Chapter 8. Stand-Alone Servers

John H. Terpstra

Samba Team

<jht@samba.org>

Table of Contents

Features and Benefits

Background

Example Configuration

Reference Documentation Server
Central Print Serving

Common Errors

-Stand-Alone servers are independent of Domain Controllers on the network. -They are NOT domain members and function more like workgroup servers. In many -cases a stand-alone server is configured with a minimum of security control +Chapter 8. Stand-alone Servers

Chapter 8. Stand-alone Servers
Prev	Part II. Server Configuration Basics	Next

Chapter 8. Stand-alone Servers

John H. Terpstra

Samba Team

<jht@samba.org>

Table of Contents

Features and Benefits

Background

Example Configuration

Reference Documentation Server
Central Print Serving

Common Errors

+Stand-alone Servers are independent of Domain Controllers on the network. +They are not Domain Members and function more like workgroup servers. In many +cases a Stand-alone Server is configured with a minimum of security control with the intent that all data served will be readily accessible to all users. -

Features and Benefits

-Stand-Alone servers can be as secure or as insecure as needs dictate. They can +

Features and Benefits

+Stand-alone Servers can be as secure or as insecure as needs dictate. They can have simple or complex configurations. Above all, despite the hoopla about -Domain security they remain a very common installation. +Domain Security they remain a common installation.

If all that is needed is a server for read-only files, or for -printers alone, it may not make sense to affect a complex installation. +printers alone, it may not make sense to effect a complex installation. For example: A drafting office needs to store old drawings and reference -standards. No-one can write files to the server as it is legislatively -important that all documents remain unaltered. A share mode read-only stand-alone -server is an ideal solution. +standards. Noone can write files to the server as it is legislatively +important that all documents remain unaltered. A share mode read-only Stand-alone +Server is an ideal solution.

Another situation that warrants simplicity is an office that has many printers that are queued off a single central server. Everyone needs to be able to print -to the printers, there is no need to affect any access controls and no files will -be served from the print server. Again a share mode stand-alone server makes +to the printers, there is no need to effect any access controls and no files will +be served from the print server. Again, a share mode Stand-alone Server makes a great solution. -

Background

-The term stand-alone server means that the server +

Background

+The term Stand-alone Server means that it will provide local authentication and access control for all resources that are available from it. In general this means that there will be a -local user database. In more technical terms, it means that resources +local user database. In more technical terms, it means resources on the machine will be made available in either SHARE mode or in USER mode.

No special action is needed other than to create user accounts. Stand-alone -servers do NOT provide network logon services. This means that machines that -use this server do NOT perform a domain logon to it. Whatever logon facility -the workstations are subject to is independent of this machine. It is however -necessary to accommodate any network user so that the logon name they use will -be translated (mapped) locally on the stand-alone server to a locally known +servers do not provide network logon services. This means that machines that +use this server do not perform a domain logon to it. Whatever logon facility +the workstations are subject to is independent of this machine. It is, however, +necessary to accommodate any network user so the logon name they use will +be translated (mapped) locally on the Stand-alone Server to a locally known user name. There are several ways this can be done.

Samba tends to blur the distinction a little in respect of what is -a stand-alone server. This is because the authentication database may be -local or on a remote server, even if from the Samba protocol perspective -the Samba server is NOT a member of a domain security context. +a Stand-alone Server. This is because the authentication database may be +local or on a remote server, even if from the SMB protocol perspective +the Samba server is not a member of a domain security context.

-Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher, which maintains the unix user database) the source of authentication may reside on +Through the use of Pluggable Authentication Modules (PAM) and the name service switcher (NSSWITCH), +which maintains the UNIX-user database) the source of authentication may reside on another server. We would be inclined to call this the authentication server. This means that the Samba server may use the local UNIX/Linux system password database (/etc/passwd or /etc/shadow), may use a -local smbpasswd file, or may use -an LDAP back end, or even via PAM and Winbind another CIFS/SMB server +local smbpasswd file, or may use an LDAP backend, or even via PAM and Winbind another CIFS/SMB server for authentication. -

Example Configuration

-The following examples are designed to inspire simplicity. It is too easy to -attempt a high level of creativity and to introduce too much complexity in -server and network design. +

Example Configuration

+The examples, , and link linkend="SimplePrintServer"/>, +are designed to inspire simplicity. It is too easy to attempt a high level of creativity +and to introduce too much complexity in server and network design.

Reference Documentation Server

-Configuration of a read-only data server that EVERYONE can access is very simple. -Here is the smb.conf file that will do this. Assume that all the reference documents -are stored in the directory /export, that the documents are owned by a user other than -nobody. No home directories are shared, that are no users in the /etc/passwd -UNIX system database. This is a very simple system to administer. -

Example 8.1. smb.conf for Reference Documentation Server

# Global parameters

[global]

workgroup = MIDEARTH

netbios name = GANDALF

security = SHARE

passdb backend = guest

wins server = 192.168.1.1

[data]

comment = Data

path = /export

guest only = Yes

-In the above example the machine name is set to REFDOCS, the workgroup is set to the name -of the local workgroup so that the machine will appear in with systems users are familiar -with. The only password backend required is the "guest" backend so as to allow default -unprivileged account names to be used. Given that there is a WINS server on this network -we do use it. +Configuration of a read-only data server that everyone can access is very simple. + is the smb.conf file that will do this. Assume that all the reference documents +are stored in the directory /export, and the documents are owned by a user other than +nobody. No home directories are shared, and there are no users in the /etc/passwd +UNIX system database. This is a simple system to administer. +

Example 8.1. smb.conf for Reference Documentation Server

# Global parameters

[global]

workgroup = MIDEARTH

netbios name = GANDALF

security = SHARE

passdb backend = guest

wins server = 192.168.1.1

[data]

comment = Data

path = /export

guest only = Yes

+In above, the machine name is set to GANDALF, the workgroup is set to the name +of the local workgroup (MIDEARTH) so the machine will appear together with systems with +which users are familiar. The only password backend required is the “guest” backend to allow default +unprivileged account names to be used. As there is a WINS server on this networki, we of obviously make use of it.

Central Print Serving

-Configuration of a simple print server is very simple if you have all the right tools +Configuration of a simple print server is easy if you have all the right tools on your system.

Assumptions:

- The print server must require no administration + The print server must require no administration.
The print spooling and processing system on our print server will be CUPS. - (Please refer to the chapter about CUPS for more information). + (Please refer to for more information).
- All printers that the print server will service will be network - printers. They will be correctly configured, by the administrator, - in the CUPS environment. + The print server will service only network printers. The network administrator + will correctly configure the CUPS environment to support the printers.
- All workstations will be installed using postscript drivers. The printer - of choice is the Apple Color LaserWriter. + All workstations will use only postscript drivers. The printer driver + of choice is the one shipped with the Windows OS for the Apple Color LaserWriter.

In this example our print server will spool all incoming print jobs to /var/spool/samba until the job is ready to be submitted by @@ -88,12 +85,12 @@ the anonymous (guest) user, two things will be required:

Enabling Anonymous Printing

The UNIX/Linux system must have a guest account. The default for this is usually the account nobody. - To find the correct name to use for your version of Samba do the + To find the correct name to use for your version of Samba, do the following:
```
-$ testparm -s -v | grep "guest account"
+$ testparm -s -v | grep "guest account"
 
```
- Then make sure that this account exists in your system password + Make sure that this account exists in your system password database (/etc/passwd).
The directory into which Samba will spool the file must have write @@ -105,8 +102,18 @@ the anonymous (guest) user, two things will be required: root# chmod a+rwt /var/spool/samba

Example 8.2. smb.conf for anonymous printing

# Global parameters

[global]

workgroup = MIDEARTH

netbios name = GANDALF

security = SHARE

passdb backend = guest

wins server = noldor

printing = cups

printcap name = cups

[printers]

comment = All Printers

path = /var/spool/samba

printer admin = root

guest ok = Yes

printable = Yes

use client driver = Yes

browseable = No

Common Errors

+The contents of the smb.conf file is shown in . +

Example 8.2. smb.conf for Anonymous Printing

# Global parameters

[global]

workgroup = MIDEARTH

netbios name = GANDALF

security = SHARE

passdb backend = guest

printing = cups

printcap name = cups

[printers]

comment = All Printers

path = /var/spool/samba

printer admin = root

guest ok = Yes

printable = Yes

use client driver = Yes

browseable = No

Note

+ + +On CUPS-enabled systems there is a facility to pass raw data directly to the printer without +intermediate processing via CUPS print filters. Where use of this mode of operation is desired, +it is necessary to configure a raw printing device. It is also necessary to enable the raw mime +handler in the /etc/mime.conv and /etc/mime.types +files. Refer to . +

Common Errors

The greatest mistake so often made is to make a network configuration too complex. It pays to use the simplest solution that will meet the needs of the moment. -

Prev	Up	Next
Chapter 7. Domain Membership	Home	Chapter 9. MS Windows Network Configuration Guide