From 3bb3f2d0ce1165d0cac683f507d838d20c8c743b Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Sat, 14 Nov 1998 03:01:40 +0000 Subject: Update for 2.0beta1. Jeremy. (This used to be commit 598d0255d40da29ebab3d1a3c9eb66ba654db7b5) --- docs/htmldocs/swat.8.html | 84 ++++++++++------------------------------------- 1 file changed, 18 insertions(+), 66 deletions(-) (limited to 'docs/htmldocs/swat.8.html') diff --git a/docs/htmldocs/swat.8.html b/docs/htmldocs/swat.8.html index 4a2eeec3d5..31afec1a89 100644 --- a/docs/htmldocs/swat.8.html +++ b/docs/htmldocs/swat.8.html @@ -3,7 +3,7 @@ -swat +swat (8) @@ -11,7 +11,7 @@
-

swat

+

swat (8)

Samba

23 Oct 1998

@@ -34,8 +34,7 @@ addition, a swat configuration page has help links to all the configurable options in the smb.conf file allowing an administrator to easily look up the effects of any change. -


swat can be run as a stand-alone daemon, from inetd, -or invoked via CGI from a Web server. +


swat is run from inetd


OPTIONS

@@ -51,13 +50,10 @@ of all the services that the server is to provide. See for more information.


  • -a -


    This option is only used if swat is running as it's own mini-web -server (see the INSTALLATION section below). -


    This option removes the need for authentication needed to modify the -smb.conf file. **THIS IS ONLY MEANT FOR -DEMOING SWAT AND MUST NOT BE SET IN NORMAL SYSTEMS** as it would -allow *ANYONE* to modify the smb.conf -file, thus giving them root access. +


    This option disables authentication and puts swat in demo mode. In +that mode anyone will be able to modify the +smb.conf file. +


    Do NOT enable this option on a production server.



    INSTALLATION

    @@ -73,14 +69,11 @@ would put these in: -


    -

    RUNNING VIA INETD

    +


    +

    INETD INSTALLATION


    You need to edit your /etc/inetd.conf and /etc/services to -enable SWAT to be launched via inetd. Note that swat can also -be launched via the cgi-bin mechanisms of a web server (such as -apache) and that is described below in the section RUNNING VIA -CGI-BIN. +enable SWAT to be launched via inetd.


    In /etc/services you need to add a line like this:


    swat 901/tcp


    Note for NIS/YP users - you may need to rebuild the NIS service maps @@ -91,67 +84,26 @@ presents an obscure security hole depending on the implementation details of your inetd daemon).


    In /etc/inetd.conf you should add a line like this:


    swat stream tcp nowait.400 root /usr/local/samba/bin/swat swat -


    If you just want to see a demo of how swat works and don't want to be -able to actually change any Samba config via swat then you may chose -to change "root" to some other user that does not have permission -to write to smb.conf.


    One you have edited /etc/services and /etc/inetd.conf you need to send a HUP signal to inetd. To do this use "kill -1 PID" where PID is the process ID of the inetd daemon. -


    -

    RUNNING VIA CGI-BIN

    - -


    To run swat via your web servers cgi-bin capability you need to -copy the swat binary to your cgi-bin directory. Note that you -should run swat either via inetd or via -cgi-bin but not both. -


    Then you need to create a swat/ directory in your web servers root -directory and copy the images/* and help/* files found in the -swat/ directory of your Samba source distribution into there so -that they are visible via the URL http://your.web.server/swat/ -


    Next you need to make sure you modify your web servers authentication -to require a username/pssword for the URL -http://your.web.server/cgi-bin/swat. **Don't forget this -step!** If you do forget it then you will be allowing anyone to edit -your Samba configuration which would allow them to easily gain root -access on your machine. -


    After testing the authentication you need to change the ownership and -permissions on the swat binary. It should be owned by root wth the -setuid bit set. It should be ONLY executable by the user that the web -server runs as. Make sure you do this carefully! -


    for example, the following would be correct if the web server ran as -group "nobody". -


    -rws--x--- 1 root nobody -


    You must also realise that this means that any user who can run -programs as the "nobody" group can run swat and modify your -Samba config. Be sure to think about this!


    LAUNCHING

    -


    To launch swat just run your favourite web browser and point it at -http://localhost:901/ or http://localhost/cgi-bin/swat/ -depending on how you installed it. -


    Note that you can attach to swat from any IP connected machine but +


    To launch swat just run your favorite web browser and point it at +http://localhost:901/. +


    Note that you can attach to swat from any IP connected machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent in the clear over the -wire. -


    If installed via inetd then you should be prompted for a -username/password when you connect. You will need to provide the -username "root" and the correct root password. More sophisticated -authentication options are planned for future versions of swat. -


    If installed via cgi-bin then you should receive whatever -authentication request you configured in your web server. +wire.


    FILES


    /etc/inetd.conf -


    If the server is to be run by the inetd meta-daemon, this file must -contain suitable startup information for the meta-daemon. See the -section RUNNING VIA INETD above. +


    This file must contain suitable startup information for the +meta-daemon.


    /etc/services -


    If running the server via the meta-daemon inetd, this file must -contain a mapping of service name (eg., swat) to service port -(eg., 901) and protocol type (eg., tcp). See the section -RUNNING VIA INETD above. +


    This file must contain a mapping of service name (e.g., swat) to +service port (e.g., 901) and protocol type (e.g., tcp).


    /usr/local/samba/lib/smb.conf


    This is the default location of the smb.conf server configuration file that swat edits. Other common places that systems install -- cgit