From 5130e1468e2028613a9f5369237db25b091fd548 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Mon, 31 Mar 2003 21:42:19 +0000 Subject: More doc updates: - Move information about compiling with ADS support to appendix about compiling - Make DOMAIN_MEMBER NT4-domain only (because current ADS info was incomplete and becoming an ADS domain member is documented more properly in ADS-HOWTO) (This used to be commit efe3dd876ac61af0abc46539369860216eeca79b) --- docs/htmldocs/Samba-HOWTO-Collection.html | 1422 ++++++++++++++--------------- 1 file changed, 697 insertions(+), 725 deletions(-) (limited to 'docs/htmldocs') diff --git a/docs/htmldocs/Samba-HOWTO-Collection.html b/docs/htmldocs/Samba-HOWTO-Collection.html index d9125d5aad..ea080fbd79 100644 --- a/docs/htmldocs/Samba-HOWTO-Collection.html +++ b/docs/htmldocs/Samba-HOWTO-Collection.html @@ -353,42 +353,38 @@ HREF="#ADS" >
8.1. Installing the required packages for DebianSetup your smb.conf
8.2. Installing the required packages for RedHatSetup your /etc/krb5.conf
8.3. Compile Samba
8.4. Setup your /etc/krb5.conf
8.5. Create the computer account
8.6. 8.4. Test your server setup
8.7. 8.5. Testing with smbclient
8.8. 8.6. Notes
9.1. Joining an NT Domain with Samba 3.0
9.2. Samba and Windows 2000 Domains
9.3. Why is this better than security = server?
10.1. Agenda
10.2. Name Resolution in a pure Unix/Linux world
10.3. Name resolution as used within MS Windows networking
10.4. How browsing functions and how to deploy stable and dependable browsing using Samba
10.5. MS Windows security options and how to configure Samba for seemless integration
10.6. Conclusions
11.1. Viewing and changing UNIX permissions using the NT security dialogs
11.2. How to view file security on a Samba share
11.3. Viewing file ownership
11.4. Viewing file or directory permissions
11.5. Modifying file or directory permissions
11.6. Interaction with the standard Samba create mask parameters
11.7. Interaction with the standard Samba file attribute mapping
12.1. Samba and PAM
12.2. Distributed Authentication
12.3. PAM Configuration in smb.conf
13.1. Instructions
14.1. Introduction
14.2. Configuration
14.3. The Imprints Toolset
14.4. Diagnosis
15.1. Introduction
15.2. CUPS - RAW Print Through Mode
15.3. The CUPS Filter Chains
15.4. CUPS Print Drivers and Devices
15.5. Limiting the number of pages users can print
15.6. Advanced Postscript Printing from MS Windows
15.7. Auto-Deletion of CUPS spool files
16.1. Abstract
16.2. Introduction
16.3. What Winbind Provides
16.4. How Winbind Works
16.5. Installation and Configuration
16.6. Limitations
16.7. Conclusion
17.1. Overview of browsing
17.2. Browsing support in samba
17.3. Problem resolution
17.4. Browsing across subnets
17.5. Setting up a WINS server
17.6. Setting up Browsing in a WORKGROUP
17.7. Setting up Browsing in a DOMAIN
17.8. Forcing samba to be the master
17.9. Making samba the domain master
17.10. Note about broadcast addresses
17.11. Multiple interfaces
18.1. Introduction and configuration
18.2. Included modules
18.3. VFS modules available elsewhere
20.1. Comparisons
20.2. Socket options
20.3. Read size
20.4. Max xmit
20.5. Log level
20.6. Read raw
20.7. Write raw
20.8. Slow Clients
20.9. Slow Logins
20.10. Client tuning
21.1. Windows '9x
21.2. Windows NT 4
21.3. Windows 2000/XP
22.1. Introduction
22.2. Using host based protection
22.3. Using interface protection
22.4. Using a firewall
22.5. Using a IPC$ share deny
22.6. Upgrading Samba
23.1. What are charsets and unicode?
23.2. Samba and charsets
24.1. HPUX
24.2. SCO Unix
24.3. DNIX
24.4. RedHat Linux Rembrandt-II
24.5. AIX
25.1. Macintosh clients?
25.2. OS2 Client
25.3. Windows for Workgroups
25.4. Windows '95/'98
25.5. Windows 2000 Service Pack 2
26.1. Access Samba source code via CVS
26.2. Accessing the samba sources via rsync and ftp
26.3. Building the Binaries
26.4. Starting the smbd and nmbd
27.1. Introduction
27.2. General info
27.3. Debug levels
27.4. Internal errors
27.5. Attaching to a running process
27.6. Patches
28.1. Introduction
28.2. Assumptions
28.3. Tests
28.4. Still having troubles?
8.1. Installing the required packages for DebianSetup your smb.conf
8.2. Installing the required packages for RedHatSetup your /etc/krb5.conf
8.3. Compile Samba
8.4. Setup your /etc/krb5.conf
8.5. Create the computer account
8.5.1. 8.3.1. Possible errors
8.6. 8.4. Test your server setup
8.7. 8.5. Testing with smbclient
8.8. 8.6. Notes
9.1. Joining an NT Domain with Samba 3.0
9.2. Samba and Windows 2000 Domains
9.3. Why is this better than security = server?

This is a rough guide to setting up Samba 3.0 with kerberos authentication against a Windows2000 KDC.

Pieces you need before you begin:

a Windows 2000 server.
samba 3.0 or higher.
the MIT kerberos development libraries (either install from the above sources or use a package). The heimdal libraries will not work.
the OpenLDAP development libraries.


8.1. Installing the required packages for Debian

On Debian you need to install the following packages:

libkrb5-dev
krb5-user


8.2. Installing the required packages for RedHat

On RedHat this means you should have at least:

krb5-workstation (for kinit)
krb5-libs (for linking with)
krb5-devel (because you are compiling from source)

in addition to the standard development environment.

Note that these are not standard on a RedHat install, and you may need -to get them off CD2.


8.3. Compile Samba8.1. Setup your smb.conf

If your kerberos libraries are in a non-standard location then - remember to add the configure option --with-krb5=DIR.

After you run configure make sure that include/config.h it - generates contains - lines like this:

#define HAVE_KRB5 1
-#define HAVE_LDAP 1

If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure out why and fix - it.

Then compile and install Samba as usual. You must use at least the - following 3 options in smb.conf:

You must use at least the following 3 options in smb.conf:

You do *not* need a smbpasswd file, and older clients will
   be authenticated as if "security = domain", although it won't do any harm
   and allows you to have local users not in the domain.
-  I expect that the above
-  required options will change soon when we get better active
-  directory integration.


8.4. Setup your /etc/krb5.conf8.2. Setup your /etc/krb5.conf

The minimal configuration for krb5.conf is:


8.5. Create the computer account8.3. Create the computer account

As a user that has write permission on the Samba private directory @@ -7281,8 +7152,8 @@ CLASS="SECT2" >


8.5.1. Possible errors8.3.1. Possible errors


8.6. Test your server setup8.4. Test your server setup

On a Windows 2000 client try


8.7. Testing with smbclient8.5. Testing with smbclient

On your Samba server try to login to a Win2000 server or your Samba @@ -7339,12 +7210,12 @@ CLASS="SECT1" >


8.8. Notes8.6. Notes

You must change administrator password at least once after DC install, - to create the right encoding types

You must change administrator password at least once after DC +install, to create the right encoding types

w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in their defaults DNS setup. Maybe fixed in service packs?

9.1. Joining an NT Domain with Samba 3.0

security = domain or - security = ads depending on if the PDC is - NT4 or running Active Directory respectivly.

Next change the root# net join -S DOMPDC +>net rpc join -S DOMPDC -UAdministrator%password


9.2. Samba and Windows 2000 Domains

Many people have asked regarding the state of Samba's ability to participate in -a Windows 2000 Domain. Samba 3.0 is able to act as a member server of a Windows -2000 domain operating in mixed or native mode. The steps above apply -to both NT4 and Windows 2000.


9.3. Why is this better than security = server?9.2. Why is this better than security = server?

Currently, domain security in Samba doesn't free you from @@ -7623,13 +7475,27 @@ CLASS="COMMAND" authenticating to a PDC means that as part of the authentication reply, the Samba server gets the user identification information such as the user SID, the list of NT groups the user belongs to, etc.

NOTE: Much of the text of this document was first published in the Web magazine Doing the NIS/NT Samba.

Introduction

10.1. Agenda
10.2. Name Resolution in a pure Unix/Linux world
10.2.1. /etc/hosts
10.2.2. /etc/resolv.conf
10.2.3. /etc/host.conf
10.2.4. /etc/nsswitch.conf
10.3. Name resolution as used within MS Windows networking
10.3.1. The NetBIOS Name Cache
10.3.2. The LMHOSTS file
10.3.3. HOSTS file
10.3.4. DNS Lookup
10.3.5. WINS Lookup
10.4. How browsing functions and how to deploy stable and dependable browsing using Samba
10.5. MS Windows security options and how to configure Samba for seemless integration
10.5.1. Use MS Windows NT as an authentication server
10.5.2. Make Samba a member of an MS Windows NT security domain
10.5.3. Configure Samba as an authentication server
10.6. Conclusions
11.1. Viewing and changing UNIX permissions using the NT security dialogs
11.2. How to view file security on a Samba share
11.3. Viewing file ownership
11.4. Viewing file or directory permissions
11.4.1. File Permissions
11.4.2. Directory Permissions
11.5. Modifying file or directory permissions
11.6. Interaction with the standard Samba create mask parameters
11.7. Interaction with the standard Samba file attribute mapping
12.1. Samba and PAM
12.2. Distributed Authentication
12.3. PAM Configuration in smb.conf
13.1. Instructions
13.1.1. Notes
14.1. Introduction
14.2. Configuration
14.2.1. Creating [print$]
14.2.2. Setting Drivers for Existing Printers
14.2.3. Support a large number of printers
14.2.4. Adding New Printers via the Windows NT APW
14.2.5. Samba and Printer Ports
14.3. The Imprints Toolset
14.3.1. What is Imprints?
14.3.2. Creating Printer Driver Packages
14.3.3. The Imprints server
14.3.4. The Installation Client
14.4. Diagnosis
14.4.1. Introduction
14.4.2. Debugging printer problems
14.4.3. What printers do I have?
14.4.4. Setting up printcap and print servers
14.4.5. Job sent, no output
14.4.6. Job sent, strange output
14.4.7. Raw PostScript printed
14.4.8. Advanced Printing
14.4.9. Real debugging
15.1. Introduction
15.2. CUPS - RAW Print Through Mode
15.3. The CUPS Filter Chains
15.4. CUPS Print Drivers and Devices
15.4.1. Further printing steps
15.5. Limiting the number of pages users can print
15.6. Advanced Postscript Printing from MS Windows
15.7. Auto-Deletion of CUPS spool files
16.1. Abstract
16.2. Introduction
16.3. What Winbind Provides
16.3.1. Target Uses
16.4. How Winbind Works
16.4.1. Microsoft Remote Procedure Calls
16.4.2. Microsoft Active Directory Services
16.4.3. Name Service Switch
16.4.4. Pluggable Authentication Modules
16.4.5. User and Group ID Allocation
16.4.6. Result Caching
16.5. Installation and Configuration
16.5.1. Introduction
16.5.2. Requirements
16.5.3. Testing Things Out
16.6. Limitations
16.7. Conclusion
17.1. Overview of browsing
17.2. Browsing support in samba
17.3. Problem resolution
17.4. Browsing across subnets
17.4.1. How does cross subnet browsing work ?
17.5. Setting up a WINS server
17.6. Setting up Browsing in a WORKGROUP
17.7. Setting up Browsing in a DOMAIN
17.8. Forcing samba to be the master
17.9. Making samba the domain master
17.10. Note about broadcast addresses
17.11. Multiple interfaces
18.1. Introduction and configuration
18.2. Included modules
18.2.1. audit
18.2.2. recycle
18.2.3. netatalk
18.3. VFS modules available elsewhere
18.3.1. DatabaseFS
18.3.2. vscan
20.1. Comparisons
20.2. Socket options
20.3. Read size
20.4. Max xmit
20.5. Log level
20.6. Read raw
20.7. Write raw
20.8. Slow Clients
20.9. Slow Logins
20.10. Client tuning
21.1. Windows '9x
21.2. Windows NT 4
21.2.1. Side bar Notes
21.2.2. Mandatory profiles
21.2.3. moveuser.exe
21.2.4. Get SID
21.3. Windows 2000/XP
22.1. Introduction
22.2. Using host based protection
22.3. Using interface protection
22.4. Using a firewall
22.5. Using a IPC$ share deny
22.6. Upgrading Samba
23.1. What are charsets and unicode?
23.2. Samba and charsets

10.1. Agenda


10.2. Name Resolution in a pure Unix/Linux world


10.2.1. /etc/hosts

10.2.2. /etc/resolv.conf

10.2.3. /etc/host.conf

10.2.4. /etc/nsswitch.conf

10.3. Name resolution as used within MS Windows networking


10.3.1. The NetBIOS Name Cache


10.3.2. The LMHOSTS file


10.3.3. HOSTS file


10.3.4. DNS Lookup


10.3.5. WINS Lookup


10.4. How browsing functions and how to deploy stable and dependable browsing using Samba


10.5. MS Windows security options and how to configure Samba for seemless integration


10.5.1. Use MS Windows NT as an authentication server


10.5.2. Make Samba a member of an MS Windows NT security domain


10.5.3. Configure Samba as an authentication server


10.5.3.1. Users


10.5.3.2. MS Windows NT Machine Accounts


10.6. Conclusions

11.1. Viewing and changing UNIX permissions using the NT security dialogs

New in the Samba 2.0.4 release is the ability for Windows - NT clients to use their native security settings dialog box to - view and modify the underlying UNIX permissions.

Windows NT clients can use their native security settings + dialog box to view and modify the underlying UNIX permissions.

Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and @@ -9573,11 +9442,11 @@ CLASS="SECT1" >


11.2. How to view file security on a Samba share

From an NT 4.0 client, single-click with the right +>From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba mounted drive letter or UNC path. When the menu pops-up, click on the Properties entry at the bottom of - the menu. This brings up the normal file properties dialog - box, but with Samba 2.0.4 this will have a new tab along the top - marked Security. Click on this tab and you +> and you will see three buttons,


11.3. Viewing file ownership

There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected - to a Samba 2.0.4 server as root to change the ownership of + to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS or Samba drive. This is available as part of the


11.4. Viewing file or directory permissions


11.4.1. File Permissions


11.4.2. Directory Permissions


11.5. Modifying file or directory permissions

"Add" - button will not return a list of users in Samba 2.0.4 (it will give + button will not return a list of users in Samba (it will give an error message of "The remote procedure call failed @@ -9973,13 +9841,14 @@ CLASS="SECT1" >


11.6. Interaction with the standard Samba create mask parameters

Note that with Samba 2.0.5 there are four new parameters - to control this interaction. These are :

There are four parameters + to control interaction with the standard Samba create mask parameters. + These are :

create mask parameter to provide compatibility with Samba 2.0.4 - where this permission change facility was introduced. To allow a user to - modify all the user/group/world permissions on a file, set this parameter +> parameter. To allow a user to modify all the + user/group/world permissions on a file, set this parameter to 0777.

Next Samba checks the changed permissions for a file against @@ -10075,8 +9943,7 @@ CLASS="PARAMETER" >force create mode parameter to provide compatibility - with Samba 2.0.4 where the permission change facility was introduced. +> parameter. To allow a user to modify all the user/group/world permissions on a file with no restrictions set this parameter to 000.

force directory mode parameter to provide - compatibility with Samba 2.0.4 where the permission change facility - was introduced.

parameter.

In this way Samba enforces the permission restrictions that an administrator can set on a Samba share, whilst still allowing users @@ -10164,37 +10029,13 @@ CLASS="PARAMETER" CLASS="PARAMETER" >force directory security mode = 0

As described, in Samba 2.0.4 the parameters :

create mask

force create mode

directory mask

force directory mode

were used instead of the parameters discussed here.


11.7. Interaction with the standard Samba file attribute mapping

12.1. Samba and PAM


12.2. Distributed Authentication


12.3. PAM Configuration in smb.conf

13.1. Instructions


13.1.1. Notes

14.1. Introduction


14.2. Configuration


14.2.1. Creating [print$]


14.2.2. Setting Drivers for Existing Printers


14.2.3. Support a large number of printers


14.2.4. Adding New Printers via the Windows NT APW


14.2.5. Samba and Printer Ports


14.3. The Imprints Toolset


14.3.1. What is Imprints?


14.3.2. Creating Printer Driver Packages


14.3.3. The Imprints server


14.3.4. The Installation Client


14.4. Diagnosis

14.4.1. Introduction


14.4.2. Debugging printer problems


14.4.3. What printers do I have?


14.4.4. Setting up printcap and print servers


14.4.5. Job sent, no output


14.4.6. Job sent, strange output


14.4.7. Raw PostScript printed


14.4.8. Advanced Printing


14.4.9. Real debugging

15.1. Introduction


15.2. CUPS - RAW Print Through Mode


15.3. The CUPS Filter Chains


15.4. CUPS Print Drivers and Devices


15.4.1. Further printing steps


15.5. Limiting the number of pages users can print


15.6. Advanced Postscript Printing from MS Windows


15.7. Auto-Deletion of CUPS spool files

16.1. Abstract


16.2. Introduction


16.3. What Winbind Provides


16.3.1. Target Uses


16.4. How Winbind Works


16.4.1. Microsoft Remote Procedure Calls


16.4.2. Microsoft Active Directory Services


16.4.3. Name Service Switch


16.4.4. Pluggable Authentication Modules


16.4.5. User and Group ID Allocation


16.4.6. Result Caching


16.5. Installation and Configuration


16.5.1. Introduction


16.5.2. Requirements


16.5.3. Testing Things Out


16.5.3.1. Configure and compile SAMBA


16.5.3.2. Configure nsswitch.conf

16.5.3.3. Configure smb.conf


16.5.3.4. Join the SAMBA server to the PDC domain


16.5.3.5. Start up the winbindd daemon and test it!


16.5.3.6. Fix the init.d startup scripts

16.5.3.6.1. Linux


16.5.3.6.2. Solaris


16.5.3.6.3. Restarting


16.5.3.7. Configure Winbind and PAM


16.5.3.7.1. Linux/FreeBSD-specific PAM configuration


16.5.3.7.2. Solaris-specific configuration


16.6. Limitations


16.7. Conclusion

17.1. Overview of browsing


17.2. Browsing support in samba


17.3. Problem resolution


17.4. Browsing across subnets


17.4.1. How does cross subnet browsing work ?


17.5. Setting up a WINS server


17.6. Setting up Browsing in a WORKGROUP


17.7. Setting up Browsing in a DOMAIN


17.8. Forcing samba to be the master


17.9. Making samba the domain master


17.10. Note about broadcast addresses


17.11. Multiple interfaces

18.1. Introduction and configuration


18.2. Included modules

18.2.1. audit


18.2.2. recycle


18.2.3. netatalk


18.3. VFS modules available elsewhere


18.3.1. DatabaseFS


18.3.2. vscan

20.1. Comparisons


20.2. Socket options


20.3. Read size


20.4. Max xmit


20.5. Log level


20.6. Read raw


20.7. Write raw


20.8. Slow Clients


20.9. Slow Logins


20.10. Client tuning

21.1. Windows '9x


21.2. Windows NT 4


21.2.1. Side bar Notes


21.2.2. Mandatory profiles


21.2.3. moveuser.exe


21.2.4. Get SID


21.3. Windows 2000/XP

22.1. Introduction


22.2. Using host based protection


22.3. Using interface protection


22.4. Using a firewall


22.5. Using a IPC$ share deny


22.6. Upgrading Samba

23.1. What are charsets and unicode?


23.2. Samba and charsets

24.1. HPUX
24.2. SCO Unix
24.3. DNIX
24.4. RedHat Linux Rembrandt-II
24.5. AIX
24.5.1. Sequential Read Ahead
25.1. Macintosh clients?
25.2. OS2 Client
25.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?
25.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?
25.2.3. Are there any other issues when OS/2 (any version) is used as a client?
25.2.4. How do I get printer driver download working for OS/2 clients?
25.3. Windows for Workgroups
25.3.1. Use latest TCP/IP stack from Microsoft
25.3.2. Delete .pwl files after password change
25.3.3. Configure WfW password handling
25.3.4. Case handling of passwords
25.3.5. Use TCP/IP as default protocol
25.4. Windows '95/'98
25.5. Windows 2000 Service Pack 2
26.1. Access Samba source code via CVS
26.1.1. Introduction
26.1.2. CVS Access to samba.org
26.2. Accessing the samba sources via rsync and ftp
26.3. Building the Binaries
26.3.1. Compiling samba with Active Directory support
26.4. Starting the smbd and nmbd
26.4.1. Starting from inetd.conf
26.4.2. Alternative: starting it as a daemon
27.1. Introduction
27.2. General info
27.3. Debug levels
27.4. Internal errors
27.5. Attaching to a running process
27.6. Patches
28.1. Introduction
28.2. Assumptions
28.3. Tests
28.3.1. Test 1
28.3.2. Test 2
28.3.3. Test 3
28.3.4. Test 4
28.3.5. Test 5
28.3.6. Test 6
28.3.7. Test 7
28.3.8. Test 8
28.3.9. Test 9
28.3.10. Test 10
28.3.11. Test 11
28.4. Still having troubles?

24.1. HPUX


24.2. SCO Unix


24.3. DNIX


24.4. RedHat Linux Rembrandt-II


24.5. AIX

24.5.1. Sequential Read Ahead


25.1. Macintosh clients?


25.2. OS2 Client

25.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?


25.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?


25.2.3. Are there any other issues when OS/2 (any version) is used as a client?


25.2.4. How do I get printer driver download working for OS/2 clients?


25.3. Windows for Workgroups

25.3.1. Use latest TCP/IP stack from Microsoft


25.3.2. Delete .pwl files after password change


25.3.3. Configure WfW password handling


25.3.4. Case handling of passwords


25.3.5. Use TCP/IP as default protocol


25.4. Windows '95/'98


25.5. Windows 2000 Service Pack 2


26.1. Access Samba source code via CVS

26.1.1. Introduction


26.1.2. CVS Access to samba.org


26.1.2.1. Access via CVSweb


26.1.2.2. Access via cvs


26.2. Accessing the samba sources via rsync and ftp


26.3. Building the Binaries

if you find this version a disaster!


26.3.1. Compiling samba with Active Directory support

In order to compile samba with ADS support, you need to have installed + on your system: +

the MIT kerberos development libraries (either install from the sources or use a package). The heimdal libraries will not work.
the OpenLDAP development libraries.

+ +

If your kerberos libraries are in a non-standard location then + remember to add the configure option --with-krb5=DIR.

After you run configure make sure that include/config.h it generates contains lines like this:

#define HAVE_KRB5 1
+#define HAVE_LDAP 1
+		  

If it doesn't then configure did not find your krb5 libraries or + your ldap libraries. Look in config.log to figure out why and fix + it.


26.3.1.1. Installing the required packages for Debian

On Debian you need to install the following packages:

libkrb5-dev
krb5-user

+


26.3.1.2. Installing the required packages for RedHat

On RedHat this means you should have at least:

krb5-workstation (for kinit)
krb5-libs (for linking with)
krb5-devel (because you are compiling from source)

+

in addition to the standard development environment.

Note that these are not standard on a RedHat install, and you may need + to get them off CD2.