From 69a26b387b2b1906637d6ef1ab29ddd874a553dc Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Fri, 12 May 2000 13:05:25 +0000 Subject: - added example config section to winbindd man page - reran yodldocs with newer version of yodl (This used to be commit faa3f49430775fd1bd327237f369f7b5df6fc0c6) --- docs/htmldocs/winbindd.8.html | 126 +++++++++++++++++++++++++++++++++++++----- 1 file changed, 113 insertions(+), 13 deletions(-) (limited to 'docs/htmldocs/winbindd.8.html') diff --git a/docs/htmldocs/winbindd.8.html b/docs/htmldocs/winbindd.8.html index ad0edf32ac..1e6b822d34 100644 --- a/docs/htmldocs/winbindd.8.html +++ b/docs/htmldocs/winbindd.8.html @@ -36,8 +36,10 @@ different databases services such as NIS or DNS. The exact behaviour can be configured throught the /etc/nsswitch.conf file. Users and groups are allocated as they are resolved to a range of user and group ids specified by the administrator of the Samba system. -

The service provided by winbindd is called `winbind' and can be used to -resolve user and group information from a Windows NT server. +

The service provided by winbindd is called `winbind' and can be +used to resolve user and group information from a Windows NT server. +The service can also provide authentication services via an associated +PAM module.

The following nsswitch databases are implemented by the winbindd service:

@@ -52,8 +54,13 @@ service: /etc/nsswitch.conf file can be used to initially resolve user and group information from /etc/passwd and /etc/group and then from the Windows NT server. -

passwd: files winbind -

group: files winbind +

+
+  passwd:         files winbind
+  group:          files winbind
+
+
+

OPTIONS

@@ -96,6 +103,20 @@ parameters in the smb.conf file. should be specified in the [global] section of smb.conf.

+

winbind separator
+

The winbind separator option allows you to specify how NT domain names +and user names are combined into unix user names when presented to +users. By default winbind will use the traditional \ separator so +that the unix user names look like DOMAIN\username. In some cases +this separator character may cause problems as the \ character has +special meaning in unix shells. In that case you can use the winbind +separator option to specify an alternative sepataror character. Good +alternatives may be / (although that conflicts with the unix directory +separator) or a + character. The + character appears to be the best +choice for 100% compatibility with existing unix utilities, but may be +an aesthetically bad choice depending on your taste. +

Example: + winbind separator = +

winbind uid

The winbind uid parameter specifies the range of user ids that are allocated by the winbindd daemon. This range of @@ -117,9 +138,16 @@ conflicts can occur otherwise.

winbind cache time

This parameter specifies the number of seconds the winbindd daemon will cache user and group -information before querying a Windows NT server again. +information before querying a Windows NT server again. When a item in +the cache is older than this time winbindd will ask the domain +controller for the sequence number of the servers account database. If +the sequence number has not changed then the cached item is marked as +valid for a further "winbind cache time" seconds. Otherwise the item +is fetched from the server. This means that as long as the account +database is not actively changing winbindd will only have to send one +sequence number query packet every "winbind cache time" seconds.

Default: - winbind cache type = 15 + winbind cache time = 15

template homedir

When filling out the user information for a Windows NT user, the winbindd daemon uses this parameter to fill in @@ -131,12 +159,85 @@ is present it is substituted with the user's Windows NT user name.

template shell

When filling out the user information for a Windows NT user, the winbindd daemon uses this parameter to fill in -the home directory for that user. If the string %D is present it is -substituted with the user's Windows NT domain name. If the string %U -is present it is substituted with the user's Windows NT user name. +the shell for that user.

Default: - template homedir = /home/%D/%U + template shell = /bin/false

+

+

EXAMPLE SETUP

+ +

To setup winbindd for user and group lookups plus authentication from +a domain controller use something like the following setup. This was +tested on a RedHat 6.2 Linux box. +

In /etc/nsswitch.conf put the following: +

+
+   passwd:     files winbind
+   group:      files winbind
+
+
+ +

In /etc/pam.d/* replace the auth lines with something like this: +

+
+	auth       required	/lib/security/pam_securetty.so
+	auth       required	/lib/security/pam_nologin.so
+	auth       sufficient	/lib/security/pam_winbind.so
+	auth       required     /lib/security/pam_pwdb.so use_first_pass shadow nullok
+
+
+ +

Note in particular the use of the sufficient keyword and the +use_first_pass keyword. +

Now replace the account lines with this: +

+
+	account    required	/lib/security/pam_winbind.so
+
+
+ +

The next step is to join the domain. To do that use the samedit +program like this: +

+
+	samedit -S '*' -W DOMAIN -UAdministrator
+
+
+ +

Then within samedit run the command: +

+
+	createuser MACHINE$ -j DOMAIN -L
+
+
+ +

This assumes your domain is called DOMAIN and your Samba workstation +is called MACHINE. +

Next copy libnss_winbind.so.2 to /lib and pam_winbind.so to +/lib/security. +

Finally, setup a smb.conf containing directives like the following: +

+
+  [global]
+        winbind separator = +
+        winbind cache time = 10
+        template shell = /bin/bash
+        template homedir = /home/%D/%U
+        winbind uid = 10000-20000
+        winbind gid = 10000-20000
+        workgroup = DOMAIN
+        security = domain
+        password server = *
+
+
+ +

Now start winbindd and you should find that your user and group +database is expanded to include your NT users and groups, and that you +can login to your unix box as a domain user, using the DOMAIN+user +syntax for the username. You may wish to use the commands "getent +passwd" and "getent group" to confirm the correct operation of +winbindd. +

NOTE: nmbd must be running on the local machine for winbindd to work.

FILES

@@ -170,9 +271,8 @@ is damaged or destroyed then the mappings will be lost.

AUTHOR

The original Samba software and related utilities were created by -Andrew Tridgell samba-bugs@samba.org. Samba is now developed -by the Samba Team as an Open Source project similar to the way the -Linux kernel is developed. +Andrew Tridgell. Samba is now developed by the Samba Team as an Open +Source project.

Winbindd was written by Tim Potter. -- cgit