Chapter 8. Stand-alone Servers

Chapter 8. Stand-alone Servers
Prev	Part II. Server Configuration Basics	Next

John H. Terpstra

Samba Team

<jht@samba.org>

Table of Contents

Features and Benefits

Background

Example Configuration

Reference Documentation Server
Central Print Serving

Common Errors

-Stand-alone Servers are independent of Domain Controllers on the network. -They are not Domain Members and function more like workgroup servers. In many -cases a Stand-alone Server is configured with a minimum of security control -with the intent that all data served will be readily accessible to all users. -

Features and Benefits

-Stand-alone Servers can be as secure or as insecure as needs dictate. They can -have simple or complex configurations. Above all, despite the hoopla about -Domain Security they remain a common installation. -

-If all that is needed is a server for read-only files, or for -printers alone, it may not make sense to effect a complex installation. -For example: A drafting office needs to store old drawings and reference -standards. Noone can write files to the server as it is legislatively -important that all documents remain unaltered. A share mode read-only Stand-alone -Server is an ideal solution. -

-Another situation that warrants simplicity is an office that has many printers -that are queued off a single central server. Everyone needs to be able to print -to the printers, there is no need to effect any access controls and no files will -be served from the print server. Again, a share mode Stand-alone Server makes -a great solution. -

Background

-The term Stand-alone Server means that it -will provide local authentication and access control for all resources -that are available from it. In general this means that there will be a -local user database. In more technical terms, it means resources -on the machine will be made available in either SHARE mode or in -USER mode. -

-No special action is needed other than to create user accounts. Stand-alone -servers do not provide network logon services. This means that machines that -use this server do not perform a domain logon to it. Whatever logon facility -the workstations are subject to is independent of this machine. It is, however, -necessary to accommodate any network user so the logon name they use will -be translated (mapped) locally on the Stand-alone Server to a locally known -user name. There are several ways this can be done. -

-Samba tends to blur the distinction a little in respect of what is -a Stand-alone Server. This is because the authentication database may be -local or on a remote server, even if from the SMB protocol perspective -the Samba server is not a member of a domain security context. -

-Through the use of Pluggable Authentication Modules (PAM) and the name service switcher (NSSWITCH), -which maintains the UNIX-user database) the source of authentication may reside on -another server. We would be inclined to call this the authentication server. -This means that the Samba server may use the local UNIX/Linux system password database -(/etc/passwd or /etc/shadow), may use a -local smbpasswd file, or may use an LDAP backend, or even via PAM and Winbind another CIFS/SMB server -for authentication. -

Example Configuration

-The examples, , and link linkend="SimplePrintServer"/>, -are designed to inspire simplicity. It is too easy to attempt a high level of creativity -and to introduce too much complexity in server and network design. -

Reference Documentation Server

-Configuration of a read-only data server that everyone can access is very simple. - is the smb.conf file that will do this. Assume that all the reference documents -are stored in the directory /export, and the documents are owned by a user other than -nobody. No home directories are shared, and there are no users in the /etc/passwd -UNIX system database. This is a simple system to administer. -

Example 8.1. smb.conf for Reference Documentation Server

# Global parameters

[global]

workgroup = MIDEARTH

netbios name = GANDALF

security = SHARE

passdb backend = guest

wins server = 192.168.1.1

[data]

comment = Data

path = /export

guest only = Yes

-In above, the machine name is set to GANDALF, the workgroup is set to the name -of the local workgroup (MIDEARTH) so the machine will appear together with systems with -which users are familiar. The only password backend required is the “guest” backend to allow default -unprivileged account names to be used. As there is a WINS server on this networki, we of obviously make use of it. -

Central Print Serving

-Configuration of a simple print server is easy if you have all the right tools -on your system. -

Assumptions:

- The print server must require no administration. -
- The print spooling and processing system on our print server will be CUPS. - (Please refer to for more information). -
- The print server will service only network printers. The network administrator - will correctly configure the CUPS environment to support the printers. -
- All workstations will use only postscript drivers. The printer driver - of choice is the one shipped with the Windows OS for the Apple Color LaserWriter. -

-In this example our print server will spool all incoming print jobs to -/var/spool/samba until the job is ready to be submitted by -Samba to the CUPS print processor. Since all incoming connections will be as -the anonymous (guest) user, two things will be required: -

Enabling Anonymous Printing

- The UNIX/Linux system must have a guest account. - The default for this is usually the account nobody. - To find the correct name to use for your version of Samba, do the - following: -
```
-$ testparm -s -v | grep "guest account"
-
```
- Make sure that this account exists in your system password - database (/etc/passwd). -
- The directory into which Samba will spool the file must have write - access for the guest account. The following commands will ensure that - this directory is available for use: -
```
-root# mkdir /var/spool/samba
-root# chown nobody.nobody /var/spool/samba
-root# chmod a+rwt /var/spool/samba
-
```
-

-The contents of the smb.conf file is shown in . -

Example 8.2. smb.conf for Anonymous Printing

# Global parameters

[global]

workgroup = MIDEARTH

netbios name = GANDALF

security = SHARE

passdb backend = guest

printing = cups

printcap name = cups

[printers]

comment = All Printers

path = /var/spool/samba

printer admin = root

guest ok = Yes

printable = Yes

use client driver = Yes

browseable = No

Note

- - -On CUPS-enabled systems there is a facility to pass raw data directly to the printer without -intermediate processing via CUPS print filters. Where use of this mode of operation is desired, -it is necessary to configure a raw printing device. It is also necessary to enable the raw mime -handler in the /etc/mime.conv and /etc/mime.types -files. Refer to . -

Common Errors

-The greatest mistake so often made is to make a network configuration too complex. -It pays to use the simplest solution that will meet the needs of the moment. -

Prev	Up	Next
Chapter 7. Domain Membership	Home	Chapter 9. MS Windows Network Configuration Guide