From a84f1e7535b64dcfb1f274097cf947d0ad6fd1ec Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Thu, 16 Jan 2003 02:21:51 +0000 Subject: regenerate docs (This used to be commit 2215dc37e26bec17eb971e7b54818622a9bb5b97) --- docs/htmldocs/ads.html | 64 ++-- docs/htmldocs/appendixes.html | 167 +++++---- docs/htmldocs/browsing-quick.html | 43 +-- docs/htmldocs/bugreport.html | 31 +- docs/htmldocs/cvs-access.html | 23 +- docs/htmldocs/diagnosis.html | 67 +--- docs/htmldocs/domain-security.html | 19 +- docs/htmldocs/findsmb.1.html | 81 +++-- docs/htmldocs/groupmapping.html | 7 +- docs/htmldocs/improved-browsing.html | 65 ++-- docs/htmldocs/install.html | 79 ++--- docs/htmldocs/integrate-ms-networks.html | 87 ++--- docs/htmldocs/introduction.html | 71 ++-- docs/htmldocs/msdfs.html | 15 +- docs/htmldocs/optional.html | 531 +++++++++++++--------------- docs/htmldocs/other-clients.html | 59 +--- docs/htmldocs/pam.html | 19 +- docs/htmldocs/pdb-mysql.html | 34 +- docs/htmldocs/pdb-xml.html | 15 +- docs/htmldocs/portability.html | 23 +- docs/htmldocs/printing.html | 101 ++---- docs/htmldocs/pwencrypt.html | 29 +- docs/htmldocs/samba-bdc.html | 39 +-- docs/htmldocs/samba-howto-collection.html | 564 ++++++++++++++---------------- docs/htmldocs/samba-ldap-howto.html | 57 +-- docs/htmldocs/samba-pdc.html | 115 ++---- docs/htmldocs/securitylevels.html | 7 +- docs/htmldocs/smb.conf.5.html | 112 +++++- docs/htmldocs/smbd.8.html | 2 +- docs/htmldocs/speed.html | 281 +-------------- docs/htmldocs/type.html | 157 ++++----- docs/htmldocs/unix-permissions.html | 43 +-- docs/htmldocs/vfs.html | 52 +-- docs/htmldocs/winbind.html | 119 ++----- 34 files changed, 1229 insertions(+), 1949 deletions(-) (limited to 'docs/htmldocs') diff --git a/docs/htmldocs/ads.html b/docs/htmldocs/ads.html index 49345be2c0..26ec1d04a7 100644 --- a/docs/htmldocs/ads.html +++ b/docs/htmldocs/ads.html @@ -5,7 +5,8 @@ >Samba as a ADS domain member

Chapter 9. Samba as a ADS domain member

Chapter 8. Samba as a ADS domain member

This is a VERY ROUGH guide to setting up the current (November 2001) -pre-alpha version of Samba 3.0 with kerberos authentication against a -Windows2000 KDC. The procedures listed here are likely to change as -the code develops.

This is a rough guide to setting up Samba 3.0 with kerberos authentication against a +Windows2000 KDC.

Pieces you need before you begin:

9.1. Installing the required packages for Debian

8.1. Installing the required packages for Debian

On Debian you need to install the following packages:

9.2. Installing the required packages for RedHat

8.2. Installing the required packages for RedHat

On RedHat this means you should have at least:

9.3. Compile Samba

8.3. Compile Samba

If your kerberos libraries are in a non-standard location then remember to add the configure option --with-krb5=DIR.

  realm = YOUR.KERBEROS.REALM
-  ads server = your.kerberos.server
   security = ADS
   encrypt passwords = yes

Strictly speaking, you can omit the realm name and you can use an IP - address for the ads server. In that case Samba will auto-detect these.

In case samba can't figure out your ads server using your realm name, use the +ads server option in smb.conf: +
  ads server = your.kerberos.server

You do *not* need a smbpasswd file, although it won't do any harm and if you have one then Samba will be able to fall back to normal @@ -225,9 +225,7 @@ CLASS="SECT1" >

9.4. Setup your /etc/krb5.conf

8.4. Setup your /etc/krb5.conf

The minimal configuration for krb5.conf is:

9.5. Create the computer account

8.5. Create the computer account

Do a "kinit" as a user that has authority to change arbitrary passwords on the KDC ("Administrator" is a good choice). Then as a @@ -281,9 +277,7 @@ CLASS="SECT2" >

9.5.1. Possible errors

8.5.1. Possible errors

9.6. Test your server setup

8.6. Test your server setup

On a Windows 2000 client try

9.7. Testing with smbclient

8.7. Testing with smbclient

On your Samba server try to login to a Win2000 server or your Samba server using smbclient and kerberos. Use smbclient as usual, but @@ -345,9 +335,7 @@ CLASS="SECT1" >

9.8. Notes

8.8. Notes

You must change administrator password at least once after DC install, to create the right encoding types

Appendixes

Chapter 4. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide

Chapter 3. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide

This document should be read in conjunction with Browsing and may be taken as the fast track guide to implementing browsing across subnets @@ -86,9 +85,7 @@ CLASS="SECT1" >

4.1. Discussion

3.1. Discussion

Firstly, all MS Windows networking is based on SMB (Server Message Block) based messaging. SMB messaging is implemented using NetBIOS. Samba @@ -132,9 +129,7 @@ CLASS="SECT1" >

4.2. Use of the "Remote Announce" parameter

3.2. Use of the "Remote Announce" parameter

The "remote announce" parameter of smb.conf can be used to forcibly ensure that all the NetBIOS names on a network get announced to a remote network. @@ -183,16 +178,14 @@ name resolution problems and should be avoided.

4.3. Use of the "Remote Browse Sync" parameter

3.3. Use of the "Remote Browse Sync" parameter

The "remote browse sync" parameter of smb.conf is used to announce to another LMB that it must synchronise it's NetBIOS name list with our @@ -212,9 +205,7 @@ CLASS="SECT1" >

4.4. Use of WINS

3.4. Use of WINS

Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly recommended. Every NetBIOS machine registers it's name together with a @@ -274,9 +265,7 @@ CLASS="SECT1" >

4.5. Do NOT use more than one (1) protocol on MS Windows machines

3.5. Do NOT use more than one (1) protocol on MS Windows machines

A very common cause of browsing problems results from installing more than one protocol on an MS Windows machine.

4.6. Name Resolution Order

3.6. Name Resolution Order

Resolution of NetBIOS names to IP addresses can take place using a number of methods. The only ones that can provide NetBIOS name_type information @@ -401,7 +388,7 @@ WIDTH="33%" ALIGN="left" VALIGN="top" >PrevOplocksImproved browsing in sambaReporting Bugs

Chapter 26. Reporting Bugs

Chapter 25. Reporting Bugs

26.1. Introduction

25.1. Introduction

The email address for bug reports for stable releases is

26.2. General info

25.2. General info

Before submitting a bug report check your config for silly errors. Look in your log files for obvious messages that tell you that @@ -150,9 +145,7 @@ CLASS="SECT1" >

26.3. Debug levels

25.3. Debug levels

If the bug has anything to do with Samba behaving incorrectly as a server (like refusing to open a file) then the log files will probably @@ -220,9 +213,7 @@ CLASS="SECT1" >

26.4. Internal errors

25.4. Internal errors

If you get a "INTERNAL ERROR" message in your log files it means that Samba got an unexpected signal while running. It is probably a @@ -264,9 +255,7 @@ CLASS="SECT1" >

26.5. Attaching to a running process

25.5. Attaching to a running process

Unfortunately some unixes (in particular some recent linux kernels) refuse to dump a core file if the task has changed uid (which smbd @@ -281,9 +270,7 @@ CLASS="SECT1" >

26.6. Patches

25.6. Patches

The best sort of bug report is one that includes a fix! If you send us patches please use HOWTO Access Samba source code via CVS

Chapter 21. HOWTO Access Samba source code via CVS

Chapter 20. HOWTO Access Samba source code via CVS

21.1. Introduction

20.1. Introduction

Samba is developed in an open environment. Developers use CVS (Concurrent Versioning System) to "checkin" (also known as @@ -102,9 +99,7 @@ CLASS="SECT1" >

21.2. CVS Access to samba.org

20.2. CVS Access to samba.org

The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, @@ -115,9 +110,7 @@ CLASS="SECT2" >

21.2.1. Access via CVSweb

20.2.1. Access via CVSweb

You can access the source code via your favourite WWW browser. This allows you to access the contents of @@ -136,9 +129,7 @@ CLASS="SECT2" >

21.2.2. Access via cvs

20.2.2. Access via cvs

You can also access the source code via a normal cvs client. This gives you much more control over you can diff --git a/docs/htmldocs/diagnosis.html b/docs/htmldocs/diagnosis.html index eaa550dc30..a7b2e59436 100644 --- a/docs/htmldocs/diagnosis.html +++ b/docs/htmldocs/diagnosis.html @@ -5,7 +5,8 @@ >Diagnosing your samba server

Chapter 27. Diagnosing your samba server

Chapter 26. Diagnosing your samba server

27.1. Introduction

26.1. Introduction

This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem @@ -95,9 +92,7 @@ CLASS="SECT1" >

27.2. Assumptions

26.2. Assumptions

In all of the tests it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.

27.3. Tests

26.3. Tests

27.3.1. Test 1

26.3.1. Test 1

In the directory in which you store your smb.conf file, run the command "testparm smb.conf". If it reports any errors then your smb.conf @@ -163,9 +154,7 @@ CLASS="SECT2" >

27.3.2. Test 2

26.3.2. Test 2

Run the command "ping BIGSERVER" from the PC and "ping ACLIENT" from the unix box. If you don't get a valid response then your TCP/IP @@ -189,9 +178,7 @@ CLASS="SECT2" >

27.3.3. Test 3

26.3.3. Test 3

Run the command "smbclient -L BIGSERVER" on the unix box. You should get a list of available shares back.

27.3.4. Test 4

26.3.4. Test 4

Run the command "nmblookup -B BIGSERVER __SAMBA__". You should get the IP address of your Samba server back.

27.3.5. Test 5

26.3.5. Test 5

run the command

27.3.6. Test 6

26.3.6. Test 6

Run the command

27.3.7. Test 7

26.3.7. Test 7

Run the command

27.3.8. Test 8

26.3.8. Test 8

On the PC type the command

27.3.9. Test 9

26.3.9. Test 9

Run the command

27.3.10. Test 10

26.3.10. Test 10

Run the command

27.3.11. Test 11

26.3.11. Test 11

From file manager try to browse the server. Your samba server should appear in the browse list of your local workgroup (or the one you @@ -573,9 +544,7 @@ CLASS="SECT1" >

27.4. Still having troubles?

26.4. Still having troubles?

Try the mailing list or newsgroup, or use the ethereal utility to sniff the problem. The official samba mailing list can be reached at diff --git a/docs/htmldocs/domain-security.html b/docs/htmldocs/domain-security.html index 1a10767235..670d96ba5f 100644 --- a/docs/htmldocs/domain-security.html +++ b/docs/htmldocs/domain-security.html @@ -5,7 +5,8 @@ >Samba as a NT4 domain member

Chapter 10. Samba as a NT4 domain member

Chapter 9. Samba as a NT4 domain member

10.1. Joining an NT Domain with Samba 2.2

9.1. Joining an NT Domain with Samba 2.2

Assume you have a Samba 2.x server with a NetBIOS name of

10.2. Samba and Windows 2000 Domains

9.2. Samba and Windows 2000 Domains

Many people have asked regarding the state of Samba's ability to participate in a Windows 2000 Domain. Samba 3.0 is able to act as a member server of a Windows @@ -336,9 +331,7 @@ CLASS="SECT1" >

10.3. Why is this better than security = server?

9.3. Why is this better than security = server?

Currently, domain security in Samba doesn't free you from having to create local Unix users to represent the users attaching diff --git a/docs/htmldocs/findsmb.1.html b/docs/htmldocs/findsmb.1.html index 618363c104..af7100ed6f 100644 --- a/docs/htmldocs/findsmb.1.html +++ b/docs/htmldocs/findsmb.1.html @@ -1,11 +1,12 @@ - + findsmb

findsmb

findsmb

Synopsis

findsmb [subnet broadcast address]

[subnet broadcast address]

-r

Controls whether findsmb takes + bugs in Windows95 into account when trying to find a Netbios name + registered of the remote machine. This option is disabled by default + because it is specific to Windows 95 and Windows 95 machines only. + If set, nmblookup + will be called with -B option.

subnet broadcast address

VERSION

SEE ALSO

AUTHOR

Group mapping HOWTO

Chapter 22. Group mapping HOWTO

Chapter 21. Group mapping HOWTO

Starting with Samba 3.0 alpha 2, a new group mapping function is available. The diff --git a/docs/htmldocs/improved-browsing.html b/docs/htmldocs/improved-browsing.html index 7609ce69cd..4e9d7f639e 100644 --- a/docs/htmldocs/improved-browsing.html +++ b/docs/htmldocs/improved-browsing.html @@ -5,7 +5,8 @@ >Improved browsing in sambaNext

Chapter 2. Improved browsing in samba

Chapter 2. Improved browsing in samba

2.1. Overview of browsing

2.1. Overview of browsing

SMB networking provides a mechanism by which clients can access a list of machines in a network, a so-called "browse list". This list @@ -104,9 +101,7 @@ CLASS="SECT1" >

2.2. Browsing support in samba

2.2. Browsing support in samba

Samba now fully supports browsing. The browsing is supported by nmbd and is also controlled by options in the smb.conf file (see smb.conf(5)).

2.3. Problem resolution

2.3. Problem resolution

If something doesn't work then hopefully the log.nmb file will help you track down the problem. Try a debug level of 2 or 3 for finding @@ -183,9 +176,7 @@ CLASS="SECT1" >

2.4. Browsing across subnets

2.4. Browsing across subnets

With the release of Samba 1.9.17(alpha1 and above) Samba has been updated to enable it to support the replication of browse lists @@ -214,9 +205,7 @@ CLASS="SECT2" >

2.4.1. How does cross subnet browsing work ?

2.4.1. How does cross subnet browsing work ?

Cross subnet browsing is a complicated dance, containing multiple moving parts. It has taken Microsoft several years to get the code @@ -426,9 +415,7 @@ CLASS="SECT1" >

2.5. Setting up a WINS server

2.5. Setting up a WINS server

Either a Samba machine or a Windows NT Server machine may be set up as a WINS server. To set a Samba machine to be a WINS server you must @@ -509,9 +496,7 @@ CLASS="SECT1" >

2.6. Setting up Browsing in a WORKGROUP

2.6. Setting up Browsing in a WORKGROUP

To set up cross subnet browsing on a network containing machines in up to be in a WORKGROUP, not an NT Domain you need to set up one @@ -593,9 +578,7 @@ CLASS="SECT1" >

2.7. Setting up Browsing in a DOMAIN

2.7. Setting up Browsing in a DOMAIN

If you are adding Samba servers to a Windows NT Domain then you must not set up a Samba server as a domain master browser. @@ -644,9 +627,7 @@ CLASS="SECT1" >

2.8. Forcing samba to be the master

2.8. Forcing samba to be the master

Who becomes the "master browser" is determined by an election process using broadcasts. Each election packet contains a number of parameters @@ -692,9 +673,7 @@ CLASS="SECT1" >

2.9. Making samba the domain master

2.9. Making samba the domain master

The domain master is responsible for collating the browse lists of multiple subnets so that browsing can occur between subnets. You can @@ -765,9 +744,7 @@ CLASS="SECT1" >

2.10. Note about broadcast addresses

2.10. Note about broadcast addresses

If your network uses a "0" based broadcast address (for example if it ends in a 0) then you will strike problems. Windows for Workgroups @@ -779,9 +756,7 @@ CLASS="SECT1" >

2.11. Multiple interfaces

2.11. Multiple interfaces

Samba now supports machines with multiple network interfaces. If you have multiple interfaces then you will need to use the "interfaces" @@ -822,7 +797,7 @@ WIDTH="33%" ALIGN="right" VALIGN="top" >NextOplocksQuick Cross Subnet Browsing / Cross Workgroup Browsing guide

How to Install and Test SAMBA

Chapter 1. How to Install and Test SAMBA

Chapter 1. How to Install and Test SAMBA

1.1. Read the man pages

1.1. Read the man pages

The man pages distributed with SAMBA contain lots of useful info that will help to get you started. @@ -122,9 +119,7 @@ CLASS="SECT1" >

1.2. Building the Binaries

1.2. Building the Binaries

To do this, first run the program

1.3. The all important step

1.3. The all important step

At this stage you must fetch yourself a coffee or other drink you find stimulating. Getting the rest @@ -238,9 +231,7 @@ CLASS="SECT1" >

1.4. Create the smb configuration file.

1.4. Create the smb configuration file.

There are sample configuration files in the examples subdirectory in the distribution. I suggest you read them @@ -294,9 +285,7 @@ CLASS="SECT1" >

1.5. Test your config file with +NAME="AEN82">1.5. Test your config file with testparm

1.6. Starting the smbd and nmbd

1.6. Starting the smbd and nmbd

You must choose to start smbd and nmbd either as daemons or from

1.6.1. Starting from inetd.conf

1.6.1. Starting from inetd.conf

NOTE; The following will be different if you use NIS or NIS+ to distributed services maps.

1.6.2. Alternative: starting it as a daemon

1.6.2. Alternative: starting it as a daemon

To start the server as a daemon you should create a script something like this one, perhaps calling @@ -525,9 +508,7 @@ CLASS="SECT1" >

1.7. Try listing the shares available on your +NAME="AEN145">1.7. Try listing the shares available on your server

1.8. Try connecting with the unix client

1.8. Try connecting with the unix client

1.9. Try connecting from a DOS, WfWg, Win9x, WinNT, +NAME="AEN170">1.9. Try connecting from a DOS, WfWg, Win9x, WinNT, Win2k, OS/2, etc... client

Try mounting disks. eg:

1.10. What If Things Don't Work?

1.10. What If Things Don't Work?

If nothing works and you start to think "who wrote this pile of trash" then I suggest you do step 2 again (and @@ -701,9 +676,7 @@ CLASS="SECT2" >

1.10.1. Diagnosing Problems

1.10.1. Diagnosing Problems

If you have installation problems then go to the

1.10.2. Scope IDs

1.10.2. Scope IDs

By default Samba uses a blank scope ID. This means all your windows boxes must also have a blank scope ID. @@ -734,9 +705,7 @@ CLASS="SECT2" >

1.10.3. Choosing the Protocol Level

1.10.3. Choosing the Protocol Level

The SMB protocol has many dialects. Currently Samba supports 5, called CORE, COREPLUS, LANMAN1, @@ -775,9 +744,7 @@ CLASS="SECT2" >

1.10.4. Printing from UNIX to a Client PC

1.10.4. Printing from UNIX to a Client PC

To use a printer that is available via a smb-based server from a unix host with LPR you will need to compile the @@ -796,9 +763,7 @@ CLASS="SECT2" >

1.10.5. Locking

1.10.5. Locking

One area which sometimes causes trouble is locking.

1.10.6. Mapping Usernames

1.10.6. Mapping Usernames

If you have different usernames on the PCs and the unix server then take a look at the "username map" option. diff --git a/docs/htmldocs/integrate-ms-networks.html b/docs/htmldocs/integrate-ms-networks.html index a3b51283d0..ad6aa9e225 100644 --- a/docs/htmldocs/integrate-ms-networks.html +++ b/docs/htmldocs/integrate-ms-networks.html @@ -5,7 +5,8 @@ >Integrating MS Windows networks with Samba

Chapter 11. Integrating MS Windows networks with Samba

Chapter 10. Integrating MS Windows networks with Samba

11.1. Agenda

10.1. Agenda

To identify the key functional mechanisms of MS Windows networking to enable the deployment of Samba as a means of extending and/or @@ -147,9 +144,7 @@ CLASS="SECT1" >

11.2. Name Resolution in a pure Unix/Linux world

10.2. Name Resolution in a pure Unix/Linux world

The key configuration files covered in this section are:

11.2.1. 10.2.1. /etc/hosts

11.2.2. 10.2.2. /etc/resolv.conf

11.2.3. 10.2.3. /etc/host.conf

11.2.4. 10.2.4. /etc/nsswitch.conf

11.3. Name resolution as used within MS Windows networking

10.3. Name resolution as used within MS Windows networking

MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as @@ -491,9 +476,7 @@ CLASS="SECT2" >

11.3.1. The NetBIOS Name Cache

10.3.1. The NetBIOS Name Cache

All MS Windows machines employ an in memory buffer in which is stored the NetBIOS names and IP addresses for all external @@ -518,9 +501,7 @@ CLASS="SECT2" >

11.3.2. The LMHOSTS file

10.3.2. The LMHOSTS file

This file is usually located in MS Windows NT 4.0 or 2000 in

11.3.3. HOSTS file

10.3.3. HOSTS file

This file is usually located in MS Windows NT 4.0 or 2000 in

11.3.4. DNS Lookup

10.3.4. DNS Lookup

This capability is configured in the TCP/IP setup area in the network configuration facility. If enabled an elaborate name resolution sequence @@ -663,9 +640,7 @@ CLASS="SECT2" >

11.3.5. WINS Lookup

10.3.5. WINS Lookup

A WINS (Windows Internet Name Server) service is the equivaent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores @@ -706,9 +681,7 @@ CLASS="SECT1" >

11.4. How browsing functions and how to deploy stable and +NAME="AEN1504">10.4. How browsing functions and how to deploy stable and dependable browsing using Samba

As stated above, MS Windows machines register their NetBIOS names @@ -773,9 +746,7 @@ CLASS="SECT1" >

11.5. MS Windows security options and how to configure +NAME="AEN1514">10.5. MS Windows security options and how to configure Samba for seemless integration

MS Windows clients may use encrypted passwords as part of a @@ -910,9 +881,7 @@ CLASS="SECT2" >

11.5.1. Use MS Windows NT as an authentication server

10.5.1. Use MS Windows NT as an authentication server

This method involves the additions of the following parameters in the smb.conf file:

11.5.2. Make Samba a member of an MS Windows NT security domain

10.5.2. Make Samba a member of an MS Windows NT security domain

This method involves additon of the following paramters in the smb.conf file:

11.5.3. Configure Samba as an authentication server

10.5.3. Configure Samba as an authentication server

This mode of authentication demands that there be on the Unix/Linux system both a Unix style account as well as an @@ -1046,9 +1011,7 @@ CLASS="SECT3" >

11.5.3.1. Users

10.5.3.1. Users

A user account that may provide a home directory should be created. The following Linux system commands are typical of @@ -1069,9 +1032,7 @@ CLASS="SECT3" >

11.5.3.2. MS Windows NT Machine Accounts

10.5.3.2. MS Windows NT Machine Accounts

These are required only when Samba is used as a domain controller. Refer to the Samba-PDC-HOWTO for more details.

11.6. Conclusions

10.6. Conclusions

Samba provides a flexible means to operate as...

General installation

Introduction

This part contains general info on how to install samba @@ -282,91 +279,77 @@ HREF="improved-browsing.html#AEN366" >

3. Oplocks
3.1. What are oplocks?
4. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide
4.1. 3.1. Discussion
4.2. 3.2. Use of the "Remote Announce" parameter
4.3. 3.3. Use of the "Remote Browse Sync" parameter
4.4. 3.4. Use of WINS
4.5. 3.5. Do NOT use more than one (1) protocol on MS Windows machines
4.6. 3.6. Name Resolution Order
5. 4. LanMan and NT Password Encryption in Samba
5.1. 4.1. Introduction
5.2. 4.2. Important Notes About Security
5.2.1. 4.2.1. Advantages of SMB Encryption
5.2.2. 4.2.2. Advantages of non-encrypted passwords
5.3. 4.3. The smbpasswd Command
Hosting a Microsoft Distributed File System tree on Samba

Chapter 14. Hosting a Microsoft Distributed File System tree on Samba

Chapter 13. Hosting a Microsoft Distributed File System tree on Samba

14.1. Instructions

13.1. Instructions

The Distributed File System (or Dfs) provides a means of separating the logical view of files and directories that users @@ -229,9 +226,7 @@ CLASS="SECT2" >

14.1.1. Notes

13.1.1. Notes

    Optional configuration

Introduction

Samba has several features that you might want or might not want to use. The chapters in this @@ -94,51 +91,51 @@ CLASS="TOC" >Table of Contents

11. 10. Integrating MS Windows networks with Samba
11.1. 10.1. Agenda
11.2. 10.2. Name Resolution in a pure Unix/Linux world
11.2.1. 10.2.1. /etc/hosts
11.2.2. 10.2.2. /etc/resolv.conf
11.2.3. 10.2.3. /etc/host.conf
11.2.4. 10.2.4. /etc/nsswitch.conf
11.3. 10.3. Name resolution as used within MS Windows networking
11.3.1. 10.3.1. The NetBIOS Name Cache
11.3.2. 10.3.2. The LMHOSTS file
11.3.3. 10.3.3. HOSTS file
11.3.4. 10.3.4. DNS Lookup
11.3.5. 10.3.5. WINS Lookup
11.4. 10.4. How browsing functions and how to deploy stable and dependable browsing using Samba
11.5. 10.5. MS Windows security options and how to configure Samba for seemless integration
11.5.1. 10.5.1. Use MS Windows NT as an authentication server
11.5.2. 10.5.2. Make Samba a member of an MS Windows NT security domain
11.5.3. 10.5.3. Configure Samba as an authentication server
11.6. 10.6. Conclusions
12. 11. UNIX Permission Bits and Windows NT Access Control Lists
12.1. 11.1. Viewing and changing UNIX permissions using the NT security dialogs
12.2. 11.2. How to view file security on a Samba share
12.3. 11.3. Viewing file ownership
12.4. 11.4. Viewing file or directory permissions
12.4.1. 11.4.1. File Permissions
12.4.2. 11.4.2. Directory Permissions
12.5. 11.5. Modifying file or directory permissions
12.6. 11.6. Interaction with the standard Samba create mask parameters
12.7. 11.7. Interaction with the standard Samba file attribute mapping
13. 12. Configuring PAM for distributed but centrally managed authentication
13.1. 12.1. Samba and PAM
13.2. 12.2. Distributed Authentication
13.3. 12.3. PAM Configuration in smb.conf
14. 13. Hosting a Microsoft Distributed File System tree on Samba
14.1. 13.1. Instructions
14.1.1. 13.1.1. Notes
15. 14. Printing Support
15.1. 14.1. Introduction
15.2. 14.2. Configuration
15.2.1. 14.2.1. Creating [print$]
15.2.2. 14.2.2. Setting Drivers for Existing Printers
15.2.3. 14.2.3. Support a large number of printers
15.2.4. 14.2.4. Adding New Printers via the Windows NT APW
15.2.5. 14.2.5. Samba and Printer Ports
15.3. 14.3. The Imprints Toolset
15.3.1. 14.3.1. What is Imprints?
15.3.2. 14.3.2. Creating Printer Driver Packages
15.3.3. 14.3.3. The Imprints server
15.3.4. 14.3.4. The Installation Client
15.4. 14.4. Diagnosis
15.4.1. 14.4.1. Introduction
15.4.2. 14.4.2. Debugging printer problems
15.4.3. 14.4.3. What printers do I have?
15.4.4. 14.4.4. Setting up printcap and print servers
15.4.5. 14.4.5. Job sent, no output
15.4.6. 14.4.6. Job sent, strange output
15.4.7. 14.4.7. Raw PostScript printed
15.4.8. 14.4.8. Advanced Printing
15.4.9. 14.4.9. Real debugging
16. 15. Unified Logons between Windows NT and UNIX using Winbind
16.1. 15.1. Abstract
16.2. 15.2. Introduction
16.3. 15.3. What Winbind Provides
16.3.1. 15.3.1. Target Uses
16.4. 15.4. How Winbind Works
16.4.1. 15.4.1. Microsoft Remote Procedure Calls
16.4.2. 15.4.2. Name Service Switch
16.4.3. 15.4.3. Pluggable Authentication Modules
16.4.4. 15.4.4. User and Group ID Allocation
16.4.5. 15.4.5. Result Caching
16.5. 15.5. Installation and Configuration
16.5.1. 15.5.1. Introduction
16.5.2. 15.5.2. Requirements
16.5.3. 15.5.3. Testing Things Out
16.6. 15.6. Limitations
16.7. 15.7. Conclusion
17. 16. Passdb MySQL plugin
17.1. 16.1. Building
17.2. 16.2. Configuring
17.3. 16.3. Using plaintext passwords or encrypted password
17.4. 16.4. Getting non-column data from the table
18. 17. Passdb XML plugin
18.1. 17.1. Building
18.2. 17.2. Usage
19. 18. Stackable VFS modules
19.1. 18.1. Introduction and configuration
19.2. 18.2. Included modules
19.2.1. 18.2.1. audit
19.2.2. 18.2.2. recycle
19.2.3. 18.2.3. netatalk
19.3. 18.3. VFS modules available elsewhere
19.3.1. 18.3.1. DatabaseFS
19.3.2. 18.3.2. vscan
20. 19. Storing Samba's User/Machine Account information in an LDAP Directory
20.1. 19.1. Purpose
20.2. 19.2. Introduction
20.3. 19.3. Supported LDAP Servers
20.4. 19.4. Schema and Relationship to the RFC 2307 posixAccount
20.5. 19.5. Configuring Samba with LDAP
20.5.1. 19.5.1. OpenLDAP configuration
20.5.2. 19.5.2. Configuring Samba
20.6. 19.6. Accounts and Groups management
20.7. 19.7. Security and sambaAccount
20.8. 19.8. LDAP specials attributes for sambaAccounts
20.9. 19.9. Example LDIF Entries for a sambaAccount
20.10. 19.10. Comments
21. 20. HOWTO Access Samba source code via CVS
21.1. 20.1. Introduction
21.2. 20.2. CVS Access to samba.org
21.2.1. 20.2.1. Access via CVSweb
21.2.2. 20.2.2. Access via cvs
22. 21. Group mapping HOWTO
23. 22. Samba performance issues
23.1. 22.1. Comparisons
23.2. Oplocks
23.2.1. Overview
23.2.2. Level2 Oplocks
23.2.3. Old 'fake oplocks' option - deprecated
23.3. 22.2. Socket options
23.4. 22.3. Read size
23.5. 22.4. Max xmit
23.6. Locking
23.7. Share modes
23.8. 22.5. Log level
23.9. Wide lines
23.10. 22.6. Read raw
23.11. 22.7. Write raw
23.12. Read prediction
23.13. Memory mapping
23.14. 22.8. Slow Clients
23.15. 22.9. Slow Logins
23.16. 22.10. Client tuning
23.17. My Results
Samba and other CIFS clients

Chapter 25. Samba and other CIFS clients

Chapter 24. Samba and other CIFS clients

This chapter contains client-specific information.

25.1. Macintosh clients?

24.1. Macintosh clients?

Yes.

25.2. OS2 Client

24.2. OS2 Client

25.2.1. How can I configure OS/2 Warp Connect or +NAME="AEN3210">24.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?

A more complete answer to this question can be @@ -195,9 +188,7 @@ CLASS="SECT2" >

25.2.2. How can I configure OS/2 Warp 3 (not Connect), +NAME="AEN3225">24.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?

You can use the free Microsoft LAN Manager 2.2c Client @@ -239,9 +230,7 @@ CLASS="SECT2" >

25.2.3. Are there any other issues when OS/2 (any version) +NAME="AEN3234">24.2.3. Are there any other issues when OS/2 (any version) is used as a client?

When you do a NET VIEW or use the "File and Print @@ -261,9 +250,7 @@ CLASS="SECT2" >

25.2.4. How do I get printer driver download working +NAME="AEN3238">24.2.4. How do I get printer driver download working for OS/2 clients?

First, create a share called [PRINTDRV] that is @@ -312,17 +299,13 @@ CLASS="SECT1" >

25.3. Windows for Workgroups

24.3. Windows for Workgroups

25.3.1. Use latest TCP/IP stack from Microsoft

24.3.1. Use latest TCP/IP stack from Microsoft

Use the latest TCP/IP stack from microsoft if you use Windows for workgroups.

25.3.2. Delete .pwl files after password change

24.3.2. Delete .pwl files after password change

WfWg does a lousy job with passwords. I find that if I change my password on either the unix box or the PC the safest thing to do is to @@ -362,9 +343,7 @@ CLASS="SECT2" >

25.3.3. Configure WfW password handling

24.3.3. Configure WfW password handling

There is a program call admincfg.exe on the last disk (disk 8) of the WFW 3.11 disk set. To install it @@ -381,9 +360,7 @@ CLASS="SECT2" >

25.3.4. Case handling of passwords

24.3.4. Case handling of passwords

Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the

25.4. Windows '95/'98

24.4. Windows '95/'98

When using Windows 95 OEM SR2 the following updates are recommended where Samba is being used. Please NOTE that the above change will affect you once these @@ -448,9 +423,7 @@ CLASS="SECT1" >

25.5. Windows 2000 Service Pack 2

24.5. Windows 2000 Service Pack 2

There are several annoyances with Windows 2000 SP2. One of which diff --git a/docs/htmldocs/pam.html b/docs/htmldocs/pam.html index 30b49b6944..ba2bf6c922 100644 --- a/docs/htmldocs/pam.html +++ b/docs/htmldocs/pam.html @@ -6,7 +6,8 @@ managed authentication

Chapter 13. Configuring PAM for distributed but centrally +NAME="PAM">Chapter 12. Configuring PAM for distributed but centrally managed authentication

13.1. Samba and PAM

12.1. Samba and PAM

A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, now utilize the Pluggable Authentication @@ -296,9 +293,7 @@ CLASS="SECT1" >

13.2. Distributed Authentication

12.2. Distributed Authentication

The astute administrator will realize from this that the combination of

13.3. PAM Configuration in smb.conf

12.3. PAM Configuration in smb.conf

There is an option in smb.conf called Passdb MySQL plugin

Chapter 17. Passdb MySQL plugin

Chapter 16. Passdb MySQL plugin

17.1. Building

16.1. Building

To build the plugin, run

17.2. Configuring

16.2. Configuring

This plugin lacks some good documentation, but here is some short info:

WARNING: since the password for the mysql user is stored in the +smb.conf file, you should make the the smb.conf file +readable only to the user that runs samba. This is considered a security +bug and will be fixed soon.

Names of the columns in this table(I've added column types those columns should have first):

17.3. Using plaintext passwords or encrypted password

16.3. Using plaintext passwords or encrypted password

I strongly discourage the use of plaintext passwords, however, you can use them:

17.4. Getting non-column data from the table

16.4. Getting non-column data from the table

It is possible to have not all data in the database and making some 'constant'.

Passdb XML plugin

Chapter 18. Passdb XML plugin

Chapter 17. Passdb XML plugin

18.1. Building

17.1. Building

This module requires libxml2 to be installed.

18.2. Usage

17.2. Usage

The usage of pdb_xml is pretty straightforward. To export data, use: diff --git a/docs/htmldocs/portability.html b/docs/htmldocs/portability.html index 25c24a3a2c..424fbe5c6c 100644 --- a/docs/htmldocs/portability.html +++ b/docs/htmldocs/portability.html @@ -5,7 +5,8 @@ >Portability

Chapter 24. Portability

Chapter 23. Portability

Samba works on a wide range of platforms but the interface all the platforms provide is not always compatible. This chapter contains @@ -84,9 +83,7 @@ CLASS="SECT1" >

24.1. HPUX

23.1. HPUX

HP's implementation of supplementary groups is, er, non-standard (for hysterical reasons). There are two group files, /etc/group and @@ -114,9 +111,7 @@ CLASS="SECT1" >

24.2. SCO Unix

23.2. SCO Unix

If you run an old version of SCO Unix then you may need to get important @@ -131,9 +126,7 @@ CLASS="SECT1" >

24.3. DNIX

23.3. DNIX

DNIX has a problem with seteuid() and setegid(). These routines are needed for Samba to work correctly, but they were left out of the DNIX @@ -238,9 +231,7 @@ CLASS="SECT1" >

24.4. RedHat Linux Rembrandt-II

23.4. RedHat Linux Rembrandt-II

By default RedHat Rembrandt-II during installation adds an entry to /etc/hosts as follows: diff --git a/docs/htmldocs/printing.html b/docs/htmldocs/printing.html index b2b893afec..46ebbcdf84 100644 --- a/docs/htmldocs/printing.html +++ b/docs/htmldocs/printing.html @@ -5,7 +5,8 @@ >Printing Support

Chapter 15. Printing Support

Chapter 14. Printing Support

15.1. Introduction

14.1. Introduction

Beginning with the 2.2.0 release, Samba supports the native Windows NT printing mechanisms implemented via @@ -163,9 +160,7 @@ CLASS="SECT1" >

15.2. Configuration

14.2. Configuration

Warning

15.2.1. Creating [print$]

14.2.1. Creating [print$]

In order to support the uploading of printer driver files, you must first configure a file share named [print$]. @@ -310,7 +303,7 @@ WIDTH="25" ALIGN="CENTER" VALIGN="TOP" >NoteWarning

15.2.2. Setting Drivers for Existing Printers

14.2.2. Setting Drivers for Existing Printers

The initial listing of printers in the Samba host's Printers folder will have no real printer driver assigned @@ -524,9 +515,7 @@ CLASS="SECT2" >

15.2.3. Support a large number of printers

14.2.3. Support a large number of printers

One issue that has arisen during the development phase of Samba 2.2 is the need to support driver downloads for @@ -590,9 +579,7 @@ CLASS="SECT2" >

15.2.4. Adding New Printers via the Windows NT APW

14.2.4. Adding New Printers via the Windows NT APW

By default, Samba offers all printer shares defined in

15.2.5. Samba and Printer Ports

14.2.5. Samba and Printer Ports

Windows NT/2000 print servers associate a port with each printer. These normally take the form of LPT1:, COM1:, FILE:, etc... Samba must also support the @@ -796,9 +781,7 @@ CLASS="SECT1" >

15.3. The Imprints Toolset

14.3. The Imprints Toolset

The Imprints tool set provides a UNIX equivalent of the Windows NT Add Printer Wizard. For complete information, please @@ -814,9 +797,7 @@ CLASS="SECT2" >

15.3.1. What is Imprints?

14.3.1. What is Imprints?

Imprints is a collection of tools for supporting the goals of

15.3.2. Creating Printer Driver Packages

14.3.2. Creating Printer Driver Packages

The process of creating printer driver packages is beyond the scope of this document (refer to Imprints.txt also included @@ -862,9 +841,7 @@ CLASS="SECT2" >

15.3.3. The Imprints server

14.3.3. The Imprints server

The Imprints server is really a database server that may be queried via standard HTTP mechanisms. Each printer @@ -886,9 +863,7 @@ CLASS="SECT2" >

15.3.4. The Installation Client

14.3.4. The Installation Client

More information regarding the Imprints installation client is available in the

15.4. Diagnosis

14.4. Diagnosis

15.4.1. Introduction

14.4.1. Introduction

This is a short description of how to debug printing problems with Samba. This describes how to debug problems with printing from a SMB @@ -1063,9 +1034,7 @@ CLASS="SECT2" >

15.4.2. Debugging printer problems

14.4.2. Debugging printer problems

One way to debug printing problems is to start by replacing these command with shell scripts that record the arguments and the contents @@ -1120,9 +1089,7 @@ CLASS="SECT2" >

15.4.3. What printers do I have?

14.4.3. What printers do I have?

You can use the 'testprns' program to check to see if the printer name you are using is recognized by Samba. For example, you can @@ -1149,9 +1116,7 @@ CLASS="SECT2" >

15.4.4. Setting up printcap and print servers

14.4.4. Setting up printcap and print servers

You may need to set up some printcaps for your Samba system to use. It is strongly recommended that you use the facilities provided by @@ -1233,9 +1198,7 @@ CLASS="SECT2" >

15.4.5. Job sent, no output

14.4.5. Job sent, no output

This is the most frustrating part of printing. You may have sent the job, verified that the job was forwarded, set up a wrapper around @@ -1278,9 +1241,7 @@ CLASS="SECT2" >

15.4.6. Job sent, strange output

14.4.6. Job sent, strange output

Once you have the job printing, you can then start worrying about making it print nicely.

15.4.7. Raw PostScript printed

14.4.7. Raw PostScript printed

This is a problem that is usually caused by either the print spooling system putting information at the start of the print job that makes @@ -1339,9 +1298,7 @@ CLASS="SECT2" >

15.4.8. Advanced Printing

14.4.8. Advanced Printing

Note that you can do some pretty magic things by using your imagination with the "print command" option and some shell scripts. @@ -1355,9 +1312,7 @@ CLASS="SECT2" >

15.4.9. Real debugging

14.4.9. Real debugging

If the above debug tips don't help, then maybe you need to bring in the bug guns, system tracing. See Tracing.txt in this directory.

LanMan and NT Password Encryption in Samba

Chapter 5. LanMan and NT Password Encryption in Samba

Chapter 4. LanMan and NT Password Encryption in Samba

5.1. Introduction

4.1. Introduction

Newer windows clients send encrypted passwords over the wire, instead of plain text passwords. The newest clients @@ -104,9 +101,7 @@ CLASS="SECT1" >

5.2. Important Notes About Security

4.2. Important Notes About Security

The unix and SMB password encryption techniques seem similar on the surface. This similarity is, however, only skin deep. The unix @@ -140,7 +135,7 @@ WIDTH="25" ALIGN="CENTER" VALIGN="TOP" >Warning

5.2.1. Advantages of SMB Encryption

4.2.1. Advantages of SMB Encryption

    5.2.2. Advantages of non-encrypted passwords

    4.2.2. Advantages of non-encrypted passwords

      5.3. The smbpasswd Command

      4.3. The smbpasswd Command

      The smbpasswd command maintains the two 32 byte password fields in the smbpasswd file. If you wish to make it similar to the unix diff --git a/docs/htmldocs/samba-bdc.html b/docs/htmldocs/samba-bdc.html index 85ec191a99..ef06a89416 100644 --- a/docs/htmldocs/samba-bdc.html +++ b/docs/htmldocs/samba-bdc.html @@ -5,7 +5,8 @@ >How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain

Chapter 8. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain

Chapter 7. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain

8.1. Prerequisite Reading

7.1. Prerequisite Reading

Before you continue reading in this chapter, please make sure that you are comfortable with configuring a Samba PDC @@ -97,9 +94,7 @@ CLASS="SECT1" >

8.2. Background

7.2. Background

What is a Domain Controller? It is a machine that is able to answer logon requests from workstations in a Windows NT Domain. Whenever a @@ -142,9 +137,7 @@ CLASS="SECT1" >

8.3. What qualifies a Domain Controller on the network?

7.3. What qualifies a Domain Controller on the network?

Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS group name SAMBA#1c with the WINS server and/or @@ -159,9 +152,7 @@ CLASS="SECT2" >

8.3.1. How does a Workstation find its domain controller?

7.3.1. How does a Workstation find its domain controller?

A NT workstation in the domain SAMBA that wants a local user to be authenticated has to find the domain controller for SAMBA. It does @@ -178,9 +169,7 @@ CLASS="SECT2" >

8.3.2. When is the PDC needed?

7.3.2. When is the PDC needed?

Whenever a user wants to change his password, this has to be done on the PDC. To find the PDC, the workstation does a NetBIOS name query @@ -194,9 +183,7 @@ CLASS="SECT1" >

8.4. Can Samba be a Backup Domain Controller?

7.4. Can Samba be a Backup Domain Controller?

With version 2.2, no. The native NT SAM replication protocols have not yet been fully implemented. The Samba Team is working on @@ -213,9 +200,7 @@ CLASS="SECT1" >

8.5. How do I set up a Samba BDC?

7.5. How do I set up a Samba BDC?

Several things have to be done:

8.5.1. How do I replicate the smbpasswd file?

7.5.1. How do I replicate the smbpasswd file?

Replication of the smbpasswd file is sensitive. It has to be done whenever changes to the SAM are made. Every user's password change is diff --git a/docs/htmldocs/samba-howto-collection.html b/docs/htmldocs/samba-howto-collection.html index 8e7eb942b0..0062e257dc 100644 --- a/docs/htmldocs/samba-howto-collection.html +++ b/docs/htmldocs/samba-howto-collection.html @@ -5,7 +5,8 @@ >SAMBA Project Documentation

SAMBA Project Documentation

SAMBA Project Documentation

SAMBA Team

SAMBA Team

Abstract

Abstract

Last Update : $Date: 2003/01/15 22:29:23 $

: Wed Jan 15

This book is a collection of HOWTOs added to Samba documentation over the years. I try to ensure that all are current, but sometimes the is a larger job @@ -223,77 +216,63 @@ HREF="improved-browsing.html#AEN366" >

3. Oplocks
3.1. What are oplocks?
4. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide
4.1. 3.1. Discussion
4.2. 3.2. Use of the "Remote Announce" parameter
4.3. 3.3. Use of the "Remote Browse Sync" parameter
4.4. 3.4. Use of WINS
4.5. 3.5. Do NOT use more than one (1) protocol on MS Windows machines
4.6. 3.6. Name Resolution Order
5. 4. LanMan and NT Password Encryption in Samba
5.1. 4.1. Introduction
5.2. 4.2. Important Notes About Security
5.3. 4.3. The smbpasswd Command
6. 5. User and Share security level (for servers not in a domain)
7. 6. How to Configure Samba as a NT4 Primary Domain Controller
7.1. 6.1. Prerequisite Reading
7.2. 6.2. Background
7.3. 6.3. Configuring the Samba Domain Controller
7.4. 6.4. Creating Machine Trust Accounts and Joining Clients to the Domain
7.5. 6.5. Common Problems and Errors
7.6. 6.6. System Policies and Profiles
7.7. 6.7. What other help can I get?
7.8. 6.8. Domain Control for Windows 9x/ME
7.9. 6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
8. 7. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain
8.1. 7.1. Prerequisite Reading
8.2. 7.2. Background
8.3. 7.3. What qualifies a Domain Controller on the network?
8.4. 7.4. Can Samba be a Backup Domain Controller?
8.5. 7.5. How do I set up a Samba BDC?
9. 8. Samba as a ADS domain member
9.1. 8.1. Installing the required packages for Debian
9.2. 8.2. Installing the required packages for RedHat
9.3. 8.3. Compile Samba
9.4. 8.4. Setup your /etc/krb5.conf
9.5. 8.5. Create the computer account
9.6. 8.6. Test your server setup
9.7. 8.7. Testing with smbclient
9.8. 8.8. Notes
10. 9. Samba as a NT4 domain member
10.1. 9.1. Joining an NT Domain with Samba 2.2
10.2. 9.2. Samba and Windows 2000 Domains
10.3. 9.3. Why is this better than security = server?
11. 10. Integrating MS Windows networks with Samba
11.1. 10.1. Agenda
11.2. 10.2. Name Resolution in a pure Unix/Linux world
11.3. 10.3. Name resolution as used within MS Windows networking
11.4. 10.4. How browsing functions and how to deploy stable and dependable browsing using Samba
11.5. 10.5. MS Windows security options and how to configure Samba for seemless integration
11.6. 10.6. Conclusions
12. 11. UNIX Permission Bits and Windows NT Access Control Lists
12.1. 11.1. Viewing and changing UNIX permissions using the NT security dialogs
12.2. 11.2. How to view file security on a Samba share
12.3. 11.3. Viewing file ownership
12.4. 11.4. Viewing file or directory permissions
12.5. 11.5. Modifying file or directory permissions
12.6. 11.6. Interaction with the standard Samba create mask parameters
12.7. 11.7. Interaction with the standard Samba file attribute mapping
13. 12. Configuring PAM for distributed but centrally managed authentication
13.1. 12.1. Samba and PAM
13.2. 12.2. Distributed Authentication
13.3. 12.3. PAM Configuration in smb.conf
14. 13. Hosting a Microsoft Distributed File System tree on Samba
14.1. 13.1. Instructions
15. 14. Printing Support
15.1. 14.1. Introduction
15.2. 14.2. Configuration
15.3. 14.3. The Imprints Toolset
15.4. 14.4. Diagnosis
16. 15. Unified Logons between Windows NT and UNIX using Winbind
16.1. 15.1. Abstract
16.2. 15.2. Introduction
16.3. 15.3. What Winbind Provides
16.4. 15.4. How Winbind Works
16.5. 15.5. Installation and Configuration
16.6. 15.6. Limitations
16.7. 15.7. Conclusion
17. 16. Passdb MySQL plugin
17.1. 16.1. Building
17.2. 16.2. Configuring
17.3. 16.3. Using plaintext passwords or encrypted password
17.4. 16.4. Getting non-column data from the table
18. 17. Passdb XML plugin
18.1. 17.1. Building
18.2. 17.2. Usage
19. 18. Stackable VFS modules
19.1. 18.1. Introduction and configuration
19.2. 18.2. Included modules
19.3. 18.3. VFS modules available elsewhere
20. 19. Storing Samba's User/Machine Account information in an LDAP Directory
20.1. 19.1. Purpose
20.2. 19.2. Introduction
20.3. 19.3. Supported LDAP Servers
20.4. 19.4. Schema and Relationship to the RFC 2307 posixAccount
20.5. 19.5. Configuring Samba with LDAP
20.6. 19.6. Accounts and Groups management
20.7. 19.7. Security and sambaAccount
20.8. 19.8. LDAP specials attributes for sambaAccounts
20.9. 19.9. Example LDIF Entries for a sambaAccount
20.10. 19.10. Comments
21. 20. HOWTO Access Samba source code via CVS
21.1. 20.1. Introduction
21.2. 20.2. CVS Access to samba.org
22. 21. Group mapping HOWTO
23. 22. Samba performance issues
23.1. 22.1. Comparisons
23.2. Oplocks
23.3. 22.2. Socket options
23.4. 22.3. Read size
23.5. 22.4. Max xmit
23.6. Locking
23.7. Share modes
23.8. 22.5. Log level
23.9. Wide lines
23.10. 22.6. Read raw
23.11. 22.7. Write raw
23.12. Read prediction
23.13. Memory mapping
23.14. 22.8. Slow Clients
23.15. 22.9. Slow Logins
23.16. 22.10. Client tuning
23.17. My Results
24. 23. Portability
24.1. 23.1. HPUX
24.2. 23.2. SCO Unix
24.3. 23.3. DNIX
24.4. 23.4. RedHat Linux Rembrandt-II
25. 24. Samba and other CIFS clients
25.1. 24.1. Macintosh clients?
25.2. 24.2. OS2 Client
25.3. 24.3. Windows for Workgroups
25.4. 24.4. Windows '95/'98
25.5. 24.5. Windows 2000 Service Pack 2
26. 25. Reporting Bugs
26.1. 25.1. Introduction
26.2. 25.2. General info
26.3. 25.3. Debug levels
26.4. 25.4. Internal errors
26.5. 25.5. Attaching to a running process
26.6. 25.6. Patches
27. 26. Diagnosing your samba server
27.1. 26.1. Introduction
27.2. 26.2. Assumptions
27.3. 26.3. Tests
27.4. 26.4. Still having troubles?
Storing Samba's User/Machine Account information in an LDAP Directory

Chapter 20. Storing Samba's User/Machine Account information in an LDAP Directory

Chapter 19. Storing Samba's User/Machine Account information in an LDAP Directory

20.1. Purpose

19.1. Purpose

This document describes how to use an LDAP directory for storing Samba user account information traditionally stored in the smbpasswd(5) file. It is @@ -125,7 +122,7 @@ early summer, 2002.

  • The Samba-PDC-LDAP-HOWTO @@ -148,9 +145,7 @@ CLASS="SECT1" >

    20.2. Introduction

    19.2. Introduction

    Traditionally, when configuring

    20.3. Supported LDAP Servers

    19.3. Supported LDAP Servers

    The LDAP samdb code in 2.2.3 has been developed and tested using the OpenLDAP 2.0 server and client libraries. The same code should be able to work with @@ -290,9 +283,7 @@ CLASS="SECT1" >

    20.4. Schema and Relationship to the RFC 2307 posixAccount

    19.4. Schema and Relationship to the RFC 2307 posixAccount

    Samba 2.2.3 includes the necessary schema file for OpenLDAP 2.0 in

    20.5. Configuring Samba with LDAP

    19.5. Configuring Samba with LDAP

    20.5.1. OpenLDAP configuration

    19.5.1. OpenLDAP configuration

    To include support for the sambaAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory.

    20.5.2. Configuring Samba

    19.5.2. Configuring Samba

    The following parameters are available in smb.conf only with

    20.6. Accounts and Groups management

    19.6. Accounts and Groups management

    As users accounts are managed thru the sambaAccount objectclass, you should modify you existing administration tools to deal with sambaAccount attributes.

    20.7. Security and sambaAccount

    19.7. Security and sambaAccount

    There are two important points to remember when discussing the security of sambaAccount entries in the directory.

    20.8. LDAP specials attributes for sambaAccounts

    19.8. LDAP specials attributes for sambaAccounts

    The sambaAccount objectclass is composed of the following attributes:

    20.9. Example LDIF Entries for a sambaAccount

    19.9. Example LDIF Entries for a sambaAccount

    The following is a working LDIF with the inclusion of the posixAccount objectclass:

    20.10. Comments

    19.10. Comments

    Please mail all comments regarding this HOWTO to How to Configure Samba as a NT4 Primary Domain Controller

    Chapter 7. How to Configure Samba as a NT4 Primary Domain Controller

    Chapter 6. How to Configure Samba as a NT4 Primary Domain Controller

    7.1. Prerequisite Reading

    6.1. Prerequisite Reading

    Before you continue reading in this chapter, please make sure that you are comfortable with configuring basic files services @@ -108,9 +105,7 @@ CLASS="SECT1" >

    7.2. Background

    6.2. Background

    Note

    7.3. Configuring the Samba Domain Controller

    6.3. Configuring the Samba Domain Controller

    The first step in creating a working Samba PDC is to understand the parameters necessary in smb.conf. I will not @@ -472,9 +465,7 @@ CLASS="SECT1" >

    7.4. Creating Machine Trust Accounts and Joining Clients to the +NAME="AEN663">6.4. Creating Machine Trust Accounts and Joining Clients to the Domain

    A machine trust account is a Samba account that is used to @@ -546,9 +537,7 @@ CLASS="SECT2" >

    7.4.1. Manual Creation of Machine Trust Accounts

    6.4.1. Manual Creation of Machine Trust Accounts

    The first step in manually creating a machine trust account is to manually create the corresponding Unix account in @@ -700,7 +689,7 @@ WIDTH="25" ALIGN="CENTER" VALIGN="TOP" >Warning

    7.4.2. "On-the-Fly" Creation of Machine Trust Accounts

    6.4.2. "On-the-Fly" Creation of Machine Trust Accounts

    The second (and recommended) way of creating machine trust accounts is simply to allow the Samba server to create them as needed when the client @@ -773,9 +760,7 @@ CLASS="SECT2" >

    7.4.3. Joining the Client to the Domain

    6.4.3. Joining the Client to the Domain

    The procedure for joining a client to the domain varies with the version of Windows.

    7.5. Common Problems and Errors

    6.5. Common Problems and Errors

    7.6. System Policies and Profiles

    6.6. System Policies and Profiles

    Much of the information necessary to implement System Policies and Roving User Profiles in a Samba domain is the same as that for @@ -1228,9 +1209,7 @@ CLASS="SECT1" >

    7.7. What other help can I get?

    6.7. What other help can I get?

    There are many sources of information available in the form of mailing lists, RFC's and documentation. The docs that come @@ -1648,9 +1627,7 @@ CLASS="SECT1" >

    7.8. Domain Control for Windows 9x/ME

    6.8. Domain Control for Windows 9x/ME

    Note

    7.8.1. Configuration Instructions: Network Logons

    6.8.1. Configuration Instructions: Network Logons

    The main difference between a PDC and a Windows 9x logon server configuration is that

    Warning

    7.8.2. Configuration Instructions: Setting up Roaming User Profiles

    6.8.2. Configuration Instructions: Setting up Roaming User Profiles

    Warning

    7.8.2.1. Windows NT Configuration

    6.8.2.1. Windows NT Configuration

    To support WinNT clients, in the [global] section of smb.conf set the following (for example):

    Note

    7.8.2.2. Windows 9X Configuration

    6.8.2.2. Windows 9X Configuration

    To support Win9X clients, you must use the "logon home" parameter. Samba has now been fixed so that "net use/home" now works as well, and it, too, relies @@ -2023,9 +1992,7 @@ CLASS="SECT3" >

    7.8.2.3. Win9X and WinNT Configuration

    6.8.2.3. Win9X and WinNT Configuration

    You can support profiles for both Win9X and WinNT clients by setting both the "logon home" and "logon path" parameters. For example:

    Note

    7.8.2.4. Windows 9X Profile Setup

    6.8.2.4. Windows 9X Profile Setup

    When a user first logs in on Windows 9X, the file user.DAT is created, as are folders "Start Menu", "Desktop", "Programs" and "Nethood". @@ -2228,9 +2193,7 @@ CLASS="SECT3" >

    7.8.2.5. Windows NT Workstation 4.0

    6.8.2.5. Windows NT Workstation 4.0

    When a user first logs in to a Windows NT Workstation, the profile NTuser.DAT is created. The profile location can be now specified @@ -2249,7 +2212,7 @@ WIDTH="25" ALIGN="CENTER" VALIGN="TOP" >NoteNote

    7.8.2.6. Windows NT Server

    6.8.2.6. Windows NT Server

    There is nothing to stop you specifying any path that you like for the location of users' profiles. Therefore, you could specify that the @@ -2356,9 +2317,7 @@ CLASS="SECT3" >

    7.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0

    6.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0

    WarningNote

    7.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba

    6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba

    WarningUser and Share security level (for servers not in a domain)

    Chapter 6. User and Share security level (for servers not in a domain)

    Chapter 5. User and Share security level (for servers not in a domain)

    A SMB server tells the client at startup what "security level" it is running. There are two options "share level" and "user level". Which diff --git a/docs/htmldocs/smb.conf.5.html b/docs/htmldocs/smb.conf.5.html index 84b0920d5b..9c1ee7a67b 100644 --- a/docs/htmldocs/smb.conf.5.html +++ b/docs/htmldocs/smb.conf.5.html @@ -16,9 +16,7 @@ VLINK="#840084" ALINK="#0000FF" >

    smb.conf

    smb.conf
  • ldap port

  • ldap server

  • COMPLETE LIST OF SERVICE PARAMETERS

    EXPLANATION OF EACH PARAMETER

    ldap port (G)

    This parameter is only available if Samba has been + configure to include the --with-ldapsam option + at compile time. +

    This option is used to control the tcp port number used to contact + the ldap server. + The default is to use the stand LDAPS port 636. +

    See Also: ldap ssl +

    Default : ldap port = 636 ; if ldap ssl = on

    Default : ldap port = 389 ; if ldap ssl = off

    ldap server (G)

    This parameter is only available if Samba has been + configure to include the --with-ldapsam option + at compile time. +

    This parameter should contain the FQDN of the ldap directory + server which should be queried to locate user account information. +

    Default : ldap server = localhost

    ldap ssl (G)
    list will be allowed. By default this option is disabled so that a client can supply a username to be used by the server. Enabling - this parameter will force the server to only user the login + this parameter will force the server to only use the login names from the list and is only really useful in shave levelshare level security.

    WARNINGS

    VERSION

    SEE ALSO

    AUTHOR

    -S parameter had been - given. + given.

    Samba performance issues

    Chapter 23. Samba performance issues

    Chapter 22. Samba performance issues

    23.1. Comparisons

    22.1. Comparisons

    The Samba server uses TCP to talk to the client. Thus if you are trying to see if it performs well you should really compare it to @@ -111,98 +108,7 @@ CLASS="SECT1" >

    23.2. Oplocks

    23.2.1. Overview

    Oplocks are the way that SMB clients get permission from a server to -locally cache file operations. If a server grants an oplock -(opportunistic lock) then the client is free to assume that it is the -only one accessing the file and it will agressively cache file -data. With some oplock types the client may even cache file open/close -operations. This can give enormous performance benefits.

    With the release of Samba 1.9.18 we now correctly support opportunistic -locks. This is turned on by default, and can be turned off on a share- -by-share basis by setting the parameter :

    oplocks = False

    We recommend that you leave oplocks on however, as current benchmark -tests with NetBench seem to give approximately a 30% improvement in -speed with them on. This is on average however, and the actual -improvement seen can be orders of magnitude greater, depending on -what the client redirector is doing.

    Previous to Samba 1.9.18 there was a 'fake oplocks' option. This -option has been left in the code for backwards compatibility reasons -but it's use is now deprecated. A short summary of what the old -code did follows.

    23.2.2. Level2 Oplocks

    With Samba 2.0.5 a new capability - level2 (read only) oplocks is -supported (although the option is off by default - see the smb.conf -man page for details). Turning on level2 oplocks (on a share-by-share basis) -by setting the parameter :

    level2 oplocks = true

    should speed concurrent access to files that are not commonly written -to, such as application serving shares (ie. shares that contain common -.EXE files - such as a Microsoft Office share) as it allows clients to -read-ahread cache copies of these files.

    23.2.3. Old 'fake oplocks' option - deprecated

    Samba can also fake oplocks, by granting a oplock whenever a client -asks for one. This is controlled using the smb.conf option "fake -oplocks". If you set "fake oplocks = yes" then you are telling the -client that it may agressively cache the file data for all opens.

    Enabling 'fake oplocks' on all read-only shares or shares that you know -will only be accessed from one client at a time you will see a big -performance improvement on many operations. If you enable this option -on shares where multiple clients may be accessing the files read-write -at the same time you can get data corruption.

    23.3. Socket options

    22.2. Socket options

    There are a number of socket options that can greatly affect the performance of a TCP based server like Samba.

    23.4. Read size

    22.3. Read size

    The option "read size" affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in @@ -254,9 +158,7 @@ CLASS="SECT1" >

    23.5. Max xmit

    22.4. Max xmit

    At startup the client and server negotiate a "maximum transmit" size, which limits the size of nearly all SMB commands. You can set the @@ -277,56 +179,7 @@ CLASS="SECT1" >

    23.6. Locking

    By default Samba does not implement strict locking on each read/write -call (although it did in previous versions). If you enable strict -locking (using "strict locking = yes") then you may find that you -suffer a severe performance hit on some systems.

    The performance hit will probably be greater on NFS mounted -filesystems, but could be quite high even on local disks.

    23.7. Share modes

    Some people find that opening files is very slow. This is often -because of the "share modes" code needed to fully implement the dos -share modes stuff. You can disable this code using "share modes = -no". This will gain you a lot in opening and closing files but will -mean that (in some cases) the system won't force a second user of a -file to open the file read-only if the first has it open -read-write. For many applications that do their own locking this -doesn't matter, but for some it may. Most Windows applications -depend heavily on "share modes" working correctly and it is -recommended that the Samba share mode support be left at the -default of "on".

    The share mode code in Samba has been re-written in the 1.9.17 -release following tests with the Ziff-Davis NetBench PC Benchmarking -tool. It is now believed that Samba 1.9.17 implements share modes -similarly to Windows NT.

    NOTE: In the most recent versions of Samba there is an option to use -shared memory via mmap() to implement the share modes. This makes -things much faster. See the Makefile for how to enable this.

    23.8. Log level

    22.5. Log level

    If you set the log level (also known as "debug level") higher than 2 then you may suffer a large drop in performance. This is because the @@ -338,23 +191,7 @@ CLASS="SECT1" >

    23.9. Wide lines

    The "wide links" option is now enabled by default, but if you disable -it (for better security) then you may suffer a performance hit in -resolving filenames. The performance loss is lessened if you have -"getwd cache = yes", which is now the default.

    23.10. Read raw

    22.6. Read raw

    The "read raw" operation is designed to be an optimised, low-latency file read operation. A server may choose to not support it, @@ -374,9 +211,7 @@ CLASS="SECT1" >

    23.11. Write raw

    22.7. Write raw

    The "write raw" operation is designed to be an optimised, low-latency file write operation. A server may choose to not support it, @@ -391,56 +226,7 @@ CLASS="SECT1" >

    23.12. Read prediction

    Samba can do read prediction on some of the SMB commands. Read -prediction means that Samba reads some extra data on the last file it -read while waiting for the next SMB command to arrive. It can then -respond more quickly when the next read request arrives.

    This is disabled by default. You can enable it by using "read -prediction = yes".

    Note that read prediction is only used on files that were opened read -only.

    Read prediction should particularly help for those silly clients (such -as "Write" under NT) which do lots of very small reads on a file.

    Samba will not read ahead more data than the amount specified in the -"read size" option. It always reads ahead on 1k block boundaries.

    23.13. Memory mapping

    Samba supports reading files via memory mapping them. One some -machines this can give a large boost to performance, on others it -makes not difference at all, and on some it may reduce performance.

    To enable you you have to recompile Samba with the -DUSE_MMAP option -on the FLAGS line of the Makefile.

    Note that memory mapping is only used on files opened read only, and -is not used by the "read raw" operation. Thus you may find memory -mapping is more effective if you disable "read raw" using "read raw = -no".

    23.14. Slow Clients

    22.8. Slow Clients

    One person has reported that setting the protocol to COREPLUS rather than LANMAN2 gave a dramatic speed improvement (from 10k/s to 150k/s).

    23.15. Slow Logins

    22.9. Slow Logins

    Slow logins are almost always due to the password checking time. Using the lowest practical "password level" will improve things a lot. You @@ -468,9 +252,7 @@ CLASS="SECT1" >

    23.16. Client tuning

    22.10. Client tuning

    Often a speed problem can be traced to the client. The client (for example Windows for Workgroups) can often be tuned for better TCP @@ -545,11 +327,13 @@ turned out I was better off without any!!!!!

    FIXME -The figures are: Put Get +>

    The figures are:          Put              Get 
     P166 client 3Com card:    420-440kB/s      500-520kB/s
     P100 client 3Com card:    390-410kB/s      490-510kB/s
    -DX4-75 client NE2000:     370-380kB/s      330-350kB/s

    I based these test on transfer two files a 4.5MB text file and a 15MB textfile. The results arn't bad considering the hardware Samba is @@ -567,35 +351,6 @@ upwards). I suppose there is more going on in the samba protocol, but if it could get up to the rate of FTP the perfomance would be quite staggering.

    23.17. My Results

    Some people want to see real numbers in a document like this, so here -they are. I have a 486sx33 client running WfWg 3.11 with the 3.11b -tcp/ip stack. It has a slow IDE drive and 20Mb of ram. It has a SMC -Elite-16 ISA bus ethernet card. The only WfWg tuning I've done is to -set DefaultRcvWindow in the [MSTCP] section of system.ini to 16384. My -server is a 486dx3-66 running Linux. It also has 20Mb of ram and a SMC -Elite-16 card. You can see my server config in the examples/tridge/ -subdirectory of the distribution.

    I get 490k/s on reading a 8Mb file with copy. -I get 441k/s writing the same file to the samba server.

    Of course, there's a lot more to benchmarks than 2 raw throughput -figures, but it gives you a ballpark figure.

    I've also tested Win95 and WinNT, and found WinNT gave me the best -speed as a samba client. The fastest client of all (for me) is -smbclient running on another linux box. Maybe I'll add those results -here someday ...

    Introduction

    Samba can operate in various SMB networks. This part contains information on configuring samba @@ -94,149 +91,149 @@ CLASS="TOC" >Table of Contents

    6. 5. User and Share security level (for servers not in a domain)
    7. 6. How to Configure Samba as a NT4 Primary Domain Controller
    7.1. 6.1. Prerequisite Reading
    7.2. 6.2. Background
    7.3. 6.3. Configuring the Samba Domain Controller
    7.4. 6.4. Creating Machine Trust Accounts and Joining Clients to the Domain
    7.4.1. 6.4.1. Manual Creation of Machine Trust Accounts
    7.4.2. 6.4.2. "On-the-Fly" Creation of Machine Trust Accounts
    7.4.3. 6.4.3. Joining the Client to the Domain
    7.5. 6.5. Common Problems and Errors
    7.6. 6.6. System Policies and Profiles
    7.7. 6.7. What other help can I get?
    7.8. 6.8. Domain Control for Windows 9x/ME
    7.8.1. 6.8.1. Configuration Instructions: Network Logons
    7.8.2. 6.8.2. Configuration Instructions: Setting up Roaming User Profiles
    7.9. 6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
    8. 7. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain
    8.1. 7.1. Prerequisite Reading
    8.2. 7.2. Background
    8.3. 7.3. What qualifies a Domain Controller on the network?
    8.3.1. 7.3.1. How does a Workstation find its domain controller?
    8.3.2. 7.3.2. When is the PDC needed?
    8.4. 7.4. Can Samba be a Backup Domain Controller?
    8.5. 7.5. How do I set up a Samba BDC?
    8.5.1. 7.5.1. How do I replicate the smbpasswd file?
    9. 8. Samba as a ADS domain member
    9.1. 8.1. Installing the required packages for Debian
    9.2. 8.2. Installing the required packages for RedHat
    9.3. 8.3. Compile Samba
    9.4. 8.4. Setup your /etc/krb5.conf
    9.5. 8.5. Create the computer account
    9.5.1. 8.5.1. Possible errors
    9.6. 8.6. Test your server setup
    9.7. 8.7. Testing with smbclient
    9.8. 8.8. Notes
    10. 9. Samba as a NT4 domain member
    10.1. 9.1. Joining an NT Domain with Samba 2.2
    10.2. 9.2. Samba and Windows 2000 Domains
    10.3. 9.3. Why is this better than security = server?
    UNIX Permission Bits and Windows NT Access Control Lists

    Chapter 12. UNIX Permission Bits and Windows NT Access Control Lists

    Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists

    12.1. Viewing and changing UNIX permissions using the NT +NAME="AEN1605">11.1. Viewing and changing UNIX permissions using the NT security dialogs

    New in the Samba 2.0.4 release is the ability for Windows @@ -120,9 +117,7 @@ CLASS="SECT1" >

    12.2. How to view file security on a Samba share

    11.2. How to view file security on a Samba share

    From an NT 4.0 client, single-click with the right mouse button on any file or directory in a Samba mounted @@ -190,9 +185,7 @@ CLASS="SECT1" >

    12.3. Viewing file ownership

    11.3. Viewing file ownership

    Clicking on the

    12.4. Viewing file or directory permissions

    11.4. Viewing file or directory permissions

    The third button is the

    12.4.1. File Permissions

    11.4.1. File Permissions

    The standard UNIX user/group/world triple and the corresponding "read", "write", "execute" permissions @@ -408,9 +397,7 @@ CLASS="SECT2" >

    12.4.2. Directory Permissions

    11.4.2. Directory Permissions

    Directories on an NT NTFS file system have two different sets of permissions. The first set of permissions @@ -440,9 +427,7 @@ CLASS="SECT1" >

    12.5. Modifying file or directory permissions

    11.5. Modifying file or directory permissions

    Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and @@ -538,9 +523,7 @@ CLASS="SECT1" >

    12.6. Interaction with the standard Samba create mask +NAME="AEN1703">11.6. Interaction with the standard Samba create mask parameters

    Note that with Samba 2.0.5 there are four new parameters @@ -815,9 +798,7 @@ CLASS="SECT1" >

    12.7. Interaction with the standard Samba file attribute +NAME="AEN1767">11.7. Interaction with the standard Samba file attribute mapping

    Samba maps some of the DOS attribute bits (such as "read diff --git a/docs/htmldocs/vfs.html b/docs/htmldocs/vfs.html index fb0554e10c..11934ae47c 100644 --- a/docs/htmldocs/vfs.html +++ b/docs/htmldocs/vfs.html @@ -5,7 +5,8 @@ >Stackable VFS modules

    Chapter 19. Stackable VFS modules

    Chapter 18. Stackable VFS modules

    19.1. Introduction and configuration

    18.1. Introduction and configuration

    Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. +>Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. Samba passes each request to access the unix file system thru the loaded VFS modules. This chapter covers all the modules that come with the samba source and references to some external modules.

    You may have problems to compile these modules, as shared libraries are compiled and linked in different ways on different systems. -I currently tested them against GNU/linux and IRIX.

    To use the VFS modules, create a share similar to the one below. The important parameter is the vfs object parameter which must point to -the exact pathname of the shared library object. For example, to use audit.so: +the exact pathname of the shared library objects. For example, to log all access +to files and use a recycle bin:

           [audit]
                     comment = Audited /data directory
                     path = /data
    -                vfs object = /path/to/audit.so
    +                vfs object = /path/to/audit.so /path/to/recycle.so
                     writeable = yes
                     browseable = yes

    The modules are used in the order they are specified.

    Further documentation on writing VFS modules for Samba can be found in -docs directory of the Samba source distribution.

    19.2. Included modules

    18.2. Included modules

    19.2.1. audit

    18.2.1. audit

    A simple module to audit file access to the syslog facility. The following operations are logged: @@ -164,9 +160,7 @@ CLASS="SECT2" >

    19.2.2. recycle

    18.2.2. recycle

    A recycle-bin like modules. When used any unlink call will be intercepted and files moved to the recycle @@ -235,9 +229,7 @@ CLASS="SECT2" >

    19.2.3. netatalk

    18.2.3. netatalk

    A netatalk module, that will ease co-existence of samba and netatalk file sharing services.

    19.3. VFS modules available elsewhere

    18.3. VFS modules available elsewhere

    This section contains a listing of various other VFS modules that have been posted but don't currently reside in the Samba CVS @@ -284,9 +274,7 @@ CLASS="SECT2" >

    19.3.1. DatabaseFS

    18.3.1. DatabaseFS

    URL:

    19.3.2. vscan

    18.3.2. vscan

    URL: Unified Logons between Windows NT and UNIX using Winbind

    Chapter 16. Unified Logons between Windows NT and UNIX using Winbind

    Chapter 15. Unified Logons between Windows NT and UNIX using Winbind

    16.1. Abstract

    15.1. Abstract

    Integration of UNIX and Microsoft Windows NT through a unified logon has been considered a "holy grail" in heterogeneous @@ -107,9 +104,7 @@ CLASS="SECT1" >

    16.2. Introduction

    15.2. Introduction

    It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and @@ -161,9 +156,7 @@ CLASS="SECT1" >

    16.3. What Winbind Provides

    15.3. What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by allowing a UNIX box to become a full member of a NT domain. Once @@ -203,9 +196,7 @@ CLASS="SECT2" >

    16.3.1. Target Uses

    15.3.1. Target Uses

    Winbind is targeted at organizations that have an existing NT based domain infrastructure into which they wish @@ -227,9 +218,7 @@ CLASS="SECT1" >

    16.4. How Winbind Works

    15.4. How Winbind Works

    The winbind system is designed around a client/server architecture. A long running

    16.4.1. Microsoft Remote Procedure Calls

    15.4.1. Microsoft Remote Procedure Calls

    Over the last two years, efforts have been underway by various Samba Team members to decode various aspects of @@ -273,9 +260,7 @@ CLASS="SECT2" >

    16.4.2. Name Service Switch

    15.4.2. Name Service Switch

    The Name Service Switch, or NSS, is a feature that is present in many UNIX operating systems. It allows system @@ -353,9 +338,7 @@ CLASS="SECT2" >

    16.4.3. Pluggable Authentication Modules

    15.4.3. Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, is a system for abstracting authentication and authorization @@ -402,9 +385,7 @@ CLASS="SECT2" >

    16.4.4. User and Group ID Allocation

    15.4.4. User and Group ID Allocation

    When a user or group is created under Windows NT is it allocated a numerical relative identifier (RID). This is @@ -428,9 +409,7 @@ CLASS="SECT2" >

    16.4.5. Result Caching

    15.4.5. Result Caching

    An active system can generate a lot of user and group name lookups. To reduce the network cost of these lookups winbind @@ -451,9 +430,7 @@ CLASS="SECT1" >

    16.5. Installation and Configuration

    15.5. Installation and Configuration

    Many thanks to John Trostel

    16.5.1. Introduction

    15.5.1. Introduction

    This HOWTO describes the procedures used to get winbind up and running on my RedHat 7.1 system. Winbind is capable of providing access @@ -537,9 +512,7 @@ CLASS="SECT2" >

    16.5.2. Requirements

    15.5.2. Requirements

    If you have a samba configuration file that you are currently using...

    16.5.3. Testing Things Out

    15.5.3. Testing Things Out

    Before starting, it is probably best to kill off all the SAMBA related daemons running on your server. Kill off all

    16.5.3.1. Configure and compile SAMBA

    15.5.3.1. Configure and compile SAMBA

    The configuration and compilation of SAMBA is pretty straightforward. The first three steps may not be necessary depending upon @@ -718,9 +687,7 @@ CLASS="SECT3" >

    16.5.3.2. Configure 15.5.3.2. Configure nsswitch.conf and the @@ -823,9 +790,7 @@ CLASS="SECT3" >

    16.5.3.3. Configure smb.conf

    15.5.3.3. Configure smb.conf

    Several parameters are needed in the smb.conf file to control the behavior of

    16.5.3.4. Join the SAMBA server to the PDC domain

    15.5.3.4. Join the SAMBA server to the PDC domain

    Enter the following command to make the SAMBA server join the PDC domain, where

    16.5.3.5. Start up the winbindd daemon and test it!

    15.5.3.5. Start up the winbindd daemon and test it!

    Eventually, you will want to modify your smb startup script to automatically invoke the winbindd daemon when the other parts of @@ -1067,17 +1028,13 @@ CLASS="SECT3" >

    16.5.3.6. Fix the init.d startup scripts

    15.5.3.6. Fix the init.d startup scripts

    16.5.3.6.1. Linux

    15.5.3.6.1. Linux

    The

    16.5.3.6.2. Solaris

    15.5.3.6.2. Solaris

    On solaris, you need to modify the

    16.5.3.6.3. Restarting

    15.5.3.6.3. Restarting

    If you restart the

    16.5.3.7. Configure Winbind and PAM

    15.5.3.7. Configure Winbind and PAM

    If you have made it this far, you know that winbindd and samba are working together. If you want to use winbind to provide authentication for other @@ -1324,9 +1275,7 @@ CLASS="SECT4" >

    16.5.3.7.1. Linux/FreeBSD-specific PAM configuration

    15.5.3.7.1. Linux/FreeBSD-specific PAM configuration

    The

    16.5.3.7.2. Solaris-specific configuration

    15.5.3.7.2. Solaris-specific configuration

    The /etc/pam.conf needs to be changed. I changed this file so that my Domain users can logon both locally as well as telnet.The following are the changes @@ -1540,9 +1487,7 @@ CLASS="SECT1" >

    16.6. Limitations

    15.6. Limitations

    Winbind has a number of limitations in its current released version that we hope to overcome in future @@ -1581,9 +1526,7 @@ CLASS="SECT1" >

    16.7. Conclusion

    15.7. Conclusion

    The winbind system, through the use of the Name Service Switch, Pluggable Authentication Modules, and appropriate -- cgit