure, but if you are forced upon it and have no time for its secrets then it a source of discomfort.

Samba started out as a project that sought to provide interoperability for MS Windows 3.x -clients with a Unix server. It has grown up a lot since its humble beginnings and now provides +clients with a UNIX server. It has grown up a lot since its humble beginnings and now provides features and functionality fit for large scale deployment. It also has some warts. In sections like this one we will tell of both.

@@ -464,14 +420,14 @@ So now, what are the benefits of features mentioned in this chapter? greater flexibility than MS Windows NT4 and in many cases a significantly higher utility than Active Directory domains with MS Windows 200x. -

Server Types

Administrators of Microsoft networks often refer to three -different type of servers:

Domain Controller
Primary Domain Controller
Backup Domain Controller
ADS Domain Controller
Domain Member Server
Active Directory Member Server
NT4 Style Domain Member Server
Stand Alone Server

Server Types

Administrators of Microsoft networks often refer to three +different type of servers:

Domain Controller
- Primary Domain Controller
- Backup Domain Controller
- ADS Domain Controller
Domain Member Server
- Active Directory Domain Server
- NT4 Style Domain Domain Server
Stand Alone Server

The chapters covering Domain Control, Backup Domain Control and Domain Membership provide -pertinent information regarding Samba-3 configuration for each of these server roles. +pertinent information regarding Samba configuration for each of these server roles. The reader is strongly encouraged to become intimately familiar with the information presented. -

Samba Security Modes

-In this section the function and purpose of Samba's security +

Samba Security Modes

+In this section the function and purpose of Samba's security modes are described. An accurate understanding of how Samba implements each security mode as well as how to configure MS Windows clients for each mode will significantly reduce user complaints and administrator heartache. @@ -486,7 +442,7 @@ ways that allow the security levels to be implemented. In actual fact, Samba imp ADS, and SERVER modes. They are documented in this chapter.

-A SMB server tells the client at startup what security level + A SMB server tells the client at startup what security level it is running. There are two options: share level and user level. Which of these two the client receives affects the way the client then tries to authenticate itself. It does not directly affect @@ -494,8 +450,8 @@ the way the client then tries to authenticate itself. It does not directly affec but it fits in with the client/server approach of SMB. In SMB everything is initiated and controlled by the client, and the server can only tell the client what is available and whether an action is allowed. -

User Level Security

-We will describe user level security first, as it's simpler. +

User Level Security

+We will describe user level security first, as it's simpler. In user level security, the client will send a session setup command directly after the protocol negotiation. This contains a username and password. The server can either accept or reject that @@ -512,13 +468,11 @@ It is also possible for a client to send multiple ses requests. When the server responds, it gives the client a uid to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this). -

Example Configuration

The smb.conf parameter that sets User Level Security is: -

-	security = user
-

security = user

This is the default setting since samba-2.2.x. -

Share Level Security

Ok, now for share level security. In share level security, the client authenticates itself separately for each share. It will send a password along with each tree connection (share mount). It does not explicitly send a @@ -538,104 +492,92 @@ level security. They normally send a valid username but no password. Samba recor this username in a list of possible usernames. When the client then does a tree connection it also adds to this list the name of the share they try to connect to (useful for home directories) and any users -listed in the user = smb.conf line. The password is then checked +listed in the user smb.conf line. The password is then checked in turn against these possible usernames. If a match is found then the client is authenticated as that user. -

Example Configuration

The smb.conf parameter that sets Share Level Security is: -

-	security = share
-

security = share

Please note that there are reports that recent MS Windows clients do not like to work with share mode security servers. You are strongly discouraged from using share level security. -

Domain Security Mode (User Level Security)

-When Samba is operating in security = domain mode, +

Domain Security Mode (User Level Security)

+When Samba is operating in security = domain mode, the Samba server has a domain security trust account (a machine account) and will cause all authentication requests to be passed through to the domain controllers. -

Example Configuration

Samba as a Domain Member Server

This method involves addition of the following parameters in the smb.conf file: -

-        security = domain
-        workgroup = "name_of_NT_domain"
-

security = domain

workgroup = MIDEARTH

In order for this method to work, the Samba server needs to join the MS Windows NT security domain. This is done as follows:

On the MS Windows NT domain controller, using the Server Manager, add a machine account for the Samba server. -
Next, on the Unix/Linux system execute:
root# smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x)
root# net join -U administrator%password (samba-3)

Note

-As of Samba-2.2.4 the Samba 2.2.x series can auto-join a Windows NT4 style Domain just -by executing: -
-root# smbpasswd -j DOMAIN_NAME -r PDC_NAME -U Administrator%password -
+
Next, on the UNIX/Linux system execute:
root# net rpc join -U administrator%password

Note

+Samba-2.2.4 and later can auto-join a Windows NT4 style Domain just by executing: +

+root# smbpasswd -j DOMAIN_NAME -r PDC_NAME \
+	 -U Administrator%password
+

-As of Samba-3 the same can be done by executing: -

-root# net join -U Administrator%password
-

-It is not necessary with Samba-3 to specify the DOMAIN_NAME or the PDC_NAME as it -figures this out from the smb.conf file settings. -

-Use of this mode of authentication does require there to be a standard Unix account +Samba-3 can do the same by executing: +

+root# net rpc join -U Administrator%password
+

+It is not necessary with Samba-3 to specify the DOMAIN_NAME or the +PDC_NAME as it figures this out from the smb.conf file settings. +

+Use of this mode of authentication does require there to be a standard UNIX account for each user in order to assign a UID once the account has been authenticated by the remote Windows DC. This account can be blocked to prevent logons by clients other than MS Windows through means such as setting an invalid shell in the /etc/passwd entry.

An alternative to assigning UIDs to Windows users on a Samba member server is -presented in the Winbind Overview chapter -in this HOWTO collection. +presented in the chapter about winbind.

-For more information of being a domain member, see the Domain -Member section of this Howto. -

ADS Security Mode (User Level Security)

+ For more information of being a domain member, see the chapter about domain membership. +

ADS Security Mode (User Level Security)

Both Samba 2.2 and 3.0 can join an Active Directory domain. This is -possible even if the domain is run in native mode. Active Directory in -native mode perfectly allows NT4-style domain members, contrary to +possible if the domain is run in native mode. Active Directory in +native mode perfectly allows NT4-style domain members. This is contrary to popular belief. The only thing that Active Directory in native mode prohibits is Backup Domain Controllers running NT4.

-If you are running Active Directory starting with Samba 3.0 you can -however join as a native AD member. Why would you want to do that? +If you are using Active Directory, starting with Samba-3 you can +join as a native AD member. Why would you want to do that? Your security policy might prohibit the use of NT-compatible authentication protocols. All your machines are running Windows 2000 -and above and all use full Kerberos. In this case Samba as a NT4-style +and above and all use Kerberos. In this case Samba as a NT4-style domain would still require NT-compatible authentication data. Samba in -AD-member mode can accept Kerberos. -

Example Configuration

-	realm = your.kerberos.REALM
-	security = ADS
-

- The following parameter may be required: -

-	ads server = your.kerberos.server
-

-Please refer to the Domain Membership and Active Directory -Membership sections for more information regarding this configuration option. -

Server Security (User Level Security)

+AD-member mode can accept Kerberos tickets. +

Example Configuration

realm = your.kerberos.REALM

security = ADS

+The following parameter may be required: +

ads server = your.kerberos.server

+Please refer to the chapter on domain membership +for more information regarding this configuration option. +

Server Security (User Level Security)

Server security mode is a left over from the time when Samba was not capable of acting as a domain member server. It is highly recommended NOT to use this feature. Server security mode has many draw backs. The draw backs include: -

Potential Account Lockout on MS Windows NT4/200x password servers

Lack of assurance that the password server is the one specified

Does not work with Winbind, particularly needed when storing profiles remotely

This mode may open connections to the password server, and keep them open for extended periods.

Security on the Samba server breaks badly when the remote password server suddenly shuts down

With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

Potential Account Lockout on MS Windows NT4/200x password servers
Lack of assurance that the password server is the one specified
Does not work with Winbind, particularly needed when storing profiles remotely
This mode may open connections to the password server, and keep them open for extended periods.
Security on the Samba server breaks badly when the remote password server suddenly shuts down
With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

In server security mode the Samba server reports to the client that it is in user level security. The client then does a session setup as described earlier. The Samba server takes the username/password that the client sends and attempts to login to the -password server by sending exactly the same username/password that +password server by sending exactly the same username/password that it got from the client. If that server is in user level security and accepts the password, then Samba accepts the clients connection. This allows the Samba server to use another SMB -server as the password server. +server as the password server.

You should also note that at the very start of all this, where the server tells the client what security level it is in, it also tells the client if it supports encryption. If it does then it supplies the client with a random cryptkey. The client will then send all passwords in encrypted form. Samba supports this type of encryption by default.

-The parameter security = server means that Samba reports to clients that +The parameter security = server means that Samba reports to clients that it is running in user mode but actually passes off all authentication requests to another user mode server. This requires an additional -parameter password server that points to the real authentication server. +parameter password server that points to the real authentication server. That real authentication server can be another Samba server or can be a Windows NT server, the later natively capable of encrypted password support.

Note

@@ -646,15 +588,11 @@ lookups because the choice of the target authentication server is arbitrary and be determined from a domain name. In essence, a Samba server that is in server security mode is operating in what used to be known as workgroup mode. -

Example Configuration

Using MS Windows NT as an authentication server

This method involves the additions of the following parameters in the smb.conf file: -

-        encrypt passwords = Yes
-        security = server
-        password server = "NetBIOS_name_of_a_DC"
-

encrypt passwords = Yes

security = server

password server = "NetBIOS_name_of_a_DC"

There are two ways of identifying whether or not a username and password pair was valid. One uses the reply information provided as part of the authentication messaging process, the other uses just an error code. @@ -665,9 +603,9 @@ server fails to reject the username and password pair then an alternative mode o identification of validation is used. Where a site uses password lock out after a certain number of failed authentication attempts this will result in user lockouts.

-Use of this mode of authentication does require there to be a standard Unix account +Use of this mode of authentication does require there to be a standard UNIX account for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. -

Seamless Windows Network Integration

Password checking

MS Windows clients may use encrypted passwords as part of a challenge/response authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple password based authentication. It should be realized that with the SMB protocol, @@ -704,21 +642,18 @@ is definitely not a good idea to re-enable plain text password support in such c The following parameters can be used to work around the issue of Windows 9x clients upper casing usernames and password before transmitting them to the SMB server when using clear text authentication. -

-        password level = integer
-        username level = integer
-

password level = integer

username level = integer

By default Samba will lower case the username before attempting to lookup the user in the database of local system accounts. Because UNIX usernames conventionally -only contain lower-case characters, the username level parameter +only contain lower-case character, the username level parameter is rarely needed.

However, passwords on UNIX systems often make use of mixed-case characters. This means that in order for a user on a Windows 9x client to connect to a Samba -server using clear text authentication, the password level +server using clear text authentication, the password level must be set to the maximum number of upper case letters which could -appear in a password. Note that the server OS uses the traditional DES version -of crypt(), a password level of 8 will result in case +appear in a password. Note that if the server OS uses the traditional DES version +of crypt(), a password level of 8 will result in case insensitive passwords as seen from Windows users. This will also result in longer login times as Samba has to compute the permutations of the password string and try them one by one until a match is located (or all combinations fail). @@ -726,7 +661,7 @@ try them one by one until a match is located (or all combinations fail). The best option to adopt is to enable support for encrypted passwords wherever Samba is used. Most attempts to apply the registry change to re-enable plain text passwords will eventually lead to user complaints and unhappiness. -

Common Errors

We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake made in a developmental test lab is expected. @@ -736,32 +671,29 @@ on the Samba mailing lists. Many of these are avoidable by doing you homework be a Samba implementation. Some are the result of misunderstanding of the English language. The English language has many turns of phrase that are potentially vague and may be highly confusing to those for whom English is not their native tongue. -

What makes Samba a SERVER?

To some the nature of the Samba security mode is very obvious, but entirely -wrong all the same. It is assumed that security = server means that Samba +wrong all the same. It is assumed that security = server means that Samba will act as a server. Not so! See above - this setting means that Samba will try to use another SMB server as its source of user authentication alone. -

What makes Samba a Domain Controller?

-The smb.conf parameter security = domain does NOT really make Samba behave +

What makes Samba a Domain Controller?

+The smb.conf parameter security = domain does NOT really make Samba behave as a Domain Controller! This setting means we want Samba to be a domain member! -

What makes Samba a Domain Member?

-Guess! So many others do. But whatever you do, do NOT think that security = user +

What makes Samba a Domain Member?

+Guess! So many others do. But whatever you do, do NOT think that security = user makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See -the Domain Member section of this Howto for more information. -

Constantly Losing Connections to Password Server

+the chapter about domain membership for more information. +

Constantly Losing Connections to Password Server

+ “ Why does server_validate() simply give up rather than re-establishing its connection to the password server? Though I am not fluent in the SMB protocol, perhaps the cluster server process passes along to its client workstation the session key it receives from the password server, which means the password hashes submitted by the client would not work on a subsequent -connection, whose session key would be different. So server_validate() must give up. +connection, whose session key would be different. So server_validate() must give up.”

-Indeed. That's why security = server is at best a nasty hack. Please use security = domain. -security = server mode is also known as pass-through authentication. -

Chapter 5. Domain Control

John H. Terpstra

Samba Team
<jht@samba.org>

Gerald (Jerry) Carter

Samba Team
<jerry@samba.org>

David Bannon

Samba Team
<dbannon@samba.org>

Table of Contents

Basics of Domain Control

Domain Controller Types
Preparing for Domain Control

Domain Control - Example Configuration

Samba ADS Domain Control

Domain and Network Logon Configuration

Domain Network Logon Service
Security Mode and Master Browsers

Common Problems and Errors

I cannot include a '$' in a machine name
I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
The system can not log you on (C000019B)....
The machine trust account for this computer either does not -exist or is not accessible.
When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

The Essence of Learning: + Indeed. That's why security = server is at best a nasty hack. Please use security = domain. +security = server mode is also known as pass-through authentication. +

Chapter 5. Domain Control

John H. Terpstra

Samba Team
<jht@samba.org>

Gerald (Jerry) Carter

Samba Team
<jerry@samba.org>

David Bannon

Samba Team
<dbannon@samba.org>

Table of Contents

Features and Benefits

Basics of Domain Control

Domain Controller Types
Preparing for Domain Control

Domain Control - Example Configuration

Samba ADS Domain Control

Domain and Network Logon Configuration

Domain Network Logon Service
Security Mode and Master Browsers

Features And Benefits

'$' cannot be included in machine name
Joining domain fails because of existing machine account
The system can not log you on (C000019B)....
The machine trust account not accessible
Account disabled
Domain Controller Unavailable
Can not log onto domain member workstation after joining domain

The Essence of Learning: There are many who approach MS Windows networking with incredible misconceptions. That's OK, because it gives the rest of us plenty of opportunity to be of assistance. Those who really want help would be well advised to become familiar with information @@ -769,18 +701,18 @@ that is already available.

The reader is advised NOT to tackle this section without having first understood and mastered some basics. MS Windows networking is not particularly forgiving of -misconfiguration. Users of MS Windows networking are likely to complain bitterly -of persistent niggles that may be caused by broken network or system configuration. +misconfiguration. Users of MS Windows networking are likely to complain +of persistent niggles that may be caused by a broken network configuration. To a great many people however, MS Windows networking starts with a domain controller that in some magical way is expected to solve all ills. -

Figure 5.1. An Example Domain

From the Samba mailing list one can readily identify many common networking issues. If you are not clear on the following subjects, then it will do much good to read the sections of this HOWTO that deal with it. These are the most common causes of MS Windows networking problems: -

Basic TCP/IP configuration

NetBIOS name resolution

Authentication configuration

User and Group configuration

Basic File and Directory Permission Control in Unix/Linux

Understanding of how MS Windows clients interoperate in a network - environment

-Do not be put off; on the surface of it MS Windows networking seems so simple that any fool +

Basic TCP/IP configuration
NetBIOS name resolution
Authentication configuration
User and Group configuration
Basic File and Directory Permission Control in UNIX/Linux
Understanding of how MS Windows clients interoperate in a network + environment

+Do not be put off; on the surface of it MS Windows networking seems so simple that anyone can do it. In fact, it is not a good idea to set up an MS Windows network with inadequate training and preparation. But let's get our first indelible principle out of the way: It is perfectly OK to make mistakes! In the right place and at @@ -791,7 +723,7 @@ burden on an organisation. Where is the right place to make mistakes? Only out of harm's way! If you are going to make mistakes, then please do this on a test network, away from users and in such a way as to not inflict pain on others. Do your learning on a test network. -

Features and Benefits

What is the key benefit of Microsoft Domain security?

In a word, Single Sign On, or SSO for short. To many, this is the holy @@ -802,13 +734,18 @@ and they will be able to log onto the network and access resources (shares, file as if they are sitting at their home (personal) workstation. This is a feature of the Domain security protocols.

-The benefits of Domain security are fully available to those sites that deploy a Samba PDC. +The benefits of Domain security are available to those sites that deploy a Samba PDC. +A Domain provides a unique network security identifier (SID). Domain user and group security +identifiers are comprised of the network SID plus a relative identifier (RID) that is unique to +the account. User and Group SIDs (the network SID plus the RID) can be used to create Access Control +Lists (ACLs) attached to network resources to provide organizational access control. UNIX systems +know only of local security identifiers.

Note

Network clients of an MS Windows Domain security environment must be Domain members to be able to gain access to the advanced features provided. Domain membership involves more than just setting the workgroup name to the Domain name. It requires the creation of a Domain trust account for the workstation (called a machine account). Please refer to the chapter on -Domain Membership for more information. +setting up samba as a domain member for more information.

The following functionalities are new to the Samba-3 release:

@@ -816,8 +753,7 @@ The following functionalities are new to the Samba-3 release:
Adding users via the User Manager for Domains. This can be done on any MS Windows client using the Nexus toolkit that is available from Microsoft's web site. - At some later date Samba-3 may get support for the use of the Microsoft Management - Console for user management. + Samba-3 supports the use of the Microsoft Management Console for user management.
Introduces replaceable and multiple user account (authentication) back ends. In the case where the back end is placed in an LDAP database, @@ -831,14 +767,18 @@ The following functionalities are new to the Samba-3 release: The following functionalities are NOT provided by Samba-3:
- SAM replication with Windows NT4 Domain Controllers - (i.e. a Samba PDC and a Windows NT BDC or vice versa) + (i.e. a Samba PDC and a Windows NT BDC or vice versa). This means samba + cannot operate as a BDC when the PDC is Microsoft-based or + replicate account data to Windows-BDC's.
- Acting as a Windows 2000 Domain Controller (i.e. Kerberos and Active Directory) - In point of fact, Samba-3 DOES have some Active Directory Domain Control ability that is at this time purely experimental AND that is certain to change as it becomes a fully supported feature some time - during the Samba-3 (or later) life cycle. + during the Samba-3 (or later) life cycle. However, Active Directory is + more then just SMB - it's also LDAP, Kerberos, DHCP and other protocols + (with proprietary extensions, of course).
Windows 9x / Me / XP Home clients are not true members of a domain for reasons outlined in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons @@ -847,67 +787,33 @@ for some time. These clients use the old LanMan Network Logon facilities that ar in Samba since approximately the Samba-1.9.15 series.
Samba-3 has an implementation of group mapping between Windows NT groups -and Unix groups (this is really quite complicated to explain in a short space). This is -discussed more fully in the Group Mapping chapter. +and UNIX groups (this is really quite complicated to explain in a short space). This is +discussed more fully in the chapter on group mapping.
Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store -user and machine trust account information in a suitable backend data store. With Samba-3 -there can be multiple back-ends for this including: -
- - smbpasswd - the plain ASCII file stored used by - earlier versions of Samba. This file configuration option requires - a Unix/Linux system account for EVERY entry (ie: both for user and for - machine accounts). This file will be located in the private - directory (default is /usr/local/samba/lib/private or on linux /etc/samba). -
- - tdbsam - a binary database backend that will be - stored in the private directory in a file called - passdb.tdb. The key benefit of this binary format - file is that it can store binary objects that can not be accommodated - in the traditional plain text smbpasswd file. These permit the extended - account controls that MS Windows NT4 and later also have. -
- - ldapsam - An LDAP based back-end. Permits the - LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com. - Like the tdbsam, ldapsam permits the storing of extended account attributes - for control of things like: Permitted access times, password activation and - expiry, permitted points of access (workstation names), per user profile - location, and much more. -
- - ldapsam_compat - An LDAP back-end that maintains backwards - compatibility with the behaviour of samba-2.2.x. You should use this in the process - of migrating from samba-2.2.x to samba-3 if you do not want to rebuild your LDAP - database. -
-Read the chapter about Account Information Database for details -regarding the choices available and how to configure them. -
Note
-The new tdbsam and ldapsam account backends store substantially more information than -smbpasswd is capable of. The new backend database includes capacity to specify -per user settings for many parameters, over-riding global settings given in the -smb.conf file. eg: logon drive, logon home, logon path, etc. -Thus, with samba-3 it is possible to have a default system configuration for profiles, -and on a per user basis to over-ride this for those users who should not be subject -to the default configuration. -

Basics of Domain Control

+user and machine trust account information in a suitable backend data store. +Refer to the section on machine trust accounts. With Samba-3 there can be multiple +back-ends for this. A complete discussion of account database backends can be found in +the chapter on Account Information Databases. +

Basics of Domain Control

Over the years, public perceptions of what Domain Control really is has taken on an almost mystical nature. Before we branch into a brief overview of Domain Control, there are three basic types of domain controllers: -

Domain Controller Types

Primary Domain Controller
Backup Domain Controller
ADS Domain Controller

Domain Controller Types

Primary Domain Controller
Backup Domain Controller
ADS Domain Controller

The Primary Domain Controller or PDC plays an important role in the MS -Windows NT4 and Windows 200x Domain Control architecture, but not in the manner that so many -expect. There is folk lore that dictates that because of it's role in the MS Windows -network, the PDC should be the most powerful and most capable machine in the network. +Windows NT4. In Windows 200x Domain Control architecture this role is held by domain controllers. +There is folk lore that dictates that because of it's role in the MS Windows +network, the domain controllers should be the most powerful and most capable machine in the network. As strange as it may seem to say this here, good over all network performance dictates that -the entire infrastructure needs to be balanced. It is advisable to invest more in the Backup -Domain Controllers and Stand-Alone (or Domain Member) servers than in the PDC. +the entire infrastructure needs to be balanced. It is advisable to invest more in Stand-Alone +(or Domain Member) servers than in the domain controllers.

-In the case of MS Windows NT4 style domains, it is the PDC seeds the Domain Control database, -a part of the Windows registry called the SAM (Security Account Manager). It plays a key +In the case of MS Windows NT4 style domains, it is the PDC that initiates a new Domain Control database. +This forms a part of the Windows registry called the SAM (Security Account Manager). It plays a key part in NT4 type domain user authentication and in synchronisation of the domain authentication database with Backup Domain Controllers.

-With MS Windows 200x Server based Active Directory domains, one domain controller seeds a potential +With MS Windows 200x Server based Active Directory domains, one domain controller initiates a potential hierarchy of domain controllers, each with their own area of delegated control. The master domain controller has the ability to override any down-stream controller, but a down-line controller has control only over it's down-line. With Samba-3 this functionality can be implemented using an @@ -915,9 +821,7 @@ LDAP based user and machine account back end.

New to Samba-3 is the ability to use a back-end database that holds the same type of data as the NT4 style SAM (Security Account Manager) database (one of the registry files). -The Samba-3 SAM can be specified via the smb.conf file parameter -passwd backend and valid options include -smbpasswd, tdbsam, ldapsam, nisplussam, xmlsam, mysqlsam, guest. +^[1]

The Backup Domain Controller or BDC plays a key role in servicing network authentication requests. The BDC is biased to answer logon requests in preference to the PDC. @@ -941,11 +845,14 @@ excluding the SAM replication components. However, please be aware that Samba-3 MS Windows 200x domain control protocols also.

At this time any appearance that Samba-3 is capable of acting as an -ADS Domain Controller is limited and experimental in nature. +Domain Controller in native ADS mode is limited and experimental in nature. This functionality should not be used until the Samba-Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all configuration and -management requirements. -

Preparing for Domain Control

+management requirements. Samba can act as a NT4-style DC in a Windows 2000/XP +environment. However, there are certain compromises: + +

No machine policy files
No Group Policy Objects
No synchronously executed AD logon scripts
Can't use ANY Active Directory management tools to manage users and machines
Registry changes tattoo the main registry, while with AD they do NOT. ie: Leave permanent changes in effect
Without AD you can not peprform the function of exporting specific applications to specific users or groups

Preparing for Domain Control

There are two ways that MS Windows machines may interact with each other, with other servers, and with Domain Controllers: Either as Stand-Alone systems, more commonly called Workgroup members, or as full participants in a security system, @@ -967,23 +874,22 @@ Domain it triggers a machine password change.

Note

When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the -Domain, then it will operate like a workgroup (stand-alone) machine. Please refer the -Domain Membership chapter for information regarding - HOW to make your MS Windows clients Domain members. +Domain, then it will operate like a workgroup (stand-alone) machine. Please refer to +the chapter on domain membership for information regarding HOW to make your MS Windows clients Domain members.

The following are necessary for configuring Samba-3 as an MS Windows NT4 style PDC for MS Windows NT4 / 200x / XP clients. -

Configuration of basic TCP/IP and MS Windows Networking

Correct designation of the Server Role (security = user)

Consistent configuration of Name Resolution (See chapter on Browsing and on - MS Windows network Integration)

Domain logons for Windows NT4 / 200x / XP Professional clients

Configuration of Roaming Profiles or explicit configuration to force local profile usage

Configuration of Network/System Policies

Adding and managing domain user accounts

Configuring MS Windows client machines to become domain members

Configuration of basic TCP/IP and MS Windows Networking
Correct designation of the Server Role (security = user)
Consistent configuration of Name Resolution (See chapter on Network Browsing and on + Integrating Unix into Windows networks)
Domain logons for Windows NT4 / 200x / XP Professional clients
Configuration of Roaming Profiles or explicit configuration to force local profile usage
Configuration of Network/System Policies
Adding and managing domain user accounts
Configuring MS Windows client machines to become domain members

The following provisions are required to serve MS Windows 9x / Me Clients: -

Configuration of basic TCP/IP and MS Windows Networking

Correct designation of the Server Role (security = user)

Network Logon Configuration (Since Windows 9x / XP Home are not technically domain - members, they do not really participate in the security aspects of Domain logons as such)

Roaming Profile Configuration

Configuration of System Policy handling

Installation of the Network driver "Client for MS Windows Networks" and configuration - to log onto the domain

Placing Windows 9x / Me clients in user level security - if it is desired to allow - all client share access to be controlled according to domain user / group identities.

Adding and managing domain user accounts

Note

Configuration of basic TCP/IP and MS Windows Networking
Correct designation of the Server Role (security = user)
Network Logon Configuration (Since Windows 9x / XP Home are not technically domain + members, they do not really participate in the security aspects of Domain logons as such)
Roaming Profile Configuration
Configuration of System Policy handling
Installation of the Network driver "Client for MS Windows Networks" and configuration + to log onto the domain
Placing Windows 9x / Me clients in user level security - if it is desired to allow + all client share access to be controlled according to domain user / group identities.
Adding and managing domain user accounts

Note

Roaming Profiles and System/Network policies are advanced network administration topics that are covered in the Profile Management and -Policy Management chapters of this document. However, these are not necessarily specific -to a Samba PDC as much as they are related to Windows NT networking concepts. +Policy Management chapters of this document. However, these are not +necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts.

A Domain Controller is an SMB/CIFS server that:

@@ -998,120 +904,86 @@ A Domain Controller is an SMB/CIFS server that: Provides a share called NETLOGON

For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide -the NETLOGON service which Samba calls the domain logons functionality +the NETLOGON service which Samba calls the domain logons functionality (after the name of the parameter in the smb.conf file). Additionally, one (1) server in a Samba-3 -Domain must advertise itself as the domain master browser. This causes the Primary Domain Controller +Domain must advertise itself as the domain master browser^[2]. This causes the Primary Domain Controller to claim domain specific NetBIOS name that identifies it as a domain master browser for its given domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets then ask for a complete copy of the browse list for the whole wide area network. Browser clients will then contact their local master browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet. -

Domain Control - Example Configuration

The first step in creating a working Samba PDC is to understand the parameters necessary -in smb.conf. Here we attempt to explain the parameters that are covered in -the smb.conf man page. -

-Here is an example smb.conf for acting as a PDC: -

-	[global]
-	    ; Basic server settings
-	    netbios name = POGO
-	    workgroup = NARNIA
-
-	    ; User and Machine Account Backends
-	    ; Choices are: tdbsam, smbpasswd, ldapsam, mysqlsam, xmlsam, guest
-	    passdb backend = ldapsam, guest
-
-	    ; we should act as the domain and local master browser
-	    os level = 64
-	    preferred master = yes
-	    domain master = yes
-	    local master = yes
-	    
-	    ; security settings (must user security = user)
-	    security = user
-	    
-	    ; encrypted passwords are a requirement for a PDC (default = Yes)
-	    encrypt passwords = yes
-	    
-	    ; support domain logons
-	    domain logons = yes
-	    
-	    ; where to store user profiles?
-	    logon path = \\%N\profiles\%u
-	    
-	    ; where is a user's home directory and where should it be mounted at?
-	    logon drive = H:
-	    logon home = \\homeserver\%u\winprofile
-	    
-	    ; specify a generic logon script for all users
-	    ; this is a relative **DOS** path to the [netlogon] share
-	    logon script = logon.cmd
-
-	; necessary share for domain controller
-	[netlogon]
-	    path = /usr/local/samba/lib/netlogon
-	    read only = yes
-	    write list = ntadmin
-	    
-	; share for storing user profiles
-	[profiles]
-	    path = /export/smb/ntprofile
-	    read only = no
-	    create mask = 0600
-	    directory mask = 0700
-

Note

+in smb.conf. An example smb.conf for acting as a PDC can be found in the example +for being a PDC. +
+
Example 5.1. smb.conf for being a PDC

[global]
netbios name = BELERIAND
workgroup = MIDEARTH
passdb backend = ldapsam, guest
os level = 33
preferred master = yes
domain master = yes
local master = yes
security = user
encrypt passwords = yes
domain logons = yes
logon path = \\%N\profiles\%u
logon drive = H:
logon home = \\homeserver\%u\winprofile
logon script = logon.cmd

[netlogon]
path = /var/lib/samba/netlogon
read only = yes
write list = ntadmin

[profiles]
path = /var/lib/samba/profiles
read only = no
create mask = 0600
directory mask = 0700
+
+The basic options shown above are explained as follows: +
passdb backend
+ This contains all the user and group account information. Acceptable values for a PDC + are: smbpasswd, tdbsam, ldapsam. The 'guest' entry provides needed + default accounts.
+ Where is is intended to use backup domain controllers (BDCs) the only logical choice is + to use LDAP so that the passdb backend can be distributed. The tdbsam and smbpasswd files + can not effectively be distributed and therefore should not be used. +
Domain Control Parameters
+ The parameters os level, preferred master, domain master, security, + encrypt passwords, domain logons play a central role in assuring domain + control and network logon support.
+ The os level must be set at or above a value of 32. A domain controller + must be the domain master browser, must be set in user mode security, + must support Microsoft compatible encrypted passwords, and must provide the network logon + service (domain logons). Encrypted passwords must be enabled, for more details on how + to do this, refer to the chapter on account information databases. +
Environment Parameters
+ The parameters logon path, logon home, logon drive, logon script are + environment support settings that help to facilitate client logon operations and that help + to provide automated control facilities to ease network management overheads. Please refer + to the man page information for these parameters. +
NETLOGON Share
+ The NETLOGON share plays a central role in domain logon and domain membership support. + This share is provided on all Microsoft domain controllers. It is used to provide logon + scripts, to store Group Policy files (NTConfig.POL), as well as to locate other common + tools that may be needed for logon processing. This is an essential share on a domain controller. +
PROFILE Share
+ This share is used to store user desktop profiles. Eash user must have a directory at the root + of this share. This directory must be write enabled for the user and must be globally read enabled. + Samba-3 has a VFS module called 'fake_permissions' that may be installed on this share. This will + allow a Samba administrator to make the directory read only to everyone. Of course this is useful + only after the profile has been properly created. +
Note
The above parameters make for a full set of parameters that may define the server's mode -of operation. The following parameters are the essentials alone: - -
- workgroup = NARNIA - domain logons = Yes - domain master = Yes - security = User -
- -The additional parameters shown in the longer listing above just makes for a -more complete environment. -
-There are a couple of points to emphasize in the above configuration. -
- Encrypted passwords must be enabled. For more details on how - to do this, refer to Account Information Database chapter. -
- The server must support domain logons and have a - [netlogon] share -
- The server must be the domain master browser in order for Windows - client to locate the server as a DC. Please refer to the various - Network Browsing documentation included with this distribution for - details. -

Samba ADS Domain Control

-Samba-3 is not and can not act as an Active Directory Server. It can not truly function as +of operation. The following smb.conf parameters are the essentials alone: +

netbios name = BELERIAND

workgroup = MIDEARTH

domain logons = Yes

domain master = Yes

security = User

+The additional parameters shown in the longer listing above just makes for +more complete explanation. +

Samba ADS Domain Control

+Samba-3 is not, and can not act as, an Active Directory Server. It can not truly function as an Active Directory Primary Domain Controller. The protocols for some of the functionality -the Active Directory Domain Controllers is have been partially implemented on an experimental -only basis. Please do NOT expect Samba-3 to support these protocols - nor should you depend -on any such functionality either now or in the future. The Samba-Team may well remove such -experimental features or may change their behaviour. -

Domain and Network Logon Configuration

-The subject of Network or Domain Logons is discussed here because it rightly forms +the Active Directory Domain Controllers has been partially implemented on an experimental +only basis. Please do NOT expect Samba-3 to support these protocols. Do not depend +on any such functionality either now or in the future. The Samba-Team may remove these +experimental features or may change their behaviour. This is mentioned for the benefit of those +who have discovered secret capabilities in samba-3 and who have asked when this functionality will be +completed. The answer is: Maybe or maybe never! +

+To be sure: Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4 style +domain controllers have. Samba-3 does NOT have all the capabilities of Windows NT4, but it does have +a number of features that Windows NT4 domain contollers do not have. In short, Samba-3 is not NT4 and it +is not Windows Server 200x and it is not an Active Directory server. We hope this is plain and simple +enough for all to understand. +

Domain and Network Logon Configuration

+The subject of Network or Domain Logons is discussed here because it forms an integral part of the essential functionality that is provided by a Domain Controller. -

Domain Network Logon Service

All Domain Controllers must run the netlogon service (domain logons -in Samba). One Domain Controller must be configured with domain master = Yes -(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No +in Samba). One Domain Controller must be configured with domain master = Yes +(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No must be set. -

Example Configuration

-	[global]
-		domain logons = Yes
-		domain master = (Yes on PDC, No on BDCs)
-
-	[netlogon]
-		comment = Network Logon Service
-		path = /var/lib/samba/netlogon
-		guest ok = Yes
-		browseable = No
-

The Special Case of MS Windows XP Home Edition

Note

Example Configuration

Example 5.2. smb.conf for being a PDC

[global]
domain logons = Yes
domain master = (Yes on PDC, No on BDCs)

[netlogon]
comment = Network Logon Service
path = /var/lib/samba/netlogon
guest ok = Yes
browseable = No

The Special Case of MS Windows XP Home Edition

Note

MS Windows XP Home Edition does not have the ability to join any type of Domain security facility. Unlike, MS Windows 9x / Me, MS Windows XP Home Edition also completely lacks the ability to log onto a network. @@ -1123,8 +995,10 @@ MS Windows XP Professional.

Now that this has been said, please do NOT ask the mailing list, or email any of the Samba-Team members with your questions asking how to make this work. It can't be done. -

The Special Case of Windows 9x / Me

-A domain and a workgroup are exactly the same thing in terms of network +If it can be done, then to do so would violate your software license agreement with +Microsoft, and we recommend that you do not do that. +

The Special Case of Windows 9x / Me

+A domain and a workgroup are exactly the same in terms of network browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a network. Also, different access rights can be granted to users if they @@ -1145,7 +1019,7 @@ which are the focus of this section. When an SMB client in a domain wishes to logon, it broadcasts requests for a logon server. The first one to reply gets the job, and validates its password using whatever mechanism the Samba administrator has installed. -It is possible (but very stupid) to create a domain where the user +It is possible (but ill advised ) to create a domain where the user database is not shared between servers, i.e. they are effectively workgroup servers advertising themselves as participating in a domain. This demonstrates how authentication is quite different from but closely @@ -1196,14 +1070,17 @@ The main difference between a PDC and a Windows 9x logon server configuration is

Password encryption is not required for a Windows 9x logon server. But note that beginning with MS Windows 98 the default setting is that plain-text - password support has been disabled. It can be re-enabled with the registry + password support is disabled. It can be re-enabled with the registry changes that are documented in the chapter on Policies.
Windows 9x/ME clients do not require and do not use machine trust accounts.

A Samba PDC will act as a Windows 9x logon server; after all, it does provide the network logon services that MS Windows 9x / Me expect to find. -

Security Mode and Master Browsers

Note

+Use of plain-text passwords is strongly discouraged. Where used they are easily detected +using a sniffer tool to examine network traffic. +

Security Mode and Master Browsers

There are a few comments to make in order to tie up some loose ends. There has been much debate over the issue of whether or not it is ok to configure Samba as a Domain Controller in security @@ -1220,24 +1097,25 @@ are two distinctly different functions), it is not a good idea to do so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS name. This is the name used by Windows clients to locate the DC. Windows clients do not distinguish between the DC and the DMB. +A DMB is a Domain Master Browser - see Domain Master Browser. For this reason, it is very wise to configure the Samba DC as the DMB.

Now back to the issue of configuring a Samba DC to use a mode other -than security = user. If a Samba host is configured to use +than security = user. If a Samba host is configured to use another SMB server or DC in order to validate user connection requests, then it is a fact that some other machine on the network -(the password server) knows more about the user than the Samba host. +(the password server) knows more about the user than the Samba host. 99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the workgroup parameter +in order to operate in domain mode security, the workgroup parameter must be set to the name of the Windows NT domain (which already has a domain controller). If the domain does NOT already have a Domain Controller then you do not yet have a Domain!

Configuring a Samba box as a DC for a domain that already by definition has a PDC is asking for trouble. Therefore, you should always configure the Samba DC -to be the DMB for its domain and set security = user. +to be the DMB for its domain and set security = user. This is the only officially supported mode of operation. -

Common Problems and Errors

I cannot include a '$' in a machine name

Common Errors

'$' cannot be included in machine name

A 'machine account', (typically) stored in /etc/passwd, takes the form of the machine name with a '$' appended. FreeBSD (and other BSD systems?) won't create a user with a '$' in their name. @@ -1245,24 +1123,26 @@ systems?) won't create a user with a '$' in their name. The problem is only in the program used to make the entry. Once made, it works perfectly. Create a user without the '$'. Then use vipw to edit the entry, adding the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! -

I get told "You already have a connection to the Domain...." +
Note
+The UNIX tool vipw is a common tool for directly editting the `/etc/passwd` file. +

Joining domain fails because of existing machine account

“I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.

+existing set.." when creating a machine trust account.”

This happens if you try to create a machine trust account from the machine itself and already have a connection (e.g. mapped drive) to a share (or IPC$) on the Samba PDC. The following command will remove all network drive connections:

-	C:\WINNT\> net use * /d
+C:\> net use * /d

Further, if the machine is already a 'member of a workgroup' that is the same name as the domain you are joining (bad idea) you will get this message. Change the workgroup name to something else, it does not matter what, reboot, and try again. -

The system can not log you on (C000019B)....

I joined the domain successfully but after upgrading +

The system can not log you on (C000019B)....

“I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message, The system can not log you on (C000019B), Please try again or consult your -system administrator when attempting to logon. +system administrator when attempting to logon.”

This occurs when the domain SID stored in the secrets.tdb database is changed. The most common cause of a change in domain SID is when @@ -1270,21 +1150,25 @@ the domain name and/or the server name (NetBIOS name) is changed. The only way to correct the problem is to restore the original domain SID or remove the domain client from the domain and rejoin. The domain SID may be reset using either the net or rpcclient utilities. -

+
The reset or change the domain SID you can use the net command as follows: -
+
root# net getlocalsid 'OLDNAME' root# net setlocalsid 'SID' -
-

The machine trust account for this computer either does not -exist or is not accessible.

-When I try to join the domain I get the message The machine account +

+Workstation machine trust accounts work only with the Domain (or network) SID. If this SID changes +then domain members (workstations) will not be able to log onto the domain. The original Domain SID +can be recovered from the secrets.tdb file. The alternative is to visit each workstation to re-join +it to the domain. +

The machine trust account not accessible

+ “When I try to join the domain I get the message The machine account for this computer either does not exist or is not accessible. What's -wrong? +wrong?”

This problem is caused by the PDC not having a suitable machine trust account. -If you are using the add machine script method to create +If you are using the add machine script method to create accounts then this would indicate that it has not worked. Ensure the domain admin user system is working.

@@ -1300,31 +1184,42 @@ Some people have also reported that inconsistent subnet masks between the Samba server and the NT client can cause this problem. Make sure that these are consistent for both client and server. -

When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.

Account disabled

“When I attempt to login to a Samba Domain from a NT4/W2K workstation, + I get a message about my account being disabled.”

Enable the user accounts with smbpasswd -e username, this is normally done as an account is created. -

Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

Domain Controller Unavailable

“Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"”

A domain controller has to announce on the network who it is. This usually takes a while. -

Chapter 6. Backup Domain Control

John H. Terpstra

Samba Team
<jht@samba.org>

Volker Lendecke

Samba Team
<Volker.Lendecke@SerNet.DE>

Table of Contents

Essential Background Information

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Backup Domain Controller Configuration

Example Configuration

Features And Benefits

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

Can not log onto domain member workstation after joining domain

After successfully joining the domain user logons fail with one of two messages:

One to the effect that the domain controller can not be found, the other claiming that the + account does not exist in the domain or that the password is incorrect.

This may be due to incompatible settings between + the Windows client and the Samba-3 server for schannel (secure channel) settings + or smb signing settings. Check your samba settings for + client schannel, server schannel, client signing, server signing by executing: + testparm -v | more and looking for the value of these parameters. +

+ Also use the Microsoft Management Console - Local Security Settings. This tool is available from the + Control Panel. The Policy settings are found in the Local Policies / Securty Options area and are prefixed by + Secure Channel: ..., and Digitally sign .... +

+ It is important that these be set consistently with the Samba-3 server settings. +

^[1]See also the chapter on Account Information Databases.
^[2]See also the chapter about network browsing

Chapter 6. Backup Domain Control

John H. Terpstra

Samba Team
<jht@samba.org>

Volker Lendecke

Samba Team
<Volker.Lendecke@SerNet.DE>

Table of Contents

Essential Background Information

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Backup Domain Controller Configuration

Example Configuration

Features and Benefits

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

Before you continue reading in this section, please make sure that you are comfortable -with configuring a Samba Domain Controller as described in the -Domain Control chapter. -

Features And Benefits

+with configuring a Samba Domain Controller as described in chapter on setting up Samba as a PDC. +

Features And Benefits

This is one of the most difficult chapters to summarise. It does not matter what we say here for someone will still draw conclusions and / or approach the Samba-Team with expectations that are either not yet capable of being delivered, or that can be achieved far more -effectively using a totally different approach. Since this HOWTO is already so large and -extensive, we have taken the decision to provide sufficient (but not comprehensive) -information regarding Backup Domain Control. In the event that you should have a persistent -concern that is not addressed in this HOWTO document then please email +effectively using a totally different approach. In the event that you should have a persistent +concern that is not addressed in this book then please email John H Terpstra clearly setting out your requirements and / or question and we will do our best to provide a solution.

Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain -Controller. A Samba-3 PDC can operate with an LDAP Account backend. The Samba-3 BDC can -operate with a slave LDAP server for the Account backend. This effectively gives samba a high -degree of scalability. This is a very sweet (nice) solution for large organisations. +Controller. A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be +either a common master LDAP server, or a slave server. The use of a slave LDAP server has the +benefit that when the master is down clients may still be able to log onto the network. +This effectively gives samba a high degree of scalability iand is a very sweet (nice) solution +for large organisations.

While it is possible to run a Samba-3 BDC with non-LDAP backend, the administrator will need to figure out precisely what is the best way to replicate (copy / distribute) the @@ -1349,8 +1244,9 @@ lets consider each possible option and look at the pro's and con's for each theo

Arguments Against: Complexity

- Passdb Backend is tdbsam based, BDCs use cron based "net rpc vampire" to - suck down the Accounts database from the PDC + Passdb Backend is tdbsam based, BDCs use cron based net rpc vampire to + obtain the Accounts database from the PDC and place them into the Samba SAM. + net rpc vampire is a Samba function of the "net" command.

Arguments For: It would be a nice solution

@@ -1371,7 +1267,7 @@ lets consider each possible option and look at the pro's and con's for each theo Arguments Against: All machine trust accounts and user accounts will be locally maintained. Domain users will NOT be able to roam from office to office. This is a broken and flawed solution. Do NOT do this. -

Essential Background Information

A Domain Controller is a machine that is able to answer logon requests from network workstations. Microsoft LanManager and IBM LanServer were two early products that provided this capability. The technology has become known as the LanMan Netlogon service. @@ -1381,7 +1277,7 @@ and with it a new form of the network logon service that has extended functional This service became known as the NT NetLogon Service. The nature of this service has changed with the evolution of MS Windows NT and today provides a very complex array of services that are implemented over a complex spectrum of technologies. -

MS Windows NT4 Style Domain Control

Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation, the workstation connects to a Domain Controller (authentication server) to validate the username and password that the user entered are valid. If the information entered @@ -1439,32 +1335,29 @@ one of the BDCs can be promoted to a PDC. If this happens while the original PDC line then it is automatically demoted to a BDC. This is an important aspect of Domain Controller management. The tool that is used to affect a promotion or a demotion is the Server Manager for Domains. -

Example PDC Configuration

Since version 2.2 Samba officially supports domain logons for all current Windows Clients, including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some parameters in the [global]-section of the smb.conf have to be set: -

-	workgroup = SAMBA
-	domain master = yes
-	domain logons = yes
-

-Several other things like a [homes] and a [netlogon] share also need to be set along with +

Example 6.1. Minimal smb.conf for being a PDC
workgroup = MIDEARTH
domain master = yes
domain logons = yes

+Several other things like a [homes] and a +[netlogon] share also need to be set along with settings for the profile path, the users home drive, etc.. This will not be covered in this -chapter, for more information please refer to the chapter on Domain Control. -

Active Directory Domain Control

+chapter, for more information please refer to the chapter about samba as a PDC. +

Active Directory Domain Control

As of the release of MS Windows 2000 and Active Directory, this information is now stored in a directory that can be replicated and for which partial or full administrative control can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT act as a Backup Domain Controller to an Active Directory Domain Controller. -

What qualifies a Domain Controller on the network?

Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network. The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server. The name type <#1b> name is normally reserved for the Domain Master Browser, a role that has nothing to do with anything related to authentication, but the Microsoft Domain implementation requires the domain master browser to be on the same machine as the PDC. -

How does a Workstation find its domain controller?

An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a local user to be authenticated has to find the domain controller for SAMBA. It does this by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each @@ -1472,22 +1365,22 @@ of the machines it gets back from the queries is a domain controller and can ans requests. To not open security holes both the workstation and the selected domain controller authenticate each other. After that the workstation sends the user's credentials (name and password) to the local Domain Controller, for validation. -

Backup Domain Controller Configuration

Several things have to be done:

The domain SID has to be the same on the PDC and the BDC. This used to be stored in the file private/MACHINE.SID. This file is not created - anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is - stored in the file private/secrets.tdb. Simply copying the secrets.tdb + since Samba 2.2.5. Nowadays the domain SID is stored in the file + private/secrets.tdb. Simply copying the secrets.tdb from the PDC to the BDC does not work, as the BDC would generate a new SID for itself and override the domain SID with this new BDC SID.
To retrieve the domain SID from the PDC or an existing BDC and store it in the secrets.tdb, execute:
```
-	root# net rpc getsid
-	
```
- The Unix user database has to be synchronized from the PDC to the +root# net rpc getsid +
+ The UNIX user database has to be synchronized from the PDC to the BDC. This means that both the /etc/passwd and /etc/group have to be replicated from the PDC to the BDC. This can be done manually whenever changes are made, or the PDC is set up as a NIS master @@ -1507,23 +1400,30 @@ Several things have to be done: BDC. This can be done manually whenever login scripts are changed, or it can be done automatically together with the smbpasswd synchronization. -

Example Configuration

Finally, the BDC has to be found by the workstations. This can be done by setting: -

-	workgroup = SAMBA
-	domain master = no
-	domain logons = yes
-

-in the [global]-section of the smb.conf of the BDC. This makes the BDC +

Example 6.2. Minimal setup for being a BDC
workgroup = MIDEARTH
domain master = no
domain logons = yes
idmap backend = ldapsam://slave-ldap.quenya.org

+In the [global]-section of the smb.conf of the BDC. This makes the BDC only register the name SAMBA<#1c> with the WINS server. This is no problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to -be registered by more than one machine. The parameter 'domain master = -no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS +be registered by more than one machine. The parameter +domain master = no +forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS name is reserved for the Primary Domain Controller. -

Common Errors

+The idmap backend will redirect the winbindd utility to +use the LDAP database to resolve all UIDs and GIDs for UNIX accounts. +

Note

+Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it +allows greater flexibility in how user and group IDs are handled in respect of NT Domain User and Group +SIDs. One of the new facilities provides for explicitly ensuring that UNIX / Linux UID and GID values +will be consistent on the PDC, all BDCs and all Domain Member servers. The parameter that controls this +is called idmap backend. Please refer to the man page for smb.conf for more information +regarding it's behaviour. Do NOT set this parameter except where an LDAP backend (ldapsam) is in use. +

Common Errors

As this is a rather new area for Samba there are not many examples that we may refer to. Keep watching for updates to this section. -

Machine Accounts keep expiring, what can I do?

This problem will occur when occur when the passdb (SAM) files are copied from a central server but the local Backup Domain Controllers. Local machine trust account password updates are not copied back to the central server. The newer machine account password is then over @@ -1534,18 +1434,15 @@ to proceed and the account expiry error will be reported.

The solution: use a more robust passdb backend, such as the ldapsam backend, setting up an slave LDAP server for each BDC, and a master LDAP server for the PDC. -

Can Samba be a Backup Domain Controller to an NT4 PDC?

With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully implemented. The Samba Team is working on understanding and implementing the protocols, -but this work has not been finished for version 2.2. +but this work has not been finished for Samba-3.

-With version 3.0, the work on both the replication protocols and a suitable storage -mechanism has progressed, and some form of NT4 BDC support is expected soon. -

-Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a +Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC. The main reason for implementing a BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to service logon requests whenever the PDC is down. -

How do I replicate the smbpasswd file?

Replication of the smbpasswd file is sensitive. It has to be done whenever changes to the SAM are made. Every user's password change is done in the smbpasswd file and has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. @@ -1559,12 +1456,12 @@ to type a password. As said a few times before, use of this method is broken and flawed. Machine trust accounts will go out of sync, resulting in a very broken domain. This method is not recommended. Try using LDAP instead. -

Can I do this all with LDAP?

The simple answer is YES. Samba's pdb_ldap code supports binding to a replica LDAP server, and will also follow referrals and rebind to the master if it ever needs to make a modification to the database. (Normally BDCs are read only, so this will not occur often). -

Chapter 7. Domain Membership

John H. Terpstra

Samba Team
<jht@samba.org>

Jeremy Allison

Samba Team
<jra@samba.org>

Gerald (Jerry) Carter

Samba Team
<jerry@samba.org>

Andrew Tridgell

Samba Team
<tridge@samba.org>

Jelmer R. Vernooij

The Samba Team
<jelmer@samba.org>

Table of Contents

MS Windows Workstation/Server Machine Trust Accounts

Manual Creation of Machine Trust Accounts
Using NT4 Server Manager to Add Machine Accounts to the Domain
"On-the-Fly" Creation of Machine Trust Accounts
Making an MS Windows Workstation or Server a Domain Member

Domain Member Server

Joining an NT4 type Domain with Samba-3
Why is this better than security = server?

Samba ADS Domain Membership

Setup your smb.conf
Setup your /etc/krb5.conf
Create the computer account
Test your server setup
Testing with smbclient
Notes

Can Not Add Machine Back to Domain
Adding Machine to Domain Fails

Chapter 7. Domain Membership

John H. Terpstra

Samba Team
<jht@samba.org>

Jeremy Allison

Samba Team
<jra@samba.org>

Gerald (Jerry) Carter

Samba Team
<jerry@samba.org>

Andrew Tridgell

Samba Team
<tridge@samba.org>

Jelmer R. Vernooij

The Samba Team
<jelmer@samba.org>

Domain Membership is a subject of vital concern, Samba must be able to participate as a member server in a Microsoft Domain security context, and Samba must be capable of providing Domain machine member trust accounts, @@ -1574,12 +1471,11 @@ This chapter covers background information pertaining to domain membership, Samba configuration for it, and MS Windows client procedures for joining a domain. Why is this necessary? Because both are areas in which there exists within the current MS Windows networking world and particularly in the -Unix/Linux networking and administration world, a considerable level of +UNIX/Linux networking and administration world, a considerable level of mis-information, incorrect understanding, and a lack of knowledge. Hopefully this chapter will fill the voids. -

Features and Benefits

-MS Windows workstations and servers that want to participate in domain -security need to +

Features and Benefits

+MS Windows workstations and servers that want to participate in domain security need to be made Domain members. Participating in Domain security is often called Single Sign On or SSO for short. This chapter describes the process that must be followed to make a workstation @@ -1614,7 +1510,7 @@ Domain membership has many advantages: client or server, other than the central Domain database (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an LDAP directory, or via an Active Directory infrastructure) -

MS Windows Workstation/Server Machine Trust Accounts

A machine trust account is an account that is used to authenticate a client machine (rather than a user) to the Domain Controller server. In Windows terminology, @@ -1633,18 +1529,18 @@ shared secret with the domain controller. A Windows NT4 PDC stores each machine trust account in the Windows Registry. The introduction of MS Windows 2000 saw the introduction of Active Directory, the new repository for machine trust accounts. -
+
A Samba PDC, however, stores each machine trust account in two parts, as follows: -
+
A Domain Security Account (stored in the - passdb backend that has been configured in the + passdb backend that has been configured in the smb.conf file. The precise nature of the account information that is stored depends on the type of backend database that has been chosen.
The older format of this data is the smbpasswd database - which contains the unix login ID, the Unix user identifier (UID), and the + which contains the UNIX login ID, the UNIX user identifier (UID), and the LanMan and NT encrypted passwords. There is also some other information in this file that we do not need to concern ourselves with here.
@@ -1653,17 +1549,18 @@ as follows: older smbpasswd file did. The extra information enables new user account controls to be used.
- A corresponding Unix account, typically stored in + A corresponding UNIX account, typically stored in /etc/passwd. Work is in progress to allow a - simplified mode of operation that does not require Unix user accounts, but + simplified mode of operation that does not require UNIX user accounts, but this may not be a feature of the early releases of Samba-3. -
-
+
+
There are three ways to create machine trust accounts:
- Manual creation from the Unix/Linux command line. Here, both the Samba and - corresponding Unix account are created by hand. + Manual creation from the UNIX/Linux command line. Here, both the Samba and + corresponding UNIX account are created by hand.
+ Using the MS Windows NT4 Server Manager (either from an NT4 Domain member server, or using the Nexus toolkit available from the Microsoft web site. This tool can be run from any MS Windows machine so long as the user is @@ -1671,28 +1568,39 @@ There are three ways to create machine trust accounts:
"On-the-fly" creation. The Samba machine trust account is automatically created by Samba at the time the client is joined to the domain. - (For security, this is the recommended method.) The corresponding Unix + (For security, this is the recommended method.) The corresponding UNIX account may be created automatically or manually. -
Manual Creation of Machine Trust Accounts
+
Manual Creation of Machine Trust Accounts
The first step in manually creating a machine trust account is to manually -create the corresponding Unix account in /etc/passwd. +create the corresponding UNIX account in /etc/passwd. This can be done using vipw or another 'add user' command -that is normally used to create new Unix accounts. The following is an example for a Linux based Samba server: -
-root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" -s /bin/false machine_name$ +that is normally used to create new UNIX accounts. The following is an example for a Linux based Samba server: + + + +
+
+root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" \ + -s /bin/false machine_name$ + root# passwd -l machine_name$ +

+ On *BSD systems, this can be done using the chpass utility:
-root# chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" +
+root# chpass -a \ + "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" +

The /etc/passwd entry will list the machine name with a "$" appended, won't have a password, will have a null shell and no home directory. For example a machine named 'doppy' would have an /etc/passwd entry like this:
-doppy$:x:505:501:machine_nickname:/dev/null:/bin/false +doppy$:x:505:100:machine_nickname:/dev/null:/bin/false
Above, machine_nickname can be any descriptive name for the client, i.e., BasementComputer. @@ -1701,39 +1609,44 @@ name of the client to be joined to the domain. The "$" must be appended to the NetBIOS name of the client or Samba will not recognize this as a machine trust account.
-Now that the corresponding Unix account has been created, the next step is to create +Now that the corresponding UNIX account has been created, the next step is to create the Samba account for the client containing the well-known initial -machine trust account password. This can be done using the smbpasswd(8) command +machine trust account password. This can be done using the +smbpasswd command as shown here: -
-
+
+
root# smbpasswd -a -m machine_name -
-
+
+
where machine_name is the machine's NetBIOS name. The RID of the new machine account is generated from the UID of -the corresponding Unix account. +the corresponding UNIX account.
Join the client to the domain immediately
Manually creating a machine trust account using this method is the equivalent of creating a machine trust account on a Windows NT PDC using + the Server Manager. From the time at which the account is created to the time which the client joins the domain and changes the password, your domain is vulnerable to an intruder joining your domain using a machine with the same NetBIOS name. A PDC inherently trusts members of the domain and will serve out a large degree of user information to such clients. You have been warned! -
Using NT4 Server Manager to Add Machine Accounts to the Domain
+

Using NT4 Server Manager to Add Machine Accounts to the Domain

If the machine from which you are trying to manage the domain is an -MS Windows NT4 workstation +MS Windows NT4 workstation or MS Windows 200x / XP Professional then the tool of choice is the package called SRVTOOLS.EXE. -When executed in the target directory this will unpack -SrvMge.exe and UsrMgr.exe (both are -Domain Management tools for MS Windows NT4 workstation. +When executed in the target directory this will unpack SrvMge.exe +and UsrMgr.exe (both are domain management tools for MS Windows NT4 workstation).

-If your workstation is any other MS Windows product you should download the -Nexus.exe package from the Microsoft web site. When executed -from the target directory this will unpack the same tools but for use on -MS Windows 9x/Me/200x/XP. +If your workstation is a Microsoft Windows 9x/Me family product + you should download the Nexus.exe package from the Microsoft web site. +When executed from the target directory this will unpack the same tools but for use on +this platform. +

+Further information about these tools may be obtained from the following locations: +http://support.microsoft.com/default.aspx?scid=kb;en-us;173673 +http://support.microsoft.com/default.aspx?scid=kb;en-us;172540

Launch the srvmgr.exe (Server Manager for Domains) and follow these steps:

Procedure 7.1. Server Manager Account Machine Account Management

@@ -1753,25 +1666,21 @@ Launch the srvmgr.exe (Server Manager for Domains) and fo Add NT Workstation of Server, then enter the machine name in the field provided, then click the Add button. -

"On-the-Fly" Creation of Machine Trust Accounts

The second (and recommended) way of creating machine trust accounts is simply to allow the Samba server to create them as needed when the client is joined to the domain. -

Since each Samba machine trust account requires a corresponding Unix account, a method -for automatically creating the Unix account is usually supplied; this requires configuration of the -add machine script option in -smb.conf. This method is not required, however; corresponding Unix +

Since each Samba machine trust account requires a corresponding UNIX account, a method +for automatically creating the UNIX account is usually supplied; this requires configuration of the +add machine script option in +smb.conf. This method is not required, however; corresponding UNIX accounts may also be created manually.

Below is an example for a RedHat Linux system. -

-[global]
-   # <...remainder of parameters...>
-   add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u 
-

Making an MS Windows Workstation or Server a Domain Member

[global]

# <...remainder of parameters...>

add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u

Making an MS Windows Workstation or Server a Domain Member

The procedure for making an MS Windows workstation of server a member of the domain varies with the version of Windows: -

Windows 200x XP Professional

When the user elects to make the client a domain member, Windows 200x prompts for an account and password that has privileges to create machine accounts in the domain. A Samba administrative account (i.e., a Samba account that has root privileges on the @@ -1785,13 +1694,13 @@ with the version of Windows: The name of the account that is used to create domain member machine accounts can be anything the network administrator may choose. If it is other than root then this is easily mapped to root using the file pointed to be the smb.conf parameter - username map = /etc/samba/smbusers. + username map = /etc/samba/smbusers.

The session key of the Samba administrative account acts as an encryption key for setting the password of the machine trust account. The machine trust account will be created on-the-fly, or updated if it already exists. -

Windows NT4

If the machine trust account was created manually, on the Identification Changes menu enter the domain name, but do not check the box Create a Computer Account in the Domain. @@ -1804,8 +1713,8 @@ with the version of Windows: Domain. In this case, joining the domain proceeds as above for Windows 2000 (i.e., you must supply a Samba administrative account when prompted). -

Samba

Joining a Samba client to a domain is documented in - the Domain Member Server section of this chapter chapter. +

Samba

Joining a Samba client to a domain is documented in + the domain member chapter.

Domain Member Server

This mode of server operation involves the Samba machine being made a member of a domain security context. This means by definition that all user @@ -1821,47 +1730,39 @@ This can be LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory Server, etc.

-Please refer to the Domain Control chapter +Please refer to the chapter on setting up a PDC for more information regarding how to create a domain machine account for a domain member server as well as for information regarding how to enable the Samba domain member machine to join the domain and to be fully trusted by it. -

Joining an NT4 type Domain with Samba-3

-
Table 7.1. Assumptions
NetBIOS name: SERV1
Win2K/NT domain name: DOM
Domain's PDC NetBIOS name: DOMPDC
Domain's BDC NetBIOS names: DOMBDC1 and DOMBDC2
-
+
Joining an NT4 type Domain with Samba-3
+
Table 7.1. Assumptions
NetBIOS name: SERV1
Win2K/NT domain name: MIDEARTH
Domain's PDC NetBIOS name: DOMPDC
Domain's BDC NetBIOS names: DOMBDC1 and DOMBDC2
+
First, you must edit your smb.conf file to tell Samba it should now use domain security.
-Change (or add) your -security line in the [global] section + Change (or add) your + security line in the [global] section of your smb.conf to read: -
-
-security = domain -
-
-Next change the -workgroup line in the [global] +
+
security = domain
+
+Next change the workgroup line in the [global] section to read: -
-
-workgroup = DOM -
-
+
+
workgroup = MIDEARTH
+
as this is the name of the domain we are joining.
-You must also have the parameter -encrypt passwords set to yes +You must also have the parameter +encrypt passwords set to yes in order for your users to authenticate to the NT PDC.
-Finally, add (or modify) a -password server line in the [global] +Finally, add (or modify) a password server line in the [global] section to read: -
--password server = DOMPDC DOMBDC1 DOMBDC2 - - + + password server = DOMPDC DOMBDC1 DOMBDC2 + These are the primary and backup domain controllers Samba will attempt to contact in order to authenticate users. Samba will try to contact each of these servers in order, so you may want to @@ -1871,21 +1772,19 @@ among domain controllers. Alternatively, if you want smbd to automatically determine the list of Domain controllers to use for authentication, you may set this line to be: - --password server = * - - + + password server = * + This method allows Samba to use exactly the same mechanism that NT does. This method either broadcasts or uses a WINS database in order to find domain controllers to authenticate against. In order to actually join the domain, you must run this command: - --root# net join -S DOMPDC -UAdministrator%password - - + + +root# net rpc join -S DOMPDC -UAdministrator%password + + If the -S DOMPDC argument is not given then the domain name will be obtained from smb.conf. @@ -1900,8 +1799,8 @@ you will see the message: Joined domain DOM. or Joined 'SERV1' to realm 'MYREALM' -in your terminal window. See the -net(8) man page for more details. +in your terminal window. See the +net man page for more details. This process joins the server to the domain without having to create the machine trust account on the PDC beforehand. @@ -1919,21 +1818,25 @@ security for your system, and should be treated as carefully as a shadow password file. Finally, restart your Samba daemons and get ready for -clients to begin using domain security! -
Why is this better than security = server?
+clients to begin using domain security! The way you can restart your +samba daemons depends on your distribution, but in most cases running +
+ root# /etc/init.d/samba restart +
+does the job. +
Why is this better than security = server?
Currently, domain security in Samba doesn't free you from -having to create local Unix users to represent the users attaching +having to create local UNIX users to represent the users attaching to your server. This means that if domain user DOM\fred attaches to your domain security Samba server, there needs -to be a local Unix user fred to represent that user in the Unix +to be a local UNIX user fred to represent that user in the UNIX filesystem. This is very similar to the older Samba security mode -security = server, +security = server, where Samba would pass through the authentication request to a Windows NT server in the same way as a Windows 95 or Windows 98 server would.
-Please refer to the Winbind chapter -for information on a system to automatically -assign UNIX uids and gids to Windows NT Domain users and groups. + Please refer to the chapter on winbind for information on a system +to automatically assign UNIX uids and gids to Windows NT Domain users and groups.
The advantage to domain-level security is that the authentication in domain-level security is passed down the authenticated @@ -1943,11 +1846,11 @@ exactly the same way NT servers do (i.e., you can add Samba servers into a resource domain and have the authentication passed on from a resource domain PDC to an account domain PDC).
-In addition, with security = server every Samba +In addition, with security = server every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run -out of available connections. With security = domain, +out of available connections. With security = domain, however, the Samba daemons connect to the PDC/BDC only for as long as is necessary to authenticate the user, and then drop the connection, thus conserving PDC connection resources. @@ -1961,44 +1864,39 @@ Much of the text of this document was first published in the Web magazine LinuxWorld as the article Doing the NIS/NT Samba. -

`Samba ADS Domain Membership`

+

`Samba ADS Domain Membership`

This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a Windows2000 KDC. A familiarity with Kerberos is assumed. - Setup your smb.conf + Setup your smb.conf You must use at least the following 3 options in smb.conf: - - realm = your.kerberos.REALM - security = ADS - encrypt passwords = yes - + realm = your.kerberos.REALM security = ADS encrypt passwords = yes In case samba can't figure out your ads server using your realm name, use the -ads server option in smb.conf: - - ads server = your.kerberos.server - -Note +ads server option in smb.conf: + ads server = your.kerberos.server + Note You do not need a smbpasswd file, and older clients will be authenticated as -if security = domain, although it won't do any harm and +if security = domain, although it won't do any harm and allows you to have local users not in the domain. It is expected that the above required options will change soon when active directory integration will get better. - Setup your /etc/krb5.conf + Setup your /etc/krb5.conf The minimal configuration for krb5.conf is: - [libdefaults] - default_realm = YOUR.KERBEROS.REALM +[libdefaults] + default_realm = YOUR.KERBEROS.REALM [realms] - YOUR.KERBEROS.REALM = { - kdc = your.kerberos.server + YOUR.KERBEROS.REALM = { + kdc = your.kerberos.server } - + Test your config by doing a kinit USERNAME@REALM and making sure that your password is accepted by the Win2000 KDC. Note The realm must be uppercase or you will get Cannot find KDC for -requested realm while getting initial credentials error. +requested realm while getting initial credentials error (Kerberos +is case-sensitive!). Note Time between the two servers must be synchronized. You will get a kinit(v5): Clock skew too great while getting initial credentials @@ -2020,20 +1918,20 @@ straight to Test wi Creating a computer account and testing your servers is only needed if you want Kerberos support for smbd and winbindd. - Create the computer account + Create the computer account As a user that has write permission on the Samba private directory (usually root) run: - - root# net join -U Administrator%password - -Possible errors -ADS support not compiled in Samba must be reconfigured (remove config.cache) and recompiled + +root# net ads join -U Administrator%password + + Possible errors + ADS support not compiled in Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the Kerberos libs and headers are installed. - net join prompts for user name You need to login to the domain using kinit + net ads join prompts for user name You need to login to the domain using kinit USERNAME@REALM. USERNAME must be a user who has rights to add a machine - to the domain. - Test your server setup + to the domain. + Test your server setup If the join was successful, you will see a new computer account with the NetBIOS name of your Samba server in Active Directory (in the "Computers" folder under Users and Computers. @@ -2042,41 +1940,41 @@ On a Windows 2000 client try net use * \\server\shareklist tickets. Did you get a ticket for the server? Does it have an encoding type of DES-CBC-MD5 ? - Testing with smbclient + Testing with smbclient On your Samba server try to login to a Win2000 server or your Samba server using smbclient and Kerberos. Use smbclient as usual, but -specify the -k option to choose Kerberos authentication. - Notes +specify the -k option to choose Kerberos authentication. + Notes You must change administrator password at least once after DC install, to create the right encoding types W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in -their defaults DNS setup. Maybe fixed in service packs? - Common Errors +their defaults DNS setup. Maybe this will be fixed later in service packs. + Common Errors In the process of adding / deleting / re-adding domain member machine accounts there are many traps for the unwary player and there are many “little” things that can go wrong. It is particularly interesting how often subscribers on the samba mailing list have concluded after repeated failed attempts to add a machine account that it is necessary to "re-install" MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type of problem. The real solution is often very simple, and with understanding of how MS Windows -networking functions. easily overcome. - Can Not Add Machine Back to Domain -Problem: A Windows workstation was reinstalled. The original domain machine +networking functions easy to overcome. + Can Not Add Machine Back to Domain +“ A Windows workstation was reinstalled. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already -exists on the network - I know it doesn't. Why is this failing? +exists on the network - I know it doesn't. Why is this failing?” The original name is still in the NetBIOS name cache and must expire after machine account deletion BEFORE adding that same name as a domain member again. The best advice is to delete the old account and then to add the machine with a new name. - Adding Machine to Domain Fails -Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a + Adding Machine to Domain Fails + “Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a message that, The machine could not be added at this time, there is a network problem. -Please try again later. Why? + Please try again later. Why?” -You should check that there is an add machine script in your smb.conf +You should check that there is an add machine script in your smb.conf file. If there is not, please add one that is appropriate for your OS platform. If a script -has been defined you will need to debug it's operation. Increase the log level +has been defined you will need to debug it's operation. Increase the log level in the smb.conf file to level 10, then try to rejoin the domain. Check the logs to see which operation is failing. @@ -2085,21 +1983,23 @@ Possible causes include: The script does not actually exist, or could not be located in the path specified. Corrective Action: Fix it. Make sure that when run manually - that the script will add both the Unix system account _and_ the Samba SAM account. + that the script will add both the UNIX system account _and_ the Samba SAM account. - The machine could not be added to the Unix system accounts file /etc/passwd + The machine could not be added to the UNIX system accounts file /etc/passwd - Corrective Action: Check that the machine name is a legal Unix - system account name. ie: If the Unix utility useradd is called + Corrective Action: Check that the machine name is a legal UNIX + system account name. ie: If the UNIX utility useradd is called then make sure that the machine name you are trying to add can be added using this tool. Useradd on some systems will not allow any upper case characters nor will it allow spaces in the name. -

`Chapter 8. Stand-Alone Servers`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Background

Example Configuration

Reference Documentation Server
Central Print Serving

+

`I can't join a Windows 2003 PDC`

Windows 2003 requires SMB signing. Client side SMB signing has + only been implemented partially in Samba 3.0. Set client use spnego = no when communicating + with a windows 2003 server.

`Chapter 8. Stand-Alone Servers`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Background

Example Configuration

Reference Documentation Server
Central Print Serving

Stand-Alone servers are independent of Domain Controllers on the network. They are NOT domain members and function more like workgroup servers. In many cases a stand-alone server is configured with a minimum of security control with the intent that all data served will be readily accessible to all users. -

`Features and Benefits`

+

`Features and Benefits`

Stand-Alone servers can be as secure or as insecure as needs dictate. They can have simple or complex configurations. Above all, despite the hoopla about Domain security they remain a very common installation. @@ -2116,7 +2016,7 @@ that are queued off a single central server. Everyone needs to be able to print to the printers, there is no need to affect any access controls and no files will be served from the print server. Again a share mode stand-alone server makes a great solution. -

`Background`

+

`Background`

The term stand-alone server means that the server will provide local authentication and access control for all resources that are available from it. In general this means that there will be a @@ -2138,50 +2038,37 @@ local or on a remote server, even if from the Samba protocol perspective the Samba server is NOT a member of a domain security context.

Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher) the source of authentication may reside on +(the name service switcher, which maintains the unix user database) the source of authentication may reside on another server. We would be inclined to call this the authentication server. -This means that the Samba server may use the local Unix/Linux system password database +This means that the Samba server may use the local UNIX/Linux system password database (/etc/passwd or /etc/shadow), may use a local smbpasswd file, or may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB server for authentication. -

`Example Configuration`

+

`Example Configuration`

The following examples are designed to inspire simplicity. It is too easy to attempt a high level of creativity and to introduce too much complexity in server and network design. -

`Reference Documentation Server`

+

`Reference Documentation Server`

Configuration of a read-only data server that EVERYONE can access is very simple. Here is the smb.conf file that will do this. Assume that all the reference documents are stored in the directory /export, that the documents are owned by a user other than nobody. No home directories are shared, that are no users in the /etc/passwd -Unix system database. This is a very simple system to administer. -

-	# Global parameters
-	[global]
-		workgroup = MYGROUP
-		netbios name = REFDOCS
-		security = SHARE
-		passdb backend = guest
-		wins server = 192.168.1.1
-
-	[data]
-		comment = Data
-		path = /export
-		guest only = Yes
-

+UNIX system database. This is a very simple system to administer. +

Example 8.1. smb.conf for Reference Documentation Server # Global parameters [global] workgroup = MIDEARTH netbios name = GANDALF security = SHARE passdb backend = guest wins server = 192.168.1.1 [data] comment = Data path = /export guest only = Yes

In the above example the machine name is set to REFDOCS, the workgroup is set to the name of the local workgroup so that the machine will appear in with systems users are familiar with. The only password backend required is the "guest" backend so as to allow default unprivileged account names to be used. Given that there is a WINS server on this network we do use it. -

`Central Print Serving`

+

`Central Print Serving`

Configuration of a simple print server is very simple if you have all the right tools on your system.

Assumptions:

The print server must require no administration
The print spooling and processing system on our print server will be CUPS. - (Please refer to the CUPS Printing chapter for more information). + (Please refer to the chapter about CUPS for more information).
All printers that the print server will service will be network printers. They will be correctly configured, by the administrator, @@ -2194,77 +2081,68 @@ In this example our print server will spool all incoming print jobs to /var/spool/samba until the job is ready to be submitted by Samba to the CUPS print processor. Since all incoming connections will be as the anonymous (guest) user, two things will be required: -
Enabling Anonymous Printing
- - The Unix/Linux system must have a guest account. + Enabling Anonymous Printing + The UNIX/Linux system must have a guest account. The default for this is usually the account nobody. To find the correct name to use for your version of Samba do the following: - + $ testparm -s -v | grep "guest account" - + Then make sure that this account exists in your system password database (/etc/passwd). - + The directory into which Samba will spool the file must have write access for the guest account. The following commands will ensure that this directory is available for use: - + root# mkdir /var/spool/samba root# chown nobody.nobody /var/spool/samba root# chmod a+rwt /var/spool/samba - - -- # Global parameters - [global] - workgroup = MYGROUP - netbios name = PTRSVR1 - security = SHARE - passdb backend = guest - wins server = 192.168.1.1 - - [printers] - comment = All Printers - path = /var/spool/samba - printer admin = root - guest ok = Yes - printable = Yes - printing = cups - use client driver = Yes - browseable = No - -

`Common Errors`

+

Example 8.2. smb.conf for anonymous printing # Global parameters [global] workgroup = MIDEARTH netbios name = GANDALF security = SHARE passdb backend = guest wins server = noldor printing = cups printcap name = cups [printers] comment = All Printers path = /var/spool/samba printer admin = root guest ok = Yes printable = Yes use client driver = Yes browseable = No

+

`Common Errors`

The greatest mistake so often made is to make a network configuration too complex. It pays to use the simplest solution that will meet the needs of the moment. -

`Chapter 9. MS Windows Network Configuration Guide`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Note

`Note`

+

`Chapter 9. MS Windows Network Configuration Guide`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Note

`Note`

This chapter did not make it into this release. It is planned for the published release of this document. -

`Advanced Configuration`

`Valuable Nuts and Bolts Information`

+

`Advanced Configuration`

`Valuable Nuts and Bolts Information`

Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features. -

Table of Contents

10. Samba / MS Windows Network Browsing Guide

What is Browsing?

WINS - The Windows Internetworking Name Server

NetBIOS over TCP/IP
TCP/IP - without NetBIOS
DNS and Active Directory

How Browsing Functions

Setting up WORKGROUP Browsing
Setting up DOMAIN Browsing
Forcing Samba to be the master
Making Samba the domain master
Note about broadcast addresses
Multiple interfaces
Use of the Remote Announce parameter
Use of the Remote Browse Sync parameter

Setting up a WINS server
WINS Replication
Static WINS Entries

Helpful Hints

Windows Networking Protocols
Name Resolution Order

Technical Overview of browsing

Browsing support in Samba
Problem resolution
Browsing across subnets

How can one flush the Samba NetBIOS name cache without restarting Samba?
My client reports "This server is not configured to list shared resources"

11. Account Information Databases

Technical Information

Important Notes About Security
Mapping User Identifiers between MS Windows and Unix

Account Management Tools

The smbpasswd Command
The pdbedit Command

Password Backends

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon - Users not in Samba SAM
Users are being added to the wrong backend database
auth methods does not work

12. Mapping MS Windows and Unix Groups

Example Configuration

Configuration Scripts

Sample smb.conf add group script
Script to configure Group Mapping

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails

13. File, Directory and Share Access Controls

MS Windows Access Control Lists and Unix Interoperability

File System Access Controls

MS Windows NTFS Comparison with Unix File Systems
Managing Directories
File and Directory Access Control

Share Definition Access Controls

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

Access Controls on Shares

Share Permissions Management

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask - parameters
Interaction with the standard Samba file attribute - mapping

Users can not write to a public share
I have set force user and Samba still makes root the owner of all the files - I touch!

14. File and Record Locking

MS Windows Opportunistic Locking and Caching Controls

Opportunistic Locking Overview

Samba Opportunistic Locking Control

Example Configuration

Workstation Service Entries
Server Service Entries

Persistent Data Corruption

locking.tdb error messages

Additional Reading

15. Securing Samba

Technical Discussion of Protective Measures and Issues

Using host based protection
User based protection
Using interface protection
Using a firewall
Using a IPC$ share deny
NTLMv2 Security

Upgrading Samba

Smbclient works on localhost, but the network is dead
Why can users access home directories of other users?

16. Interdomain Trust Relationships

Native MS Windows NT4 Trusts Configuration

Trust Relationship Background

NT4 as the Trusting Domain (ie. creating the trusted account)
NT4 as the Trusted Domain (ie. creating trusted account's password)

Configuring Samba NT-style Domain Trusts

Samba-3 as the Trusting Domain
Samba-3 as the Trusted Domain

Tell me about Trust Relationships using Samba

17. Hosting a Microsoft Distributed File System tree on Samba

Features and Benefits
Common Errors

18. Classical Printing Support

A simple Configuration to Print with Samba-3

Technical Introduction

What happens if you send a Job from a Client
Printing Related Configuration Parameters
Parameters Recommended for Use
Parameters for Backwards Compatibility
Parameters no longer in use

Verification of "Settings in Use" with testparm
A little Experiment to warn you

Extended Sample Configuration to Print with Samba-3

Detailed Explanation of the Example's Settings

The [global] Section
The [printers] Section
Any [my_printer_name] Section
Print Commands
Default Print Commands for various Unix Print Subsystems
Setting up your own Print Commands

Innovations in Samba Printing since 2.2

Client Drivers on Samba Server for Point'n'Print
The [printer$] Section is removed from Samba-3
Creating the [print$] Share
Parameters in the [print$] Section
Subdirectory Structure in [print$]

Installing Drivers into [print$]

Setting Drivers for existing Printers with a Client GUI
Setting Drivers for existing Printers with -rpcclient

"The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)

The first Client Driver Installation
IMPORTANT! Setting Device Modes on new Printers
Further Client Driver Install Procedures
Always make first Client Connection as root or "printer admin"

Other Gotchas

Setting Default Print Options for the Client Drivers
Supporting large Numbers of Printers
Adding new Printers with the Windows NT APW
Weird Error Message Cannot connect under a -different Name
Be careful when assembling Driver Files
Samba and Printer Ports
Avoiding the most common Misconfigurations of the Client Driver

The Imprints Toolset

What is Imprints?
Creating Printer Driver Packages
The Imprints Server
The Installation Client

Add Network Printers at Logon without User Interaction

The addprinter command

Migration of "Classical" printing to Samba-3

Publishing Printer Information in Active Directory or LDAP

Common Errors and Problems

I give my root password but I don't get access
My printjobs get spooled into the spooling directory, but then get lost

19. CUPS Printing Support in Samba 3.0

Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download

Features and Benefits
Overview

Basic Configuration of CUPS support

Linking of smbd with libcups.so
Simple smb.conf Settings for CUPS
More complex smb.conf Settings for -CUPS

Advanced Configuration

Central spooling vs. "Peer-to-Peer" printing
CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
Driver Installation Methods on Windows Clients
Explicitly enable "raw" printing for -application/octet-stream!
Three familiar Methods for driver upload plus a new one

GDI on Windows -- PostScript on Unix
Windows Drivers, GDI and EMF
Unix Printfile Conversion and GUI Basics
PostScript and Ghostscript
Ghostscript -- the Software RIP for non-PostScript Printers
PostScript Printer Description (PPD) Specification
CUPS can use all Windows-formatted Vendor PPDs
CUPS also uses PPDs for non-PostScript Printers

The CUPS Filtering Architecture

MIME types and CUPS Filters
MIME type Conversion Rules
Filter Requirements
Prefilters
pstops
pstoraster
imagetops and imagetoraster
rasterto [printers specific]
CUPS Backends
cupsomatic/Foomatic -- how do they fit into the Picture?
The Complete Picture
mime.convs
"Raw" printing
"application/octet-stream" printing
PostScript Printer Descriptions (PPDs) for non-PS Printers
Difference between cupsomatic/foomatic-rip and -native CUPS printing
Examples for filtering Chains
Sources of CUPS drivers / PPDs
Printing with Interface Scripts

Network printing (purely Windows)

From Windows Clients to an NT Print Server
Driver Execution on the Client
Driver Execution on the Server

Network Printing (Windows clients -- UNIX/Samba Print -Servers)

From Windows Clients to a CUPS/Samba Print Server
Samba receiving Jobfiles and passing them to CUPS

Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs

PPDs for non-PS Printers on UNIX
PPDs for non-PS Printers on Windows

Windows Terminal Servers (WTS) as CUPS Clients

Printer Drivers running in "Kernel Mode" cause many -Problems
Workarounds impose Heavy Limitations
CUPS: a "Magical Stone"?
PostScript Drivers with no major problems -- even in Kernel -Mode

Setting up CUPS for driver Download

cupsaddsmb: the unknown Utility
Prepare your smb.conf for -cupsaddsmb
CUPS Package of "PostScript Driver for WinNT/2k/XP"
Recognize the different Driver Files
Acquiring the Adobe Driver Files
ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
Caveats to be considered
What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
Run "cupsaddsmb" (quiet Mode)
Run "cupsaddsmb" with verbose Output
Understanding cupsaddsmb
How to recognize if cupsaddsm completed successfully
cupsaddsmb with a Samba PDC
cupsaddsmb Flowchart
Installing the PostScript Driver on a Client
Avoiding critical PostScript Driver Settings on the -Client

Installing PostScript Driver Files manually (using -rpcclient)

A Check of the rpcclient man Page
Understanding the rpcclient man Page
Producing an Example by querying a Windows Box
What is required for adddriver and setdriver to succeed
Manual Commandline Driver Installation in 15 little Steps
Troubleshooting revisited

The printing *.tdb Files

Trivial DataBase Files
Binary Format
Losing *.tdb Files
Using tdbbackup

CUPS Print Drivers from Linuxprinting.org

foomatic-rip and Foomatic explained
foomatic-rip and Foomatic-PPD Download and Installation

Page Accounting with CUPS

Setting up Quotas
Correct and incorrect Accounting
Adobe and CUPS PostScript Drivers for Windows Clients
The page_log File Syntax
Possible Shortcomings
Future Developments
Other Accounting Tools

Additional Material

Auto-Deletion or Preservation of CUPS Spool Files

CUPS Configuration Settings explained
Pre-conditions
Manual Configuration

When not to use Samba to print to -CUPS

In Case of Trouble.....

Where to find Documentation
How to ask for Help
Where to find Help

Appendix

Printing from CUPS to Windows attached -Printers
More CUPS filtering Chains
Trouble Shooting Guidelines to fix typical Samba printing -Problems
An Overview of the CUPS Printing Processes

20. Stackable VFS modules

Included modules

audit
extd_audit
fake_perms
recycle
netatalk

VFS modules available elsewhere

DatabaseFS
vscan

21. Integrated Logon Support using Winbind

What Winbind Provides

Target Uses

How Winbind Works

Microsoft Remote Procedure Calls
Microsoft Active Directory Services
Name Service Switch
Pluggable Authentication Modules
User and Group ID Allocation
Result Caching

Installation and Configuration

Introduction
Requirements
Testing Things Out

Conclusion

22. Advanced Network Management

Remote Server Administration

Remote Desktop Management

Remote Management from NoMachines.Com

Network Logon Script Magic

Adding printers without user intervention

23. System and Account Policies

Creating and Managing System Policies

Windows 9x/Me Policies
Windows NT4 Style Policy Files
MS Windows 200x / XP Professional Policies

Managing Account/User Policies

Samba Editreg Toolset
Windows NT4/200x
Samba PDC

System Startup and Logon Processing Overview

Policy Does Not Work

24. Desktop Profile Management

Roaming Profiles

Samba Configuration for Profile Handling
Windows Client Profile Configuration Information
Sharing Profiles between W9x/Me and NT4/200x/XP workstations
Profile Migration from Windows NT4/200x Server to Samba

Mandatory profiles

Creating/Managing Group Profiles

Default Profile for Windows Users

MS Windows 9x/Me
MS Windows NT4 Workstation
MS Windows 200x/XP

How does one set up roaming profiles for just one (or a few) user/s or group/s?
Can NOT use Roaming Profiles
Changing the default profile

25. PAM based Distributed Authentication

Technical Discussion

PAM Configuration Syntax
Example System Configurations
smb.conf PAM Configuration
Remote CIFS Authentication using winbindd.so
Password Synchronization using pam_smbpass.so

pam_winbind problem

26. Integrating MS Windows networks with Samba

Name Resolution in a pure Unix/Linux world

Background Information

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

Name resolution as used within MS Windows networking

The NetBIOS Name Cache
The LMHOSTS file
HOSTS file
DNS Lookup
WINS Lookup

My Boomerang Won't Come Back
Very Slow Network Connections
Samba server name change problem

27. Unicode/Charsets

Features and Benefits
What are charsets and unicode?
Samba and charsets
Conversion from old names
Japanese charsets

28. Samba Backup Techniques

Note
Features and Benefits

29. High Availability Options

Note

`Chapter 10. Samba / MS Windows Network Browsing Guide`

`John H. Terpstra`

Samba Team <jht@samba.org>

July 5, 1998

Updated: April 21, 2003

+

Table of Contents

10. Samba / MS Windows Network Browsing Guide

What is Browsing?

WINS - The Windows Internetworking Name Server

NetBIOS over TCP/IP
TCP/IP - without NetBIOS
DNS and Active Directory

How Browsing Functions

Setting up WORKGROUP Browsing
Setting up DOMAIN Browsing
Forcing Samba to be the master
Making Samba the domain master
Note about broadcast addresses
Multiple interfaces
Use of the Remote Announce parameter
Use of the Remote Browse Sync parameter

Setting up a WINS server
WINS Replication
Static WINS Entries

Helpful Hints

Windows Networking Protocols
Name Resolution Order

Technical Overview of browsing

Browsing support in Samba
Problem resolution
Browsing across subnets

How can one flush the Samba NetBIOS name cache without restarting Samba?
My client reports "This server is not configured to list shared resources"
I get an Unable to browse the network error

11. Account Information Databases

Backwards Compatibility Backends
New Backends

Technical Information

Important Notes About Security
Mapping User Identifiers between MS Windows and UNIX
Mapping Common UIDs/GIDs on Distributed Machines

Account Management Tools

The smbpasswd Command
The pdbedit Command

Password Backends

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon
Users being added to wrong backend database
auth methods does not work

12. Mapping MS Windows and UNIX Groups

Example Configuration

Configuration Scripts

Sample smb.conf add group script
Script to configure Group Mapping

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails
Adding Domain Users to the Power Users group

13. File, Directory and Share Access Controls

MS Windows Access Control Lists and UNIX Interoperability

File System Access Controls

MS Windows NTFS Comparison with UNIX File Systems
Managing Directories
File and Directory Access Control

Share Definition Access Controls

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

Access Controls on Shares

Share Permissions Management

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask + parameters
Interaction with the standard Samba file attribute mapping

Users can not write to a public share
I have set force user but Samba still makes root the owner of all the files I touch!
MS Word with Samba changes owner of file

14. File and Record Locking

MS Windows Opportunistic Locking and Caching Controls

Opportunistic Locking Overview

Samba Opportunistic Locking Control

Example Configuration

Workstation Service Entries
Server Service Entries

Persistent Data Corruption

locking.tdb error messages
Problems saving files in MS Office on Windows XP
Long delays deleting files over network with XP SP1

Additional Reading

15. Securing Samba

Technical Discussion of Protective Measures and Issues

Using host based protection
User based protection
Using interface protection
Using a firewall
Using a IPC$ share deny
NTLMv2 Security

Upgrading Samba

Smbclient works on localhost, but the network is dead
Why can users access home directories of other users?

16. Interdomain Trust Relationships

Native MS Windows NT4 Trusts Configuration

Trust Relationship Background

Creating an NT4 Domain Trust
Completing an NT4 Domain Trust
Inter-Domain Trust Facilities

Configuring Samba NT-style Domain Trusts

Samba as the Trusted Domain
Samba as the Trusting Domain

NT4-style Domain Trusts with Windows 2000

17. Hosting a Microsoft Distributed File System tree on Samba

Features and Benefits
Common Errors

18. Classical Printing Support

Extended Sample Configuration to Print

Technical Introduction

What happens if you send a Job from a Client
Printing Related Configuration Parameters
Parameters Recommended for Use

A simple Configuration to Print

Verification of "Settings in Use" with testparm
A little Experiment to warn you

Detailed Explanation of the Example's Settings

The [global] Section
The [printers] Section
Any [my_printer_name] Section
Print Commands
Default Print Commands for various UNIX Print Subsystems
Setting up your own Print Commands

Innovations in Samba Printing since 2.2

Client Drivers on Samba Server for Point'n'Print
The [printer$] Section is removed from Samba 3
Creating the [print$] Share
Parameters in the [print$] Section
Subdirectory Structure in [print$]

Installing Drivers into [print$]

Setting Drivers for existing Printers with a Client GUI
Setting Drivers for existing Printers with +rpcclient

Client Driver Install Procedure

The first Client Driver Installation
IMPORTANT! Setting Device Modes on new Printers
Further Client Driver Install Procedures
Always make first Client Connection as root or "printer admin"

Other Gotchas

Setting Default Print Options for the Client Drivers
Supporting large Numbers of Printers
Adding new Printers with the Windows NT APW
Weird Error Message Cannot connect under a +different Name
Be careful when assembling Driver Files
Samba and Printer Ports
Avoiding the most common Misconfigurations of the Client Driver

The Imprints Toolset

What is Imprints?
Creating Printer Driver Packages
The Imprints Server
The Installation Client

Add Network Printers at Logon without User Interaction

The addprinter command

Migration of "Classical" printing to Samba

Publishing Printer Information in Active Directory or LDAP

I give my root password but I don't get access
My printjobs get spooled into the spooling directory, but then get lost

19. CUPS Printing Support in Samba 3.0

Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download

Features and Benefits
Overview

Basic Configuration of CUPS support

Linking of smbd with libcups.so
Simple smb.conf Settings for CUPS
More complex smb.conf Settings for +CUPS

Advanced Configuration

Central spooling vs. "Peer-to-Peer" printing
CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
Driver Installation Methods on Windows Clients
Explicitly enable "raw" printing for +application/octet-stream!
Three familiar Methods for driver upload plus a new one

GDI on Windows -- PostScript on UNIX
Windows Drivers, GDI and EMF
UNIX Printfile Conversion and GUI Basics
PostScript and Ghostscript
Ghostscript -- the Software RIP for non-PostScript Printers
PostScript Printer Description (PPD) Specification
CUPS can use all Windows-formatted Vendor PPDs
CUPS also uses PPDs for non-PostScript Printers

The CUPS Filtering Architecture

MIME types and CUPS Filters
MIME type Conversion Rules
Filter Requirements
Prefilters
pstops
pstoraster
imagetops and imagetoraster
rasterto [printers specific]
CUPS Backends
cupsomatic/Foomatic -- how do they fit into the Picture?
The Complete Picture
mime.convs
"Raw" printing
"application/octet-stream" printing
PostScript Printer Descriptions (PPDs) for non-PS Printers
Difference between cupsomatic/foomatic-rip and +native CUPS printing
Examples for filtering Chains
Sources of CUPS drivers / PPDs
Printing with Interface Scripts

Network printing (purely Windows)

From Windows Clients to an NT Print Server
Driver Execution on the Client
Driver Execution on the Server

Network Printing (Windows clients -- UNIX/Samba Print +Servers)

From Windows Clients to a CUPS/Samba Print Server
Samba receiving Jobfiles and passing them to CUPS

Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs

PPDs for non-PS Printers on UNIX
PPDs for non-PS Printers on Windows

Windows Terminal Servers (WTS) as CUPS Clients

Printer Drivers running in "Kernel Mode" cause many +Problems
Workarounds impose Heavy Limitations
CUPS: a "Magical Stone"?
PostScript Drivers with no major problems -- even in Kernel +Mode

Setting up CUPS for driver Download

cupsaddsmb: the unknown Utility
Prepare your smb.conf for cupsaddsmb
CUPS Package of "PostScript Driver for WinNT/2k/XP"
Recognize the different Driver Files
Acquiring the Adobe Driver Files
ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
Caveats to be considered
Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
Run "cupsaddsmb" (quiet Mode)
Run "cupsaddsmb" with verbose Output
Understanding cupsaddsmb
How to recognize if cupsaddsmb completed successfully
cupsaddsmb with a Samba PDC
cupsaddsmb Flowchart
Installing the PostScript Driver on a Client
Avoiding critical PostScript Driver Settings on the +Client

Installing PostScript Driver Files manually (using +rpcclient)

A Check of the rpcclient man Page
Understanding the rpcclient man page
Producing an Example by querying a Windows Box
What is required for adddriver and setdriver to succeed
Manual Driver Installation in 15 Steps
Troubleshooting revisited

The printing *.tdb Files

Trivial DataBase Files
Binary Format
Losing *.tdb Files
Using tdbbackup

CUPS Print Drivers from Linuxprinting.org

foomatic-rip and Foomatic explained
foomatic-rip and Foomatic-PPD Download and Installation

Page Accounting with CUPS

Setting up Quotas
Correct and incorrect Accounting
Adobe and CUPS PostScript Drivers for Windows Clients
The page_log File Syntax
Possible Shortcomings
Future Developments
Other Accounting Tools

Additional Material

Auto-Deletion or Preservation of CUPS Spool Files

CUPS Configuration Settings explained
Pre-conditions
Manual Configuration

In Case of Trouble.....

Printing from CUPS to Windows attached +Printers

More CUPS filtering Chains

An Overview of the CUPS Printing Processes

Win9x client can't install driver
"cupsaddsmb" keeps asking for root password in + neverending loop
"cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present
Client can't connect to Samba printer
Can't reconnect to Samba under new account + from Win2K/XP
Avoid being connected to the Samba server as the + "wrong" user
Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems
Can't use "cupsaddsmb" on Samba server which is + a PDC
Deleted Win2K printer driver is still shown
Win2K/XP "Local Security + Policies"
WinXP clients: "Administrator can not install + printers for all local users"
"Print Change Notify" functions on + NT-clients
WinXP-SP1
Print options for all users can't be set on Win2K/XP
Most common blunders in driver + settings on Windows clients
cupsaddsmb does not work + with newly installed printer
Permissions on +/var/spool/samba/ get reset after each +reboot
Printer named "lp" +intermittently swallows jobs and spits out completely different +ones
Location of Adobe PostScript driver files necessary for "cupsaddsmb"

20. Stackable VFS modules

Included modules

audit
extd_audit
fake_perms
recycle
netatalk

VFS modules available elsewhere

DatabaseFS
vscan

21. Winbind: Use of Domain Accounts

What Winbind Provides

Target Uses

How Winbind Works

Microsoft Remote Procedure Calls
Microsoft Active Directory Services
Name Service Switch
Pluggable Authentication Modules
User and Group ID Allocation
Result Caching

Installation and Configuration

Introduction
Requirements
Testing Things Out

Conclusion

NSCD Problem Warning

22. Advanced Network Management

Remote Server Administration

Remote Desktop Management

Remote Management from NoMachines.Com

Network Logon Script Magic

Adding printers without user intervention

23. System and Account Policies

Creating and Managing System Policies

Windows 9x/Me Policies
Windows NT4 Style Policy Files
MS Windows 200x / XP Professional Policies

Managing Account/User Policies

Samba Editreg Toolset
Windows NT4/200x
Samba PDC

System Startup and Logon Processing Overview

Policy Does Not Work

24. Desktop Profile Management

Roaming Profiles

Samba Configuration for Profile Handling
Windows Client Profile Configuration Information
Sharing Profiles between W9x/Me and NT4/200x/XP workstations
Profile Migration from Windows NT4/200x Server to Samba

Mandatory profiles

Creating/Managing Group Profiles

Default Profile for Windows Users

MS Windows 9x/Me
MS Windows NT4 Workstation
MS Windows 200x/XP

Setting up roaming profiles for just a few user's or group's?
Can NOT use Roaming Profiles
Changing the default profile

25. PAM based Distributed Authentication

Technical Discussion

PAM Configuration Syntax
Example System Configurations
smb.conf PAM Configuration
Remote CIFS Authentication using winbindd.so
Password Synchronization using pam_smbpass.so

pam_winbind problem
Winbind is not resolving users and groups

26. Integrating MS Windows networks with Samba

Name Resolution in a pure UNIX/Linux world

Background Information

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

Name resolution as used within MS Windows networking

The NetBIOS Name Cache
The LMHOSTS file
HOSTS file
DNS Lookup
WINS Lookup

Pinging works only in one way
Very Slow Network Connections
Samba server name change problem

27. Unicode/Charsets

What are charsets and unicode?

Samba and charsets

Conversion from old names

Japanese charsets

Common errors

CP850.so can't be found

28. Samba Backup Techniques

Note
Features and Benefits

29. High Availability Options

Note

`Chapter 10. Samba / MS Windows Network Browsing Guide`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

July 5, 1998

Updated: April 21, 2003

Table of Contents

What is Browsing?

WINS - The Windows Internetworking Name Server

NetBIOS over TCP/IP
TCP/IP - without NetBIOS
DNS and Active Directory

How Browsing Functions

Setting up WORKGROUP Browsing
Setting up DOMAIN Browsing
Forcing Samba to be the master
Making Samba the domain master
Note about broadcast addresses
Multiple interfaces
Use of the Remote Announce parameter
Use of the Remote Browse Sync parameter

Setting up a WINS server
WINS Replication
Static WINS Entries

Helpful Hints

Windows Networking Protocols
Name Resolution Order

Technical Overview of browsing

Browsing support in Samba
Problem resolution
Browsing across subnets

How can one flush the Samba NetBIOS name cache without restarting Samba?
My client reports "This server is not configured to list shared resources"
I get an Unable to browse the network error

This document contains detailed information as well as a fast track guide to implementing browsing across subnets and / or across workgroups (or domains). WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is @@ -2275,11 +2153,11 @@ over TCP/IP. Samba-3 and later also supports this mode of operation. When the use of NetBIOS over TCP/IP has been disabled then the primary means for resolution of MS Windows machine names is via DNS and Active Directory. The following information assumes that your site is running NetBIOS over TCP/IP. -

`Features and Benefits`

+

`Features and Benefits`

Someone once referred to the past in terms of: They were the worst of times, they were the best of times. The more we look back, them more we long for what was and hope it never returns!. -

+

For many MS Windows network administrators, that statement sums up their feelings about NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle nature was just par for the course. For those who never quite managed to tame its @@ -2304,63 +2182,55 @@ help Samba to affect stable WINS operations beyond the normal scope of MS WINS. Please note that WINS is exclusively a service that applies only to those systems that run NetBIOS over TCP/IP. MS Windows 200x / XP have the capacity to turn off -support for NetBIOS, in which case WINS is of no relevance. Samba-3 supports this also. +support for NetBIOS, in which case WINS is of no relevance. Samba supports this also. For those networks on which NetBIOS has been disabled (ie: WINS is NOT required) the use of DNS is necessary for host name resolution. -

`What is Browsing?`

+

`What is Browsing?`

To most people browsing means that they can see the MS Windows and Samba servers in the Network Neighborhood, and when the computer icon for a particular server is clicked, it opens up and shows the shares and printers available on the target server.

What seems so simple is in fact a very complex interaction of different technologies. The technologies (or methods) employed in making all of this work includes: -

MS Windows machines register their presence to the network

Machines announce themselves to other machines on the network

One or more machine on the network collates the local announcements

The client machine finds the machine that has the collated list of machines

The client machine is able to resolve the machine names to IP addresses

The client machine is able to connect to a target machine

+

MS Windows machines register their presence to the network
Machines announce themselves to other machines on the network
One or more machine on the network collates the local announcements
The client machine finds the machine that has the collated list of machines
The client machine is able to resolve the machine names to IP addresses
The client machine is able to connect to a target machine

The Samba application that controls browse list management and name resolution is called nmbd. The configuration parameters involved in nmbd's operation are: -

-		
-	Browsing options:
-	-----------------
-		* os level
-		  lm announce
-		  lm interval
-		* preferred master
-		* local master
-		* domain master
-		  browse list
-		  enhanced browsing
-
-	Name Resolution Method:
-	-----------------------
-		* name resolve order
-
-	WINS options:
-	-------------
-		  dns proxy
-		  wins proxy
-		* wins server
-		* wins support
-		  wins hook
-

+

Browsing options: os level(*), + lm announce, + lm interval, + preferred master(*), + local master(*), + domain master(*), + browse list, + enhanced browsing. +

Name Resolution Method: + name resolve order(*). +

WINS options: + dns proxy, + wins proxy, + wins server(*), + wins support(*), + wins hook. +

For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with an '*' are the only options that commonly MAY need to be modified. Even if not one of these parameters is set nmbd will still do it's job. -

`Discussion`

+

`Discussion`

Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging. SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports NetBIOS over TCP/IP for backwards compatibility. Microsoft is intent on phasing out NetBIOS support. -

`NetBIOS over TCP/IP`

+

`NetBIOS over TCP/IP`

Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP. MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to affect browse list management. When running NetBIOS over TCP/IP, this uses UDP based messaging. UDP messages can be broadcast or unicast. -

+

Normally, only unicast UDP messaging can be forwarded by routers. The -remote announce parameter to smb.conf helps to project browse announcements +remote announce parameter to smb.conf helps to project browse announcements to remote network segments via unicast UDP. Similarly, the -remote browse sync parameter of smb.conf +remote browse sync parameter of smb.conf implements browse list collation using unicast UDP. Secondly, in those networks where Samba is the only SMB server technology, @@ -2368,12 +2238,13 @@ wherever possible nmbd should be configured on one (1) server. This makes it easy to manage the browsing environment. If each network segment is configured with it's own Samba WINS server, then the only way to get cross segment browsing to work is by using the -remote announce and the remote browse sync +remote announce and the remote browse sync parameters to your smb.conf file. + If only one WINS server is used for an entire multi-segment network then -the use of the remote announce and the -remote browse sync parameters should NOT be necessary. +the use of the remote announce and the +remote browse sync parameters should NOT be necessary. As of Samba 3 WINS replication is being worked on. The bulk of the code has been committed, but it still needs maturation. This is NOT a supported feature @@ -2384,7 +2255,7 @@ Right now Samba WINS does not support MS-WINS replication. This means that when setting up Samba as a WINS server there must only be one nmbd configured as a WINS server on the network. Some sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used -remote browse sync and remote announce +remote browse sync and remote announce to affect browse list collation across all segments. Note that this means clients will only resolve local names, and must be configured to use DNS to resolve names on other subnets in order to resolve the IP addresses of the servers they can see @@ -2395,7 +2266,10 @@ Lastly, take note that browse lists are a collection of unreliable broadcast messages that are repeated at intervals of not more than 15 minutes. This means that it will take time to establish a browse list and it can take up to 45 minutes to stabilise, particularly across network segments. -

`TCP/IP - without NetBIOS`

+

`TCP/IP - without NetBIOS`

+ + + All TCP/IP using systems use various forms of host name resolution. The primary methods for TCP/IP hostname resolutions involves either a static file (/etc/hosts ) or DNS (the Domain Name System). DNS is the technology that makes @@ -2418,7 +2292,7 @@ it follows a defined path:

Looks up entries in LMHOSTS. It is located in C:\WinNT\System32\Drivers\etc. -

+

Windows 200x / XP can register it's host name with a Dynamic DNS server. You can force register with a Dynamic DNS server in Windows 200x / XP using: ipconfig /registerdns @@ -2431,8 +2305,8 @@ consequently network services will be severely impaired. The use of Dynamic DNS is highly recommended with Active Directory, in which case the use of BIND9 is preferred for it's ability to adequately support the SRV (service) records that are needed for Active Directory. -

`DNS and Active Directory`

-Occasionally we hear from Unix network administrators who want to use a Unix based Dynamic +

`DNS and Active Directory`

+Occasionally we hear from UNIX network administrators who want to use a UNIX based Dynamic DNS server in place of the Microsoft DNS server. While this might be desirable to some, the MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible to use BIND version 8 or 9, but it will almost certainly be necessary to create service records @@ -2453,7 +2327,7 @@ The following are some of the default service records that Active Directory requ _ldap._tcp.Site.gc.ms-dcs.DomainTree Used by MS Windows clients to locate site configuration dependent Global Catalog server. -

`How Browsing Functions`

+

`How Browsing Functions`

MS Windows machines register their NetBIOS names (ie: the machine name for each service type in operation) on start up. The exact method by which this name registration @@ -2467,7 +2341,7 @@ resolution to the local subnet, unless LMHOSTS is used to list all names and IP addresses. In such situations Samba provides a means by which the Samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the -remote announce parameter). +remote announce parameter).

Where a WINS server is used, the MS Windows client will use UDP unicast to register with the WINS server. Such packets can be routed @@ -2495,20 +2369,18 @@ will annoy users because they will have to put up with protracted inability to use the network services.

Samba supports a feature that allows forced synchronisation -of browse lists across routed networks using the remote -browse sync parameter in the smb.conf file. +of browse lists across routed networks using the remote browse sync parameter in the smb.conf file. This causes Samba to contact the local master browser on a remote network and to request browse list synchronisation. This effectively bridges two networks that are separated by routers. The two remote networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the remote -browse sync parameter provides browse list synchronisation - and +based name resolution, but it should be noted that the remote browse sync parameter provides browse list synchronisation - and that is distinct from name to address resolution, in other words, for cross subnet browsing to function correctly it is essential that a name to address resolution mechanism be provided. This mechanism could be via DNS, /etc/hosts, and so on. -

`Setting up WORKGROUP Browsing`

+

`Setting up WORKGROUP Browsing`

To set up cross subnet browsing on a network containing machines in up to be in a WORKGROUP, not an NT Domain you need to set up one Samba server to be the Domain Master Browser (note that this is *NOT* @@ -2526,22 +2398,15 @@ Samba server, and there must only be one domain master browser per workgroup name. To set up a Samba server as a domain master browser, set the following option in the [global] section of the smb.conf file : -

-- domain master = yes - - -The domain master browser should also preferrably be the local master + + domain master = yes + +The domain master browser should also preferably be the local master browser for its own subnet. In order to achieve this set the following options in the [global] section of the smb.conf file : - -- domain master = yes - local master = yes - preferred master = yes - os level = 65 - - + + Example 10.1. Domain master browser smb.conf [global] domain master = yes local master = yes preferred master = yes os level = 65 + The domain master browser may be the same machine as the WINS server, if you require. @@ -2553,21 +2418,16 @@ tend to get rebooted more often, so it's not such a good idea to use these). To make a Samba server a local master browser set the following options in the [global] section of the smb.conf file : - -- domain master = no - local master = yes - preferred master = yes - os level = 65 - - + + Example 10.2. Local master browser smb.conf [global] domain master = no local master = yes preferred master = yes os level = 65 + Do not do this for more than one Samba server on each subnet, or they will war with each other over which is to be the local master browser. -The local master parameter allows Samba to act as a -local master browser. The preferred master causes nmbd -to force a browser election on startup and the os level +The local master parameter allows Samba to act as a +local master browser. The preferred master causes nmbd +to force a browser election on startup and the os level parameter sets Samba high enough so that it should win any browser elections. If you have an NT machine on the subnet that you wish to @@ -2575,14 +2435,9 @@ be the local master browser then you can disable Samba from becoming a local master browser by setting the following options in the [global] section of the smb.conf file : - -- domain master = no - local master = no - preferred master = no - os level = 0 - -

`Setting up DOMAIN Browsing`

+

Example 10.3. smb.conf for not being a master browser [global] domain master = no local master = no preferred master = no os level = 0

+

`Setting up DOMAIN Browsing`

If you are adding Samba servers to a Windows NT Domain then you must not set up a Samba server as a domain master browser. By default, a Windows NT Primary Domain Controller for a domain @@ -2594,18 +2449,13 @@ with WINS instead of the PDC. For subnets other than the one containing the Windows NT PDC you may set up Samba servers as local master browsers as described. To make a Samba server a local master browser set -the following options in the [global] section +the following options in the [global] section of the smb.conf file : -

-- domain master = no - local master = yes - preferred master = yes - os level = 65 - - + + Example 10.4. Local master browser smb.conf [global] domain master = no local master = yes preferred master = yes os level = 65 + If you wish to have a Samba server fight the election with machines -on the same subnet you may set the os level parameter +on the same subnet you may set the os level parameter to lower levels. By doing this you can tune the order of machines that will become local master browsers if they are running. For more details on this see the section @@ -2618,39 +2468,34 @@ you can disable Samba from taking part in browser elections and ever becoming a local master browser by setting following options in the [global] section of the smb.conf file : - -- domain master = no - local master = no - preferred master = no - os level = 0 - -

`Forcing Samba to be the master`

-Who becomes the master browser is determined by an election +

+

Example 10.5. smb.conf for not being a master browser [global] domain master = no local master = no preferred master = no os level = 0

+

`Forcing Samba to be the master`

+Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters which determine what precedence (bias) a host should have in the election. By default Samba uses a very low precedence and thus loses elections to just about anyone else.

-If you want Samba to win elections then just set the os level global +If you want Samba to win elections then just set the os level global option in smb.conf to a higher number. It defaults to 0. Using 34 would make it win all elections over every other system (except other samba systems!)

-A os level of 2 would make it beat WfWg and Win95, but not MS Windows +A os level of 2 would make it beat WfWg and Win95, but not MS Windows NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.

The maximum os level is 255

If you want Samba to force an election on startup, then set the -preferred master global option in smb.conf to yes. Samba will +preferred master global option in smb.conf to yes. Samba will then have a slight advantage over other potential master browsers that are not preferred master browsers. Use this parameter with care, as if you have two hosts (whether they are Windows 95 or NT or -Samba) on the same local subnet both set with preferred master to +Samba) on the same local subnet both set with preferred master to yes, then periodically and continually they will force an election in order to become the local master browser.

-If you want Samba to be a domain master browser, then it is -recommended that you also set preferred master to yes, because + If you want Samba to be a domain master browser, then it is +recommended that you also set preferred master to yes, because Samba will not become a domain master browser for the whole of your LAN or WAN if it is not also a local master browser on its own broadcast isolated subnet. @@ -2662,10 +2507,10 @@ attempt to become the domain master browser every 5 minutes. They will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should the current domain master browser fail. -

`Making Samba the domain master`

+

`Making Samba the domain master`

The domain master is responsible for collating the browse lists of multiple subnets so that browsing can occur between subnets. You can -make Samba act as the domain master by setting domain master = yes +make Samba act as the domain master by setting domain master = yes in smb.conf. By default it will not be a domain master.

Note that you should not set Samba to be the domain master for a @@ -2677,8 +2522,8 @@ master browsers on other subnets and then contact them to synchronise browse lists.

If you want Samba to be the domain master then I suggest you also set -the os level high enough to make sure it wins elections, and set -preferred master to yes, to get Samba to force an election on +the os level high enough to make sure it wins elections, and set +preferred master to yes, to get Samba to force an election on startup.

Note that all your servers (including Samba) and clients should be @@ -2704,31 +2549,31 @@ If, however, both Samba and your clients are using a WINS server, then: resolve the NetBIOS name of that host. as long as that host has registered its NetBIOS name with the same WINS server, the user will be able to see that host. -

`Note about broadcast addresses`

+

`Note about broadcast addresses`

If your network uses a "0" based broadcast address (for example if it ends in a 0) then you will strike problems. Windows for Workgroups does not seem to support a 0's broadcast and you will probably find that browsing and name lookups won't work. -

`Multiple interfaces`

+

`Multiple interfaces`

Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the interfaces +have multiple interfaces then you will need to use the interfaces option in smb.conf to configure them. -

`Use of the Remote Announce parameter`

-The remote announce parameter of +

`Use of the Remote Announce parameter`

+The remote announce parameter of smb.conf can be used to forcibly ensure that all the NetBIOS names on a network get announced to a remote network. -The syntax of the remote announce parameter is: -

-	remote announce = a.b.c.d [e.f.g.h] ...
-

+The syntax of the remote announce parameter is: + remote announce = a.b.c.d [e.f.g.h] ... or - - remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ... - + remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ... where: - a.b.c.d and -e.f.g.h is either the LMB (Local Master Browser) IP address + a.b.c.d and +e.f.g.h + + + + is either the LMB (Local Master Browser) IP address or the broadcast address of the remote network. ie: the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask @@ -2743,23 +2588,21 @@ workgroup name of the remote network then our NetBIOS machine names will end up looking like they belong to that workgroup, this may cause name resolution problems and should be avoided. - - Use of the Remote Browse Sync parameter -The remote browse sync parameter of + +

`Use of the Remote Browse Sync parameter`

+The remote browse sync parameter of smb.conf is used to announce to another LMB that it must synchronise its NetBIOS name list with our Samba LMB. It works ONLY if the Samba server that has this option is simultaneously the LMB on its network segment. -

-The syntax of the remote browse sync parameter is: + +The syntax of the remote browse sync parameter is: - -remote browse sync = a.b.c.d - + remote browse sync = a.b.c.d where a.b.c.d is either the IP address of the remote LMB or else is the network broadcast address of the remote segment. -

`WINS - The Windows Internetworking Name Server`

+

`WINS - The Windows Internetworking Name Server`

Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly recommended. Every NetBIOS machine registers its name together with a name_type value for each of several types of service it has available. @@ -2800,36 +2643,34 @@ lookup attempts by other clients and will therefore cause workstation access errors.

To configure Samba as a WINS server just add -wins support = yes to the smb.conf -file [globals] section. +wins support = yes to the smb.conf +file [global] section.

To configure Samba to register with a WINS server just add -wins server = a.b.c.d to your smb.conf file [globals] section. +wins server = a.b.c.d to your smb.conf file [global] section.

`Important`

-Never use both wins support = yes together -with wins server = a.b.c.d +Never use both wins support = yes together +with wins server = a.b.c.d particularly not using it's own IP address. Specifying both will cause nmbd to refuse to start! -

`Setting up a WINS server`

+

`Setting up a WINS server`

Either a Samba machine or a Windows NT Server machine may be set up as a WINS server. To set a Samba machine to be a WINS server you must add the following option to the smb.conf file on the selected machine : -in the [globals] section add the line -

-- wins support = yes - - +in the [global] section add the line + + wins support = yes + Versions of Samba prior to 1.9.17 had this parameter default to yes. If you have any older versions of Samba on your network it is strongly suggested you upgrade to a recent version, or at the very least set the parameter to 'no' on all these machines. -Machines with wins support = yes will keep a list of +Machines with wins support = yes will keep a list of all NetBIOS names registered with them, acting as a DNS for NetBIOS names. You should set up only ONE WINS server. Do NOT set the -wins support = yes option on more than one Samba +wins support = yes option on more than one Samba server. To set up a Windows NT Server as a WINS server you need to set up @@ -2841,7 +2682,7 @@ participate in these replications. It is possible in the future that a Samba->Samba WINS replication protocol may be defined, in which case more than one Samba machine could be set up as a WINS server but currently only one Samba server should have the -wins support = yes parameter set. +wins support = yes parameter set. After the WINS server has been configured you must ensure that all machines participating on the network are configured with the address @@ -2851,18 +2692,16 @@ the Control Panel->Network->Protocols->TCP->W in Windows 95 or Windows NT. To tell a Samba server the IP address of the WINS server add the following line to the [global] section of all smb.conf files : - -- wins server = <name or IP address> - - + + wins server = <name or IP address> + where <name or IP address> is either the DNS name of the WINS server machine or its IP address. Note that this line MUST NOT BE SET in the smb.conf file of the Samba server acting as the WINS server itself. If you set both the -wins support = yes option and the -wins server = <name> option then +wins support = yes option and the +wins server = <name> option then nmbd will fail to start. There are two possible scenarios for setting up cross subnet browsing. @@ -2870,45 +2709,45 @@ The first details setting up cross subnet browsing on a network containing Windows 95, Samba and Windows NT machines that are not configured as part of a Windows NT Domain. The second details setting up cross subnet browsing on networks that contain NT Domains. -

`WINS Replication`

+

`WINS Replication`

Samba-3 permits WINS replication through the use of the wrepld utility. This tool is not currently capable of being used as it is still in active development. As soon as this tool becomes moderately functional we will prepare man pages and enhance this section of the documentation to provide usage and technical details. -

`Static WINS Entries`

-Adding static entries to your Samba-3 WINS server is actually fairly easy. +

`Static WINS Entries`

+Adding static entries to your Samba WINS server is actually fairly easy. All you have to do is add a line to wins.dat, typically located in /usr/local/samba/var/locks. -

+ Entries in wins.dat take the form of - + "NAME#TYPE" TTL ADDRESS+ FLAGS - + where NAME is the NetBIOS name, TYPE is the NetBIOS type, TTL is the time-to-live as an absolute time in seconds, ADDRESS+ is one or more addresses corresponding to the registration and FLAGS are the NetBIOS flags for the registration. - + A typical dynamic entry looks like: - + "MADMAN#03" 1055298378 192.168.1.2 66R - + To make it static, all that has to be done is set the TTL to 0: - + "MADMAN#03" 0 192.168.1.2 66R - - + + Though this method works with early Samba-3 versions, there's a possibility that it may change in future versions if WINS replication is added. -

`Helpful Hints`

+

`Helpful Hints`

The following hints should be carefully considered as they are stumbling points for many new network administrators. -

`Windows Networking Protocols`

`Warning`

+

`Windows Networking Protocols`

`Warning`

Do NOT use more than one (1) protocol on MS Windows machines

A very common cause of browsing problems results from installing more than @@ -2938,34 +2777,27 @@ differently from MS Windows NT4. Generally, where a server does NOT support the newer or extended protocol, these will fall back to the NT4 protocols.

The safest rule of all to follow it this - USE ONLY ONE PROTOCOL! -

`Name Resolution Order`

+

`Name Resolution Order`

Resolution of NetBIOS names to IP addresses can take place using a number of methods. The only ones that can provide NetBIOS name_type information are: -

WINS: the best tool!

LMHOSTS: is static and hard to maintain.

Broadcast: uses UDP and can not resolve names across remote segments.

+

WINS: the best tool!
LMHOSTS: is static and hard to maintain.
Broadcast: uses UDP and can not resolve names across remote segments.

Alternative means of name resolution includes: -

/etc/hosts: is static, hard to maintain, and lacks name_type info

DNS: is a good choice but lacks essential name_type info.

+ /etc/hosts: is static, hard to maintain, and lacks name_type info DNS: is a good choice but lacks essential name_type info. Many sites want to restrict DNS lookups and want to avoid broadcast name -resolution traffic. The name resolve order parameter is -of great help here. The syntax of the name resolve order -parameter is: - -name resolve order = wins lmhosts bcast host - +resolution traffic. The name resolve order parameter is of great help here. +The syntax of the name resolve order parameter is: + name resolve order = wins lmhosts bcast host or - -name resolve order = wins lmhosts (eliminates bcast and host) - + name resolve order = wins lmhosts (eliminates bcast and host) The default is: - -name resolve order = host lmhost wins bcast - -where "host" refers the the native methods used by the Unix system + name resolve order = host lmhost wins bcast +where "host" refers to the native methods used by the UNIX system to implement the gethostbyname() function call. This is normally controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. -

`Technical Overview of browsing`

+

`Technical Overview of browsing`

SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called browse list. This list +of machines in a network, a so-called browse list. This list contains machines that are ready to offer file and/or print services to other machines within the network. Thus it does not include machines which aren't currently able to do server tasks. The browse @@ -2983,7 +2815,7 @@ Where NetBIOS over TCP/IP is enabled use of a WINS server is highly recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. WINS allows remote segment clients to obtain NetBIOS name_type information that can NOT be provided by any other means of name resolution. -

`Browsing support in Samba`

+

`Browsing support in Samba`

Samba facilitates browsing. The browsing is supported by nmbd and is also controlled by options in the smb.conf file. Samba can act as a local browse master for a workgroup and the ability @@ -3010,15 +2842,15 @@ WINS server capabilities. In a Samba-only environment, it is recommended that you use one and only one Samba server as your WINS server.

To get browsing to work you need to run nmbd as usual, but will need -to use the workgroup option in smb.conf +to use the workgroup option in smb.conf to control what workgroup Samba becomes a part of.

Samba also has a useful option for a Samba server to offer itself for browsing on another subnet. It is recommended that this option is only used for 'unusual' purposes: announcements over the internet, for -example. See remote announce in the +example. See remote announce in the smb.conf man page. -

`Problem resolution`

+

`Problem resolution`

If something doesn't work then hopefully the log.nmbd file will help you track down the problem. Try a debug level of 2 or 3 for finding problems. Also note that the current browse list usually gets stored @@ -3029,7 +2861,7 @@ type the server name as \\SERVER in filemanager then hit enter and filemanager should display the list of available shares.

Some people find browsing fails because they don't have the global -guest account set to a valid account. Remember that the +guest account set to a valid account. Remember that the IPC$ connection that lists the shares is done as guest, and thus you must have a valid guest account.

@@ -3043,7 +2875,7 @@ server resources. The other big problem people have is that their broadcast address, netmask or IP address is wrong (specified with the "interfaces" option in smb.conf) -

`Browsing across subnets`

+

`Browsing across subnets`

Since the release of Samba 1.9.17(alpha1), Samba has supported the replication of browse lists across subnet boundaries. This section describes how to set this feature up in different settings. @@ -3064,32 +2896,14 @@ be they Windows 95, Windows NT, or Samba servers must have the IP address of a WINS server given to them by a DHCP server, or by manual configuration (for Win95 and WinNT, this is in the TCP/IP Properties, under Network settings) for Samba this is in the smb.conf file. -

`How does cross subnet browsing work ?`

+

`How does cross subnet browsing work ?`

Cross subnet browsing is a complicated dance, containing multiple moving parts. It has taken Microsoft several years to get the code that achieves this correct, and Samba lags behind in some areas. Samba is capable of cross subnet browsing when configured correctly.

-Consider a network set up as follows : -

- -- (DMB) - N1_A N1_B N1_C N1_D N1_E - | | | | | - ------------------------------------------------------- - | subnet 1 | - +---+ +---+ - |R1 | Router 1 Router 2 |R2 | - +---+ +---+ - | | - | subnet 2 subnet 3 | - -------------------------- ------------------------------------ - | | | | | | | | - N2_A N2_B N2_C N2_D N3_A N3_B N3_C N3_D - (WINS) - - + Consider a network set up as in the diagram below. + Figure 10.1. Cross subnet browsing example Consisting of 3 subnets (1, 2, 3) connected by two routers (R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume @@ -3130,9 +2944,9 @@ called 'non-authoritative'. At this point the browse lists look as follows (these are the machines you would see in your network neighborhood if you looked in it on a particular network right now). - -Table 10.1. Browse subnet example 1 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E Subnet2 N2_B N2_A, N2_B, N2_C, N2_D Subnet3 N3_D N3_A, N3_B, N3_C, N3_D - + + Table 10.1. Browse subnet example 1 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E Subnet2 N2_B N2_A, N2_B, N2_C, N2_D Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + Note that at this point all the subnets are separate, no machine is seen across any of the subnets. @@ -3152,26 +2966,31 @@ names it knows about. Once the domain master browser receives the MasterAnnouncement packet it schedules a synchronization request to the sender of that packet. After both synchronizations are done the browse lists look like : - -Table 10.2. Browse subnet example 2 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + + Table 10.2. Browse subnet example 2 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D Servers with a (*) after them are non-authoritative names. - + At this point users looking in their network neighborhood on subnets 1 or 2 will see all the servers on both, users on subnet 3 will still only see the servers on their own subnet. -The same sequence of events that occured for N2_B now occurs +The same sequence of events that occurred for N2_B now occurs for the local master browser on subnet 3 (N3_D). When it synchronizes browse lists with the domain master browser (N1_A) it gets both the server entries on subnet 1, and those on subnet 2. After N3_D has synchronized with N1_C and vica-versa the browse lists look like. - -Table 10.3. Browse subnet example 3 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) + + Table 10.3. Browse subnet example 3 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) Servers with a (*) after them are non-authoritative names. - + At this point users looking in their network neighborhood on subnets 1 or 3 will see all the servers on all subnets, users on subnet 2 will still only see the servers on subnets 1 and 2, but not 3. @@ -3180,11 +2999,17 @@ Finally, the local master browser for subnet 2 (N2_B) will sync again with the domain master browser (N1_C) and will receive the missing server entries. Finally - and as a steady state (if no machines are removed or shut off) the browse lists will look like : - -Table 10.4. Browse subnet example 4 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) + + Table 10.4. Browse subnet example 4 Subnet Browse Master List Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), +N3_C(*), N3_D(*) Subnet2 N2_B N2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), +N3_C(*), N3_D(*) Subnet3 N3_D N3_A, N3_B, N3_C, N3_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), +N2_C(*), N2_D(*) Servers with a (*) after them are non-authoritative names. - + Synchronizations between the domain master browser and local master browsers will continue to occur, but this should be a steady state situation. @@ -3202,11 +3027,11 @@ If either router R1 or R2 fails the following will occur: be able to access servers on its local subnet, by using subnet-isolated broadcast NetBIOS name resolution. The effects are similar to that of losing access to a DNS server. -

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D

Subnet	Browse Master	List
Subnet1	N1_C	N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(), N2_B(), N2_C(), N2_D()
Subnet2	N2_B	N2_A, N2_B, N2_C, N2_D, N1_A(), N1_B(), N1_C(), N1_D(), N1_E(*)
Subnet3	N3_D	N3_A, N3_B, N3_C, N3_D

`Common Errors`

+

`Common Errors`

Many questions are asked on the mailing lists regarding browsing. The majority of browsing problems originate out of incorrect configuration of NetBIOS name resolution. Some are of particular note. -

`How can one flush the Samba NetBIOS name cache without restarting Samba?`

+

`How can one flush the Samba NetBIOS name cache without restarting Samba?`

Samba's nmbd process controls all browse list handling. Under normal circumstances it is safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear @@ -3216,33 +3041,37 @@ want to clear a rogue machine from the list then every machine on the network wi shut down and restarted at after all machines are down. Failing a complete restart, the only other thing you can do is wait until the entry times out and is then flushed from the list. This may take a long time on some networks (months). -

`My client reports "This server is not configured to list shared resources"`

+

`My client reports "This server is not configured to list shared resources"`

Your guest account is probably invalid for some reason. Samba uses the guest account for browsing in smbd. Check that your guest account is valid. -

See also guest account in the smb.conf man page.

`Chapter 11. Account Information Databases`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`Jeremy Allison`

Samba Team <jra@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

`Olivier (lem) Lemaire`

IDEALX <olem@IDEALX.org>

May 24, 2003

Table of Contents

Technical Information

Important Notes About Security
Mapping User Identifiers between MS Windows and Unix

Account Management Tools

The smbpasswd Command
The pdbedit Command

Password Backends

Plain Text
smbpasswd - Encrypted Password Database
tdbsam
ldapsam
MySQL
XML

Users can not logon - Users not in Samba SAM
Users are being added to the wrong backend database
auth methods does not work

-Samba-3 implements a new capability to work concurrently with multiple account backends. -The possible new combinations of password backends allows Samba-3 a degree of flexibility +

See also guest account in the smb.conf man page.

`I get an Unable to browse the network error`

This error can have multiple causes:

There is no local master browser. Configure nmbd + or any other machine to serve as local master browser.
You can not log onto the machine that is the local master + browser. Can you logon to it as guest user?
There is no IP connectivity to the local master browser. + Can you reach it by broadcast?

`Chapter 11. Account Information Databases`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`Jeremy Allison`

Samba Team <jra@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

`Olivier (lem) Lemaire`

IDEALX <olem@IDEALX.org>

May 24, 2003

+Samba 3 implements a new capability to work concurrently with multiple account backends. +The possible new combinations of password backends allows Samba 3 a degree of flexibility and scalability that previously could be achieved only with MS Windows Active Directory. This chapter describes the new functionality and how to get the most out of it.

In the course of development of Samba-3, a number of requests were received to provide the ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide -matching Unix/Linux accounts. We called this the Non Unix Accounts (NUA) +matching UNIX/Linux accounts. We called this the Non UNIX Accounts (NUA) capability. The intent was that an administrator could decide to use the tdbsam -backend and by simply specifying "passdb backend = tdbsam_nua, guest" -this would allow Samba-3 to implement a solution that did not use Unix accounts per se. Late +backend and by simply specifying passdb backend = tdbsam_nua +this would allow Samba-3 to implement a solution that did not use UNIX accounts per se. Late in the development cycle, the team doing this work hit upon some obstacles that prevents this solution from being used. Given the delays with Samba-3 release a decision was made to NOT deliver this functionality until a better method of recognising NT Group SIDs from NT User SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series.

`Note`

-Samba-3.0.0 does NOT support Non-Unix Account (NUA) operation. -

`Features and Benefits`

+Samba-3 does NOT support Non-UNIX Account (NUA) operation for user accounts. +Samba-3 does support NUA operation for machine accounts. +

`Features and Benefits`

Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality as follows: -

Backwards Compatibility Backends

Plain Text:

- This option uses nothing but the Unix/Linux /etc/passwd +

`Backwards Compatibility Backends`

Plain Text:: + This option uses nothing but the UNIX/Linux /etc/passwd style back end. On systems that have PAM (Pluggable Authentication Modules) support all PAM modules are supported. The behaviour is just as it was with Samba-2.2.x, and the protocol limitations imposed by MS Windows clients @@ -3264,13 +3093,9 @@ as follows: This option is provided primarily as a migration tool, although there is no reason to force migration at this time. Note that this tool will eventually be deprecated. -

+

`New Backends`

Samba-3 introduces the following new password backend capabilities: -

New Backends

guest:

- This is always required as the last backend specified. - It provides the ability to handle guest account requirements for access to - resources like IPC$ which is used for browsing. -

tdbsam:

+

tdbsam:: This backend provides a rich database backend for local servers. This backend is NOT suitable for multiple domain controller (ie: PDC + one or more BDC) installations. @@ -3312,10 +3137,7 @@ Samba-3 introduces the following new password backend capabilities: The xmlsam option can be useful for account migration between database backends or backups. Use of this tool will allow the data to be edited before migration into another backend format. -
nisplussam:: - The NIS+ based passdb backend. Takes name NIS domain as an - optional argument. Only works with Sun NIS+ servers. -

`Technical Information`

+

`Technical Information`

Old windows clients send plain text passwords over the wire. Samba can check these passwords by crypting them and comparing them to the hash stored in the unix user database.

@@ -3330,10 +3152,10 @@ Samba-3 introduces the following new password backend capabilities: In addition to differently encrypted passwords, windows also stores certain data for each user that is not stored in a unix user database. e.g: workstations the user may logon from, the location where the users' profile is stored, and so on. Samba retrieves and stores this - information using a passdb backend. Commonly available backends are LDAP, plain text + information using a passdb backend. Commonly available backends are LDAP, plain text file, MySQL and nisplus. For more information, see the man page for smb.conf regarding the - passdb backend parameter. -

`Important Notes About Security`

+ passdb backend parameter. +

Figure 11.1. IDMAP

`Important Notes About Security`

The unix and SMB password encryption techniques seem similar on the surface. This similarity is, however, only skin deep. The unix scheme typically sends clear text passwords over the network when logging in. This is bad. The SMB encryption scheme @@ -3357,12 +3179,12 @@ Samba-3 introduces the following new password backend capabilities:

The following versions of MS Windows do not support full domain security protocols, although they may log onto a domain environment: -

MS DOS Network client 3.0 with the basic network redirector installed

Windows 95 with the network redirector update installed

Windows 98 [se]

Windows Me

`Note`

+

MS DOS Network client 3.0 with the basic network redirector installed
Windows 95 with the network redirector update installed
Windows 98 [se]
Windows Me

`Note`

MS Windows XP Home does not have facilities to become a domain member and it can not participate in domain logons.

The following versions of MS Windows fully support domain security protocols. -

Windows NT 3.5x

Windows NT 4.0

Windows 2000 Professional

Windows 200x Server/Advanced Server

Windows XP Professional

+

Windows NT 3.5x
Windows NT 4.0
Windows 2000 Professional
Windows 200x Server/Advanced Server
Windows XP Professional

All current release of Microsoft SMB/CIFS clients support authentication via the SMB Challenge/Response mechanism described here. Enabling clear text authentication does not disable the ability of the client to participate in encrypted authentication. @@ -3375,7 +3197,7 @@ Samba-3 introduces the following new password backend capabilities: (broken) only the cached (encrypted) password will be sent to the resource server to affect a auto-reconnect. If the resource server does not support encrypted passwords the auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED. -

`Advantages of Encrypted Passwords`

Plain text passwords are not passed across +
Advantages of Encrypted Passwords
- Plain text passwords are not passed across the network. Someone using a network sniffer cannot just record passwords going to the SMB server.
- Plain text passwords are not stored anywhere in memory or on disk.
- WinNT doesn't like talking to a server @@ -3386,32 +3208,44 @@ Samba-3 introduces the following new password backend capabilities: only things you can do to stop this is to use SMB encryption.
- Encrypted password support allows automatic share (resource) reconnects.
- Encrypted passwords are essential for PDC/BDC - operation.
Advantages of non-encrypted passwords
- Plain text passwords are not kept + operation.
Advantages of non-encrypted passwords
- Plain text passwords are not kept on disk, and are NOT cached in memory.
- Uses same password file as other unix services such as login and ftp
- Use of other services (such as telnet and ftp) which send plain text passwords over the net, so sending them for SMB - isn't such a big deal.

`Mapping User Identifiers between MS Windows and Unix`

- Every operation in Unix/Linux requires a user identifier (UID), just as in + isn't such a big deal.

`Mapping User Identifiers between MS Windows and UNIX`

+ Every operation in UNIX/Linux requires a user identifier (UID), just as in MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides - two means for mapping an MS Windows user to a Unix/Linux UID. + two means for mapping an MS Windows user to a UNIX/Linux UID.

Firstly, all Samba SAM (Security Account Manager database) accounts require - a Unix/Linux UID that the account will map to. As users are added to the account - information database, Samba-3 will call the add user script - interface to add the account to the Samba host OS. In essence, all accounts in + a UNIX/Linux UID that the account will map to. As users are added to the account + information database, Samba will call the add user script + interface to add the account to the Samba host OS. In essence all accounts in the local SAM require a local user account.

- The second way to affect Windows SID to Unix UID mapping is via the + The second way to affect Windows SID to UNIX UID mapping is via the idmap uid, idmap gid parameters in smb.conf. Please refer to the man page for information about these parameters. These parameters are essential when mapping users from a remote SAM server. -

`Account Management Tools`

-Samba-3 provides two (2) tools for management of User and machine accounts. These tools are +

`Mapping Common UIDs/GIDs on Distributed Machines`

+ Samba-3 has a special facility that makes it possible to maintain identical UIDs and GIDs + on all servers in a distributed network. A distributed network is one where there exists + a PDC, one or more BDCs and/or one or more domain member servers. Why is this important? + This is important if files are being shared over more than one protocol (eg: NFS) and where + users are copying files across UNIX/Linux systems using tools such as rsync. +

+ The special facility is enabled using a parameter called idmap backend. + The default setting for this parameter is an empty string. Administrators should NOT set this + parameter except when an LDAP based passdb backend is in use. An example of use is: +

+

Example 11.1. [global] idmap backend = ldapsam://ldap-server.quenya.org:636

+

`Account Management Tools`

+Samba provides two (2) tools for management of User and machine accounts. These tools are called smbpasswd and pdbedit. A third tool is under development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will be announced in time for the Samba-3.0.1 release. -

`The smbpasswd Command`

+

`The smbpasswd Command`

The smbpasswd utility is a utility similar to the passwd or yppasswd programs. It maintains the two 32 byte password fields in the passdb backend. @@ -3425,20 +3259,20 @@ be announced in time for the Samba-3.0.1 release. if changing an NT Domain user's password).

smbpasswd can be used to: -

add user or machine accounts

delete user or machine accounts

enable user or machine accounts

disable user or machine accounts

set to NULL user passwords

manage interdomain trust accounts

+

add user or machine accounts
delete user or machine accounts
enable user or machine accounts
disable user or machine accounts
set to NULL user passwords
manage interdomain trust accounts

To run smbpasswd as a normal user just type: -

- - $ smbpasswd - Old SMB password: secret - + + +$ smbpasswd +Old SMB password: secret + For secret type old value here - or hit return if there was no old password - - New SMB Password: new secret - Repeat New SMB Password: new secret - - + +New SMB Password: new secret +Repeat New SMB Password: new secret + + If the old value does not match the current value stored for that user, or the two new values do not match each other, then the password will not be changed. @@ -3457,10 +3291,10 @@ be announced in time for the Samba-3.0.1 release. For more details on using smbpasswd refer to the man page (the definitive reference). -

`The pdbedit Command`

+

`The pdbedit Command`

pdbedit is a tool that can be used only by root. It is used to manage the passdb backend. pdbedit can be used to: -

add, remove or modify user accounts

listing user accounts

migrate user accounts

+

add, remove or modify user accounts
listing user accounts
migrate user accounts

The pdbedit tool is the only one that can manage the account security and policy settings. It is capable of all operations that smbpasswd can do as well as a super set of them. @@ -3472,50 +3306,60 @@ be announced in time for the Samba-3.0.1 release. The following is an example of the user account information that is stored in a tdbsam password backend. This listing was produced by running:

-		$ pdbedit -Lv met
-		Unix username:        met
-		NT username:
-		Account Flags:        [UX         ]
-		User SID:             S-1-5-21-1449123459-1407424037-3116680435-2004
-		Primary Group SID:    S-1-5-21-1449123459-1407424037-3116680435-1201
-		Full Name:            Melissa E Terpstra
-		Home Directory:       \\frodo\met\Win9Profile
-		HomeDir Drive:        H:
-		Logon Script:         scripts\logon.bat
-		Profile Path:         \\frodo\Profiles\met
-		Domain:               MIDEARTH
-		Account desc:
-		Workstations:         melbelle
-		Munged dial:
-		Logon time:           0
-		Logoff time:          Mon, 18 Jan 2038 20:14:07 GMT
-		Kickoff time:         Mon, 18 Jan 2038 20:14:07 GMT
-		Password last set:    Sat, 14 Dec 2002 14:37:03 GMT
-		Password can change:  Sat, 14 Dec 2002 14:37:03 GMT
-		Password must change: Mon, 18 Jan 2038 20:14:07 GMT
-

`Password Backends`

-Samba-3 offers the greatest flexibility in backend account database design of any SMB/CIFS server +$ pdbedit -Lv met +UNIX username: met +NT username: +Account Flags: [UX ] +User SID: S-1-5-21-1449123459-1407424037-3116680435-2004 +Primary Group SID: S-1-5-21-1449123459-1407424037-3116680435-1201 +Full Name: Melissa E Terpstra +Home Directory: \\frodo\met\Win9Profile +HomeDir Drive: H: +Logon Script: scripts\logon.bat +Profile Path: \\frodo\Profiles\met +Domain: MIDEARTH +Account desc: +Workstations: melbelle +Munged dial: +Logon time: 0 +Logoff time: Mon, 18 Jan 2038 20:14:07 GMT +Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT +Password last set: Sat, 14 Dec 2002 14:37:03 GMT +Password can change: Sat, 14 Dec 2002 14:37:03 GMT +Password must change: Mon, 18 Jan 2038 20:14:07 GMT +

+ The pdbedit tool allows migration of authentication (account) + databases from one backend to another. For example: To migrate accounts from an + old smbpasswd database to a tdbsam + backend: +

+ Set the passdb backend = tdbsam, smbpasswd. +
+ Execute: +
```
+root# pdbedit -i smbpassed -e tdbsam
+
```
+
+ Now remove the smbpasswd from the passdb backend + configuration in smb.conf. +

`Password Backends`

+Samba offers the greatest flexibility in backend account database design of any SMB/CIFS server technology available today. The flexibility is immediately obvious as one begins to explore this capability.

It is possible to specify not only multiple different password backends, but even multiple backends of the same type. For example, to use two different tdbsam databases: -

--[globals] - passdb backend = tdbsam:/etc/samba/passdb.tdb, \ - tdbsam:/etc/samba/old-passdb.tdb, guest - -Plain Text + + passdb backend = tdbsam:/etc/samba/passdb.tdb, tdbsam:/etc/samba/old-passdb.tdb + Plain Text Older versions of Samba retrieved user information from the unix user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd. When password encryption is disabled, no SMB specific data is stored at all. Instead all operations are conducted via the way that the Samba host OS will access its /etc/passwd database. eg: On Linux systems that is done via PAM. - smbpasswd - Encrypted Password Database - Traditionally, when configuring encrypt - passwords = yes in Samba's smb.conf file, user account + smbpasswd - Encrypted Password Database + Traditionally, when configuring encrypt passwords = yes in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account flags have been stored in the smbpasswd(5) file. There are several disadvantages to this approach for sites with very large numbers of users (counted @@ -3541,10 +3385,10 @@ backends of the same type. For example, to use two different tdbsam databases: is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the Samba CVS trees). - Samba-3 provides an enhanced set of passdb backends that overcome the deficiencies + Samba provides an enhanced set of passdb backends that overcome the deficiencies of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. Of these ldapsam will be of most interest to large corporate or enterprise sites. - tdbsam Samba can store user and machine account data in a "TDB" (Trivial Database). + tdbsam Samba can store user and machine account data in a "TDB" (Trivial Database). Using this backend doesn't require any additional configuration. This backend is recommended for new installations that do not require LDAP. @@ -3552,7 +3396,7 @@ backends of the same type. For example, to use two different tdbsam databases: that have 250 or more users. Additionally, tdbsam is not capable of scaling for use in sites that require PDB/BDC implementations that requires replication of the account database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. - ldapsam + ldapsam There are a few points to stress that the ldapsam does not provide. The LDAP support referred to in the this documentation does not include: A means of retrieving user account information from @@ -3575,30 +3419,32 @@ backends of the same type. For example, to use two different tdbsam databases: and has a working directory server already installed. For more information on LDAP architectures and Directories, please refer to the following sites. OpenLDAP - http://www.openldap.org/ iPlanet Directory Server - - http://iplanet.netscape.com/directory + http://iplanet.netscape.com/directory Two additional Samba resources which may prove to be helpful are The Samba-PDC-LDAP-HOWTO maintained by Ignacio Coupeau. The NT migration scripts from IDEALX that are geared to manage users and group in such a Samba-LDAP Domain Controller configuration. - Supported LDAP Servers + Supported LDAP Servers The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs. These should not be hard to fix. Please submit fixes via Bug reporting facility. - Schema and Relationship to the RFC 2307 posixAccount + Schema and Relationship to the RFC 2307 posixAccount Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: - --objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY - DESC 'Samba Auxiliary Account' - MUST ( uid $ rid ) - MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $ - logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $ - displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $ - description $ userWorkstations $ primaryGroupID $ domain )) - - + + +objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY + DESC 'Samba 3.0 Auxiliary SAM Account' + MUST ( uid $ sambaSID ) + MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ + sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ + sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ + displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ + sambaProfilePath $ description $ sambaUserWorkstations $ + sambaPrimaryGroupSID $ sambaDomainName )) + + The samba.schema file has been formatted for OpenLDAP 2.0/2.1. The OID's are owned by the Samba Team and as such is legal to be openly published. If you translate the schema to be used with Netscape DS, please @@ -3620,23 +3466,23 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure. - OpenLDAP configuration + OpenLDAP configuration To include support for the sambaSamAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory. The samba.schema file can be found in the directory examples/LDAP in the samba source distribution. - -+ + root# cp samba.schema /etc/openldap/schema/ - - + + Next, include the samba.schema file in slapd.conf. The sambaSamAccount object contains two attributes which depend upon other schema files. The 'uid' attribute is defined in cosine.schema and the 'displayName' attribute is defined in the inetorgperson.schema file. Both of these must be included before the samba.schema file. - -+ + ## /etc/openldap/slapd.conf ## schema files (core.schema is required by default) @@ -3648,13 +3494,13 @@ include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/nis.schema .... - - + + It is recommended that you maintain some indices on some of the most useful attributes, like in the following example, to speed up searches made on sambaSamAccount objectclasses (and possibly posixAccount and posixGroup as well). - -+ + # Indices to maintain ## required by OpenLDAP index objectclass eq @@ -3676,132 +3522,101 @@ index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub - - + + Create the new index by executing: - --./sbin/slapindex -f slapd.conf - - + + +root# ./sbin/slapindex -f slapd.conf + + Remember to restart slapd after making these changes: - -+ + root# /etc/init.d/slapd restart - - Initialise the LDAP database + + Initialise the LDAP database Before you can add accounts to the LDAP database you must create the account containers that they will be stored in. The following LDIF file should be modified to match your needs (ie: Your DNS entries, etc.). - -+ + # Organization for Samba Base -dn: dc=plainjoe,dc=org +dn: dc=quenya,dc=org objectclass: dcObject objectclass: organization -dc: plainjoe -o: Terpstra Org Network +dc: quenya +o: Quenya Org Network description: The Samba-3 Network LDAP Example # Organizational Role for Directory Management -dn: cn=Manager,dc=plainjoe,dc=org +dn: cn=Manager,dc=quenya,dc=org objectclass: organizationalRole cn: Manager description: Directory Manager # Setting up container for users -dn: ou=People,dc=plainjoe,dc=org +dn: ou=People,dc=quenya,dc=org objectclass: top objectclass: organizationalUnit ou: People # Setting up admin handle for People OU -dn: cn=admin,ou=People,dc=plainjoe,dc=org +dn: cn=admin,ou=People,dc=quenya,dc=org cn: admin objectclass: top objectclass: organizationalRole objectclass: simpleSecurityObject userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz - - + + The userPassword shown above should be generated using slappasswd. The following command will then load the contents of the LDIF file into the LDAP database. - -+ + $ slapadd -v -l initldap.dif - - + + Do not forget to secure your LDAP server with an adequate access control list, as well as an admin password. - Note + Note Before Samba can access the LDAP server you need to store the LDAP admin password into the Samba-3 secrets.tdb database by: - -root# smbpasswd -w secret - - Configuring Samba + +root# smbpasswd -w secret + + Configuring Samba The following parameters are available in smb.conf only if your version of samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found. - passdb backend = ldapsam:url ldap ssl ldap admin dn ldap suffix ldap filter ldap machine suffix ldap user suffix ldap delete dn ldap passwd sync ldap trust ids + LDAP related smb.conf options: + passdb backend = ldapsam:url, + ldap ssl, + ldap admin dn, + ldap suffix, + ldap filter, + ldap machine suffix, + ldap user suffix, + ldap delete dn, + ldap passwd sync, + ldap trust ids. + These are described in the smb.conf man page and so will not be repeated here. However, a sample smb.conf file for use with an LDAP directory could appear as - --## /usr/local/samba/lib/smb.conf -[global] - security = user - encrypt passwords = yes - - netbios name = TASHTEGO - workgroup = NARNIA - - # ldap related parameters - - # define the DN to use when binding to the directory servers - # The password for this DN is not stored in smb.conf. Rather it - # must be set by using 'smbpasswd -w secretpw' to store the - # passphrase in the secrets.tdb file. If the "ldap admin dn" values - # change, this password will need to be reset. - ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org" - - # Define the SSL option when connecting to the directory - # ('off', 'start tls', or 'on' (default)) - ldap ssl = start tls - - # syntax: passdb backend = ldapsam:ldap://server-name[:port] - passdb backend = ldapsam:ldap://funball.samba.org, guest - - # smbpasswd -x delete the entire dn-entry - ldap delete dn = no - - # the machine and user suffix added to the base suffix - # wrote WITHOUT quotes. NULL suffixes by default - ldap user suffix = ou=People - ldap machine suffix = ou=Systems - - # Trust unix account information in LDAP - # (see the smb.conf manpage for details) - ldap trust ids = Yes - - # specify the base DN to use when searching the directory - ldap suffix = "ou=people,dc=samba,dc=org" - - # generally the default ldap search filter is ok - # ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))" - - Accounts and Groups management + + Example 11.2. Configuration with LDAP [global] security = user encrypt passwords = yes netbios name = TASHTEGO workgroup = NARNIA # ldap related parameters # define the DN to use when binding to the directory servers # The password for this DN is not stored in smb.conf. Rather it # must be set by using 'smbpasswd -w secretpw' to store the # passphrase in the secrets.tdb file. If the "ldap admin dn" values # change, this password will need to be reset. ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org" # Define the SSL option when connecting to the directory # ('off', 'start tls', or 'on' (default)) ldap ssl = start tls # syntax: passdb backend = ldapsam:ldap://server-name[:port] passdb backend = ldapsam:ldap://funball.samba.org # smbpasswd -x delete the entire dn-entry ldap delete dn = no # the machine and user suffix added to the base suffix # wrote WITHOUT quotes. NULL suffixes by default ldap user suffix = ou=People ldap machine suffix = ou=Systems # Trust unix account information in LDAP # (see the smb.conf manpage for details) ldap trust ids = Yes # specify the base DN to use when searching the directory ldap suffix = "ou=people,dc=samba,dc=org" # generally the default ldap search filter is ok ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))" + Accounts and Groups management As users accounts are managed through the sambaSamAccount objectclass, you should modify your existing administration tools to deal with sambaSamAccount attributes. Machines accounts are managed with the sambaSamAccount objectclass, just like users accounts. However, it's up to you to store those accounts in a different tree of your LDAP namespace: you should use - "ou=Groups,dc=plainjoe,dc=org" to store groups and - "ou=People,dc=plainjoe,dc=org" to store users. Just configure your + "ou=Groups,dc=quenya,dc=org" to store groups and + "ou=People,dc=quenya,dc=org" to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration file). @@ -3809,7 +3624,7 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz groups. This means that Samba makes use of the posixGroup objectclass. For now, there is no NT-like group system management (global and local groups). - Security and sambaSamAccount + Security and sambaSamAccount There are two important points to remember when discussing the security of sambaSamAccount entries in the directory. Never retrieve the lmPassword or @@ -3820,13 +3635,13 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz on the details of LM/NT password hashes, refer to the Account Information Database section of this chapter. - To remedy the first security issue, the ldap ssl smb.conf parameter defaults - to require an encrypted session (ldap ssl = on) using + To remedy the first security issue, the ldap ssl smb.conf parameter defaults + to require an encrypted session (ldap ssl = on) using the default port of 636 when contacting the directory server. When using an OpenLDAP server, it is possible to use the use the StartTLS LDAP extended operation in the place of LDAPS. In either case, you are strongly discouraged to disable this security - (ldap ssl = off). + (ldap ssl = off). Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS extended operation. However, the OpenLDAP library still provides support for @@ -3835,88 +3650,87 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz The second security precaution is to prevent non-administrative users from harvesting password hashes from the directory. This can be done using the following ACL in slapd.conf: - -+ + ## allow the "ldap admin dn" access, but deny everyone else access to attrs=lmPassword,ntPassword - by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write + by dn="cn=Samba Admin,ou=people,dc=quenya,dc=org" write by * none - - LDAP special attributes for sambaSamAccounts + + LDAP special attributes for sambaSamAccounts The sambaSamAccount objectclass is composed of the following attributes: - - Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP) lmPassword the LANMAN password 16-byte hash stored as a character - representation of a hexadecimal string. ntPassword the NT password hash 16-byte stored as a character - representation of a hexadecimal string. pwdLastSet The integer time in seconds since 1970 when the - lmPassword and ntPassword attributes were last set. - acctFlags string of 11 characters surrounded by square brackets [] + + Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP) sambaLMPassword the LANMAN password 16-byte hash stored as a character +representation of a hexadecimal string. sambaNTPassword the NT password hash 16-byte stored as a character + representation of a hexadecimal string. sambaPwdLastSet The integer time in seconds since 1970 when the + sambaLMPassword and sambaNTPassword attributes were last set. + sambaAcctFlags string of 11 characters surrounded by square brackets [] representing account flags such as U (user), W(workstation), X(no password expiration), I(Domain trust account), H(Home dir required), S(Server trust account), - and D(disabled). logonTime Integer value currently unused logoffTime Integer value currently unused kickoffTime Integer value currently unused pwdCanChange Integer value currently unused pwdMustChange Integer value currently unused homeDrive specifies the drive letter to which to map the - UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" + and D(disabled). sambaLogonTime Integer value currently unused sambaLogoffTime Integer value currently unused sambaKickoffTime Integer value currently unused sambaPwdCanChange Integer value currently unused sambaPwdMustChange Integer value currently unused sambaHomeDrive specifies the drive letter to which to map the + UNC path specified by sambaHomePath. The drive letter must be specified in the form "X:" where X is the letter of the drive to map. Refer to the "logon drive" parameter in the - smb.conf(5) man page for more information. scriptPath The scriptPath property specifies the path of + smb.conf(5) man page for more information. sambaLogonScript The sambaLogonScript property specifies the path of the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path - is relative to the netlogon share. Refer to the "logon script" parameter in the - smb.conf(5) man page for more information. profilePath specifies a path to the user's profile. + is relative to the netlogon share. Refer to the logon script parameter in the + smb.conf man page for more information. sambaProfilePath specifies a path to the user's profile. This value can be a null string, a local absolute path, or a UNC path. Refer to the - "logon path" parameter in the smb.conf(5) man page for more information. smbHome The homeDirectory property specifies the path of - the home directory for the user. The string can be null. If homeDrive is set and specifies - a drive letter, homeDirectory should be a UNC path. The path must be a network - UNC path of the form \\server\share\directory. This value can be a null string. - Refer to the logon home parameter in the smb.conf man page for more information. - userWorkstation character string value currently unused. - rid the integer representation of the user's relative identifier - (RID). primaryGroupID the relative identifier (RID) of the primary group - of the user. domain domain the user is part of. - + logon path parameter in the smb.conf man page for more information. sambaHomePath The sambaHomePath property specifies the path of +the home directory for the user. The string can be null. If sambaHomeDrive is set and specifies +a drive letter, sambaHomePath should be a UNC path. The path must be a network +UNC path of the form \\server\share\directory. This value can be a null string. +Refer to the logon home parameter in the smb.conf man page for more information. + sambaUserWorkstations character string value currently unused. + sambaSID The security identifier(SID) of the user. The windows equivalent of unix uid's. sambaPrimaryGroupSID the relative identifier (RID) of the primary group + of the user. sambaDomainName domain the user is part of. + The majority of these parameters are only used when Samba is acting as a PDC of a domain (refer to the Samba as a primary domain controller chapter for details on how to configure Samba as a Primary Domain Controller). The following four attributes are only stored with the sambaSamAccount entry if the values are non-default values: - smbHome scriptPath logonPath homeDrive + sambaHomePath sambaLogonScript sambaProfilePath sambaHomeDrive These attributes are only stored with the sambaSamAccount entry if the values are non-default values. For example, assume TASHTEGO has now been - configured as a PDC and that logon home = \\%L\%u was defined in + configured as a PDC and that logon home = \\%L\%u was defined in its smb.conf file. When a user named "becky" logons to the domain, - the logon home string is expanded to \\TASHTEGO\becky. + the logon home string is expanded to \\TASHTEGO\becky. If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", this value is used. However, if this attribute does not exist, then the value - of the logon home parameter is used in its place. Samba + of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is something other than the default (e.g. \\MOBY\becky). - Example LDIF Entries for a sambaSamAccount + Example LDIF Entries for a sambaSamAccount The following is a working LDIF with the inclusion of the posixAccount objectclass: - - - dn: uid=guest2, ou=people,dc=plainjoe,dc=org - ntPassword: 878D8014606CDA29677A44EFA1353FC7 - pwdMustChange: 2147483647 - primaryGroupID: 1201 - lmPassword: 552902031BEDE9EFAAD3B435B51404EE - pwdLastSet: 1010179124 - logonTime: 0 + + + dn: uid=guest2, ou=people,dc=quenya,dc=org + sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7 + sambaPwdMustChange: 2147483647 + sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-513 + sambaNTPassword: 552902031BEDE9EFAAD3B435B51404EE + sambaPwdLastSet: 1010179124 + sambaLogonTime: 0 objectClass: sambaSamAccount uid: guest2 - kickoffTime: 2147483647 - acctFlags: [UX ] - logoffTime: 2147483647 - rid: 19006 - pwdCanChange: 0 - - + sambaKickoffTime: 2147483647 + sambaAcctFlags: [UX ] + sambaLogoffTime: 2147483647 + sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5006 + sambaPwdCanChange: 0 + + The following is an LDIF entry for using both the sambaSamAccount and posixAccount objectclasses: - - - dn: uid=gcarter, ou=people,dc=plainjoe,dc=org - logonTime: 0 + + + dn: uid=gcarter, ou=people,dc=quenya,dc=org + sambaLogonTime: 0 displayName: Gerald Carter - lmPassword: 552902031BEDE9EFAAD3B435B51404EE - primaryGroupID: 1201 + sambaLMPassword: 552902031BEDE9EFAAD3B435B51404EE + sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-1201 objectClass: posixAccount objectClass: sambaSamAccount - acctFlags: [UX ] + sambaAcctFlags: [UX ] userPassword: {crypt}BpM2ej8Rkzogo uid: gcarter uidNumber: 9000 @@ -3924,60 +3738,59 @@ access to attrs=lmPassword,ntPassword loginShell: /bin/bash logoffTime: 2147483647 gidNumber: 100 - kickoffTime: 2147483647 - pwdLastSet: 1010179230 - rid: 19000 + sambaKickoffTime: 2147483647 + sambaPwdLastSet: 1010179230 + sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5004 homeDirectory: /home/tashtego/gcarter - pwdCanChange: 0 - pwdMustChange: 2147483647 - ntPassword: 878D8014606CDA29677A44EFA1353FC7 - - Password synchronisation + sambaPwdCanChange: 0 + sambaPwdMustChange: 2147483647 + sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7 + + Password synchronisation Since version 3.0 samba can update the non-samba (LDAP) password stored with an account. When using pam_ldap, this allows changing both unix and windows passwords at once. - The ldap passwd sync options can have the following values: yes When the user changes his password, update + The ldap passwd sync options can have the following values: yes When the user changes his password, update ntPassword, lmPassword - and the password fields. no Only update ntPassword and lmPassword. only Only update the LDAP password and let the LDAP server worry - about the other fields. This option is only available when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD. More information can be found in the smb.conf manpage. - MySQL + and the password fields. no Only update ntPassword and lmPassword. only Only update the LDAP password and let the LDAP server worry about the other fields. This option is only available on some LDAP servers. ^[3] More information can be found in the smb.conf manpage. + MySQL Every so often someone will come along with a great new idea. Storing of user accounts in an SQL backend is one of them. Those who want to do this are in the best position to know what the specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt to document every nitty little detail why certain things of marginal utility to the bulk of Samba users might make sense to the rest. In any case, the following instructions should help the determined SQL user to implement a working system. - Creating the database + Creating the database You either can set up your own table and specify the field names to pdb_mysql (see below for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump contains the correct queries to create the required tables. Use the command : - $ mysql -uusername -hhostname -ppassword \ -databasename < /path/to/samba/examples/pdb/mysql/mysql.dump - Configuring This plugin lacks some good documentation, but here is some short info: Add a the following to the passdb backend variable in your smb.conf: - - passdb backend = [other-plugins] mysql:identifier [other-plugins] - - The identifier can be any string you like, as long as it doesn't collide with + +$ mysql -uusername -hhostname -ppassword \ +databasename < /path/to/samba/examples/pdb/mysql/mysql.dump + + Configuring This plugin lacks some good documentation, but here is some short info: Add a the following to the passdb backend variable in your smb.conf: + passdb backend = [other-plugins] mysql:identifier [other-plugins] + The identifier can be any string you like, as long as it doesn't collide with the identifiers of other plugins or other instances of pdb_mysql. If you - specify multiple pdb_mysql.so entries in passdb backend, you also need to + specify multiple pdb_mysql.so entries in passdb backend, you also need to use different identifiers! Additional options can be given through the smb.conf file in the [global] section. - - Table 11.2. Basic smb.conf options for MySQL passdb backend Field Contents identifier:mysql host host name, defaults to 'localhost' identifier:mysql password identifier:mysql user defaults to 'samba' identifier:mysql database defaults to 'samba' identifier:mysql port defaults to 3306 identifier:table Name of the table containing users - Warning + + Table 11.2. Basic smb.conf options for MySQL passdb backend Field Contents mysql host host name, defaults to 'localhost' mysql password mysql user defaults to 'samba' mysql database defaults to 'samba' mysql port defaults to 3306 table Name of the table containing users + Warning Since the password for the MySQL user is stored in the - smb.conf file, you should make the the smb.conf file + smb.conf file, you should make the smb.conf file readable only to the user that runs Samba This is considered a security bug and will be fixed soon. - Names of the columns in this table (I've added column types those columns should have first): - Table 11.3. MySQL field names for MySQL passdb backend Field Type Contents identifier:logon time column int(9) identifier:logoff time column int(9) identifier:kickoff time column int(9) identifier:pass last set time column int(9) identifier:pass can change time column int(9) identifier:pass must change time column int(9) identifier:username column varchar(255) unix username identifier:domain column varchar(255) NT domain user is part of identifier:nt username column varchar(255) NT username identifier:fullname column varchar(255) Full name of user identifier:home dir column varchar(255) Unix homedir path identifier:dir drive column varchar(2) Directory drive path (eg: 'H:') identifier:logon script column varchar(255) Batch file to run on client side when logging on identifier:profile path column varchar(255) Path of profile identifier:acct desc column varchar(255) Some ASCII NT user data identifier:workstations column varchar(255) Workstations user can logon to (or NULL for all) identifier:unknown string column varchar(255) unknown string identifier:munged dial column varchar(255) ? identifier:user sid column varchar(255) NT user SID identifier:group sid column varchar(255) NT group ID identifier:lanman pass column varchar(255) encrypted lanman password identifier:nt pass column varchar(255) encrypted nt passwd identifier:plain pass column varchar(255) plaintext password identifier:acct control column int(9) nt user data identifier:unknown 3 column int(9) unknown identifier:logon divs column int(9) ? identifier:hours len column int(9) ? identifier:unknown 5 column int(9) unknown identifier:unknown 6 column int(9) unknown - + Names of the columns in this table (I've added column types those columns should have first): + Table 11.3. MySQL field names for MySQL passdb backend Field Type Contents logon time column int(9) logoff time column int(9) kickoff time column int(9) pass last set time column int(9) pass can change time column int(9) pass must change time column int(9) username column varchar(255) unix username domain column varchar(255) NT domain user is part of nt username column varchar(255) NT username fullname column varchar(255) Full name of user home dir column varchar(255) UNIX homedir path dir drive column varchar(2) Directory drive path (eg: 'H:') logon script column varchar(255) Batch file to run on client side when logging on profile path column varchar(255) Path of profile acct desc column varchar(255) Some ASCII NT user data workstations column varchar(255) Workstations user can logon to (or NULL for all) unknown string column varchar(255) unknown string munged dial column varchar(255) ? user sid column varchar(255) NT user SID group sid column varchar(255) NT group ID lanman pass column varchar(255) encrypted lanman password nt pass column varchar(255) encrypted nt passwd plain pass column varchar(255) plaintext password acct control column int(9) nt user data unknown 3 column int(9) unknown logon divs column int(9) ? hours len column int(9) ? unknown 5 column int(9) unknown unknown 6 column int(9) unknown + Eventually, you can put a colon (:) after the name of each column, which should specify the column to update when updating the table. You can also specify nothing behind the colon - then the data from the field will not be updated. - Using plaintext passwords or encrypted password + Using plaintext passwords or encrypted password I strongly discourage the use of plaintext passwords, however, you can use them: If you would like to use plaintext passwords, set @@ -3987,7 +3800,7 @@ access to attrs=lmPassword,ntPassword If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default. - Getting non-column data from the table + Getting non-column data from the table It is possible to have not all data in the database and making some 'constant'. For example, you can set 'identifier:fullname column' to : @@ -4002,75 +3815,68 @@ access to attrs=lmPassword,ntPassword To import data, use: $ pdbedit -i xml:filename - Common Errors Users can not logon - Users not in Samba SAM - People forget to put their users in their backend and then complain Samba won't authorize them. - Users are being added to the wrong backend database + Common Errors Users can not logon “I've installed samba, but now I can't log on with my unix account!” Make sure your user has been added to the current samba passdb backend. Read the section Account Management Tools for details. Users being added to wrong backend database A few complaints have been received from users that just moved to Samba-3. The following smb.conf file entries were causing problems, new accounts were being added to the old smbpasswd file, not to the tdbsam passdb.tdb file: - - - [globals] - ... - passdb backend = smbpasswd, tdbsam, guest - ... - - + + [global] ... passdb backend = smbpasswd, tdbsam ... + Samba will add new accounts to the first entry in the passdb backend parameter entry. If you want to update to the tdbsam, then change the entry to: - - - [globals] - ... - passdb backend = tdbsam, smbpasswd, guest - ... - - auth methods does not work - If you explicitly set an 'auth methods' parameter, guest must be specified as the first - entry on the line. Eg: auth methods = guest sam. - This is the exact opposite of the requirement for the passdb backed + [globals] ... passdb backend = tdbsam, smbpasswd ... + auth methods does not work + If you explicitly set an auth methods parameter, guest must be specified as the first + entry on the line. Eg: auth methods = guest sam. + + This is the exact opposite of the requirement for the passdb backend option, where it must be the LAST parameter on the line. - Chapter 12. Mapping MS Windows and Unix Groups Jean François Micouleau Gerald (Jerry) Carter Samba Team <jerry@samba.org> John H. Terpstra Samba Team <jht@samba.org> Table of Contents Features and Benefits Discussion Example Configuration Configuration Scripts Sample smb.conf add group script Script to configure Group Mapping Common Errors Adding Groups Fails Adding MS Windows Groups to MS Windows Groups Fails + ^[3]Only when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD

`Chapter 12. Mapping MS Windows and UNIX Groups`

`Jean François Micouleau`

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Configuration Scripts

Discussion

Example Configuration

Sample smb.conf add group script
Script to configure Group Mapping

Adding Groups Fails
Adding MS Windows Groups to MS Windows Groups Fails
Adding Domain Users to the Power Users group

Starting with Samba-3, new group mapping functionality is available to create associations - between Windows group SIDs and UNIX groups. The groupmap subcommand + between Windows group SIDs and UNIX groups. The groupmap subcommand included with the net tool can be used to manage these associations. Warning The first immediate reason to use the group mapping on a Samba PDC, is that + the domain admin group has been removed and should no longer be specified in smb.conf. This parameter was used to give the listed users membership in the Domain Admins Windows group which gave local admin rights on their workstations (in default configurations). - Features and Benefits + Features and Benefits Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to - arbitrarily associate them with Unix/Linux group accounts. - - Group accounts can be managed using the MS Windows NT4 or MS Windows 200x MMC tools - so long as appropriate interface scripts have been provided to smb.conf. - + arbitrarily associate them with UNIX/Linux group accounts. + + Group accounts can be managed using the MS Windows NT4 or MS Windows 200x / XP Professional MMC tools. + Appropriate interface scripts should be provided in smb.conf if it is desired that UNIX / Linux system + accounts should be automatically created when these tools are used. In the absence of these scripts, and + so long as winbind is running, Samba accounts group accounts that are created using these tools will be + allocated UNIX UIDs/GIDs from the parameters set by the idmap uid/idmap gid settings + in the smb.conf file. + Figure 12.1. IDMAP groups Administrators should be aware that where smb.conf group interface scripts make - direct calls to the Unix/Linux system tools (eg: the shadow utilities, groupadd, - groupdel, groupmod) then the resulting Unix/Linux group names will be subject + direct calls to the UNIX/Linux system tools (eg: the shadow utilities, groupadd, + groupdel, groupmod) then the resulting UNIX/Linux group names will be subject to any limits imposed by these tools. If the tool does NOT allow upper case characters or space characters, then the creation of an MS Windows NT4 / 200x style group of - Engineering Managers will attempt to create an identically named - Unix/Linux group, an attempt that will of course fail! - + Engineering Managers will attempt to create an identically named + UNIX/Linux group, an attempt that will of course fail! + There are several possible work-arounds for the operating system tools limitation. One - method is to use a script that generates a name for the Unix/Linux system group that - fits the operating system limits, and that then just passes the Unix/Linux group id (GID) + method is to use a script that generates a name for the UNIX/Linux system group that + fits the operating system limits, and that then just passes the UNIX/Linux group id (GID) back to the calling Samba interface. This will provide a dynamic work-around solution. - Another work-around is to manually create a Unix/Linux group, then manually create the + Another work-around is to manually create a UNIX/Linux group, then manually create the MS Windows NT4 / 200x group on the Samba server and then use the net groupmap tool to connect the two to each other. - Discussion + Discussion When installing MS Windows NT4 / 200x on a computer, the installation program creates default users and groups, notably the Administrators group, and gives that group privileges necessary privileges to perform essential system tasks. eg: Ability to change the date and time or to kill (or close) any process running on the local machine. - + The 'Administrator' user is a member of the 'Administrators' group, and thus inherits 'Administrators' group privileges. If a 'joe' user is created to be a member of the 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'. @@ -4083,58 +3889,58 @@ access to attrs=lmPassword,ntPassword The following steps describe how to make Samba PDC users members of the 'Domain Admins' group? create a unix group (usually in /etc/group), let's call it domadm - add to this group the users that must be Administrators. For example + add to this group the users that must be Administrators. For example if you want joe, john and mary, your entry in /etc/group will look like: domadm:x:502:joe,john,mary - - + + Map this domadm group to the "Domain Admins" group by running the command: - - - root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm - - - The quotes around "Domain Admins" are necessary due to the space in the group name. + + +root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm + + + The quotes around "Domain Admins" are necessary due to the space in the group name. Also make sure to leave no whitespace surrounding the equal character (=). Now joe, john and mary are domain administrators! - + It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as making any UNIX group a Windows domain group. For example, if you wanted to include a UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, you would flag that group as a domain group by running the following on the Samba PDC: - - - root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct - - + + +root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct + + Be aware that the RID parameter is a unsigned 32 bit integer that should normally start at 1000. However, this rid must not overlap with any RID assigned - to a user. Verifying this is done differently depending on on the passdb backend + to a user. Verifying this is done differently depending on the passdb backend you are using. Future versions of the tools may perform the verification automatically, but for now the burden is on you. - Example Configuration + Example Configuration You can list the various groups in the mapping database by executing net groupmap list. Here is an example: - - - root# net groupmap list - System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin - Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin - Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser - Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest - - + + +root# net groupmap list +System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin +Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin +Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser +Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest + + For complete details on net groupmap, refer to the net(8) man page. - Configuration Scripts + Configuration Scripts Everyone needs tools. Some of us like to create our own, others prefer to use canned tools (ie: prepared by someone else for general use). - Sample smb.conf add group script - A script to great complying group names for use by the Samba group interfaces: - -Example 12.1. smbgrpadd.sh + Sample smb.conf add group script + A script to create complying group names for use by the Samba group interfaces: + + Example 12.1. smbgrpadd.sh #!/bin/bash @@ -4150,17 +3956,15 @@ cat /etc/group.bak | sed s/smbtmpgrp00/$1/g > /etc/group # Now return the GID as would normally happen. echo $thegid exit 0 - - + + The smb.conf entry for the above script would look like: - - add group script = /path_to_tool/smbgrpadd.sh %g - - Script to configure Group Mapping - In our example we have created a Unix/Linux group called ntadmin. - Our script will create the additional groups Engineers, Marketoids, Gnomes: - -+ add group script = /path_to_tool/smbgrpadd.sh %g + Script to configure Group Mapping + In our example we have created a UNIX/Linux group called ntadmin. + Our script will create the additional groups Orks, Elves, Gnomes: + + #!/bin/bash net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin @@ -4176,58 +3980,70 @@ net groupmap modify ntgroup="Print Operators" unixgroup=lp net groupmap modify ntgroup="Replicators" unixgroup=daemon net groupmap modify ntgroup="Power Users" unixgroup=sys -#groupadd Engineers -#groupadd Marketoids -#groupadd Gnomes +groupadd Orks +groupadd Elves +groupadd Gnomes -#net groupmap add ntgroup="Engineers" unixgroup=Engineers type=d -#net groupmap add ntgroup="Marketoids" unixgroup=Marketoids type=d -#net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d - - +net groupmap add ntgroup="Orks" unixgroup=Orks type=d +net groupmap add ntgroup="Elves" unixgroup=Elves type=d +net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d + + Of course it is expected that the administrator will modify this to suit local needs. For information regarding the use of the net groupmap tool please refer to the man page. - Common Errors +

`Common Errors`

At this time there are many little surprises for the unwary administrator. In a real sense it is imperative that every step of automated control scripts must be carefully tested manually before putting them into active service. -

`Adding Groups Fails`

+

`Adding Groups Fails`

This is a common problem when the groupadd is called directly - by the Samba interface script for the add group script in + by the Samba interface script for the add group script in the smb.conf file.

The most common cause of failure is an attempt to add an MS Windows group account that has either an upper case character and/or a space character in it.

There are three possible work-arounds. Firstly, use only group names that comply - with the limitations of the Unix/Linux groupadd system tool. + with the limitations of the UNIX/Linux groupadd system tool. The second involves use of the script mentioned earlier in this chapter, and the - third option is to manually create a Unix/Linux group account that can substitute + third option is to manually create a UNIX/Linux group account that can substitute for the MS Windows group name, then use the procedure listed above to map that group to the MS Windows group. -

`Adding MS Windows Groups to MS Windows Groups Fails`

+

`Adding MS Windows Groups to MS Windows Groups Fails`

Samba-3 does NOT support nested groups from the MS Windows control environment. -

`Chapter 13. File, Directory and Share Access Controls`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Jeremy Allison`

Samba Team <jra@samba.org>

May 10, 2003

Table of Contents

File System Access Controls

MS Windows NTFS Comparison with Unix File Systems
Managing Directories
File and Directory Access Control

Share Definition Access Controls

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

Access Controls on Shares

Share Permissions Management

MS Windows Access Control Lists and Unix Interoperability

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask - parameters
Interaction with the standard Samba file attribute - mapping

Users can not write to a public share
I have set force user and Samba still makes root the owner of all the files - I touch!

+

`Adding Domain Users to the Power Users group`

“ + What must I do to add Domain Users to the Power Users group? + ”

+ The Power Users group is a group that is local to each Windows + 200x / XP Professional workstation. You can not add the Domain Users group to the Power Users + group automatically, this must be done on each workstation by logging in as the local workstation + administrator and then using click on Start / Control Panel / Users and Passwords + now click on the 'Advanced' tab, then on the 'Advanced' Button. +

+ Now click on 'Groups', then double click on 'Power Users'. This will launch the panel to add users + or groups to the local machine 'Power Uses' group. Click on the 'Add' button, select the domain + from which the 'Domain Users' group is to be added, double click on the 'Domain Users' group, then + click on the 'Ok' button. Note: If a logon box is presented during this process please remember to + enter the connect as DOMAIN\UserName. ie: For the domain MIDEARTH and the user 'root' enter + MIDEARTH\root. +

`Chapter 13. File, Directory and Share Access Controls`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Jeremy Allison`

Samba Team <jra@samba.org>

`Jelmer R. Vernooij`

drawingThe Samba Team <jelmer@samba.org>

May 10, 2003

Table of Contents

File System Access Controls

MS Windows NTFS Comparison with UNIX File Systems
Managing Directories
File and Directory Access Control

Share Definition Access Controls

User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls

Access Controls on Shares

Share Permissions Management

MS Windows Access Control Lists and UNIX Interoperability

Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask + parameters
Interaction with the standard Samba file attribute mapping

Users can not write to a public share
I have set force user but Samba still makes root the owner of all the files I touch!
MS Word with Samba changes owner of file

Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network -administrators are often confused regarding network access controls and what is the best way to -provide users with the type of access they need while protecting resources from the consequences -of untoward access capabilities. +administrators are often confused regarding network access controls and how to +provide users with the access they need while protecting resources from unauthorised access. -Unix administrators frequently are not familiar with the MS Windows environment and in particular +Many UNIX administrators are unfamiliar with the MS Windows environment and in particular have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file and directory access permissions. The problem lies in the differences in how file and directory permissions and controls work between the two environments. This difference is one that Samba can not completely hide, even -though it does try to make the chasm transparent. - +though it does try to bridge the chasm to a degree. + POSIX Access Control List technology has been available (along with Extended Attributes) -for Unix for many years, yet there is little evidence today of any significant use. This +for UNIX for many years, yet there is little evidence today of any significant use. This explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows administrators are astounded at this given that ACLs were a foundational capability of the now decade old MS Windows NT operating system. @@ -4236,25 +4052,24 @@ The purpose of this chapter is to present each of the points of control that are Samba-3 in the hope that this will help the network administrator to find the optimum method for delivering the best environment for MS Windows desktop users. -This is an opportune point to mention that it should be borne in mind that Samba was created to -provide a means of interoperability and interchange of data between two operating environments -that are quite different. It was never the intent to make Unix/Linux like MS Windows NT. Instead -the purpose was an is to provide a sufficient level of exchange of data between the two environments. -What is available today extends well beyond early plans and expectations, yet the gap continues to -shrink. - Features and Benefits +This is an opportune point to mention that Samba was created to provide a means of interoperability +and interchange of data between differing operating environments. Samba has no intent change +UNIX/Linux into a platform like MS Windows. Instead the purpose was and is to provide a sufficient +level of exchange of data between the two environments. What is available today extends well +beyond early plans and expectations, yet the gap continues to shrink. + Features and Benefits Samba offers a lot of flexibility in file system access management. These are the key access control facilities present in Samba today: Samba Access Control Facilities - Unix File and Directory Permissions + UNIX File and Directory Permissions - Samba honours and implements Unix file system access controls. Users + Samba honours and implements UNIX file system access controls. Users who access a Samba server will do so as a particular MS Windows user. This information is passed to the Samba server as part of the logon or connection setup process. Samba uses this user identity to validate whether or not the user should be given access to file system resources (files and directories). This chapter provides an overview for those - to whom the Unix permissions and controls are a little strange or unknown. + to whom the UNIX permissions and controls are a little strange or unknown. Samba Share Definitions @@ -4273,22 +4088,22 @@ shrink. easiest ways to affect access controls (restrictions) and can often do so with minimum invasiveness compared with other methods. - MS Windows ACLs through Unix POSIX ACLs + MS Windows ACLs through UNIX POSIX ACLs - The use of POSIX ACLs on Unix/Linux is possible ONLY if the underlying + The use of POSIX ACLs on UNIX/Linux is possible ONLY if the underlying operating system supports them. If not, then this option will not be - available to you. Current Unix technology platforms have native support + available to you. Current UNIX technology platforms have native support for POSIX ACLs. There are patches for the Linux kernel that provide this also. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information for users of platforms that support them. - File System Access Controls + File System Access Controls Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP -implement a totally divergent file system technology from what is provided in the Unix operating system +implement a totally divergent file system technology from what is provided in the UNIX operating system environment. Firstly we should consider what the most significant differences are, then we shall look at how Samba helps to bridge the differences. - MS Windows NTFS Comparison with Unix File Systems - Samba operates on top of the Unix file system. This means it is subject to Unix file system conventions + MS Windows NTFS Comparison with UNIX File Systems + Samba operates on top of the UNIX file system. This means it is subject to UNIX file system conventions and permissions. It also means that if the MS Windows networking environment requires file system behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating that in a transparent and consistent manner. @@ -4298,128 +4113,108 @@ at how Samba helps to bridge the differences. but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore to depths of control ability should review the smb.conf man page. File System Feature Comparison Name Space - MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, Unix file names + MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, UNIX file names may be 1023 characters long. In MS Windows file extensions indicate particular file types, - in Unix this is not so rigorously observed as all names are considered arbitrary. + in UNIX this is not so rigorously observed as all names are considered arbitrary. - What MS Windows calls a Folder, Unix calls a directory, + What MS Windows calls a Folder, UNIX calls a directory. Case Sensitivity - MS Windows file names are generally Upper Case if made up of 8.3 (ie: 8 character file name + + MS Windows file names are generally upper case if made up of 8.3 (ie: 8 character file name and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case Insensitive. - Unix file and directory names are Case Sensitive and Case Preserving. Samba implements the - MS Windows file name behaviour, but it does so as a user application. The Unix file system + UNIX file and directory names are case sensitive and case preserving. Samba implements the + MS Windows file name behaviour, but it does so as a user application. The UNIX file system provides no mechanism to perform case insensitive file name lookups. MS Windows does this by default. This means that Samba has to carry the processing overhead to provide features - that are NOT native to the Unix operating system environment. + that are NOT native to the UNIX operating system environment. - Consider the following, all are unique Unix names but one single MS Windows file name: + Consider the following, all are unique UNIX names but one single MS Windows file name: MYFILE.TXT MyFile.txt myfile.txt - So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in Unix + So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in UNIX they can. So what should Samba do if all three are present? Answer, the one that is lexically first will be accessible to MS Windows users, the others are invisible and unaccessible - any other solution would be suicidal. Directory Separators - MS Windows and DOS uses the back-slash '\' as a directory delimiter, Unix uses the forward-slash '/' + MS Windows and DOS uses the back-slash '\' as a directory delimiter, UNIX uses the forward-slash '/' as it's directory delimiter. This is transparently handled by Samba. Drive Identification MS Windows products support a notion of drive letters, like C: to represent - disk partitions. Unix has NO concept if separate identifiers for file partitions since each + disk partitions. UNIX has NO concept if separate identifiers for file partitions since each such file system is mounted to become part of the over-all directory tree. - The Unix directory tree begins at '/', just like the root of a DOS drive is specified like + The UNIX directory tree begins at '/', just like the root of a DOS drive is specified like C:\. File Naming Conventions - MS Windows generally never experiences file names that begin with a '.', while in Unix these + MS Windows generally never experiences file names that begin with a '.', while in UNIX these are commonly found in a user's home directory. Files that begin with a '.' are typically - either start up files for various Unix applications, or they may be files that contain + either start up files for various UNIX applications, or they may be files that contain start-up configuration data. Links and Short-Cuts + + + + MS Windows make use of "links and Short-Cuts" that are actually special types of files that will - redirect an attempt to execute the file to the real location of the file. Unix knows of file and directory + redirect an attempt to execute the file to the real location of the file. UNIX knows of file and directory links, but they are entirely different from what MS Windows users are used to. - Symbolic links are files in Unix that contain the actual location of the data (file OR directory). An + Symbolic links are files in UNIX that contain the actual location of the data (file OR directory). An operation (like read or write) will operate directly on the file referenced. Symbolic links are also referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows one physical file to be known simultaneously by more than one file name. There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort - in the process of becoming familiar with Unix/Linux. These are best left for a text that is dedicated to the - purpose of Unix/Linux training/education. - Managing Directories + in the process of becoming familiar with UNIX/Linux. These are best left for a text that is dedicated to the + purpose of UNIX/Linux training/education. + Managing Directories There are three basic operations for managing directories, create, delete, rename. - Table 13.1. Managing directories with unix and windows Action MS Windows Command Unix Command create md folder mkdir folder delete rd folder rmdir folder rename rename oldname newname mv oldname newname - File and Directory Access Control + Table 13.1. Managing directories with unix and windows Action MS Windows Command UNIX Command create md folder mkdir folder delete rd folder rmdir folder rename rename oldname newname mv oldname newname + File and Directory Access Control The network administrator is strongly advised to read foundational training manuals and reference materials - regarding file and directory permissions maintenance. Much can be achieved with the basic Unix permissions + regarding file and directory permissions maintenance. Much can be achieved with the basic UNIX permissions without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended Attributes (EAs). - - Unix/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. - A Unix file listing looks as follows:- - - - jht@frodo:~/stuff> ls -la - total 632 - drwxr-xr-x 13 jht users 816 2003-05-12 22:56 . - drwxr-xr-x 37 jht users 3800 2003-05-12 22:29 .. - d--------- 2 jht users 48 2003-05-12 22:29 muchado00 - d--x--x--x 2 jht users 48 2003-05-12 22:29 muchado01 - dr-xr-xr-x 2 jht users 48 2003-05-12 22:29 muchado02 - drwxrwxrwx 2 jht users 48 2003-05-12 22:29 muchado03 - drw-rw-rw- 2 jht users 48 2003-05-12 22:29 muchado04 - d-w--w--w- 2 jht users 48 2003-05-12 22:29 muchado05 - dr--r--r-- 2 jht users 48 2003-05-12 22:29 muchado06 - drwxrwxrwt 2 jht users 48 2003-05-12 22:29 muchado07 - drwsrwsrwx 2 jht users 48 2003-05-12 22:29 muchado08 - ---------- 1 jht users 1242 2003-05-12 22:31 mydata00.lst - ---x--x--x 1 jht users 1674 2003-05-12 22:33 mydata01.lst - --w--w--w- 1 jht users 7754 2003-05-12 22:33 mydata02.lst - --wx-wx-wx 1 jht users 260179 2003-05-12 22:33 mydata03.lst - -r--r--r-- 1 jht users 21017 2003-05-12 22:32 mydata04.lst - -r-xr-xr-x 1 jht users 206339 2003-05-12 22:32 mydata05.lst - -rw-rw-rw- 1 jht users 41105 2003-05-12 22:32 mydata06.lst - -rwxrwxrwx 1 jht users 19312 2003-05-12 22:32 mydata07.lst - jht@frodo:~/stuff> - - - The columns above represent (from left to right): permissions, no blocks used, owner, group, size (bytes), access date, access time, file name. - - The permissions field is made up of: + + UNIX/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. + A UNIX file listing looks as follows:- - - JRV: Put this into a diagram of some sort - [ type ] [ users ] [ group ] [ others ] [File, Directory Permissions] - [ d | l ] [ r w x ] [ r w x ] [ r w x ] - | | | | | | | | | | | - | | | | | | | | | | |-----> Can Execute, List files - | | | | | | | | | |-------> Can Write, Create files - | | | | | | | | |---------> Can Read, Read files - | | | | | | | |---------------> Can Execute, List files - | | | | | | |-----------------> Can Write, Create files - | | | | | |-------------------> Can Read, Read files - | | | | |-------------------------> Can Execute, List files - | | | |---------------------------> Can Write, Create files - | | |-----------------------------> Can Read, Read files - | |-----------------------------------> Is a symbolic Link - |---------------------------------------> Is a directory - - + +$ ls -la +total 632 +drwxr-xr-x 13 maryo gnomes 816 2003-05-12 22:56 . +drwxrwxr-x 37 maryo gnomes 3800 2003-05-12 22:29 .. +dr-xr-xr-x 2 maryo gnomes 48 2003-05-12 22:29 muchado02 +drwxrwxrwx 2 maryo gnomes 48 2003-05-12 22:29 muchado03 +drw-rw-rw- 2 maryo gnomes 48 2003-05-12 22:29 muchado04 +d-w--w--w- 2 maryo gnomes 48 2003-05-12 22:29 muchado05 +dr--r--r-- 2 maryo gnomes 48 2003-05-12 22:29 muchado06 +drwsrwsrwx 2 maryo gnomes 48 2003-05-12 22:29 muchado08 +---------- 1 maryo gnomes 1242 2003-05-12 22:31 mydata00.lst +--w--w--w- 1 maryo gnomes 7754 2003-05-12 22:33 mydata02.lst +-r--r--r-- 1 maryo gnomes 21017 2003-05-12 22:32 mydata04.lst +-rw-rw-rw- 1 maryo gnomes 41105 2003-05-12 22:32 mydata06.lst +$ + + + The columns above represent (from left to right): permissions, number of hard links to file, owner, group, size (bytes), access date, access time, file name. + + An overview of the permissions field can be found in the image below. + Figure 13.1. Overview of unix permissions field Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character. - Example 13.1. Example File + Example 13.1. Example File -rwxr-x--- Means: The owner (user) can read, write, execute the group can read and execute everyone else can NOT do anything with it - + - - Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket. + + Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = UNIX Domain Socket. The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x), execute only if the file is a directory or already has execute permission for some user (X), set user or group ID on execution (s), @@ -4438,101 +4233,101 @@ at how Samba helps to bridge the differences. the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then group members will be able to write to (or delete) them. - Share Definition Access Controls + Share Definition Access Controls The following parameters in the smb.conf file sections that define a share control or affect access controls. Before using any of the following options please refer to the man page for smb.conf. - User and Group Based Controls + User and Group Based Controls User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all - file system operations as if a single user is doing this, the use of the force user and - force group behaviour will achieve this. In other situations it may be necessary to affect a + file system operations as if a single user is doing this, the use of the force user and + force group behaviour will achieve this. In other situations it may be necessary to affect a paranoia level of control to ensure that only particular authorised persons will be able to access a share or - it's contents, here the use of the valid users or the invalid users may + it's contents, here the use of the valid users or the invalid users may be most useful. As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for controlling access. Remember, that when you leave the scene someone else will need to provide assistance and if that person finds too great a mess, or if they do not understand what you have done then there is risk of Samba being removed and an alternative solution being adopted. - Table 13.2. User and Group Based Controls Control Parameter Description - Action - Notes admin users + Table 13.2. User and Group Based Controls Control Parameter Description - Action - Notes admin users List of users who will be granted administrative privileges on the share. They will do all file operations as the super-user (root). Any user in this list will be able to do anything they like on the share, irrespective of file permissions. - force group + force group Specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service. - force user + force user Specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. This is useful for sharing files. Incorrect use can cause security problems. - guest ok + guest ok If this parameter is set for a service, then no password is required to connect to the service. Privileges will be those of the guest account. - invalid users + invalid users List of users that should not be allowed to login to this service. - only user + only user Controls whether connections with usernames not in the user list will be allowed. - read list + read list List of users that are given read-only access to a service. Users in this list will not be given write access, no matter what the read only option is set to. - username + username Refer to the smb.conf man page for more information - this is a complex and potentially misused parameter. - valid users + valid users List of users that should be allowed to login to this service. - write list + write list List of users that are given read-write access to a service. - File and Directory Permissions Based Controls + File and Directory Permissions Based Controls The following file and directory permission based controls, if misused, can result in considerable difficulty to diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually re-introduce them in a controlled fashion. - Table 13.3. File and Directory Permission Based Controls Control Parameter Description - Action - Notes create mask + Table 13.3. File and Directory Permission Based Controls Control Parameter Description - Action - Notes create mask Refer to the smb.conf man page. - directory mask + directory mask The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. See also: directory security mask. - dos filemode + dos filemode Enabling this parameter allows a user who has write access to the file to modify the permissions on it. - force create mode + force create mode This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba. - force directory mode + force directory mode This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba. - force directory security mode + force directory security mode Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory - force security mode + force security mode Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. - hide unreadable + hide unreadable Prevents clients from seeing the existence of files that cannot be read. - hide unwriteable files + hide unwriteable files Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. - nt acl support + nt acl support This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. - security mask + security mask Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. - Miscellaneous Controls - The following are documented because of the prevalence of administrators creating inadvertant barriers to file + Miscellaneous Controls + The following are documented because of the prevalence of administrators creating inadvertent barriers to file access by not understanding the full implications of smb.conf file settings. - Table 13.4. Other Controls Control Parameter Description - Action - Notes case sensitive, default case, short preserve case + Table 13.4. Other Controls Control Parameter Description - Action - Notes case sensitive, default case, short preserve case This means that all file name lookup will be done in a case sensitive manner. Files will be created with the precise filename Samba received from the MS Windows client. - csc policy + csc policy Client Side Caching Policy - parallels MS Windows client side file caching capabilities. - dont descend + dont descend Allows to specify a comma-delimited list of directories that the server should always show as empty. - dos filetime resolution + dos filetime resolution This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. - dos filetimes + dos filetimes DOS and Windows allows users to change file time stamps if they can write to the file. POSIX semantics prevent this. This options allows DOS and Windows behaviour. - fake oplocks + fake oplocks Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an oplock then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. - hide dot files, hide files, veto files + hide dot files, hide files, veto files Note: MS Windows Explorer allows over-ride of files marked as hidden so they will still be visible. - read only + read only If this parameter is yes, then users of a service may not create or modify files in the service's directory. - veto files + veto files List of files and directories that are neither visible nor accessible. - Access Controls on Shares + Access Controls on Shares This section deals with how to configure Samba per share access control restrictions. By default, Samba sets no restrictions on the share itself. Restrictions on the share itself can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can @@ -4549,9 +4344,9 @@ Before using any of the following options please refer to the man page for /usr/local/samba/var. If the tdbdump utility has been compiled and installed on your system, then you can examine the contents of this file by: tdbdump share_info.tdb. - Share Permissions Management + Share Permissions Management The best tool for the task is platform dependant. Choose the best tool for your environment. - Windows NT4 Workstation/Server + Windows NT4 Workstation/Server The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. @@ -4561,9 +4356,9 @@ Before using any of the following options please refer to the man page for Now click on the share that you wish to manage, then click on the Properties tab, next click on the Permissions tab. Now you can add or change access control settings as you wish. - Windows 200x/XP + Windows 200x/XP On MS Windows NT4/200x/XP system access control lists on the share itself are set using native - tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, + tools, usually from file manager. For example, in Windows 200x: right click on the shared folder, then select Sharing, then click on Permissions. The default Windows NT4/200x permission allows Everyone Full Control on the Share. @@ -4590,71 +4385,70 @@ Before using any of the following options please refer to the man page for no access means that MaryK who is part of the group Everyone will have no access even if this user is given explicit full control access. - MS Windows Access Control Lists and Unix Interoperability Managing UNIX permissions Using NT Security Dialogs Windows NT clients can use their native security settings - dialog box to view and modify the underlying UNIX permissions. Note that this ability is careful not to compromise - the security of the UNIX host Samba is running on, and - still obeys all the file permission rules that a Samba - administrator can set. Note - All access to Unix/Linux system file via Samba is controlled at - the operating system file access control level. When trying to - figure out file access problems it is vitally important to identify - the identity of the Windows user as it is presented by Samba at - the point of file access. This can best be determined from the +

`MS Windows Access Control Lists and UNIX Interoperability`

`Managing UNIX permissions Using NT Security Dialogs`

+ Windows NT clients can use their native security settings dialog box to view and modify the + underlying UNIX permissions. +

+ Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and + still obeys all the file permission rules that a Samba administrator can set. +

+ Samba does not attempt to go beyond POSIX ACLs, so that the various finer-grained access control + options provided in Windows are actually ignore. +

`Note`

+ All access to UNIX/Linux system files via Samba is controlled by the operating system file access controls. + When trying to figure out file access problems it is vitally important to find the identity of the Windows + user as it is presented by Samba at the point of file access. This can best be determined from the Samba log files. -

`Viewing File Security on a Samba Share`

From an NT4/2000/XP client, single-click with the right - mouse button on any file or directory in a Samba mounted - drive letter or UNC path. When the menu pops-up, click - on the Properties entry at the bottom of - the menu. This brings up the file properties dialog - box. Click on the tab Security and you - will see three buttons, Permissions, - Auditing, and Ownership. - The Auditing button will cause either - an error message A requested privilege is not held - by the client to appear if the user is not the - NT Administrator, or a dialog which is intended to allow an - Administrator to add auditing requirements to a file if the - user is logged on as the NT Administrator. This dialog is - non-functional with a Samba share at this time, as the only - useful button, the Add button will not currently - allow a list of users to be seen.

`Viewing file ownership`

Clicking on the Ownership button - brings up a dialog box telling you who owns the given file. The - owner name will be of the form :

"SERVER\user (Long name)"

Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database). Click on the - Close button to remove this dialog.

If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone".

The Take Ownership button will not allow - you to change the ownership of this file to yourself (clicking on - it will display a dialog box complaining that the user you are - currently logged onto the NT client cannot be found). The reason - for this is that changing the ownership of a file is a privileged - operation in UNIX, available only to the root - user. As clicking on this button causes NT to attempt to change - the ownership of a file to the current user logged into the NT - client this will not work with Samba at this time.

There is an NT chown command that will work with Samba - and allow a user with Administrator privilege connected - to a Samba server as root to change the ownership of - files on both a local NTFS filesystem or remote mounted NTFS - or Samba drive. This is available as part of the Seclib - NT security library written by Jeremy Allison of - the Samba Team, available from the main Samba ftp site.

`Viewing File or Directory Permissions`

The third button is the Permissions - button. Clicking on this brings up a dialog box that shows both - the permissions and the UNIX owner of the file or directory. - The owner is displayed in the form :

"SERVER\ +

`Viewing File Security on a Samba Share`

+ From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba + mounted drive letter or UNC path. When the menu pops-up, click on the Properties + entry at the bottom of the menu. This brings up the file properties dialog box. Click on the tab + Security and you will see three buttons, Permissions, + Auditing, and Ownership. The Auditing + button will cause either an error message A requested privilege is not held by the client + to appear if the user is not the NT Administrator, or a dialog which is intended to allow an Administrator + to add auditing requirements to a file if the user is logged on as the NT Administrator. This dialog is + non-functional with a Samba share at this time, as the only useful button, the Add + button will not currently allow a list of users to be seen. +

`Viewing file ownership`

+ Clicking on the Ownership button brings up a dialog box telling you who owns + the given file. The owner name will be of the form: +

+ "SERVER\user (Long name)" +

+ Where SERVER is the NetBIOS name of the Samba server, user + is the user name of the UNIX user who owns the file, and (Long name) is the + descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). + Click on the Close button to remove this dialog. +

+ If the parameter nt acl support is set to false + then the file owner will be shown as the NT user "Everyone". +

+ The Take Ownership button will not allow you to change the ownership of this file to + yourself (clicking on it will display a dialog box complaining that the user you are currently logged onto + the NT client cannot be found). The reason for this is that changing the ownership of a file is a privileged + operation in UNIX, available only to the root user. As clicking on this button causes + NT to attempt to change the ownership of a file to the current user logged into the NT client this will + not work with Samba at this time.

+ There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected + to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS + or Samba drive. This is available as part of the Seclib NT security library written + by Jeremy Allison of the Samba-Team, available from the main Samba FTP site.

`Viewing File or Directory Permissions`

+ The third button is the Permissions button. Clicking on this brings up a dialog box + that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed in the form: +

"SERVER\ user - (Long name)"

If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone" and the - permissions will be shown as NT "Full Control".

The permissions field is displayed differently for files - and directories, so I'll describe the way file permissions - are displayed first.

`File Permissions`

The standard UNIX user/group/world triplet and + (Long name)"

Where SERVER is the NetBIOS name of the Samba server, + user is the user name of the UNIX user who owns the file, and + (Long name) is the descriptive string identifying the user (normally found in the + GECOS field of the UNIX password database).

+ If the parameter nt acl support is set to false + then the file owner will be shown as the NT user "Everyone" and the permissions will be + shown as NT "Full Control". +

+ The permissions field is displayed differently for files and directories, so I'll describe the way file permissions + are displayed first. +

`File Permissions`

The standard UNIX user/group/world triplet and the corresponding "read", "write", "execute" permissions triplets are mapped by Samba into a three element NT ACL with the 'r', 'w', and 'x' bits mapped into the corresponding @@ -4669,14 +4463,14 @@ Before using any of the following options please refer to the man page for or full control then usually the permissions will be prefixed by the words "Special Access" in the NT display list.

But what happens if the file has no permissions allowed - for a particular UNIX user group or world component ? In order + for a particular UNIX user group or world component? In order to allow "no permissions" to be seen and modified then Samba overloads the NT "Take Ownership" ACL attribute (which has no meaning in UNIX) and reports a component with no permissions as having the NT "O" bit set. This was chosen of course to make it look like a zero, meaning zero permissions. More details on the decision behind this will - be given below.

`Directory Permissions`

Directories on an NT NTFS file system have two + be given below.

`Directory Permissions`

Directories on an NT NTFS file system have two different sets of permissions. The first set of permissions is the ACL set on the directory itself, this is usually displayed in the first set of parentheses in the normal "RW" @@ -4687,12 +4481,12 @@ Before using any of the following options please refer to the man page for permissions that any file created within this directory would inherit.

Samba synthesises these inherited permissions for NT by returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

`Modifying file or directory permissions`

Modifying file and directory permissions is as simple + created by Samba on this share would receive.

`Modifying file or directory permissions`

Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and clicking the OK button. However, there are limitations that a user needs to be aware of, and also interactions with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.

If the parameter nt acl support + attributes that need to also be taken into account.

If the parameter nt acl support is set to false then any attempt to set security permissions will fail with an "Access Denied" message.

The first thing to note is that the "Add" @@ -4721,59 +4515,56 @@ Before using any of the following options please refer to the man page for Remove button, or set the component to only have the special Take Ownership permission (displayed as "O" - ) highlighted.

`Interaction with the standard Samba create mask - parameters`

There are four parameters + ) highlighted.

`Interaction with the standard Samba create mask + parameters`

There are four parameters to control interaction with the standard Samba create mask parameters. These are : - security mask force security mode directory security mask force directory security mode +

security mask
force security mode
directory security mask
force directory security mode

-

Once a user clicks OK to apply the +

Once a user clicks OK to apply the permissions Samba maps the given permissions into a user/group/world r/w/x triplet set, and then will check the changed permissions for a - file against the bits set in the - security mask parameter. Any bits that + file against the bits set in the + security mask parameter. Any bits that were changed that are not set to '1' in this parameter are left alone - in the file permissions.

Essentially, zero bits in the security mask + in the file permissions.

Essentially, zero bits in the security mask mask may be treated as a set of bits the user is not allowed to change, and one bits are those the user is allowed to change.

If not set explicitly this parameter is set to the same value as - the create mask - parameter. To allow a user to modify all the + the create mask parameter. To allow a user to modify all the user/group/world permissions on a file, set this parameter to 0777.

Next Samba checks the changed permissions for a file against - the bits set in the - force security mode parameter. Any bits + the bits set in the + force security mode parameter. Any bits that were changed that correspond to bits set to '1' in this parameter are forced to be set.

Essentially, bits set in the force security mode parameter may be treated as a set of bits that, when modifying security on a file, the user has always set to be 'on'.

If not set explicitly this parameter is set to the same value - as the force - create mode parameter. + as the force create mode parameter. To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000.

The security mask and force + with no restrictions set this parameter to 000.

The security mask and force security mode parameters are applied to the change request in that order.

For a directory Samba will perform the same operations as described above for a file except using the parameter directory security mask instead of security mask, and force directory security mode parameter instead of force security mode - .

The directory security mask parameter + .

The directory security mask parameter by default is set to the same value as the directory mask parameter and the force directory security mode parameter by default is set to the same value as - the force directory mode parameter.

In this way Samba enforces the permission restrictions that + the force directory mode parameter.

In this way Samba enforces the permission restrictions that an administrator can set on a Samba share, whilst still allowing users to modify the permission bits within that restriction.

If you want to set up a share that allows users full control in modifying the permission bits on their files and directories and doesn't force any particular bits to be set 'on', then set the following parameters in the smb.conf file in that share specific section : -

security mask = 0777

force security mode = 0

directory security mask = 0777

force directory security mode = 0

`Interaction with the standard Samba file attribute - mapping`

Samba maps some of the DOS attribute bits (such as "read +

security mask = 0777

force security mode = 0

directory security mask = 0777

force directory security mode = 0

`Interaction with the standard Samba file attribute mapping`

`Note`

Samba maps some of the DOS attribute bits (such as "read only") into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security dialog and the permission bits set by the file attribute mapping. -

One way this can show up is if a file has no UNIX read access +

One way this can show up is if a file has no UNIX read access for the owner it will show up as "read only" in the standard file attributes tabbed dialog. Unfortunately this dialog is the same one that contains the security info in another tab.

What this can mean is that if the owner changes the permissions @@ -4785,10 +4576,10 @@ Before using any of the following options please refer to the man page for OK to get back to the attributes dialog you should always hit Cancel rather than OK to ensure that your changes - are not overridden.

`Common Errors`

+ are not overridden.

`Common Errors`

File, Directory and Share access problems are very common on the mailing list. The following are examples taken from the mailing list in recent times. -

`Users can not write to a public share`

+

`Users can not write to a public share`

“ We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), and there's a public share, on which everyone needs to have permission to create / modify files, but only @@ -4797,80 +4588,89 @@ are examples taken from the mailing list in recent times. ”

There are many ways to solve this problem, here are a few hints: -

Procedure 13.3. Example Solution:

+

Go to the top of the directory that is shared -
+

Set the ownership to what ever public owner and group you want -

-			find 'directory_name' -type d -exec chown user.group {}\;
-			find 'directory_name' -type d -exec chmod 6775 'directory_name'
-			find 'directory_name' -type f -exec chmod 0775 {} \;
-			find 'directory_name' -type f -exec chown user.group {}\;
-

- Note + +$ find 'directory_name' -type d -exec chown user.group {}\; +$ find 'directory_name' -type d -exec chmod 6775 'directory_name' +$ find 'directory_name' -type f -exec chmod 0775 {} \; +$ find 'directory_name' -type f -exec chown user.group {}\; + + Note The above will set the 'sticky bit' on all directories. Read your - Unix/Linux man page on what that does. It causes the OS to assign + UNIX/Linux man page on what that does. It causes the OS to assign to all files created in the directories the ownership of the directory. -

Directory is: /foodbar -

-				$ chown jack.engr /foodbar
-

- Note - This is the same as doing: - - $ chown jack /foodbar - $ chgrp engr /foodbar - -

Now do: + +$ chown jack.engr /foodbar + + Note This is the same as doing: +$ chown jack /foodbar +$ chgrp engr /foodbar +

Now do: -

-				$ chmod 6775 /foodbar
-				$ ls -al /foodbar/..
-

+ +$ chmod 6775 /foodbar +$ ls -al /foodbar/.. + - You should see: - - drwsrwsr-x 2 jack engr 48 2003-02-04 09:55 foodbar - -

Now do: - - $ su - jill - $ cd /foodbar - $ touch Afile - $ ls -al - - + You should see: + +drwsrwsr-x 2 jack engr 48 2003-02-04 09:55 foodbar + +

Now do: +

+$ su - jill
+$ cd /foodbar
+$ touch Afile
+$ ls -al
+

+

You should see that the file Afile created by Jill will have ownership and permissions of Jack, as follows: -

-		-rw-r--r--  1 jack  engr     0 2003-02-04 09:57 Afile
-

-

+ +-rw-r--r-- 1 jack engr 0 2003-02-04 09:57 Afile + +

Now in your smb.conf for the share add: -
```
-		force create mode = 0775
-		force directory mode = 6775
-		
```
- Note + force create mode = 0775 force direcrtory mode = 6775 + Note The above are only needed if your users are not members of the group you have used. ie: Within the OS do not have write permission on the directory. - + An alternative is to set in the smb.conf entry for the share: - - force user = jack - force group = engr - -

`I have set force user and Samba still makes root the owner of all the files - I touch!`

- When you have a user in 'admin users', Samba will always do file operations for - this user as root, even if force user has been set. -

`Chapter 14. File and Record Locking`

`Jeremy Allison`

Samba Team <jra@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

`Eric Roseme`

HP Oplocks Usage Recommendations Whitepaper <eric.roseme@hp.com>

Table of Contents

Samba Opportunistic Locking Control

Discussion

Opportunistic Locking Overview

Example Configuration

MS Windows Opportunistic Locking and Caching Controls

Workstation Service Entries
Server Service Entries

Persistent Data Corruption

locking.tdb error messages

Additional Reading

+

force user = jack

force group = engr

+

`I have set force user but Samba still makes root the owner of all the files I touch!`

+ When you have a user in admin users, samba will always do file operations for + this user as root, even if force user has been set. +

`MS Word with Samba changes owner of file`

+ Question: “When userB saves a word document that is owned by userA the updated file is now owned by userB. + Why is Samba doing this? How do I fix this?” +

+ Answer: Word does the following when you modify/change a Word document: Word Creates a NEW document with + a temporary name, Word then closes the old document and deletes it, Word then renames the new document to the original document name. + There is NO mechanism by which Samba CAN IN ANY WAY know that the new document really should be owned by the owners + of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able + to tell, the file that gets created is a NEW file, not one that the application (Word) is updating. +

+ There is a work-around to solve the permissions problem. That work-around involves understanding how you can manage file + system behaviour from within the smb.conf file, as well as understanding how Unix file systems work. Set on the directory + in which you are changing word documents: chmod g+s 'directory_name' This ensures that all files will + be created with the group that owns the directory. In smb.conf share declaration section set: +

+

force create mode = 0660

force directory mode = 0770

+

+ These two settings will ensure that all directories and files that get created in the share will be read/writable by the + owner and group set on the directory itself. +

`Chapter 14. File and Record Locking`

`Jeremy Allison`

Samba Team <jra@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

`Eric Roseme`

HP Oplocks Usage Recommendations Whitepaper <eric.roseme@hp.com>

Table of Contents

Samba Opportunistic Locking Control

Discussion

Opportunistic Locking Overview

Example Configuration

MS Windows Opportunistic Locking and Caching Controls

Workstation Service Entries
Server Service Entries

Persistent Data Corruption